@agentcomms/resend 0.25.0 → 0.26.1

package/dist/{send-1murS6En.mjs → send-BjDliNlb.mjs}

@@ -1,4 +1,4 @@
-import { C as unknown, S as union, b as strictObject, c as boolean, g as object, h as number, i as _enum, l as discriminatedUnion, m as looseObject, n as datetime, p as literal$1, s as array, x as string, y as record } from "./iso-USuVU_sk.mjs";
+import { C as unknown, S as union, b as strictObject, c as boolean, g as object, h as number, i as _enum, l as discriminatedUnion, m as looseObject, n as datetime, p as literal$1, s as array, x as string, y as record } from "./iso-5-9R47LC.mjs";
 import { access, chmod, constants, link, lstat, mkdir, open, readFile, readdir, readlink, realpath, rename, rm, stat, unlink, utimes } from "node:fs/promises";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
 import { domainToASCII, fileURLToPath, pathToFileURL } from "node:url";
@@ -9,10 +9,11 @@ import { styleText } from "node:util";
 import { homedir, platform, userInfo } from "node:os";
 import { accessSync, constants as constants$1, lstatSync, readFileSync, readlinkSync, realpathSync, statSync } from "node:fs";
 import { execFile, spawn } from "node:child_process";
+import { gunzipSync } from "node:zlib";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$2 = "0.25.0";
+const VERSION$2 = "0.26.1";
 //#endregion
 //#region src/api/routes.ts
 /**
@@ -201,7 +202,7 @@ const RESEND_CALLER = Object.freeze({
 	packageName: PACKAGE_NAME
 });
 //#endregion
-//#region ../core/dist/update-check-CMD_Te5S.mjs
+//#region ../core/dist/update-check-CfybSI56.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
@@ -4447,9 +4448,6 @@ function isBehind(version, latest) {
 function isPlainVersion(value) {
 	return typeof value === "string" && /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(value);
 }
-function isPrerelease(version) {
-	return VERSION_PATTERN.exec(version)?.[4] !== void 0;
-}
 /**
 * Whether `version` is within a package's `engines` range: true or false, or null when the range is not one this reads.
 *
@@ -5583,8 +5581,8 @@ async function mergeIntoJsonConfig(path, client, name, entry) {
 }
 /** Starts the server exactly as a client would, and completes the handshake. */
 async function verifyEntry(entry, product) {
-	const { Client } = await import("./dist-C7DG2LdL-l0mj9_dH.mjs");
-	const { StdioClientTransport } = await import("./stdio-CyjIgrch-59zcjSEt.mjs");
+	const { Client } = await import("./dist-C7DG2LdL-6QTVBgXp.mjs");
+	const { StdioClientTransport } = await import("./stdio-CRbkOCqe-BpzkpnG6.mjs");
 	const client = new Client({
 		name: `${product.binary}-install-check`,
 		version: product.version
@@ -12998,7 +12996,7 @@ function folding(platform) {
 	return platform === "win32" ? (text) => text.toLowerCase() : (text) => text;
 }
 /** The package version, read from package.json at build time. */
-const VERSION = "0.25.0";
+const VERSION = "0.26.1";
 /**
 * The command a person is told to run for one of this suite's own CLIs (design 2026-10-04, D1 and D5; CUE-403).
 *
@@ -14371,7 +14369,7 @@ const PER_WORKSPACE = {
 	"agentLabel.slackStyles": "app",
 	"agentLabel.slackIcons": "your Slack photo"
 };
-function recordOf$1(value) {
+function recordOf$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 /**
@@ -14381,7 +14379,7 @@ function recordOf$1(value) {
 */
 function perWorkspace(field, before, after) {
 	const none = PER_WORKSPACE[field];
-	const [was, now] = [recordOf$1(before ?? {}), recordOf$1(after ?? {})];
+	const [was, now] = [recordOf$2(before ?? {}), recordOf$2(after ?? {})];
 	if (none === void 0 || was === void 0 || now === void 0) return void 0;
 	const value = (record, name) => Object.hasOwn(record, name) ? String(record[name]) : none;
 	const moved = [.../* @__PURE__ */ new Set([...Object.keys(was), ...Object.keys(now)])].filter((name) => value(was, name) !== value(now, name)).sort();
@@ -14394,7 +14392,7 @@ function perWorkspace(field, before, after) {
 * commas. A level one side does not list allows everything there. Undefined for a value of another shape.
 */
 function perLevel(field, before, after) {
-	const [was, now] = [recordOf$1(before ?? {}), recordOf$1(after ?? {})];
+	const [was, now] = [recordOf$2(before ?? {}), recordOf$2(after ?? {})];
 	if (field !== "behaviour.rules" || was === void 0 || now === void 0) return void 0;
 	const value = (record, level) => Object.hasOwn(record, level) ? String(record[level]) : "everything";
 	const levels = [.../* @__PURE__ */ new Set([...Object.keys(was), ...Object.keys(now)])].sort();
@@ -15012,7 +15010,7 @@ const OUTCOMES = [
 	"unknown"
 ];
 const isString = (value) => typeof value === "string";
-const isTime$2 = (value) => isString(value) && ISO.test(value) && !Number.isNaN(Date.parse(value));
+const isTime$3 = (value) => isString(value) && ISO.test(value) && !Number.isNaN(Date.parse(value));
 /** One line as an entry, or null when it is not one this release wrote. */
 function entryOf(line) {
 	let raw;
@@ -15023,7 +15021,7 @@ function entryOf(line) {
 	}
 	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
 	const entry = raw;
-	if (!isTime$2(entry.at)) return null;
+	if (!isTime$3(entry.at)) return null;
 	if (entry.kind === "use") {
 		if (![
 			"standingId",
@@ -15055,7 +15053,7 @@ function entryOf(line) {
 	if (entry.kind === "outcome") {
 		if (!isString(entry.childId) || !isString(entry.outcome) || !OUTCOMES.includes(entry.outcome)) return null;
 		if (!isString(entry.notice) || entry.link !== void 0 && !isString(entry.link)) return null;
-		if (entry.actAt !== void 0 && !isTime$2(entry.actAt)) return null;
+		if (entry.actAt !== void 0 && !isTime$3(entry.actAt)) return null;
 		return {
 			kind: "outcome",
 			at: entry.at,
@@ -15500,7 +15498,7 @@ function updateJobSupported(platform) {
 function updateJobMarkerPath(stateDir) {
 	return join(stateDir, "update-job.json");
 }
-const isTime$1 = (value) => typeof value === "string" && Number.isFinite(Date.parse(value));
+const isTime$2 = (value) => typeof value === "string" && Number.isFinite(Date.parse(value));
 /** The record, or null when there is none — or none this release can read, which is treated as none. */
 async function readUpdateJobMarker(stateDir) {
 	let parsed;
@@ -15515,11 +15513,11 @@ async function readUpdateJobMarker(stateDir) {
 		platform: record.platform,
 		installedAt: record.installedAt,
 		label: record.label,
-		...isTime$1(record.lastRun) ? { lastRun: record.lastRun } : {}
+		...isTime$2(record.lastRun) ? { lastRun: record.lastRun } : {}
 	};
 }
 function within$1(at, now, intervalMs) {
-	if (at === void 0 || !isTime$1(at)) return false;
+	if (at === void 0 || !isTime$2(at)) return false;
 	const since = now.getTime() - Date.parse(at);
 	return since >= -3e5 && since < intervalMs;
 }
@@ -15600,7 +15598,7 @@ const NOTICE_OUTCOMES = [
 function readBackgroundNotice(value) {
 	if (typeof value !== "object" || value === null) return null;
 	const { at, outcome, version, text } = value;
-	if (!isTime(at) || !NOTICE_OUTCOMES.includes(outcome) || typeof text !== "string") return null;
+	if (!isTime$1(at) || !NOTICE_OUTCOMES.includes(outcome) || typeof text !== "string") return null;
 	return {
 		at,
 		outcome,
@@ -15629,7 +15627,7 @@ const EMPTY_UPDATE_CHECK = Object.freeze({
 function updateCheckPath(stateDir) {
 	return join(stateDir, UPDATE_CHECK_FILE);
 }
-const isTime = (value) => typeof value === "string" && Number.isFinite(Date.parse(value));
+const isTime$1 = (value) => typeof value === "string" && Number.isFinite(Date.parse(value));
 const isWords = (value) => Array.isArray(value) && value.every((word) => typeof word === "string");
 function readRelease(value) {
 	if (typeof value !== "object" || value === null) return null;
@@ -15662,17 +15660,17 @@ async function readUpdateCheck(stateDir) {
 	}
 	const held = typeof parsed === "object" && parsed !== null ? parsed : {};
 	return {
-		lastChecked: isTime(held.lastChecked) ? held.lastChecked : null,
+		lastChecked: isTime$1(held.lastChecked) ? held.lastChecked : null,
 		latest: isPlainVersion(held.latest) ? held.latest : null,
 		behind: typeof held.behind === "boolean" ? held.behind : null,
 		current: readCurrent(held.current),
 		lastError: typeof held.lastError === "string" ? held.lastError.slice(0, 300) : null,
-		snoozedUntil: isTime(held.snoozedUntil) ? held.snoozedUntil : null,
-		checking: isTime(held.checking) ? held.checking : null,
-		commandNoticeAt: isTime(held.commandNoticeAt) ? held.commandNoticeAt : null,
-		noticeAt: isTime(held.noticeAt) ? held.noticeAt : null,
-		pausedAt: isTime(held.pausedAt) ? held.pausedAt : null,
-		pausedUntil: isTime(held.pausedUntil) ? held.pausedUntil : null,
+		snoozedUntil: isTime$1(held.snoozedUntil) ? held.snoozedUntil : null,
+		checking: isTime$1(held.checking) ? held.checking : null,
+		commandNoticeAt: isTime$1(held.commandNoticeAt) ? held.commandNoticeAt : null,
+		noticeAt: isTime$1(held.noticeAt) ? held.noticeAt : null,
+		pausedAt: isTime$1(held.pausedAt) ? held.pausedAt : null,
+		pausedUntil: isTime$1(held.pausedUntil) ? held.pausedUntil : null,
 		release: readRelease(held.release),
 		securityAsked: isPlainVersion(held.securityAsked) ? held.securityAsked : null,
 		securityShown: readSecurityShown(held.securityShown),
@@ -15681,11 +15679,41 @@ async function readUpdateCheck(stateDir) {
 	};
 }
 /**
+* How every writer of the record takes the lock beside it: 2 s for each holder, and 15 s in all (design 2026-10-22, R2).
+*
+* Every server's tool call takes this lock for its refresh, so on a busy machine a writer often waits behind several
+* holders in turn, each holding it for a moment. Counted from the start of the wait, 2 s was a budget for that whole
+* queue, and a writer at the back of it gave up while the lock was being handed on exactly as it should be: a
+* person's update was installed and its record dropped. Counted per holder, a writer gives up only on one holder that
+* kept the lock for 2 s, which is a stuck lock; 15 s bounds a queue that never empties, as config writes are bounded.
+*/
+const UPDATE_CHECK_LOCK = Object.freeze({
+	timeoutPerHolder: true,
+	timeoutMs: 2e3,
+	maxWaitMs: 15e3
+});
+/**
+* How a notice takes the lock: 2 s in all, counted from the start of the wait, however often it changes hands meanwhile.
+*
+* A notice is best effort. Deciding a tool call's or a command's line, the security line in a preview, and recording
+* the person's answer to that line take the lock only for what is said, and each runs while a person or an agent
+* waits. Waited out holder by holder, as `UPDATE_CHECK_LOCK` waits, a busy machine's queue of refreshes held them for
+* up to 15 s. Busy past 2 s, a notice decides nothing this time, and a later call says it.
+*
+* Claiming the day's check is best effort too: busy past 2 s, nothing is claimed, and a later process claims it (0.26.0
+* review B). The claim's function is not named here: this comment ships in WhatsApp's bundle, which carries none of the
+* checker, not even its name (`packages/whatsapp/test/update-gate.test.ts`).
+*/
+const UPDATE_NOTICE_LOCK = Object.freeze({ timeoutMs: 2e3 });
+/**
 * Reads the record, changes it and writes it back, under a lock beside it, atomically — so a server recording a check
 * and a person's "not now" arriving at the same moment each keep what the other wrote. Returns what `change` returned
 * alongside the record written; `change` returning `null` writes nothing.
+*
+* `lock` is how long to wait for the lock: `UPDATE_CHECK_LOCK`, for a record that matters, unless a notice or the
+* day's claim passes `UPDATE_NOTICE_LOCK`. Busy past it, this throws LOCK_TIMEOUT, and nothing is written.
 */
-async function changeUpdateCheck(stateDir, change) {
+async function changeUpdateCheck(stateDir, change, lock = UPDATE_CHECK_LOCK) {
 	return withFileLock(join(stateDir, ".update-check.lock"), async () => {
 		const current = await readUpdateCheck(stateDir);
 		const next = change(current);
@@ -15700,7 +15728,7 @@ async function changeUpdateCheck(stateDir, change) {
 			result: next.result,
 			written: true
 		};
-	}, { timeoutMs: 2e3 });
+	}, lock);
 }
 /**
 * Whether the check is due: never asked, asked a day or more ago, or — a clock that went back — asked more than a few
@@ -15960,7 +15988,7 @@ async function securityAnswered(stateDir, approvalId) {
 				securityAsked: record.securityShown.version,
 				securityShown: null
 			} };
-		});
+		}, UPDATE_NOTICE_LOCK);
 	} catch {}
 }
 /** A local time as a person reads it in a preview: `2026-09-29 00:00`. */
@@ -16522,34 +16550,47 @@ function releaseIntegrity(packument, version) {
 	return typeof integrity === "string" && integrity.trim() !== "" ? integrity : null;
 }
 /**
-* What a release's core manifest declares under `agentcommsRelease` (U5): a security fix, and a decision it needs from
-* the person — as flags only. The decision's own words are never read out: they are the registry's, and an update says
-* that one is needed in its own words. A declaration this release cannot read waits for the person: it may be the
-* decision it cannot see.
+* What a release's core manifest declares under `agentcommsRelease` (U5, design 2026-10-22 §8.1): a security fix, a
+* decision it needs from the person, and the newest release up to it that needed one — as flags and a plain version
+* only. The manifest is the one in the release's verified tarball (`release-declarations.ts`, design 2026-10-22 P1),
+* never the registry's copy. The decision's own words are never read out: an update says that one is needed in its own
+* words. A declaration this release cannot read waits for the person, as it may be the decision it cannot see: a field
+* that is not an object, a `needsDecision` that is not false, or a `needsDecisionSince` that is not a plain version.
 */
 function releaseDeclaration(manifest) {
 	const declared = manifest?.agentcommsRelease;
 	if (declared === void 0 || declared === null) return {
 		security: false,
-		needsDecision: false
+		needsDecision: false,
+		needsDecisionSince: null
 	};
 	if (typeof declared !== "object" || Array.isArray(declared)) return {
 		security: false,
-		needsDecision: true
+		needsDecision: true,
+		needsDecisionSince: null
 	};
-	const { security, needsDecision } = declared;
+	const { security, needsDecision, needsDecisionSince } = declared;
+	const since = isPlainVersion(needsDecisionSince) ? needsDecisionSince : null;
 	return {
 		security: security === true,
-		needsDecision: !(needsDecision === void 0 || needsDecision === null || needsDecision === false)
+		needsDecision: needsDecisionSince !== void 0 && since === null || !(needsDecision === void 0 || needsDecision === null || needsDecision === false),
+		needsDecisionSince: since
 	};
 }
 /**
-* Every release the registry lists after `from`, up to and including `to`, oldest first: what an update takes this
-* machine past. Prereleases are left out — no update installs one — and so is anything that is not a version, or that
-* carries build metadata, which no published version does.
+* The release a machine running `from` must decide on before it runs `declared` (design 2026-10-22 §8.1), or null when
+* there is none: `declared` itself when it declares `needsDecision`; otherwise the release its `needsDecisionSince`
+* names, when that is after `from` — a decision this machine has not taken. One at or before `from` was taken when
+* that release was installed. Nothing else counts: no release the registry lists, hidden or added, decides anything.
+* A `from` that is not known, or not a version, cannot be shown to be past it, so it waits; a `since` after
+* `declared`, which no release check lets through, is said as `declared`.
 */
-function releasesBetween(packument, from, to) {
-	return Object.keys(packument.versions ?? {}).filter((version) => isVersion(version) && !isPrerelease(version) && !version.includes("+") && (compareVersions(version, from) ?? 0) > 0 && (compareVersions(version, to) ?? 1) <= 0).sort((a, b) => compareVersions(a, b) ?? 0);
+function decisionNeeded(declared, from) {
+	if (declared.needsDecision) return declared.version;
+	const since = declared.needsDecisionSince;
+	if (since === null) return null;
+	if (from !== null && (compareVersions(since, from) ?? 1) <= 0) return null;
+	return (compareVersions(since, declared.version) ?? 1) > 0 ? declared.version : since;
 }
 /** The oldest of `versions` that are versions, or null. */
 function oldestVersion(versions) {
@@ -16653,42 +16694,6 @@ async function verifyReleaseSet(sources, wanted, act = "update", noVerifierHint)
 	return verified;
 }
 /**
-* What every release after `from`, up to `latest`, declares (design 2026-10-16 U5, U7; security review of 0.20.0,
-* severity 6): a decision any of them needs — a later release that does not say so again does not end it — and whether
-* `latest` is a security fix. Each declaration acted on is verified first, with `verify`; one that does not verify, or
-* where nothing here can verify (`verify` null: a channel's process, which carries no Sigstore), counts for nothing.
-* `from` null reads `latest` alone. Throws when the registry's document cannot be read.
-*/
-async function declaredSince(registry, verify, packageName, from, latest) {
-	const { packument } = await registry(packageName);
-	const declared = (version) => releaseDeclaration(packument.versions?.[version]);
-	const range = from === null ? [] : releasesBetween(packument, from, latest);
-	const deciding = [.../* @__PURE__ */ new Set([...range, latest])].filter((version) => declared(version).needsDecision);
-	const verified = /* @__PURE__ */ new Map();
-	const check = async (version) => {
-		const known = verified.get(version);
-		if (known !== void 0) return known;
-		const integrity = releaseIntegrity(packument, version);
-		const ok = verify !== null && integrity !== null && await verify({
-			packageName,
-			version,
-			integrity
-		}).then((v) => v.ok);
-		verified.set(version, ok);
-		return ok;
-	};
-	const decisions = [];
-	for (const version of deciding) decisions.push({
-		version,
-		verified: await check(version)
-	});
-	return {
-		security: declared(latest).security && await check(latest),
-		needsDecision: decisions.some((decision) => decision.verified),
-		deciding: decisions
-	};
-}
-/**
 * Registering, pruning and listing every declared channel or service MCP server, from the core.
 *
 * `agentcomms mcp install` registers core or a declared service; `comms_server_install` registers any declared
@@ -17006,6 +17011,7 @@ function serverInstallChange(core, env, request, own, deps = {}) {
 			});
 			const unverifiedOwn = fetches && deps.verifyRelease === void 0 && running !== void 0 && running.packageName === product.packageName && running.version === version;
 			const verified = fetches && !unverifiedOwn || checksDisk ? (await verifyReleaseSet(from, /* @__PURE__ */ new Map([[product.packageName, version]]), "install", from.registry === null || from.verify === null ? verifyInCore() : void 0)).get(product.packageName) : void 0;
+			if (request.print !== true && launcher === "npx" && target.writes && deps.verifyRelease !== void 0) await verifyReleaseSet(from, /* @__PURE__ */ new Map([[facts.npxPackage, version]]), "install");
 			planned = {
 				product,
 				install: plannedInstall(preflight),
@@ -17185,7 +17191,7 @@ function serverPruneChange(core, env, request, own) {
 	};
 	const { packageName, version } = ownProduct(request.channel, own) ?? {
 		packageName: serverFacts(request.channel).packageName,
-		version: "0.25.0"
+		version: "0.26.1"
 	};
 	const product = {
 		packageName,
@@ -17339,6 +17345,599 @@ Object.freeze([
 	"off"
 ]);
 Object.keys(STANDING_LIMITS);
+const UNPACKED_MAX_BYTES = 134217728;
+const NPM_REGISTRY = "https://registry.npmjs.org/";
+const REDIRECTS = /* @__PURE__ */ new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+const BLOCK = 512;
+/** Where npm's own registry serves a release's tarball: `https://registry.npmjs.org/<name>/-/<file>-<version>.tgz`. */
+function canonicalTarballUrl(packageName, version) {
+	return `${NPM_REGISTRY}${packageName}/-/${packageName.split("/").at(-1) ?? packageName}-${version}.tgz`;
+}
+/** `value` as an absolute `http:` or `https:` address (against `base` when given), without a user or password. */
+function httpAddress(value, base) {
+	if (typeof value !== "string" || value.trim() === "") return null;
+	let url;
+	try {
+		url = base === void 0 ? new URL(value) : new URL(value, base);
+	} catch {
+		return null;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+	url.username = "";
+	url.password = "";
+	return url.href;
+}
+/**
+* `dist.tarball` of `version` when it is an absolute http(s) URL; otherwise null. A user and password in it are left
+* out: no credential is sent with a tarball request, so a mirror that needs one falls back to npm's address.
+*/
+function tarballLocation(packument, version) {
+	return httpAddress(packument.versions?.[version]?.dist?.tarball);
+}
+/**
+* The fetch a tarball is asked with, unless a caller hands in another: Node's own, asking for the bytes as they are
+* stored (`accept-encoding: identity` — otherwise it asks for a compressed transfer and decodes it), with no
+* credential and no cookie.
+*/
+const fetchTarball = (url, init) => fetch(url, {
+	...init,
+	headers: { "accept-encoding": "identity" },
+	credentials: "omit"
+});
+function discard(response) {
+	response.body?.cancel().catch(() => void 0);
+}
+/**
+* One location: its redirects followed by hand, at most five, each to http(s); its body counted as it arrives; ended
+* by its own time, or by `deadline` — the caller's — whichever is first.
+*/
+async function fetchOne(ask, url, timeoutMs, deadline) {
+	const own = AbortSignal.timeout(timeoutMs);
+	const signal = deadline === void 0 ? own : AbortSignal.any([own, deadline]);
+	let current = url;
+	try {
+		for (let redirects = 0;; redirects += 1) {
+			const response = await ask(current, {
+				redirect: "manual",
+				signal
+			});
+			if (REDIRECTS.has(response.status)) {
+				discard(response);
+				const next = httpAddress(response.headers.get("location"), current);
+				if (next === null || redirects >= 5) return {
+					ok: false,
+					problem: "download"
+				};
+				current = next;
+				continue;
+			}
+			if (!response.ok) {
+				discard(response);
+				return {
+					ok: false,
+					problem: "download"
+				};
+			}
+			const declared = Number(response.headers.get("content-length") ?? NaN);
+			if (Number.isFinite(declared) && declared > 33554432) {
+				discard(response);
+				return {
+					ok: false,
+					problem: "size"
+				};
+			}
+			if (response.body === null) return {
+				ok: true,
+				bytes: Buffer.alloc(0)
+			};
+			const reader = response.body.getReader();
+			const chunks = [];
+			let total = 0;
+			for (;;) {
+				const { done, value } = await reader.read();
+				if (done) break;
+				total += value.byteLength;
+				if (total > 33554432) {
+					reader.cancel().catch(() => void 0);
+					return {
+						ok: false,
+						problem: "size"
+					};
+				}
+				chunks.push(Buffer.from(value.buffer, value.byteOffset, value.byteLength));
+			}
+			return {
+				ok: true,
+				bytes: Buffer.concat(chunks, total)
+			};
+		}
+	} catch {
+		return {
+			ok: false,
+			problem: "download"
+		};
+	}
+}
+/** Of two failed downloads, the one that says more: bytes that came and were not the release's, then too many. */
+const RANK = {
+	download: 0,
+	size: 1,
+	digest: 2
+};
+/**
+* The release's tarball: from `location`, then — if that fails in any way — once from npm's canonical address, which
+* is never asked twice. Kept only when its sha512 is the verified one; otherwise the problem that says the most of the
+* two tries. A caller's `signal` ends it: what is being fetched is cut off, and nothing more is asked.
+*/
+async function downloadVerifiedTarball(release, location, options = {}) {
+	const ask = options.fetch ?? fetchTarball;
+	const timeoutMs = options.timeoutMs ?? 6e4;
+	const want = release.sha512.toLowerCase();
+	const canonical = canonicalTarballUrl(release.packageName, release.version);
+	const first = location === null ? null : httpAddress(location);
+	let problem = "download";
+	for (const place of first === null || first === canonical ? [canonical] : [first, canonical]) {
+		if (options.signal?.aborted) break;
+		const fetched = await fetchOne(ask, place, timeoutMs, options.signal);
+		let failed;
+		if (fetched.ok) {
+			if (createHash("sha512").update(fetched.bytes).digest("hex") === want) return fetched;
+			failed = "digest";
+		} else failed = fetched.problem;
+		if (RANK[failed] > RANK[problem]) problem = failed;
+	}
+	return {
+		ok: false,
+		problem
+	};
+}
+/** A header field's text: its bytes up to the first NUL. */
+function fieldText(header, at, width) {
+	const raw = header.subarray(at, at + width);
+	const end = raw.indexOf(0);
+	return raw.subarray(0, end === -1 ? width : end).toString("utf8");
+}
+/** A header's octal number, spaces around it allowed; null for base-256 (the high bit set) or anything not octal. */
+function octalField(header, at, width) {
+	if ((header[at] & 128) !== 0) return null;
+	const digits = fieldText(header, at, width).trim();
+	if (digits === "") return 0;
+	if (!/^[0-7]+$/.test(digits)) return null;
+	const value = Number.parseInt(digits, 8);
+	return Number.isSafeInteger(value) ? value : null;
+}
+/** The checksum ustar stores at 148: the header's byte sum, its own eight bytes read as spaces. */
+function checksumHolds(header) {
+	const stored = octalField(header, 148, 8);
+	if (stored === null) return false;
+	let sum = 0;
+	for (let at = 0; at < BLOCK; at += 1) sum += at >= 148 && at < 156 ? 32 : header[at];
+	return sum === stored;
+}
+/** A pax extended header's records, `<length> <key>=<value>\n` each; null when one is not that. */
+function paxRecords(data) {
+	const records = /* @__PURE__ */ new Map();
+	let at = 0;
+	while (at < data.length) {
+		if (data.subarray(at).every((byte) => byte === 0)) break;
+		const space = data.indexOf(32, at);
+		if (space === -1) return null;
+		const length = data.subarray(at, space).toString("latin1");
+		if (!/^[1-9]\d*$/.test(length)) return null;
+		const end = at + Number(length);
+		if (end > data.length || end <= space + 1 || data[end - 1] !== 10) return null;
+		const record = data.subarray(space + 1, end - 1).toString("utf8");
+		const equals = record.indexOf("=");
+		if (equals <= 0) return null;
+		records.set(record.slice(0, equals), record.slice(equals + 1));
+		at = end;
+	}
+	return records;
+}
+/**
+* An entry's path below `package/`, POSIX, with any leading `./` gone and empty or `.` segments dropped: `''` for the
+* folder itself. Null for anything outside `package/`, a `..` segment, or a backslash, which no npm pack writes and
+* which some file systems read as a separator.
+*/
+function belowPackage(name) {
+	let rest = name;
+	while (rest.startsWith("./")) rest = rest.slice(2);
+	if (rest.includes("\\")) return null;
+	const parts = rest.split("/");
+	if (parts[0] !== "package" || parts.includes("..")) return null;
+	return parts.slice(1).filter((part) => part !== "" && part !== ".").join("/");
+}
+function entryType(flag) {
+	if (flag === "0" || flag === "\0") return "file";
+	if (flag === "1" || flag === "2") return "link";
+	if (flag === "5") return "directory";
+	return "other";
+}
+/**
+* Every entry of a release's archive, in order: gunzipped with `node:zlib`, stopping past 128 MiB, then walked as
+* ustar — 512-byte headers, each checksum checked, to the first all-zero block. A pax `x` header's `path` and `size`,
+* and a GNU `L` long name, apply to the next entry. `package/` itself is not listed.
+*/
+function tarballEntries(gz) {
+	let tar;
+	try {
+		tar = gunzipSync(gz, { maxOutputLength: UNPACKED_MAX_BYTES });
+	} catch {
+		return {
+			ok: false,
+			problem: "gzip"
+		};
+	}
+	const broken = {
+		ok: false,
+		problem: "archive"
+	};
+	const entries = [];
+	let pax = {};
+	let longName;
+	for (let offset = 0; offset + BLOCK <= tar.length;) {
+		const header = tar.subarray(offset, offset + BLOCK);
+		if (header.every((byte) => byte === 0)) break;
+		if (!checksumHolds(header)) return broken;
+		const ownSize = octalField(header, 124, 12);
+		if (ownSize === null) return broken;
+		const flag = String.fromCharCode(header[156]);
+		const size = flag === "x" || flag === "L" || flag === "K" || flag === "g" ? ownSize : pax.size ?? ownSize;
+		const start = offset + BLOCK;
+		if (start + size > tar.length) return broken;
+		const data = tar.subarray(start, start + size);
+		offset = start + Math.ceil(size / BLOCK) * BLOCK;
+		if (flag === "g") return broken;
+		if (flag === "x") {
+			const records = paxRecords(data);
+			if (records === null) return broken;
+			const path = records.get("path");
+			const paxSize = records.get("size");
+			if (paxSize !== void 0 && !/^\d+$/.test(paxSize)) return broken;
+			pax = {
+				...pax,
+				...path !== void 0 ? { path } : {},
+				...paxSize !== void 0 ? { size: Number(paxSize) } : {}
+			};
+			if (pax.size !== void 0 && !Number.isSafeInteger(pax.size)) return broken;
+			continue;
+		}
+		if (flag === "L") {
+			const end = data.indexOf(0);
+			longName = data.subarray(0, end === -1 ? data.length : end).toString("utf8");
+			continue;
+		}
+		if (flag === "K") continue;
+		const prefix = fieldText(header, 257, 6) === "ustar" ? fieldText(header, 345, 155) : "";
+		const own = fieldText(header, 0, 100);
+		const name = pax.path ?? longName ?? (prefix === "" ? own : `${prefix}/${own}`);
+		pax = {};
+		longName = void 0;
+		const path = belowPackage(name);
+		const type = entryType(flag);
+		if (path === null) return broken;
+		if (path === "") {
+			if (type === "directory") continue;
+			return broken;
+		}
+		entries.push({
+			path,
+			type,
+			data
+		});
+	}
+	return {
+		ok: true,
+		entries
+	};
+}
+/**
+* The release's `package/package.json`, as an object: exactly one entry by that name (in any case), a regular file of
+* at most 1 MiB, holding a JSON object. Anything else is `manifest`; an archive that cannot be walked, `archive`.
+*/
+function tarballManifest(gz) {
+	const read = tarballEntries(gz);
+	if (!read.ok) return read;
+	const none = {
+		ok: false,
+		problem: "manifest"
+	};
+	const named = read.entries.filter((entry) => entry.path.toLowerCase() === "package.json");
+	const [entry] = named;
+	if (named.length !== 1 || entry === void 0) return none;
+	if (entry.path !== "package.json" || entry.type !== "file" || entry.data.length > 1048576) return none;
+	let manifest;
+	try {
+		manifest = JSON.parse(entry.data.toString("utf8").replace(/^/, ""));
+	} catch {
+		return none;
+	}
+	if (manifest === null || typeof manifest !== "object" || Array.isArray(manifest)) return none;
+	return {
+		ok: true,
+		manifest
+	};
+}
+const REMOVED_GLOBALS_FILE = "removed-globals.json";
+function isTime(value) {
+	if (typeof value !== "string") return false;
+	const at = new Date(value);
+	return !Number.isNaN(at.getTime()) && at.toISOString() === value;
+}
+/**
+* The globals recorded for the next update to reinstall, each once: none when there is no record or it cannot be
+* read. Only a name of this suite and a plain release are read from it.
+*/
+async function readRemovedGlobals(stateDir) {
+	let parsed;
+	try {
+		parsed = JSON.parse(await readFile(join(stateDir, REMOVED_GLOBALS_FILE), "utf8"));
+	} catch {
+		return [];
+	}
+	const listed = typeof parsed === "object" && parsed !== null ? parsed.removed : void 0;
+	if (!Array.isArray(listed)) return [];
+	const removed = [];
+	for (const item of listed) {
+		if (typeof item !== "object" || item === null) continue;
+		const { package: name, version, removedAt } = item;
+		if (typeof name !== "string" || !SUITE_NAME.test(name) || typeof version !== "string") continue;
+		if (!isPlainVersion(version) || !isTime(removedAt)) continue;
+		if (removed.some((one) => one.package === name)) continue;
+		removed.push({
+			package: name,
+			version,
+			removedAt
+		});
+	}
+	return removed;
+}
+/** A name of this suite, as npm writes one: only then is it said in a detail. */
+const SUITE_NAME = /^@agentcomms\/[a-z0-9][a-z0-9._-]{0,213}$/;
+/**
+* What a release declares — a security fix, a decision it needs from the person — read from its verified tarball, and
+* never from the registry (design 2026-10-22 P1). The registry's copy of a manifest is the registry's word: a mirror
+* could add or remove either flag on a genuine release. The tarball whose sha512 is the verified provenance digest is
+* the release's own.
+*
+* What was read is kept per integrity, content-free — the version, the integrity, the two flags and the release a
+* needed decision is carried from (design 2026-10-22 §8.1), never a word of the manifest — in
+* `<state>/release-declarations.json`, so neither the daily check nor the background run downloads a release it read.
+* A declaration that cannot be read is unknown: it is never cached, so the next check or run tries it again, and the
+* caller fails closed. The cache saves downloads, not verification: the caller verifies the release first, every time.
+*/
+const DECLARATIONS_FILE = "release-declarations.json";
+const LOCK_FILE = ".release-declarations.lock";
+const INTEGRITY = /^sha512-[A-Za-z0-9+/]{86}==$/;
+function declarationsPath(stateDir) {
+	return join(stateDir, DECLARATIONS_FILE);
+}
+/**
+* A record as the cache keeps it, or null for anything else: only these five keys, each of its type. One without
+* `needsDecisionSince`, as a build before it was carried wrote, is no record: it costs a download, never a decision.
+*/
+function recordOf(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const { version, integrity, security, needsDecision, needsDecisionSince } = value;
+	if (!isVersion(version) || typeof integrity !== "string" || !INTEGRITY.test(integrity)) return null;
+	if (typeof security !== "boolean" || typeof needsDecision !== "boolean") return null;
+	if (needsDecisionSince !== null && !isPlainVersion(needsDecisionSince)) return null;
+	return {
+		version,
+		integrity,
+		security,
+		needsDecision,
+		needsDecisionSince
+	};
+}
+/** The cache's records; a file that is missing or cannot be read counts as empty. */
+async function readCache(stateDir) {
+	try {
+		const listed = JSON.parse(await readFile(declarationsPath(stateDir), "utf8"))?.declarations;
+		if (!Array.isArray(listed)) return [];
+		return listed.map(recordOf).filter((record) => record !== null);
+	} catch {
+		return [];
+	}
+}
+/**
+* Adds one record, under the cache's lock, to the file as it is then — so two processes reading at once each keep
+* the other's — keeping the newest 64. Best effort: a write that fails changes no answer, and costs a download later.
+*/
+async function remember(stateDir, record) {
+	try {
+		await withFileLock(join(stateDir, LOCK_FILE), async () => {
+			const declarations = [...(await readCache(stateDir)).filter((one) => one.integrity !== record.integrity || one.version !== record.version), record].slice(-64);
+			await writeFileAtomic(declarationsPath(stateDir), `${JSON.stringify({ declarations }, null, 2)}\n`);
+		});
+	} catch {}
+}
+/**
+* What a verified release declares: from the cache, by its integrity and version, or else from its tarball — the bytes
+* whose sha512 is `provenance.sha512`, from `location` or npm's canonical address — whose `package/package.json` must
+* name the release itself. Unknown, with the problem, when it cannot be read, or when `signal` ends the read first. A
+* known declaration is cached unless `writeCache` is false (a dry run); an unknown one never is.
+*/
+async function readVerifiedDeclaration(provenance, location, options) {
+	const { version } = provenance;
+	const integrity = `sha512-${Buffer.from(provenance.sha512, "hex").toString("base64")}`;
+	const hit = (await readCache(options.stateDir)).find((record) => record.integrity === integrity && record.version === version);
+	if (hit !== void 0) {
+		const { security, needsDecision, needsDecisionSince } = hit;
+		return {
+			known: true,
+			version,
+			security,
+			needsDecision,
+			needsDecisionSince,
+			from: "cache"
+		};
+	}
+	const download = await downloadVerifiedTarball({
+		packageName: provenance.package,
+		version,
+		sha512: provenance.sha512
+	}, location, {
+		...options.fetch !== void 0 ? { fetch: options.fetch } : {},
+		...options.timeoutMs !== void 0 ? { timeoutMs: options.timeoutMs } : {},
+		...options.signal !== void 0 ? { signal: options.signal } : {}
+	});
+	if (!download.ok) return {
+		known: false,
+		version,
+		problem: download.problem
+	};
+	const read = tarballManifest(download.bytes);
+	if (!read.ok) return {
+		known: false,
+		version,
+		problem: read.problem
+	};
+	if (read.manifest.name !== provenance.package || read.manifest.version !== version) return {
+		known: false,
+		version,
+		problem: "identity"
+	};
+	const { security, needsDecision, needsDecisionSince } = releaseDeclaration(read.manifest);
+	if (options.writeCache !== false) await remember(options.stateDir, {
+		version,
+		integrity,
+		security,
+		needsDecision,
+		needsDecisionSince
+	});
+	return {
+		known: true,
+		version,
+		security,
+		needsDecision,
+		needsDecisionSince,
+		from: "tarball"
+	};
+}
+/**
+* What the release an update goes to declares, believed only from its verified tarball (design 2026-10-22 P1, P2,
+* §8.1): for the daily check's record, `update --check`, and the by-hand update's preview.
+*
+* Only that one release is read. A needed decision is carried forward from release to release in core's
+* `agentcommsRelease.needsDecisionSince`, which the release check holds to the changelog, so the release an update goes
+* to says itself whether a release on the way needed one: which versions the registry lists decides nothing. A registry
+* or mirror that leaves out the release needing a decision, adds an unverifiable one, or lists five hundred, changes no
+* fact and costs no request.
+*
+* The registry's document is read once, for that release's integrity and where its tarball is — never for what it
+* declares: a registry or a mirror can add or remove either flag on a genuine release. The release is verified, and
+* then its declaration read (`readVerifiedDeclaration`) from the bytes whose sha512 its verified provenance signs. One
+* that does not verify, that the registry gives no integrity for, whose tarball cannot be read, or whose read is cut off
+* by its deadline is *unknown*, and counts for nothing either way: neither a security fix nor its absence, neither a
+* decision nor none.
+*
+* Only core reads these, since only core carries the verifier: a channel's process reads none (`releaseFactsReader`).
+* No Sigstore here, and nothing runs when this module is loaded: WhatsApp's bundle, which reaches the module that
+* imports this one, drops it.
+*/
+/**
+* How long a check gives its target's declaration — its document, its verification and its tarball, from both places —
+* before it counts it unknown (review B of 0.26.0, finding 2). A check runs under a claim of `UPDATE_CHECK_LEASE_MS`,
+* two minutes, which also holds the registry's ten seconds for `latest`, `npm ls`'s minute and up to 15 seconds for
+* the record's lock: 30 seconds beside them still records inside the lease, where a tarball's two tries of a minute
+* each did not, and the check's finding was dropped as superseded.
+*/
+const DECLARATION_DEADLINE_MS = 3e4;
+/**
+* What `version` declares, read from its verified tarball, and nothing of any other release. Unknown when the
+* registry's document cannot be read or gives no integrity for it, when it does not verify, when its tarball cannot be
+* read, or when `signal` ends the read first. Never throws.
+*/
+async function targetDeclaration(sources, packageName, version, options = {}) {
+	const unknown = {
+		known: false,
+		version
+	};
+	try {
+		const { packument } = await sources.registry(packageName);
+		const integrity = releaseIntegrity(packument, version);
+		if (integrity === null || options.signal?.aborted) return unknown;
+		const verdict = await sources.verify({
+			packageName,
+			version,
+			integrity
+		});
+		if (!verdict.ok || options.signal?.aborted) return unknown;
+		const read = await readVerifiedDeclaration(verdict.provenance, tarballLocation(packument, version), {
+			stateDir: sources.stateDir,
+			...sources.tarballs !== void 0 ? { fetch: sources.tarballs } : {},
+			...options.signal !== void 0 ? { signal: options.signal } : {}
+		});
+		if (!read.known) return unknown;
+		const { security, needsDecision, needsDecisionSince } = read;
+		return {
+			known: true,
+			version,
+			security,
+			needsDecision,
+			needsDecisionSince
+		};
+	} catch {
+		return unknown;
+	}
+}
+/**
+* `read`, given `deadlineMs` at most: unknown once that has passed, and the read cut off then — never a guess of
+* `false`. The timer is cleared as soon as the read is done.
+*/
+async function withinDeadline(read, version, deadlineMs = DECLARATION_DEADLINE_MS) {
+	const controller = new AbortController();
+	let timer;
+	const passed = new Promise((resolve) => {
+		timer = setTimeout(() => {
+			controller.abort();
+			resolve({
+				known: false,
+				version
+			});
+		}, deadlineMs);
+	});
+	try {
+		return await Promise.race([read(controller.signal), passed]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/**
+* What the release declares for a machine whose oldest release is `from` (design 2026-10-22 §8.1): its own security
+* flag, and a decision when it declares one or carries one after `from` (`decisionNeeded`).
+*/
+function declaredFor(declared, from) {
+	if (!declared.known) return {
+		security: null,
+		needsDecision: null,
+		deciding: null,
+		unread: true
+	};
+	const deciding = decisionNeeded(declared, from);
+	return {
+		security: declared.security,
+		needsDecision: deciding !== null,
+		deciding,
+		unread: false
+	};
+}
+/** The record's facts for `version`: null unless its declaration was read. */
+function factsOf(version, declared) {
+	const { security, needsDecision } = declared;
+	return security === null || needsDecision === null ? null : {
+		version,
+		security,
+		needsDecision
+	};
+}
 /**
 * Bringing a machine to the latest release, from a terminal (`agentcomms update`) or a chat (`comms_update`).
 *
@@ -17507,6 +18106,7 @@ async function inspect(core, env, deps) {
 			package: server.args.some((arg) => arg.startsWith(`${facts.npxPackage}@`)) ? facts.npxPackage : facts.packageName
 		};
 	});
+	const removedGlobals = (await readRemovedGlobals(core.paths.stateDir)).filter((one) => PUBLISHED_NAMES.includes(one.package));
 	let installed = {};
 	try {
 		const listed = await (deps.globalPackages ?? (() => npmGlobalPackages(env, PUBLISHED_NAMES)))();
@@ -17524,6 +18124,7 @@ async function inspect(core, env, deps) {
 		wanted.add(entry.package);
 	}
 	for (const name of Object.keys(installed)) wanted.add(name);
+	for (const removed of removedGlobals) wanted.add(removed.package);
 	const latest = await latestReleases([...wanted].sort(), deps.latestVersion ?? ((name) => npmLatestVersion(name, { env })));
 	let config = null;
 	try {
@@ -17625,16 +18226,19 @@ async function inspect(core, env, deps) {
 	}
 	const globals = [];
 	for (const name of PUBLISHED_NAMES) {
-		const version = installed[name];
+		const removed = removedGlobals.find((one) => one.package === name);
+		const version = installed[name] ?? removed?.version;
 		const newestRelease = latest[name];
 		if (version === void 0 || newestRelease === void 0) continue;
+		const reinstall = removed !== void 0 && !isBehind(version, newestRelease);
 		const item = {
 			kind: "global",
 			package: name,
 			version,
-			latest: newestRelease
+			latest: newestRelease,
+			...reinstall ? { reinstall: true } : {}
 		};
-		if (isBehind(version, newestRelease)) {
+		if (reinstall || isBehind(version, newestRelease)) {
 			behind.push(item);
 			globals.push(item);
 		} else upToDate.push(item);
@@ -17669,54 +18273,87 @@ async function inspect(core, env, deps) {
 */
 async function updateCheck(core, env, deps = {}, claim) {
 	const { report } = await inspect(core, env, deps);
-	await recordFound(core, env, report, deps, null, claim, await releaseOf(report, env, deps));
+	await recordFound(core, env, report, deps, null, claim, await releaseOf(core, report, env, deps));
 	return report;
 }
 /**
-* What the latest release's core manifest declares, for the daily check's file — or null, where it is not to be read
-* or could not be: never a reason for the check to fail. Read only for a release newer than nothing — a counted one.
+* What the latest release's core manifest declares, for the daily check's file, as its verified tarball says (design
+* 2026-10-22 P1, §8.1): the facts when it was read; null when this check read it and it could not be read; and
+* undefined where this process reads none — a channel's, with no verifier, or a test's stand-in registry (P2). For
+* null and undefined alike the record keeps what core's verified check found of the same version, and otherwise makes
+* no claim. Never a reason for the check to fail.
 */
-async function releaseOf(report, env, deps) {
+async function releaseOf(core, report, env, deps) {
 	const latest = report.latest[CORE_PACKAGE$1];
-	if (latest === void 0 || !isPlainVersion(latest)) return null;
-	const read = deps.releaseFacts !== void 0 ? deps.releaseFacts : releaseFactsReader(env, deps);
-	if (read === null) return null;
+	if (latest === void 0 || !isPlainVersion(latest)) return void 0;
+	const read = deps.releaseFacts !== void 0 ? deps.releaseFacts : releaseFactsReader(env, deps, core.paths.stateDir);
+	if (read === null) return void 0;
 	try {
-		return {
+		const facts = await read(CORE_PACKAGE$1, latest, oldestHere(report));
+		return facts === null ? null : {
 			version: latest,
-			...await read(CORE_PACKAGE$1, latest, oldestHere(report))
+			security: facts.security,
+			needsDecision: facts.needsDecision
 		};
 	} catch {
 		return null;
 	}
 }
 /**
-* The oldest release this machine runs, as the report saw it — what every release after it is read for: the core
-* answering, and every registration, runtime and global package behind.
+* The oldest release this machine runs, as the report saw it — what a decision the latest carries is counted from: the
+* core answering, and every registration, runtime and global package behind.
 */
 function oldestHere(report) {
 	return oldestVersion([report.core, ...report.behind.map((item) => item.version)]);
 }
 /**
-* The daily check's and `update --check`'s reader of what releases declare (`declaredSince`): the registry handed in,
-* or the one npm reads — but only beside the registry's own `latest`: a test with a stand-in `latestVersion` hands in
-* `releaseFacts` itself, or none is read. With the verifier handed in, and none where none was: a channel's process
-* carries no Sigstore, so what it reads counts for nothing. Each package's document is read once, however often asked.
-*/
-function releaseFactsReader(env, deps) {
-	if (deps.latestVersion !== void 0) return null;
-	const read = deps.registry ?? npmRegistry(env);
-	const documents = /* @__PURE__ */ new Map();
-	const registry = (packageName) => {
-		const known = documents.get(packageName) ?? read(packageName);
-		documents.set(packageName, known);
-		return known;
+* The daily check's and `update --check`'s reader of what a release declares (design 2026-10-22 P1, §8.1): the release
+* verified, then its declaration read from its tarball and cached in `stateDir`; its facts for each machine's `from`,
+* or null when it could not be read (`factsOf`). Nothing of any other release is read: a needed decision is carried in
+* the release itself.
+*
+* Each release is read once however often it is asked — the check asks once for the core answering, and again for the
+* oldest release it finds here — and known or unknown, the answer stands for the reader's life: an unreadable tarball
+* is asked for at most twice in a check, at its location and at npm's own address (review B of 0.26.0, finding 2).
+* And the read is given `deadlineMs` at most (`DECLARATION_DEADLINE_MS` unless a test gives another), and stops at
+* `deadline` — a time, by `Date.now()` — when that comes first: the day's check passes its claim's time plus
+* `DECLARATION_DEADLINE_MS`, well inside the claim, however late its ask began. After it the read is unknown — never
+* false — and cut off, and one not started by then is not started at all, so the check records what it found while
+* its claim is still its own.
+*
+* The registry handed in, or the one npm reads — but only beside the registry's own `latest`: a test with a stand-in
+* `latestVersion` hands in `releaseFacts` itself, or none is read. And only with a verifier (P2): a channel's process
+* carries no Sigstore, so it reads nothing a release declares — no document, no tarball — and its check keeps what
+* core's verified check recorded.
+*/
+function releaseFactsReader(env, deps, stateDir, options = {}) {
+	const verify = deps.verifyRelease;
+	if (deps.latestVersion !== void 0 || verify === void 0) return null;
+	const sources = {
+		registry: deps.registry ?? npmRegistry(env),
+		verify,
+		stateDir,
+		tarballs: deps.tarballs
+	};
+	const declarations = /* @__PURE__ */ new Map();
+	const declarationOf = (packageName, version) => {
+		const key = `${packageName}@${version}`;
+		let read = declarations.get(key);
+		if (read === void 0) {
+			const left = Math.min(options.deadlineMs ?? 3e4, options.deadline === void 0 ? Number.POSITIVE_INFINITY : options.deadline - Date.now());
+			read = left > 0 ? withinDeadline((signal) => targetDeclaration(sources, packageName, version, { signal }), version, left) : Promise.resolve({
+				known: false,
+				version
+			});
+			declarations.set(key, read);
+		}
+		return read;
 	};
 	return async (packageName, version, from = null) => {
-		const { security, needsDecision } = await declaredSince(registry, deps.verifyRelease ?? null, packageName, from, version);
-		return {
-			security,
-			needsDecision
+		const facts = factsOf(version, declaredFor(await declarationOf(packageName, version), from));
+		return facts === null ? null : {
+			security: facts.security,
+			needsDecision: facts.needsDecision
 		};
 	};
 }
@@ -17752,25 +18389,34 @@ const registrationKey = (entry) => [
 * when this is that background check's own finding, is the claim it was made under: the finding is dropped when the
 * file no longer holds it, because something newer — a check a person asked for, an update — was written meanwhile.
 * The machine it describes was read before that, and put back it would say "update" where "restart" is right.
+*
+* Says how it went: `written`; `busy`, when the file's lock stayed held past its bound, so an update can try once
+* more (design 2026-10-22, R2); and `unchanged` for everything else — switched off, a claim given up, or a write that
+* failed for any other reason, each left as it always was.
 */
 async function recordFound(core, env, report, deps, after = null, claim, release) {
 	const latest = report.latest[CORE_PACKAGE$1];
-	if (updateCheckSwitchedOff(env) !== null || latest === void 0 || !isVersion(latest)) return;
+	if (updateCheckSwitchedOff(env) !== null || latest === void 0 || !isVersion(latest)) return "unchanged";
 	const at = (deps.now ?? (() => /* @__PURE__ */ new Date()))().toISOString();
 	const { behind, current } = updateCheckFindings(report, latest, after);
 	const moves = movesLeft(report, after);
-	const facts = (record) => release !== void 0 ? release : record.release?.version === latest ? record.release : null;
-	await changeUpdateCheck(core.paths.stateDir, (record) => claim !== void 0 && record.checking !== claim ? null : { record: {
-		...record,
-		lastChecked: at,
-		latest,
-		behind,
-		current,
-		lastError: null,
-		checking: null,
-		release: facts(record),
-		moves
-	} }).catch(() => void 0);
+	const facts = (record) => release ?? (record.release?.version === latest ? record.release : null);
+	try {
+		const { written } = await changeUpdateCheck(core.paths.stateDir, (record) => claim !== void 0 && record.checking !== claim ? null : { record: {
+			...record,
+			lastChecked: at,
+			latest,
+			behind,
+			current,
+			lastError: null,
+			checking: null,
+			release: facts(record),
+			moves
+		} });
+		return written ? "written" : "unchanged";
+	} catch (error) {
+		return toCommsError(error).code === "LOCK_TIMEOUT" ? "busy" : "unchanged";
+	}
 }
 /**
 * How many managed registrations still name a versioned runtime once `after` is done, for the notice (design
@@ -17820,7 +18466,7 @@ function updateCheckFindings(report, latest, after = null) {
 	const globals = items.filter((item) => item.kind === "global");
 	const global = CHANNELS.filter((channel) => {
 		const name = serverFacts(channel).packageName;
-		return globals.some((item) => item.package === name && atLatest(installed.has(name) ? item.latest : item.version));
+		return globals.some((item) => item.package === name && atLatest(installed.has(name) ? item.latest : item.reinstall ? null : item.version));
 	});
 	const stillBehind = after === null ? report.behind.length > 0 : !(after.ok && after.manual.length === 0 && after.status !== "manual");
 	const unknown = report.unreadable.length > 0 || report.unpinned.length > 0;
@@ -17931,7 +18577,7 @@ async function decideNotice(options, where) {
 		};
 	};
 	if (due(await readUpdateCheck(options.core.paths.stateDir), now()) === null) return null;
-	return (await changeUpdateCheck(options.core.paths.stateDir, (record) => {
+	const decide = (record) => {
 		const at = now();
 		const decision = due(record, at);
 		if (decision === null) return null;
@@ -17955,7 +18601,8 @@ async function decideNotice(options, where) {
 				}
 			}
 		};
-	})).result ?? null;
+	};
+	return (await changeUpdateCheck(options.core.paths.stateDir, decide, UPDATE_NOTICE_LOCK)).result ?? null;
 }
 /**
 * What a background run left, when it is this process's to say: an install only to a process running a release before
@@ -18123,7 +18770,7 @@ async function securityNotice(options) {
 					record: withSecurityShown(record, now, approvalId),
 					result: now
 				};
-			});
+			}, UPDATE_NOTICE_LOCK);
 			if (decided.result === void 0) return null;
 			shown = decided.result;
 		}
@@ -18279,7 +18926,7 @@ async function checkForUpdates(core, env, options = {}) {
 			asked: false,
 			record: await readUpdateCheck(stateDir)
 		};
-		await askUnderClaim(core, env, claimedAt, options);
+		if (!(options.handOff !== void 0 && options.deps === void 0 && await handToCore(core, env, claimedAt, options.handOff, Date.now() + 12e4))) await askUnderClaim(core, env, claimedAt, options);
 		return {
 			asked: true,
 			record: await readUpdateCheck(stateDir)
@@ -18300,6 +18947,11 @@ async function checkForUpdates(core, env, options = {}) {
 * claim written before anyone asks, so of two processes that both found it a day old, one asks. The time is read under
 * the lock too: read before it, the second process's time could be earlier than the first's claim, which reads as a
 * clock gone back.
+*
+* A claim is best effort, as a notice is (`UPDATE_NOTICE_LOCK`): 2 s at most for the lock, however often it changes
+* hands meanwhile, then null, and a later process claims. Every command's and every tool call's check claims here,
+* before the person's output is done; waited out holder by holder, as a record that matters waits, a busy machine's
+* refreshes kept a finished command's process and its stdout open for up to 15 s (0.26.0 review B).
 */
 async function claimUpdateCheck(core, options = {}) {
 	const now = options.now ?? (() => /* @__PURE__ */ new Date());
@@ -18316,7 +18968,7 @@ async function claimUpdateCheck(core, options = {}) {
 			},
 			result: checking
 		};
-	}).catch(() => null))?.result ?? null;
+	}, UPDATE_NOTICE_LOCK).catch(() => null))?.result ?? null;
 }
 /**
 * The ask, under a claim already taken (`claimUpdateCheck`): the registry, then `comms_update`'s own check. What it
@@ -18341,7 +18993,7 @@ async function ask(core, env, options) {
 	*/
 	const settle = (found) => changeUpdateCheck(core.paths.stateDir, (record) => record.checking === options.claimedAt ? { record: {
 		...record,
-		...found,
+		...typeof found === "function" ? found(record) : found,
 		lastChecked: options.claimedAt,
 		checking: null
 	} } : null).catch(() => void 0);
@@ -18363,12 +19015,12 @@ async function ask(core, env, options) {
 		});
 		return;
 	}
-	const read = deps.releaseFacts !== void 0 ? deps.releaseFacts : releaseFactsReader(env, deps);
-	const release = read === null ? null : await read(CORE_PACKAGE, latest, VERSION).then((facts) => ({
+	const read = deps.releaseFacts !== void 0 ? deps.releaseFacts : releaseFactsReader(env, deps, core.paths.stateDir, { deadline: Date.parse(options.claimedAt) + DECLARATION_DEADLINE_MS });
+	const release = read === null ? void 0 : await read(CORE_PACKAGE, latest, VERSION).then((facts) => facts === null ? null : {
 		version: latest,
 		security: facts.security,
 		needsDecision: facts.needsDecision
-	}), () => null);
+	}, () => null);
 	try {
 		await updateCheck(core, env, {
 			...deps,
@@ -18377,13 +19029,13 @@ async function ask(core, env, options) {
 			now: options.now
 		}, options.claimedAt);
 	} catch (error) {
-		await settle({
+		await settle((record) => ({
 			latest,
 			behind: null,
 			current: null,
 			lastError: reason(error),
-			release
-		});
+			release: release ?? (record.release?.version === latest ? record.release : null)
+		}));
 	}
 }
 /**
@@ -18502,8 +19154,13 @@ function updateCheckChildEnvironment(env, platform = process.platform) {
 * message — or whatever reads that output would wait for the child as it waited for the check. Detached, so a
 * Ctrl-C at the terminal does not cut the ask short, and hidden, so Windows opens no console for it.
 *
-* When the child cannot be started — no entry to start, a program not there or not allowed — the check is asked in
-* this process instead, as it was before. It never throws.
+* A channel's command hands the ask to core's CLI first (design 2026-10-22, P2): core's command, located at the
+* channel's own version, with the same hidden command, the same claim and the same environment. Core's child verifies
+* what a release declares, which the channel's own could not.
+*
+* When the child cannot be started — no core, no entry to start, a program not there or not allowed, a `.cmd` that
+* would need a shell, a launcher whose Node was removed, which starts and ends at once — the next is tried: the
+* channel's own child, then the check in this process, as it was before. It never throws.
 */
 async function handUpdateCheckToChild(core, env, options) {
 	const deadline = Date.now() + TERMINAL_CHECK_WAIT_MS;
@@ -18515,59 +19172,127 @@ async function handUpdateCheckToChild(core, env, options) {
 			intervalMs: enabled.intervalMs
 		});
 		if (claimedAt === null) return;
+		if (options.handOff !== void 0 && await handToCore(core, env, claimedAt, options.handOff, deadline)) return;
 		const entry = options.entry === void 0 ? updateCheckChildEntry() : options.entry;
-		if (!(entry !== null && await startUpdateCheckChild(entry, claimedAt, core.paths, env, deadline))) await askUnderClaim(core, env, claimedAt, {
+		if (!(entry !== null && await startedSafely(options.handOff?.start ?? startCheckChild, ownChildWords(entry, claimedAt, core.paths), updateCheckChildEnvironment(env), deadline))) await askUnderClaim(core, env, claimedAt, {
 			now: options.now,
 			...options.verifyRelease ? { deps: { verifyRelease: options.verifyRelease } } : {}
 		});
 	} catch {}
 }
+/** This CLI again, as its child: the entry, every folder pinned, the hidden command and the claim. */
+function ownChildWords(entry, claimedAt, paths) {
+	const pathArgs = PATH_OPTIONS.flatMap(({ key, flag }) => [flag, paths[key]]);
+	return [
+		entry.command,
+		...entry.args,
+		...pathArgs,
+		UPDATE_CHECK_CHILD_COMMAND,
+		claimedAt
+	];
+}
 /**
-* Starts the child and waits, until `deadline` at most, for it to say the ask is over, or to end. False when it could
-* not be started at all; then nothing was asked, and the claim is still this process's to ask under.
+* Core's own command for `update-check-child <claimedAt>`, as the words to start: `core.handoffs.core(…)` with every
+* folder pinned, located as the channel finds core — its installed dependency, at exactly the channel's own version,
+* through the stable way in a managed runtime keeps (`locateCliCommand`). Locating checks files and runs nothing.
+*
+* Located for this process's own system, whatever shell its printed commands are quoted for: these words are started
+* here, and a managed runtime's stable launcher is started one way on Windows and another elsewhere.
+*
+* Null for core's own process, which asks itself and is never handed its own check; for a core opened without its
+* caller, which can locate nothing; and where no such core is found.
 */
-async function startUpdateCheckChild(entry, claimedAt, paths, env, deadline) {
+function coreUpdateCheckWords(core, claimedAt) {
+	if (core.handoffs === void 0 || core.handoffs.caller.packageName === CORE_PACKAGE) return null;
+	try {
+		const handoff = requireHandoffs(core, process.platform).core([UPDATE_CHECK_CHILD_COMMAND, claimedAt], { downloads: true });
+		return isCommand(handoff) ? handoff.words : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* The ask handed to core's CLI (design 2026-10-22, P2): its command located (`handOff.locate`), started with the
+* claim and this command's child environment (`handOff.start`), and waited for until `deadline`. False when there is
+* no such command, or it did not start: then nothing was asked, and the claim is still this process's to ask under. It
+* never throws.
+*/
+async function handToCore(core, env, claimedAt, handOff, deadline) {
+	let words;
+	try {
+		words = (handOff.locate ?? coreUpdateCheckWords)(core, claimedAt);
+	} catch {
+		return false;
+	}
+	if (words === null || words.length === 0) return false;
+	return startedSafely(handOff.start ?? startCheckChild, words, updateCheckChildEnvironment(env), deadline);
+}
+/** A start's answer, with one that throws counted as not started: the fallback after it is all that is left. */
+async function startedSafely(start, words, env, deadline) {
+	try {
+		return await start(words, env, deadline) === true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Starts `words` — a program, then its arguments — detached and hidden, with no shell and `env` as given, and waits,
+* until `deadline` at most, for it to say the ask is over, or to end. False when it could not be started at all, or
+* when it ended with a code other than 0, or by a signal, before it said the ask is over — a launcher whose Node was
+* removed starts, and ends at once with 127 (0.26.0 review B). Either way nothing was asked, and the claim is still
+* this process's to ask under.
+*
+* Never through a shell: each word is one argument, as located, and nothing in them is read as a shell would read it.
+* A program only a shell could start — a Windows `.cmd` or `.bat`, which Node refuses without one (EINVAL) — is not
+* started, and the caller falls back.
+*/
+async function startCheckChild(words, env, deadline) {
+	const [command, ...args] = words;
+	if (command === void 0) return false;
 	let child;
 	try {
-		const pathArgs = PATH_OPTIONS.flatMap(({ key, flag }) => [flag, paths[key]]);
-		child = spawn(entry.command, [
-			...entry.args,
-			...pathArgs,
-			UPDATE_CHECK_CHILD_COMMAND,
-			claimedAt
-		], {
+		child = spawn(command, args, {
 			detached: true,
 			windowsHide: true,
+			shell: false,
 			stdio: [
 				"ignore",
 				"ignore",
 				"ignore",
 				"ipc"
 			],
-			env: updateCheckChildEnvironment(env)
+			env
 		});
 	} catch {
 		return false;
 	}
-	let failed = false;
-	child.on("error", () => {
-		if (child.pid === void 0) failed = true;
-	});
-	await new Promise((resolve) => {
-		const timer = setTimeout(resolve, Math.max(0, deadline - Date.now()));
-		const done = () => {
+	child.on("error", () => void 0);
+	const started = await new Promise((resolve) => {
+		const timer = setTimeout(() => resolve(true), Math.max(0, deadline - Date.now()));
+		const done = (started) => {
 			clearTimeout(timer);
-			resolve();
+			resolve(started);
 		};
-		child.once("error", done);
-		child.once("exit", done);
+		child.once("error", () => done(child.pid !== void 0));
 		child.on("message", (message) => {
-			if (message?.type === "settled") done();
+			if (message?.type === "settled") done(true);
+		});
+		let ended = null;
+		const over = () => {
+			if (ended !== null && !child.connected) done(ended.code === 0 && ended.signal === null);
+		};
+		child.once("exit", (code, signal) => {
+			ended = {
+				code,
+				signal
+			};
+			over();
 		});
+		child.once("disconnect", over);
 	});
 	if (child.connected) child.disconnect();
 	child.unref();
-	return !failed;
+	return started;
 }
 /**
 * The hidden command's work, in the child a command started (`UPDATE_CHECK_CHILD_COMMAND`): the ask, under the claim
@@ -18579,7 +19304,7 @@ async function startUpdateCheckChild(entry, claimedAt, paths, env, deadline) {
 async function runUpdateCheckChild(core, env, claimedAt, options = {}) {
 	if (claimedAt === void 0 || !Number.isFinite(Date.parse(claimedAt))) throw new CommsError("USAGE", `${UPDATE_CHECK_CHILD_COMMAND} takes the time of the claim it asks under`, { hint: handoffSentence(requireHandoffs(core).core(["update", "--check"]), (command) => `Nothing runs this but a command finishing the day’s update check; ${command} asks now.`) });
 	try {
-		if ((await readUpdateCheck(core.paths.stateDir)).checking === claimedAt) await askUnderClaim(core, env, claimedAt, options.verifyRelease ? { deps: { verifyRelease: options.verifyRelease } } : {});
+		if ((await readUpdateCheck(core.paths.stateDir)).checking === claimedAt) await askUnderClaim(core, env, claimedAt, options.deps !== void 0 ? { deps: options.deps } : {});
 	} finally {
 		settled();
 	}
@@ -18608,12 +19333,13 @@ function terminalUpdateHooks(core, env, options = {}) {
 		await handUpdateCheckToChild(core, env, {
 			now: options.now,
 			entry: options.childEntry,
-			verifyRelease: options.verifyRelease
+			verifyRelease: options.verifyRelease,
+			handOff: options.handOff
 		});
 	} };
 }
 //#endregion
-//#region ../core/dist/tool-arguments-BW3WUyxT.mjs
+//#region ../core/dist/tool-arguments-CJ4RQpx4.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**
@@ -19002,7 +19728,7 @@ function spoken(words, joiner) {
 	return `${words.slice(0, -1).join(", ")} ${joiner} ${words.at(-1)}`;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/postal-mime@4.0.5/node_modules/postal-mime/dist/esm/decode-strings.js
+//#region ../../node_modules/.pnpm/postal-mime@4.1.4/node_modules/postal-mime/dist/esm/decode-strings.js
 const textEncoder = new TextEncoder();
 const base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 const base64Lookup = /* @__PURE__ */ new Uint8Array(256);
@@ -19101,20 +19827,51 @@ const ENCODING_LABELS = new Set([
 	"cseuckr csksc56011987 euc-kr iso-ir-149 korean ks_c_5601-1987 ks_c_5601-1989 ksc5601 ksc_5601",
 	"windows-949",
 	"csiso2022kr hz-gb-2312 iso-2022-cn iso-2022-cn-ext iso-2022-kr replacement",
-	"unicodefffe utf-16be",
-	"csunicode iso-10646-ucs-2 ucs-2 unicode unicodefeff utf-16 utf-16le",
 	"x-user-defined"
 ].join(" ").split(" "));
+const REPLACEMENT_LABELS = /* @__PURE__ */ new Set([
+	"csiso2022kr",
+	"hz-gb-2312",
+	"iso-2022-cn",
+	"iso-2022-cn-ext",
+	"iso-2022-kr",
+	"replacement"
+]);
+const replacementDecoder = {
+	encoding: "replacement",
+	decode: (input) => input && input.byteLength ? "�" : ""
+};
+const UTF16_LABELS = /* @__PURE__ */ new Map([
+	["utf-16", "utf-16"],
+	["utf16", "utf-16"],
+	["utf_16", "utf-16"],
+	["utf-16le", "utf-16le"],
+	["utf-16be", "utf-16be"]
+]);
+/**
+* The label of the Encoding Standard a charset resolves to, as written or through the
+* alias tables, or null when it names no encoding the standard lists
+*/
+function resolveLabel(charset) {
+	charset = (charset || "utf8").trim().toLowerCase();
+	if (ENCODING_LABELS.has(charset)) return charset;
+	const utf16 = UTF16_LABELS.get(charset);
+	if (utf16) return utf16;
+	const normalized = normalizeCharset(charset);
+	const codePage = normalized.match(codePagePattern);
+	const alias = codePage && codePageAliases.get(codePage[1]) || charsetAliases.get(normalized) || normalized;
+	return ENCODING_LABELS.has(alias) ? alias : null;
+}
 const decoders = /* @__PURE__ */ new Map();
-function tryDecoder(charset) {
-	if (!ENCODING_LABELS.has(charset)) return null;
-	let decoder = decoders.get(charset);
+function tryDecoder(label) {
+	if (REPLACEMENT_LABELS.has(label)) return replacementDecoder;
+	let decoder = decoders.get(label);
 	if (decoder === void 0) {
 		decoder = null;
 		try {
-			decoder = new TextDecoder(charset);
+			decoder = new TextDecoder(label);
 		} catch {}
-		decoders.set(charset, decoder);
+		decoders.set(label, decoder);
 	}
 	return decoder;
 }
@@ -19123,16 +19880,21 @@ const utf8Decoder = new TextDecoder();
 * Finds the decoder for a charset label, or null when the runtime has no encoding for it
 */
 function findDecoder(charset) {
-	charset = (charset || "utf8").trim().toLowerCase();
-	const decoder = tryDecoder(charset);
-	if (decoder) return decoder;
-	const normalized = normalizeCharset(charset);
-	const codePage = normalized.match(codePagePattern);
-	return tryDecoder(codePage && codePageAliases.get(codePage[1]) || charsetAliases.get(normalized) || normalized);
+	const label = resolveLabel(charset);
+	return label ? tryDecoder(label) : null;
 }
 function getDecoder(charset) {
 	return findDecoder(charset) || tryDecoder("windows-1252") || utf8Decoder;
 }
+const UTF16_UNORDERED_LABELS = /* @__PURE__ */ new Set(["utf-16"]);
+/**
+* The byte order a UTF-16 byte order mark at the start of the bytes names, or null without one
+*/
+function bomByteOrder(bytes) {
+	if (bytes[0] === 254 && bytes[1] === 255) return "utf-16be";
+	if (bytes[0] === 255 && bytes[1] === 254) return "utf-16le";
+	return null;
+}
 /**
 * Whether the bytes are well formed UTF-8. A scan rather than a fatal TextDecoder, since
 * the exception one throws costs more than the decode itself and a message decides how
@@ -19186,8 +19948,14 @@ function decodeUtf8OrWindows1252(bytes, utf8 = utf8Decoder) {
 * @return Decoded text
 */
 function decodeCharset(bytes, charset) {
-	const decoder = findDecoder(charset);
-	return decoder ? decoder.decode(bytes) : decodeUtf8OrWindows1252(bytes);
+	const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+	const label = resolveLabel(charset);
+	let decoder = label ? tryDecoder(label) : null;
+	if (label && UTF16_UNORDERED_LABELS.has(label)) {
+		const order = bomByteOrder(view);
+		decoder = order && tryDecoder(order) || decoder;
+	}
+	return decoder ? decoder.decode(view) : decodeUtf8OrWindows1252(view);
 }
 /**
 * Numeric value of an ASCII hex digit
@@ -19307,7 +20075,7 @@ function splitEncodedWords(str) {
 function canJoinWords(left, right) {
 	const encoding = left.encoding.toUpperCase();
 	if (left.charset !== right.charset || encoding !== right.encoding.toUpperCase()) return false;
-	if (encoding === "B") return left.encodedText.length % 4 === 0 && !/=$/.test(left.encodedText);
+	if (encoding === "B") return left.encodedText.length % 4 === 0 && !left.padded;
 	return true;
 }
 /**
@@ -19334,13 +20102,15 @@ function renderTokens(tokens, joinWords) {
 		}
 		if (pending && joinWords && canJoinWords(pending, token)) {
 			pending.encodedText += token.encodedText;
+			pending.padded = token.encodedText.endsWith("=");
 			continue;
 		}
 		if (pending) result += decodeWord(pending.charset, pending.encoding, pending.encodedText);
 		pending = {
 			charset: token.charset,
 			encoding: token.encoding,
-			encodedText: token.encodedText
+			encodedText: token.encodedText,
+			padded: token.encodedText.endsWith("=")
 		};
 	}
 	if (pending) result += decodeWord(pending.charset, pending.encoding, pending.encodedText);
@@ -19359,7 +20129,86 @@ function decodeWords(str) {
 }
 new TextDecoder("utf-8", { ignoreBOM: true });
 //#endregion
-//#region ../../node_modules/.pnpm/postal-mime@4.0.5/node_modules/postal-mime/dist/esm/address-parser.js
+//#region ../../node_modules/.pnpm/postal-mime@4.1.4/node_modules/postal-mime/dist/esm/text-format.js
+const hexByte = (value) => value.toString(16).toUpperCase().padStart(2, "0");
+Array.from({ length: 256 }, (_, byte) => "%" + hexByte(byte));
+//#endregion
+//#region ../../node_modules/.pnpm/postal-mime@4.1.4/node_modules/postal-mime/dist/esm/address-parser.js
+/** The token is an operator, a text run otherwise */
+const TOKEN_OPERATOR = 1;
+/** The next character continues the same run without whitespace in between */
+const TOKEN_NO_BREAK = 2;
+/** The text run holds characters its value leaves out or changes, so it is no plain slice */
+const TOKEN_DIRTY = 4;
+/** A backslash escapes the next character in the text run, inside a quoted string or a comment */
+const TOKEN_ESCAPES = 8;
+/** The text run opens on a character an escaping backslash in front of it has escaped */
+const TOKEN_STARTS_ESCAPED = 16;
+/**
+* The tokens of an address field, kept as offsets into it.
+*
+* Every token used to be an object of its own, an operator for every ',' and a value string
+* for every run of text, and a list of one letter names, 'a,a,a,...', took some 65 times its
+* size in tokens before any address was read. A token is now three numbers in one typed
+* array, its kind and the range of the field it covers, and its value is sliced off the field
+* when it is read. The few text runs whose value differs from their slice, as they hold an
+* escaping backslash, a line break or a control character, are rebuilt once and kept aside.
+*/
+var TokenList = class {
+	constructor(str) {
+		this.str = str;
+		this.slots = /* @__PURE__ */ new Int32Array(48);
+		this.length = 0;
+		this.cleaned = /* @__PURE__ */ new Map();
+	}
+	/**
+	* Appends a token
+	*
+	* @param kind Kind and flags of the token
+	* @param start Offset of its first character
+	* @param end Offset just past its last character
+	* @return Index of the token
+	*/
+	push(kind, start, end) {
+		if ((this.length + 1) * 3 > this.slots.length) {
+			const grown = new Int32Array(this.slots.length * 2);
+			grown.set(this.slots);
+			this.slots = grown;
+		}
+		const at = this.length * 3;
+		this.slots[at] = kind;
+		this.slots[at + 1] = start;
+		this.slots[at + 2] = end;
+		return this.length++;
+	}
+	/**
+	* The character of an operator token, an empty string for a text run
+	*/
+	operatorAt(index) {
+		const at = index * 3;
+		return this.slots[at] & TOKEN_OPERATOR ? this.str.charAt(this.slots[at + 1]) : "";
+	}
+	/**
+	* Whether a token is an operator
+	*/
+	isOperator(index) {
+		return (this.slots[index * 3] & TOKEN_OPERATOR) !== 0;
+	}
+	/**
+	* Whether the next character continues the run of a token without whitespace in between
+	*/
+	noBreak(index) {
+		return (this.slots[index * 3] & TOKEN_NO_BREAK) !== 0;
+	}
+	/**
+	* Value of a token
+	*/
+	value(index) {
+		const cleaned = this.cleaned.get(index);
+		if (cleaned !== void 0) return cleaned;
+		return this.str.slice(this.slots[index * 3 + 1], this.slots[index * 3 + 2]);
+	}
+};
 /**
 * Any whitespace, the test for an angle-addr that needs recovering
 */
@@ -19374,6 +20223,23 @@ const QUOTED_LOCAL_ADDR = /^("(?:[^"\\]|\\[\s\S])*"@\S+)(?:\s+([\s\S]+))?$/;
 */
 const ADDR_SPEC = /^[^@\s]+@[^@\s]+$/;
 /**
+* The same with a domain literal for the domain, which may hold an '@' of its own
+*/
+const LITERAL_ADDR_SPEC = /^[^@\s]+@\[[^[\]\\\s]*\]$/;
+/**
+* The '@' and domain that follow a quoted local part in the same run
+*/
+const QUOTED_LOCAL_DOMAIN = /^@(?:[^@\s"]+|\[[^[\]\\\s]*\])$/;
+/**
+* Whether a whitespace free run reads as an addr-spec under the strict grammar
+*
+* @param value Run to check
+* @return true when it does
+*/
+function isAddrSpec(value) {
+	return ADDR_SPEC.test(value) || LITERAL_ADDR_SPEC.test(value);
+}
+/**
 * The looser reading applied once the strict one finds nothing, which tolerates the
 * further '@' that a domain should not have but malformed headers carry anyway
 */
@@ -19384,6 +20250,22 @@ const LOOSE_ADDR_SPEC = /^[^@\s]+@\S+$/;
 */
 const LOOSE_TEXT_ADDR = /\s*\b[^@\s]+@[^\s]+\b\s*/y;
 /**
+* A domain literal that ends an address. dtext includes '@' (RFC 5322 3.4.1), so the '@'
+* in front of the literal is the one that splits the domain off, not the last one: reading
+* 'a@[x@evil.com]' at its last '@' made it an address at evil.com.
+*/
+const DOMAIN_LITERAL_TAIL = /@(\[[^[\]\\]*\])$/;
+/**
+* Offset of the '@' that splits the domain off an address, or -1 when there is none
+*
+* @param address Address to split
+* @return Offset of the '@'
+*/
+function domainAt(address) {
+	const literal = address.charAt(address.length - 1) === "]" ? DOMAIN_LITERAL_TAIL.exec(address) : null;
+	return literal ? address.length - literal[1].length - 1 : address.lastIndexOf("@");
+}
+/**
 * Restores the quoting of a local part that was read out of a quoted string.
 *
 * RFC 5321 allows '@' inside a quoted local part, so handing '"user@evil.com"@good.com'
@@ -19396,7 +20278,7 @@ const LOOSE_TEXT_ADDR = /\s*\b[^@\s]+@[^\s]+\b\s*/y;
 * @return Address with the local part as a quoted-string
 */
 function quoteLocalPart(address) {
-	const lastAt = address.lastIndexOf("@");
+	const lastAt = domainAt(address);
 	if (lastAt < 0) return address;
 	const user = address.substring(0, lastAt);
 	if (/^[^\s"(),:;<>@[\\\]]+$/.test(user) || /^"(?:[^"\\]|\\[\s\S])*"$/.test(user)) return address;
@@ -19433,6 +20315,50 @@ function indexOfAt(text, from, to) {
 	return -1;
 }
 /**
+* A quoted-string a value opens with
+*/
+const LEADING_QUOTED_STRING = /^"(?:[^"\\]|\\[\s\S])*"/;
+/**
+* Drops the whitespace on either side of the '@' at an offset.
+*
+* obs-local-part and obs-domain allow CFWS around the '@' (RFC 5322 4.4), so 'user @ good.com'
+* names user@good.com. Kept, the whitespace became part of the address as '"user "@ good.com'.
+* The scan is by index, a pattern such as /\s+@/ backtracks over a long whitespace run that
+* no '@' follows.
+*
+* @param value Value holding the '@'
+* @param at Offset of the '@', or -1
+* @return The value with the whitespace beside that '@' removed
+*/
+function joinAtSpacing(value, at) {
+	if (at < 0) return value;
+	let start = at;
+	while (start > 0 && isSpaceCode(value.charCodeAt(start - 1))) start--;
+	let end = at + 1;
+	while (end < value.length && isSpaceCode(value.charCodeAt(end))) end++;
+	return start === at && end === at + 1 ? value : value.slice(0, start) + "@" + value.slice(end);
+}
+/**
+* Drops the whitespace beside the '@' that splits the domain off a value. That is the '@'
+* right after a quoted local part the value opens with, or else the only '@' it holds outside
+* any quoted string. With several it is not clear which one the whitespace belongs to, and
+* '<x@evil.com @good.com>' is left to the addr-spec recovery to read as it always has.
+*
+* @param value Value to clean up
+* @return The value with the whitespace beside that '@' removed
+*/
+function collapseAtSpacing(value) {
+	const quoted = LEADING_QUOTED_STRING.exec(value);
+	if (quoted) {
+		let at = quoted[0].length;
+		while (at < value.length && isSpaceCode(value.charCodeAt(at))) at++;
+		if (value.charAt(at) === "@" && value.indexOf("@", at + 1) < 0) return joinAtSpacing(value, at);
+	}
+	const at = value.indexOf("@");
+	if (at < 0 || value.indexOf("@", at + 1) >= 0 || value.lastIndexOf("\"") > at) return value;
+	return joinAtSpacing(value, at);
+}
+/**
 * Finds the offset LOOSE_TEXT_ADDR matches at, or -1 when it does not match at all.
 *
 * Letting the pattern search for itself is quadratic: '[^@\s]+' is retried from every
@@ -19503,6 +20429,7 @@ function looseAddressStart(text) {
 * @return The address and the display text, with any leftovers moved to the text
 */
 function recoverAddrSpec(address, text) {
+	address = collapseAtSpacing(address);
 	if (!HAS_WHITESPACE.test(address)) return {
 		address,
 		text
@@ -19522,7 +20449,7 @@ function recoverAddrSpec(address, text) {
 			text
 		};
 		const parts = address.split(/\s+/);
-		let addrIndex = parts.findIndex((part) => ADDR_SPEC.test(part));
+		let addrIndex = parts.findIndex(isAddrSpec);
 		if (addrIndex < 0) addrIndex = parts.findIndex((part) => LOOSE_ADDR_SPEC.test(part));
 		if (addrIndex < 0) return {
 			address,
@@ -19545,7 +20472,16 @@ function recoverAddrSpec(address, text) {
 * consumer stripping the comment reads as 'user@example.comevil.com'. A comment is folding
 * whitespace, so it is read as a space that splits two atoms and as nothing next to an '@',
 * the same rule the token walk applies outside the brackets. Quoted strings and domain
-* literals are copied through untouched, a '(' in there is not a comment.
+* literals are copied through untouched, a '(' in there is not a comment. An unexpected '<'
+* outside them drops everything in front of it, comments included.
+*
+* RFC 822 also let an angle-addr name the relays to go through in front of the mailbox,
+* '<@relay1,@relay2:user@example.com>', which RFC 5322 still parses as obs-route. The route
+* is not part of the mailbox, and folded into the local part it made
+* '"@relay1,@relay2:user"@example.com' a recipient that does not exist. A local part can not
+* start with '@', so contents that do, up to the first ':' outside a domain literal and in
+* front of any quoted string, are a route and are dropped, as long as a mailbox with an '@'
+* of its own follows.
 *
 * @param address Contents of the angle brackets
 * @return The address with the comments removed, and the text of the comments
@@ -19557,6 +20493,10 @@ function stripAddressComments(address) {
 	let depth = 0;
 	let closer = "";
 	let lastChar = "";
+	let pendingSpace = false;
+	let firstChar = "";
+	let quoteSeen = false;
+	let routeEnd = -1;
 	for (let i = 0, len = address.length; i < len; i++) {
 		const chr = address.charAt(i);
 		if (depth) {
@@ -19567,13 +20507,17 @@ function stripAddressComments(address) {
 			} else if (chr === ")" && !--depth) {
 				comments.push(comment.trim());
 				comment = "";
-				if (lastChar !== "@" && address.charAt(i + 1) !== "@") {
-					result += " ";
-					lastChar = " ";
-				}
+				pendingSpace = lastChar !== "@";
 			} else comment += chr;
 			continue;
 		}
+		if (pendingSpace && chr !== "(") {
+			pendingSpace = false;
+			if (chr !== "@" && chr !== "<" && !isSpaceCode(address.charCodeAt(i))) {
+				result += " ";
+				lastChar = " ";
+			}
+		}
 		if (closer) {
 			if (chr === "\\" && closer === "\"" && i < len - 1) {
 				result += chr + address.charAt(++i);
@@ -19581,15 +20525,28 @@ function stripAddressComments(address) {
 				continue;
 			}
 			if (chr === closer) closer = "";
-		} else if (chr === "\"") closer = "\"";
+		} else if (chr === "\"") {
+			closer = "\"";
+			quoteSeen = true;
+		} else if (chr === ":" && routeEnd < 0 && firstChar === "@" && !quoteSeen) routeEnd = result.length + 1;
 		else if (chr === "[") closer = "]";
 		else if (chr === "(") {
 			depth = 1;
 			continue;
+		} else if (chr === "<") {
+			result = "";
+			lastChar = "";
+			comments.length = 0;
+			firstChar = "";
+			quoteSeen = false;
+			routeEnd = -1;
+			continue;
 		}
 		result += chr;
 		lastChar = chr;
+		if (!firstChar && !isSpaceCode(address.charCodeAt(i))) firstChar = chr;
 	}
+	if (routeEnd >= 0 && result.indexOf("@", routeEnd) >= 0) result = result.slice(routeEnd);
 	if (depth) comments.push(comment.trim());
 	return {
 		address: result.trim(),
@@ -19597,62 +20554,36 @@ function stripAddressComments(address) {
 	};
 }
 /**
-* Checks whether text holds an angle bracket address, ie. `<` and `>` around a run
-* without other angle brackets that has an '@' with at least one character on each side.
-*
-* Same answer as `/<[^<>]+@[^<>]+>/.test(text)`, which backtracks quadratically on a `<`
-* followed by a long run of '@' and no closing `>`.
+* Walks the tokens of one entry of an address list and sorts them into the runs of display
+* text, angle-addr and comment they belong to
 *
-* @param text Text to check
-* @return true if an angle bracket address is present
+* @param tokens Tokens of the whole address list
+* @param from Index of the first token of the entry
+* @param to Index just past the last token of the entry
+* @return The collected runs, and whether the display text came out of a comment
 */
-function hasAngleAddress(text) {
-	let start = -1;
-	let at = -1;
-	for (let i = 0; i < text.length; i++) {
-		const chr = text.charAt(i);
-		if (chr === "<") {
-			start = i + 1;
-			at = -1;
-		} else if (chr === ">") {
-			if (at >= 0 && at < i - 1) return true;
-			start = -1;
-			at = -1;
-		} else if (chr === "@" && start >= 0 && at < 0 && i > start) at = i;
-	}
-	return false;
-}
-/**
-* Converts tokens for a single address into an address object
-*
-* @param tokens Tokens object
-* @param depth Current recursion depth for nested group protection
-* @return Address objects
-*/
-function _handleAddress(tokens, depth) {
-	let isGroup = false;
+function collectAddressParts(tokens, from, to) {
 	let state = "text";
-	let addresses = [];
 	let data = {
 		address: [],
 		comment: [],
-		group: [],
 		text: [],
-		textWasQuoted: []
+		textWasQuoted: [],
+		quotedLocalAt: []
 	};
+	let lastTextPureQuoted = false;
 	let i;
-	let len;
 	let insideQuotes = false;
 	const lastChars = {
 		address: "",
 		comment: "",
-		group: "",
 		text: ""
 	};
-	for (i = 0, len = tokens.length; i < len; i++) {
-		let token = tokens[i];
-		let prevToken = i ? tokens[i - 1] : null;
-		if (token.type === "operator") switch (token.value) {
+	for (i = from; i < to; i++) {
+		const value = tokens.value(i);
+		const prevOperator = i > from ? tokens.operatorAt(i - 1) : "";
+		const prevNoBreak = i > from && tokens.noBreak(i - 1);
+		if (tokens.isOperator(i)) switch (value) {
 			case "<":
 				state = "address";
 				insideQuotes = false;
@@ -19661,11 +20592,6 @@ function _handleAddress(tokens, depth) {
 				state = "comment";
 				insideQuotes = false;
 				break;
-			case ":":
-				state = "group";
-				isGroup = true;
-				insideQuotes = false;
-				break;
 			case "\"":
 				insideQuotes = !insideQuotes;
 				state = "text";
@@ -19674,108 +20600,132 @@ function _handleAddress(tokens, depth) {
 				state = "text";
 				insideQuotes = false;
 		}
-		else if (token.value) {
-			const prevPrevToken = i > 1 ? tokens[i - 2] : null;
-			const opensAfterEmptyQuotedString = prevToken?.type === "operator" && prevToken.value === "\"" && !!prevToken.noBreak && prevPrevToken?.type === "operator" && prevPrevToken.value === "\"";
-			if (state === "address") token.value = token.value.replace(/^[^<]*<\s*/, "");
-			if (prevToken && prevToken.noBreak && data[state].length && (prevToken.value !== ")" || lastChars[state] === "@" || token.value.charAt(0) === "@")) {
-				data[state][data[state].length - 1] += token.value;
-				if (state === "text" && insideQuotes) data.textWasQuoted[data.textWasQuoted.length - 1] = true;
+		else {
+			const opensAfterEmptyQuotedString = prevOperator === "\"" && prevNoBreak && i > from + 1 && tokens.operatorAt(i - 2) === "\"";
+			if (prevNoBreak && data[state].length && (prevOperator !== ")" || lastChars[state] === "@" || value.charAt(0) === "@")) {
+				const last = data[state].length - 1;
+				if (state === "text" && !insideQuotes) {
+					if (lastTextPureQuoted && value.charAt(0) === "@") data.quotedLocalAt[last] = data.text[last].length;
+					lastTextPureQuoted = false;
+				}
+				data[state][last] += value;
+				if (state === "text" && insideQuotes) data.textWasQuoted[last] = true;
 			} else {
-				data[state].push(token.value);
-				if (state === "text") data.textWasQuoted.push(insideQuotes || opensAfterEmptyQuotedString);
+				data[state].push(value);
+				if (state === "text") {
+					data.textWasQuoted.push(insideQuotes || opensAfterEmptyQuotedString);
+					data.quotedLocalAt.push(opensAfterEmptyQuotedString && value.charAt(0) === "@" ? 0 : -1);
+					lastTextPureQuoted = insideQuotes;
+				}
 			}
-			lastChars[state] = token.value.charAt(token.value.length - 1);
+			lastChars[state] = value.charAt(value.length - 1);
 		}
 	}
+	let textFromComment = false;
 	if (!data.text.length && data.comment.length) {
 		data.text = data.comment;
 		data.comment = [];
+		textFromComment = true;
 	}
-	if (isGroup) {
-		const text = data.text.join(" ");
-		let groupMembers = [];
-		if (data.group.length) parseAddressList$1(data.group.join(","), depth + 1).forEach((member) => {
-			if (member.group) for (const nestedMember of member.group) groupMembers.push(nestedMember);
-			else groupMembers.push(member);
-		});
-		addresses.push({
-			name: decodeWords(text),
-			group: groupMembers
-		});
-	} else {
-		const addressComments = [];
-		const addressParts = [];
-		for (const part of data.address) {
-			if (part.indexOf("(") < 0) {
-				addressParts.push(part);
-				continue;
-			}
-			const stripped = stripAddressComments(part);
-			for (const comment of stripped.comments) addressComments.push(comment);
-			if (stripped.address) addressParts.push(stripped.address);
-		}
-		data.address = addressParts;
-		if (!data.address.length && data.text.length) {
-			for (i = data.text.length - 1; i >= 0; i--) if (!data.textWasQuoted[i] && ADDR_SPEC.test(data.text[i])) {
-				data.address = data.text.splice(i, 1);
+	return {
+		data,
+		textFromComment
+	};
+}
+/**
+* Name of a group, from the tokens in front of its ':'. A comment names it when no text
+* does, as it names a mailbox.
+*
+* @param tokens Tokens of the whole address list
+* @param from Index of the first token in front of the ':'
+* @param to Index of the ':'
+* @return Decoded name of the group
+*/
+function groupName(tokens, from, to) {
+	return decodeWords(collectAddressParts(tokens, from, to).data.text.join(" "));
+}
+/**
+* Converts tokens for a single address into an address object
+*
+* @param tokens Tokens of the whole address list
+* @param from Index of the first token of this address
+* @param to Index just past the last token of this address
+* @return The address object
+*/
+function _handleAddress(tokens, from, to) {
+	const collected = collectAddressParts(tokens, from, to);
+	const data = collected.data;
+	let textFromComment = collected.textFromComment;
+	let i;
+	const addressComments = [];
+	const addressParts = [];
+	for (const part of data.address) {
+		const stripped = stripAddressComments(part);
+		for (const comment of stripped.comments) addressComments.push(comment);
+		if (stripped.address) addressParts.push(stripped.address);
+	}
+	data.address = addressParts;
+	if (!data.address.length && data.text.length && !textFromComment) {
+		const candidates = data.text.map((part) => collapseAtSpacing(part));
+		for (i = 0; i < data.text.length; i++) {
+			const local = data.quotedLocalAt[i];
+			const quotedLocal = data.textWasQuoted[i] && local >= 0 && QUOTED_LOCAL_DOMAIN.test(data.text[i].slice(local)) ? quoteLocalPart(data.text[i]) : "";
+			if (quotedLocal || !data.textWasQuoted[i] && isAddrSpec(candidates[i])) {
+				data.address = [quotedLocal || candidates[i]];
+				data.text.splice(i, 1);
 				data.textWasQuoted.splice(i, 1);
+				data.quotedLocalAt.splice(i, 1);
 				break;
 			}
-			if (!data.address.length) {
-				for (i = data.text.length - 1; i >= 0; i--) if (!data.textWasQuoted[i]) {
-					const part = data.text[i];
-					const start = looseAddressStart(part);
-					if (start >= 0) {
-						LOOSE_TEXT_ADDR.lastIndex = start;
-						const match = LOOSE_TEXT_ADDR.exec(part);
-						if (match) {
-							data.address = [match[0].trim()];
-							data.text[i] = (part.slice(0, start) + " " + part.slice(start + match[0].length)).trim();
-							break;
-						}
+		}
+		if (!data.address.length) {
+			for (i = 0; i < data.text.length; i++) if (!data.textWasQuoted[i]) {
+				const part = candidates[i];
+				const start = looseAddressStart(part);
+				if (start >= 0) {
+					LOOSE_TEXT_ADDR.lastIndex = start;
+					const match = LOOSE_TEXT_ADDR.exec(part);
+					if (match) {
+						data.address = [match[0].trim()];
+						data.text[i] = (part.slice(0, start) + " " + part.slice(start + match[0].length)).trim();
+						break;
 					}
-					data.text[i] = part.trim();
 				}
+				data.text[i] = data.text[i].trim();
 			}
 		}
-		if (!data.text.length && data.comment.length) {
-			data.text = data.comment;
-			data.comment = [];
-		}
-		if (data.address.length > 1) data.text = data.text.concat(data.address.splice(1));
-		const addressFromQuotedText = !data.address.length && data.textWasQuoted.some((wasQuoted) => wasQuoted);
-		let text = data.text.join(" ");
-		let addressValue = data.address.join(" ");
-		if (!addressValue && isEncodedWordsOnly(text.trim())) {
-			const decodedText = decodeWords(text);
-			if (!addressFromQuotedText && hasAngleAddress(decodedText)) {
-				const parsedSubAddresses = parseAddressList$1(decodedText, depth + 1);
-				if (parsedSubAddresses.length) return parsedSubAddresses;
-			}
-			return [{
-				address: "",
-				name: decodedText
-			}];
-		}
-		if (addressFromQuotedText && text.indexOf("@") >= 0) {
-			addressValue = quoteLocalPart(text);
-			text = "";
-		}
-		({address: addressValue, text} = recoverAddrSpec(addressValue, text));
-		if (!text && addressComments.length) text = addressComments.join(" ");
-		const rawName = text || addressValue || "";
-		const address = {
-			address: addressValue || text || "",
-			name: decodeWords(rawName)
-		};
-		if (address.address === rawName || address.address === address.name) {
-			if (address.address.match(/@/)) address.name = "";
-			else address.address = "";
-		}
-		addresses.push(address);
 	}
-	return addresses;
+	if (!data.text.length && data.comment.length) {
+		data.text = data.comment;
+		data.comment = [];
+	}
+	if (data.address.length > 1) data.text = data.text.concat(data.address.splice(1));
+	const addressFromQuotedText = !data.address.length && data.textWasQuoted.some((wasQuoted) => wasQuoted);
+	let text = data.text.join(" ");
+	let addressValue = data.address.join(" ");
+	if (!addressValue && isEncodedWordsOnly(text.trim())) return {
+		address: "",
+		name: decodeWords(text)
+	};
+	if (addressFromQuotedText && text.indexOf("@") >= 0) {
+		addressValue = quoteLocalPart(joinAtSpacing(text, domainAt(text)));
+		text = "";
+	}
+	({address: addressValue, text} = recoverAddrSpec(addressValue, text));
+	if (!text && addressComments.length) {
+		text = addressComments.join(" ");
+		textFromComment = true;
+	}
+	const rawName = text || addressValue || "";
+	const address = {
+		address: addressValue || (textFromComment ? "" : text) || "",
+		name: decodeWords(rawName)
+	};
+	if (address.address === rawName || address.address === address.name) {
+		if (address.address.match(/@/)) address.name = "";
+		else address.address = "";
+	}
+	return address;
 }
 /**
 * Tokenizer for address field strings
@@ -19788,17 +20738,22 @@ var Tokenizer$2 = class {
 		this.str = (str || "").toString();
 		this.operatorCurrent = "";
 		this.operatorExpecting = "";
-		this.node = null;
+		this.node = -1;
 		this.escaped = false;
 		this.inDomainLiteral = false;
 		this.afterAt = false;
-		this.list = [];
+		this.inGroup = false;
+		this.innerQuoted = false;
+		this.innerComment = 0;
+		this.innerLiteral = false;
+		this.innerEscaped = false;
+		this.list = new TokenList(this.str);
 		this.operators = {
 			"\"": "\"",
 			"(": ")",
 			"<": ">",
 			",": "",
-			":": ";",
+			":": "",
 			";": ""
 		};
 	}
@@ -19808,115 +20763,259 @@ var Tokenizer$2 = class {
 	* @return An array of operator|text tokens
 	*/
 	tokenize() {
-		let list = [];
-		for (let i = 0, len = this.str.length; i < len; i++) {
-			let chr = this.str.charAt(i);
-			let nextChr = i < len - 1 ? this.str.charAt(i + 1) : null;
-			this.checkChar(chr, nextChr);
-		}
-		this.list.forEach((node) => {
-			node.value = (node.value || "").toString().trim();
-			if (node.value) list.push(node);
-		});
+		const str = this.str;
+		const len = str.length;
+		for (let i = 0; i < len; i++) this.checkChar(str.charAt(i), i);
+		this.closeText(len);
+		const list = this.list;
+		const slots = list.slots;
+		let kept = 0;
+		for (let i = 0, count = list.length; i < count; i++) {
+			const kind = slots[i * 3];
+			let start = slots[i * 3 + 1];
+			let end = slots[i * 3 + 2];
+			if (kind & TOKEN_DIRTY) {
+				const value = this.cleanValue(start, end, kind).trim();
+				if (!value) continue;
+				list.cleaned.set(kept, value);
+			} else if (!(kind & TOKEN_OPERATOR)) {
+				while (start < end && isSpaceCode(str.charCodeAt(start))) start++;
+				while (end > start && isSpaceCode(str.charCodeAt(end - 1))) end--;
+				if (start === end) continue;
+			}
+			slots[kept * 3] = kind;
+			slots[kept * 3 + 1] = start;
+			slots[kept * 3 + 2] = end;
+			kept++;
+		}
+		list.length = kept;
 		return list;
 	}
 	/**
+	* Ends the text run being collected, if there is one
+	*
+	* @param end Offset just past its last character
+	*/
+	closeText(end) {
+		if (this.node >= 0) {
+			this.list.slots[this.node * 3 + 2] = end;
+			this.node = -1;
+		}
+	}
+	/**
+	* Rebuilds the value of a text run that is no plain slice of the field, applying the
+	* rules checkChar collects characters by: an escaping backslash is dropped, a line break
+	* reads as a space and any other control character is left out
+	*
+	* @param start Offset of the first character of the run
+	* @param end Offset just past its last character
+	* @param kind Kind and flags of the run
+	* @return Value of the run
+	*/
+	cleanValue(start, end, kind) {
+		const str = this.str;
+		const escapes = (kind & TOKEN_ESCAPES) !== 0;
+		let escaped = (kind & TOKEN_STARTS_ESCAPED) !== 0;
+		let value = "";
+		for (let i = start; i < end; i++) {
+			const chr = str.charAt(i);
+			if (escapes && !escaped && chr === "\\") {
+				escaped = true;
+				continue;
+			}
+			escaped = false;
+			if (chr === "\n") value += " ";
+			else if (chr.charCodeAt(0) >= 33 || chr === " " || chr === "	") value += chr;
+		}
+		return value;
+	}
+	/**
 	* Checks if a character is an operator or text and acts accordingly
 	*
 	* @param chr Character from the address field
-	* @param nextChr The character that follows, or null at the end of the field
+	* @param i Offset of the character in the field
 	*/
-	checkChar(chr, nextChr) {
+	checkChar(chr, i) {
 		if (!this.escaped && !this.operatorExpecting) {
 			if (!this.inDomainLiteral && chr === "[" && this.afterAt) this.inDomainLiteral = true;
 			else if (this.inDomainLiteral && (chr === "]" || chr === "," || chr === ";")) this.inDomainLiteral = false;
 		}
-		if (this.escaped) {} else if (chr === this.operatorExpecting) {
-			this.node = {
-				type: "operator",
-				value: chr
-			};
-			if (nextChr && ![
+		let nested = false;
+		if (this.operatorExpecting === ">") {
+			nested = this.trackInner(chr);
+			if (!nested && chr === ";" && this.inGroup) {
+				this.closeText(i);
+				this.operatorExpecting = "";
+				this.resetInner();
+			}
+		} else if (this.operatorExpecting === ")" && !this.escaped) {
+			if (chr === "(") this.innerComment++;
+			else if (chr === ")" && this.innerComment) {
+				this.innerComment--;
+				nested = true;
+			}
+		}
+		if (this.escaped) {} else if (chr === this.operatorExpecting && !nested) {
+			const nextChr = this.str.charAt(i + 1);
+			this.closeText(i);
+			this.list.push(nextChr && ![
 				" ",
 				"	",
 				"\r",
 				"\n",
 				",",
 				";"
-			].includes(nextChr)) this.node.noBreak = true;
-			this.list.push(this.node);
-			this.node = null;
+			].includes(nextChr) ? 3 : TOKEN_OPERATOR, i, i + 1);
 			if (chr !== ")") this.afterAt = false;
 			this.operatorExpecting = "";
 			this.escaped = false;
+			this.resetInner();
 			return;
 		} else if (!this.operatorExpecting && !(this.inDomainLiteral && chr === ":") && chr in this.operators) {
-			this.node = {
-				type: "operator",
-				value: chr
-			};
-			this.list.push(this.node);
-			this.node = null;
+			this.closeText(i);
+			this.list.push(TOKEN_OPERATOR, i, i + 1);
+			if (chr === ":") this.inGroup = true;
+			else if (chr === ";") this.inGroup = false;
 			if (chr !== "(") this.afterAt = false;
 			this.operatorExpecting = this.operators[chr];
 			this.escaped = false;
+			this.resetInner();
 			return;
 		} else if ((this.operatorExpecting === "\"" || this.operatorExpecting === ")") && chr === "\\") {
 			this.escaped = true;
+			if (this.node >= 0) this.list.slots[this.node * 3] |= TOKEN_DIRTY;
 			return;
 		}
-		if (!this.node) {
-			this.node = {
-				type: "text",
-				value: ""
-			};
-			this.list.push(this.node);
+		if (this.node < 0) this.node = this.list.push((this.operatorExpecting === "\"" || this.operatorExpecting === ")" ? TOKEN_ESCAPES : 0) | (this.escaped ? TOKEN_STARTS_ESCAPED : 0), i, i);
+		if (chr === "\n") {
+			chr = " ";
+			this.list.slots[this.node * 3] |= TOKEN_DIRTY;
 		}
-		if (chr === "\n") chr = " ";
-		if (chr.charCodeAt(0) >= 33 || [" ", "	"].includes(chr)) {
-			this.node.value += chr;
+		if (chr.charCodeAt(0) >= 33 || chr === " " || chr === "	") {
 			if (!this.operatorExpecting && chr !== " " && chr !== "	") this.afterAt = chr === "@";
-		}
+		} else this.list.slots[this.node * 3] |= TOKEN_DIRTY;
 		this.escaped = false;
 	}
+	/**
+	* Tracks the quoted strings, comments and domain literals inside an angle-addr, which its
+	* closer must not be read from. A backslash escapes the next character inside a quoted
+	* string and a comment. A domain literal opens right after an "@" and ends at the "]".
+	* dtext holds the list separators as well, and inside the brackets they never split the
+	* list anyway.
+	*
+	* @param chr Character from the address field
+	* @return true while the character sits inside one of them, the one that closes it included
+	*/
+	trackInner(chr) {
+		if (this.innerEscaped) {
+			this.innerEscaped = false;
+			return true;
+		}
+		if (this.innerQuoted) {
+			if (chr === "\\") this.innerEscaped = true;
+			else if (chr === "\"") this.innerQuoted = false;
+			return true;
+		}
+		if (this.innerComment) {
+			if (chr === "\\") this.innerEscaped = true;
+			else if (chr === "(") this.innerComment++;
+			else if (chr === ")") this.innerComment--;
+			return true;
+		}
+		if (this.innerLiteral) {
+			if (chr === "]") this.innerLiteral = false;
+			return true;
+		}
+		if (chr === "\"") {
+			this.innerQuoted = true;
+			return true;
+		}
+		if (chr === "(") {
+			this.innerComment = 1;
+			return true;
+		}
+		if (chr === "[" && this.afterAt) {
+			this.innerLiteral = true;
+			return true;
+		}
+		if (!isSpaceCode(chr.charCodeAt(0))) this.afterAt = chr === "@";
+		return false;
+	}
+	/**
+	* Forgets the nesting collected for the operator that just opened or ended
+	*/
+	resetInner() {
+		this.innerQuoted = false;
+		this.innerComment = 0;
+		this.innerLiteral = false;
+		this.innerEscaped = false;
+	}
 };
 /**
-* Maximum recursion depth for parsing nested groups.
-* RFC 5322 doesn't allow nested groups, so this is a safeguard against
-* malicious input that could cause stack overflow.
+* Folds the fragments an unquoted display name holding a comma is split into back together.
+*
+* "Joe Foo, PhD <joe@example.com>" is split on the comma into
+* [{name:"Joe Foo", address:""}, {name:"PhD", address:"joe@example.com"}]. A name-only entry
+* followed by an entry with both name and address is recombined. Walked back to front so
+* that a run of fragments folds into one entry in a single pass. Splicing each fragment out
+* of the list instead would be quadratic.
+*
+* @param list Parsed entries, in order
+* @return The entries with the fragments folded in
 */
-const MAX_NESTED_GROUP_DEPTH = 50;
+function mergeNameFragments(list) {
+	const merged = [];
+	for (let i = list.length - 1; i >= 0; i--) {
+		const current = list[i];
+		const next = merged.length ? merged[merged.length - 1] : null;
+		if (next && current.address === "" && current.name && !current.group && next.address && next.name) next.name = current.name + ", " + next.name;
+		else merged.push(current);
+	}
+	return merged.reverse();
+}
 /**
-* Parses an address list, recursing into groups. The depth is threaded through the
-* calls rather than taken from an option, so a caller supplied options object can not
-* seed it and lift the recursion limit.
+* Parses an address list, groups included, in a single pass over its tokens.
+*
+* A group used to be cut out of the field at the ';' that ends it and parsed again as an
+* address list of its own, recursively, so every level of nesting parsed what was left of
+* the field once more. RFC 5322 does not nest groups at all, and the nested ones were
+* flattened anyway. The tokens are now walked once: a ':' opens a group, its members are
+* read as they come, a ';' closes it. A ':' inside an open group stands for a group nested
+* in it, whose name is dropped and whose members belong to the outer one, and the first ';'
+* ends the group, nested or not, as before.
 *
 * @param str Address field
-* @param depth Current recursion depth for nested group protection
 * @return An array of address objects
 */
-function parseAddressList$1(str, depth) {
-	if (depth > MAX_NESTED_GROUP_DEPTH) return [];
-	let tokens = new Tokenizer$2(str).tokenize();
-	let addresses = [];
-	let address = [];
+function parseAddressList$1(str) {
+	const tokens = new Tokenizer$2(str).tokenize();
 	const parsedAddresses = [];
-	tokens.forEach((token) => {
-		if (token.type === "operator" && (token.value === "," || token.value === ";")) {
-			if (address.length) addresses.push(address);
-			address = [];
-		} else address.push(token);
-	});
-	if (address.length) addresses.push(address);
-	for (const tokens of addresses) for (const address of _handleAddress(tokens, depth)) parsedAddresses.push(address);
-	const mergedAddresses = [];
-	for (let i = parsedAddresses.length - 1; i >= 0; i--) {
-		const current = parsedAddresses[i];
-		const next = mergedAddresses.length ? mergedAddresses[mergedAddresses.length - 1] : null;
-		if (next && current.address === "" && current.name && !current.group && next.address && next.name) next.name = current.name + ", " + next.name;
-		else mergedAddresses.push(current);
+	let group = null;
+	let members = [];
+	let from = 0;
+	for (let i = 0, len = tokens.length; i <= len; i++) {
+		const operator = i < len ? tokens.operatorAt(i) : "";
+		if (i < len && operator !== "," && operator !== ";" && operator !== ":") continue;
+		if (operator === ":") {
+			if (!group) {
+				group = {
+					name: groupName(tokens, from, i),
+					group: []
+				};
+				members = [];
+			}
+			from = i + 1;
+			continue;
+		}
+		if (i > from) (group ? members : parsedAddresses).push(_handleAddress(tokens, from, i));
+		from = i + 1;
+		if (group && (operator === ";" || i === len)) {
+			group.group = mergeNameFragments(members);
+			parsedAddresses.push(group);
+			group = null;
+		}
 	}
-	return mergedAddresses.reverse();
+	return mergeNameFragments(parsedAddresses);
 }
 /**
 * Parses structured e-mail addresses from an address field
@@ -19934,7 +21033,7 @@ function parseAddressList$1(str, depth) {
 * @return An array of address objects
 */
 function addressParser(str, options) {
-	const parsedAddresses = parseAddressList$1(str, 0);
+	const parsedAddresses = parseAddressList$1(str);
 	if (options && options.flatten) {
 		let addresses = [];
 		let walkAddressList = (list) => {