@agentcomms/resend 0.26.0 → 0.26.1

package/dist/{send-1tzjQOn0.mjs → send-BjDliNlb.mjs}

@@ -1,4 +1,4 @@
-import { C as unknown, S as union, b as strictObject, c as boolean, g as object, h as number, i as _enum, l as discriminatedUnion, m as looseObject, n as datetime, p as literal$1, s as array, x as string, y as record } from "./iso-USuVU_sk.mjs";
+import { C as unknown, S as union, b as strictObject, c as boolean, g as object, h as number, i as _enum, l as discriminatedUnion, m as looseObject, n as datetime, p as literal$1, s as array, x as string, y as record } from "./iso-5-9R47LC.mjs";
 import { access, chmod, constants, link, lstat, mkdir, open, readFile, readdir, readlink, realpath, rename, rm, stat, unlink, utimes } from "node:fs/promises";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
 import { domainToASCII, fileURLToPath, pathToFileURL } from "node:url";
@@ -13,7 +13,7 @@ import { gunzipSync } from "node:zlib";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$2 = "0.26.0";
+const VERSION$2 = "0.26.1";
 //#endregion
 //#region src/api/routes.ts
 /**
@@ -202,7 +202,7 @@ const RESEND_CALLER = Object.freeze({
 	packageName: PACKAGE_NAME
 });
 //#endregion
-//#region ../core/dist/update-check-C3j1VxDg.mjs
+//#region ../core/dist/update-check-CfybSI56.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
@@ -5581,8 +5581,8 @@ async function mergeIntoJsonConfig(path, client, name, entry) {
 }
 /** Starts the server exactly as a client would, and completes the handshake. */
 async function verifyEntry(entry, product) {
-	const { Client } = await import("./dist-C7DG2LdL-l0mj9_dH.mjs");
-	const { StdioClientTransport } = await import("./stdio-CyjIgrch-59zcjSEt.mjs");
+	const { Client } = await import("./dist-C7DG2LdL-6QTVBgXp.mjs");
+	const { StdioClientTransport } = await import("./stdio-CRbkOCqe-BpzkpnG6.mjs");
 	const client = new Client({
 		name: `${product.binary}-install-check`,
 		version: product.version
@@ -12996,7 +12996,7 @@ function folding(platform) {
 	return platform === "win32" ? (text) => text.toLowerCase() : (text) => text;
 }
 /** The package version, read from package.json at build time. */
-const VERSION = "0.26.0";
+const VERSION = "0.26.1";
 /**
 * The command a person is told to run for one of this suite's own CLIs (design 2026-10-04, D1 and D5; CUE-403).
 *
@@ -17191,7 +17191,7 @@ function serverPruneChange(core, env, request, own) {
 	};
 	const { packageName, version } = ownProduct(request.channel, own) ?? {
 		packageName: serverFacts(request.channel).packageName,
-		version: "0.26.0"
+		version: "0.26.1"
 	};
 	const product = {
 		packageName,
@@ -19339,7 +19339,7 @@ function terminalUpdateHooks(core, env, options = {}) {
 	} };
 }
 //#endregion
-//#region ../core/dist/tool-arguments-C8Oy4uOx.mjs
+//#region ../core/dist/tool-arguments-CJ4RQpx4.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**
@@ -19728,7 +19728,7 @@ function spoken(words, joiner) {
 	return `${words.slice(0, -1).join(", ")} ${joiner} ${words.at(-1)}`;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/postal-mime@4.0.5/node_modules/postal-mime/dist/esm/decode-strings.js
+//#region ../../node_modules/.pnpm/postal-mime@4.1.4/node_modules/postal-mime/dist/esm/decode-strings.js
 const textEncoder = new TextEncoder();
 const base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 const base64Lookup = /* @__PURE__ */ new Uint8Array(256);
@@ -19827,20 +19827,51 @@ const ENCODING_LABELS = new Set([
 	"cseuckr csksc56011987 euc-kr iso-ir-149 korean ks_c_5601-1987 ks_c_5601-1989 ksc5601 ksc_5601",
 	"windows-949",
 	"csiso2022kr hz-gb-2312 iso-2022-cn iso-2022-cn-ext iso-2022-kr replacement",
-	"unicodefffe utf-16be",
-	"csunicode iso-10646-ucs-2 ucs-2 unicode unicodefeff utf-16 utf-16le",
 	"x-user-defined"
 ].join(" ").split(" "));
+const REPLACEMENT_LABELS = /* @__PURE__ */ new Set([
+	"csiso2022kr",
+	"hz-gb-2312",
+	"iso-2022-cn",
+	"iso-2022-cn-ext",
+	"iso-2022-kr",
+	"replacement"
+]);
+const replacementDecoder = {
+	encoding: "replacement",
+	decode: (input) => input && input.byteLength ? "�" : ""
+};
+const UTF16_LABELS = /* @__PURE__ */ new Map([
+	["utf-16", "utf-16"],
+	["utf16", "utf-16"],
+	["utf_16", "utf-16"],
+	["utf-16le", "utf-16le"],
+	["utf-16be", "utf-16be"]
+]);
+/**
+* The label of the Encoding Standard a charset resolves to, as written or through the
+* alias tables, or null when it names no encoding the standard lists
+*/
+function resolveLabel(charset) {
+	charset = (charset || "utf8").trim().toLowerCase();
+	if (ENCODING_LABELS.has(charset)) return charset;
+	const utf16 = UTF16_LABELS.get(charset);
+	if (utf16) return utf16;
+	const normalized = normalizeCharset(charset);
+	const codePage = normalized.match(codePagePattern);
+	const alias = codePage && codePageAliases.get(codePage[1]) || charsetAliases.get(normalized) || normalized;
+	return ENCODING_LABELS.has(alias) ? alias : null;
+}
 const decoders = /* @__PURE__ */ new Map();
-function tryDecoder(charset) {
-	if (!ENCODING_LABELS.has(charset)) return null;
-	let decoder = decoders.get(charset);
+function tryDecoder(label) {
+	if (REPLACEMENT_LABELS.has(label)) return replacementDecoder;
+	let decoder = decoders.get(label);
 	if (decoder === void 0) {
 		decoder = null;
 		try {
-			decoder = new TextDecoder(charset);
+			decoder = new TextDecoder(label);
 		} catch {}
-		decoders.set(charset, decoder);
+		decoders.set(label, decoder);
 	}
 	return decoder;
 }
@@ -19849,16 +19880,21 @@ const utf8Decoder = new TextDecoder();
 * Finds the decoder for a charset label, or null when the runtime has no encoding for it
 */
 function findDecoder(charset) {
-	charset = (charset || "utf8").trim().toLowerCase();
-	const decoder = tryDecoder(charset);
-	if (decoder) return decoder;
-	const normalized = normalizeCharset(charset);
-	const codePage = normalized.match(codePagePattern);
-	return tryDecoder(codePage && codePageAliases.get(codePage[1]) || charsetAliases.get(normalized) || normalized);
+	const label = resolveLabel(charset);
+	return label ? tryDecoder(label) : null;
 }
 function getDecoder(charset) {
 	return findDecoder(charset) || tryDecoder("windows-1252") || utf8Decoder;
 }
+const UTF16_UNORDERED_LABELS = /* @__PURE__ */ new Set(["utf-16"]);
+/**
+* The byte order a UTF-16 byte order mark at the start of the bytes names, or null without one
+*/
+function bomByteOrder(bytes) {
+	if (bytes[0] === 254 && bytes[1] === 255) return "utf-16be";
+	if (bytes[0] === 255 && bytes[1] === 254) return "utf-16le";
+	return null;
+}
 /**
 * Whether the bytes are well formed UTF-8. A scan rather than a fatal TextDecoder, since
 * the exception one throws costs more than the decode itself and a message decides how
@@ -19912,8 +19948,14 @@ function decodeUtf8OrWindows1252(bytes, utf8 = utf8Decoder) {
 * @return Decoded text
 */
 function decodeCharset(bytes, charset) {
-	const decoder = findDecoder(charset);
-	return decoder ? decoder.decode(bytes) : decodeUtf8OrWindows1252(bytes);
+	const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+	const label = resolveLabel(charset);
+	let decoder = label ? tryDecoder(label) : null;
+	if (label && UTF16_UNORDERED_LABELS.has(label)) {
+		const order = bomByteOrder(view);
+		decoder = order && tryDecoder(order) || decoder;
+	}
+	return decoder ? decoder.decode(view) : decodeUtf8OrWindows1252(view);
 }
 /**
 * Numeric value of an ASCII hex digit
@@ -20033,7 +20075,7 @@ function splitEncodedWords(str) {
 function canJoinWords(left, right) {
 	const encoding = left.encoding.toUpperCase();
 	if (left.charset !== right.charset || encoding !== right.encoding.toUpperCase()) return false;
-	if (encoding === "B") return left.encodedText.length % 4 === 0 && !/=$/.test(left.encodedText);
+	if (encoding === "B") return left.encodedText.length % 4 === 0 && !left.padded;
 	return true;
 }
 /**
@@ -20060,13 +20102,15 @@ function renderTokens(tokens, joinWords) {
 		}
 		if (pending && joinWords && canJoinWords(pending, token)) {
 			pending.encodedText += token.encodedText;
+			pending.padded = token.encodedText.endsWith("=");
 			continue;
 		}
 		if (pending) result += decodeWord(pending.charset, pending.encoding, pending.encodedText);
 		pending = {
 			charset: token.charset,
 			encoding: token.encoding,
-			encodedText: token.encodedText
+			encodedText: token.encodedText,
+			padded: token.encodedText.endsWith("=")
 		};
 	}
 	if (pending) result += decodeWord(pending.charset, pending.encoding, pending.encodedText);
@@ -20085,7 +20129,86 @@ function decodeWords(str) {
 }
 new TextDecoder("utf-8", { ignoreBOM: true });
 //#endregion
-//#region ../../node_modules/.pnpm/postal-mime@4.0.5/node_modules/postal-mime/dist/esm/address-parser.js
+//#region ../../node_modules/.pnpm/postal-mime@4.1.4/node_modules/postal-mime/dist/esm/text-format.js
+const hexByte = (value) => value.toString(16).toUpperCase().padStart(2, "0");
+Array.from({ length: 256 }, (_, byte) => "%" + hexByte(byte));
+//#endregion
+//#region ../../node_modules/.pnpm/postal-mime@4.1.4/node_modules/postal-mime/dist/esm/address-parser.js
+/** The token is an operator, a text run otherwise */
+const TOKEN_OPERATOR = 1;
+/** The next character continues the same run without whitespace in between */
+const TOKEN_NO_BREAK = 2;
+/** The text run holds characters its value leaves out or changes, so it is no plain slice */
+const TOKEN_DIRTY = 4;
+/** A backslash escapes the next character in the text run, inside a quoted string or a comment */
+const TOKEN_ESCAPES = 8;
+/** The text run opens on a character an escaping backslash in front of it has escaped */
+const TOKEN_STARTS_ESCAPED = 16;
+/**
+* The tokens of an address field, kept as offsets into it.
+*
+* Every token used to be an object of its own, an operator for every ',' and a value string
+* for every run of text, and a list of one letter names, 'a,a,a,...', took some 65 times its
+* size in tokens before any address was read. A token is now three numbers in one typed
+* array, its kind and the range of the field it covers, and its value is sliced off the field
+* when it is read. The few text runs whose value differs from their slice, as they hold an
+* escaping backslash, a line break or a control character, are rebuilt once and kept aside.
+*/
+var TokenList = class {
+	constructor(str) {
+		this.str = str;
+		this.slots = /* @__PURE__ */ new Int32Array(48);
+		this.length = 0;
+		this.cleaned = /* @__PURE__ */ new Map();
+	}
+	/**
+	* Appends a token
+	*
+	* @param kind Kind and flags of the token
+	* @param start Offset of its first character
+	* @param end Offset just past its last character
+	* @return Index of the token
+	*/
+	push(kind, start, end) {
+		if ((this.length + 1) * 3 > this.slots.length) {
+			const grown = new Int32Array(this.slots.length * 2);
+			grown.set(this.slots);
+			this.slots = grown;
+		}
+		const at = this.length * 3;
+		this.slots[at] = kind;
+		this.slots[at + 1] = start;
+		this.slots[at + 2] = end;
+		return this.length++;
+	}
+	/**
+	* The character of an operator token, an empty string for a text run
+	*/
+	operatorAt(index) {
+		const at = index * 3;
+		return this.slots[at] & TOKEN_OPERATOR ? this.str.charAt(this.slots[at + 1]) : "";
+	}
+	/**
+	* Whether a token is an operator
+	*/
+	isOperator(index) {
+		return (this.slots[index * 3] & TOKEN_OPERATOR) !== 0;
+	}
+	/**
+	* Whether the next character continues the run of a token without whitespace in between
+	*/
+	noBreak(index) {
+		return (this.slots[index * 3] & TOKEN_NO_BREAK) !== 0;
+	}
+	/**
+	* Value of a token
+	*/
+	value(index) {
+		const cleaned = this.cleaned.get(index);
+		if (cleaned !== void 0) return cleaned;
+		return this.str.slice(this.slots[index * 3 + 1], this.slots[index * 3 + 2]);
+	}
+};
 /**
 * Any whitespace, the test for an angle-addr that needs recovering
 */
@@ -20100,6 +20223,23 @@ const QUOTED_LOCAL_ADDR = /^("(?:[^"\\]|\\[\s\S])*"@\S+)(?:\s+([\s\S]+))?$/;
 */
 const ADDR_SPEC = /^[^@\s]+@[^@\s]+$/;
 /**
+* The same with a domain literal for the domain, which may hold an '@' of its own
+*/
+const LITERAL_ADDR_SPEC = /^[^@\s]+@\[[^[\]\\\s]*\]$/;
+/**
+* The '@' and domain that follow a quoted local part in the same run
+*/
+const QUOTED_LOCAL_DOMAIN = /^@(?:[^@\s"]+|\[[^[\]\\\s]*\])$/;
+/**
+* Whether a whitespace free run reads as an addr-spec under the strict grammar
+*
+* @param value Run to check
+* @return true when it does
+*/
+function isAddrSpec(value) {
+	return ADDR_SPEC.test(value) || LITERAL_ADDR_SPEC.test(value);
+}
+/**
 * The looser reading applied once the strict one finds nothing, which tolerates the
 * further '@' that a domain should not have but malformed headers carry anyway
 */
@@ -20110,6 +20250,22 @@ const LOOSE_ADDR_SPEC = /^[^@\s]+@\S+$/;
 */
 const LOOSE_TEXT_ADDR = /\s*\b[^@\s]+@[^\s]+\b\s*/y;
 /**
+* A domain literal that ends an address. dtext includes '@' (RFC 5322 3.4.1), so the '@'
+* in front of the literal is the one that splits the domain off, not the last one: reading
+* 'a@[x@evil.com]' at its last '@' made it an address at evil.com.
+*/
+const DOMAIN_LITERAL_TAIL = /@(\[[^[\]\\]*\])$/;
+/**
+* Offset of the '@' that splits the domain off an address, or -1 when there is none
+*
+* @param address Address to split
+* @return Offset of the '@'
+*/
+function domainAt(address) {
+	const literal = address.charAt(address.length - 1) === "]" ? DOMAIN_LITERAL_TAIL.exec(address) : null;
+	return literal ? address.length - literal[1].length - 1 : address.lastIndexOf("@");
+}
+/**
 * Restores the quoting of a local part that was read out of a quoted string.
 *
 * RFC 5321 allows '@' inside a quoted local part, so handing '"user@evil.com"@good.com'
@@ -20122,7 +20278,7 @@ const LOOSE_TEXT_ADDR = /\s*\b[^@\s]+@[^\s]+\b\s*/y;
 * @return Address with the local part as a quoted-string
 */
 function quoteLocalPart(address) {
-	const lastAt = address.lastIndexOf("@");
+	const lastAt = domainAt(address);
 	if (lastAt < 0) return address;
 	const user = address.substring(0, lastAt);
 	if (/^[^\s"(),:;<>@[\\\]]+$/.test(user) || /^"(?:[^"\\]|\\[\s\S])*"$/.test(user)) return address;
@@ -20159,6 +20315,50 @@ function indexOfAt(text, from, to) {
 	return -1;
 }
 /**
+* A quoted-string a value opens with
+*/
+const LEADING_QUOTED_STRING = /^"(?:[^"\\]|\\[\s\S])*"/;
+/**
+* Drops the whitespace on either side of the '@' at an offset.
+*
+* obs-local-part and obs-domain allow CFWS around the '@' (RFC 5322 4.4), so 'user @ good.com'
+* names user@good.com. Kept, the whitespace became part of the address as '"user "@ good.com'.
+* The scan is by index, a pattern such as /\s+@/ backtracks over a long whitespace run that
+* no '@' follows.
+*
+* @param value Value holding the '@'
+* @param at Offset of the '@', or -1
+* @return The value with the whitespace beside that '@' removed
+*/
+function joinAtSpacing(value, at) {
+	if (at < 0) return value;
+	let start = at;
+	while (start > 0 && isSpaceCode(value.charCodeAt(start - 1))) start--;
+	let end = at + 1;
+	while (end < value.length && isSpaceCode(value.charCodeAt(end))) end++;
+	return start === at && end === at + 1 ? value : value.slice(0, start) + "@" + value.slice(end);
+}
+/**
+* Drops the whitespace beside the '@' that splits the domain off a value. That is the '@'
+* right after a quoted local part the value opens with, or else the only '@' it holds outside
+* any quoted string. With several it is not clear which one the whitespace belongs to, and
+* '<x@evil.com @good.com>' is left to the addr-spec recovery to read as it always has.
+*
+* @param value Value to clean up
+* @return The value with the whitespace beside that '@' removed
+*/
+function collapseAtSpacing(value) {
+	const quoted = LEADING_QUOTED_STRING.exec(value);
+	if (quoted) {
+		let at = quoted[0].length;
+		while (at < value.length && isSpaceCode(value.charCodeAt(at))) at++;
+		if (value.charAt(at) === "@" && value.indexOf("@", at + 1) < 0) return joinAtSpacing(value, at);
+	}
+	const at = value.indexOf("@");
+	if (at < 0 || value.indexOf("@", at + 1) >= 0 || value.lastIndexOf("\"") > at) return value;
+	return joinAtSpacing(value, at);
+}
+/**
 * Finds the offset LOOSE_TEXT_ADDR matches at, or -1 when it does not match at all.
 *
 * Letting the pattern search for itself is quadratic: '[^@\s]+' is retried from every
@@ -20229,6 +20429,7 @@ function looseAddressStart(text) {
 * @return The address and the display text, with any leftovers moved to the text
 */
 function recoverAddrSpec(address, text) {
+	address = collapseAtSpacing(address);
 	if (!HAS_WHITESPACE.test(address)) return {
 		address,
 		text
@@ -20248,7 +20449,7 @@ function recoverAddrSpec(address, text) {
 			text
 		};
 		const parts = address.split(/\s+/);
-		let addrIndex = parts.findIndex((part) => ADDR_SPEC.test(part));
+		let addrIndex = parts.findIndex(isAddrSpec);
 		if (addrIndex < 0) addrIndex = parts.findIndex((part) => LOOSE_ADDR_SPEC.test(part));
 		if (addrIndex < 0) return {
 			address,
@@ -20271,7 +20472,16 @@ function recoverAddrSpec(address, text) {
 * consumer stripping the comment reads as 'user@example.comevil.com'. A comment is folding
 * whitespace, so it is read as a space that splits two atoms and as nothing next to an '@',
 * the same rule the token walk applies outside the brackets. Quoted strings and domain
-* literals are copied through untouched, a '(' in there is not a comment.
+* literals are copied through untouched, a '(' in there is not a comment. An unexpected '<'
+* outside them drops everything in front of it, comments included.
+*
+* RFC 822 also let an angle-addr name the relays to go through in front of the mailbox,
+* '<@relay1,@relay2:user@example.com>', which RFC 5322 still parses as obs-route. The route
+* is not part of the mailbox, and folded into the local part it made
+* '"@relay1,@relay2:user"@example.com' a recipient that does not exist. A local part can not
+* start with '@', so contents that do, up to the first ':' outside a domain literal and in
+* front of any quoted string, are a route and are dropped, as long as a mailbox with an '@'
+* of its own follows.
 *
 * @param address Contents of the angle brackets
 * @return The address with the comments removed, and the text of the comments
@@ -20283,6 +20493,10 @@ function stripAddressComments(address) {
 	let depth = 0;
 	let closer = "";
 	let lastChar = "";
+	let pendingSpace = false;
+	let firstChar = "";
+	let quoteSeen = false;
+	let routeEnd = -1;
 	for (let i = 0, len = address.length; i < len; i++) {
 		const chr = address.charAt(i);
 		if (depth) {
@@ -20293,13 +20507,17 @@ function stripAddressComments(address) {
 			} else if (chr === ")" && !--depth) {
 				comments.push(comment.trim());
 				comment = "";
-				if (lastChar !== "@" && address.charAt(i + 1) !== "@") {
-					result += " ";
-					lastChar = " ";
-				}
+				pendingSpace = lastChar !== "@";
 			} else comment += chr;
 			continue;
 		}
+		if (pendingSpace && chr !== "(") {
+			pendingSpace = false;
+			if (chr !== "@" && chr !== "<" && !isSpaceCode(address.charCodeAt(i))) {
+				result += " ";
+				lastChar = " ";
+			}
+		}
 		if (closer) {
 			if (chr === "\\" && closer === "\"" && i < len - 1) {
 				result += chr + address.charAt(++i);
@@ -20307,15 +20525,28 @@ function stripAddressComments(address) {
 				continue;
 			}
 			if (chr === closer) closer = "";
-		} else if (chr === "\"") closer = "\"";
+		} else if (chr === "\"") {
+			closer = "\"";
+			quoteSeen = true;
+		} else if (chr === ":" && routeEnd < 0 && firstChar === "@" && !quoteSeen) routeEnd = result.length + 1;
 		else if (chr === "[") closer = "]";
 		else if (chr === "(") {
 			depth = 1;
 			continue;
+		} else if (chr === "<") {
+			result = "";
+			lastChar = "";
+			comments.length = 0;
+			firstChar = "";
+			quoteSeen = false;
+			routeEnd = -1;
+			continue;
 		}
 		result += chr;
 		lastChar = chr;
+		if (!firstChar && !isSpaceCode(address.charCodeAt(i))) firstChar = chr;
 	}
+	if (routeEnd >= 0 && result.indexOf("@", routeEnd) >= 0) result = result.slice(routeEnd);
 	if (depth) comments.push(comment.trim());
 	return {
 		address: result.trim(),
@@ -20323,62 +20554,36 @@ function stripAddressComments(address) {
 	};
 }
 /**
-* Checks whether text holds an angle bracket address, ie. `<` and `>` around a run
-* without other angle brackets that has an '@' with at least one character on each side.
-*
-* Same answer as `/<[^<>]+@[^<>]+>/.test(text)`, which backtracks quadratically on a `<`
-* followed by a long run of '@' and no closing `>`.
-*
-* @param text Text to check
-* @return true if an angle bracket address is present
-*/
-function hasAngleAddress(text) {
-	let start = -1;
-	let at = -1;
-	for (let i = 0; i < text.length; i++) {
-		const chr = text.charAt(i);
-		if (chr === "<") {
-			start = i + 1;
-			at = -1;
-		} else if (chr === ">") {
-			if (at >= 0 && at < i - 1) return true;
-			start = -1;
-			at = -1;
-		} else if (chr === "@" && start >= 0 && at < 0 && i > start) at = i;
-	}
-	return false;
-}
-/**
-* Converts tokens for a single address into an address object
+* Walks the tokens of one entry of an address list and sorts them into the runs of display
+* text, angle-addr and comment they belong to
 *
-* @param tokens Tokens object
-* @param depth Current recursion depth for nested group protection
-* @return Address objects
+* @param tokens Tokens of the whole address list
+* @param from Index of the first token of the entry
+* @param to Index just past the last token of the entry
+* @return The collected runs, and whether the display text came out of a comment
 */
-function _handleAddress(tokens, depth) {
-	let isGroup = false;
+function collectAddressParts(tokens, from, to) {
 	let state = "text";
-	let addresses = [];
 	let data = {
 		address: [],
 		comment: [],
-		group: [],
 		text: [],
-		textWasQuoted: []
+		textWasQuoted: [],
+		quotedLocalAt: []
 	};
+	let lastTextPureQuoted = false;
 	let i;
-	let len;
 	let insideQuotes = false;
 	const lastChars = {
 		address: "",
 		comment: "",
-		group: "",
 		text: ""
 	};
-	for (i = 0, len = tokens.length; i < len; i++) {
-		let token = tokens[i];
-		let prevToken = i ? tokens[i - 1] : null;
-		if (token.type === "operator") switch (token.value) {
+	for (i = from; i < to; i++) {
+		const value = tokens.value(i);
+		const prevOperator = i > from ? tokens.operatorAt(i - 1) : "";
+		const prevNoBreak = i > from && tokens.noBreak(i - 1);
+		if (tokens.isOperator(i)) switch (value) {
 			case "<":
 				state = "address";
 				insideQuotes = false;
@@ -20387,11 +20592,6 @@ function _handleAddress(tokens, depth) {
 				state = "comment";
 				insideQuotes = false;
 				break;
-			case ":":
-				state = "group";
-				isGroup = true;
-				insideQuotes = false;
-				break;
 			case "\"":
 				insideQuotes = !insideQuotes;
 				state = "text";
@@ -20400,108 +20600,132 @@ function _handleAddress(tokens, depth) {
 				state = "text";
 				insideQuotes = false;
 		}
-		else if (token.value) {
-			const prevPrevToken = i > 1 ? tokens[i - 2] : null;
-			const opensAfterEmptyQuotedString = prevToken?.type === "operator" && prevToken.value === "\"" && !!prevToken.noBreak && prevPrevToken?.type === "operator" && prevPrevToken.value === "\"";
-			if (state === "address") token.value = token.value.replace(/^[^<]*<\s*/, "");
-			if (prevToken && prevToken.noBreak && data[state].length && (prevToken.value !== ")" || lastChars[state] === "@" || token.value.charAt(0) === "@")) {
-				data[state][data[state].length - 1] += token.value;
-				if (state === "text" && insideQuotes) data.textWasQuoted[data.textWasQuoted.length - 1] = true;
+		else {
+			const opensAfterEmptyQuotedString = prevOperator === "\"" && prevNoBreak && i > from + 1 && tokens.operatorAt(i - 2) === "\"";
+			if (prevNoBreak && data[state].length && (prevOperator !== ")" || lastChars[state] === "@" || value.charAt(0) === "@")) {
+				const last = data[state].length - 1;
+				if (state === "text" && !insideQuotes) {
+					if (lastTextPureQuoted && value.charAt(0) === "@") data.quotedLocalAt[last] = data.text[last].length;
+					lastTextPureQuoted = false;
+				}
+				data[state][last] += value;
+				if (state === "text" && insideQuotes) data.textWasQuoted[last] = true;
 			} else {
-				data[state].push(token.value);
-				if (state === "text") data.textWasQuoted.push(insideQuotes || opensAfterEmptyQuotedString);
+				data[state].push(value);
+				if (state === "text") {
+					data.textWasQuoted.push(insideQuotes || opensAfterEmptyQuotedString);
+					data.quotedLocalAt.push(opensAfterEmptyQuotedString && value.charAt(0) === "@" ? 0 : -1);
+					lastTextPureQuoted = insideQuotes;
+				}
 			}
-			lastChars[state] = token.value.charAt(token.value.length - 1);
+			lastChars[state] = value.charAt(value.length - 1);
 		}
 	}
+	let textFromComment = false;
 	if (!data.text.length && data.comment.length) {
 		data.text = data.comment;
 		data.comment = [];
+		textFromComment = true;
 	}
-	if (isGroup) {
-		const text = data.text.join(" ");
-		let groupMembers = [];
-		if (data.group.length) parseAddressList$1(data.group.join(","), depth + 1).forEach((member) => {
-			if (member.group) for (const nestedMember of member.group) groupMembers.push(nestedMember);
-			else groupMembers.push(member);
-		});
-		addresses.push({
-			name: decodeWords(text),
-			group: groupMembers
-		});
-	} else {
-		const addressComments = [];
-		const addressParts = [];
-		for (const part of data.address) {
-			if (part.indexOf("(") < 0) {
-				addressParts.push(part);
-				continue;
-			}
-			const stripped = stripAddressComments(part);
-			for (const comment of stripped.comments) addressComments.push(comment);
-			if (stripped.address) addressParts.push(stripped.address);
-		}
-		data.address = addressParts;
-		if (!data.address.length && data.text.length) {
-			for (i = data.text.length - 1; i >= 0; i--) if (!data.textWasQuoted[i] && ADDR_SPEC.test(data.text[i])) {
-				data.address = data.text.splice(i, 1);
+	return {
+		data,
+		textFromComment
+	};
+}
+/**
+* Name of a group, from the tokens in front of its ':'. A comment names it when no text
+* does, as it names a mailbox.
+*
+* @param tokens Tokens of the whole address list
+* @param from Index of the first token in front of the ':'
+* @param to Index of the ':'
+* @return Decoded name of the group
+*/
+function groupName(tokens, from, to) {
+	return decodeWords(collectAddressParts(tokens, from, to).data.text.join(" "));
+}
+/**
+* Converts tokens for a single address into an address object
+*
+* @param tokens Tokens of the whole address list
+* @param from Index of the first token of this address
+* @param to Index just past the last token of this address
+* @return The address object
+*/
+function _handleAddress(tokens, from, to) {
+	const collected = collectAddressParts(tokens, from, to);
+	const data = collected.data;
+	let textFromComment = collected.textFromComment;
+	let i;
+	const addressComments = [];
+	const addressParts = [];
+	for (const part of data.address) {
+		const stripped = stripAddressComments(part);
+		for (const comment of stripped.comments) addressComments.push(comment);
+		if (stripped.address) addressParts.push(stripped.address);
+	}
+	data.address = addressParts;
+	if (!data.address.length && data.text.length && !textFromComment) {
+		const candidates = data.text.map((part) => collapseAtSpacing(part));
+		for (i = 0; i < data.text.length; i++) {
+			const local = data.quotedLocalAt[i];
+			const quotedLocal = data.textWasQuoted[i] && local >= 0 && QUOTED_LOCAL_DOMAIN.test(data.text[i].slice(local)) ? quoteLocalPart(data.text[i]) : "";
+			if (quotedLocal || !data.textWasQuoted[i] && isAddrSpec(candidates[i])) {
+				data.address = [quotedLocal || candidates[i]];
+				data.text.splice(i, 1);
 				data.textWasQuoted.splice(i, 1);
+				data.quotedLocalAt.splice(i, 1);
 				break;
 			}
-			if (!data.address.length) {
-				for (i = data.text.length - 1; i >= 0; i--) if (!data.textWasQuoted[i]) {
-					const part = data.text[i];
-					const start = looseAddressStart(part);
-					if (start >= 0) {
-						LOOSE_TEXT_ADDR.lastIndex = start;
-						const match = LOOSE_TEXT_ADDR.exec(part);
-						if (match) {
-							data.address = [match[0].trim()];
-							data.text[i] = (part.slice(0, start) + " " + part.slice(start + match[0].length)).trim();
-							break;
-						}
+		}
+		if (!data.address.length) {
+			for (i = 0; i < data.text.length; i++) if (!data.textWasQuoted[i]) {
+				const part = candidates[i];
+				const start = looseAddressStart(part);
+				if (start >= 0) {
+					LOOSE_TEXT_ADDR.lastIndex = start;
+					const match = LOOSE_TEXT_ADDR.exec(part);
+					if (match) {
+						data.address = [match[0].trim()];
+						data.text[i] = (part.slice(0, start) + " " + part.slice(start + match[0].length)).trim();
+						break;
 					}
-					data.text[i] = part.trim();
 				}
+				data.text[i] = data.text[i].trim();
 			}
 		}
-		if (!data.text.length && data.comment.length) {
-			data.text = data.comment;
-			data.comment = [];
-		}
-		if (data.address.length > 1) data.text = data.text.concat(data.address.splice(1));
-		const addressFromQuotedText = !data.address.length && data.textWasQuoted.some((wasQuoted) => wasQuoted);
-		let text = data.text.join(" ");
-		let addressValue = data.address.join(" ");
-		if (!addressValue && isEncodedWordsOnly(text.trim())) {
-			const decodedText = decodeWords(text);
-			if (!addressFromQuotedText && hasAngleAddress(decodedText)) {
-				const parsedSubAddresses = parseAddressList$1(decodedText, depth + 1);
-				if (parsedSubAddresses.length) return parsedSubAddresses;
-			}
-			return [{
-				address: "",
-				name: decodedText
-			}];
-		}
-		if (addressFromQuotedText && text.indexOf("@") >= 0) {
-			addressValue = quoteLocalPart(text);
-			text = "";
-		}
-		({address: addressValue, text} = recoverAddrSpec(addressValue, text));
-		if (!text && addressComments.length) text = addressComments.join(" ");
-		const rawName = text || addressValue || "";
-		const address = {
-			address: addressValue || text || "",
-			name: decodeWords(rawName)
-		};
-		if (address.address === rawName || address.address === address.name) {
-			if (address.address.match(/@/)) address.name = "";
-			else address.address = "";
-		}
-		addresses.push(address);
 	}
-	return addresses;
+	if (!data.text.length && data.comment.length) {
+		data.text = data.comment;
+		data.comment = [];
+	}
+	if (data.address.length > 1) data.text = data.text.concat(data.address.splice(1));
+	const addressFromQuotedText = !data.address.length && data.textWasQuoted.some((wasQuoted) => wasQuoted);
+	let text = data.text.join(" ");
+	let addressValue = data.address.join(" ");
+	if (!addressValue && isEncodedWordsOnly(text.trim())) return {
+		address: "",
+		name: decodeWords(text)
+	};
+	if (addressFromQuotedText && text.indexOf("@") >= 0) {
+		addressValue = quoteLocalPart(joinAtSpacing(text, domainAt(text)));
+		text = "";
+	}
+	({address: addressValue, text} = recoverAddrSpec(addressValue, text));
+	if (!text && addressComments.length) {
+		text = addressComments.join(" ");
+		textFromComment = true;
+	}
+	const rawName = text || addressValue || "";
+	const address = {
+		address: addressValue || (textFromComment ? "" : text) || "",
+		name: decodeWords(rawName)
+	};
+	if (address.address === rawName || address.address === address.name) {
+		if (address.address.match(/@/)) address.name = "";
+		else address.address = "";
+	}
+	return address;
 }
 /**
 * Tokenizer for address field strings
@@ -20514,17 +20738,22 @@ var Tokenizer$2 = class {
 		this.str = (str || "").toString();
 		this.operatorCurrent = "";
 		this.operatorExpecting = "";
-		this.node = null;
+		this.node = -1;
 		this.escaped = false;
 		this.inDomainLiteral = false;
 		this.afterAt = false;
-		this.list = [];
+		this.inGroup = false;
+		this.innerQuoted = false;
+		this.innerComment = 0;
+		this.innerLiteral = false;
+		this.innerEscaped = false;
+		this.list = new TokenList(this.str);
 		this.operators = {
 			"\"": "\"",
 			"(": ")",
 			"<": ">",
 			",": "",
-			":": ";",
+			":": "",
 			";": ""
 		};
 	}
@@ -20534,115 +20763,259 @@ var Tokenizer$2 = class {
 	* @return An array of operator|text tokens
 	*/
 	tokenize() {
-		let list = [];
-		for (let i = 0, len = this.str.length; i < len; i++) {
-			let chr = this.str.charAt(i);
-			let nextChr = i < len - 1 ? this.str.charAt(i + 1) : null;
-			this.checkChar(chr, nextChr);
-		}
-		this.list.forEach((node) => {
-			node.value = (node.value || "").toString().trim();
-			if (node.value) list.push(node);
-		});
+		const str = this.str;
+		const len = str.length;
+		for (let i = 0; i < len; i++) this.checkChar(str.charAt(i), i);
+		this.closeText(len);
+		const list = this.list;
+		const slots = list.slots;
+		let kept = 0;
+		for (let i = 0, count = list.length; i < count; i++) {
+			const kind = slots[i * 3];
+			let start = slots[i * 3 + 1];
+			let end = slots[i * 3 + 2];
+			if (kind & TOKEN_DIRTY) {
+				const value = this.cleanValue(start, end, kind).trim();
+				if (!value) continue;
+				list.cleaned.set(kept, value);
+			} else if (!(kind & TOKEN_OPERATOR)) {
+				while (start < end && isSpaceCode(str.charCodeAt(start))) start++;
+				while (end > start && isSpaceCode(str.charCodeAt(end - 1))) end--;
+				if (start === end) continue;
+			}
+			slots[kept * 3] = kind;
+			slots[kept * 3 + 1] = start;
+			slots[kept * 3 + 2] = end;
+			kept++;
+		}
+		list.length = kept;
 		return list;
 	}
 	/**
+	* Ends the text run being collected, if there is one
+	*
+	* @param end Offset just past its last character
+	*/
+	closeText(end) {
+		if (this.node >= 0) {
+			this.list.slots[this.node * 3 + 2] = end;
+			this.node = -1;
+		}
+	}
+	/**
+	* Rebuilds the value of a text run that is no plain slice of the field, applying the
+	* rules checkChar collects characters by: an escaping backslash is dropped, a line break
+	* reads as a space and any other control character is left out
+	*
+	* @param start Offset of the first character of the run
+	* @param end Offset just past its last character
+	* @param kind Kind and flags of the run
+	* @return Value of the run
+	*/
+	cleanValue(start, end, kind) {
+		const str = this.str;
+		const escapes = (kind & TOKEN_ESCAPES) !== 0;
+		let escaped = (kind & TOKEN_STARTS_ESCAPED) !== 0;
+		let value = "";
+		for (let i = start; i < end; i++) {
+			const chr = str.charAt(i);
+			if (escapes && !escaped && chr === "\\") {
+				escaped = true;
+				continue;
+			}
+			escaped = false;
+			if (chr === "\n") value += " ";
+			else if (chr.charCodeAt(0) >= 33 || chr === " " || chr === "	") value += chr;
+		}
+		return value;
+	}
+	/**
 	* Checks if a character is an operator or text and acts accordingly
 	*
 	* @param chr Character from the address field
-	* @param nextChr The character that follows, or null at the end of the field
+	* @param i Offset of the character in the field
 	*/
-	checkChar(chr, nextChr) {
+	checkChar(chr, i) {
 		if (!this.escaped && !this.operatorExpecting) {
 			if (!this.inDomainLiteral && chr === "[" && this.afterAt) this.inDomainLiteral = true;
 			else if (this.inDomainLiteral && (chr === "]" || chr === "," || chr === ";")) this.inDomainLiteral = false;
 		}
-		if (this.escaped) {} else if (chr === this.operatorExpecting) {
-			this.node = {
-				type: "operator",
-				value: chr
-			};
-			if (nextChr && ![
+		let nested = false;
+		if (this.operatorExpecting === ">") {
+			nested = this.trackInner(chr);
+			if (!nested && chr === ";" && this.inGroup) {
+				this.closeText(i);
+				this.operatorExpecting = "";
+				this.resetInner();
+			}
+		} else if (this.operatorExpecting === ")" && !this.escaped) {
+			if (chr === "(") this.innerComment++;
+			else if (chr === ")" && this.innerComment) {
+				this.innerComment--;
+				nested = true;
+			}
+		}
+		if (this.escaped) {} else if (chr === this.operatorExpecting && !nested) {
+			const nextChr = this.str.charAt(i + 1);
+			this.closeText(i);
+			this.list.push(nextChr && ![
 				" ",
 				"	",
 				"\r",
 				"\n",
 				",",
 				";"
-			].includes(nextChr)) this.node.noBreak = true;
-			this.list.push(this.node);
-			this.node = null;
+			].includes(nextChr) ? 3 : TOKEN_OPERATOR, i, i + 1);
 			if (chr !== ")") this.afterAt = false;
 			this.operatorExpecting = "";
 			this.escaped = false;
+			this.resetInner();
 			return;
 		} else if (!this.operatorExpecting && !(this.inDomainLiteral && chr === ":") && chr in this.operators) {
-			this.node = {
-				type: "operator",
-				value: chr
-			};
-			this.list.push(this.node);
-			this.node = null;
+			this.closeText(i);
+			this.list.push(TOKEN_OPERATOR, i, i + 1);
+			if (chr === ":") this.inGroup = true;
+			else if (chr === ";") this.inGroup = false;
 			if (chr !== "(") this.afterAt = false;
 			this.operatorExpecting = this.operators[chr];
 			this.escaped = false;
+			this.resetInner();
 			return;
 		} else if ((this.operatorExpecting === "\"" || this.operatorExpecting === ")") && chr === "\\") {
 			this.escaped = true;
+			if (this.node >= 0) this.list.slots[this.node * 3] |= TOKEN_DIRTY;
 			return;
 		}
-		if (!this.node) {
-			this.node = {
-				type: "text",
-				value: ""
-			};
-			this.list.push(this.node);
+		if (this.node < 0) this.node = this.list.push((this.operatorExpecting === "\"" || this.operatorExpecting === ")" ? TOKEN_ESCAPES : 0) | (this.escaped ? TOKEN_STARTS_ESCAPED : 0), i, i);
+		if (chr === "\n") {
+			chr = " ";
+			this.list.slots[this.node * 3] |= TOKEN_DIRTY;
 		}
-		if (chr === "\n") chr = " ";
-		if (chr.charCodeAt(0) >= 33 || [" ", "	"].includes(chr)) {
-			this.node.value += chr;
+		if (chr.charCodeAt(0) >= 33 || chr === " " || chr === "	") {
 			if (!this.operatorExpecting && chr !== " " && chr !== "	") this.afterAt = chr === "@";
-		}
+		} else this.list.slots[this.node * 3] |= TOKEN_DIRTY;
 		this.escaped = false;
 	}
+	/**
+	* Tracks the quoted strings, comments and domain literals inside an angle-addr, which its
+	* closer must not be read from. A backslash escapes the next character inside a quoted
+	* string and a comment. A domain literal opens right after an "@" and ends at the "]".
+	* dtext holds the list separators as well, and inside the brackets they never split the
+	* list anyway.
+	*
+	* @param chr Character from the address field
+	* @return true while the character sits inside one of them, the one that closes it included
+	*/
+	trackInner(chr) {
+		if (this.innerEscaped) {
+			this.innerEscaped = false;
+			return true;
+		}
+		if (this.innerQuoted) {
+			if (chr === "\\") this.innerEscaped = true;
+			else if (chr === "\"") this.innerQuoted = false;
+			return true;
+		}
+		if (this.innerComment) {
+			if (chr === "\\") this.innerEscaped = true;
+			else if (chr === "(") this.innerComment++;
+			else if (chr === ")") this.innerComment--;
+			return true;
+		}
+		if (this.innerLiteral) {
+			if (chr === "]") this.innerLiteral = false;
+			return true;
+		}
+		if (chr === "\"") {
+			this.innerQuoted = true;
+			return true;
+		}
+		if (chr === "(") {
+			this.innerComment = 1;
+			return true;
+		}
+		if (chr === "[" && this.afterAt) {
+			this.innerLiteral = true;
+			return true;
+		}
+		if (!isSpaceCode(chr.charCodeAt(0))) this.afterAt = chr === "@";
+		return false;
+	}
+	/**
+	* Forgets the nesting collected for the operator that just opened or ended
+	*/
+	resetInner() {
+		this.innerQuoted = false;
+		this.innerComment = 0;
+		this.innerLiteral = false;
+		this.innerEscaped = false;
+	}
 };
 /**
-* Maximum recursion depth for parsing nested groups.
-* RFC 5322 doesn't allow nested groups, so this is a safeguard against
-* malicious input that could cause stack overflow.
+* Folds the fragments an unquoted display name holding a comma is split into back together.
+*
+* "Joe Foo, PhD <joe@example.com>" is split on the comma into
+* [{name:"Joe Foo", address:""}, {name:"PhD", address:"joe@example.com"}]. A name-only entry
+* followed by an entry with both name and address is recombined. Walked back to front so
+* that a run of fragments folds into one entry in a single pass. Splicing each fragment out
+* of the list instead would be quadratic.
+*
+* @param list Parsed entries, in order
+* @return The entries with the fragments folded in
 */
-const MAX_NESTED_GROUP_DEPTH = 50;
+function mergeNameFragments(list) {
+	const merged = [];
+	for (let i = list.length - 1; i >= 0; i--) {
+		const current = list[i];
+		const next = merged.length ? merged[merged.length - 1] : null;
+		if (next && current.address === "" && current.name && !current.group && next.address && next.name) next.name = current.name + ", " + next.name;
+		else merged.push(current);
+	}
+	return merged.reverse();
+}
 /**
-* Parses an address list, recursing into groups. The depth is threaded through the
-* calls rather than taken from an option, so a caller supplied options object can not
-* seed it and lift the recursion limit.
+* Parses an address list, groups included, in a single pass over its tokens.
+*
+* A group used to be cut out of the field at the ';' that ends it and parsed again as an
+* address list of its own, recursively, so every level of nesting parsed what was left of
+* the field once more. RFC 5322 does not nest groups at all, and the nested ones were
+* flattened anyway. The tokens are now walked once: a ':' opens a group, its members are
+* read as they come, a ';' closes it. A ':' inside an open group stands for a group nested
+* in it, whose name is dropped and whose members belong to the outer one, and the first ';'
+* ends the group, nested or not, as before.
 *
 * @param str Address field
-* @param depth Current recursion depth for nested group protection
 * @return An array of address objects
 */
-function parseAddressList$1(str, depth) {
-	if (depth > MAX_NESTED_GROUP_DEPTH) return [];
-	let tokens = new Tokenizer$2(str).tokenize();
-	let addresses = [];
-	let address = [];
+function parseAddressList$1(str) {
+	const tokens = new Tokenizer$2(str).tokenize();
 	const parsedAddresses = [];
-	tokens.forEach((token) => {
-		if (token.type === "operator" && (token.value === "," || token.value === ";")) {
-			if (address.length) addresses.push(address);
-			address = [];
-		} else address.push(token);
-	});
-	if (address.length) addresses.push(address);
-	for (const tokens of addresses) for (const address of _handleAddress(tokens, depth)) parsedAddresses.push(address);
-	const mergedAddresses = [];
-	for (let i = parsedAddresses.length - 1; i >= 0; i--) {
-		const current = parsedAddresses[i];
-		const next = mergedAddresses.length ? mergedAddresses[mergedAddresses.length - 1] : null;
-		if (next && current.address === "" && current.name && !current.group && next.address && next.name) next.name = current.name + ", " + next.name;
-		else mergedAddresses.push(current);
+	let group = null;
+	let members = [];
+	let from = 0;
+	for (let i = 0, len = tokens.length; i <= len; i++) {
+		const operator = i < len ? tokens.operatorAt(i) : "";
+		if (i < len && operator !== "," && operator !== ";" && operator !== ":") continue;
+		if (operator === ":") {
+			if (!group) {
+				group = {
+					name: groupName(tokens, from, i),
+					group: []
+				};
+				members = [];
+			}
+			from = i + 1;
+			continue;
+		}
+		if (i > from) (group ? members : parsedAddresses).push(_handleAddress(tokens, from, i));
+		from = i + 1;
+		if (group && (operator === ";" || i === len)) {
+			group.group = mergeNameFragments(members);
+			parsedAddresses.push(group);
+			group = null;
+		}
 	}
-	return mergedAddresses.reverse();
+	return mergeNameFragments(parsedAddresses);
 }
 /**
 * Parses structured e-mail addresses from an address field
@@ -20660,7 +21033,7 @@ function parseAddressList$1(str, depth) {
 * @return An array of address objects
 */
 function addressParser(str, options) {
-	const parsedAddresses = parseAddressList$1(str, 0);
+	const parsedAddresses = parseAddressList$1(str);
 	if (options && options.flatten) {
 		let addresses = [];
 		let walkAddressList = (list) => {