@rackbops/ac-agent 2.0.0-alpha.42 → 2.0.0-alpha.44

package/dist/ac-agent.mjs

@@ -47,7 +47,7 @@ function _mergeNamespaces(n, m) {
 }
 
 var name = "@rackbops/ac-agent";
-var version = "2.0.0-alpha.42";
+var version = "2.0.0-alpha.44";
 var type = "module";
 var description = "The per-machine host agent (installed with npx @rackbops/ac-agent): an HTTPS health server plus install/status/uninstall for a Windows logon task or a systemd user unit.";
 var bin = {
@@ -73,7 +73,7 @@ var dependencies = {
 	"@hono/node-server": "^2.1.3",
 	hono: "^4.13.11",
 	selfsigned: "^5.0.0",
-	"smol-toml": "^1.0.0",
+	"smol-toml": "^1.9.0",
 	yaml: "^2.9.1"
 };
 var devDependencies = {
@@ -447,134 +447,6 @@ function createClaudeDesktopWatch(deps, hooks = {}, opts = {}) {
     return { current: () => held, refresh, start };
 }
 
-/*!
- * Copyright (c) Squirrel Chat et al., All rights reserved.
- * SPDX-License-Identifier: BSD-3-Clause
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright notice, this
- *    list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright notice,
- *    this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the copyright holder nor the names of its contributors
- *    may be used to endorse or promote products derived from this software without
- *    specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
- * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-let DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[T ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|[-+]\d{2}:\d{2})?$/i;
-class TomlDate extends Date {
-    #hasDate = false;
-    #hasTime = false;
-    #offset = null;
-    constructor(date) {
-        let hasDate = true;
-        let hasTime = true;
-        let offset = 'Z';
-        if (typeof date === 'string') {
-            let match = date.match(DATE_TIME_RE);
-            if (match) {
-                if (!match[1]) {
-                    hasDate = false;
-                    date = `0000-01-01T${date}`;
-                }
-                hasTime = !!match[2];
-                // Make sure to use T instead of a space. Breaks in case of extreme values otherwise.
-                hasTime && date[10] === ' ' && (date = date.replace(' ', 'T'));
-                // Do not allow rollover hours.
-                if (match[2] && +match[2] > 23) {
-                    date = '';
-                }
-                else {
-                    offset = match[3] || null;
-                    date = date.toUpperCase();
-                    if (!offset && hasTime)
-                        date += 'Z';
-                }
-            }
-            else {
-                date = '';
-            }
-        }
-        super(date);
-        if (!isNaN(this.getTime())) {
-            this.#hasDate = hasDate;
-            this.#hasTime = hasTime;
-            this.#offset = offset;
-        }
-    }
-    isDateTime() {
-        return this.#hasDate && this.#hasTime;
-    }
-    isLocal() {
-        return !this.#hasDate || !this.#hasTime || !this.#offset;
-    }
-    isDate() {
-        return this.#hasDate && !this.#hasTime;
-    }
-    isTime() {
-        return this.#hasTime && !this.#hasDate;
-    }
-    isValid() {
-        return this.#hasDate || this.#hasTime;
-    }
-    toISOString() {
-        let iso = super.toISOString();
-        // Local Date
-        if (this.isDate())
-            return iso.slice(0, 10);
-        // Local Time
-        if (this.isTime())
-            return iso.slice(11, 23);
-        // Local DateTime
-        if (this.#offset === null)
-            return iso.slice(0, -1);
-        // Offset DateTime
-        if (this.#offset === 'Z')
-            return iso;
-        // This part is quite annoying: JS strips the original timezone from the ISO string representation
-        // Instead of using a "modified" date and "Z", we restore the representation "as authored"
-        let offset = (+(this.#offset.slice(1, 3)) * 60) + +(this.#offset.slice(4, 6));
-        offset = this.#offset[0] === '-' ? offset : -offset;
-        let offsetDate = new Date(this.getTime() - (offset * 60e3));
-        return offsetDate.toISOString().slice(0, -1) + this.#offset;
-    }
-    static wrapAsOffsetDateTime(jsDate, offset = 'Z') {
-        let date = new TomlDate(jsDate);
-        date.#offset = offset;
-        return date;
-    }
-    static wrapAsLocalDateTime(jsDate) {
-        let date = new TomlDate(jsDate);
-        date.#offset = null;
-        return date;
-    }
-    static wrapAsLocalDate(jsDate) {
-        let date = new TomlDate(jsDate);
-        date.#hasTime = false;
-        date.#offset = null;
-        return date;
-    }
-    static wrapAsLocalTime(jsDate) {
-        let date = new TomlDate(jsDate);
-        date.#hasDate = false;
-        date.#offset = null;
-        return date;
-    }
-}
-
 /*!
  * Copyright (c) Squirrel Chat et al., All rights reserved.
  * SPDX-License-Identifier: BSD-3-Clause
@@ -603,11 +475,11 @@ class TomlDate extends Date {
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 function getLineColFromPtr(string, ptr) {
-    let lines = string.slice(0, ptr).split(/\r\n|\n|\r/g);
+    let lines = string.slice(0, ptr).split(/\r?\n/);
     return [lines.length, lines.pop().length + 1];
 }
 function makeCodeBlock(string, line, column) {
-    let lines = string.split(/\r\n|\n|\r/g);
+    let lines = string.split(/\r?\n/);
     let codeblock = '';
     let numberLen = (Math.log10(line + 1) | 0) + 1;
     for (let i = line - 1; i <= line + 1; i++) {
@@ -637,95 +509,10 @@ class TomlError extends Error {
         this.column = column;
         this.codeblock = codeblock;
     }
-}
-
-/*!
- * Copyright (c) Squirrel Chat et al., All rights reserved.
- * SPDX-License-Identifier: BSD-3-Clause
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright notice, this
- *    list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright notice,
- *    this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the copyright holder nor the names of its contributors
- *    may be used to endorse or promote products derived from this software without
- *    specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
- * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-/** @internal */
-function indexOfNewline(str, start = 0) {
-    let idx = str.indexOf('\n', start);
-    if (str.charCodeAt(idx - 1) === 0xd /* \r */)
-        idx--;
-    return idx;
-}
-/** @internal */
-function skipComment$1(ctx) {
-    for (; ctx.p < ctx.s.length; ctx.p++) {
-        let c = ctx.s.charCodeAt(ctx.p);
-        if (c === 0xa /* \n */)
-            break;
-        if (c === 0xd /* \r */ && ctx.s.charCodeAt(ctx.p + 1) === 0xa /* \n */) {
-            ctx.p++;
-            break;
-        }
-        if ((c < 0x20 && c !== 0x9 /* \t */) || c === 0x7f) {
-            throw new TomlError('control characters are not allowed in comments', {
-                toml: ctx.s,
-                ptr: ctx.p,
-            });
-        }
-    }
-}
-/** @internal */
-function skipVoid(ctx, banNewLines, banComments) {
-    let c;
-    while (1) {
-        while ((c = ctx.s.charCodeAt(ctx.p)) === 0x20 ||
-            c === 0x9 /* \t */ ||
-            (!banNewLines &&
-                (c === 0xa /* \n */ || (c === 0xd /* \r */ && ctx.s.charCodeAt(ctx.p + 1) === 0xa /* \n */))))
-            ctx.p++;
-        if (banComments || c !== 0x23 /* # */)
-            break;
-        skipComment$1(ctx);
-    }
-}
-/** @internal */
-function skipUntil(ctx, sep, end) {
-    let ptr = ctx.p;
-    if (!end) {
-        ptr = indexOfNewline(ctx.s, ptr);
-        ctx.p = ptr < 0 ? ctx.s.length : ptr;
-        return;
-    }
-    for (; ctx.p < ctx.s.length; ctx.p++) {
-        let c = ctx.s.charCodeAt(ctx.p);
-        if (c === 0x23 /* # */) {
-            skipComment$1(ctx);
-        }
-        else if (c === end || c === sep) {
-            return;
-        }
+    /** @internal */
+    static x(message, ctx, ptr) {
+        throw new TomlError(message, { toml: ctx.s, ptr: ptr ?? ctx.p });
     }
-    throw new TomlError('cannot find end of structure', {
-        toml: ctx.s,
-        ptr,
-    });
 }
 
 /*!
@@ -755,13 +542,9 @@ function skipUntil(ctx, sep, end) {
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
-// let CTRL_REGEX = /[\x00-\x08\x0f-\x1f\x7f]/
-let INT_REGEX = /^((0x[0-9a-fA-F](_?[0-9a-fA-F])*)|(([+-]|0[ob])?\d(_?\d)*))$/;
-let FLOAT_REGEX = /^[+-]?\d(_?\d)*(\.\d(_?\d)*)?([eE][+-]?\d(_?\d)*)?$/;
-let LEADING_ZERO = /^[+-]?0[0-9_]/;
 /** @internal */
 function parseString(ctx) {
-    let start = ctx.p;
+    let startPtr = ctx.p;
     let c = ctx.s.charCodeAt(ctx.p++);
     let first = c;
     let isLiteral = c === 0x27; /* ' */
@@ -773,37 +556,8 @@ function parseString(ctx) {
         else if (c === 0xd /* \r */ && ctx.s.charCodeAt(ctx.p + 1) === 0xa /* \n */)
             ctx.p += 2;
     }
-    /*
-    The fast path does not seem to bring significant performance gains, so it's commented out.
-    Kept for reference and/or future fafoing.
-
-    Without: spec  5.08 µs/iter    3.88 ipc (99.44% cache)   23.90 branch misses   28.61k cycles    111.01k instructions
-             5MB   115.73 ms/iter  2.51 ipc (98.36% cache)   3.12M branch misses   619.30M cycles   1.56G instructions
-
-    With:    spec  5.09 µs/iter    3.90 ipc (99.46% cache)   24.42 branch misses   28.57k cycles    111.49k instructions
-             5MB   113.89 ms/iter  2.47 ipc (98.38% cache)   3.12M branch misses   611.94M cycles   1.51G instructions
-
-    if (c === "'") {
-        // Literal strings fast path - no transform needs to occur; just grab the str and that's it
-        let endPtr = str.indexOf(isMultiline ? "'''" : "'", ptr)
-        if (endPtr < 0) {
-            throw new TomlError("unfinished string literal", { toml: str, ptr })
-        }
-
-        if (isMultiline) {
-            // If the string ends with 4-5 quotes, then the first 1-2 are part of the string
-            if (str[endPtr + 3] === "'") endPtr++
-            if (str[endPtr + 3] === "'") endPtr++
-        }
-
-        let string = str.slice(ptr, endPtr)
-        if (CTRL_REGEX.test(string)) {
-            let match = string.match(CTRL_REGEX)!
-            throw new TomlError('control characters are not allowed in strings', { toml: str, ptr: ptr + (match.index ?? 0) })
-        }
-        return [string, endPtr + (isMultiline ? 3 : 1)]
-    }
-    */
+    // For the record: it is not worth it to use a fast-path for literal strings using `indexOf`.
+    // Doing a char-by-char iteration ends up dispatching less instructions, for the same wall-clock runtime.
     let parsed = '';
     let sliceStart = ctx.p;
     // states:
@@ -820,10 +574,7 @@ function parseString(ctx) {
         }
         // Control characters are banned in TOML, so we throw an error if we encounter them
         else if ((c < 0x20 && c !== 0x9 /* \t */) || c === 0x7f) {
-            throw new TomlError('control characters are not allowed in strings', {
-                toml: ctx.s,
-                ptr: ctx.p,
-            });
+            TomlError.x('control characters are not allowed in strings', ctx);
         }
         // The string might terminate while we're parsing through a newline escape.
         // It must have encountered a newline; otherwise, it'll simply fail in another branch.
@@ -836,11 +587,15 @@ function parseString(ctx) {
                     ctx.p++;
             }
             // If we're in a newline escape still, then there's nothing to add.
-            if (!state)
-                parsed += ctx.s.slice(sliceStart, ctx.p);
+            if (!state) {
+                // Avoid a useless concat operation if the string can be used as-is.
+                let s = ctx.s.slice(sliceStart, ctx.p);
+                parsed = parsed ? parsed + s : s;
+            }
             ctx.p += isMultiline ? 3 : 1;
             return parsed;
         }
+        // Baseline state; keep moving forward unless an escape sequence starts
         else if (!state) {
             if (!isLiteral && c === 0x5c /* \ */) {
                 parsed += ctx.s.slice(sliceStart, (sliceStart = ctx.p));
@@ -849,29 +604,32 @@ function parseString(ctx) {
         }
         else if (state === 1) {
             if (c === 0x78 /* x */ || c === 0x75 /* u */ || c === 0x55 /* U */) { // Unicode escape
+                let errPtr = ctx.p++ - 1;
                 let value = 0;
                 let len = c === 0x78 /* x */ ? 2 : c === 0x75 /* u */ ? 4 : 8;
                 for (let j = 0; j < len; j++, ctx.p++) {
-                    let hex = ctx.s.charCodeAt(ctx.p + 1);
+                    let hex = ctx.s.charCodeAt(ctx.p);
                     let digit = 
                     /* 0-9 */ hex >= 0x30 && hex <= 0x39 ? hex - 0x30 :
                         /* A-F */ hex >= 0x41 && hex <= 0x46 ? hex - 0x41 + 10 :
                             /* a-f */ hex >= 0x61 && hex <= 0x66 ? hex - 0x61 + 10 : -1;
                     if (digit < 0)
-                        throw new TomlError('invalid non-hex character in unicode escape', { toml: ctx.s, ptr: ctx.p + 1 });
+                        TomlError.x('invalid non-hex character in unicode escape', ctx);
                     value = (value << 4) | digit;
                 }
                 // Because JS does bitwise on signed 32bit integers, all 0xfzzzzzzz values are actually seen as negative
                 if (value < 0 || value > 0x10ffff || (value >= 0xd800 && value <= 0xdfff)) {
-                    throw new TomlError('invalid unicode escape', { toml: ctx.s, ptr: ctx.p });
+                    TomlError.x('invalid unicode escape', ctx, errPtr);
                 }
                 parsed += String.fromCodePoint(value);
-                sliceStart = ctx.p + 1;
+                sliceStart = ctx.p--;
                 state = 0;
             }
-            else if (c === 0x20 || c === 0x9 /* \t */) { // If it was a newline, it'd have been handled earlier
+            // Newline escape sequence. We only need to care about spaces and tabs; newlines are dealt with earlier
+            else if (isMultiline && (c === 0x20 || c === 0x9 /* \t */)) {
                 state = 2;
             }
+            // Basic escape sequence
             else {
                 if (c === 0x62 /* b */)
                     parsed += '\b';
@@ -890,78 +648,179 @@ function parseString(ctx) {
                 else if (c === 0x5c /* \ */)
                     parsed += '\\';
                 else
-                    throw new TomlError('unrecognized escape sequence', { toml: ctx.s, ptr: ctx.p });
+                    TomlError.x('unrecognised escape sequence', ctx);
                 sliceStart = ctx.p + 1;
                 state = 0;
             }
         }
+        // Newline escape continuation: keep moving forward until the first non-whitespace char
         else if (c !== 0x20 && c !== 0x9 /* \t */) {
-            if (state === 2) {
-                throw new TomlError('invalid escape: only line-ending whitespace may be escaped', {
-                    toml: ctx.s,
-                    ptr: sliceStart,
-                });
-            }
+            if (state === 2)
+                TomlError.x('invalid escape: only line-ending whitespace may be escaped', ctx, sliceStart);
             // State cannot be zero, or we'd have branched earlier already.
             // If it's a backslash, immediately transition to the escape state so it can be processed.
             state = !isLiteral && c === 0x5c /* \ */ ? 1 : 0;
             sliceStart = ctx.p;
         }
     }
-    throw new TomlError('unfinished string', { toml: ctx.s, ptr: start });
-}
-function sliceAndTrimEndOf(ctx, start, end) {
-    let value = ctx.s.slice(start, end);
-    let commentIdx = value.indexOf('#');
-    if (commentIdx > 0) {
-        // The call to skipComment allows to "validate" the comment
-        // (absence of control characters)
-        skipComment$1({ s: value, p: commentIdx});
-        value = value.slice(0, commentIdx);
-    }
-    return value.trimEnd();
+    TomlError.x('unfinished string', ctx, startPtr);
 }
-/** @internal */
-function parseValue(ctx, integersAsBigInt, end) {
-    let ptr = ctx.p;
-    let err = { toml: ctx.s, ptr };
-    skipUntil(ctx, 0x2c /* , */, end);
-    let value = sliceAndTrimEndOf(ctx, ptr, ctx.p);
-    if (!value)
-        throw new TomlError('incomplete declaration: value expected', err);
-    if (value === '-inf')
-        return -Infinity;
-    if (value === 'inf' || value === '+inf')
-        return Infinity;
-    if (value === 'nan' || value === '+nan' || value === '-nan')
-        return NaN;
-    // Avoid FP representation of -0
-    if (value === '-0')
-        return integersAsBigInt ? 0n : 0;
-    // Numbers
-    let isInt = INT_REGEX.test(value);
-    if (isInt || FLOAT_REGEX.test(value)) {
-        if (LEADING_ZERO.test(value)) {
-            throw new TomlError('leading zeroes are not allowed', err);
-        }
-        value = value.replace(/_/g, '');
-        let numeric = +value;
-        if (isNaN(numeric)) {
-            throw new TomlError('invalid number', err);
-        }
-        if (isInt) {
-            if ((isInt = !Number.isSafeInteger(numeric)) && !integersAsBigInt) {
-                throw new TomlError('integer value cannot be represented losslessly', err);
+
+/*!
+ * Copyright (c) Squirrel Chat et al., All rights reserved.
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the copyright holder nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+let DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[Tt ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|z|[-+]\d{2}:\d{2})?$/i;
+class TomlDate extends Date {
+    #hasDate = false;
+    #hasTime = false;
+    #offset = null;
+    constructor(date, fasttype, unsafeDelim) {
+        let hasDate = true;
+        let hasTime = true;
+        let offset = 'Z';
+        let c;
+        if (typeof date === 'string') {
+            if (fasttype)
+                prep: {
+                    // Date-time
+                    if (fasttype < 3) {
+                        if (+date.slice(11, 13) > 23) {
+                            date = '';
+                            break prep;
+                        }
+                        // Local
+                        if (fasttype === 2) {
+                            offset = null;
+                            date += 'Z';
+                        }
+                        // Offset; keep track of offset if not Z
+                        else if ((c = date.charCodeAt(date.length - 1)) !== 0x5a /* Z */ && c !== 0x7a /* z */) {
+                            offset = date.slice(date.length - 6);
+                        }
+                        if (unsafeDelim)
+                            date = date.slice(0, 10) + 'T' + date.slice(11);
+                    }
+                    // Time
+                    else if (fasttype === 4) {
+                        date = +date.slice(0, 2) > 23 ? '' : `0000-01-01T${date}Z`;
+                    }
+                    hasDate = fasttype !== 4;
+                    hasTime = fasttype !== 3;
+                }
+            else {
+                let match = date.match(DATE_TIME_RE);
+                if (match) {
+                    if (!match[1]) {
+                        hasDate = false;
+                        date = `0000-01-01T${date}`;
+                    }
+                    hasTime = !!match[2];
+                    // Make sure to use T instead of a space. Breaks in case of extreme values otherwise.
+                    hasTime && date[10] === ' ' && (date = date.replace(' ', 'T'));
+                    // Do not allow rollover hours.
+                    if (match[2] && +match[2] > 23) {
+                        date = '';
+                    }
+                    else {
+                        offset = match[3] || null;
+                        if (!offset && hasTime)
+                            date += 'Z';
+                    }
+                }
+                else {
+                    date = '';
+                }
             }
-            if (isInt || integersAsBigInt === true)
-                numeric = BigInt(value);
         }
-        return numeric;
+        super(date);
+        if (!isNaN(this.getTime())) {
+            this.#hasDate = hasDate;
+            this.#hasTime = hasTime;
+            this.#offset = offset;
+        }
+    }
+    isDateTime() {
+        return this.#hasDate && this.#hasTime;
+    }
+    isLocal() {
+        return !this.#hasDate || !this.#hasTime || !this.#offset;
+    }
+    isDate() {
+        return this.#hasDate && !this.#hasTime;
+    }
+    isTime() {
+        return this.#hasTime && !this.#hasDate;
+    }
+    isValid() {
+        return this.#hasDate || this.#hasTime;
+    }
+    toISOString() {
+        let iso = super.toISOString();
+        // Local Date
+        if (this.isDate())
+            return iso.slice(0, 10);
+        // Local Time
+        if (this.isTime())
+            return iso.slice(11, 23);
+        // Local DateTime
+        if (this.#offset === null)
+            return iso.slice(0, -1);
+        // Offset DateTime
+        if (this.#offset === 'Z' || this.#offset === 'z')
+            return iso;
+        // This part is quite annoying: JS strips the original timezone from the ISO string representation
+        // Instead of using a "modified" date and "Z", we restore the representation "as authored"
+        let offset = (+(this.#offset.slice(1, 3)) * 60) + +(this.#offset.slice(4, 6));
+        offset = this.#offset[0] === '-' ? offset : -offset;
+        let offsetDate = new Date(this.getTime() - (offset * 60e3));
+        return offsetDate.toISOString().slice(0, -1) + this.#offset;
+    }
+    static wrapAsOffsetDateTime(jsDate, offset = 'Z') {
+        let date = new TomlDate(jsDate);
+        date.#offset = offset;
+        return date;
+    }
+    static wrapAsLocalDateTime(jsDate) {
+        let date = new TomlDate(jsDate);
+        date.#offset = null;
+        return date;
+    }
+    static wrapAsLocalDate(jsDate) {
+        let date = new TomlDate(jsDate);
+        date.#hasTime = false;
+        date.#offset = null;
+        return date;
+    }
+    static wrapAsLocalTime(jsDate) {
+        let date = new TomlDate(jsDate);
+        date.#hasDate = false;
+        date.#offset = null;
+        return date;
     }
-    const date = new TomlDate(value);
-    if (!date.isValid())
-        throw new TomlError('invalid value', err);
-    return date;
 }
 
 /*!
@@ -991,21 +850,29 @@ function parseValue(ctx, integersAsBigInt, end) {
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
+function isDigit(char, base = 10) {
+    return base === 16
+        ? (char > 0x2f && char < 0x3a) || (char > 0x40 && char < 0x47) || (char > 0x60 && char < 0x67)
+        : (char > 0x2f && char < 0x30 + base);
+}
+function isEndOfValue(char, delim) {
+    // Whitespace -- we're permissive on `\r` for performance; it'll be dealt with later anyway
+    return char === 0x20 || char === 0x9 /* \t */ || char === 0xa /* \n */ || char === 0xd /* \r */ ||
+        // Structure end or next value delimiter
+        (delim && (char === delim || char === 0x2c /* , */)) ||
+        // Comment
+        char === 0x23; /* # */
+}
 /** @internal */
-function extractValue(ctx, end, integersAsBigInt) {
-    let ptr = ctx.p;
-    let c = ctx.s.charCodeAt(ptr);
+function extractValue(ctx, end) {
+    let errPtr = ctx.p;
+    let c = ctx.s.charCodeAt(ctx.p);
     // Structs
     if (c === 0x5b /* [ */ || c === 0x7b /* { */) {
-        if (!ctx.d--) {
-            throw new TomlError('document contains excessively nested structures. aborting.', {
-                toml: ctx.s,
-                ptr,
-            });
-        }
+        ctx.d-- || TomlError.x('document contains excessively nested structures. aborting.', ctx);
         let value = c === 0x5b /* [ */
-            ? parseArray(ctx, integersAsBigInt)
-            : parseInlineTable(ctx, integersAsBigInt);
+            ? parseArray(ctx)
+            : parseInlineTable(ctx);
         ctx.d++;
         return value;
     }
@@ -1017,18 +884,229 @@ function extractValue(ctx, end, integersAsBigInt) {
     // We can fast-path because the first character is enough to know the only possible value
     if (c === 0x74 /* t */) { // Only possible valid value is `true`
         if (ctx.s.charCodeAt(++ctx.p) !== 0x72 || ctx.s.charCodeAt(++ctx.p) !== 0x75 || ctx.s.charCodeAt(++ctx.p) !== 0x65)
-            throw new TomlError('invalid value', { toml: ctx.s, ptr });
-        ctx.p++;
-        return true;
+            TomlError.x('invalid value', ctx, errPtr);
+        return ctx.p++, true;
     }
     if (c === 0x66 /* f */) { // Only possible valid value is `false`
         if (ctx.s.charCodeAt(++ctx.p) !== 0x61 || ctx.s.charCodeAt(++ctx.p) !== 0x6c || ctx.s.charCodeAt(++ctx.p) !== 0x73 || ctx.s.charCodeAt(++ctx.p) !== 0x65)
-            throw new TomlError('invalid value', { toml: ctx.s, ptr });
-        ctx.p++;
-        return false;
+            TomlError.x('invalid value', ctx, errPtr);
+        return ctx.p++, false;
+    }
+    if (c === 0x2b /* + */ || c === 0x2d /* - */) {
+        return parseNumber(ctx, ctx.p, ctx.s.charCodeAt(++ctx.p), 0x2c - c, end);
+    }
+    // Rough heuristic, but `parseDate` falls back to number parsing if it's a false positive.
+    // e.g.: `a = 1\n-------------- = 1` would match this heuristic, but gracefully fallback to numbers.
+    if (ctx.s.charCodeAt(ctx.p + 4) === 0x2d /* - */ && ctx.s.charCodeAt(ctx.p + 7) === 0x2d /* - */) {
+        return parseDate(ctx, c, end);
+    }
+    // Same logic as above; `parseTime` falls back to number parsing if it's a false positive.
+    if (ctx.s.charCodeAt(ctx.p + 2) === 0x3a /* : */) {
+        return parseTime(ctx, c, end);
+    }
+    return parseNumber(ctx, ctx.p, c, 0, end);
+}
+// State:
+// 0: init
+// 1: integer
+// 2: fractional dot
+// 3: fractional
+// 4: exponent letter
+// 5: exponent
+// >9: underscore; see below
+//     -> 12: was integer
+//     -> 14: was fractional
+//     -> 16: was exponent
+// states 2-5, 14, 16 are ONLY permitted iif base === 10
+function parseNumber(ctx, startPtr, startChr, sign, endChr) {
+    let c = startChr;
+    let state = 0;
+    let hasUnderscores = false;
+    // (+/-)inf
+    if (c === 0x69 /* i */) {
+        if (ctx.s.charCodeAt(++ctx.p) !== 0x6e || ctx.s.charCodeAt(++ctx.p) !== 0x66)
+            TomlError.x('invalid value', ctx, startPtr);
+        return ctx.p++, (sign || 1) / 0;
+    }
+    // (+/-)nan
+    if (c === 0x6e /* n */) {
+        if (ctx.s.charCodeAt(++ctx.p) !== 0x61 || ctx.s.charCodeAt(++ctx.p) !== 0x6e)
+            TomlError.x('invalid value', ctx, startPtr);
+        return ctx.p++, NaN;
+    }
+    // Leading zero
+    // Only allowed cases: `0<EOV>`, `0.(...)`, `0e(...)`, `0x(...)`, `0b(...)`, `0o(...)`
+    // FWIW, `0e(...)` is a stupid case, but it's not banned per-se so we have to parse it
+    if (c === 0x30 /* 0 */) {
+        if (++ctx.p >= ctx.s.length || isEndOfValue(c = ctx.s.charCodeAt(ctx.p), endChr))
+            return ctx.bi === true ? 0n : 0; // note: conveniently deals with `-0`
+        if (!sign) {
+            if (c === 0x78 /* x */)
+                return parseIntegerBaseN(ctx, startPtr, 16, endChr);
+            else if (c === 0x62 /* b */)
+                return parseIntegerBaseN(ctx, startPtr, 2, endChr);
+            else if (c === 0x6f /* o */)
+                return parseIntegerBaseN(ctx, startPtr, 8, endChr);
+        }
+        if (c === 0x2e /* . */)
+            state = 2;
+        else if (c === 0x65 /* e */ || c === 0x45 /* E */)
+            state = 4;
+        else
+            TomlError.x('illegal leading zero', ctx, startPtr);
+    }
+    // If the 1st char is not a digit by now, then it's not a valid TOML value at all
+    else if (!isDigit(c))
+        TomlError.x('invalid value', ctx, startPtr);
+    while (++ctx.p < ctx.s.length && (c = ctx.s.charCodeAt(ctx.p), !isEndOfValue(c, endChr))) {
+        if (!state)
+            state = 1; // Detects single-digit numbers we can use a fast parse path for
+        // The way the states are numbered is not random: underscores are always permitted in odd-numbered states and
+        // never permitted in even-numbered ones.
+        if (c === 0x5f /* _ */) {
+            if (!(state & 1))
+                TomlError.x('illegal underscore', ctx);
+            state += 11; // 11 is a marker that makes the state even and greater than 9; see the numbering + rationale above
+            hasUnderscores = true;
+        }
+        // Transition to fractional part.
+        else if (state === 1 && c === 0x2e /* . */)
+            state = 2;
+        // Transition to exponent part.
+        else if ((state === 1 || state === 3) && (c === 0x65 /* e */ || c === 0x45 /* E */))
+            state = 4;
+        // + and - are permitted in state 4 only (handled before entering the function for state 0)
+        else if (state === 4 && (c === 0x2b /* + */ || c === 0x2d /* - */)) ;
+        // All special cases have been handled; only digits are allowed here
+        else if (!isDigit(c))
+            TomlError.x(`illegal character in numeric literal`, ctx);
+        // Clear state flags
+        else if (state > 9)
+            state -= 11;
+        else if (!(state & 1))
+            state++;
+    }
+    // Single-char number; we can fast-path these very easily.
+    if (!state) {
+        let val = (startChr - 0x30 /* 0 */) * (sign || 1);
+        return ctx.bi === true ? BigInt(val) : val;
+    }
+    // Even-numbered states absolutely require a digit next; not even end of value is permitted
+    if (!(state & 1))
+        TomlError.x('unfinished numeric value', ctx, startPtr);
+    let str = ctx.s.slice(startPtr, ctx.p);
+    if (hasUnderscores)
+        str = str.replaceAll('_', ''); // perf: replaceAll 1.25x faster than replace with a regex
+    return state > 1
+        ? parseFloat(str)
+        : parseInteger(ctx, str, 10, startPtr);
+}
+function parseIntegerBaseN(ctx, startPtr, base, endChr) {
+    let c, underscore = 1;
+    while (++ctx.p < ctx.s.length && (c = ctx.s.charCodeAt(ctx.p), !isEndOfValue(c, endChr))) {
+        if (c === 0x5f /* _ */) {
+            if (underscore & 1)
+                TomlError.x('illegal underscore', ctx);
+            underscore = 3;
+        }
+        // We only need to check if the number is a valid digit, nothing else is permitted
+        else if (!isDigit(c, base))
+            TomlError.x(`illegal character in numeric literal`, ctx);
+        // Clear underscore flag
+        else if (underscore & 1)
+            underscore--;
+    }
+    // Trailing underscore is not allowed
+    if (underscore & 1)
+        TomlError.x('unfinished numeric value', ctx);
+    let str = ctx.s.slice(startPtr + 2, ctx.p);
+    if (underscore)
+        str = str.replaceAll('_', ''); // perf: replaceAll 1.25x faster than replace with a regex
+    return parseInteger(ctx, str, base, startPtr);
+}
+function parseInteger(ctx, str, base, startPtr) {
+    if (ctx.bi !== true)
+        int: {
+            let val = parseInt(str, base);
+            if (!Number.isSafeInteger(val)) {
+                if (ctx.bi)
+                    break int;
+                TomlError.x('integer value cannot be represented losslessly', ctx, startPtr);
+            }
+            return val;
+        }
+    return base === 10 ? BigInt(str) : BigInt((base === 2 ? '0b' : base === 8 ? '0o' : '0x') + str);
+}
+function parseDate(ctx, c, endChr) {
+    let startPtr = ctx.p++, unsafeSeparator;
+    if (!isDigit(c) ||
+        !isDigit(ctx.s.charCodeAt(ctx.p++)) ||
+        !isDigit(ctx.s.charCodeAt(ctx.p++)) ||
+        !isDigit(ctx.s.charCodeAt(ctx.p++))) {
+        return parseNumber(ctx, ctx.p = startPtr, c, 0, endChr);
+    }
+    ctx.p += 5;
+    if (!isDigit(ctx.s.charCodeAt(ctx.p++)))
+        TomlError.x('invalid date-time: date part is malformed', ctx, startPtr);
+    if (ctx.p >= ctx.s.length || (((c = ctx.s.charCodeAt(ctx.p)) !== 0x20 || (unsafeSeparator = true, !isDigit(ctx.s.charCodeAt(ctx.p + 1)))) && c !== 0x54 /* T */ && c !== 0x74 /* t */)) {
+        let t = ctx.s.slice(startPtr, ctx.p);
+        return readDate(ctx, t, 3, false, startPtr);
+    }
+    if (ctx.s.charCodeAt(ctx.p += 3) !== 0x3a /* : */)
+        TomlError.x('invalid date-time: time part is malformed', ctx, startPtr);
+    if (ctx.s.charCodeAt(ctx.p += 3) === 0x3a /* : */)
+        ctx.p += 3;
+    if (ctx.s.charCodeAt(ctx.p) === 0x2e /* . */)
+        while (isDigit(ctx.s.charCodeAt(++ctx.p)))
+            ;
+    if (c = ctx.s.charCodeAt(ctx.p)) {
+        if (c === 0x5a /* Z */ || c === 0x7a /* z */) {
+            let t = ctx.s.slice(startPtr, ++ctx.p);
+            return readDate(ctx, t, 1, unsafeSeparator, startPtr, '[+00:00]');
+        }
+        if (c === 0x2b /* + */ || c === 0x2d /* - */) {
+            // Temporal's ZonedDateTime is weird asf when it comes to dealing with traditional offsets...
+            // It's 1.2x faster to allocate a new string to pass to ZDT than use Instant.toZonedDateTimeISO
+            let t = ctx.s.slice(startPtr, ctx.p += 6);
+            return readDate(ctx, t, 1, unsafeSeparator, startPtr, !ctx.ld && ('[' + ctx.s.slice(ctx.p - 6, ctx.p) + ']'));
+        }
+    }
+    let t = ctx.s.slice(startPtr, ctx.p);
+    return readDate(ctx, t, 2, unsafeSeparator, startPtr);
+}
+function parseTime(ctx, c, endChr) {
+    let start = ctx.p;
+    if (!isDigit(c) || !isDigit(ctx.s.charCodeAt(++ctx.p))) {
+        return parseNumber(ctx, --ctx.p, c, 0, endChr);
+    }
+    if (ctx.s.charCodeAt(ctx.p += 4) === 0x3a /* : */)
+        ctx.p += 3;
+    if (ctx.s.charCodeAt(ctx.p) === 0x2e /* . */)
+        while (isDigit(ctx.s.charCodeAt(++ctx.p)))
+            ;
+    let t = ctx.s.slice(start, ctx.p);
+    return readDate(ctx, t, 4, false, start);
+}
+function readDate(ctx, str, type, unsafeDelim, errPtr, temporalSuffix) {
+    if (ctx.ld) {
+        let date = new TomlDate(str, type, unsafeDelim);
+        if (!date.isValid())
+            TomlError.x('invalid date', ctx, errPtr);
+        return date;
+    }
+    try {
+        if (temporalSuffix)
+            str += temporalSuffix;
+        switch (type) {
+            case 1: return Temporal.ZonedDateTime.from(str);
+            case 2: return Temporal.PlainDateTime.from(str);
+            case 3: return Temporal.PlainDate.from(str);
+            case 4: return Temporal.PlainTime.from(str);
+        }
+    }
+    catch (e) {
+        TomlError.x(e instanceof Error ? e.message : '' + e, ctx, errPtr);
     }
-    // Legacy logic for numbers and dates. Slow and needs to be rewritten.
-    return parseValue(ctx, integersAsBigInt, end);
 }
 
 /*!
@@ -1058,83 +1136,124 @@ function extractValue(ctx, end, integersAsBigInt) {
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
-let KEY_PART_RE = /^[a-zA-Z0-9-_]+[ \t]*$/;
 /** @internal */
-function parseKey(ctx, end = '=') {
-    let start = ctx.p;
-    let dot = start - 1;
-    let parsed = [];
-    let endPtr = ctx.s.indexOf(end, start);
-    if (endPtr < 0) {
-        throw new TomlError('incomplete key-value: cannot find end of key', {
-            toml: ctx.s,
-            ptr: start,
-        });
+function skipComment$1(ctx) {
+    for (; ctx.p < ctx.s.length; ctx.p++) {
+        let c = ctx.s.charCodeAt(ctx.p);
+        if (c === 0xa /* \n */)
+            break;
+        if (c === 0xd /* \r */ && ctx.s.charCodeAt(ctx.p + 1) === 0xa /* \n */) {
+            ctx.p++;
+            break;
+        }
+        if ((c < 0x20 && c !== 0x9 /* \t */) || c === 0x7f) {
+            TomlError.x('control characters are not allowed in comments', ctx);
+        }
+    }
+}
+/** @internal */
+function skipVoid(ctx, banNewLines, banComments) {
+    let c;
+    while (ctx.p < ctx.s.length) {
+        while (ctx.p < ctx.s.length && ((c = ctx.s.charCodeAt(ctx.p)) === 0x20 ||
+            c === 0x9 /* \t */ ||
+            (!banNewLines &&
+                (c === 0xa /* \n */ || (c === 0xd /* \r */ && ctx.s.charCodeAt(ctx.p + 1) === 0xa /* \n */)))))
+            ctx.p++;
+        if (banComments || c !== 0x23 /* # */)
+            break;
+        skipComment$1(ctx);
     }
+}
+
+/*!
+ * Copyright (c) Squirrel Chat et al., All rights reserved.
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the copyright holder nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+/** @internal */
+function parseKey(ctx, end = 0x3d /* = */) {
+    // States:
+    // 0: before first char
+    // 1: parsing bare key
+    // 2: after key component
+    let startPtr;
+    let state = 0;
+    let parsed = [];
+    let sliceStart;
+    let c = ctx.s.charCodeAt(startPtr = ctx.p);
     do {
-        let c = ctx.s.charCodeAt(ctx.p = ++dot);
-        // If it's whitespace, ignore
-        if (c !== 0x20 && c !== 0x9 /* \t */) {
-            // If it's a string
-            if (c === 0x22 /* " */ || c === 0x27 /* ' */) {
-                if (c === ctx.s.charCodeAt(ctx.p + 1) && c === ctx.s.charCodeAt(ctx.p + 2)) {
-                    throw new TomlError('multiline strings are not allowed in keys', {
-                        toml: ctx.s,
-                        ptr: ctx.p,
-                    });
-                }
-                let part = parseString(ctx);
-                dot = ctx.s.indexOf('.', ctx.p);
-                let strEnd = ctx.s.slice(ctx.p, dot < 0 || dot > endPtr ? endPtr : dot);
-                let newLine = indexOfNewline(strEnd);
-                if (newLine > -1) {
-                    throw new TomlError('newlines are not allowed in keys', {
-                        toml: ctx.s,
-                        ptr: newLine,
-                    });
-                }
-                if (strEnd.trimStart()) {
-                    throw new TomlError('found extra tokens after the string part', {
-                        toml: ctx.s,
-                        ptr: ctx.p,
-                    });
-                }
-                if (endPtr < ctx.p) {
-                    endPtr = ctx.s.indexOf(end, ctx.p);
-                    if (endPtr < 0) {
-                        throw new TomlError('incomplete key-value: cannot find end of key', {
-                            toml: ctx.s,
-                            ptr: start,
-                        });
-                    }
-                }
-                parsed.push(part);
-            }
-            else {
-                // Normal raw key part consumption and validation
-                dot = ctx.s.indexOf('.', ctx.p);
-                let part = ctx.s.slice(ctx.p, dot < 0 || dot > endPtr ? endPtr : dot);
-                if (!KEY_PART_RE.test(part)) {
-                    throw new TomlError('only letter, numbers, dashes and underscores are allowed in keys', {
-                        toml: ctx.s,
-                        ptr: ctx.p,
-                    });
-                }
-                parsed.push(part.trimEnd());
+        // End of key
+        if (c === end) {
+            if (!state)
+                TomlError.x('unexpected end of key', ctx);
+            if (state === 1)
+                parsed.push(ctx.s.slice(sliceStart, ctx.p));
+            return ctx.p++, parsed;
+        }
+        // Dotted key separator
+        else if (c === 0x2e /* . */) {
+            if (!state)
+                TomlError.x('illegal empty bare key', ctx);
+            if (state === 1)
+                parsed.push(ctx.s.slice(sliceStart, ctx.p));
+            state = 0;
+        }
+        // Quoted key
+        else if (!state && (c === 0x22 /* " */ || c === 0x27 /* ' */)) {
+            if (c === ctx.s.charCodeAt(ctx.p + 1) && c === ctx.s.charCodeAt(ctx.p + 2))
+                TomlError.x('illegal quoted key: multiline strings are not allowed', ctx);
+            parsed.push(parseString(ctx));
+            state = 2;
+            ctx.p--;
+        }
+        // Whitespace; no-op in state 0 and 2, end of bare key in state 1
+        else if (c === 0x20 || c === 0x9 /* \t */) {
+            if (state === 1) {
+                parsed.push(ctx.s.slice(sliceStart, ctx.p));
+                state = 2;
             }
         }
-        // Until there's no more dot
-    } while (dot + 1 && dot < endPtr);
-    ctx.p = endPtr + 1;
-    skipVoid(ctx, true, true);
-    return parsed;
+        // If state is post-key, no character is allowed; otherwise ensure it's a bare-key component
+        else if (state === 2 || (c < 0x30 && c !== 0x2d /* - */) || (c > 0x39 && c < 0x41) || (c > 0x5a && c < 0x61 && c !== 0x5f /* _ */) || c > 0x7a) {
+            TomlError.x('illegal character in key', ctx);
+        }
+        // Illegal character
+        else if (!state) {
+            state = 1;
+            sliceStart = ctx.p;
+        }
+    } while (c = ctx.s.charCodeAt(++ctx.p));
+    TomlError.x('incomplete key-value: cannot find end of key', ctx, startPtr);
 }
 /** @internal */
-function parseInlineTable(ctx, integersAsBigInt) {
-    let res = {};
+function parseInlineTable(ctx) {
+    let startPtr = ctx.p++;
+    let res = Object.create(null);
     let seen = new Set();
     let c;
-    ctx.p++;
     while (ctx.p < ctx.s.length) {
         skipVoid(ctx);
         if ((c = ctx.s.charCodeAt(ctx.p)) === 0x7d /* } */) {
@@ -1144,67 +1263,60 @@ function parseInlineTable(ctx, integersAsBigInt) {
         let k;
         let t = res;
         let hasOwn = false;
-        let p = ctx.p;
+        let errPtr = ctx.p;
         let key = parseKey(ctx);
         for (let i = 0; i < key.length; i++) {
             if (i)
-                t = hasOwn ? t[k] : (t[k] = {});
+                t = hasOwn ? t[k] : (t[k] = Object.create(null));
             k = key[i];
             if ((hasOwn = Object.hasOwn(t, k)) && (typeof t[k] !== 'object' || seen.has(t[k]))) {
-                throw new TomlError('trying to redefine an already defined value', {
-                    toml: ctx.s,
-                    ptr: p,
-                });
+                TomlError.x('trying to redefine an already defined value', ctx, errPtr);
+            }
+            let unsafe = k === '__proto__';
+            if (ctx.uk && (unsafe || k === 'constructor')) {
+                t = ctx.uk !== 1 && TomlError.x('document contains an unsafe property', ctx, errPtr);
+                break;
             }
-            if (!hasOwn && k === '__proto__') {
+            if (!hasOwn && unsafe) {
                 Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
             }
         }
         if (hasOwn) {
-            throw new TomlError('trying to redefine an already defined value', {
-                toml: ctx.s,
-                ptr: ctx.p,
-            });
+            TomlError.x('trying to redefine an already defined value', ctx, errPtr);
         }
-        let value = extractValue(ctx, 0x7d /* } */, integersAsBigInt);
-        seen.add(t[k] = value);
+        skipVoid(ctx, true, true);
+        let value = extractValue(ctx, 0x7d /* } */);
+        if (t && typeof (t[k] = value) === 'object')
+            seen.add(value);
         skipVoid(ctx);
         if ((c = ctx.s.charCodeAt(ctx.p++)) === 0x7d /* } */) {
             return res;
         }
-        if (c !== 0x2c /* , */) {
-            throw new TomlError('expected comma or end of structure', { toml: ctx.s, ptr: ctx.p - 1 });
-        }
+        if (c !== 0x2c /* , */)
+            TomlError.x('expected comma or end of structure', ctx, ctx.p - 1);
     }
-    throw new TomlError('unfinished table encountered', {
-        toml: ctx.s,
-        ptr: ctx.p,
-    });
+    TomlError.x('unfinished table', ctx, startPtr);
 }
 /** @internal */
-function parseArray(ctx, integersAsBigInt) {
+function parseArray(ctx) {
+    let startPtr = ctx.p++;
     let res = [];
     let c;
-    ctx.p++;
     while (ctx.p < ctx.s.length) {
         skipVoid(ctx);
         if ((c = ctx.s.charCodeAt(ctx.p)) === 0x5d /* ] */) {
             ctx.p++;
             return res;
         }
-        res.push(extractValue(ctx, 0x5d /* ] */, integersAsBigInt));
+        res.push(extractValue(ctx, 0x5d /* ] */));
         skipVoid(ctx);
         if ((c = ctx.s.charCodeAt(ctx.p++)) === 0x5d /* ] */) {
             return res;
         }
-        if (c !== 0x2c /* , */) {
-            throw new TomlError('expected comma or end of structure', { toml: ctx.s, ptr: ctx.p - 1 });
-        }
+        if (c !== 0x2c /* , */)
+            TomlError.x('expected comma or end of structure', ctx, ctx.p - 1);
     }
-    throw new TomlError('unfinished array encountered', {
-        toml: ctx.s,
-        ptr: ctx.p,
-    });
+    TomlError.x('unfinished array', ctx, startPtr);
 }
 
 /*!
@@ -1234,7 +1346,7 @@ function parseArray(ctx, integersAsBigInt) {
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
-function peekTable(key, table, meta, type) {
+function peekTable(ctx, key, table, meta, type) {
     let t = table;
     let m = meta;
     let k;
@@ -1242,7 +1354,7 @@ function peekTable(key, table, meta, type) {
     let state;
     for (let i = 0; i < key.length; i++) {
         if (i) {
-            t = hasOwn ? t[k] : (t[k] = {});
+            t = hasOwn ? t[k] : (t[k] = Object.create(null));
             m = (state = m[k]).c;
             if (type === 0 /* Type.DOTTED */ && (state.t === 1 /* Type.EXPLICIT */ || state.t === 2 /* Type.ARRAY */)) {
                 return null;
@@ -1258,7 +1370,10 @@ function peekTable(key, table, meta, type) {
             return null;
         }
         if (!hasOwn) {
-            if (k === '__proto__') {
+            let unsafe = k === '__proto__';
+            if (ctx.uk && (unsafe || k === 'constructor'))
+                return false;
+            if (unsafe) {
                 Object.defineProperty(t, k, { enumerable: true, configurable: true, writable: true });
                 Object.defineProperty(m, k, { enumerable: true, configurable: true, writable: true });
             }
@@ -1267,7 +1382,7 @@ function peekTable(key, table, meta, type) {
                     ? 3 /* Type.ARRAY_DOTTED */ : type,
                 d: false,
                 i: 0,
-                c: {},
+                c: Object.create(null),
             };
         }
     }
@@ -1281,8 +1396,8 @@ function peekTable(key, table, meta, type) {
             state.d = true;
             t[k] = [];
         }
-        t[k].push(t = {});
-        state.c[state.i++] = (state = { t: 1 /* Type.EXPLICIT */, d: false, i: 0, c: {} });
+        t[k].push(t = Object.create(null));
+        state.c[state.i++] = (state = { t: 1 /* Type.EXPLICIT */, d: false, i: 0, c: Object.create(null) });
     }
     if (state.d) {
         // Redefining a table!
@@ -1290,63 +1405,75 @@ function peekTable(key, table, meta, type) {
     }
     state.d = true;
     if (type === 1 /* Type.EXPLICIT */) {
-        t = hasOwn ? t[k] : (t[k] = {});
+        t = hasOwn ? t[k] : (t[k] = Object.create(null));
     }
     else if (type === 0 /* Type.DOTTED */ && hasOwn) {
         return null;
     }
     return [k, t, state.c];
 }
-function parse$4(toml, { maxDepth = 1000, integersAsBigInt } = {}) {
-    let ctx = { s: toml, p: 0, d: maxDepth };
-    let res = {};
-    let meta = {};
+function validateTablePeek(ctx, peek, ptr) {
+    if (peek === null || ctx.uk === 2)
+        TomlError.x(peek === null
+            ? 'trying to redefine an already defined table or value'
+            : 'document contains an unsafe property', ctx, ptr);
+}
+function parse$4(toml, options = {}) {
+    let ctx = {
+        s: toml,
+        p: 0,
+        d: options.maxDepth ?? 1000,
+        bi: options.integersAsBigInt ?? false,
+        ld: options.useLegacyDate ?? true,
+        uk: options.unsafeKeyBehaviour === 'throw' ? 2 : options.unsafeKeyBehaviour === 'drop' ? 1 : 0,
+    };
+    let res = Object.create(null);
+    let meta = Object.create(null);
     let tmp;
+    let skipping = false;
     let tbl = res;
     let m = meta;
+    // BOM is allowed, skip.
+    // JS is UTF-16, so we have to check for the UTF-16 BOM instead of the UTF-8 BOM sequence!
+    if (toml.charCodeAt(0) === 0xfeff)
+        ctx.p++;
     skipVoid(ctx);
     while (ctx.p < toml.length) {
         if (toml.charCodeAt(ctx.p) === 0x5b /* [ */) {
             let isTableArray = toml.charCodeAt(++ctx.p) === 0x5b; /* [ */
             tmp = ctx.p += +isTableArray;
-            let k = parseKey(ctx, ']');
+            skipping = false;
+            let k = parseKey(ctx, 0x5d /* ] */);
             if (isTableArray) {
-                if (toml.charCodeAt(ctx.p - 1) !== 0x5d /* ] */) {
-                    throw new TomlError('expected end of table declaration', {
-                        toml: toml,
-                        ptr: ctx.p - 1,
-                    });
+                if (toml.charCodeAt(ctx.p) !== 0x5d /* ] */) {
+                    TomlError.x('expected end of table array declaration', ctx);
                 }
                 ctx.p++;
             }
-            let p = peekTable(k, res, meta, isTableArray ? 2 /* Type.ARRAY */ : 1 /* Type.EXPLICIT */);
+            let p = peekTable(ctx, k, res, meta, isTableArray ? 2 /* Type.ARRAY */ : 1 /* Type.EXPLICIT */);
             if (!p) {
-                throw new TomlError('trying to redefine an already defined table or value', {
-                    toml: toml,
-                    ptr: tmp,
-                });
+                validateTablePeek(ctx, p, tmp);
+                skipping = true;
+            }
+            else {
+                m = p[2];
+                tbl = p[1];
             }
-            m = p[2];
-            tbl = p[1];
         }
         else {
             tmp = ctx.p;
             let k = parseKey(ctx);
-            let p = peekTable(k, tbl, m, 0 /* Type.DOTTED */);
-            if (!p) {
-                throw new TomlError('trying to redefine an already defined table or value', {
-                    toml: toml,
-                    ptr: tmp,
-                });
-            }
-            p[1][p[0]] = extractValue(ctx, void 0, integersAsBigInt);
+            let p = peekTable(ctx, k, tbl, m, 0 /* Type.DOTTED */);
+            if (!p && !skipping)
+                validateTablePeek(ctx, p, tmp);
+            skipVoid(ctx, true, true);
+            let v = extractValue(ctx, void 0);
+            if (p && !skipping)
+                p[1][p[0]] = v;
         }
         skipVoid(ctx, true);
-        if (ctx.p < toml.length && (tmp = toml.charCodeAt(ctx.p)) !== 0xa /* \n */ && tmp !== 0xd /* \r */) {
-            throw new TomlError('each key-value declaration must be followed by an end-of-line', {
-                toml: toml,
-                ptr: ctx.p,
-            });
+        if (ctx.p < toml.length && (tmp = toml.charCodeAt(ctx.p)) !== 0xa /* \n */ && (tmp !== 0xd /* \r */ || toml.charCodeAt(ctx.p + 1) !== 0xa /* \n */)) {
+            TomlError.x('each key-value declaration must be followed by an end-of-line', ctx);
         }
         skipVoid(ctx);
     }
@@ -1381,22 +1508,29 @@ function parse$4(toml, { maxDepth = 1000, integersAsBigInt } = {}) {
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 let BARE_KEY = /^[a-z0-9-_]+$/i;
+let HAS_WELLFORMED = !!(''.isWellFormed);
 function extendedTypeOf(obj) {
     let type = typeof obj;
     if (type === 'object') {
         if (Array.isArray(obj))
             return 'array';
-        if (typeof obj?.getUTCDate === 'function' && obj instanceof Date)
+        if (typeof obj.getUTCDate === 'function' && obj instanceof Date)
             return 'date';
-        if (globalThis.Temporal &&
-            // check for the 'since' property as an early bailout that avoids running all 5 instanceof checks
-            typeof obj?.since === 'function' &&
-            (obj instanceof Temporal.Instant ||
-                obj instanceof Temporal.PlainDate ||
-                obj instanceof Temporal.PlainDateTime ||
-                obj instanceof Temporal.PlainTime ||
-                obj instanceof Temporal.ZonedDateTime)) {
-            return 'temporal';
+        if (globalThis.Temporal) {
+            if (obj.until) {
+                if (obj instanceof Temporal.ZonedDateTime)
+                    return 'temporal/tz+uc';
+                if (obj instanceof Temporal.PlainDateTime || obj instanceof Temporal.PlainDate)
+                    return 'temporal/uc';
+                if (obj instanceof Temporal.PlainTime || obj instanceof Temporal.Instant)
+                    return 'temporal';
+                if (obj instanceof Temporal.PlainYearMonth)
+                    return 'temporal/x';
+            }
+            else if ((obj.toPlainDate && obj instanceof Temporal.PlainMonthDay) ||
+                (obj.negated && obj instanceof Temporal.Duration)) {
+                return 'temporal/x';
+            }
         }
     }
     return type;
@@ -1408,16 +1542,20 @@ function isArrayOfTables(obj) {
     }
     return obj.length != 0;
 }
+function formatWellFormedStringUnchecked(s) {
+    return JSON.stringify(s).replaceAll('\x7f', '\\u007f');
+}
 function formatString(s) {
-    return JSON.stringify(s).replace(/\x7f/g, '\\u007f');
+    return formatWellFormedStringUnchecked(HAS_WELLFORMED ? s.toWellFormed() : s);
 }
-function stringifyTemporal(temporal) {
-    return temporal.toString({
-        calendarName: 'never',
-        timeZoneName: 'never',
-    });
+function formatKey(s) {
+    if (BARE_KEY.test(s))
+        return s;
+    if (HAS_WELLFORMED && !s.isWellFormed())
+        throw new RangeError('key contains illegal lone surrogates');
+    return formatWellFormedStringUnchecked(s);
 }
-function stringifyValue(val, type, depth, numberAsFloat) {
+function stringifyValue(val, type, depth, numberAsFloat, strictTemporal) {
     if (depth === 0) {
         throw new Error('Could not stringify the object: maximum object depth exceeded');
     }
@@ -1434,6 +1572,7 @@ function stringifyValue(val, type, depth, numberAsFloat) {
                 return val.toFixed(1);
         case 'bigint':
         case 'boolean':
+        case 'temporal':
             return val.toString();
         case 'string':
             return formatString(val);
@@ -1442,14 +1581,42 @@ function stringifyValue(val, type, depth, numberAsFloat) {
                 throw new TypeError('cannot serialize invalid date');
             return val.toISOString();
         case 'object':
-            return stringifyInlineTable(val, depth, numberAsFloat);
+            return stringifyInlineTable(val, depth, numberAsFloat, strictTemporal);
         case 'array':
-            return stringifyArray(val, depth, numberAsFloat);
-        case 'temporal':
-            return stringifyTemporal(val);
+            return stringifyArray(val, depth, numberAsFloat, strictTemporal);
+        // @ts-expect-error -- intentional fallthrough case
+        case 'temporal/tz+uc':
+            if (strictTemporal) {
+                let tz = val.timeZoneId;
+                let tzc = tz.charCodeAt(0);
+                if (
+                // Classic offset
+                tzc !== 0x2b /* + */ && tzc !== 0x2d /* - */ &&
+                    (
+                    // Fast pre-check pass; see below for the actually accepted values
+                    (tzc !== 0x55 /* U */ && tzc !== 0x47 /* G */ && tzc !== 0x5a /* Z */ && tzc !== 0x45 /* E */) ||
+                        (
+                        // UTC and its aliases; Temporal implementations don't all canonicalise unfortunately
+                        tz !== 'UTC' && tz !== 'UCT' && tz !== 'Universal' && tz !== 'Zulu' &&
+                            // GMT is a TZ but it's for all intents and purposes equivalent to UTC. Safe to downgrade.
+                            !tz.startsWith('GMT') && tz !== 'Greenwich' &&
+                            // Etc/* are all safe to downgrade to offset (either UTC, GMT, or offset)
+                            !tz.startsWith('Etc/')))) {
+                    throw new TypeError('Temporal objects with an IANA timezone are not allowed in Temporal strict mode');
+                }
+            }
+        case 'temporal/uc':
+            if (strictTemporal && val.calendarId !== 'iso8601')
+                throw new TypeError('Temporal objects with a non-default calendar are not allowed in Temporal strict mode');
+            return val.toString({
+                calendarName: 'never',
+                timeZoneName: 'never',
+            });
+        case 'temporal/x':
+            throw new TypeError('Unsupported ' + val[Symbol.toStringTag]);
     }
 }
-function stringifyInlineTable(obj, depth, numberAsFloat) {
+function stringifyInlineTable(obj, depth, numberAsFloat, strictTemporal) {
     let keys = Object.keys(obj);
     if (keys.length === 0)
         return '{}';
@@ -1458,13 +1625,11 @@ function stringifyInlineTable(obj, depth, numberAsFloat) {
         let k = keys[i];
         if (i)
             res += ', ';
-        res += BARE_KEY.test(k) ? k : formatString(k);
-        res += ' = ';
-        res += stringifyValue(obj[k], extendedTypeOf(obj[k]), depth - 1, numberAsFloat);
+        res += formatKey(k) + ' = ' + stringifyValue(obj[k], extendedTypeOf(obj[k]), depth - 1, numberAsFloat, strictTemporal);
     }
     return res + ' }';
 }
-function stringifyArray(array, depth, numberAsFloat) {
+function stringifyArray(array, depth, numberAsFloat, strictTemporal) {
     if (array.length === 0)
         return '[]';
     let res = '[ ';
@@ -1474,22 +1639,22 @@ function stringifyArray(array, depth, numberAsFloat) {
         if (array[i] === null || array[i] === void 0) {
             throw new TypeError('arrays cannot contain null or undefined values');
         }
-        res += stringifyValue(array[i], extendedTypeOf(array[i]), depth - 1, numberAsFloat);
+        res += stringifyValue(array[i], extendedTypeOf(array[i]), depth - 1, numberAsFloat, strictTemporal);
     }
     return res + ' ]';
 }
-function stringifyArrayTable(array, key, depth, numberAsFloat) {
+function stringifyArrayTable(array, key, depth, numberAsFloat, strictTemporal) {
     if (depth === 0) {
         throw new Error('Could not stringify the object: maximum object depth exceeded');
     }
     let res = '';
     for (let i = 0; i < array.length; i++) {
         res += `${res && '\n'}[[${key}]]\n`;
-        res += stringifyTable(0, array[i], key, depth, numberAsFloat);
+        res += stringifyTable(0, array[i], key, depth, numberAsFloat, strictTemporal);
     }
     return res;
 }
-function stringifyTable(tableKey, obj, prefix, depth, numberAsFloat) {
+function stringifyTable(tableKey, obj, prefix, depth, numberAsFloat, strictTemporal) {
     if (depth === 0) {
         throw new Error('Could not stringify the object: maximum object depth exceeded');
     }
@@ -1503,18 +1668,18 @@ function stringifyTable(tableKey, obj, prefix, depth, numberAsFloat) {
             if (type === 'symbol' || type === 'function') {
                 throw new TypeError(`cannot serialize values of type '${type}'`);
             }
-            let key = BARE_KEY.test(k) ? k : formatString(k);
+            let key = formatKey(k);
             if (type === 'array' && isArrayOfTables(obj[k])) {
-                tables += (tables && '\n') + stringifyArrayTable(obj[k], prefix ? `${prefix}.${key}` : key, depth - 1, numberAsFloat);
+                tables += (tables && '\n') + stringifyArrayTable(obj[k], prefix ? `${prefix}.${key}` : key, depth - 1, numberAsFloat, strictTemporal);
             }
             else if (type === 'object') {
                 let tblKey = prefix ? `${prefix}.${key}` : key;
-                tables += (tables && '\n') + stringifyTable(tblKey, obj[k], tblKey, depth - 1, numberAsFloat);
+                tables += (tables && '\n') + stringifyTable(tblKey, obj[k], tblKey, depth - 1, numberAsFloat, strictTemporal);
             }
             else {
                 preamble += key;
                 preamble += ' = ';
-                preamble += stringifyValue(obj[k], type, depth, numberAsFloat);
+                preamble += stringifyValue(obj[k], type, depth, numberAsFloat, strictTemporal);
                 preamble += '\n';
             }
         }
@@ -1525,11 +1690,11 @@ function stringifyTable(tableKey, obj, prefix, depth, numberAsFloat) {
         ? `${preamble}\n${tables}`
         : preamble || tables;
 }
-function stringify$1(obj, { maxDepth = 1000, numbersAsFloat = false } = {}) {
+function stringify$1(obj, { maxDepth = 1000, numbersAsFloat = false, strictTemporal = false } = {}) {
     if (extendedTypeOf(obj) !== 'object') {
         throw new TypeError('stringify can only be called with an object');
     }
-    let str = stringifyTable(0, obj, '', maxDepth, numbersAsFloat);
+    let str = stringifyTable(0, obj, '', maxDepth, numbersAsFloat, strictTemporal);
     if (str[str.length - 1] !== '\n')
         return str + '\n';
     return str;
@@ -21231,6 +21396,30 @@ function locateRootValue(source) {
     }
     return null;
 }
+/**
+ * A parsed TOML value with every table rebuilt as a plain object, so a deep comparison is about the
+ * values and not about which prototype a table carries. smol-toml >= 1.9 parses every table, the document
+ * root included (and inline tables), to a null-prototype object, and `isDeepStrictEqual` treats a null
+ * prototype as different from `Object.prototype`, while the spread `{ ...original, repos_root }` that
+ * `editReposRoot` compares against is plain at its top level: on 1.9 every edit that reached the
+ * comparison failed it, whatever the document held. An array maps each element; an object whose prototype
+ * is `null` or `Object.prototype` becomes a fresh plain object with each value mapped the same way;
+ * anything else (a string, number, boolean, `null`, a `Date` or smol-toml's `TomlDate`, an object of any
+ * other class) is returned as it is. So the comparison ignores prototypes and compares everything else as
+ * before, except that a rebuilt table keeps only its own enumerable string keys (a TOML document has no
+ * others). The input is not mutated.
+ */
+function withPlainPrototypes(value) {
+    if (Array.isArray(value))
+        return value.map((element) => withPlainPrototypes(element));
+    if (typeof value === "object" && value !== null) {
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype === null || prototype === Object.prototype) {
+            return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, withPlainPrototypes(entry)]));
+        }
+    }
+    return value;
+}
 /**
  * Edit only the top-level string `repos_root` assignment while preserving every unrelated byte.
  * `missingValue` is the unoverlaid value a missing key means to `loadConfig`; when it already equals
@@ -21262,7 +21451,7 @@ function editReposRoot(source, next, missingValue, locateValue = locateRootValue
     }
     const reparsed = parseDocument$1(proposed);
     const expected = { ...original, repos_root: next };
-    if (!isDeepStrictEqual(reparsed, expected)) {
+    if (!isDeepStrictEqual(withPlainPrototypes(reparsed), withPlainPrototypes(expected))) {
         fail$1("proposed edit changed more than the requested value");
     }
     return proposed;
@@ -74285,8 +74474,8 @@ function parse(src, reviver, options) {
  * tunnel, capability `agent.tunnel.lint`. The design decision (recorded in the registry): the lint runs
  * as an agent verb, because the console is a container that cannot read the tunnel host's config (the
  * issue's own finding) and has no Tooling clone (roshne, 2026-09-16, recorded at
- * `admin-cards.test.ts`); the console is meant to ask each paired machine through `host.agent.call`
- * (PR 2).
+ * `admin-cards.test.ts`); the console asks each paired machine through `host.agent.call` (#416 PR 2,
+ * `plugins/admin/src/tunnel-audit.ts`).
  *
  * The verb takes NO request input: which file is read and which script is run come only from
  * `agent.toml` / the `AC_AGENT_TUNNEL_*` env (`config.ts`), set by the machine's own operator. Two