@limetech/lime-elements 40.13.1 → 40.14.0

package/dist/cjs/limel-form.cjs.entry.js

@@ -21360,6 +21360,12 @@ function requireUtils$1 () {
 	/** @type {(value: string) => boolean} */
 	const isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u);
 
+	/** @type {(value: string) => boolean} */
+	const isRegNameCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=]$/u);
+
+	/** @type {(value: string) => boolean} */
+	const isLiteralRegName = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=]*$/u);
+
 	/**
 	 * @param {Array<string>} input
 	 * @returns {string}
@@ -21683,23 +21689,78 @@ function requireUtils$1 () {
 	}
 
 	/**
-	 * Re-escape RFC 3986 gen-delims that must not appear literally in the host.
-	 * After the URI regex parses, these characters cannot be literal in the host
-	 * field, so any that appear after decoding came from percent-encoding and
-	 * must be restored to prevent authority structure changes.
+	 * Removes dot segments from the path of a relative reference (a path that does
+	 * not start with "/") without changing what it resolves to against any base.
+	 * Unlike `removeDotSegments`, leading ".." segments that cannot be collapsed
+	 * are kept, the result never becomes root-relative, and a result that would be
+	 * empty or start with an empty segment is prefixed with "." (an empty path
+	 * means "same document" and a leading "//" would introduce an authority).
+	 *
+	 * @param {string} path
+	 * @returns {string}
+	 */
+	function removeDotSegmentsRelative (path) {
+	  if (path === '' || path[0] === '/') {
+	    return removeDotSegments(path)
+	  }
+
+	  const segments = path.split('/');
+	  const last = segments.length - 1;
+	  /** @type {string[]} */
+	  const output = [];
+	  let trailingDirectory = false;
+
+	  for (let i = 0; i <= last; i++) {
+	    const segment = segments[i];
+	    if (segment === '.' || segment === '..') {
+	      if (segment === '..') {
+	        if (output.length !== 0 && output[output.length - 1] !== '..') {
+	          output.pop();
+	        } else {
+	          output.push('..');
+	        }
+	      }
+	      trailingDirectory = i === last;
+	    } else {
+	      output.push(segment);
+	    }
+	  }
+
+	  if (trailingDirectory && output[output.length - 1] !== '..') {
+	    output.push('');
+	  }
+	  if (output.length === 0 || output[0] === '' || output[0].includes(':')) {
+	    // An empty path, a leading empty segment ("//"), or a first segment
+	    // containing ":" (which would be mistaken for a scheme, RFC 3986 section
+	    // 4.2) must stay behind a "." segment so the reference keeps its meaning.
+	    output.unshift('.');
+	  }
+
+	  return output.join('/')
+	}
+
+	/**
+	 * Encodes a host according to the RFC 3986 host grammar. Valid IP literals
+	 * have already been checked by `normalizeIPv6`, so their address separators
+	 * remain literal. Every other host is a reg-name and may contain only
+	 * unreserved characters, sub-delimiters, and valid percent escapes.
 	 *
 	 * @param {string} host
-	 * @param {boolean} isIP - true for IPv4/IPv6 hosts (skip colon re-escaping)
+	 * @param {boolean} isIP - true for a validated IPv4/IPv6 host
+	 * @param {boolean} [allowNonAscii=false] - preserve non-ASCII IRI characters
 	 * @returns {string}
 	 */
-	const HOST_DELIMS = { '@': '%40', '/': '%2F', '?': '%3F', '#': '%23', ':': '%3A' };
-	const HOST_DELIM_RE = /[@/?#:]/g;
-	const HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
+	const IP_HOST_DELIMS = { '@': '%40', '/': '%2F', '?': '%3F', '#': '%23' };
+	const IP_HOST_DELIM_RE = /[@/?#]/g;
 
-	function reescapeHostDelimiters (host, isIP) {
-	  const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
-	  re.lastIndex = 0;
-	  return host.replace(re, (ch) => HOST_DELIMS[ch])
+	function encodeHost (host, isIP, allowNonAscii = false) {
+	  if (!isIP) {
+	    if (isLiteralRegName(host)) return host
+	    return encodeComponent(host, isRegNameCharacter, allowNonAscii)
+	  }
+
+	  IP_HOST_DELIM_RE.lastIndex = 0;
+	  return host.replace(IP_HOST_DELIM_RE, (ch) => IP_HOST_DELIMS[ch])
 	}
 
 	/**
@@ -21962,9 +22023,10 @@ function requireUtils$1 () {
 	 *
 	 * @param {string} input
 	 * @param {(value: string) => boolean} isAllowed
+	 * @param {boolean} [allowNonAscii=false]
 	 * @returns {string}
 	 */
-	function encodeComponent (input, isAllowed) {
+	function encodeComponent (input, isAllowed, allowNonAscii = false) {
 	  let output = '';
 
 	  for (let i = 0; i < input.length; i++) {
@@ -21985,17 +22047,19 @@ function requireUtils$1 () {
 	      if (code < 0x80) {
 	        output += BYTE_HEX[code];
 	      } else if (code < 0xD800 || code > 0xDFFF) {
-	        output += percentEncodeNonAscii(code);
+	        output += allowNonAscii ? ch : percentEncodeNonAscii(code);
 	      } else if (code <= 0xDBFF && i + 1 < input.length) {
 	        const low = input.charCodeAt(i + 1);
 	        if (low >= 0xDC00 && low <= 0xDFFF) {
-	          output += percentEncodeNonAscii(0x10000 + ((code - 0xD800) << 10) + (low - 0xDC00));
+	          output += allowNonAscii
+	            ? ch + input[i + 1]
+	            : percentEncodeNonAscii(0x10000 + ((code - 0xD800) << 10) + (low - 0xDC00));
 	          i++;
 	        } else {
-	          output += percentEncodeNonAscii(0xFFFD);
+	          output += allowNonAscii ? '\uFFFD' : percentEncodeNonAscii(0xFFFD);
 	        }
 	      } else {
-	        output += percentEncodeNonAscii(0xFFFD);
+	        output += allowNonAscii ? '\uFFFD' : percentEncodeNonAscii(0xFFFD);
 	      }
 	    }
 	  }
@@ -22109,9 +22173,10 @@ function requireUtils$1 () {
 
 	/**
 	 * @param {import('../types/index').URIComponent} component
+	 * @param {boolean} [allowNonAscii=false] - preserve non-ASCII IRI characters
 	 * @returns {string|undefined}
 	 */
-	function recomposeAuthority (component) {
+	function recomposeAuthority (component, allowNonAscii = false) {
 	  const uriTokens = [];
 
 	  if (component.userinfo !== undefined) {
@@ -22144,7 +22209,7 @@ function requireUtils$1 () {
 	        if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
 	          host = `[${ipV6res.escapedHost}]`;
 	        } else {
-	          host = reescapeHostDelimiters(host, false);
+	          host = encodeHost(host, false, allowNonAscii);
 	        }
 	      }
 	    }
@@ -22168,7 +22233,7 @@ function requireUtils$1 () {
 	  nonSimpleDomain,
 	  nonSimpleMailtoDomain,
 	  recomposeAuthority,
-	  reescapeHostDelimiters,
+	  encodeHost,
 	  normalizePercentEncoding,
 	  normalizePathEncoding,
 	  serializePathEncoding,
@@ -22178,6 +22243,7 @@ function requireUtils$1 () {
 	  encodeFragment,
 	  escapePreservingEscapes,
 	  removeDotSegments,
+	  removeDotSegmentsRelative,
 	  isIPv4,
 	  isUUID,
 	  normalizeIPv6,
@@ -22423,7 +22489,10 @@ function requireSchemes$1 () {
 	  scheme: 'urn',
 	  parse: urnParse,
 	  serialize: urnSerialize,
-	  skipNormalize: true
+	  skipNormalize: true,
+	  // The NSS is opaque to generic URI path processing. In particular, RFC 2141
+	  // and RFC 8141 do not treat slash-delimited dot segments as equivalent.
+	  absolutePath: true
 	});
 
 	const urnuuid = /** @type {SchemeHandler} */ ({
@@ -22904,22 +22973,30 @@ function requireFastUri$1 () {
 	if (hasRequiredFastUri$1) return fastUri$1.exports;
 	hasRequiredFastUri$1 = 1;
 
-	const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = requireUtils$1();
+	const { normalizeIPv6, removeDotSegments, removeDotSegmentsRelative, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, encodeHost, isIPv4, nonSimpleDomain } = requireUtils$1();
 	const { SCHEMES, getSchemeHandler } = requireSchemes$1();
 
 	const VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
 	const MALFORMED_SCHEME_ERROR = 'URI scheme is malformed.';
+	const MALFORMED_HOST_ERROR = 'URI host is malformed.';
+	// ASCII characters outside the RFC 3986 reg-name set (unreserved, sub-delims
+	// and "%" for pct-encoded): C0 controls, space, DEL, and "#/:<>?@[\]^`{|}.
+	const FORBIDDEN_DOMAIN_HOST_CHARACTER = /[\0-\x20"#/:<>?@[\\\]^`{|}\x7F]/u;
 
 	/**
+	 * RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so the
+	 * scheme is validated as-is and never decoded. Decoding would let inert input
+	 * such as `%6Aavascript:` become a live `javascript:` scheme.
+	 *
 	 * @param {string} scheme
 	 * @returns {string}
 	 */
-	function decodeValidScheme (scheme) {
-	  const decodedScheme = unescape(String(scheme));
-	  if (!VALID_SCHEME.test(decodedScheme)) {
+	function validateScheme (scheme) {
+	  const stringScheme = String(scheme);
+	  if (!VALID_SCHEME.test(stringScheme)) {
 	    throw new TypeError(MALFORMED_SCHEME_ERROR)
 	  }
-	  return decodedScheme
+	  return stringScheme
 	}
 
 	/**
@@ -22948,6 +23025,7 @@ function requireFastUri$1 () {
 	  const {
 	    parsed: baseParsed,
 	    malformedAuthorityOrPort: baseMalformed,
+	    malformedReferenceEdge: baseMalformedReferenceEdge,
 	    malformedPercentEncoding: baseMalformedPercentEncoding,
 	    malformedSchemeSpecific: baseMalformedSchemeSpecific,
 	    malformedHost: baseMalformedHost,
@@ -22956,6 +23034,7 @@ function requireFastUri$1 () {
 	  const {
 	    parsed: relativeParsed,
 	    malformedAuthorityOrPort: relativeMalformed,
+	    malformedReferenceEdge: relativeMalformedReferenceEdge,
 	    malformedPercentEncoding: relativeMalformedPercentEncoding,
 	    malformedSchemeSpecific: relativeMalformedSchemeSpecific,
 	    malformedHost: relativeMalformedHost,
@@ -22964,6 +23043,8 @@ function requireFastUri$1 () {
 	  if (
 	    baseMalformed ||
 	    relativeMalformed ||
+	    baseMalformedReferenceEdge ||
+	    relativeMalformedReferenceEdge ||
 	    baseMalformedPercentEncoding ||
 	    relativeMalformedPercentEncoding ||
 	    baseMalformedSchemeSpecific ||
@@ -22978,8 +23059,22 @@ function requireFastUri$1 () {
 	  const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
 	  const resolvedSchemeHandler = getSchemeHandler((options && options.scheme) || resolved.scheme);
 	  const resolvedHost = resolved.host;
+	  // Inputs are parsed scheme-neutrally during resolution, so enforce the final
+	  // HTTP scheme's required host before serializing an invalid HTTP URI.
+	  if (
+	    (resolved.scheme === 'http' || resolved.scheme === 'https') &&
+	    !resolvedHost
+	  ) {
+	    throw new Error('HTTP URIs must have a host.')
+	  }
 	  const resolvedHostIsIP = resolvedHost !== undefined && resolvedHost !== '' &&
 	    (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+	  // Inputs are parsed scheme-neutrally, so delimiters and controls in a domain
+	  // host are only detected here, once the final scheme is known. They always
+	  // fail closed, including in percent-encoded hosts.
+	  if (hasForbiddenDomainHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)) {
+	    throw new Error(MALFORMED_HOST_ERROR)
+	  }
 	  canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
 	  // Percent escapes in an ASCII reg-name are encoded data. The WHATWG hostname
 	  // parser can reject them even though fast-uri preserves them safely as RFC
@@ -22990,6 +23085,9 @@ function requireFastUri$1 () {
 	    throw new Error(resolved.error)
 	  }
 	  schemelessOptions.skipEscape = true;
+	  if (resolvedSchemeHandler && resolvedSchemeHandler.absolutePath) {
+	    schemelessOptions.absolutePath = true;
+	  }
 	  return serialize(resolved, schemelessOptions)
 	}
 
@@ -23031,7 +23129,10 @@ function requireFastUri$1 () {
 	    target.userinfo = relative.userinfo;
 	    copyHost(target, relative);
 	    target.port = relative.port;
-	    target.path = removeDotSegments(relative.path || '');
+	    const relativeSchemeHandler = getSchemeHandler(relative.scheme);
+	    target.path = relativeSchemeHandler && relativeSchemeHandler.absolutePath
+	      ? relative.path || ''
+	      : removeDotSegments(relative.path || '');
 	    target.query = relative.query;
 	  } else {
 	    if (relative.userinfo !== undefined || relative.host !== undefined || relative.port !== undefined) {
@@ -23053,14 +23154,17 @@ function requireFastUri$1 () {
 	        if (relative.path[0] === '/') {
 	          target.path = removeDotSegments(relative.path);
 	        } else {
-	          if ((base.userinfo !== undefined || base.host !== undefined || base.port !== undefined) && !base.path) {
+	          const baseHasAuthority = base.userinfo !== undefined || base.host !== undefined || base.port !== undefined;
+	          if (baseHasAuthority && !base.path) {
 	            target.path = '/' + relative.path;
 	          } else if (!base.path) {
 	            target.path = relative.path;
 	          } else {
 	            target.path = base.path.slice(0, base.path.lastIndexOf('/') + 1) + relative.path;
 	          }
-	          target.path = removeDotSegments(target.path);
+	          target.path = base.scheme === undefined && !baseHasAuthority && target.path[0] !== '/'
+	            ? removeDotSegmentsRelative(target.path)
+	            : removeDotSegments(target.path);
 	        }
 	        target.query = relative.query;
 	      }
@@ -23121,7 +23225,7 @@ function requireFastUri$1 () {
 	  const uriTokens = [];
 
 	  if (component.scheme) {
-	    component.scheme = decodeValidScheme(component.scheme);
+	    component.scheme = validateScheme(component.scheme);
 	  }
 
 	  // find scheme handler
@@ -23131,7 +23235,11 @@ function requireFastUri$1 () {
 	  if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
 
 	  const hasAuthority = component.userinfo !== undefined || component.host !== undefined || component.port !== undefined;
-	  const pathNoScheme = !options.skipEscape && component.scheme === undefined && !hasAuthority;
+	  // A reference with no emitted scheme is path-noscheme: a bare ':' in its
+	  // first path segment would reparse as a scheme (RFC 3986 3.3/4.2). Enforced
+	  // under skipEscape too (resolve()), so the reapply below gates on this flag.
+	  const schemelessReference = (component.scheme === undefined || options.reference === 'suffix') && !hasAuthority;
+	  const pathNoScheme = !options.skipEscape && schemelessReference;
 
 	  if (component.path !== undefined) {
 	    if (!options.skipEscape) {
@@ -23143,11 +23251,12 @@ function requireFastUri$1 () {
 
 	  if (options.reference !== 'suffix' && component.scheme) {
 	    // Scheme handlers may replace the scheme during serialization.
-	    component.scheme = decodeValidScheme(component.scheme);
+	    component.scheme = validateScheme(component.scheme);
 	    uriTokens.push(component.scheme, ':');
 	  }
 
-	  const authority = recomposeAuthority(component);
+	  const allowNonAsciiHost = options.unicodeSupport === true || Boolean(schemeHandler && schemeHandler.unicodeSupport);
+	  const authority = recomposeAuthority(component, allowNonAsciiHost);
 	  if (authority !== undefined) {
 	    if (options.reference !== 'suffix') {
 	      uriTokens.push('//');
@@ -23163,13 +23272,18 @@ function requireFastUri$1 () {
 	    let s = component.path;
 
 	    if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
-	      s = removeDotSegments(s);
+	      // A relative-path reference keeps its unresolvable leading ".." segments
+	      // and must never become root-relative (RFC 3986 section 5.2.4 applies to
+	      // merged target paths, not to the reference itself).
+	      s = schemelessReference && s[0] !== '/'
+	        ? removeDotSegmentsRelative(s)
+	        : removeDotSegments(s);
 	    }
 
 	    // Dot-segment removal can expose a colon that was not originally in the
 	    // first segment (for example, "./a:b"). Reapply path-noscheme encoding so
 	    // the serialized relative reference cannot be reparsed as a URI scheme.
-	    if (pathNoScheme) {
+	    if (schemelessReference) {
 	      s = serializePathEncoding(s, true);
 	    }
 
@@ -23289,6 +23403,11 @@ function requireFastUri$1 () {
 	    parsed.host[0] === '[' &&
 	    parsed.host[parsed.host.length - 1] === ']';
 
+	  if (hasForbiddenDomainHost(parsed, options, schemeHandler, isIP)) {
+	    parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+	    return true
+	  }
+
 	  if (
 	    !options.unicodeSupport &&
 	    (!schemeHandler || !schemeHandler.unicodeSupport) &&
@@ -23299,21 +23418,67 @@ function requireFastUri$1 () {
 	    !bracketedIPLiteral &&
 	    nonSimpleDomain(parsed.host)
 	  ) {
+	    let url;
 	    try {
-	      parsed.host = new URL('http://' + parsed.host).hostname;
+	      url = new URL('http://' + parsed.host);
 	    } catch (e) {
 	      parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
 	      return true
 	    }
+	    // The WHATWG parser must have read the whole input as a host. Anything
+	    // else means it found a delimiter fast-uri did not, so its hostname would
+	    // describe a different authority.
+	    if (!isHostOnlyURL(url)) {
+	      parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+	      return true
+	    }
+	    parsed.host = url.hostname;
 	  }
 
 	  return false
 	}
 
+	/**
+	 * Whether a domain host contains an ASCII character that RFC 3986 does not
+	 * allow in a reg-name (unreserved, sub-delims, or pct-encoded). Such a host is
+	 * rejected instead of being handed to the WHATWG URL parser, which would treat
+	 * "@" as a userinfo delimiter (silently dropping the data before it) and strip
+	 * TAB, LF, and CR. Non-ASCII characters remain allowed for IDNs.
+	 *
+	 * @param {import('./types/index').URIComponent} parsed
+	 * @param {import('./types/index').Options} options
+	 * @param {{ domainHost?: boolean }|undefined} schemeHandler
+	 * @param {boolean} isIP
+	 * @returns {boolean}
+	 */
+	function hasForbiddenDomainHost (parsed, options, schemeHandler, isIP) {
+	  return Boolean(
+	    parsed.host &&
+	    isIP === false &&
+	    !isIPLiteral(parsed.host) &&
+	    (options.domainHost || (schemeHandler && schemeHandler.domainHost)) &&
+	    FORBIDDEN_DOMAIN_HOST_CHARACTER.test(parsed.host)
+	  )
+	}
+
+	/**
+	 * @param {URL} url
+	 * @returns {boolean}
+	 */
+	function isHostOnlyURL (url) {
+	  return url.username === '' &&
+	    url.password === '' &&
+	    url.port === '' &&
+	    url.pathname === '/' &&
+	    url.search === '' &&
+	    url.hash === '' &&
+	    url.hostname !== ''
+	}
+
 	/**
 	 * @param {string} uri
 	 * @param {import('./types/index').Options} [opts]
-	 * @returns {{ parsed: import('./types/index').URIComponent, malformedAuthorityOrPort: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
+	 * @returns {{ parsed: import('./types/index').URIComponent, malformedAuthorityOrPort: boolean, malformedReferenceEdge: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
 	 */
 	function parseWithStatus (uri, opts) {
 	  const options = Object.assign({}, opts);
@@ -23329,6 +23494,12 @@ function requireFastUri$1 () {
 	  };
 
 	  let malformedAuthorityOrPort = false;
+	  // Check the caller's original reference before suffix mode prepends a scheme
+	  // or authority marker and turns its leading edge into interior data.
+	  const malformedReferenceEdge = uri.length !== 0 && (
+	    uri.charCodeAt(0) <= 0x20 ||
+	    uri.charCodeAt(uri.length - 1) <= 0x20
+	  );
 	  let malformedPercentEncoding = false;
 	  let malformedSchemeSpecific = false;
 	  let malformedHost = false;
@@ -23379,6 +23550,10 @@ function requireFastUri$1 () {
 	    }
 	  }
 
+	  if (malformedReferenceEdge) {
+	    parsed.error = parsed.error || 'URI must not contain leading or trailing C0 controls or spaces.';
+	  }
+
 	  const matches = uri.match(URI_PARSE);
 
 	  if (matches) {
@@ -23392,9 +23567,8 @@ function requireFastUri$1 () {
 	    parsed.fragment = matches[8];
 
 	    if (parsed.scheme !== undefined) {
-	      const decodedScheme = unescape(parsed.scheme);
-	      if (VALID_SCHEME.test(decodedScheme)) {
-	        parsed.scheme = decodedScheme.toLowerCase();
+	      if (VALID_SCHEME.test(parsed.scheme)) {
+	        parsed.scheme = parsed.scheme.toLowerCase();
 	      } else {
 	        parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
 	        malformedScheme = true;
@@ -23438,7 +23612,7 @@ function requireFastUri$1 () {
 	        }
 
 	        if (malformedIPLiteral) {
-	          parsed.error = parsed.error || 'URI host is malformed.';
+	          parsed.error = parsed.error || MALFORMED_HOST_ERROR;
 	          malformedAuthorityOrPort = true;
 	        }
 	      } else {
@@ -23468,14 +23642,24 @@ function requireFastUri$1 () {
 	      malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
 	    }
 
-	    if (uri.indexOf('%') !== -1 && parsed.host !== undefined && !malformedIPLiteral) {
-	      let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
-	      if (!isIP) {
+	    if (parsed.host !== undefined && !malformedIPLiteral) {
+	      let host = parsed.host;
+	      if (uri.indexOf('%') !== -1 && !isIP) {
+	        host = normalizePercentEncoding(host, true);
 	        // Fold reg-name case after decoding unreserved octets. The second
 	        // pass only restores uppercase hex in escapes that remain encoded.
 	        host = normalizePercentEncoding(host.toLowerCase());
 	      }
-	      parsed.host = reescapeHostDelimiters(host, isIP);
+	      // Resolution parses both inputs with the internal `null` scheme before
+	      // the effective scheme is known. Preserve raw host characters for that
+	      // intermediate step so the final scheme can apply domain canonicalization;
+	      // the resolved authority is encoded when it is serialized.
+	      if (options.scheme !== 'null') {
+	        const allowNonAsciiHost = options.unicodeSupport === true || Boolean(schemeHandler && schemeHandler.unicodeSupport);
+	        parsed.host = encodeHost(host, isIP, allowNonAsciiHost);
+	      } else {
+	        parsed.host = host;
+	      }
 	    }
 
 	    if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
@@ -23500,7 +23684,7 @@ function requireFastUri$1 () {
 	  } else {
 	    parsed.error = parsed.error || 'URI can not be parsed.';
 	  }
-	  return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme }
+	  return { parsed, malformedAuthorityOrPort, malformedReferenceEdge, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme }
 	}
 
 	/**
@@ -23524,13 +23708,14 @@ function requireFastUri$1 () {
 	/**
 	 * @param {string} uri
 	 * @param {import('./types/index').Options} [opts]
-	 * @returns {{ normalized: string, malformedAuthorityOrPort: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
+	 * @returns {{ normalized: string, malformedAuthorityOrPort: boolean, malformedReferenceEdge: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
 	 */
 	function normalizeStringWithStatus (uri, opts) {
-	  const { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts);
+	  const { parsed, malformedAuthorityOrPort, malformedReferenceEdge, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts);
 	  return {
-	    normalized: malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
+	    normalized: malformedAuthorityOrPort || malformedReferenceEdge || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
 	    malformedAuthorityOrPort,
+	    malformedReferenceEdge,
 	    malformedPercentEncoding,
 	    malformedSchemeSpecific,
 	    malformedHost,
@@ -23554,8 +23739,8 @@ function requireFastUri$1 () {
 	  } catch {
 	    return undefined
 	  }
-	  const { normalized, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts);
-	  return malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? undefined : normalized
+	  const { normalized, malformedAuthorityOrPort, malformedReferenceEdge, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts);
+	  return malformedAuthorityOrPort || malformedReferenceEdge || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? undefined : normalized
 	}
 
 	const fastUri = {
@@ -38761,6 +38946,57 @@ function requireUtils () {
 	  return output.join('')
 	}
 
+	/**
+	 * Removes dot segments from the path of a relative reference (a path that does
+	 * not start with "/") without changing what it resolves to against any base.
+	 * Unlike `removeDotSegments`, leading ".." segments that cannot be collapsed
+	 * are kept, the result never becomes root-relative, and a result that would be
+	 * empty or start with an empty segment is prefixed with "." (an empty path
+	 * means "same document" and a leading "//" would introduce an authority).
+	 *
+	 * @param {string} path
+	 * @returns {string}
+	 */
+	function removeDotSegmentsRelative (path) {
+	  if (path === '' || path[0] === '/') {
+	    return removeDotSegments(path)
+	  }
+
+	  const segments = path.split('/');
+	  const last = segments.length - 1;
+	  /** @type {string[]} */
+	  const output = [];
+	  let trailingDirectory = false;
+
+	  for (let i = 0; i <= last; i++) {
+	    const segment = segments[i];
+	    if (segment === '.' || segment === '..') {
+	      if (segment === '..') {
+	        if (output.length !== 0 && output[output.length - 1] !== '..') {
+	          output.pop();
+	        } else {
+	          output.push('..');
+	        }
+	      }
+	      trailingDirectory = i === last;
+	    } else {
+	      output.push(segment);
+	    }
+	  }
+
+	  if (trailingDirectory && output[output.length - 1] !== '..') {
+	    output.push('');
+	  }
+	  if (output.length === 0 || output[0] === '' || output[0].includes(':')) {
+	    // An empty path, a leading empty segment ("//"), or a first segment
+	    // containing ":" (which would be mistaken for a scheme, RFC 3986 section
+	    // 4.2) must stay behind a "." segment so the reference keeps its meaning.
+	    output.unshift('.');
+	  }
+
+	  return output.join('/')
+	}
+
 	/**
 	 * Re-escape RFC 3986 gen-delims that must not appear literally in the host.
 	 * After the URI regex parses, these characters cannot be literal in the host
@@ -39155,6 +39391,7 @@ function requireUtils () {
 	  encodeFragment,
 	  escapePreservingEscapes,
 	  removeDotSegments,
+	  removeDotSegmentsRelative,
 	  isIPv4,
 	  isUUID,
 	  normalizeIPv6,
@@ -39449,22 +39686,30 @@ function requireFastUri () {
 	if (hasRequiredFastUri) return fastUri.exports;
 	hasRequiredFastUri = 1;
 
-	const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = requireUtils();
+	const { normalizeIPv6, removeDotSegments, removeDotSegmentsRelative, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = requireUtils();
 	const { SCHEMES, getSchemeHandler } = requireSchemes();
 
 	const VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
 	const MALFORMED_SCHEME_ERROR = 'URI scheme is malformed.';
+	const MALFORMED_HOST_ERROR = 'URI host is malformed.';
+	// ASCII characters outside the RFC 3986 reg-name set (unreserved, sub-delims
+	// and "%" for pct-encoded): C0 controls, space, DEL, and "#/:<>?@[\]^`{|}.
+	const FORBIDDEN_DOMAIN_HOST_CHARACTER = /[\0-\x20"#/:<>?@[\\\]^`{|}\x7F]/u;
 
 	/**
+	 * RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so the
+	 * scheme is validated as-is and never decoded. Decoding would let inert input
+	 * such as `%6Aavascript:` become a live `javascript:` scheme.
+	 *
 	 * @param {string} scheme
 	 * @returns {string}
 	 */
-	function decodeValidScheme (scheme) {
-	  const decodedScheme = unescape(String(scheme));
-	  if (!VALID_SCHEME.test(decodedScheme)) {
+	function validateScheme (scheme) {
+	  const stringScheme = String(scheme);
+	  if (!VALID_SCHEME.test(stringScheme)) {
 	    throw new TypeError(MALFORMED_SCHEME_ERROR)
 	  }
-	  return decodedScheme
+	  return stringScheme
 	}
 
 	/**
@@ -39525,6 +39770,12 @@ function requireFastUri () {
 	  const resolvedHost = resolved.host;
 	  const resolvedHostIsIP = resolvedHost !== undefined && resolvedHost !== '' &&
 	    (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+	  // Inputs are parsed scheme-neutrally, so delimiters and controls in a domain
+	  // host are only detected here, once the final scheme is known. They always
+	  // fail closed, including in percent-encoded hosts.
+	  if (hasForbiddenDomainHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)) {
+	    throw new Error(MALFORMED_HOST_ERROR)
+	  }
 	  canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
 	  // Percent escapes in an ASCII reg-name are encoded data. The WHATWG hostname
 	  // parser can reject them even though fast-uri preserves them safely as RFC
@@ -39582,14 +39833,17 @@ function requireFastUri () {
 	        if (relative.path[0] === '/') {
 	          target.path = removeDotSegments(relative.path);
 	        } else {
-	          if ((base.userinfo !== undefined || base.host !== undefined || base.port !== undefined) && !base.path) {
+	          const baseHasAuthority = base.userinfo !== undefined || base.host !== undefined || base.port !== undefined;
+	          if (baseHasAuthority && !base.path) {
 	            target.path = '/' + relative.path;
 	          } else if (!base.path) {
 	            target.path = relative.path;
 	          } else {
 	            target.path = base.path.slice(0, base.path.lastIndexOf('/') + 1) + relative.path;
 	          }
-	          target.path = removeDotSegments(target.path);
+	          target.path = base.scheme === undefined && !baseHasAuthority && target.path[0] !== '/'
+	            ? removeDotSegmentsRelative(target.path)
+	            : removeDotSegments(target.path);
 	        }
 	        target.query = relative.query;
 	      }
@@ -39645,7 +39899,7 @@ function requireFastUri () {
 	  const uriTokens = [];
 
 	  if (component.scheme) {
-	    component.scheme = decodeValidScheme(component.scheme);
+	    component.scheme = validateScheme(component.scheme);
 	  }
 
 	  // find scheme handler
@@ -39655,7 +39909,11 @@ function requireFastUri () {
 	  if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
 
 	  const hasAuthority = component.userinfo !== undefined || component.host !== undefined || component.port !== undefined;
-	  const pathNoScheme = !options.skipEscape && component.scheme === undefined && !hasAuthority;
+	  // A reference with no emitted scheme is path-noscheme: a bare ':' in its
+	  // first path segment would reparse as a scheme (RFC 3986 3.3/4.2). Enforced
+	  // under skipEscape too (resolve()), so the reapply below gates on this flag.
+	  const schemelessReference = (component.scheme === undefined || options.reference === 'suffix') && !hasAuthority;
+	  const pathNoScheme = !options.skipEscape && schemelessReference;
 
 	  if (component.path !== undefined) {
 	    if (!options.skipEscape) {
@@ -39667,7 +39925,7 @@ function requireFastUri () {
 
 	  if (options.reference !== 'suffix' && component.scheme) {
 	    // Scheme handlers may replace the scheme during serialization.
-	    component.scheme = decodeValidScheme(component.scheme);
+	    component.scheme = validateScheme(component.scheme);
 	    uriTokens.push(component.scheme, ':');
 	  }
 
@@ -39687,13 +39945,18 @@ function requireFastUri () {
 	    let s = component.path;
 
 	    if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
-	      s = removeDotSegments(s);
+	      // A relative-path reference keeps its unresolvable leading ".." segments
+	      // and must never become root-relative (RFC 3986 section 5.2.4 applies to
+	      // merged target paths, not to the reference itself).
+	      s = schemelessReference && s[0] !== '/'
+	        ? removeDotSegmentsRelative(s)
+	        : removeDotSegments(s);
 	    }
 
 	    // Dot-segment removal can expose a colon that was not originally in the
 	    // first segment (for example, "./a:b"). Reapply path-noscheme encoding so
 	    // the serialized relative reference cannot be reparsed as a URI scheme.
-	    if (pathNoScheme) {
+	    if (schemelessReference) {
 	      s = serializePathEncoding(s, true);
 	    }
 
@@ -39808,6 +40071,11 @@ function requireFastUri () {
 	 * @returns {boolean} whether host conversion failed
 	 */
 	function canonicalizeHost (parsed, options, schemeHandler, isIP) {
+	  if (hasForbiddenDomainHost(parsed, options, schemeHandler, isIP)) {
+	    parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+	    return true
+	  }
+
 	  if (
 	    !options.unicodeSupport &&
 	    (!schemeHandler || !schemeHandler.unicodeSupport) &&
@@ -39817,16 +40085,62 @@ function requireFastUri () {
 	    isIP === false &&
 	    nonSimpleDomain(parsed.host)
 	  ) {
+	    let url;
 	    try {
-	      parsed.host = new URL('http://' + parsed.host).hostname;
+	      url = new URL('http://' + parsed.host);
 	    } catch (e) {
 	      parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
 	      return true
 	    }
+	    // The WHATWG parser must have read the whole input as a host. Anything
+	    // else means it found a delimiter fast-uri did not, so its hostname would
+	    // describe a different authority.
+	    if (!isHostOnlyURL(url)) {
+	      parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+	      return true
+	    }
+	    parsed.host = url.hostname;
 	  }
 	  return false
 	}
 
+	/**
+	 * Whether a domain host contains an ASCII character that RFC 3986 does not
+	 * allow in a reg-name (unreserved, sub-delims, or pct-encoded). Such a host is
+	 * rejected instead of being handed to the WHATWG URL parser, which would treat
+	 * "@" as a userinfo delimiter (silently dropping the data before it) and strip
+	 * TAB, LF, and CR. Non-ASCII characters remain allowed for IDNs.
+	 *
+	 * @param {import('./types/index').URIComponent} parsed
+	 * @param {import('./types/index').Options} options
+	 * @param {{ domainHost?: boolean }|undefined} schemeHandler
+	 * @param {boolean} isIP
+	 * @returns {boolean}
+	 */
+	function hasForbiddenDomainHost (parsed, options, schemeHandler, isIP) {
+	  return Boolean(
+	    parsed.host &&
+	    isIP === false &&
+	    !isIPLiteral(parsed.host) &&
+	    (options.domainHost || (schemeHandler && schemeHandler.domainHost)) &&
+	    FORBIDDEN_DOMAIN_HOST_CHARACTER.test(parsed.host)
+	  )
+	}
+
+	/**
+	 * @param {URL} url
+	 * @returns {boolean}
+	 */
+	function isHostOnlyURL (url) {
+	  return url.username === '' &&
+	    url.password === '' &&
+	    url.port === '' &&
+	    url.pathname === '/' &&
+	    url.search === '' &&
+	    url.hash === '' &&
+	    url.hostname !== ''
+	}
+
 	/**
 	 * @param {string} uri
 	 * @param {import('./types/index').Options} [opts]
@@ -39909,9 +40223,8 @@ function requireFastUri () {
 	    parsed.fragment = matches[8];
 
 	    if (parsed.scheme !== undefined) {
-	      const decodedScheme = unescape(parsed.scheme);
-	      if (VALID_SCHEME.test(decodedScheme)) {
-	        parsed.scheme = decodedScheme.toLowerCase();
+	      if (VALID_SCHEME.test(parsed.scheme)) {
+	        parsed.scheme = parsed.scheme.toLowerCase();
 	      } else {
 	        parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
 	        malformedScheme = true;
@@ -39945,7 +40258,7 @@ function requireFastUri () {
 	        parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
 
 	        if (malformedIPLiteral) {
-	          parsed.error = parsed.error || 'URI host is malformed.';
+	          parsed.error = parsed.error || MALFORMED_HOST_ERROR;
 	          malformedAuthorityOrPort = true;
 	        }
 	      } else {
@@ -39982,7 +40295,11 @@ function requireFastUri () {
 	        // pass only restores uppercase hex in escapes that remain encoded.
 	        host = normalizePercentEncoding(host.toLowerCase());
 	      }
-	      parsed.host = reescapeHostDelimiters(host, isIP);
+	      // Resolution parses both inputs with the internal `null` scheme before
+	      // the effective scheme is known. Keep raw host delimiters for that step
+	      // so resolve() can reject them for domain-host schemes; the resolved
+	      // authority is encoded when it is serialized.
+	      parsed.host = isIP || options.scheme !== 'null' ? reescapeHostDelimiters(host, isIP) : host;
 	    }
 
 	    if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {