@mininglamp-oss/octo-runtime 1.0.1 → 1.1.0

package/node_modules/fast-uri/test/reserved-path-normalization.test.js

@@ -1,109 +0,0 @@
-'use strict'
-
-const test = require('tape')
-const fastURI = require('..')
-
-const PATH_RESERVED = "!$&'()*+,;=:@/"
-
-function percentEncode (character, lowerCase) {
-  const hex = character.charCodeAt(0).toString(16).padStart(2, '0')
-  return '%' + (lowerCase ? hex : hex.toUpperCase())
-}
-
-test('normalize preserves literal and escaped reserved path characters', (t) => {
-  t.equal(
-    fastURI.normalize('http://example.com/a;b'),
-    'http://example.com/a;b',
-    'literal semicolon remains literal'
-  )
-  t.equal(
-    fastURI.normalize('http://example.com/a%3ab'),
-    'http://example.com/a%3Ab',
-    'escaped colon remains escaped and its hex is uppercased'
-  )
-
-  for (const character of PATH_RESERVED) {
-    const literal = `http://example.com/a${character}b`
-    const escaped = `http://example.com/a${percentEncode(character, true)}b`
-    const normalizedEscape = `http://example.com/a${percentEncode(character, false)}b`
-
-    t.equal(fastURI.normalize(literal), literal, `preserves literal ${character}`)
-    t.equal(fastURI.normalize(escaped), normalizedEscape, `preserves escaped ${character}`)
-  }
-
-  t.equal(
-    fastURI.normalize('http://example.com/a/./café'),
-    'http://example.com/a/caf%C3%A9',
-    'removes real dot segments and UTF-8 encodes raw non-ASCII'
-  )
-  t.equal(
-    fastURI.normalize('http://example.com/a/%2e%2e/b'),
-    'http://example.com/a/%2E%2E/b',
-    'preserves escaped dots as path data'
-  )
-  t.equal(
-    fastURI.normalize('http://example.com/Kſ'),
-    'http://example.com/%E2%84%AA%C5%BF',
-    'UTF-8 encodes Unicode characters that case-fold to ASCII'
-  )
-  t.end()
-})
-
-test('serialize uses the RFC 3986 path character set without opening escapes', (t) => {
-  const rawPath = `/a${PATH_RESERVED}b`
-  t.equal(
-    fastURI.serialize({ scheme: 'http', host: 'example.com', path: rawPath }),
-    `http://example.com${rawPath}`,
-    'keeps all legal raw path characters'
-  )
-
-  const escapedPath = Array.from(PATH_RESERVED, (character) => percentEncode(character, true)).join('')
-  const normalizedEscapedPath = Array.from(PATH_RESERVED, (character) => percentEncode(character, false)).join('')
-  t.equal(
-    fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/' + escapedPath }),
-    'http://example.com/' + normalizedEscapedPath,
-    'uppercases valid escapes without decoding reserved characters'
-  )
-
-  t.equal(
-    fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/a?b#c[d]' }),
-    'http://example.com/a%3Fb%23c%5Bd%5D',
-    'encodes characters that would leave the path component'
-  )
-  t.equal(
-    fastURI.serialize({ path: 'a:b/c:d' }),
-    'a%3Ab/c:d',
-    'only escapes a colon where path-noscheme requires it'
-  )
-  t.equal(
-    fastURI.serialize({ path: './a:b/c:d' }),
-    'a%3Ab/c:d',
-    'escapes a first-segment colon exposed by dot-segment removal'
-  )
-  t.equal(
-    fastURI.normalize('./a:b'),
-    'a%3Ab',
-    'normalization keeps a relative path from becoming a scheme'
-  )
-  t.equal(
-    fastURI.serialize({ path: '/Kſ' }),
-    '/%E2%84%AA%C5%BF',
-    'UTF-8 encodes Unicode characters that case-fold to ASCII'
-  )
-  t.end()
-})
-
-test('equal distinguishes escaped reserved path data from literal syntax', (t) => {
-  for (const character of PATH_RESERVED) {
-    const literal = `http://example.com/a${character}b`
-    const escaped = `http://example.com/a${percentEncode(character, false)}b`
-    t.equal(fastURI.equal(literal, escaped, {}), false, `distinguishes literal and escaped ${character}`)
-  }
-
-  t.equal(
-    fastURI.equal('./a:b', 'a:b', {}),
-    false,
-    'does not equate a relative path with an absolute URI after removing dot segments'
-  )
-  t.end()
-})

package/node_modules/fast-uri/test/resolve.test.js

@@ -1,87 +0,0 @@
-'use strict'
-
-const test = require('tape')
-const fastURI = require('..')
-
-test('URI Resolving', (t) => {
-  // normal examples from RFC 3986
-  const base = 'uri://a/b/c/d;p?q'
-  t.equal(fastURI.resolve(base, 'g:h'), 'g:h', 'g:h')
-  t.equal(fastURI.resolve(base, 'g:h'), 'g:h', 'g:h')
-  t.equal(fastURI.resolve(base, 'g'), 'uri://a/b/c/g', 'g')
-  t.equal(fastURI.resolve(base, './g'), 'uri://a/b/c/g', './g')
-  t.equal(fastURI.resolve(base, 'g/'), 'uri://a/b/c/g/', 'g/')
-  t.equal(fastURI.resolve(base, '/g'), 'uri://a/g', '/g')
-  t.equal(fastURI.resolve(base, '//g'), 'uri://g', '//g')
-  t.equal(fastURI.resolve(base, '?y'), 'uri://a/b/c/d;p?y', '?y')
-  t.equal(fastURI.resolve(base, 'g?y'), 'uri://a/b/c/g?y', 'g?y')
-  t.equal(fastURI.resolve(base, '#s'), 'uri://a/b/c/d;p?q#s', '#s')
-  t.equal(fastURI.resolve(base, 'g#s'), 'uri://a/b/c/g#s', 'g#s')
-  t.equal(fastURI.resolve(base, 'g?y#s'), 'uri://a/b/c/g?y#s', 'g?y#s')
-  t.equal(fastURI.resolve(base, ';x'), 'uri://a/b/c/;x', ';x')
-  t.equal(fastURI.resolve(base, 'g;x'), 'uri://a/b/c/g;x', 'g;x')
-  t.equal(fastURI.resolve(base, 'g;x?y#s'), 'uri://a/b/c/g;x?y#s', 'g;x?y#s')
-  t.equal(fastURI.resolve(base, ''), 'uri://a/b/c/d;p?q', '')
-  t.equal(fastURI.resolve(base, '.'), 'uri://a/b/c/', '.')
-  t.equal(fastURI.resolve(base, './'), 'uri://a/b/c/', './')
-  t.equal(fastURI.resolve(base, '..'), 'uri://a/b/', '..')
-  t.equal(fastURI.resolve(base, '../'), 'uri://a/b/', '../')
-  t.equal(fastURI.resolve(base, '../g'), 'uri://a/b/g', '../g')
-  t.equal(fastURI.resolve(base, '../..'), 'uri://a/', '../..')
-  t.equal(fastURI.resolve(base, '../../'), 'uri://a/', '../../')
-  t.equal(fastURI.resolve(base, '../../g'), 'uri://a/g', '../../g')
-
-  // abnormal examples from RFC 3986
-  t.equal(fastURI.resolve(base, '../../../g'), 'uri://a/g', '../../../g')
-  t.equal(fastURI.resolve(base, '../../../../g'), 'uri://a/g', '../../../../g')
-
-  t.equal(fastURI.resolve(base, '/./g'), 'uri://a/g', '/./g')
-  t.equal(fastURI.resolve(base, '/../g'), 'uri://a/g', '/../g')
-  t.equal(fastURI.resolve(base, 'g.'), 'uri://a/b/c/g.', 'g.')
-  t.equal(fastURI.resolve(base, '.g'), 'uri://a/b/c/.g', '.g')
-  t.equal(fastURI.resolve(base, 'g..'), 'uri://a/b/c/g..', 'g..')
-  t.equal(fastURI.resolve(base, '..g'), 'uri://a/b/c/..g', '..g')
-
-  t.equal(fastURI.resolve(base, './../g'), 'uri://a/b/g', './../g')
-  t.equal(fastURI.resolve(base, './g/.'), 'uri://a/b/c/g/', './g/.')
-  t.equal(fastURI.resolve(base, 'g/./h'), 'uri://a/b/c/g/h', 'g/./h')
-  t.equal(fastURI.resolve(base, 'g/../h'), 'uri://a/b/c/h', 'g/../h')
-  t.equal(fastURI.resolve(base, 'g;x=1/./y'), 'uri://a/b/c/g;x=1/y', 'g;x=1/./y')
-  t.equal(fastURI.resolve(base, 'g;x=1/../y'), 'uri://a/b/c/y', 'g;x=1/../y')
-
-  t.equal(fastURI.resolve(base, 'g?y/./x'), 'uri://a/b/c/g?y/./x', 'g?y/./x')
-  t.equal(fastURI.resolve(base, 'g?y/../x'), 'uri://a/b/c/g?y/../x', 'g?y/../x')
-  t.equal(fastURI.resolve(base, 'g#s/./x'), 'uri://a/b/c/g#s/./x', 'g#s/./x')
-  t.equal(fastURI.resolve(base, 'g#s/../x'), 'uri://a/b/c/g#s/../x', 'g#s/../x')
-
-  t.equal(fastURI.resolve(base, 'uri:g'), 'uri:g', 'uri:g')
-  t.equal(fastURI.resolve(base, 'uri:g', {}), 'uri:g', 'uri:g')
-  t.equal(fastURI.resolve(base, 'uri:g', { tolerant: undefined }), 'uri:g', 'uri:g')
-  t.equal(fastURI.resolve(base, 'uri:g', { tolerant: false }), 'uri:g', 'uri:g')
-  t.equal(fastURI.resolve(base, 'uri:g', { tolerant: true }), 'uri://a/b/c/g', 'uri:g')
-
-  // examples by PAEz
-  // example was provided to avoid infinite loop within regex
-  // this is not the case anymore
-  // t.equal(URI.resolve('//www.g.com/', '/adf\ngf'), '//www.g.com/adf%0Agf', '/adf\\ngf')
-  // t.equal(URI.resolve('//www.g.com/error\n/bleh/bleh', '..'), '//www.g.com/error%0A/', '//www.g.com/error\\n/bleh/bleh')
-  t.end()
-})
-
-test('URN Resolving', (t) => {
-  // example from epoberezkin
-  t.equal(fastURI.resolve('', 'urn:some:ip:prop'), 'urn:some:ip:prop', 'urn:some:ip:prop')
-  t.equal(fastURI.resolve('#', 'urn:some:ip:prop'), 'urn:some:ip:prop', 'urn:some:ip:prop')
-  t.equal(fastURI.resolve('urn:some:ip:prop', 'urn:some:ip:prop'), 'urn:some:ip:prop', 'urn:some:ip:prop')
-  t.equal(fastURI.resolve('urn:some:other:prop', 'urn:some:ip:prop'), 'urn:some:ip:prop', 'urn:some:ip:prop')
-  t.end()
-})
-
-test('URI Resolving tolerates malformed fragments', (t) => {
-  t.equal(
-    fastURI.resolve('http://base.com/', 'http://example.com/#%E0%A4A'),
-    'http://example.com/#%E0%A4A',
-    'malformed fragment does not throw during resolve'
-  )
-  t.end()
-})

package/node_modules/fast-uri/test/rfc-3986.test.js

@@ -1,90 +0,0 @@
-'use strict'
-
-const test = require('tape')
-const fastURI = require('..')
-
-test('RFC 3986', (t) => {
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-
-  // A.  If the input buffer begins with a prefix of "../" or "./",
-  //     then remove that prefix from the input buffer; otherwise,
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '../', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: './', secure: true }),
-    'http://example.com/', 'http://example.com/')
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '../../', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '././', secure: true }),
-    'http://example.com/', 'http://example.com/')
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: './../', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '.././', secure: true }),
-    'http://example.com/', 'http://example.com/')
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '../foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: './foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '../../foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '././foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: './../foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '.././foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-
-  // B.  if the input buffer begins with a prefix of "/./" or "/.",
-  //     where "." is a complete path segment, then replace that
-  //     prefix with "/" in the input buffer; otherwise,
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/./', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/.', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/./foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/.././foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-
-  // C.  if the input buffer begins with a prefix of "/../" or "/..",
-  //     where ".." is a complete path segment, then replace that
-  //     prefix with "/" in the input buffer and remove the last
-  //     segment and its preceding "/" (if any) from the output
-  //     buffer; otherwise,
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/../', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/..', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/../foo', secure: true }),
-    'http://example.com/foo', 'http://example.com/foo')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/foo/..', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/foo/bar/..', secure: true }),
-    'http://example.com/foo/', 'http://example.com/foo/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/foo/../bar/..', secure: true }),
-    'http://example.com/', 'http://example.com/')
-
-  // D.  if the input buffer consists only of "." or "..", then remove
-  //     that from the input buffer; otherwise,
-
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/.', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/..', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '.', secure: true }),
-    'http://example.com/', 'http://example.com/')
-  t.strictEqual(fastURI.serialize({ scheme: 'http', host: 'example.com', path: '..', secure: true }),
-    'http://example.com/', 'http://example.com/')
-
-  t.end()
-})

package/node_modules/fast-uri/test/scheme-validation.test.js

@@ -1,124 +0,0 @@
-'use strict'
-
-const test = require('tape')
-const fastURI = require('..')
-
-const MALFORMED_SCHEME_ERROR = 'URI scheme is malformed.'
-
-const malformedSchemes = [
-  '%2f%2fevil.example:/pwn',
-  '%u002f%u002fevil.example:/pwn',
-  '%0d%0aSet-Cookie:%20sid=attacker:/p',
-  'foo%3Abar:value',
-  'foo%2Fbar:value',
-  '1http://example.com/',
-  'foo_bar:value',
-  'éxample:value',
-  'Kttp://example.com/',
-  'ſcheme:value'
-]
-
-test('parse validates the decoded scheme against RFC 3986', (t) => {
-  const validSchemes = [
-    ['a:value', 'a'],
-    ['HTTP://example.com/', 'http'],
-    ['a1+.-:value', 'a1+.-'],
-    ['%4Aavascript:alert(1)', 'javascript'],
-    ['foo%2Bbar:value', 'foo+bar'],
-    ['%u006Aavascript:1', 'javascript'],
-    ['ht%74ps://example.com/', 'https']
-  ]
-
-  for (const [uri, scheme] of validSchemes) {
-    const parsed = fastURI.parse(uri)
-    t.equal(parsed.error, undefined, uri)
-    t.equal(parsed.scheme, scheme, uri + ' scheme')
-  }
-
-  for (const uri of malformedSchemes) {
-    const parsed = fastURI.parse(uri)
-    t.equal(parsed.error, MALFORMED_SCHEME_ERROR, uri)
-  }
-  t.end()
-})
-
-test('decoded schemes select their scheme handlers', (t) => {
-  t.equal(
-    fastURI.normalize('ht%74ps://example.com:443'),
-    'https://example.com/',
-    'HTTP normalization runs after decoding the scheme'
-  )
-
-  // 3.x has no mailto scheme handler (added in v4); use the ws handler to
-  // verify that a percent-encoded scheme still selects its scheme handler
-  const ws = fastURI.parse('we%62socket://example.com/')
-  t.equal(ws.scheme, 'websocket', 'ws parsing runs after decoding the scheme')
-  t.end()
-})
-
-test('normalize preserves schemes that decode to invalid identifiers', (t) => {
-  for (const uri of malformedSchemes) {
-    t.equal(fastURI.normalize(uri), uri, uri)
-  }
-  t.end()
-})
-
-test('scheme normalization cannot introduce authority or control delimiters', (t) => {
-  const authority = '%2f%2fevil.example:/pwn'
-  const crlf = '%0d%0aSet-Cookie:%20sid=attacker:/p'
-
-  t.equal(fastURI.parse(authority).host, undefined, 'original input has no authority')
-  t.equal(fastURI.normalize(authority), authority, 'normalization does not create an authority')
-  t.equal(fastURI.normalize(crlf), crlf, 'normalization does not emit raw CRLF')
-  t.equal(fastURI.normalize(crlf).includes('\r\n'), false, 'normalized output contains no raw CRLF')
-  t.end()
-})
-
-test('equal returns false for malformed decoded schemes', (t) => {
-  for (const uri of malformedSchemes) {
-    t.equal(fastURI.equal(uri, uri, {}), false, uri)
-  }
-  t.end()
-})
-
-test('resolve rejects malformed decoded schemes in either input', (t) => {
-  t.throws(
-    () => fastURI.resolve('%2f%2fevil.example:/base', 'child'),
-    /URI scheme is malformed\./,
-    'malformed base'
-  )
-  t.throws(
-    () => fastURI.resolve('https://allowed.example/app/', '%2f%2fevil.example:/pwn'),
-    /URI scheme is malformed\./,
-    'malformed relative reference'
-  )
-  t.end()
-})
-
-test('serialize validates decoded component schemes', (t) => {
-  t.equal(
-    fastURI.serialize({ scheme: 'foo%2Bbar', path: 'value' }),
-    'foo+bar:value',
-    'valid decoded scheme is serialized'
-  )
-  t.throws(
-    () => fastURI.serialize({ scheme: '//evil.example', path: '/pwn' }),
-    /URI scheme is malformed\./,
-    'raw invalid scheme'
-  )
-  t.throws(
-    () => fastURI.serialize({ scheme: '%2f%2fevil.example', path: '/pwn' }),
-    /URI scheme is malformed\./,
-    'encoded invalid scheme'
-  )
-  t.equal(
-    fastURI.equal(
-      { scheme: '%2f%2fevil.example', path: '/pwn' },
-      { scheme: '%2f%2fevil.example', path: '/pwn' },
-      {}
-    ),
-    false,
-    'equality fails closed for malformed component objects'
-  )
-  t.end()
-})

package/node_modules/fast-uri/test/security-normalization.test.js

@@ -1,178 +0,0 @@
-'use strict'
-
-const test = require('tape')
-const fastURI = require('..')
-
-test('parse preserves reserved path escapes as data', (t) => {
-  const components = fastURI.parse('http://example.com/a%2Fb/public/%2e%2e/admin')
-
-  t.equal(components.path, '/a%2Fb/public/%2E%2E/admin')
-  t.end()
-})
-
-test('normalize preserves percent-encoded path separators and dot segments', (t) => {
-  t.equal(
-    fastURI.normalize('http://example.com/public/%2e%2e/admin'),
-    'http://example.com/public/%2E%2E/admin'
-  )
-
-  t.equal(
-    fastURI.normalize('http://example.com/a%2Fb'),
-    'http://example.com/a%2Fb'
-  )
-
-  t.end()
-})
-
-test('equal does not treat reserved path escapes as live path syntax', (t) => {
-  t.equal(
-    fastURI.equal('http://example.com/public/%2e%2e/admin', 'http://example.com/admin', {}),
-    false
-  )
-
-  t.equal(
-    fastURI.equal('http://example.com/a%2Fb', 'http://example.com/a/b', {}),
-    false
-  )
-
-  t.end()
-})
-
-test('serialize preserves literal RFC 3986 reserved path characters', (t) => {
-  // GHSA-7mh8-fcmq-x23c: literal reserved path chars must not be rewritten to
-  // percent escapes by the escape()-style safe set.
-  const cases = [
-    'http://example.com/a;b',
-    'http://example.com/a=b',
-    'http://example.com/a&b',
-    'http://example.com/a$b',
-    'http://example.com/a:b',
-    'http://example.com/a@b'
-  ]
-
-  t.plan(cases.length)
-
-  cases.forEach((uri) => {
-    t.equal(fastURI.serialize(fastURI.parse(uri)), uri, uri)
-  })
-  t.end()
-})
-
-test('serialize preserves existing reserved path escapes as data', (t) => {
-  // GHSA-7mh8-fcmq-x23c: an existing %3A escape must stay %3A instead of being
-  // rewritten into a live colon.
-  const cases = [
-    'http://example.com/a%3Ab',
-    'http://example.com/a%3Bb',
-    'http://example.com/a%3D%3D'
-  ]
-
-  t.plan(cases.length)
-
-  cases.forEach((uri) => {
-    t.equal(fastURI.serialize(fastURI.parse(uri)), uri, uri)
-  })
-  t.end()
-})
-
-test('serialize keeps path-noscheme colon escaping', (t) => {
-  // Without a scheme a literal colon would be reparsed as a scheme separator,
-  // so it must stay percent-escaped while an existing %3A is preserved.
-  t.equal(fastURI.serialize({ path: 'foo:bar' }), 'foo%3Abar')
-  t.equal(fastURI.serialize({ path: 'a%3Ab' }), 'a%3Ab')
-  t.end()
-})
-
-test('hostname normalization never decodes an escape more than once', (t) => {
-  const encodedLocalhost = 'http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/'
-  const encodedLoopback = '//127%252e0%252e0%252e1/private'
-  const encodedMetadataAddress = '//169%252E254%252E169%252E254/latest/meta-data/'
-
-  t.equal(fastURI.normalize(encodedLocalhost), encodedLocalhost, 'nested hostname letters remain encoded')
-  t.equal(fastURI.normalize(encodedLoopback), encodedLoopback, 'nested IPv4 dots remain encoded')
-  t.equal(
-    fastURI.resolve('https://safe.example/', encodedLoopback),
-    'https://127%252e0%252e0%252e1/private',
-    'resolve does not turn nested dots into a loopback address'
-  )
-  t.equal(
-    fastURI.resolve('https://allowed.com/api/v1/', encodedMetadataAddress),
-    'https://169%252e254%252e169%252e254/latest/meta-data/',
-    'resolve does not turn nested dots into a metadata address'
-  )
-  t.equal(
-    fastURI.normalize('http://allowed.com%255Cevil.com/'),
-    'http://allowed.com%255Cevil.com/',
-    'normalize does not activate a nested backslash'
-  )
-  t.equal(
-    fastURI.serialize({ scheme: 'http', host: '%256cocalhost', path: '/' }),
-    'http://%256cocalhost/',
-    'component serialization preserves an encoded percent sign'
-  )
-  t.equal(
-    fastURI.equal(encodedLocalhost, 'http://localhost/', {}),
-    false,
-    'nested escapes do not compare equal to their twice-decoded target'
-  )
-  t.end()
-})
-
-test('hostname normalization decodes only current unreserved escapes', (t) => {
-  t.equal(fastURI.normalize('x://%6cocalhost/'), 'x://localhost/', 'a current unreserved escape is decoded')
-  t.equal(fastURI.normalize('x://%256cocalhost/'), 'x://%256cocalhost/', 'an encoded percent is preserved')
-  t.equal(fastURI.normalize('x://host%2540evil/'), 'x://host%2540evil/', 'a nested authority delimiter stays inert')
-  t.equal(fastURI.normalize('x://%2525/'), 'x://%2525/', 'nested encoded percent signs stay encoded')
-  t.end()
-})
-
-test('scheme-relative hostname normalization folds decoded ASCII case', (t) => {
-  const encodedHost = '//%41.com'
-  const normalizedHost = fastURI.normalize(encodedHost)
-  const encodedMetadata = '//%4Detadata.internal/private'
-  const literalMetadata = '//metadata.internal/private'
-
-  t.equal(fastURI.parse(encodedHost).host, 'a.com', 'parse folds an encoded uppercase host letter')
-  t.equal(normalizedHost, '//a.com', 'normalize emits a lowercase host')
-  t.equal(fastURI.normalize(normalizedHost), normalizedHost, 'host normalization is idempotent')
-  t.equal(fastURI.equal(encodedHost, '//a.com'), true, 'encoded and literal host spellings compare equal')
-  t.equal(fastURI.equal(encodedMetadata, literalMetadata), true, 'encoded metadata host compares equal')
-  t.equal(
-    fastURI.resolve('x://trusted.example/', encodedMetadata),
-    fastURI.resolve('x://trusted.example/', literalMetadata),
-    'encoded and literal metadata hosts resolve identically'
-  )
-  t.equal(
-    fastURI.normalize('//example.com%2fpath'),
-    '//example.com%2Fpath',
-    'reserved host escapes remain encoded with uppercase hex'
-  )
-  t.equal(fastURI.normalize('//%2541.com'), '//%2541.com', 'nested host escapes are not decoded twice')
-  t.equal(fastURI.equal('//User@%41.com/path', '//user@a.com/path'), false, 'userinfo remains case-sensitive')
-  t.equal(fastURI.equal('//%41.com/Path', '//a.com/path'), false, 'path remains case-sensitive')
-  t.equal(fastURI.equal('//%41.com/?Token=Value', '//a.com/?token=value'), false, 'query remains case-sensitive')
-  t.end()
-})
-
-test('host normalization applies to schemes that skip path normalization', (t) => {
-  const encodedHost = 'mailto://%41.com'
-  const literalHost = 'mailto://a.com'
-
-  t.equal(fastURI.parse(encodedHost).host, fastURI.parse(literalHost).host, 'parse results have consistent hosts')
-  t.equal(fastURI.normalize(encodedHost), fastURI.normalize(literalHost), 'normalize results are consistent')
-  t.equal(fastURI.equal(encodedHost, literalHost), true, 'encoded and literal hosts compare equal')
-  t.end()
-})
-
-test('host conversion failures are not treated as comparable URLs', (t) => {
-  const malformedHost = 'http://trusted.test%2540evil.test/'
-
-  t.equal(fastURI.normalize(malformedHost), malformedHost, 'normalization preserves the failing input')
-  t.equal(fastURI.equal(malformedHost, malformedHost, {}), false, 'equal rejects a failed host conversion')
-  t.throws(
-    () => fastURI.resolve(malformedHost, 'child', { domainHost: true }),
-    /Host's domain name can not be converted to ASCII/,
-    'resolve propagates a host conversion failure'
-  )
-  t.end()
-})