@nocobase/plugin-mcp-server 2.4.0-alpha.1 → 2.4.0-alpha.11

package/dist/node_modules/fast-uri/test/ipv6-validation.test.js

@@ -0,0 +1,124 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+const HOST_ERROR = 'URI host is malformed.'
+
+const malformedLiterals = [
+  '::not-valid',
+  'fc00::not-hex',
+  'fe80::not-hex',
+  '1:2:3',
+  '1:2:3:4:5:6:7',
+  '1:2:3:4:5:6:7:8:9',
+  '1::2::3',
+  '1:::2',
+  ':::1',
+  '12345::',
+  '1:2:3:4:5:6:7::8',
+  '::ffff:192.0.2.999',
+  '::ffff:192.0.2',
+  '::ffff:192.168.001.1',
+  '::192.0.2.1:1',
+  '1:2:3:4:5:192.0.2.1::',
+  'v.foo',
+  'v1.',
+  'v1.foo%25bar',
+  'v1.K',
+  'fe80::1%25',
+  'fe80::1%25eth 0',
+  'fe80::1%25eth%ZZ',
+  'fe80::1%25K',
+  'not-an-ip'
+]
+
+test('malformed bracketed IP literals fail without being rewritten', (t) => {
+  for (const literal of malformedLiterals) {
+    const uri = `http://[${literal}]/private`
+    const parsed = fastURI.parse(uri)
+
+    t.equal(parsed.error, HOST_ERROR, `parse rejects ${literal}`)
+    t.equal(parsed.host, `[${literal.toLowerCase()}]`, `parse does not truncate ${literal}`)
+    t.equal(fastURI.normalize(uri), uri, `normalize preserves ${literal}`)
+    t.equal(fastURI.equal(uri, uri), false, `equal rejects ${literal}`)
+  }
+  t.end()
+})
+
+test('resolve throws for malformed bracketed IP literals', (t) => {
+  for (const literal of malformedLiterals) {
+    const uri = `http://[${literal}]/private`
+
+    t.throws(
+      () => fastURI.resolve(uri, 'child'),
+      /URI host is malformed\./,
+      `rejects malformed base ${literal}`
+    )
+    t.throws(
+      () => fastURI.resolve('http://example.com/', uri),
+      /URI host is malformed\./,
+      `rejects malformed relative input ${literal}`
+    )
+  }
+  t.end()
+})
+
+test('valid IPv6, IPvFuture, embedded IPv4, and zone forms normalize safely', (t) => {
+  const cases = [
+    ['http://[::]/', 'http://[::]/', '::'],
+    ['http://[::1]/', 'http://[::1]/', '::1'],
+    ['http://[1::]/', 'http://[1::]/', '1::'],
+    ['http://[2001:0DB8::0001]/', 'http://[2001:db8::1]/', '2001:db8::1'],
+    ['http://[0:0:0:0:0:0:0:0]/', 'http://[::]/', '::'],
+    ['http://[::ffff:192.0.2.1]/', 'http://[::ffff:192.0.2.1]/', '::ffff:192.0.2.1'],
+    ['http://[1:2:3:4:5:6:192.0.2.1]/', 'http://[1:2:3:4:5:6:192.0.2.1]/', '1:2:3:4:5:6:192.0.2.1'],
+    ['http://[fe80::A%25EN1]/', 'http://[fe80::a%25EN1]/', 'fe80::a%EN1'],
+    ['http://[fe80::a%en1]/', 'http://[fe80::a%25en1]/', 'fe80::a%en1'],
+    ['http://[fe80::a%25eth%2D0]/', 'http://[fe80::a%25eth%2D0]/', 'fe80::a%eth%2D0'],
+    ['http://[v1.example]/', 'http://[v1.example]/', '[v1.example]'],
+    ['http://[vF.A:b]/', 'http://[vf.a:b]/', '[vf.a:b]']
+  ]
+
+  for (const [uri, normalized, host] of cases) {
+    const parsed = fastURI.parse(uri)
+    t.equal(parsed.error, undefined, `${uri} parses without error`)
+    t.equal(parsed.host, host, `${uri} has the expected host`)
+    t.equal(fastURI.normalize(uri), normalized, `${uri} normalizes safely`)
+  }
+  t.end()
+})
+
+test('hosts with unbalanced or misplaced IP-literal brackets are rejected', (t) => {
+  const malformed = [
+    'http://[fe80',
+    'http://[',
+    'http://[not-an-ip',
+    'http://[\u65e5\u672c',
+    'http://user@[@127.0.0.1:8123/admin',
+    'http://user@]127.0.0.1:8123/admin',
+    'http://user@prefix[@127.0.0.1:8123/admin',
+    'http://user@prefix]@127.0.0.1:8123/admin'
+  ]
+  const modes = [
+    ['default', undefined],
+    ['Unicode', { unicodeSupport: true }]
+  ]
+
+  for (const [mode, options] of modes) {
+    for (const uri of malformed) {
+      const parsed = fastURI.parse(uri, options)
+      const message = `${mode} mode rejects ${uri}`
+
+      t.equal(parsed.error, HOST_ERROR, `parse ${message}`)
+      t.equal(fastURI.normalize(uri, options), uri, `normalize preserves ${uri} in ${mode} mode`)
+      t.equal(fastURI.equal(uri, uri, options), false, `equal ${message}`)
+      t.throws(
+        () => fastURI.resolve('http://example.com/', uri, options),
+        /URI host is malformed\./,
+        `resolve ${message}`
+      )
+    }
+  }
+  t.end()
+})

package/dist/node_modules/fast-uri/test/malformed-percent.test.js

@@ -0,0 +1,77 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+const MALFORMED_PERCENT_ERROR = 'URI contains malformed percent-encoding.'
+
+const malformedComponents = [
+  ['path', 'x://example.test/a%'],
+  ['path with one trailing hex digit', 'x://example.test/a%2'],
+  ['path with non-hex digits', 'x://example.test/a%GG'],
+  ['host', 'x://exa%mple.test/path'],
+  ['userinfo', 'x://us%er@example.test/path'],
+  ['query', 'x://example.test/path?q=%G0'],
+  ['fragment', 'x://example.test/path#frag%1']
+]
+
+test('parse reports malformed percent syntax in generic URI components', (t) => {
+  for (const [component, uri] of malformedComponents) {
+    t.equal(fastURI.parse(uri).error, MALFORMED_PERCENT_ERROR, component)
+  }
+  t.end()
+})
+
+test('normalize preserves malformed percent input unchanged', (t) => {
+  for (const [component, uri] of malformedComponents) {
+    t.equal(fastURI.normalize(uri), uri, component)
+  }
+  t.end()
+})
+
+test('equal does not equate malformed input with repaired valid input', (t) => {
+  const cases = [
+    ['x://example.test/a%', 'x://example.test/a%25'],
+    ['x://exa%mple.test/path', 'x://exa%25mple.test/path'],
+    ['x://us%er@example.test/path', 'x://us%25er@example.test/path'],
+    ['x://example.test/path?q=%', 'x://example.test/path?q=%25'],
+    ['x://example.test/path#%', 'x://example.test/path#%25']
+  ]
+
+  for (const [malformed, repaired] of cases) {
+    t.equal(fastURI.equal(malformed, repaired, {}), false, malformed)
+  }
+  t.end()
+})
+
+test('resolve rejects malformed percent syntax in either input', (t) => {
+  t.throws(
+    () => fastURI.resolve('x://example.test/base%', 'child'),
+    /URI contains malformed percent-encoding\./,
+    'malformed base'
+  )
+  t.throws(
+    () => fastURI.resolve('x://example.test/base', 'child%'),
+    /URI contains malformed percent-encoding\./,
+    'malformed relative reference'
+  )
+  t.end()
+})
+
+test('valid percent octets remain valid without UTF-8 validation', (t) => {
+  const uri = '/%ff?q=%80#%fe'
+  const parsed = fastURI.parse(uri)
+
+  t.equal(parsed.error, undefined, 'non-UTF-8 octets are valid percent syntax')
+  t.equal(parsed.path, '/%FF', 'path octet is preserved and hex is uppercased')
+  t.equal(parsed.query, 'q=%80', 'query octet is preserved')
+  t.equal(parsed.fragment, '%FE', 'fragment octet is preserved and hex is uppercased')
+  t.equal(fastURI.normalize(uri), '/%FF?q=%80#%FE', 'normalization preserves the octets')
+
+  const allGenericComponents = fastURI.parse('x://u%2f@exa%2fmple.test/%2f?q=%2f#%2f')
+  t.equal(allGenericComponents.error, undefined, 'valid escapes are accepted in every generic component')
+
+  const ipv6Zone = fastURI.parse('//[2001:db8::7%en0]')
+  t.equal(ipv6Zone.error, undefined, 'historically accepted raw IPv6 zone separator is unchanged')
+  t.end()
+})

package/dist/node_modules/fast-uri/test/malformed-urn.test.js

@@ -0,0 +1,61 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+const malformedURNs = [
+  'urn:',
+  'URN:',
+  'urn:foo',
+  'urn::foo',
+  'urn:foo:',
+  'urn:%66oo:bar'
+]
+
+test('parse reports malformed ordinary URNs', (t) => {
+  for (const uri of malformedURNs) {
+    t.match(fastURI.parse(uri).error, /^URN can not be parsed\.?$/, uri)
+  }
+  t.end()
+})
+
+test('normalize preserves malformed ordinary URNs without throwing', (t) => {
+  for (const uri of malformedURNs) {
+    t.doesNotThrow(() => fastURI.normalize(uri), `${uri} does not throw`)
+    t.equal(fastURI.normalize(uri), uri, `${uri} is preserved`)
+  }
+  t.equal(
+    fastURI.normalize('urn:foo', { reference: 'relative' }),
+    'urn:foo',
+    'an earlier parse error does not hide the missing URN nid'
+  )
+  t.end()
+})
+
+test('equal returns false for malformed ordinary URNs', (t) => {
+  for (const uri of malformedURNs) {
+    t.equal(fastURI.equal(uri, uri, {}), false, `${uri} is not equal to itself as malformed input`)
+    t.equal(fastURI.equal(uri, 'urn:foo:bar', {}), false, `${uri} is not equal to a valid URN`)
+  }
+  t.end()
+})
+
+test('resolve handles malformed ordinary URNs without throwing', (t) => {
+  for (const uri of malformedURNs) {
+    t.doesNotThrow(() => fastURI.resolve('uri://base/', uri), `${uri} does not throw as a relative reference`)
+    t.doesNotThrow(() => fastURI.resolve(uri, ''), `${uri} does not throw as a base URI`)
+  }
+  // resolve preserves the malformed scheme-specific input rather than surfacing
+  // an uncaught 'URN without nid cannot be serialized' error (matches upstream uri-js)
+  t.equal(fastURI.resolve('uri://base/', 'urn:'), 'urn:', 'malformed relative URN is preserved')
+  t.equal(fastURI.resolve('URN:', ''), 'urn:', 'scheme case is normalized')
+  t.equal(fastURI.resolve('uri://base/', 'urn:%66oo:bar'), 'urn:foo:bar', 'percent-encoding is decoded')
+  t.end()
+})
+
+test('valid URNs retain their existing behavior', (t) => {
+  t.equal(fastURI.normalize('URN:FOO:a123,456'), 'urn:foo:a123,456')
+  t.equal(fastURI.equal('urn:foo:a123,456', 'URN:FOO:a123,456', {}), true)
+  t.equal(fastURI.resolve('uri://base/', 'urn:'), 'urn:', 'default resolve behavior is unchanged')
+  t.end()
+})

package/dist/node_modules/fast-uri/test/parse.test.js

@@ -1,13 +1,13 @@
 'use strict'
 
 const test = require('tape')
-const URI = require('../')
+const fastURI = require('..')
 
 test('URI parse', (t) => {
   let components
 
   // scheme
-  components = URI.parse('uri:')
+  components = fastURI.parse('uri:')
   t.equal(components.error, undefined, 'scheme errors')
   t.equal(components.scheme, 'uri', 'scheme')
   // t.equal(components.authority, undefined, "authority");
@@ -19,7 +19,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, undefined, 'fragment')
 
   // userinfo
-  components = URI.parse('//@')
+  components = fastURI.parse('//@')
   t.equal(components.error, undefined, 'userinfo errors')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, "@", "authority");
@@ -31,7 +31,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, undefined, 'fragment')
 
   // host
-  components = URI.parse('//')
+  components = fastURI.parse('//')
   t.equal(components.error, undefined, 'host errors')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, "", "authority");
@@ -43,7 +43,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, undefined, 'fragment')
 
   // port
-  components = URI.parse('//:')
+  components = fastURI.parse('//:')
   t.equal(components.error, undefined, 'port errors')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, ":", "authority");
@@ -55,7 +55,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, undefined, 'fragment')
 
   // path
-  components = URI.parse('')
+  components = fastURI.parse('')
   t.equal(components.error, undefined, 'path errors')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
@@ -67,7 +67,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, undefined, 'fragment')
 
   // query
-  components = URI.parse('?')
+  components = fastURI.parse('?')
   t.equal(components.error, undefined, 'query errors')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
@@ -79,7 +79,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, undefined, 'fragment')
 
   // fragment
-  components = URI.parse('#')
+  components = fastURI.parse('#')
   t.equal(components.error, undefined, 'fragment errors')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
@@ -91,7 +91,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, '', 'fragment')
 
   // fragment with character tabulation
-  components = URI.parse('#\t')
+  components = fastURI.parse('#\t')
   t.equal(components.error, undefined, 'path errors')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
@@ -103,7 +103,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, '%09', 'fragment')
 
   // fragment with line feed
-  components = URI.parse('#\n')
+  components = fastURI.parse('#\n')
   t.equal(components.error, undefined, 'path errors')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
@@ -115,7 +115,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, '%0A', 'fragment')
 
   // fragment with line tabulation
-  components = URI.parse('#\v')
+  components = fastURI.parse('#\v')
   t.equal(components.error, undefined, 'path errors')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
@@ -127,7 +127,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, '%0B', 'fragment')
 
   // fragment with form feed
-  components = URI.parse('#\f')
+  components = fastURI.parse('#\f')
   t.equal(components.error, undefined, 'path errors')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
@@ -139,7 +139,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, '%0C', 'fragment')
 
   // fragment with carriage return
-  components = URI.parse('#\r')
+  components = fastURI.parse('#\r')
   t.equal(components.error, undefined, 'path errors')
   t.equal(components.scheme, undefined, 'scheme')
   // t.equal(components.authority, undefined, "authority");
@@ -150,8 +150,15 @@ test('URI parse', (t) => {
   t.equal(components.query, undefined, 'query')
   t.equal(components.fragment, '%0D', 'fragment')
 
+  // a fragment whose decoded bytes are not valid UTF-8 is still valid
+  // percent-encoding (RFC 3986 §2.1 is byte-level), so it is preserved as-is
+  // rather than being flagged as malformed
+  components = fastURI.parse('http://example.com/#%E0%A4A')
+  t.equal(components.error, undefined, 'valid percent-encoding is not flagged as malformed')
+  t.equal(components.fragment, '%E0%A4A', 'fragment is preserved')
+
   // all
-  components = URI.parse('uri://user:pass@example.com:123/one/two.three?q1=a1&q2=a2#body')
+  components = fastURI.parse('uri://user:pass@example.com:123/one/two.three?q1=a1&q2=a2#body')
   t.equal(components.error, undefined, 'all errors')
   t.equal(components.scheme, 'uri', 'scheme')
   // t.equal(components.authority, "user:pass@example.com:123", "authority");
@@ -163,7 +170,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, 'body', 'fragment')
 
   // IPv4address
-  components = URI.parse('//10.10.10.10')
+  components = fastURI.parse('//10.10.10.10')
   t.equal(components.error, undefined, 'IPv4address errors')
   t.equal(components.scheme, undefined, 'scheme')
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -174,7 +181,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, undefined, 'fragment')
 
   // IPv4address with unformated 0 stay as-is
-  components = URI.parse('//10.10.000.10') // not valid as per https://datatracker.ietf.org/doc/html/rfc5954#section-4.1
+  components = fastURI.parse('//10.10.000.10') // not valid as per https://datatracker.ietf.org/doc/html/rfc5954#section-4.1
   t.equal(components.error, undefined, 'IPv4address errors')
   t.equal(components.scheme, undefined, 'scheme')
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -183,7 +190,7 @@ test('URI parse', (t) => {
   t.equal(components.path, '', 'path')
   t.equal(components.query, undefined, 'query')
   t.equal(components.fragment, undefined, 'fragment')
-  components = URI.parse('//01.01.01.01') // not valid in URIs: https://datatracker.ietf.org/doc/html/rfc3986#section-7.4
+  components = fastURI.parse('//01.01.01.01') // not valid in URIs: https://datatracker.ietf.org/doc/html/rfc3986#section-7.4
   t.equal(components.error, undefined, 'IPv4address errors')
   t.equal(components.scheme, undefined, 'scheme')
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -194,7 +201,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, undefined, 'fragment')
 
   // IPv6address
-  components = URI.parse('//[2001:db8::7]')
+  components = fastURI.parse('//[2001:db8::7]')
   t.equal(components.error, undefined, 'IPv4address errors')
   t.equal(components.scheme, undefined, 'scheme')
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -205,11 +212,12 @@ test('URI parse', (t) => {
   t.equal(components.fragment, undefined, 'fragment')
 
   // invalid IPv6
-  components = URI.parse('//[2001:dbZ::7]')
+  components = fastURI.parse('//[2001:dbZ::7]')
   t.equal(components.host, '[2001:dbz::7]')
+  t.equal(components.error, 'URI host is malformed.')
 
   // mixed IPv4address & IPv6address
-  components = URI.parse('//[::ffff:129.144.52.38]')
+  components = fastURI.parse('//[::ffff:129.144.52.38]')
   t.equal(components.error, undefined, 'IPv4address errors')
   t.equal(components.scheme, undefined, 'scheme')
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -220,7 +228,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, undefined, 'fragment')
 
   // mixed IPv4address & reg-name, example from terion-name (https://github.com/garycourt/uri-js/issues/4)
-  components = URI.parse('uri://10.10.10.10.example.com/en/process')
+  components = fastURI.parse('uri://10.10.10.10.example.com/en/process')
   t.equal(components.error, undefined, 'mixed errors')
   t.equal(components.scheme, 'uri', 'scheme')
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -231,7 +239,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, undefined, 'fragment')
 
   // IPv6address, example from bkw (https://github.com/garycourt/uri-js/pull/16)
-  components = URI.parse('//[2606:2800:220:1:248:1893:25c8:1946]/test')
+  components = fastURI.parse('//[2606:2800:220:1:248:1893:25c8:1946]/test')
   t.equal(components.error, undefined, 'IPv6address errors')
   t.equal(components.scheme, undefined, 'scheme')
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -242,7 +250,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, undefined, 'fragment')
 
   // IPv6address, example from RFC 5952
-  components = URI.parse('//[2001:db8::1]:80')
+  components = fastURI.parse('//[2001:db8::1]:80')
   t.equal(components.error, undefined, 'IPv6address errors')
   t.equal(components.scheme, undefined, 'scheme')
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -253,7 +261,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, undefined, 'fragment')
 
   // IPv6address with zone identifier, RFC 6874
-  components = URI.parse('//[fe80::a%25en1]')
+  components = fastURI.parse('//[fe80::a%25en1]')
   t.equal(components.error, undefined, 'IPv4address errors')
   t.equal(components.scheme, undefined, 'scheme')
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -264,7 +272,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, undefined, 'fragment')
 
   // IPv6address with an unescaped interface specifier, example from pekkanikander (https://github.com/garycourt/uri-js/pull/22)
-  components = URI.parse('//[2001:db8::7%en0]')
+  components = fastURI.parse('//[2001:db8::7%en0]')
   t.equal(components.error, undefined, 'IPv6address interface errors')
   t.equal(components.scheme, undefined, 'scheme')
   t.equal(components.userinfo, undefined, 'userinfo')
@@ -275,7 +283,7 @@ test('URI parse', (t) => {
   t.equal(components.fragment, undefined, 'fragment')
 
   // UUID V1
-  components = URI.parse('urn:uuid:b571b0bc-4713-11ec-81d3-0242ac130003')
+  components = fastURI.parse('urn:uuid:b571b0bc-4713-11ec-81d3-0242ac130003')
   t.equal(components.error, undefined, 'errors')
   t.equal(components.scheme, 'urn', 'scheme')
   // t.equal(components.authority, undefined, "authority");
@@ -290,13 +298,13 @@ test('URI parse', (t) => {
   t.equal(components.uuid, 'b571b0bc-4713-11ec-81d3-0242ac130003', 'uuid')
 
   // UUID v4
-  components = URI.parse('urn:uuid:97a32222-89b7-420e-8507-4360723e2c2a')
+  components = fastURI.parse('urn:uuid:97a32222-89b7-420e-8507-4360723e2c2a')
   t.equal(components.uuid, '97a32222-89b7-420e-8507-4360723e2c2a', 'uuid')
 
-  components = URI.parse('urn:uuid:notauuid-7dec-11d0-a765-00a0c91e6bf6')
+  components = fastURI.parse('urn:uuid:notauuid-7dec-11d0-a765-00a0c91e6bf6')
   t.notSame(components.error, undefined, 'errors')
 
-  components = URI.parse('urn:foo:a123,456')
+  components = fastURI.parse('urn:foo:a123,456')
   t.equal(components.error, undefined, 'errors')
   t.equal(components.scheme, 'urn', 'scheme')
   // t.equal(components.authority, undefined, "authority");
@@ -309,10 +317,11 @@ test('URI parse', (t) => {
   t.equal(components.nid, 'foo', 'nid')
   t.equal(components.nss, 'a123,456', 'nss')
 
-  components = URI.parse('//[2606:2800:220:1:248:1893:25c8:1946:43209]')
+  components = fastURI.parse('//[2606:2800:220:1:248:1893:25c8:1946:43209]')
   t.equal(components.host, '[2606:2800:220:1:248:1893:25c8:1946:43209]')
+  t.equal(components.error, 'URI host is malformed.')
 
-  components = URI.parse('urn:foo:|\\24fpl')
+  components = fastURI.parse('urn:foo:|\\24fpl')
   t.equal(components.error, 'URN can not be parsed.')
   t.end()
 })

package/dist/node_modules/fast-uri/test/query-fragment-normalization.test.js

@@ -0,0 +1,33 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+test('query percent-encoding is normalized (RFC 3986 §6.2.2)', (t) => {
+  // hex digits are uppercased, like the path component already does
+  t.equal(fastURI.normalize('x://h/p?a=%2a'), 'x://h/p?a=%2A', 'uppercases hex in query')
+  // unreserved characters are decoded
+  t.equal(fastURI.normalize('x://h/p?a=%7e%2e'), 'x://h/p?a=~.', 'decodes unreserved in query')
+  // reserved characters stay percent-encoded
+  t.equal(fastURI.normalize('x://h/p?a=%2F'), 'x://h/p?a=%2F', 'keeps reserved encoded in query')
+  // raw characters that are not allowed are percent-encoded
+  t.equal(fastURI.normalize('x://h/p?a b'), 'x://h/p?a%20b', 'encodes a raw space in query')
+  t.equal(fastURI.normalize('x://h/p?café'), 'x://h/p?caf%C3%A9', 'encodes raw non-ASCII in query')
+  // `?` is allowed unencoded in a query
+  t.equal(fastURI.normalize('x://h/p?a?b'), 'x://h/p?a?b', 'keeps `?` raw in query')
+
+  t.end()
+})
+
+test('fragment percent-encoding is normalized without decoding reserved characters', (t) => {
+  // reserved characters must NOT be decoded — `%2F` is not `/`
+  t.equal(fastURI.normalize('x://h/p#a%2Fb%2A'), 'x://h/p#a%2Fb%2A', 'keeps reserved encoded in fragment')
+  // hex is uppercased and unreserved is decoded
+  t.equal(fastURI.normalize('x://h/p#a%2a%7e'), 'x://h/p#a%2A~', 'uppercases hex and decodes unreserved in fragment')
+  // raw characters are still encoded
+  t.equal(fastURI.normalize('x://h/p#a b'), 'x://h/p#a%20b', 'encodes a raw space in fragment')
+  // `?` and `/` are allowed unencoded in a fragment
+  t.equal(fastURI.normalize('x://h/p#f?x/y'), 'x://h/p#f?x/y', 'keeps `?` and `/` raw in fragment')
+
+  t.end()
+})

package/dist/node_modules/fast-uri/test/reserved-path-normalization.test.js

@@ -0,0 +1,109 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+const PATH_RESERVED = "!$&'()*+,;=:@/"
+
+function percentEncode (character, lowerCase) {
+  const hex = character.charCodeAt(0).toString(16).padStart(2, '0')
+  return '%' + (lowerCase ? hex : hex.toUpperCase())
+}
+
+test('normalize preserves literal and escaped reserved path characters', (t) => {
+  t.equal(
+    fastURI.normalize('http://example.com/a;b'),
+    'http://example.com/a;b',
+    'literal semicolon remains literal'
+  )
+  t.equal(
+    fastURI.normalize('http://example.com/a%3ab'),
+    'http://example.com/a%3Ab',
+    'escaped colon remains escaped and its hex is uppercased'
+  )
+
+  for (const character of PATH_RESERVED) {
+    const literal = `http://example.com/a${character}b`
+    const escaped = `http://example.com/a${percentEncode(character, true)}b`
+    const normalizedEscape = `http://example.com/a${percentEncode(character, false)}b`
+
+    t.equal(fastURI.normalize(literal), literal, `preserves literal ${character}`)
+    t.equal(fastURI.normalize(escaped), normalizedEscape, `preserves escaped ${character}`)
+  }
+
+  t.equal(
+    fastURI.normalize('http://example.com/a/./café'),
+    'http://example.com/a/caf%C3%A9',
+    'removes real dot segments and UTF-8 encodes raw non-ASCII'
+  )
+  t.equal(
+    fastURI.normalize('http://example.com/a/%2e%2e/b'),
+    'http://example.com/a/%2E%2E/b',
+    'preserves escaped dots as path data'
+  )
+  t.equal(
+    fastURI.normalize('http://example.com/Kſ'),
+    'http://example.com/%E2%84%AA%C5%BF',
+    'UTF-8 encodes Unicode characters that case-fold to ASCII'
+  )
+  t.end()
+})
+
+test('serialize uses the RFC 3986 path character set without opening escapes', (t) => {
+  const rawPath = `/a${PATH_RESERVED}b`
+  t.equal(
+    fastURI.serialize({ scheme: 'http', host: 'example.com', path: rawPath }),
+    `http://example.com${rawPath}`,
+    'keeps all legal raw path characters'
+  )
+
+  const escapedPath = Array.from(PATH_RESERVED, (character) => percentEncode(character, true)).join('')
+  const normalizedEscapedPath = Array.from(PATH_RESERVED, (character) => percentEncode(character, false)).join('')
+  t.equal(
+    fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/' + escapedPath }),
+    'http://example.com/' + normalizedEscapedPath,
+    'uppercases valid escapes without decoding reserved characters'
+  )
+
+  t.equal(
+    fastURI.serialize({ scheme: 'http', host: 'example.com', path: '/a?b#c[d]' }),
+    'http://example.com/a%3Fb%23c%5Bd%5D',
+    'encodes characters that would leave the path component'
+  )
+  t.equal(
+    fastURI.serialize({ path: 'a:b/c:d' }),
+    'a%3Ab/c:d',
+    'only escapes a colon where path-noscheme requires it'
+  )
+  t.equal(
+    fastURI.serialize({ path: './a:b/c:d' }),
+    'a%3Ab/c:d',
+    'escapes a first-segment colon exposed by dot-segment removal'
+  )
+  t.equal(
+    fastURI.normalize('./a:b'),
+    'a%3Ab',
+    'normalization keeps a relative path from becoming a scheme'
+  )
+  t.equal(
+    fastURI.serialize({ path: '/Kſ' }),
+    '/%E2%84%AA%C5%BF',
+    'UTF-8 encodes Unicode characters that case-fold to ASCII'
+  )
+  t.end()
+})
+
+test('equal distinguishes escaped reserved path data from literal syntax', (t) => {
+  for (const character of PATH_RESERVED) {
+    const literal = `http://example.com/a${character}b`
+    const escaped = `http://example.com/a${percentEncode(character, false)}b`
+    t.equal(fastURI.equal(literal, escaped, {}), false, `distinguishes literal and escaped ${character}`)
+  }
+
+  t.equal(
+    fastURI.equal('./a:b', 'a:b', {}),
+    false,
+    'does not equate a relative path with an absolute URI after removing dot segments'
+  )
+  t.end()
+})