@openclaw/lobster 2026.6.33 → 2026.6.35

package/node_modules/fast-uri/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "3.1.2",
+  "version": "4.1.4",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",
@@ -48,14 +48,14 @@
   "scripts": {
     "lint": "eslint",
     "lint:fix": "eslint --fix",
-    "test": "npm run test:unit && npm run test:typescript",
+    "test": "npm run test:unit",
     "test:browser:chromium": "playwright-test ./test/* --runner tape --browser=chromium",
     "test:browser:firefox": "playwright-test ./test/* --runner tape --browser=firefox",
     "test:browser:webkit": "playwright-test ./test/* --runner tape --browser=webkit",
     "test:browser": "npm run test:browser:chromium && npm run test:browser:firefox && npm run test:browser:webkit",
     "test:unit": "tape test/**/*.js",
     "test:unit:dev": "npm run test:unit -- --coverage-report=html",
-    "test:typescript": "tsd"
+    "test:typescript": "tstyche"
   },
   "devDependencies": {
     "ajv": "^8.16.0",
@@ -63,6 +63,6 @@
     "neostandard": "^0.13.0",
     "playwright-test": "^14.1.12",
     "tape": "^5.8.1",
-    "tsd": "^0.33.0"
+    "tstyche": "^7.0.0"
   }
 }

package/node_modules/fast-uri/test/component-safe-serialization.test.js

@@ -0,0 +1,163 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+test('userinfo serialization cannot terminate the authority', (t) => {
+  const uri = fastURI.serialize({
+    scheme: 'http',
+    userinfo: 'attacker.example/',
+    host: 'trusted.example',
+    path: '/'
+  })
+
+  t.equal(uri, 'http://attacker.example%2F@trusted.example/', 'slash is encoded as userinfo data')
+
+  const reparsed = fastURI.parse(uri)
+  t.equal(reparsed.host, 'trusted.example', 'reparsing retains the supplied host')
+  t.equal(reparsed.userinfo, 'attacker.example%2F', 'encoded slash remains in userinfo')
+  t.equal(
+    fastURI.serialize({ userinfo: 'user@/?:#[]\\', host: 'example.test' }),
+    '//user%40%2F%3F:%23%5B%5D%5C@example.test',
+    'all userinfo component delimiters are encoded as data'
+  )
+  t.end()
+})
+
+test('port serialization rejects non-digit values', (t) => {
+  const malformedPorts = [
+    '@127.0.0.1:8124',
+    '8080@evil.example',
+    '8080/path',
+    '8080?query',
+    '8080#fragment',
+    '8080:9000',
+    '-1',
+    '1.5',
+    1.5,
+    NaN,
+    Infinity,
+    '\u0661'
+  ]
+
+  for (const port of malformedPorts) {
+    t.throws(
+      () => fastURI.serialize({ scheme: 'http', host: 'trusted.example', port, path: '/app' }),
+      /URI port is malformed\./,
+      String(port)
+    )
+  }
+
+  t.throws(
+    () => fastURI.normalize({ scheme: 'http', host: 'trusted.example', port: '@evil.example' }),
+    /URI port is malformed\./,
+    'object normalization rejects a malformed port'
+  )
+  t.equal(
+    fastURI.equal(
+      { scheme: 'http', host: 'trusted.example', port: '@evil.example' },
+      { scheme: 'http', host: 'trusted.example', port: '@evil.example' }
+    ),
+    false,
+    'object equality fails closed for a malformed port'
+  )
+  t.end()
+})
+
+test('port serialization preserves RFC 3986 digit values', (t) => {
+  const validPorts = [
+    [8080, '8080'],
+    ['8080', '8080'],
+    ['00080', '00080'],
+    ['', '']
+  ]
+
+  for (const [port, expected] of validPorts) {
+    t.equal(
+      fastURI.serialize({ scheme: 'uri', host: 'example.test', port }),
+      `uri://example.test:${expected}`,
+      JSON.stringify(port)
+    )
+  }
+  t.end()
+})
+
+test('query and fragment serialization cannot inject component delimiters', (t) => {
+  const uri = fastURI.serialize({
+    scheme: 'x',
+    path: '/resource',
+    query: 'key=value#still-query',
+    fragment: 'first#still-fragment'
+  })
+
+  t.equal(
+    uri,
+    'x:/resource?key=value%23still-query#first%23still-fragment',
+    'raw hashes are encoded within their supplied components'
+  )
+
+  const reparsed = fastURI.parse(uri)
+  t.equal(reparsed.query, 'key=value%23still-query', 'hash remains query data')
+  t.equal(reparsed.fragment, 'first%23still-fragment', 'hash remains fragment data')
+  t.end()
+})
+
+test('component serializers preserve each RFC 3986 literal character set', (t) => {
+  const unreservedAndSubDelims = "AZaz09-._~!$&'()*+,;="
+  const userinfo = unreservedAndSubDelims + ':'
+  const queryOrFragment = unreservedAndSubDelims + ':@/?'
+
+  t.equal(
+    fastURI.serialize({ userinfo, host: 'example.test' }),
+    '//' + userinfo + '@example.test',
+    'userinfo literals are preserved'
+  )
+  t.equal(
+    fastURI.serialize({ query: queryOrFragment }),
+    '?' + queryOrFragment,
+    'query literals are preserved'
+  )
+  t.equal(
+    fastURI.serialize({ fragment: queryOrFragment }),
+    '#' + queryOrFragment,
+    'fragment literals are preserved'
+  )
+  t.end()
+})
+
+test('component serializers preserve escapes and encode Unicode as UTF-8', (t) => {
+  t.equal(
+    fastURI.serialize({ userinfo: 'café/%2f%GG', host: 'example.test' }),
+    '//caf%C3%A9%2F%2F%25GG@example.test',
+    'userinfo preserves valid escapes, uppercases hex, and escapes malformed percent data'
+  )
+  t.equal(
+    fastURI.serialize({ query: '日本/%2f#%GG' }),
+    '?%E6%97%A5%E6%9C%AC/%2F%23%25GG',
+    'query uses UTF-8 and does not double encode valid escapes'
+  )
+  t.equal(
+    fastURI.serialize({ fragment: '😀/%3f#%GG' }),
+    '#%F0%9F%98%80/%3F%23%25GG',
+    'fragment uses UTF-8 and does not double encode valid escapes'
+  )
+  t.equal(
+    fastURI.serialize({ query: 'Kſ' }),
+    '?%E2%84%AA%C5%BF',
+    'Unicode characters that case-fold to ASCII are still UTF-8 encoded'
+  )
+  t.end()
+})
+
+test('parsed URI serialization remains stable', (t) => {
+  const input = 'x://user:pass@example.test/a%2Fb?x=a/b?c&y=%23#frag/a?b%23'
+  const serialized = fastURI.serialize(fastURI.parse(input))
+
+  t.equal(serialized, input, 'an already normalized parsed URI round-trips unchanged')
+  t.equal(
+    fastURI.serialize(fastURI.parse(serialized)),
+    serialized,
+    'repeated parse and serialize cycles are stable'
+  )
+  t.end()
+})

package/node_modules/fast-uri/test/equal.test.js

@@ -21,6 +21,36 @@ test('URI Equals', (t) => {
   t.end()
 })
 
+test('URI Equals rejects malformed object input even when identical', (t) => {
+  const malformed = { scheme: 'http', host: 'example.com', port: 99999, path: '/x' }
+  t.equal(fn(malformed, malformed), false)
+  t.end()
+})
+
+test('URI Equals preserves case-sensitive components', (t) => {
+  const suite = [
+    { pair: ['http://example.com/Admin', 'http://example.com/admin'], result: false },
+    { pair: ['http://example.com/?token=SECRET', 'http://example.com/?token=secret'], result: false },
+    { pair: ['http://example.com/#Section', 'http://example.com/#section'], result: false },
+    { pair: ['http://User@example.com/', 'http://user@example.com/'], result: false },
+    { pair: ['urn:foo:CaseSensitive', 'urn:foo:casesensitive'], result: false },
+    { pair: ['ws://example.com/Chat', 'ws://example.com/chat'], result: false },
+    { pair: ['ws://example.com/?token=SECRET', 'ws://example.com/?token=secret'], result: false },
+    { pair: [{ scheme: 'http', host: 'example.com', path: '/Admin' }, { scheme: 'http', host: 'example.com', path: '/admin' }], result: false }
+  ]
+  runTest(t, suite)
+  t.end()
+})
+
+test('URI Equals folds normalized scheme and host case', (t) => {
+  const suite = [
+    { pair: ['HTTP://EXAMPLE.COM/resource', 'http://example.com/resource'], result: true },
+    { pair: [{ scheme: 'HTTP', host: 'EXAMPLE.COM', path: '/resource' }, { scheme: 'http', host: 'example.com', path: '/resource' }], result: true }
+  ]
+  runTest(t, suite)
+  t.end()
+})
+
 //   test('IRI Equals', (t) => {
 //     // example from RFC 3987
 //     t.equal(URI.equal('example://a/b/c/%7Bfoo%7D/ros\xE9', 'eXAMPLE://a/./b/../b/%63/%7bfoo%7d/ros%C3%A9', IRI_OPTION), true)
@@ -66,9 +96,7 @@ test('URN Equals', (t) => {
 
   runTest(t, suite)
 
-  t.throws(() => {
-    fn('urn:', 'urn:FOO:a123,456')
-  }, 'URN without nid cannot be serialized')
+  t.equal(fn('urn:', 'urn:FOO:a123,456'), false, 'malformed URN fails equality safely')
 
   t.end()
 })
@@ -107,6 +135,18 @@ test('WSS Equal', (t) => {
   t.end()
 })
 
+test('Mailto Equal normalizes domains without folding message data', (t) => {
+  const suite = [
+    { pair: ['mailto:user@EXAMPLE.ORG', 'mailto:user@example.org'], result: true },
+    { pair: ['mailto:User@example.org', 'mailto:user@example.org'], result: false },
+    { pair: ['mailto:user@example.org?subject=Hello', 'mailto:user@example.org?subject=hello'], result: false },
+    { pair: ['mailto:user@example.org?body=Hello', 'mailto:user@example.org?body=hello'], result: false },
+    { pair: ['mailto:user@example.org?x=Hello', 'mailto:user@example.org?x=hello'], result: false }
+  ]
+  runTest(t, suite)
+  t.end()
+})
+
 test('URI Equals tolerates malformed fragments', (t) => {
   t.equal(
     fastURI.equal('http://example.com/#%E0%A4A', 'http://example.com/#%E0%A4A'),
@@ -115,3 +155,54 @@ test('URI Equals tolerates malformed fragments', (t) => {
   )
   t.end()
 })
+
+test('URI Equals — raw UTF-8 char equals its percent-encoded UTF-8 form', (t) => {
+  const suite = [
+    // BMP characters
+    { pair: ['http://example.com/日本', 'http://example.com/%E6%97%A5%E6%9C%AC'], result: true },
+    { pair: ['http://example.com/café', 'http://example.com/caf%C3%A9'], result: true },
+    { pair: ['http://example.com/€', 'http://example.com/%E2%82%AC'], result: true },
+    { pair: ['http://example.com/中文', 'http://example.com/%E4%B8%AD%E6%96%87'], result: true },
+    // supplementary plane (emoji, surrogate pairs)
+    { pair: ['http://example.com/🚀', 'http://example.com/%F0%9F%9A%80'], result: true },
+    { pair: ['http://example.com/😀', 'http://example.com/%F0%9F%98%80'], result: true },
+    // mixed encoded + raw in same path
+    { pair: ['http://example.com/users/日本/profile', 'http://example.com/users/%E6%97%A5%E6%9C%AC/profile'], result: true },
+    { pair: ['http://example.com/a/€/b', 'http://example.com/a/%E2%82%AC/b'], result: true }
+  ]
+  runTest(t, suite)
+  t.end()
+})
+
+test('URI Equals — percent-encoded UTF-8 is case-insensitive in hex digits', (t) => {
+  const suite = [
+    { pair: ['http://example.com/caf%C3%A9', 'http://example.com/caf%c3%a9'], result: true },
+    { pair: ['http://example.com/%E6%97%A5', 'http://example.com/%e6%97%a5'], result: true },
+    { pair: ['http://example.com/%F0%9F%9A%80', 'http://example.com/%f0%9f%9a%80'], result: true }
+  ]
+  runTest(t, suite)
+  t.end()
+})
+
+test('URI Equals — different Unicode code points are not equal', (t) => {
+  const suite = [
+    { pair: ['http://example.com/日本', 'http://example.com/中文'], result: false },
+    { pair: ['http://example.com/café', 'http://example.com/cafe'], result: false },
+    { pair: ['http://example.com/🚀', 'http://example.com/🎉'], result: false }
+  ]
+  runTest(t, suite)
+  t.end()
+})
+
+test('URI Equals — Latin-1 byte is not equal to UTF-8 multi-byte encoding', (t) => {
+  // Parser-differential guard: %C3%A9 (UTF-8 for "é") must NOT equal %E9
+  // (raw Latin-1 byte). The old escape() emitted single Latin-1 bytes for
+  // non-ASCII, which would have made these incorrectly compare equal in a
+  // round-tripped URI.
+  const suite = [
+    { pair: ['http://example.com/caf%C3%A9', 'http://example.com/caf%E9'], result: false },
+    { pair: ['http://example.com/%E6%97%A5', 'http://example.com/%E6'], result: false }
+  ]
+  runTest(t, suite)
+  t.end()
+})

package/node_modules/fast-uri/test/fixtures/uri-js-parse.json

@@ -53,6 +53,7 @@
       "host": "[2001:dbz::1]",
       "port": 80,
       "path": "",
+      "error": "URI host is malformed.",
       "reference": "relative"
     }
   ],
@@ -242,6 +243,7 @@
     {
       "host": "[2606:2800:220:1:248:1893:25c8:1946:43209]",
       "path": "",
+      "error": "URI host is malformed.",
       "reference": "relative"
     }
   ],
@@ -497,5 +499,26 @@
       "subject": "Test",
       "body": "NATTO"
     }
+  ],
+  [
+    "mailto:addr1@an.example,addr2@an.example",
+    {
+      "scheme": "mailto",
+      "reference": "absolute",
+      "to": [
+        "addr1@an.example",
+        "addr2@an.example"
+      ]
+    }
+  ],
+  [
+    "mailto:user@example.org?",
+    {
+      "scheme": "mailto",
+      "reference": "absolute",
+      "to": [
+        "user@example.org"
+      ]
+    }
   ]
-]
+]

package/node_modules/fast-uri/test/fixtures/uri-js-serialize.json

@@ -116,5 +116,27 @@
       "path": "with:colon"
     },
     "scheme:with:colon"
+  ],
+  [
+    {
+      "scheme": "mailto",
+      "to": [
+        "chris@example.com"
+      ]
+    },
+    "mailto:chris@example.com"
+  ],
+  [
+    {
+      "scheme": "mailto",
+      "to": [
+        "joe@example.com"
+      ],
+      "headers": {
+        "cc": "bob@example.com"
+      },
+      "body": "hello"
+    },
+    "mailto:joe@example.com?cc=bob@example.com&body=hello"
   ]
-]
+]

package/node_modules/fast-uri/test/ipv6-canonical.test.js

@@ -0,0 +1,34 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+test('IPv6 hosts normalize to the RFC 5952 canonical form', (t) => {
+  const cases = [
+    ['http://[0:0:0:0:0:0:0:1]/', 'http://[::1]/'],
+    ['http://[0:0:0:0:0:0:0:0]/', 'http://[::]/'],
+    ['http://[2001:0db8:0000:0000:0000:0000:0000:0001]/', 'http://[2001:db8::1]/'],
+    ['http://[2001:0:0:0:0:0:0:1]/', 'http://[2001::1]/'],
+    ['http://[fe80:0:0:0:0:0:0:1]/', 'http://[fe80::1]/'],
+    ['http://[1:0:0:0:2:0:0:3]/', 'http://[1::2:0:0:3]/']
+  ]
+
+  for (const [uri, normalized] of cases) {
+    t.equal(fastURI.normalize(uri), normalized, `${uri} normalizes to ${normalized}`)
+  }
+  t.end()
+})
+
+test('IPv6 equal() matches the same address across compressed and expanded forms', (t) => {
+  const pairs = [
+    ['http://[::1]/', 'http://[0:0:0:0:0:0:0:1]/'],
+    ['http://[::]/', 'http://[0:0:0:0:0:0:0:0]/'],
+    ['http://[2001:db8::1]/', 'http://[2001:0db8:0000:0000:0000:0000:0000:0001]/'],
+    ['http://[1::2:0:0:3]/', 'http://[1:0:0:0:2:0:0:3]/']
+  ]
+
+  for (const [a, b] of pairs) {
+    t.equal(fastURI.equal(a, b), true, `${a} equals ${b}`)
+  }
+  t.end()
+})

package/node_modules/fast-uri/test/ipv6-validation.test.js

@@ -0,0 +1,154 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+const HOST_ERROR = 'URI host is malformed.'
+
+const malformedLiterals = [
+  '::not-valid',
+  'fc00::not-hex',
+  'fe80::not-hex',
+  '1:2:3',
+  '1:2:3:4:5:6:7',
+  '1:2:3:4:5:6:7:8:9',
+  '1::2::3',
+  '1:::2',
+  ':::1',
+  '12345::',
+  '1:2:3:4:5:6:7::8',
+  '::ffff:192.0.2.999',
+  '::ffff:192.0.2',
+  '::ffff:192.168.001.1',
+  '::192.0.2.1:1',
+  '1:2:3:4:5:192.0.2.1::',
+  'v.foo',
+  'v1.',
+  'v1.foo%25bar',
+  'v1.K',
+  'fe80::1%25',
+  'fe80::1%25eth 0',
+  'fe80::1%25eth%ZZ',
+  'fe80::1%25K',
+  'not-an-ip'
+]
+
+test('malformed bracketed IP literals fail without being rewritten', (t) => {
+  for (const literal of malformedLiterals) {
+    const uri = `http://[${literal}]/private`
+    const parsed = fastURI.parse(uri)
+
+    t.equal(parsed.error, HOST_ERROR, `parse rejects ${literal}`)
+    t.equal(parsed.host, `[${literal.toLowerCase()}]`, `parse does not truncate ${literal}`)
+    t.equal(fastURI.normalize(uri), uri, `normalize preserves ${literal}`)
+    t.equal(fastURI.equal(uri, uri), false, `equal rejects ${literal}`)
+  }
+  t.end()
+})
+
+test('resolve throws for malformed bracketed IP literals', (t) => {
+  for (const literal of malformedLiterals) {
+    const uri = `http://[${literal}]/private`
+
+    t.throws(
+      () => fastURI.resolve(uri, 'child'),
+      /URI host is malformed\./,
+      `rejects malformed base ${literal}`
+    )
+    t.throws(
+      () => fastURI.resolve('http://example.com/', uri),
+      /URI host is malformed\./,
+      `rejects malformed relative input ${literal}`
+    )
+  }
+  t.end()
+})
+
+test('valid IPv6, IPvFuture, embedded IPv4, and zone forms normalize safely', (t) => {
+  const cases = [
+    ['http://[::]/', 'http://[::]/', '::'],
+    ['http://[::1]/', 'http://[::1]/', '::1'],
+    ['http://[1::]/', 'http://[1::]/', '1::'],
+    ['http://[2001:0DB8::0001]/', 'http://[2001:db8::1]/', '2001:db8::1'],
+    ['http://[0:0:0:0:0:0:0:0]/', 'http://[::]/', '::'],
+    ['http://[::ffff:192.0.2.1]/', 'http://[::ffff:192.0.2.1]/', '::ffff:192.0.2.1'],
+    ['http://[1:2:3:4:5:6:192.0.2.1]/', 'http://[1:2:3:4:5:6:192.0.2.1]/', '1:2:3:4:5:6:192.0.2.1'],
+    ['http://[fe80::A%25EN1]/', 'http://[fe80::a%25EN1]/', 'fe80::a%EN1'],
+    ['http://[fe80::a%en1]/', 'http://[fe80::a%25en1]/', 'fe80::a%en1'],
+    ['http://[fe80::a%25eth%2D0]/', 'http://[fe80::a%25eth%2D0]/', 'fe80::a%eth%2D0'],
+    ['http://[v1.example]/', 'http://[v1.example]/', '[v1.example]'],
+    ['http://[vF.A:b]/', 'http://[vf.a:b]/', '[vf.a:b]']
+  ]
+
+  for (const [uri, normalized, host] of cases) {
+    const parsed = fastURI.parse(uri)
+    t.equal(parsed.error, undefined, `${uri} parses without error`)
+    t.equal(parsed.host, host, `${uri} has the expected host`)
+    t.equal(fastURI.normalize(uri), normalized, `${uri} normalizes safely`)
+  }
+  t.end()
+})
+
+test('IPv6 zone identifiers are validated correctly', (t) => {
+  const valid = [
+    'http://[fe80::1%25eth0]/',
+    'http://[fe80::a%en1]/',
+    'http://[fe80::a%25eth%2D0]/'
+  ]
+
+  for (const uri of valid) {
+    const parsed = fastURI.parse(uri)
+
+    t.equal(parsed.error, undefined, `${uri} parses without error`)
+  }
+
+  const malformed = [
+    'http://[fe80::1%25]/',
+    'http://[fe80::1%25eth 0]/',
+    'http://[fe80::1%25eth%ZZ]/',
+    'http://[fe80::1%25K]/'
+  ]
+
+  for (const uri of malformed) {
+    const parsed = fastURI.parse(uri)
+
+    t.equal(parsed.error, HOST_ERROR, `${uri} is rejected`)
+    t.equal(fastURI.normalize(uri), uri, `${uri} is not rewritten`)
+    t.equal(fastURI.equal(uri, uri), false, `${uri} is not comparable`)
+  }
+  t.end()
+})
+
+test('hosts with unbalanced or misplaced IP-literal brackets are rejected', (t) => {
+  const malformed = [
+    'http://[fe80',
+    'http://[',
+    'http://[not-an-ip',
+    'http://[\u65e5\u672c',
+    'http://user@[@127.0.0.1:8123/admin',
+    'http://user@]127.0.0.1:8123/admin',
+    'http://user@prefix[@127.0.0.1:8123/admin',
+    'http://user@prefix]@127.0.0.1:8123/admin'
+  ]
+  const modes = [
+    ['default', undefined],
+    ['Unicode', { unicodeSupport: true }]
+  ]
+
+  for (const [mode, options] of modes) {
+    for (const uri of malformed) {
+      const parsed = fastURI.parse(uri, options)
+      const message = `${mode} mode rejects ${uri}`
+
+      t.equal(parsed.error, HOST_ERROR, `parse ${message}`)
+      t.equal(fastURI.normalize(uri, options), uri, `normalize preserves ${uri} in ${mode} mode`)
+      t.equal(fastURI.equal(uri, uri, options), false, `equal ${message}`)
+      t.throws(
+        () => fastURI.resolve('http://example.com/', uri, options),
+        /URI host is malformed\./,
+        `resolve ${message}`
+      )
+    }
+  }
+  t.end()
+})

package/node_modules/fast-uri/test/malformed-percent.test.js

@@ -0,0 +1,77 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+const MALFORMED_PERCENT_ERROR = 'URI contains malformed percent-encoding.'
+
+const malformedComponents = [
+  ['path', 'x://example.test/a%'],
+  ['path with one trailing hex digit', 'x://example.test/a%2'],
+  ['path with non-hex digits', 'x://example.test/a%GG'],
+  ['host', 'x://exa%mple.test/path'],
+  ['userinfo', 'x://us%er@example.test/path'],
+  ['query', 'x://example.test/path?q=%G0'],
+  ['fragment', 'x://example.test/path#frag%1']
+]
+
+test('parse reports malformed percent syntax in generic URI components', (t) => {
+  for (const [component, uri] of malformedComponents) {
+    t.equal(fastURI.parse(uri).error, MALFORMED_PERCENT_ERROR, component)
+  }
+  t.end()
+})
+
+test('normalize preserves malformed percent input unchanged', (t) => {
+  for (const [component, uri] of malformedComponents) {
+    t.equal(fastURI.normalize(uri), uri, component)
+  }
+  t.end()
+})
+
+test('equal does not equate malformed input with repaired valid input', (t) => {
+  const cases = [
+    ['x://example.test/a%', 'x://example.test/a%25'],
+    ['x://exa%mple.test/path', 'x://exa%25mple.test/path'],
+    ['x://us%er@example.test/path', 'x://us%25er@example.test/path'],
+    ['x://example.test/path?q=%', 'x://example.test/path?q=%25'],
+    ['x://example.test/path#%', 'x://example.test/path#%25']
+  ]
+
+  for (const [malformed, repaired] of cases) {
+    t.equal(fastURI.equal(malformed, repaired, {}), false, malformed)
+  }
+  t.end()
+})
+
+test('resolve rejects malformed percent syntax in either input', (t) => {
+  t.throws(
+    () => fastURI.resolve('x://example.test/base%', 'child'),
+    /URI contains malformed percent-encoding\./,
+    'malformed base'
+  )
+  t.throws(
+    () => fastURI.resolve('x://example.test/base', 'child%'),
+    /URI contains malformed percent-encoding\./,
+    'malformed relative reference'
+  )
+  t.end()
+})
+
+test('valid percent octets remain valid without UTF-8 validation', (t) => {
+  const uri = '/%ff?q=%80#%fe'
+  const parsed = fastURI.parse(uri)
+
+  t.equal(parsed.error, undefined, 'non-UTF-8 octets are valid percent syntax')
+  t.equal(parsed.path, '/%FF', 'path octet is preserved and hex is uppercased')
+  t.equal(parsed.query, 'q=%80', 'query octet is preserved')
+  t.equal(parsed.fragment, '%FE', 'fragment octet is preserved and hex is uppercased')
+  t.equal(fastURI.normalize(uri), '/%FF?q=%80#%FE', 'normalization preserves the octets')
+
+  const allGenericComponents = fastURI.parse('x://u%2f@exa%2fmple.test/%2f?q=%2f#%2f')
+  t.equal(allGenericComponents.error, undefined, 'valid escapes are accepted in every generic component')
+
+  const ipv6Zone = fastURI.parse('//[2001:db8::7%en0]')
+  t.equal(ipv6Zone.error, undefined, 'historically accepted raw IPv6 zone separator is unchanged')
+  t.end()
+})