@openclaw/lobster 2026.6.33 → 2026.6.35

package/node_modules/fast-uri/test/security.test.js

@@ -125,9 +125,307 @@ test('serialize escapes authority delimiters in host field', (t) => {
 })
 
 test('normalize does not double-decode %2540 into a live @', (t) => {
-  const result = fastURI.normalize('http://trusted.com%2540evil.com/')
+  const input = 'http://trusted.com%2540evil.com/'
+  const result = fastURI.normalize(input)
   const parsed = fastURI.parse(result)
 
-  t.plan(1)
-  t.notEqual(parsed.host, 'trusted.com@evil.com', 'http://trusted.com%2540evil.com/')
+  t.plan(2)
+  t.equal(result, input, 'the encoded percent sign is preserved')
+  t.notEqual(parsed.host, 'trusted.com@evil.com', input)
+})
+
+test('parse canonicalises IDN / Unicode hosts to their ASCII form', (t) => {
+  const cases = [
+    {
+      input: 'http://127。0。0。1/',
+      expectedHost: '127.0.0.1',
+      description: 'full-width ideographic stops as octet separators'
+    },
+    {
+      input: 'http://ｅxample.com/',
+      expectedHost: 'example.com',
+      description: 'fullwidth e as first letter'
+    },
+    {
+      input: 'http://納豆.example.org/',
+      expectedHost: 'xn--99zt52a.example.org',
+      description: 'CJK label requiring punycode'
+    }
+  ]
+
+  t.plan(cases.length * 2)
+
+  cases.forEach(({ input, expectedHost, description }) => {
+    const parsed = fastURI.parse(input)
+    t.notOk(parsed.error, `parse should not set error: ${description}`)
+    t.equal(parsed.host, expectedHost, `host canonicalised to ASCII: ${description}`)
+  })
+})
+
+test('resolve canonicalises the host using the final resolved scheme', (t) => {
+  const cases = [
+    {
+      base: 'http://trusted.example/base',
+      relative: '//127\u30020\u30020\u30021/private',
+      expected: 'http://127.0.0.1/private',
+      expectedHost: '127.0.0.1',
+      description: 'scheme-relative loopback host'
+    },
+    {
+      base: 'https://ex\u00ADample.com/base',
+      relative: 'child',
+      expected: 'https://example.com/child',
+      expectedHost: 'example.com',
+      description: 'host inherited from the base'
+    },
+    {
+      base: 'http://trusted.example/base',
+      relative: 'http://ex\u200Bample.com/',
+      expected: 'http://example.com/',
+      expectedHost: 'example.com',
+      description: 'absolute relative reference'
+    }
+  ]
+
+  t.plan(cases.length * 2)
+
+  cases.forEach(({ base, relative, expected, expectedHost, description }) => {
+    const resolved = fastURI.resolve(base, relative)
+    t.equal(resolved, expected, description)
+    t.equal(fastURI.parse(resolved).host, expectedHost, `${description} reparses consistently`)
+  })
+})
+
+test('resolve applies domain canonicalisation only when the effective scheme opts in', (t) => {
+  const host = 'ex\u00ADample.com'
+
+  t.plan(2)
+  t.equal(
+    fastURI.resolve('uri://trusted.example/', `//${host}/`),
+    `uri://${host}/`,
+    'an unsupported scheme preserves the host'
+  )
+  t.equal(
+    fastURI.resolve('http://trusted.example/', `//${host}/`, { unicodeSupport: true }),
+    `http://${host}/`,
+    'unicodeSupport preserves the Unicode host'
+  )
+})
+
+test('resolve throws when the final scheme cannot canonicalise the host', (t) => {
+  const invalidHost = '\u200D.example'
+  const cases = [
+    ['http://trusted.example/', `//${invalidHost}/`],
+    [`https://${invalidHost}/base`, 'child'],
+    ['http://trusted.example/', `http://${invalidHost}/`],
+    ['http://trusted.example/', `//${invalidHost}%2Etest/`]
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach(([base, relative]) => {
+    t.throws(
+      () => fastURI.resolve(base, relative),
+      /Host's domain name can not be converted to ASCII/,
+      `${base} + ${relative}`
+    )
+  })
+})
+
+test('parse rejects a literal backslash in the authority as malformed (RFC 3986)', (t) => {
+  // Regression for the host-confusion bypass: a literal "\" is invalid RFC 3986
+  // syntax and must be flagged malformed, not silently rewritten. Otherwise "\"
+  // acts as a host delimiter here while Node's native URL parses a different
+  // host, defeating a host-based SSRF/redirect/origin allowlist.
+  const cases = [
+    'http://evil.com\\@allowed.com',
+    'https://169.254.169.254\\@trusted.example.com',
+    'http://127.0.0.1\\@public.example.com',
+    'https://attacker.com\\@api.internal',
+    'http://a\\@b',
+    'ws://evil.com\\@allowed.com/chat',
+    'wss://evil.com\\@allowed.com/chat',
+    'http://evil.com\\%40allowed.com',
+    '//evil.com\\@allowed.com'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(
+      fastURI.parse(input).error,
+      'URI authority must not contain a literal backslash.',
+      input
+    )
+  })
+})
+
+test('normalize does not canonicalize a literal-backslash URI into a different valid URL', (t) => {
+  const cases = [
+    'http://evil.com\\@allowed.com',
+    'https://attacker.com\\@api.internal'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(fastURI.normalize(input), input, input)
+  })
+})
+
+test('parse leaves percent-encoded %5C untouched as encoded data (not rejected)', (t) => {
+  // Only the literal "\" byte is rejected; %5C stays valid encoded data and
+  // does not diverge from the native URL parser, so it must not be flagged.
+  const input = 'http://evil.com%5C@allowed.com'
+  const parsed = fastURI.parse(input)
+
+  t.plan(2)
+  t.notOk(parsed.error, '%5C is valid encoded data, not malformed')
+  t.equal(parsed.host, new URL(input).hostname, '%5C host matches native URL (no divergence)')
+})
+
+test('parse does not reject a literal backslash in the query or fragment', (t) => {
+  // The rejection is scoped to the authority/path (the host-confusion surface);
+  // a backslash after "?"/"#" is normalized as encoded data as before.
+  const parsed = fastURI.parse('http://host.example.com/?x=\\y#z\\w')
+
+  t.plan(2)
+  t.notOk(parsed.error, 'backslash in query/fragment does not mark the URI malformed')
+  t.equal(parsed.host, 'host.example.com', 'host parsed normally')
+})
+
+test('parse rejects a malformed authority introducer (\\\\, /\\, \\/) in place of //', (t) => {
+  // Regression: "\\", "/\\", "\\/" after the scheme colon are not valid authority
+  // introducers. Node's URL treats "\\" as interchangeable with "/" on special
+  // schemes, so "http:\\\\evil.com/path" would be parsed as host "evil.com" by
+  // Node, but fast-uri must reject it as malformed to prevent SSRF/redirect bypass.
+  const cases = [
+    'http:\\\\evil.com/path',
+    'http:/\\evil.com/path',
+    'http:\\/evil.com/path',
+    'ws:\\\\evil.com/chat',
+    'wss:\\\\evil.com/chat',
+    'ftp:\\\\evil.com/',
+    '\\\\evil.com/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(
+      fastURI.parse(input).error,
+      'URI authority must not contain a literal backslash.',
+      input
+    )
+  })
+})
+
+test('normalize does not canonicalize a malformed-authority-introducer URI', (t) => {
+  const cases = [
+    'http:\\\\evil.com/path',
+    'http:/\\evil.com/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(fastURI.normalize(input), input, input)
+  })
+})
+
+test('equal returns false for malformed-authority-introducer URIs', (t) => {
+  const pairs = [
+    ['http:\\\\evil.com/path', 'http://evil.com/path'],
+    ['http:/\\evil.com/path', 'http://evil.com/path']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([left, right]) => {
+    t.equal(fastURI.equal(left, right), false, `${left} != ${right}`)
+  })
+})
+
+test('resolve throws on malformed authority introducer', (t) => {
+  // resolve() returns a plain string with no error field, so the only safe
+  // behavior is to throw when either component has a malformed authority.
+  const pairs = [
+    ['https://allowed.com/', '\\\\evil.com/path'],
+    ['\\\\evil.com/path', 'https://allowed.com/'],
+    ['https://allowed.com/', 'http:/\\evil.com/path'],
+    ['https://allowed.com/', 'http:\\/evil.com/path']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([base, rel]) => {
+    t.throws(
+      () => fastURI.resolve(base, rel),
+      /URI authority must not contain a literal backslash/,
+      `${base} + ${rel}`
+    )
+  })
+})
+
+test('parse rejects a whitespace-split authority introducer (TAB, LF, CR)', (t) => {
+  // The WHATWG URL parser removes TAB (U+0009), LF (U+000A) and CR (U+000D) from
+  // the input before parsing, so a stripped character wedged into the introducer
+  // ("/<TAB>\\", "/<TAB>/", or a leading "<TAB>//") reaches an authority in Node
+  // while fast-uri would otherwise fold it into the path. These must be rejected
+  // like the adjacent "\\", "/\\", "\\/" forms.
+  const cases = [
+    { input: '/\t\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
+    { input: '/\n\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '/\r\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: '\t//evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
+    { input: '\t/\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
+    { input: 'https:/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' }
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach(({ input, expectedError }) => {
+    t.equal(fastURI.parse(input).error, expectedError, JSON.stringify(input))
+  })
+})
+
+test('resolve throws on a whitespace-split authority introducer', (t) => {
+  const pairs = [
+    ['https://allowed.com/', '/\t\\evil.com/path'],
+    ['https://allowed.com/', '/\t/evil.com/path'],
+    ['https://allowed.com/', '/\n\\evil.com/path'],
+    ['/\t/evil.com/path', 'https://allowed.com/']
+  ]
+
+  t.plan(pairs.length)
+
+  pairs.forEach(([base, rel]) => {
+    t.throws(
+      () => fastURI.resolve(base, rel),
+      /URI authority (must not contain a literal backslash|introducer must not contain whitespace)/,
+      `${JSON.stringify(base)} + ${JSON.stringify(rel)}`
+    )
+  })
+})
+
+test('parse does not reject valid authority introducer patterns', (t) => {
+  // No false positives: "//" introducer and scheme-less "//" must be valid.
+  const cases = [
+    'http://good.com/',
+    'https://good.com/',
+    'ws://good.com/chat',
+    'wss://good.com/chat',
+    'ftp://good.com/',
+    '//good.com/path',
+    '/absolute/path',
+    'relative/path'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    const parsed = fastURI.parse(input)
+    t.notOk(parsed.error, input)
+  })
 })

package/node_modules/fast-uri/test/serialize.test.js

@@ -149,3 +149,147 @@ test('URN NID Override', (t) => {
   t.equal(fastURI.serialize(components, { nid: 'uuid' }), 'urn:foo:f81d4fae-7dec-11d0-a765-00a0c91e6bf6')
   t.end()
 })
+
+test('Mailto serialization preserves delimiters, escapes, and input state', (t) => {
+  const valueComponent = {
+    scheme: 'mailto',
+    to: ['user@example.org'],
+    headers: { x: 'a&b' }
+  }
+  const valueURI = fastURI.serialize(valueComponent)
+  t.equal(valueURI, 'mailto:user@example.org?x=a%26b', 'ampersand in header value is encoded')
+  // spread: `headers` has a null prototype, which t.deepEqual compares strictly
+  t.deepEqual({ ...fastURI.parse(valueURI).headers }, { x: 'a&b' }, 'header value round-trips')
+
+  const nameComponent = {
+    scheme: 'mailto',
+    to: ['user@example.org'],
+    headers: { 'x&y': 'z' }
+  }
+  const nameURI = fastURI.serialize(nameComponent)
+  t.equal(nameURI, 'mailto:user@example.org?x%26y=z', 'ampersand in header name is encoded')
+  t.deepEqual({ ...fastURI.parse(nameURI).headers }, { 'x&y': 'z' }, 'header name round-trips')
+
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', to: ['user@example.org'], subject: 'a%2fb' }),
+    'mailto:user@example.org?subject=a%2Fb',
+    'valid percent escape is preserved and uppercased'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', to: ['user@example.org'], subject: 'a%GGb' }),
+    'mailto:user@example.org?subject=a%25GGb',
+    'malformed percent escape is encoded'
+  )
+
+  const immutableComponent = {
+    scheme: 'mailto',
+    to: ['café@EXAMPLE.ORG'],
+    subject: 'hello',
+    headers: { cc: 'other@example.org' }
+  }
+  const expected = JSON.parse(JSON.stringify(immutableComponent))
+  fastURI.serialize(immutableComponent)
+  t.deepEqual(immutableComponent, expected, 'recipient and header containers are not mutated')
+  t.end()
+})
+
+test('Mailto serialization does not let recipient data inject URI structure', (t) => {
+  // A recipient domain must never reach the output with a delimiter intact:
+  // "?" would inject header fields and "#" a fragment.
+  const cases = [
+    ['user@example.org?subject=Injected', 'mailto:user@example.org%3Fsubject%3Dinjected'],
+    ['user@example.org#frag', 'mailto:user@example.org%23frag'],
+    // domain literals accept the full RFC 5321 dcontent range, which includes "?"
+    ['user@[x?subject=Injected]', 'mailto:user@[x%3Fsubject%3Dinjected]'],
+    // "," is the recipient delimiter, so it must be encoded inside an address
+    ['a,b@example.org', 'mailto:a%2Cb@example.org']
+  ]
+
+  for (const [recipient, expected] of cases) {
+    const uri = fastURI.serialize({ scheme: 'mailto', to: [recipient] })
+    t.equal(uri, expected, 'encodes delimiters in ' + recipient)
+    const reparsed = fastURI.parse(uri)
+    t.deepEqual(reparsed.to, [recipient.toLowerCase()], 'round-trips ' + recipient)
+    t.equal(reparsed.subject, undefined, 'no subject injected by ' + recipient)
+    t.equal(reparsed.headers, undefined, 'no headers injected by ' + recipient)
+    t.equal(reparsed.fragment, undefined, 'no fragment injected by ' + recipient)
+  }
+
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', to: ['a@x.test', 'b@y.test'] }),
+    'mailto:a@x.test,b@y.test',
+    'the joining comma between recipients stays literal'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', to: ['user@[IPv6:2001:db8::1]'] }),
+    'mailto:user@[ipv6:2001:db8::1]',
+    'a valid domain literal keeps its delimiters'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', to: ['user@納豆.example.org'] }),
+    'mailto:user@xn--99zt52a.example.org',
+    'Unicode domain is still converted to ASCII'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', to: ['user@納豆.example.org'] }, { unicodeSupport: true }),
+    'mailto:user@納豆.example.org',
+    'Unicode domain is still preserved when requested'
+  )
+  t.end()
+})
+
+test('Mailto encoding is consistent across the fast/slow path boundary', (t) => {
+  // The encoder returns the input untouched when every character is allowed,
+  // and only then falls back to the per-character loop. Both branches must
+  // agree on what needs escaping.
+  const base = { scheme: 'mailto', to: ['user@example.org'] }
+
+  t.equal(
+    fastURI.serialize({ ...base, headers: { 'In-Reply-To': 'plain-value' } }),
+    'mailto:user@example.org?In-Reply-To=plain-value',
+    'fully allowed name and value are emitted verbatim'
+  )
+  t.equal(
+    fastURI.serialize({ ...base, headers: { 'x y': '<a>&b c' } }),
+    'mailto:user@example.org?x%20y=%3Ca%3E%26b%20c',
+    'disallowed characters are escaped in both name and value'
+  )
+  t.equal(
+    fastURI.serialize({ ...base, body: 'send current-issue\r\nsend index' }),
+    'mailto:user@example.org?body=send%20current-issue%0D%0Asend%20index',
+    'space and CRLF are escaped in a body'
+  )
+  t.equal(
+    fastURI.serialize({ ...base, subject: 'a%2fb%GGc' }),
+    'mailto:user@example.org?subject=a%2Fb%25GGc',
+    'valid escapes are uppercased and invalid ones escaped in one pass'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', to: ['a.b-c_d~e!f@example.org'] }),
+    'mailto:a.b-c_d~e!f@example.org',
+    'an entirely allowed local part takes the fast path unchanged'
+  )
+  t.end()
+})
+
+test('Mailto serialization ignores a caller-supplied path', (t) => {
+  // `to` is the only recipient source. A raw path has not been through this
+  // handler's encoder, and the handler sets `skipEscape`, so emitting it would
+  // put unescaped data (including CR/LF) straight into the URI.
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', path: 'a@b.test\r\nBcc: evil@evil.test' }),
+    'mailto:',
+    'a path containing CRLF is dropped, not emitted raw'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', path: 'user@example.org?subject=Injected' }),
+    'mailto:',
+    'a path containing header fields is dropped'
+  )
+  t.equal(
+    fastURI.serialize({ scheme: 'mailto', to: ['a@b.test'], path: 'ignored?x=1' }),
+    'mailto:a@b.test',
+    'a path is ignored when recipients are present'
+  )
+  t.end()
+})

package/node_modules/fast-uri/test/uri-js-compatibility.test.js

@@ -13,9 +13,6 @@ test('uri-js compatibility Parse', (t) => {
     if (value === '//10.10.000.10') {
       return t.skip('Skipping //10.10.000.10 as it is not a valid URI per URI spec: https://datatracker.ietf.org/doc/html/rfc5954#section-4.1')
     }
-    if (value.slice(0, 6) === 'mailto') {
-      return t.skip('Skipping mailto schema test as it is not supported by fastifyURI')
-    }
     t.same(JSON.parse(JSON.stringify(fastURI.parse(value))), expected, 'Compatibility parse: ' + value)
   })
   t.end()

package/node_modules/fast-uri/test/uri-js.test.js

@@ -8,7 +8,7 @@ const fastURI = require('..')
  *
  * @fileoverview An RFC 3986 compliant, scheme extendable URI parsing/normalizing/resolving/serializing library for JavaScript.
  * @author <a href="mailto:gary.court@gmail.com">Gary Court</a>
- * @see http://github.com/garycourt/uri-js
+ * @see https://github.com/garycourt/uri-js
  */
 
 /**
@@ -692,7 +692,7 @@ if (fastURI.SCHEMES.mailto) {
 
     components = fastURI.parse('mailto:list@example.org?In-Reply-To=%3C3469A91.D10AF4C@example.com%3E')
     t.deepEqual(components.to, ['list@example.org'], 'to')
-    t.deepEqual(components.headers, { 'In-Reply-To': '<3469A91.D10AF4C@example.com>' }, 'headers')
+    t.deepEqual({ ...components.headers }, { 'In-Reply-To': '<3469A91.D10AF4C@example.com>' }, 'headers')
 
     components = fastURI.parse('mailto:majordomo@example.com?body=subscribe%20bamboo-l')
     t.deepEqual(components.to, ['majordomo@example.com'], 'to')
@@ -701,7 +701,7 @@ if (fastURI.SCHEMES.mailto) {
     components = fastURI.parse('mailto:joe@example.com?cc=bob@example.com&body=hello')
     t.deepEqual(components.to, ['joe@example.com'], 'to')
     t.equal(components.body, 'hello', 'body')
-    t.deepEqual(components.headers, { cc: 'bob@example.com' }, 'headers')
+    t.deepEqual({ ...components.headers }, { cc: 'bob@example.com' }, 'headers')
 
     components = fastURI.parse('mailto:joe@example.com?cc=bob@example.com?body=hello')
     if (fastURI.VALIDATE_SUPPORT) t.ok(components.error, 'invalid header fields')
@@ -711,7 +711,7 @@ if (fastURI.SCHEMES.mailto) {
 
     components = fastURI.parse('mailto:unlikely%3Faddress@example.com?blat=foop')
     t.deepEqual(components.to, ['unlikely?address@example.com'], 'to unlikely?address@example.com')
-    t.deepEqual(components.headers, { blat: 'foop' }, 'headers')
+    t.deepEqual({ ...components.headers }, { blat: 'foop' }, 'headers')
 
     components = fastURI.parse('mailto:Mike%26family@example.org')
     t.deepEqual(components.to, ['Mike&family@example.org'], 'to Mike&family@example.org')

package/node_modules/fast-uri/test/urn-full-input.test.js

@@ -0,0 +1,29 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+test('URN parsing validates the complete scheme-specific input', (t) => {
+  const embedded = fastURI.parse('urn:x|foo:bar')
+  t.equal(embedded.error, 'URN can not be parsed.', 'does not search for a later nid:nss substring')
+  t.equal(embedded.nid, undefined, 'does not adopt the later nid')
+  t.equal(embedded.nss, undefined, 'does not adopt the later nss')
+
+  const trailing = fastURI.parse('urn:foo:bar|ignored')
+  t.equal(trailing.error, 'URN can not be parsed.', 'rejects trailing input outside the RFC 2141 NSS grammar')
+  t.equal(trailing.nid, undefined, 'does not return an nid from a partial match')
+  t.equal(trailing.nss, undefined, 'does not return a truncated nss')
+
+  t.end()
+})
+
+test('URN parsing preserves the complete RFC 2141 NSS', (t) => {
+  const parsed = fastURI.parse('urn:foo:allowed/evil')
+  t.equal(parsed.error, undefined, 'accepts slash in an RFC 2141 NSS')
+  t.equal(parsed.nid, 'foo', 'parses the nid')
+  t.equal(parsed.nss, 'allowed/evil', 'preserves the complete NSS')
+  t.equal(fastURI.normalize('urn:foo:allowed/evil'), 'urn:foo:allowed/evil', 'normalization retains slash data')
+  t.equal(fastURI.equal('urn:foo:allowed/evil', 'urn:foo:allowed'), false, 'distinct NSS values do not compare equal')
+
+  t.end()
+})

package/node_modules/fast-uri/test/util.test.js

@@ -29,6 +29,15 @@ test('removeDotSegments', (t) => {
   // https://github.com/fastify/fast-uri/issues/139
   testCases.push(['WS:/WS://1305G130505:1&%0D:1&C(XXXXX*)))))))XXX130505:UUVUaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa$aaaaaaaaaaaa13a',
     'WS:/WS://1305G130505:1&%0D:1&C(XXXXX*)))))))XXX130505:UUVUaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa$aaaaaaaaaaaa13a'])
+  // trailing empty segments must be preserved: RFC 3986 5.2.4 only removes
+  // complete "." / ".." segments, never an empty segment
+  testCases.push(['//', '//'])
+  testCases.push(['/foo//', '/foo//'])
+  testCases.push(['/a/b//', '/a/b//'])
+  testCases.push(['/x//y//z', '/x//y//z'])
+  // "." / ".." segments still collapse
+  testCases.push(['/a/b/c/./../../g', '/a/g'])
+  testCases.push(['/.', '/'])
 
   t.plan(testCases.length)
 

package/node_modules/fast-uri/test/websocket-query-preservation.test.js

@@ -0,0 +1,24 @@
+'use strict'
+
+const test = require('tape')
+const fastURI = require('..')
+
+test('WebSocket queries preserve additional question marks', (t) => {
+  for (const scheme of ['ws', 'wss']) {
+    const uri = `${scheme}://example.com/chat?a?b`
+    const truncatedURI = `${scheme}://example.com/chat?a`
+    const parsed = fastURI.parse(uri)
+
+    t.equal(parsed.resourceName, '/chat?a?b', `${scheme} parse preserves the resource name`)
+    t.equal(fastURI.serialize(parsed), uri, `${scheme} parsed components round-trip`)
+    t.equal(
+      fastURI.serialize({ scheme, host: 'example.com', resourceName: '/chat?a?b' }),
+      uri,
+      `${scheme} resource name serializes without truncation`
+    )
+    t.equal(fastURI.normalize(uri), uri, `${scheme} normalization preserves the full query`)
+    t.equal(fastURI.equal(uri, truncatedURI), false, `${scheme} equality distinguishes the full query`)
+  }
+
+  t.end()
+})

package/node_modules/fast-uri/tsconfig.json

@@ -1,9 +1,10 @@
 {
-    "compilerOptions": {
-        "allowJs": true,
-        "checkJs": true,
-        "strict": true,
-        "noImplicitAny": true,
-        "target": "es2015"
-    }
+  "compilerOptions": {
+    "allowJs": true,
+    "checkJs": true,
+    "strict": true,
+    "noImplicitAny": true,
+    "target": "es2022",
+    "noEmit": true
+  }
 }

package/node_modules/fast-uri/types/index.d.ts

@@ -16,6 +16,10 @@ declare namespace fastUri {
     secure?: boolean;
     uuid?: string;
     error?: string;
+    to?: string[];
+    subject?: string;
+    body?: string;
+    headers?: { [hfname: string]: string };
   }
   export interface Options {
     scheme?: string;
@@ -28,15 +32,6 @@ declare namespace fastUri {
     nid?: string;
   }
 
-  /**
-   * @deprecated Use Options instead
-   */
-  export type options = Options
-  /**
-   * @deprecated Use URIComponent instead
-   */
-  export type URIComponents = URIComponent
-
   export function normalize (uri: string, opts?: Options): string
   export function normalize (uri: URIComponent, opts?: Options): URIComponent
   export function normalize (uri: any, opts?: Options): any

package/node_modules/fast-uri/types/index.tst.ts

@@ -0,0 +1,31 @@
+import uri, {
+  type URIComponent,
+} from '..'
+import { expect } from 'tstyche'
+
+const parsed = uri.parse('foo')
+expect(parsed).type.toBe<URIComponent>()
+
+const parsed2 = uri.parse('foo', {
+  domainHost: true,
+  scheme: 'https',
+  unicodeSupport: false
+})
+
+expect(parsed2).type.toBe<URIComponent>()
+
+const mailtoComponent: URIComponent = {
+  scheme: 'mailto',
+  to: ['user@example.org'],
+  subject: 'Hello',
+  body: 'Message',
+  headers: { cc: 'other@example.org' }
+}
+
+expect(uri.serialize(mailtoComponent, { unicodeSupport: true })).type.toBe<string>()
+
+const parsedMailto = uri.parse('mailto:user@example.org')
+expect(parsedMailto.to).type.toBe<string[] | undefined>()
+expect(parsedMailto.subject).type.toBe<string | undefined>()
+expect(parsedMailto.body).type.toBe<string | undefined>()
+expect(parsedMailto.headers).type.toBe<{ [hfname: string]: string } | undefined>()