@openclaw/lobster 2026.9.5 → 2026.9.7

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/SECURITY.md

@@ -15,38 +15,87 @@ Reports based solely on comparing or mixing parsers that follow these different
 standards are out of scope. Applications must use the same parsing and
 normalization rules for both security decisions and subsequent URI use.
 
+A WHATWG comparison may be useful supporting evidence, but a parser difference
+is not by itself a vulnerability. A report remains in scope when it independently
+demonstrates a defect in `fast-uri`'s RFC or documented behavior for a supported
+scheme and a concrete security impact when the application uses `fast-uri`
+consistently. An exploit that requires validating with `fast-uri` and then
+passing the original, unmodified input to a parser with different rules is an
+application parser-confusion issue.
+
 Reports are assessed based on reproducibility, documented supported usage, and
 concrete security impact—not merely on whether they mention WHATWG URL
-behavior. Reports demonstrating a parsing or normalization flaw in a supported
-scheme remain eligible for evaluation.
+behavior.
 
 ## Threat model
 
 `fast-uri`'s threat model extends the
 [Node.js threat model](https://github.com/nodejs/node/blob/main/SECURITY.md#the-nodejs-threat-model).
 
-**Trusted:** Application code, parser options, configuration, and the runtime
-environment.
+**Trusted:** Application code, structured component objects constructed or
+modified by application code and passed directly to `serialize()`, parser
+options, configuration, and the runtime environment.
 
 **Untrusted:** URI and IRI strings passed to the package's public APIs.
 
+## Vulnerability classification
+
+A report is treated as a vulnerability when it demonstrates all of the
+following:
+
+1. Attacker-controlled input reaches a public API through documented,
+   supported usage.
+2. `fast-uri` violates an applicable RFC or its documented API contract.
+3. The defect creates a concrete confidentiality, integrity, or availability
+   impact in a realistic supported use case.
+4. The impact does not depend solely on application misuse, an unsupported
+   scheme, a different parser interpreting the original input, or another
+   package's behavior.
+
+A reproducible bug can still merit a normal issue and fix without meeting the
+security-vulnerability threshold.
+
 ### Examples of vulnerabilities
 
-- RFC 3986 parsing or normalization flaws that bypass security controls
-- Denial of service through malformed input
-- Inconsistent parsing or normalization between `fast-uri` APIs
+- `parse()`, `normalize()`, or `resolve()` changes an attacker-controlled
+  authority within `fast-uri`, and the report demonstrates a host security
+  control being bypassed using that output
+- `equal()` aliases distinct URIs under the rules of a supported scheme, and
+  the report demonstrates an authorization, signature, or cache boundary being
+  bypassed
+- One public API call on a reasonably sized malformed URI causes
+  disproportionate CPU or memory consumption, with reproducible availability
+  impact
+- Parsing or normalization turns component data into a structural delimiter
+  and the report demonstrates a security-control bypass in documented usage
+
+### Denial-of-service reports
+
+A synchronous exception, parse error, or non-idempotent result is not by itself
+a denial-of-service vulnerability. A report must demonstrate disproportionate
+resource consumption in a public API call, or loss of availability in a
+supported deployment despite normal exception handling. An application that
+terminates on an uncaught exception, or repeatedly normalizes until reaching a
+fixpoint, does not establish a package vulnerability by itself.
 
 ### Examples of non-vulnerabilities
 
 The following are **not** considered vulnerabilities in `fast-uri`:
 
-- **Different URL standards:** Differences between RFC 3986 behavior and
-  WHATWG URL behavior, including differences exposed by mixing parsers that
-  implement those standards
-- **Unsupported scheme semantics:** Scheme-specific behavior for schemes that
-  `fast-uri` does not document as supported
+- **Different URL standards:** `fast-uri` returns one host, but an application
+  passes the original input to WHATWG `URL`, `fetch`, or another parser that
+  applies different recovery, whitespace, or legacy-IP rules
+- **Unsupported scheme semantics:** Behavior specific to schemes such as
+  `ftp` or `file`, which `fast-uri` does not document as supported
+- **Correctness without security impact:** Non-idempotent normalization,
+  surprising equality, truncation, re-encoding, or malformed-input handling
+  without a demonstrated security boundary or availability impact
+- **Caller-created resource use:** An application repeatedly parses or
+  normalizes a value, or fails to catch a synchronous exception
+- **Trusted structured input:** Boundary characters supplied in a component
+  object that application code constructs and passes to `serialize()`
 - **Application code vulnerabilities:** Security flaws in code that consumes
-  `fast-uri` output
+  `fast-uri` output contrary to its documented contract
 - **Configuration mistakes:** Security issues caused by incorrect parser
   options or application configuration
 - **Missing security features:** Application-level protections that are not

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/index.js

@@ -89,6 +89,22 @@ function resolve (baseURI, relativeURI, options) {
   return serialize(resolved, schemelessOptions)
 }
 
+/**
+ * Copies a host component together with its parse-time zone identifier (if
+ * any), so downstream recomposition does not re-derive an IPv6 zone from the
+ * ambiguous single-"%" component form. The zone is validated on use by
+ * `recomposeAuthority` rather than blindly trusted.
+ *
+ * @param {import('./types/index').URIComponent} target
+ * @param {import('./types/index').URIComponent} source
+ */
+function copyHost (target, source) {
+  target.host = source.host
+  if (source.ipv6Zone !== undefined) {
+    target.ipv6Zone = source.ipv6Zone
+  }
+}
+
 /**
  * @param {import ('./types/index').URIComponent} base
  * @param {import ('./types/index').URIComponent} relative
@@ -109,7 +125,7 @@ function resolveComponent (base, relative, options, skipNormalization) {
     target.scheme = relative.scheme
     // target.authority = relative.authority;
     target.userinfo = relative.userinfo
-    target.host = relative.host
+    copyHost(target, relative)
     target.port = relative.port
     target.path = removeDotSegments(relative.path || '')
     target.query = relative.query
@@ -117,7 +133,7 @@ function resolveComponent (base, relative, options, skipNormalization) {
     if (relative.userinfo !== undefined || relative.host !== undefined || relative.port !== undefined) {
       // target.authority = relative.authority;
       target.userinfo = relative.userinfo
-      target.host = relative.host
+      copyHost(target, relative)
       target.port = relative.port
       target.path = removeDotSegments(relative.path || '')
       target.query = relative.query
@@ -146,7 +162,7 @@ function resolveComponent (base, relative, options, skipNormalization) {
       }
       // target.authority = base.authority;
       target.userinfo = base.userinfo
-      target.host = base.host
+      copyHost(target, base)
       target.port = base.port
     }
     target.scheme = base.scheme
@@ -178,6 +194,7 @@ function equal (uriA, uriB, options) {
 function serialize (cmpts, opts) {
   const component = {
     host: cmpts.host,
+    ipv6Zone: cmpts.ipv6Zone,
     scheme: cmpts.scheme,
     userinfo: cmpts.userinfo,
     port: cmpts.port,
@@ -506,6 +523,16 @@ function parseWithStatus (uri, opts) {
         malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true)
         parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase()
 
+        if (isIP && ipv6result.isIPV6 === true && parsed.host.indexOf('%') !== -1) {
+          // Persist the zone identifier so recomposition never has to re-derive
+          // it from the ambiguous single-"%" component form, which misreads a
+          // zone that begins with "25" as a %25 separator. It is validated on
+          // use during recomposition, so a host reassigned after parse or an
+          // input zone that does not describe the host is ignored. Only zoned
+          // literals are ambiguous; plain IPv6 addresses round-trip without it.
+          parsed.ipv6Zone = parsed.host.slice(parsed.host.indexOf('%') + 1)
+        }
+
         if (malformedIPLiteral) {
           parsed.error = parsed.error || 'URI host is malformed.'
           malformedAuthorityOrPort = true
@@ -537,13 +564,17 @@ function parseWithStatus (uri, opts) {
       malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP)
     }
 
-    if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
-      if (uri.indexOf('%') !== -1) {
-        if (parsed.host !== undefined && !malformedIPLiteral) {
-          const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true)
-          parsed.host = reescapeHostDelimiters(host, isIP)
-        }
+    if (uri.indexOf('%') !== -1 && parsed.host !== undefined && !malformedIPLiteral) {
+      let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true)
+      if (!isIP) {
+        // Fold reg-name case after decoding unreserved octets. The second
+        // pass only restores uppercase hex in escapes that remain encoded.
+        host = normalizePercentEncoding(host.toLowerCase())
       }
+      parsed.host = reescapeHostDelimiters(host, isIP)
+    }
+
+    if (!schemeHandler || (schemeHandler && !schemeHandler.skipNormalize)) {
       if (parsed.path) {
         parsed.path = normalizePathEncoding(parsed.path)
       }

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/lib/schemes.js

@@ -290,6 +290,7 @@ const DTEXT_IRI = allowSet(DTEXT_ALLOWED, true)
 const HEX_PAIR = /^[\da-f]{2}$/iu
 const MAILTO_DOMAIN_LITERAL = /^\[[\x21-\x5A\x5E-\x7E]*\]$/u
 const MAILTO_DOMAIN_ERROR = 'URI mailto has an invalid recipient domain.'
+const MAILTO_AUTHORITY_ERROR = 'URI mailto must not have an authority component.'
 const HAS_SURROGATE = /[\uD800-\uDFFF]/u
 
 /**
@@ -495,29 +496,51 @@ function mailtoParse (component, options) {
         mailtoComponent.error = mailtoComponent.error || 'URI mailto has malformed header fields.'
         continue
       }
-      const name = eqIdx === -1 ? token : token.slice(0, eqIdx)
+      const name = decodeHex(eqIdx === -1 ? token : token.slice(0, eqIdx))
+      const normalizedName = name.toLowerCase()
       const value = eqIdx === -1 ? '' : token.slice(eqIdx + 1)
-      if (name === 'to') {
+      if (normalizedName === 'to') {
         const addrs = value.split(',')
         for (let j = 0; j < addrs.length; j++) to.push(addrs[j])
         continue
       }
-      if (name === 'subject') {
+      if (normalizedName === 'subject') {
         mailtoComponent.subject = decodeHex(value)
         continue
       }
-      if (name === 'body') {
+      if (normalizedName === 'body') {
         mailtoComponent.body = decodeHex(value)
         continue
       }
       if (headers === null) headers = /** @type {Record<string,string>} */ (Object.create(null))
-      headers[decodeHex(name)] = decodeHex(value)
+      headers[name] = decodeHex(value)
     }
     if (headers !== null) mailtoComponent.headers = headers
   }
 
   mailtoComponent.query = undefined
 
+  // RFC 6068 defines no authority for the `mailto` scheme. A `mailto://` input
+  // that retains an authority and also carries recipients (from the path or a
+  // `to=` hfield) folds a leading "/" into the recipient local part on the
+  // next parse; the generic serializer then reinserts a "/" before that path
+  // on every pass, so serialize(parse(x)) is not a fixpoint and a
+  // renormalize-to-fixpoint loop accretes one "%2F" per pass. Drop the
+  // retained authority so the parse -> serialize round trip is stable. A bare
+  // `mailto://host` with no recipients is left as-is: it is idempotent and host
+  // normalization for skip-normalize schemes stays intact.
+  if (
+    to.length > 0 &&
+    (mailtoComponent.userinfo !== undefined ||
+      mailtoComponent.host !== undefined ||
+      mailtoComponent.port !== undefined)
+  ) {
+    mailtoComponent.userinfo = undefined
+    mailtoComponent.host = undefined
+    mailtoComponent.port = undefined
+    mailtoComponent.error = mailtoComponent.error || MAILTO_AUTHORITY_ERROR
+  }
+
   for (let i = 0; i < to.length; i++) {
     const rawAddr = to[i]
     const atIdx = rawAddr.lastIndexOf('@')
@@ -536,6 +559,18 @@ function mailtoParse (component, options) {
   return mailtoComponent
 }
 
+/**
+ * Encodes a decoded mailto header name. Unlike `encodeWithAllow`, a percent
+ * sign is always data here, even when followed by two hex digits. Preserving
+ * such a sequence as an existing escape would decode the name again on the
+ * next parse and could turn a generic header into `to`, `subject`, or `body`.
+ * @param {string} name
+ * @returns {string}
+ */
+function mailtoEncodeHeaderName (name) {
+  return encodeWithAllow(name.replace(/%/gu, '%25'), HFNAME)
+}
+
 /**
  * @param {import('../types/index').URIComponent} component
  * @param {import('../types/index').Options} options
@@ -544,7 +579,40 @@ function mailtoParse (component, options) {
 function mailtoSerialize (component, options) {
   const mailtoComponent = component
   const to = Array.isArray(mailtoComponent.to) ? mailtoComponent.to.slice() : []
+  const sourceHeaders = mailtoComponent.headers && typeof mailtoComponent.headers === 'object'
+    ? Object.assign(Object.create(null), mailtoComponent.headers)
+    : Object.create(null)
+  const headers = Object.create(null)
+
+  // Header field names are case-insensitive. Canonicalize the fields with
+  // dedicated component properties so callers cannot smuggle a second spelling
+  // through `headers`. As during parsing, all `to` fields are accumulated;
+  // repeated subject/body fields use the last value.
+  for (const name in sourceHeaders) {
+    const normalizedName = name.toLowerCase()
+    if (normalizedName === 'to') {
+      const addrs = String(sourceHeaders[name]).split(',')
+      for (let i = 0; i < addrs.length; i++) to.push(addrs[i])
+    } else if (normalizedName === 'subject' || normalizedName === 'body') {
+      headers[normalizedName] = sourceHeaders[name]
+    } else {
+      headers[name] = sourceHeaders[name]
+    }
+  }
+
+  if (mailtoComponent.subject !== undefined) headers.subject = mailtoComponent.subject
+  if (mailtoComponent.body !== undefined) headers.body = mailtoComponent.body
+  mailtoComponent.headers = headers
+
   if (to.length) {
+    // RFC 6068 defines no authority for the `mailto` scheme. If an
+    // application constructs a component with both an authority and recipients,
+    // drop the authority before the generic serializer can insert a "/" path
+    // separator that becomes part of the first recipient on the next parse.
+    mailtoComponent.userinfo = undefined
+    mailtoComponent.host = undefined
+    mailtoComponent.port = undefined
+
     for (let i = 0; i < to.length; i++) {
       const addr = String(to[i])
       const atIdx = addr.lastIndexOf('@')
@@ -570,21 +638,13 @@ function mailtoSerialize (component, options) {
     mailtoComponent.path = undefined
   }
 
-  const headers = mailtoComponent.headers && typeof mailtoComponent.headers === 'object'
-    ? Object.assign(Object.create(null), mailtoComponent.headers)
-    : Object.create(null)
-
-  if (mailtoComponent.subject) headers.subject = mailtoComponent.subject
-  if (mailtoComponent.body) headers.body = mailtoComponent.body
-  mailtoComponent.headers = headers
-
-  // `headers` has a null prototype and was filled via Object.assign, so every
-  // enumerable key is an own property and no hasOwnProperty guard is needed.
+  // `headers` has a null prototype, so every enumerable key is an own property
+  // and no hasOwnProperty guard is needed.
   let query = ''
   let count = 0
   for (const name in headers) {
     if (count++ !== 0) query += '&'
-    query += encodeWithAllow(name, HFNAME) + '=' + encodeWithAllow(String(headers[name]), HFNAME)
+    query += mailtoEncodeHeaderName(name) + '=' + encodeWithAllow(String(headers[name]), HFNAME)
   }
 
   if (count !== 0) {

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/lib/utils.js

@@ -740,6 +740,37 @@ function escapePreservingEscapes (input) {
   return output
 }
 
+/**
+ * Rebuilds the bracketed form of a zoned IPv6 authority from the current
+ * `component.host` and its zone identifier (`component.ipv6Zone`), but only
+ * when they are consistent and describe a real zoned IPv6 literal that
+ * normalizes back to `component.host`. This validates the zone on use, so a
+ * caller-supplied `ipv6Zone` that does not match the host (or a host
+ * reassigned after `parse`) is never trusted and recomposition falls back to
+ * the normal path.
+ *
+ * @param {import('../types/index').URIComponent} component
+ * @returns {string|undefined}
+ */
+function recomposeZonedIPv6Host (component) {
+  const zone = component.ipv6Zone
+  // Without an ipv6Zone the single-"%" host form is genuinely ambiguous when
+  // the zone begins with "25", so we fall through to the best-effort heuristic
+  // (which matches the pre-existing behavior for hand-built components that do
+  // not carry a zone).
+  if (zone === undefined) return undefined
+  const host = component.host
+  const separator = host.indexOf('%')
+  if (separator === -1) return undefined
+  const address = host.slice(0, separator)
+  const escaped = address + '%25' + zone
+  const derived = normalizeIPv6('[' + escaped + ']')
+  if (derived.isIPV6 === true && derived.host === host) {
+    return '[' + escaped + ']'
+  }
+  return undefined
+}
+
 /**
  * @param {import('../types/index').URIComponent} component
  * @returns {string|undefined}
@@ -755,17 +786,30 @@ function recomposeAuthority (component) {
   if (component.host !== undefined) {
     let host = component.host
     if (!isIPv4(host)) {
-      let ipV6res = normalizeIPv6(host)
-      if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
-        // Decode only unreserved bytes, once. In particular, keep %25 encoded
-        // so it cannot introduce a second escape during recomposition.
-        host = normalizePercentEncoding(host, true)
-        ipV6res = normalizeIPv6(host)
-      }
-      if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
-        host = `[${ipV6res.escapedHost}]`
+      // A parse-time zone identifier is authoritative only while it still
+      // describes the current host. Re-deriving an IPv6 zone from the
+      // single-"%" component form is ambiguous when the zone begins with
+      // "25": it is misread as a %25 separator, rewriting e.g. zone
+      // "25eth0" into "eth0" (or destroying a zone of just "25"). A
+      // validated zone keeps parse, normalize, serialize and equal in
+      // agreement.
+      const zonedHost = recomposeZonedIPv6Host(component)
+      if (zonedHost !== undefined) {
+        host = zonedHost
       } else {
-        host = reescapeHostDelimiters(host, false)
+        let ipV6res = normalizeIPv6(host)
+        if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
+          // Decode only unreserved bytes, once. In particular, keep %25
+          // encoded so it cannot introduce a second escape during
+          // recomposition.
+          host = normalizePercentEncoding(host, true)
+          ipV6res = normalizeIPv6(host)
+        }
+        if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
+          host = `[${ipV6res.escapedHost}]`
+        } else {
+          host = reescapeHostDelimiters(host, false)
+        }
       }
     }
     uriTokens.push(host)

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "4.1.4",
+  "version": "4.2.1",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/test/fixtures/uri-js-parse.json

@@ -43,6 +43,7 @@
     "//[2001:db8::7%en0]",
     {
       "host": "2001:db8::7%en0",
+      "ipv6Zone": "en0",
       "path": "",
       "reference": "relative"
     }

package/node_modules/@clawdbot/lobster/node_modules/fast-uri/test/ipv6-validation.test.js

@@ -119,6 +119,136 @@ test('IPv6 zone identifiers are validated correctly', (t) => {
   t.end()
 })
 
+test('zoned IPv6 hosts beginning with "25" round-trip through parse/normalize/serialize/equal', (t) => {
+  const cases = [
+    // zones beginning with "25" (once ambiguous with a %25 separator)
+    ['http://[fe80::1%2525]/', 'fe80::1%25', 'http://[fe80::1%2525]/'],
+    ['http://[fe80::1%2525eth0]/', 'fe80::1%25eth0', 'http://[fe80::1%2525eth0]/'],
+    ['http://[fe80::1%2525en1]/', 'fe80::1%25en1', 'http://[fe80::1%2525en1]/'],
+    // zones that do not begin with "25" must stay idempotent
+    ['http://[fe80::1%25eth0]/', 'fe80::1%eth0', 'http://[fe80::1%25eth0]/'],
+    ['http://[fe80::a%en1]/', 'fe80::a%en1', 'http://[fe80::a%25en1]/'],
+    ['http://[fe80::a%25eth%2D0]/', 'fe80::a%eth%2D0', 'http://[fe80::a%25eth%2D0]/']
+  ]
+
+  for (const [input, host, normalized] of cases) {
+    const parsed = fastURI.parse(input)
+    t.equal(parsed.error, undefined, `${input} parses without error`)
+    t.equal(parsed.host, host, `${input} exposes the expected host`)
+    t.equal(fastURI.normalize(input), normalized, `${input} normalizes to the canonical form`)
+    t.equal(fastURI.serialize(parsed), normalized, `${input} serializes to the canonical form`)
+    const reparsed = fastURI.parse(normalized)
+    t.equal(reparsed.error, undefined, `${input} canonical output reparses without error`)
+    t.equal(reparsed.host, host, `${input} parse-after-normalize is stable`)
+  }
+
+  // distinct zones must not be conflated by equal
+  t.equal(
+    fastURI.equal('http://[fe80::1%2525eth0]/', 'http://[fe80::1%25eth0]/'),
+    false,
+    'equal distinguishes zones "25eth0" and "eth0"'
+  )
+  t.equal(
+    fastURI.equal('http://[fe80::1%2525]/', 'http://[fe80::1%25eth0]/'),
+    false,
+    'equal distinguishes zones "25" and "eth0"'
+  )
+  // the same zone still compares equal
+  t.equal(
+    fastURI.equal('http://[fe80::1%2525eth0]/', 'http://[fe80::1%2525eth0]/'),
+    true,
+    'an identical zoned authority is equal'
+  )
+  t.equal(
+    fastURI.equal('http://[fe80::1%2525]/', 'http://[fe80::1%2525]/'),
+    true,
+    'zone "25" equals itself'
+  )
+
+  // resolve must preserve the zone too
+  t.equal(
+    fastURI.resolve('http://example.com/', 'http://[fe80::1%2525eth0]/path'),
+    'http://[fe80::1%2525eth0]/path',
+    'resolve preserves a zone beginning with "25"'
+  )
+  t.equal(
+    fastURI.resolve('http://[fe80::1%2525eth0]/', 'child'),
+    'http://[fe80::1%2525eth0]/child',
+    'resolve preserves a zoned base'
+  )
+
+  t.end()
+})
+
+test('serialize only trusts the parse-derived IPv6 zone while the host is unchanged', (t) => {
+  // Reassigning `host` after parse must take effect for serialize.
+  const parsed = fastURI.parse('http://[::1]/admin')
+  parsed.host = 'example.com'
+  t.equal(
+    fastURI.serialize(parsed),
+    'http://example.com/admin',
+    'a host reassigned after parse wins over the stale zone'
+  )
+
+  // A caller-supplied `ipv6Zone` that does not match `host` must be ignored.
+  const forged = fastURI.serialize({
+    scheme: 'http',
+    host: 'fe80::1%25en1',
+    ipv6Zone: 'eth0',
+    path: '/'
+  })
+  t.equal(forged, 'http://[fe80::1%25en1]/', 'a mismatched ipv6Zone is ignored')
+  t.equal(fastURI.parse(forged).host, 'fe80::1%en1', 'mismatched ipv6Zone cannot redirect the parsed host')
+
+  // A caller-supplied `ipv6Zone` on a non-zoned host must be ignored too.
+  const noZone = fastURI.serialize({
+    scheme: 'http',
+    host: 'good.example',
+    ipv6Zone: 'eth0',
+    path: '/'
+  })
+  t.equal(noZone, 'http://good.example/', 'ipv6Zone on a non-zoned host is ignored')
+
+  // Reassigning a zoned host to a different zone must recompute, not reuse.
+  const zoned = fastURI.parse('http://[fe80::1%2525eth0]/')
+  zoned.host = 'fe80::1%25en1'
+  t.equal(
+    fastURI.serialize(zoned),
+    'http://[fe80::1%25en1]/',
+    'rewriting the zone recomposes from the new host'
+  )
+
+  // A consistent caller-supplied zone is honored (explicit disambiguation).
+  const disambiguated = fastURI.serialize({
+    scheme: 'http',
+    host: 'fe80::1%25eth0',
+    ipv6Zone: '25eth0',
+    path: '/'
+  })
+  t.equal(
+    disambiguated,
+    'http://[fe80::1%2525eth0]/',
+    'a consistent ipv6Zone disambiguates the component host'
+  )
+
+  // Without ipv6Zone, an ambiguous single-"%" host falls back to the
+  // best-effort heuristic (documented behavior for hand-built components).
+  t.equal(
+    fastURI.serialize({ host: 'fe80::1%25eth0' }),
+    '//[fe80::1%25eth0]',
+    'an ambiguous host without ipv6Zone uses the best-effort heuristic'
+  )
+
+  // Mutating the host must not poison resolve either.
+  t.equal(
+    fastURI.resolve('http://example.com/', 'http://[fe80::1%2525eth0]/path'),
+    'http://[fe80::1%2525eth0]/path',
+    'resolve preserves the parse-derived zone'
+  )
+
+  t.end()
+})
+
 test('hosts with unbalanced or misplaced IP-literal brackets are rejected', (t) => {
   const malformed = [
     'http://[fe80',