Recover round-trip for associative keys with non-varname characters

`isExplodedPairBoundary` was using RFC 6570 varname rules (`isVarcharAt`
plus the point-continuation logic in `readPairKeyEnd`) to detect the
start of the next exploded associative entry.  Associative keys are
emitted through `encodeValue` on the expansion side, so the legal key
character set is the full unreserved/reserved alphabet, not just
varname characters.  Round-trip matches against keys like `b-c`, `~x`,
or any key containing `-`, `!`, `~`, etc. silently failed: the
boundary detector skipped past the next separator and the entire tail
of the body was treated as one value, leaving the round-trip check to
reject the only decomposition the matcher had reached.

Switch the boundary check to a value-driven scan: at each separator,
walk forward until the next `=` (boundary) or the next separator
(no boundary).  The detector still fires only at separator positions,
so an `=` inside an `allowReserved` value cannot be mistaken for a
key/value split.  The now-unused `readPairKeyEnd` helper and the
`isVarcharAt` import are removed.

Adds a regression test covering `{keys*}` against `a=1,b-c=2`, plus a
companion test that pins the parser's rejection of the seven actual
1-byte control characters (NUL/SOH/TAB/LF/CR/US/DEL) via
`String.fromCodePoint`.  The CTL test documents the boundary that the
`wrong.json` fixture *names* but does not exercise (since JSON parses
the double-escaped `` sequences in those fixtures to 6-character
backslash strings, not control bytes).

Reported in PR #758
(CodeRabbit, 2026-05-11).

Assisted-by: Claude Opus 4.7 (1M context)

Author: 2chanhaeng

packages/uri-template/src/template/match.ts

@@ -8,7 +8,7 @@ import type {
   Token,
   VarSpec,
 } from "../types.ts";
-import { encodeName, isVarcharAt, truncateValue } from "./encoding.ts";
+import { encodeName, truncateValue } from "./encoding.ts";
 import expand from "./expand.ts";
 
 /**
@@ -351,27 +351,12 @@ const isExplodedPairBoundary = (
   if (!body.startsWith(separator, index)) return false;
 
   const keyStart = index + separator.length;
-  const keyEnd = readPairKeyEnd(body, keyStart);
-  return keyEnd > keyStart && body[keyEnd] === "=";
-};
-
-function readPairKeyEnd(body: string, start: number): number {
-  let index = start;
-  let expectVarchar = true;
-  while (index < body.length) {
-    const varcharLength = isVarcharAt(body, index);
-    if (varcharLength > 0) {
-      index += varcharLength;
-      expectVarchar = false;
-      continue;
-    }
-    if (body[index] !== ".") break;
-    if (expectVarchar || isVarcharAt(body, index + 1) < 1) break;
-    index++;
-    expectVarchar = true;
+  for (let i = keyStart; i < body.length; i++) {
+    if (body[i] === "=") return i > keyStart;
+    if (body.startsWith(separator, i)) return false;
   }
-  return index;
-}
+  return false;
+};
 
 /**
  * Yields candidate readings of a single value string under non-exploded

packages/uri-template/src/template/template.test.ts

@@ -129,3 +129,35 @@ test("Template#match — unnamed minLength must allow current var to consume one
     "matcher should reach the binding with x consuming one part",
   );
 });
+
+// Regression for PR #758 review item 36: `expand` encodes associative keys
+// with the full unreserved/reserved set, but `isExplodedPairBoundary` in
+// match.ts uses RFC 6570 varname rules to detect the next key. Keys that are
+// valid in URIs but outside the varname class (e.g. containing `-` or `~`)
+// expand cleanly yet fail to round-trip.
+test("Template#match — associative keys with non-varname characters round-trip", () => {
+  const template = new Template("{keys*}");
+  const uri = template.expand({ keys: { a: "1", "b-c": "2" } });
+  equal(uri, "a=1,b-c=2");
+  const m = template.match(uri);
+  ok(m != null, "matcher returned null for a round-trippable exploded URI");
+  deepEqual(m, { keys: { a: "1", "b-c": "2" } });
+});
+
+// Regression for PR #758 review item 37: the *wrong.json* fixtures for
+// "Invalid characters in literals" store double-escaped sequences such as
+// "\\u0000", which JSON-decode to 6-character backslash strings rather than
+// the 1-byte control characters they claim to test. The parser does reject
+// actual CTL bytes — this test pins that behavior directly, so future
+// refactors cannot silently regress on the CTL branch.
+test("Template — actual control-character literals throw InvalidLiteralError", () => {
+  for (const codePoint of [0x00, 0x01, 0x09, 0x0a, 0x0d, 0x1f, 0x7f]) {
+    throws(
+      () => new Template(String.fromCodePoint(codePoint)),
+      InvalidLiteralError,
+      `code point 0x${
+        codePoint.toString(16).padStart(2, "0")
+      } should be rejected`,
+    );
+  }
+});