@20syldev/api 4.3.0 → 4.4.0

package/src/routes/post.ts

@@ -2,6 +2,8 @@ import { Router, type Request, type Response } from 'express';
 import { chatStorage, ticTacToeStorage } from '../storage/index.js';
 import { MIN_TOKEN_LENGTH, MAX_TOKEN_LENGTH } from '../constants.js';
 import { error } from '../utils/response.js';
+import { since } from '../utils/helpers.js';
+import type { HashResult } from '../modules/v4/hash.js';
 
 const router = Router();
 
@@ -64,7 +66,7 @@ router.post('/:version/chat/private', (req: Request, res: Response) => {
 
 // Generate hash
 router.post('/:version/hash', (req: Request, res: Response) => {
-    const { text, method } = (req.body as Record<string, string>) || {};
+    const { text, method, encoding } = (req.body as Record<string, string>) || {};
 
     if (!text) {
         error(res, 400, 'Please provide a text (?text={text})', `${req.version}/hash`);
@@ -76,8 +78,14 @@ router.post('/:version/hash', (req: Request, res: Response) => {
     }
 
     try {
-        const result = req.module.hash(text, method);
-        res.jsonResponse(result);
+        if (since(req.version, 4)) {
+            const hashFn = req.module.hash as (t: string, m: string, e?: string) => HashResult;
+            const result = hashFn(text, method, encoding);
+            res.jsonResponse(result);
+        } else {
+            const result = (req.module.hash as (t: string, m: string) => Record<string, string>)(text, method);
+            res.jsonResponse(result);
+        }
     } catch (err) {
         error(res, 400, (err as Error).message, `${req.version}/hash`);
     }

package/src/utils/colors.ts

@@ -0,0 +1,91 @@
+/**
+ * Parses a hex color string into an RGB tuple.
+ *
+ * @param hex - Hex color string (#RRGGBB or RRGGBB)
+ * @returns RGB tuple [r, g, b] with values 0-255
+ * @throws Error if the hex string is invalid
+ */
+export function hexToRgb(hex: string): [number, number, number] {
+    const clean = hex.replace('#', '');
+    if (!/^[0-9a-fA-F]{6}$/.test(clean)) throw new Error('Invalid HEX color (use #RRGGBB)');
+    return [parseInt(clean.slice(0, 2), 16), parseInt(clean.slice(2, 4), 16), parseInt(clean.slice(4, 6), 16)];
+}
+
+/**
+ * Converts HSL values to an RGB tuple.
+ *
+ * @param h - Hue in degrees (0-360)
+ * @param s - Saturation (0-1)
+ * @param l - Lightness (0-1)
+ * @returns RGB tuple [r, g, b] with values 0-255
+ */
+export function hslToRgb(h: number, s: number, l: number): [number, number, number] {
+    const c = (1 - Math.abs(2 * l - 1)) * s;
+    const x = c * (1 - Math.abs(((h / 60) % 2) - 1));
+    const m = l - c / 2;
+    let r1 = 0,
+        g1 = 0,
+        b1 = 0;
+    if (h < 60) [r1, g1, b1] = [c, x, 0];
+    else if (h < 120) [r1, g1, b1] = [x, c, 0];
+    else if (h < 180) [r1, g1, b1] = [0, c, x];
+    else if (h < 240) [r1, g1, b1] = [0, x, c];
+    else if (h < 300) [r1, g1, b1] = [x, 0, c];
+    else [r1, g1, b1] = [c, 0, x];
+    return [Math.round((r1 + m) * 255), Math.round((g1 + m) * 255), Math.round((b1 + m) * 255)];
+}
+
+/**
+ * Validates and normalizes a hex color string, adding # if missing.
+ *
+ * @param value - Raw color value (with or without #)
+ * @param def - Default color if value is empty
+ * @returns Normalized hex color string with #
+ * @throws Error if the color format is invalid
+ */
+export function normalizeColor(value: string | undefined, def: string): string {
+    if (!value) return def;
+    const clean = value.startsWith('#') ? value : `#${value}`;
+    if (!/^#([0-9a-fA-F]{3}){1,2}$/.test(clean)) throw new Error('Invalid color (use hex like ff6600)');
+    return clean;
+}
+
+/**
+ * Formats an RGB tuple as a hex color string.
+ *
+ * @param r - Red channel (0-255)
+ * @param g - Green channel (0-255)
+ * @param b - Blue channel (0-255)
+ * @returns Hex color string (#rrggbb)
+ */
+export function rgbToHex(r: number, g: number, b: number): string {
+    return `#${[r, g, b].map((x) => x.toString(16).padStart(2, '0')).join('')}`;
+}
+
+/**
+ * Converts RGB values to an HSL tuple.
+ *
+ * @param r - Red channel (0-255)
+ * @param g - Green channel (0-255)
+ * @param b - Blue channel (0-255)
+ * @returns HSL tuple [h (0-360), s (0-1), l (0-1)]
+ */
+export function rgbToHsl(r: number, g: number, b: number): [number, number, number] {
+    const r1 = r / 255,
+        g1 = g / 255,
+        b1 = b / 255;
+    const max = Math.max(r1, g1, b1),
+        min = Math.min(r1, g1, b1);
+    const l = (max + min) / 2;
+
+    if (max === min) return [0, 0, l];
+
+    const d = max - min;
+    const s = l > 0.5 ? d / (2 - max - min) : d / (max + min);
+    let h = 0;
+    if (max === r1) h = (g1 - b1) / d + (g1 < b1 ? 6 : 0);
+    else if (max === g1) h = (b1 - r1) / d + 2;
+    else h = (r1 - g1) / d + 4;
+
+    return [(h * 60 + 360) % 360, s, l];
+}

package/src/utils/helpers.ts

@@ -0,0 +1,90 @@
+/**
+ * Tracks requests per user and throws if the rate limit is exceeded.
+ *
+ * @param rateLimits - Store of timestamps per user
+ * @param userId - Identifier of the requesting user
+ * @param timestamp - Current timestamp in milliseconds
+ * @param window - Time window in milliseconds
+ * @param limit - Maximum requests allowed in the window
+ * @returns false if within limits
+ * @throws Error if rate limit is exceeded
+ */
+export function checkRateLimit(
+    rateLimits: Record<string, number[]>,
+    userId: string,
+    timestamp: number,
+    window = 10000,
+    limit = 50,
+): boolean {
+    rateLimits[userId] = (rateLimits[userId] ?? []).filter((ts) => timestamp - ts < window);
+
+    if (rateLimits[userId]!.length > limit) {
+        const remainingTime = Math.ceil((rateLimits[userId]![0]! + window - timestamp) / 1000);
+        throw new Error(`Rate limit exceeded. Try again in ${remainingTime} seconds.`);
+    }
+
+    rateLimits[userId]!.push(timestamp);
+    return false;
+}
+
+/**
+ * Parses a space-separated environment variable into an array.
+ *
+ * @param key - The environment variable name
+ * @returns The parsed array, or null if not set
+ */
+export function envList(key: string): string[] | null {
+    const v = process.env[key];
+    return v && v !== 'undefined' ? v.split(' ') : null;
+}
+
+/**
+ * Formats a Date to ISO string without timezone suffix.
+ *
+ * @param date - The date to format
+ * @returns ISO-formatted string without trailing Z
+ */
+export function formatDate(date: Date): string {
+    return new Date(date.getTime() - date.getTimezoneOffset() * 60000).toISOString().replace('Z', '');
+}
+
+/**
+ * Generates a random IPv4 address.
+ *
+ * @returns A string in the format "X.X.X.X"
+ */
+export function genIP(): string {
+    return `${randomNumber(0, 255)}.${randomNumber(0, 255)}.${randomNumber(0, 255)}.${randomNumber(0, 255)}`;
+}
+
+/**
+ * Returns a random element from an array.
+ *
+ * @param arr - The source array
+ * @returns A random element
+ */
+export function random<T>(arr: T[]): T {
+    return arr[Math.floor(Math.random() * arr.length)]!;
+}
+
+/**
+ * Returns a random integer between min and max (inclusive).
+ *
+ * @param min - Lower bound
+ * @param max - Upper bound
+ * @returns A random integer in [min, max]
+ */
+export function randomNumber(min: number, max: number): number {
+    return Math.floor(Math.random() * (max - min + 1)) + min;
+}
+
+/**
+ * Checks if a version string is at least the given minimum.
+ *
+ * @param version - Version string (e.g. "v4")
+ * @param min - Minimum version number
+ * @returns true if the version is >= min
+ */
+export function since(version: string, min: number): boolean {
+    return parseInt(version.replace('v', '')) >= min;
+}

package/src/utils/response.ts

@@ -1,6 +1,14 @@
 import type { Response } from 'express';
 import { DOCS_URL, STATUS_MESSAGES } from '../constants.js';
 
+/**
+ * Sends a standardized JSON error response.
+ *
+ * @param res - Express response object
+ * @param status - HTTP status code
+ * @param message - Error description
+ * @param docPath - Optional documentation path appended to the base URL
+ */
 export function error(res: Response, status: number, message: string, docPath?: string): void {
     res.status(status).jsonResponse({
         message: STATUS_MESSAGES[status] ?? 'Error',

package/tests/integration/api.test.ts

@@ -90,15 +90,23 @@ describe('GET /v4/algorithms', () => {
 });
 
 describe('GET /v4/captcha', () => {
-    test('returns PNG', async () => {
+    test('returns PNG with provided text', async () => {
         const res = await fetch(`${baseUrl}/v4/captcha?text=hello`);
         assert.equal(res.status, 200);
         assert.match(res.headers.get('content-type') ?? '', /image\/png/);
+        assert.equal(res.headers.get('x-captcha-text'), 'hello');
     });
 
-    test('without text returns 400', async () => {
-        const { status } = await getJson('/v4/captcha');
-        assert.equal(status, 400);
+    test('auto-generates text when none provided', async () => {
+        const res = await fetch(`${baseUrl}/v4/captcha`);
+        assert.equal(res.status, 200);
+        assert.match(res.headers.get('content-type') ?? '', /image\/png/);
+        assert.ok(res.headers.get('x-captcha-text')!.length > 0);
+    });
+
+    test('accepts noise and dimensions', async () => {
+        const res = await fetch(`${baseUrl}/v4/captcha?text=AB&noise=high&width=200&height=80`);
+        assert.equal(res.status, 200);
     });
 });
 
@@ -117,7 +125,7 @@ describe('GET /v4/chat', () => {
 });
 
 describe('GET /v4/color', () => {
-    test('returns color formats', async () => {
+    test('returns random color formats', async () => {
         const { status, body } = await getJson('/v4/color');
         assert.equal(status, 200);
         assert.match(body.hex as string, /^#[0-9a-f]{6}$/);
@@ -125,6 +133,12 @@ describe('GET /v4/color', () => {
         assert.ok('hsl' in body);
         assert.ok('cmyk' in body);
     });
+
+    test('accepts hex input', async () => {
+        const { status, body } = await getJson('/v4/color?hex=ff6600');
+        assert.equal(status, 200);
+        assert.equal(body.hex, '#ff6600');
+    });
 });
 
 describe('GET /v4/convert', () => {
@@ -134,6 +148,12 @@ describe('GET /v4/convert', () => {
         assert.equal(body.result, 212);
     });
 
+    test('km to mi', async () => {
+        const { status, body } = await getJson('/v4/convert?value=1&from=km&to=mi');
+        assert.equal(status, 200);
+        assert.ok(Math.abs((body.result as number) - 0.621371) < 0.001);
+    });
+
     test('missing value returns 400', async () => {
         const { status } = await getJson('/v4/convert?from=celsius&to=fahrenheit');
         assert.equal(status, 400);
@@ -249,8 +269,16 @@ describe('GET /v4/placeholder', () => {
 });
 
 describe('GET /v4/qrcode', () => {
-    test('returns data URL', async () => {
-        const { status, body } = await getJson('/v4/qrcode?url=https%3A%2F%2Fexample.com');
+    test('returns PNG image by default', async () => {
+        const res = await fetch(`${baseUrl}/v4/qrcode?url=https%3A%2F%2Fexample.com`);
+        assert.equal(res.status, 200);
+        assert.match(res.headers.get('content-type') ?? '', /image\/png/);
+        const buf = Buffer.from(await res.arrayBuffer());
+        assert.ok(buf.subarray(0, 4).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47])));
+    });
+
+    test('returns data URL with format=base64', async () => {
+        const { status, body } = await getJson('/v4/qrcode?url=https%3A%2F%2Fexample.com&format=base64');
         assert.equal(status, 200);
         assert.match(body as unknown as string, /^data:image\/png;base64,/);
     });
@@ -425,6 +453,7 @@ describe('POST /v4/hash', () => {
         const { status, body } = await sendJson('POST', '/v4/hash', { text: 'hello', method: 'sha256' });
         assert.equal(status, 200);
         assert.equal(body.hash, '2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824');
+        assert.equal(body.encoding, 'hex');
     });
 
     test('md5', async () => {
@@ -432,6 +461,21 @@ describe('POST /v4/hash', () => {
         assert.equal(body.hash, '5d41402abc4b2a76b9719d911017c592');
     });
 
+    test('base64 encoding', async () => {
+        const { status, body } = await sendJson('POST', '/v4/hash', {
+            text: 'hello',
+            method: 'sha256',
+            encoding: 'base64',
+        });
+        assert.equal(status, 200);
+        assert.equal(body.encoding, 'base64');
+    });
+
+    test('unsupported method returns 400', async () => {
+        const { status } = await sendJson('POST', '/v4/hash', { text: 'hello', method: 'fakehash' });
+        assert.equal(status, 400);
+    });
+
     test('missing text returns 400', async () => {
         const { status } = await sendJson('POST', '/v4/hash', { method: 'sha256' });
         assert.equal(status, 400);

package/tests/unit/captcha.test.ts

@@ -2,22 +2,60 @@ import { test, describe } from 'node:test';
 import { strict as assert } from 'node:assert';
 import captcha from '../../src/modules/v4/captcha.js';
 
+const PNG_MAGIC = Buffer.from([0x89, 0x50, 0x4e, 0x47]);
+
 describe('captcha', () => {
-    test('returns a Buffer for valid text', () => {
-        const result = captcha('hello');
-        assert.ok(Buffer.isBuffer(result));
-        assert.ok(result.length > 0);
+    test('returns PNG buffer with provided text', () => {
+        const result = captcha({ text: 'hello' });
+        assert.equal(result.contentType, 'image/png');
+        assert.ok(Buffer.isBuffer(result.body));
+        assert.ok(result.body.subarray(0, 4).equals(PNG_MAGIC));
+        assert.equal(result.text, 'hello');
+    });
+
+    test('auto-generates text when none provided', () => {
+        const result = captcha({});
+        assert.equal(result.text.length, 6);
+        assert.ok(Buffer.isBuffer(result.body));
+    });
+
+    test('respects custom length', () => {
+        const result = captcha({ length: 10 });
+        assert.equal(result.text.length, 10);
+    });
+
+    test('throws on invalid length', () => {
+        assert.throws(() => captcha({ length: 0 }), /length/);
+        assert.throws(() => captcha({ length: 99 }), /length/);
+    });
+
+    test('accepts custom dimensions', () => {
+        const result = captcha({ text: 'AB', width: 200, height: 80 });
+        assert.ok(Buffer.isBuffer(result.body));
+    });
+
+    test('throws on invalid dimensions', () => {
+        assert.throws(() => captcha({ text: 'AB', width: 10 }), /width/);
+        assert.throws(() => captcha({ text: 'AB', height: 500 }), /height/);
+    });
+
+    test('accepts noise levels', () => {
+        for (const noise of ['low', 'medium', 'high'] as const) {
+            const result = captcha({ text: 'test', noise });
+            assert.ok(Buffer.isBuffer(result.body));
+        }
+    });
+
+    test('throws on invalid noise', () => {
+        assert.throws(() => captcha({ text: 'test', noise: 'extreme' as 'low' }), /noise/);
     });
 
-    test('PNG starts with correct magic bytes', () => {
-        const result = captcha('test');
-        assert.equal(result[0], 0x89);
-        assert.equal(result[1], 0x50); // P
-        assert.equal(result[2], 0x4e); // N
-        assert.equal(result[3], 0x47); // G
+    test('accepts custom colors', () => {
+        const result = captcha({ text: 'test', bg: 'f0f0f0', color: '333333' });
+        assert.ok(Buffer.isBuffer(result.body));
     });
 
-    test('throws on missing text', () => {
-        assert.throws(() => captcha(''));
+    test('throws on invalid color', () => {
+        assert.throws(() => captcha({ text: 'test', bg: 'xyz' }), /color/i);
     });
 });

package/tests/unit/chat.test.ts

@@ -37,7 +37,10 @@ describe('chat', () => {
     });
 
     test('throws on missing username', () => {
-        assert.throws(() => chat('message', { username: '', message: 'hi', session: 's', storage: makeStorage() }), /username/);
+        assert.throws(
+            () => chat('message', { username: '', message: 'hi', session: 's', storage: makeStorage() }),
+            /username/,
+        );
     });
 
     test('throws on invalid action', () => {

package/tests/unit/color.test.ts

@@ -15,19 +15,39 @@ describe('color', () => {
 
     test('hex matches #RRGGBB', () => {
         for (let i = 0; i < 20; i++) {
-            assert.match(color().hex!, /^#[0-9a-f]{6}$/);
+            assert.match(color().hex, /^#[0-9a-f]{6}$/);
         }
     });
 
     test('rgb format', () => {
-        assert.match(color().rgb!, /^rgb\(\d{1,3}, \d{1,3}, \d{1,3}\)$/);
+        assert.match(color().rgb, /^rgb\(\d{1,3}, \d{1,3}, \d{1,3}\)$/);
     });
 
     test('hsl format', () => {
-        assert.match(color().hsl!, /^hsl\(\d+(\.\d+)?, \d+(\.\d+)?%, \d+(\.\d+)?%\)$/);
+        assert.match(color().hsl, /^hsl\(\d+(\.\d+)?, \d+(\.\d+)?%, \d+(\.\d+)?%\)$/);
     });
 
     test('cmyk format with 4 channels', () => {
-        assert.match(color().cmyk!, /^cmyk\(/);
+        assert.match(color().cmyk, /^cmyk\(/);
+    });
+
+    test('accepts hex input', () => {
+        const result = color('#ff6600');
+        assert.equal(result.hex, '#ff6600');
+        assert.equal(result.rgb, 'rgb(255, 102, 0)');
+    });
+
+    test('accepts hex without #', () => {
+        const result = color('ff6600');
+        assert.equal(result.hex, '#ff6600');
+    });
+
+    test('throws on invalid hex', () => {
+        assert.throws(() => color('xyz'), /Invalid HEX/);
+    });
+
+    test('HSV correct for equal channels', () => {
+        const result = color('#808000');
+        assert.match(result.hsv, /^hsv\(60\.0,/);
     });
 });

package/tests/unit/convert.test.ts

@@ -36,7 +36,32 @@ describe('convert', () => {
         assert.throws(() => convert(-300, 'celsius', 'kelvin'), /absolute zero/);
     });
 
+    test('km to mi', () => {
+        const result = convert(1, 'km', 'mi');
+        assert.ok(Math.abs(result.result - 0.621371) < 0.001);
+    });
+
+    test('kg to lb', () => {
+        const result = convert(1, 'kg', 'lb');
+        assert.ok(Math.abs(result.result - 2.20462) < 0.001);
+    });
+
+    test('kb to mb', () => {
+        const result = convert(1024, 'kb', 'mb');
+        assert.equal(result.result, 1);
+    });
+
+    test('km/h to mph', () => {
+        const result = convert(100, 'km/h', 'mph');
+        assert.ok(Math.abs(result.result - 62.1371) < 0.01);
+    });
+
+    test('negative values allowed for non-temperature', () => {
+        const result = convert(-5, 'km', 'mi');
+        assert.ok(result.result < 0);
+    });
+
     test('throws on non-numeric value', () => {
-        assert.throws(() => convert('abc', 'celsius', 'kelvin'), /must be a number/);
+        assert.throws(() => convert(NaN, 'celsius', 'kelvin'), /must be a number/);
     });
 });

package/tests/unit/hash.test.ts

@@ -8,25 +8,32 @@ describe('hash', () => {
         assert.deepEqual(result, {
             method: 'sha256',
             hash: '2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824',
+            encoding: 'hex',
         });
     });
 
     test('md5 of "hello"', () => {
         const result = hash('hello', 'md5');
-        assert.deepEqual(result, {
-            method: 'md5',
-            hash: '5d41402abc4b2a76b9719d911017c592',
-        });
+        assert.equal(result.hash, '5d41402abc4b2a76b9719d911017c592');
+        assert.equal(result.encoding, 'hex');
+    });
+
+    test('base64 encoding', () => {
+        const result = hash('hello', 'sha256', 'base64');
+        assert.equal(result.encoding, 'base64');
+        assert.ok(result.hash.length > 0);
+    });
+
+    test('throws on empty text', () => {
+        assert.throws(() => hash('', 'sha256'), /Text is required/);
     });
 
-    test('sha1 of empty string', () => {
-        const result = hash('', 'sha1');
-        assert.equal((result as { hash: string }).hash, 'da39a3ee5e6b4b0d3255bfef95601890afd80709');
+    test('throws on unsupported method', () => {
+        assert.throws(() => hash('hello', 'fakehash'), /Unsupported method/);
     });
 
-    test('returns error object on unsupported method', () => {
-        const result = hash('hello', 'fakehash');
-        assert.ok('error' in result);
+    test('throws on invalid encoding', () => {
+        assert.throws(() => hash('hello', 'sha256', 'utf8'), /Encoding must be/);
     });
 
     test('same input + method = same hash (deterministic)', () => {

package/tests/unit/qrcode.test.ts

@@ -2,13 +2,81 @@ import { test, describe } from 'node:test';
 import { strict as assert } from 'node:assert';
 import qrcode from '../../src/modules/v4/qrcode.js';
 
+const PNG_MAGIC = Buffer.from([0x89, 0x50, 0x4e, 0x47]);
+
 describe('qrcode', () => {
-    test('returns data URL for valid url', async () => {
-        const result = await qrcode('https://example.com');
-        assert.match(result, /^data:image\/png;base64,/);
+    test('returns PNG buffer by default', async () => {
+        const result = await qrcode({ url: 'https://example.com' });
+        assert.equal(result.contentType, 'image/png');
+        assert.ok(Buffer.isBuffer(result.body));
+        assert.ok((result.body as Buffer).subarray(0, 4).equals(PNG_MAGIC));
+    });
+
+    test('returns data URL with format=base64', async () => {
+        const result = await qrcode({ url: 'https://example.com', format: 'base64' });
+        assert.equal(result.contentType, 'application/json');
+        assert.match(result.body as string, /^data:image\/png;base64,/);
+    });
+
+    test('throws on invalid format', async () => {
+        await assert.rejects(() => qrcode({ url: 'https://example.com', format: 'jpg' as 'png' }), /format/);
     });
 
     test('throws on missing url', async () => {
-        await assert.rejects(() => qrcode(''));
+        await assert.rejects(() => qrcode({ url: '' }));
+    });
+
+    test('accepts custom size', async () => {
+        const result = await qrcode({ url: 'https://example.com', size: 400 });
+        assert.equal(result.contentType, 'image/png');
+    });
+
+    test('throws on invalid size', async () => {
+        await assert.rejects(() => qrcode({ url: 'https://example.com', size: 9999 }), /size/);
+    });
+
+    test('accepts custom colors', async () => {
+        const result = await qrcode({ url: 'https://example.com', dark: 'ff0000', light: 'ffffff' });
+        assert.equal(result.contentType, 'image/png');
+    });
+
+    test('throws on invalid dark color', async () => {
+        await assert.rejects(() => qrcode({ url: 'https://example.com', dark: 'xyz' }), /color/i);
+    });
+
+    test('throws on invalid light color', async () => {
+        await assert.rejects(() => qrcode({ url: 'https://example.com', light: 'nope' }), /color/i);
+    });
+
+    test('accepts correction level', async () => {
+        const result = await qrcode({ url: 'https://example.com', correction: 'H' });
+        assert.equal(result.contentType, 'image/png');
+    });
+
+    test('throws on invalid correction level', async () => {
+        await assert.rejects(() => qrcode({ url: 'https://example.com', correction: 'X' as 'L' }), /correction/);
+    });
+
+    test('accepts custom margin', async () => {
+        const result = await qrcode({ url: 'https://example.com', margin: 0 });
+        assert.equal(result.contentType, 'image/png');
+    });
+
+    test('throws on invalid margin', async () => {
+        await assert.rejects(() => qrcode({ url: 'https://example.com', margin: 99 }), /margin/);
+    });
+
+    test('throws on non-HTTPS icon URL', async () => {
+        await assert.rejects(
+            () => qrcode({ url: 'https://example.com', icon: 'http://example.com/icon.png' }),
+            /HTTPS/,
+        );
+    });
+
+    test('throws on unreachable icon URL', async () => {
+        await assert.rejects(
+            () => qrcode({ url: 'https://example.com', icon: 'https://localhost:1/nope.png' }),
+            /Failed to fetch icon|fetch/i,
+        );
     });
 });

package/tests/unit/tic_tac_toe.test.ts

@@ -36,7 +36,10 @@ describe('tic_tac_toe', () => {
     });
 
     test('throws on missing username', () => {
-        assert.throws(() => tic_tac_toe('play', { move: '1-1', session: 's', game: 'G', storage: makeStorage() }), /username/);
+        assert.throws(
+            () => tic_tac_toe('play', { move: '1-1', session: 's', game: 'G', storage: makeStorage() }),
+            /username/,
+        );
     });
 
     test('throws on missing move', () => {