@ignix-social/editor 0.1.0

package/vendor/hyperframes/dist/skills/media-use/scripts/lib/local-run.test.mjs

@@ -0,0 +1,121 @@
+import { strict as assert } from "node:assert";
+import { test } from "node:test";
+import { runLocalModel } from "./local-run.mjs";
+
+const strongCpu = { ramMB: 16000, gpu: { present: false, vramMB: 0 }, appleSilicon: false };
+const tiny = { ramMB: 512, gpu: { present: false, vramMB: 0 }, appleSilicon: false };
+const ok = () => {}; // which/exec that succeed
+
+test("recommends the CLI path when no local tier fits the machine", () => {
+  const r = runLocalModel("tts", { specs: tiny, which: ok, exec: ok });
+  assert.equal(r.recommend, "cli");
+});
+
+test("recommends install when the tool is not on PATH", () => {
+  const r = runLocalModel("tts", {
+    specs: strongCpu,
+    which: () => {
+      throw new Error("not found");
+    },
+    exec: ok,
+    vars: { text: "hi", out: "/tmp/v.wav" },
+  });
+  assert.equal(r.recommend, "install");
+  assert.equal(r.model, "kokoro");
+  assert.match(r.command, /pip install kokoro/);
+});
+
+test("runs the model and returns the output path when installed", () => {
+  let ran = "";
+  const r = runLocalModel("tts", {
+    specs: strongCpu,
+    which: ok,
+    exec: (cmd) => {
+      ran = cmd;
+    },
+    vars: { text: "hello world", voice: "af_heart", out: "/tmp/v.wav" },
+  });
+  assert.equal(r.model, "kokoro");
+  assert.equal(r.out, "/tmp/v.wav");
+  assert.match(ran, /hello world/, "invoke template filled with vars");
+  assert.match(ran, /\/tmp\/v\.wav/);
+});
+
+test("a failing run degrades to an install recommendation, never throws", () => {
+  const r = runLocalModel("upscale", {
+    specs: strongCpu,
+    which: ok,
+    exec: () => {
+      throw new Error("boom");
+    },
+    vars: { in: "a.png", out: "b.png" },
+  });
+  assert.equal(r.recommend, "install");
+});
+
+test("a tier whose tool is missing demotes to the next tier that fits", () => {
+  // 64GB + GPU fits BOTH tts tiers, so the ladder has two rungs: fish-speech
+  // (its own binary) above Kokoro (`python -m kokoro`). fish-speech absent must
+  // not cost the user Kokoro.
+  const strongGpu = { ramMB: 64000, gpu: { present: true, vramMB: 24000 } };
+  let ran = "";
+  const r = runLocalModel("tts", {
+    specs: strongGpu,
+    which: (bin) => {
+      if (bin === "fish-speech") throw new Error("not found");
+    },
+    exec: (cmd) => {
+      ran = cmd;
+    },
+    vars: { text: "hello", voice: "af_heart", out: "/tmp/v.wav" },
+  });
+
+  assert.equal(r.model, "kokoro", "demoted past the missing fish-speech binary");
+  assert.equal(r.tier, "medium");
+  assert.match(ran, /kokoro/);
+});
+
+test("every fitting tier failing reports the last tier's install command", () => {
+  const strongGpu = { ramMB: 64000, gpu: { present: true, vramMB: 24000 } };
+  const r = runLocalModel("tts", {
+    specs: strongGpu,
+    which: ok,
+    exec: () => {
+      throw new Error("boom");
+    },
+    vars: { text: "hi", out: "/tmp/v.wav" },
+  });
+
+  assert.equal(r.recommend, "install");
+  assert.equal(r.model, "kokoro", "the smallest fitting tier is the actionable one");
+});
+
+test("the install recommendation states the download size", () => {
+  // nothing today tells the user what they are agreeing to before a tool
+  // starts pulling weights, so the size travels in the payload AND in the
+  // text a caller shows them
+  const r = runLocalModel("tts", {
+    specs: strongCpu,
+    which: () => {
+      throw new Error("not found");
+    },
+  });
+
+  assert.equal(r.recommend, "install");
+  assert.equal(typeof r.sizeMB, "number");
+  assert.ok(r.sizeMB > 0);
+  assert.match(r.reason, /GB to download/);
+});
+
+test("a failed run still reports the tier's size", () => {
+  const r = runLocalModel("tts", {
+    specs: strongCpu,
+    which: ok,
+    exec: () => {
+      throw new Error("boom");
+    },
+  });
+
+  assert.equal(r.recommend, "install");
+  assert.equal(typeof r.sizeMB, "number");
+});

package/vendor/hyperframes/dist/skills/media-use/scripts/lib/logo-provider.mjs

@@ -0,0 +1,244 @@
+import { fetchMedia, readCappedBody } from "./media-fetch.mjs";
+// Official brand marks — the `logo` type's provider tiers, tried in registry
+// order.
+//
+//   1. thesvg: one pinned manifest matched locally ("Next.js", "nextjs", "next js" hit one
+//      entry); default full-color mark; skips licenses outside THESVG_ACCEPTED_LICENSES.
+//   2. github avatar: known orgs only; guessing a login risks a same-named personal account.
+//   3. domain favicon: DuckDuckGo ip3 last resort; under ~500B is its globe placeholder.
+//
+// HeyGen asset search is deliberately absent: for brand queries it returns
+// generic look-alike icons (0/3 in testing) — worse than a miss. A total miss
+// falls through to resolve's normal failure path (`no provider could resolve
+// logo`, exit 1).
+
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// Bump by pointing at a newer glincker/thesvg commit; the manifest and every
+// icon URL resolve against the same pin, so a resolve is reproducible.
+const THESVG_REV = "e5957fa742c1ebf6da07ac40665bdd01d8add35f";
+const THESVG_CDN = `https://cdn.jsdelivr.net/gh/glincker/thesvg@${THESVG_REV}`;
+const THESVG_MANIFEST = `${THESVG_CDN}/src/data/icons.json`;
+const FAVICON_MIN_BYTES = 500;
+// ponytail: the manifest is ~3.3MB today; 20MB leaves headroom without trusting an
+// unbounded body from a CDN edge.
+const MAX_MANIFEST_BYTES = 20 * 1024 * 1024;
+
+// When several entries share a normalized name (e.g. "slack" and the
+// "slack-badge" auth button), the brand mark wins over cloud/infra and badge
+// collections.
+const THESVG_COLLECTION_RANK = ["brands", "community", "aws", "azure", "gcp", "k8s", "auth-badges"];
+
+// The ten SPDX ids theSVG's submission form accepts and verifies before merge
+// (thesvg.org LICENSING.md §5); anything else routes through their unaudited
+// "Other/custom" path.
+const THESVG_ACCEPTED_LICENSES = new Set([
+  "CC0-1.0",
+  "Unlicense",
+  "MIT",
+  "Apache-2.0",
+  "BSD-3-Clause",
+  "ISC",
+  "CC-BY-4.0",
+  "CC-BY-SA-4.0",
+  "CC-BY-ND-4.0",
+  "MPL-2.0",
+]);
+
+// Known GitHub orgs. Only mapped entities resolve at this tier — a brand name
+// is NOT a GitHub login, and guessing hits same-named personal accounts.
+const GITHUB_ORGS = {
+  slack: "slackhq",
+  meta: "facebook",
+  google: "google",
+  microsoft: "microsoft",
+  aws: "aws",
+  vercel: "vercel",
+  nextjs: "vercel",
+  alibaba: "alibaba",
+  heygen: "heygen-com",
+};
+
+// Favicon domains that aren't `<entity>.com`.
+const FAVICON_DOMAINS = {
+  cocacola: "coca-cola.com",
+  aws: "aws.amazon.com",
+  nextjs: "nextjs.org",
+};
+
+const norm = (s) =>
+  String(s)
+    .toLowerCase()
+    .replace(/[^a-z0-9]/g, "");
+
+/** The brand entity for a query: --entity wins; else the intent minus filler. */
+export function entityFrom(intent, entity) {
+  if (entity) return entity.toLowerCase().trim();
+  return String(intent)
+    .toLowerCase()
+    .replace(/\b(logo|logos|icon|brand|official|mark)\b/g, "")
+    .trim()
+    .replace(/\s+/g, " ");
+}
+
+/** Exact match after stripping case/spacing/punctuation — "Next.js" ≡ "nextjs". */
+export function titleMatches(title, entity) {
+  return norm(title) === norm(entity);
+}
+
+/** Best theSVG entry for an entity, or null: slug > title > alias, ties to the brands
+ * collection; entries outside THESVG_ACCEPTED_LICENSES are never returned. */
+export function thesvgMatch(icons, entity) {
+  const want = norm(entity);
+  if (!want || !Array.isArray(icons)) return null;
+  const collectionRank = (icon) => {
+    const i = THESVG_COLLECTION_RANK.indexOf(icon.collection);
+    return i === -1 ? THESVG_COLLECTION_RANK.length : i;
+  };
+  let best = null;
+  let bestScore = Infinity;
+  for (const icon of icons) {
+    if (!icon || typeof icon.slug !== "string" || !icon.variants?.default) continue;
+    if (!THESVG_ACCEPTED_LICENSES.has(icon.license)) continue;
+    let field;
+    if (norm(icon.slug) === want) field = 0;
+    else if (titleMatches(icon.title, want)) field = 1;
+    else if ((icon.aliases || []).some((a) => titleMatches(a, want))) field = 2;
+    else continue;
+    const score = field * 100 + collectionRank(icon);
+    if (score < bestScore) {
+      best = icon;
+      bestScore = score;
+    }
+  }
+  return best;
+}
+
+export function githubOrgFor(entity) {
+  return GITHUB_ORGS[norm(entity)] || null;
+}
+
+export function faviconDomainFor(entity) {
+  return FAVICON_DOMAINS[norm(entity)] || `${norm(entity)}.com`;
+}
+
+async function fetchJson(url) {
+  const res = await fetchMedia(url, { signal: AbortSignal.timeout(10_000) });
+  if (!res.ok) return null;
+  const body = await readCappedBody(res, MAX_MANIFEST_BYTES, "fetchJson");
+  return JSON.parse(body.toString("utf8"));
+}
+
+async function urlExists(url) {
+  const res = await fetchMedia(url, { method: "HEAD", signal: AbortSignal.timeout(10_000) });
+  return res.ok;
+}
+
+// One manifest per process: a multi-logo resolve pays the download once. A
+// failed load is not cached, so the next call retries.
+let thesvgManifest = null;
+
+async function loadThesvgManifest() {
+  if (!thesvgManifest) {
+    thesvgManifest = fetchJson(THESVG_MANIFEST).then((icons) => {
+      if (!Array.isArray(icons)) throw new Error("theSVG manifest: unexpected shape");
+      return icons;
+    });
+    thesvgManifest.catch(() => {
+      thesvgManifest = null;
+    });
+  }
+  return thesvgManifest;
+}
+
+/** Test hook: drop the memoized manifest. */
+export function resetThesvgManifest() {
+  thesvgManifest = null;
+}
+
+export async function thesvgSearch(intent, ctx = {}) {
+  const entity = entityFrom(intent, ctx.entity);
+  let icons;
+  try {
+    icons = await loadThesvgManifest();
+  } catch {
+    return null; // network down or bad payload — let the next tier try its own host
+  }
+  const hit = thesvgMatch(icons, entity);
+  if (!hit) return null;
+  // theSVG also ships mono, light/dark and wordmark variants; default is the full-color mark.
+  const route = hit.variants.default;
+  return {
+    url: `${THESVG_CDN}/public${route.startsWith("/") ? "" : "/"}${route}`,
+    ext: ".svg",
+    source: "search",
+    metadata: {
+      description: `${hit.title} logo (official mark)`,
+      provider: "thesvg",
+      provenance: {
+        entity,
+        slug: hit.slug,
+        variant: "default",
+        variants: Object.keys(hit.variants),
+        collection: hit.collection,
+        license: hit.license,
+        pinned: `glincker/thesvg@${THESVG_REV}`,
+      },
+    },
+  };
+}
+
+export async function githubAvatarSearch(intent, ctx = {}) {
+  const entity = entityFrom(intent, ctx.entity);
+  const org = githubOrgFor(entity);
+  if (!org) return null;
+  const url = `https://github.com/${org}.png?size=460`;
+  try {
+    if (!(await urlExists(url))) return null;
+  } catch {
+    return null;
+  }
+  return {
+    url,
+    ext: ".png",
+    source: "search",
+    metadata: {
+      description: `${entity} logo (GitHub org avatar)`,
+      provider: "github.avatar",
+      provenance: { entity, org },
+    },
+  };
+}
+
+export async function faviconSearch(intent, ctx = {}) {
+  const entity = entityFrom(intent, ctx.entity);
+  const domain = faviconDomainFor(entity);
+  const url = `https://icons.duckduckgo.com/ip3/${domain}.ico`;
+  let body;
+  try {
+    const res = await fetchMedia(url, { signal: AbortSignal.timeout(10_000) });
+    if (!res.ok) return null;
+    body = Buffer.from(await res.arrayBuffer());
+  } catch {
+    return null;
+  }
+  if (body.byteLength < FAVICON_MIN_BYTES) return null; // DDG placeholder, not a logo
+  // Hand the verified bytes over as a local file: the freeze step copies it
+  // instead of re-downloading, so the size check is authoritative over what
+  // gets frozen and the favicon tier costs one network round-trip, not two.
+  const bytes = body.byteLength;
+  const tmp = join(mkdtempSync(join(tmpdir(), "media-use-logo-")), `${domain}.ico`);
+  writeFileSync(tmp, body);
+  return {
+    localPath: tmp,
+    ext: ".ico",
+    source: "search",
+    metadata: {
+      description: `${entity} favicon (small raster — chip-size use only)`,
+      provider: "favicon.ddg",
+      provenance: { entity, domain, bytes, low_res: true },
+    },
+  };
+}

package/vendor/hyperframes/dist/skills/media-use/scripts/lib/logo-provider.test.mjs

@@ -0,0 +1,298 @@
+import test from "node:test";
+import assert from "node:assert";
+import { readFileSync } from "node:fs";
+import {
+  entityFrom,
+  titleMatches,
+  thesvgMatch,
+  githubOrgFor,
+  faviconDomainFor,
+  thesvgSearch,
+  resetThesvgManifest,
+  githubAvatarSearch,
+  faviconSearch,
+} from "./logo-provider.mjs";
+import { getProviders, runProviders } from "./registry.mjs";
+
+test("entityFrom strips filler words from the intent; --entity wins", () => {
+  assert.equal(entityFrom("LinkedIn logo"), "linkedin");
+  assert.equal(entityFrom("official Slack brand mark"), "slack");
+  assert.equal(entityFrom("anything", "Notion"), "notion");
+});
+
+test("titleMatches ignores case, spacing, punctuation — and rejects lookalikes", () => {
+  assert.ok(titleMatches("Next.js", "nextjs"));
+  assert.ok(titleMatches("Coca-Cola", "coca cola"));
+  assert.ok(!titleMatches("Slackware", "slack"));
+});
+
+// A slice of the real theSVG manifest shape (src/data/icons.json).
+const ICONS = [
+  {
+    slug: "nextdotjs",
+    title: "Next.js",
+    aliases: [],
+    collection: "brands",
+    license: "CC0-1.0",
+    variants: { default: "/icons/nextdotjs/default.svg", mono: "/icons/nextdotjs/mono.svg" },
+  },
+  {
+    slug: "slack-badge",
+    title: "Slack",
+    aliases: [],
+    collection: "auth-badges",
+    license: "CC0-1.0",
+    variants: { default: "/icons/slack-badge/default.svg" },
+  },
+  {
+    slug: "slack",
+    title: "Slack",
+    aliases: [],
+    collection: "brands",
+    license: "CC0-1.0",
+    variants: { default: "/icons/slack/default.svg", wordmark: "/icons/slack/wordmark.svg" },
+  },
+  {
+    slug: "aws",
+    title: "AWS",
+    aliases: ["Amazon Web Services"],
+    collection: "brands",
+    license: "MIT",
+    variants: { default: "/icons/aws/color.svg", mono: "/icons/aws/mono.svg" },
+  },
+  {
+    slug: "coca-cola",
+    title: "Coca-Cola",
+    aliases: [],
+    collection: "brands",
+    license: "CC0-1.0",
+    variants: { default: "/icons/coca-cola/default.svg" },
+  },
+  {
+    slug: "slackware",
+    title: "Slackware",
+    aliases: [],
+    collection: "brands",
+    license: "CC0-1.0",
+    variants: { default: "/icons/slackware/default.svg" },
+  },
+  // Mirrors the real manifest's Microsoft entries verbatim (theSVG's own
+  // "needs maintainer review" wording) — never a valid match.
+  {
+    slug: "power-bi",
+    title: "Power BI",
+    aliases: [],
+    collection: "brands",
+    license:
+      "Microsoft proprietary product icon; no express redistribution license supplied; maintainer review required",
+    variants: { default: "/icons/power-bi/default.svg" },
+  },
+  {
+    slug: "acme-unresolved",
+    title: "Acme Unresolved",
+    aliases: [],
+    collection: "brands",
+    license: "brand-use",
+    variants: { default: "/icons/acme-unresolved/default.svg" },
+  },
+];
+
+test("thesvgMatch finds entries by normalized slug, title, or alias", () => {
+  assert.equal(thesvgMatch(ICONS, "nextjs").slug, "nextdotjs", "title Next.js ≡ nextjs");
+  assert.equal(thesvgMatch(ICONS, "coca cola").slug, "coca-cola");
+  assert.equal(thesvgMatch(ICONS, "amazon web services").slug, "aws", "alias hit");
+  assert.equal(thesvgMatch(ICONS, "zzzbrand"), null);
+});
+
+test("thesvgMatch prefers the brand mark over an auth badge with the same title", () => {
+  assert.equal(thesvgMatch(ICONS, "slack").slug, "slack");
+});
+
+test("thesvgMatch never returns a lookalike", () => {
+  assert.equal(thesvgMatch(ICONS, "slackwa"), null);
+  assert.equal(thesvgMatch(ICONS, ""), null);
+});
+
+test("thesvgMatch skips an entry outside theSVG's ten accepted SPDX licenses", () => {
+  assert.equal(
+    thesvgMatch(ICONS, "power bi"),
+    null,
+    "Microsoft's own 'needs maintainer review' text",
+  );
+  assert.equal(
+    thesvgMatch(ICONS, "acme unresolved"),
+    null,
+    "brand-use is not on the accepted list",
+  );
+});
+
+test("thesvgMatch falls through to a lower-ranked accepted entry when the top match is unlicensed", () => {
+  const icons = [
+    {
+      slug: "acme",
+      title: "Acme",
+      aliases: [],
+      collection: "brands",
+      license: "Proprietary",
+      variants: { default: "/icons/acme/default.svg" },
+    },
+    {
+      slug: "acme-community",
+      title: "Acme",
+      aliases: [],
+      collection: "community",
+      license: "CC0-1.0",
+      variants: { default: "/icons/acme-community/default.svg" },
+    },
+  ];
+  assert.equal(thesvgMatch(icons, "acme").slug, "acme-community");
+});
+
+test("github avatar tier never guesses an org", () => {
+  assert.equal(githubOrgFor("slack"), "slackhq");
+  assert.equal(githubOrgFor("heygen"), "heygen-com");
+  assert.equal(githubOrgFor("some-random-startup"), null);
+});
+
+test("favicon domain defaults to <entity>.com with explicit overrides", () => {
+  assert.equal(faviconDomainFor("cocacola"), "coca-cola.com");
+  assert.equal(faviconDomainFor("stripe"), "stripe.com");
+});
+
+// --- async tiers, network mocked -------------------------------------------
+// The 54-brand stress test is a manual snapshot; these pin the same behavior
+// as CI gates: descriptor shape, alias retry, error→null fallthrough, the
+// placeholder filter, and the real cascade order under a mocked network.
+
+const json = (data) => new Response(JSON.stringify(data), { status: 200 });
+const status = (code) => new Response(null, { status: code });
+const bin = (n) => new Response(new Uint8Array(n), { status: 200 });
+
+test("thesvgSearch returns a pinned CDN url for the default variant", async (t) => {
+  resetThesvgManifest();
+  t.mock.method(globalThis, "fetch", async () => json(ICONS));
+  const res = await thesvgSearch("AWS logo", {});
+  assert.match(
+    res.url,
+    /^https:\/\/cdn\.jsdelivr\.net\/gh\/glincker\/thesvg@[0-9a-f]{40}\/public\/icons\/aws\/color\.svg$/,
+  );
+  assert.equal(res.ext, ".svg");
+  assert.equal(res.metadata.provider, "thesvg");
+  assert.equal(res.metadata.provenance.slug, "aws");
+  assert.deepEqual(res.metadata.provenance.variants, ["default", "mono"]);
+});
+
+test("thesvgSearch fetches the manifest once per process", async (t) => {
+  resetThesvgManifest();
+  const fetchMock = t.mock.method(globalThis, "fetch", async () => json(ICONS));
+  await thesvgSearch("slack logo", {});
+  await thesvgSearch("nextjs logo", {});
+  assert.equal(await thesvgSearch("zzzbrand logo", {}), null);
+  assert.equal(fetchMock.mock.callCount(), 1);
+});
+
+test("thesvgSearch returns null when the network is down, then retries next call", async (t) => {
+  resetThesvgManifest();
+  let down = true;
+  t.mock.method(globalThis, "fetch", async () => {
+    if (down) throw new Error("network down");
+    return json(ICONS);
+  });
+  assert.equal(await thesvgSearch("figma logo", {}), null);
+  down = false;
+  assert.equal((await thesvgSearch("slack logo", {})).metadata.provenance.slug, "slack");
+});
+
+test("thesvgSearch treats a non-array manifest as a miss", async (t) => {
+  resetThesvgManifest();
+  t.mock.method(globalThis, "fetch", async () => json({ error: "unexpected shape" }));
+  assert.equal(await thesvgSearch("slack logo", {}), null);
+});
+
+test("thesvgSearch rejects a manifest body over the size cap instead of buffering it whole", async (t) => {
+  resetThesvgManifest();
+  t.mock.method(globalThis, "fetch", async () => ({
+    ok: true,
+    status: 200,
+    headers: { get: () => null },
+    // 4 × 6MB > the 20MB cap, no content-length header (matches jsDelivr).
+    body: (async function* () {
+      for (let i = 0; i < 4; i++) yield new Uint8Array(6 * 1024 * 1024);
+    })(),
+  }));
+  assert.equal(await thesvgSearch("slack logo", {}), null);
+});
+
+test("faviconSearch rejects DDG's sub-500B placeholder with null", async (t) => {
+  t.mock.method(globalThis, "fetch", async () => bin(120));
+  assert.equal(await faviconSearch("someco logo", {}), null);
+});
+
+test("faviconSearch hands verified bytes over as a local file — one fetch, no re-download", async (t) => {
+  const fetchMock = t.mock.method(globalThis, "fetch", async () => bin(600));
+  const res = await faviconSearch("someco logo", {});
+  assert.ok(res.localPath, "returns a localPath, not a url");
+  assert.equal(readFileSync(res.localPath).byteLength, 600, "frozen bytes are the verified bytes");
+  assert.equal(fetchMock.mock.callCount(), 1, "single network round-trip");
+  assert.equal(res.metadata.provenance.low_res, true);
+});
+
+test("githubAvatarSearch never touches the network for an unmapped entity", async (t) => {
+  const fetchMock = t.mock.method(globalThis, "fetch", async () => status(200));
+  assert.equal(await githubAvatarSearch("some-random-startup logo", {}), null);
+  assert.equal(fetchMock.mock.callCount(), 0);
+});
+
+test("the real logo cascade resolves a theSVG brand on tier 1", async (t) => {
+  resetThesvgManifest();
+  t.mock.method(globalThis, "fetch", async (url) => {
+    if (String(url).includes("glincker/thesvg")) return json(ICONS);
+    throw new Error(`unexpected fetch: ${url}`);
+  });
+  const res = await runProviders(getProviders("logo"), "search", "Next.js logo", {});
+  assert.equal(res.metadata.provider, "thesvg");
+  assert.ok(res.url.endsWith("/public/icons/nextdotjs/default.svg"));
+});
+
+test("the real logo cascade falls through tier by tier to the first hit", async (t) => {
+  resetThesvgManifest();
+  t.mock.method(globalThis, "fetch", async (url) => {
+    const u = String(url);
+    if (u.includes("glincker/thesvg")) return json(ICONS); // tier 1: no entry
+    // tier 2 (github) is never called: entity is unmapped
+    if (u.includes("duckduckgo")) return bin(600); // tier 3: real favicon
+    throw new Error(`unexpected fetch: ${u}`);
+  });
+  const res = await runProviders(getProviders("logo"), "search", "zzzbrand logo", {
+    entity: "zzzbrand",
+  });
+  assert.ok(res, "cascade must land on the favicon tier");
+  assert.equal(res.metadata.provider, "favicon.ddg");
+});
+
+test("githubAvatarSearch rejects private HEAD redirects", async (t) => {
+  const seen = [];
+  t.mock.method(globalThis, "fetch", async (url, options) => {
+    seen.push(url);
+    assert.equal(options.method, "HEAD");
+    assert.ok(options.signal);
+    return options.redirect === "manual"
+      ? new Response(null, { status: 302, headers: { location: "http://127.0.0.1/private" } })
+      : new Response(null, { status: 200 });
+  });
+  assert.equal(await githubAvatarSearch("vercel logo"), null);
+  assert.equal(seen.length, 1);
+  assert.ok(!seen[0].includes("127.0.0.1"));
+});
+
+test("thesvgSearch rejects a manifest redirect to a private host", async (t) => {
+  resetThesvgManifest();
+  const seen = [];
+  t.mock.method(globalThis, "fetch", async (url, options) => {
+    seen.push(url);
+    assert.equal(options.redirect, "manual");
+    return new Response(null, { status: 302, headers: { location: "http://127.0.0.1/private" } });
+  });
+  assert.equal(await thesvgSearch("vercel logo"), null);
+  assert.equal(seen.length, 1);
+});