hyperframes 0.8.67 → 0.8.68

package/dist/skills/media-use/scripts/lib/logo-provider.test.mjs

@@ -4,12 +4,11 @@ import { readFileSync } from "node:fs";
 import {
   entityFrom,
   titleMatches,
-  svglQueriesFor,
-  simpleIconSlugsFor,
+  thesvgMatch,
   githubOrgFor,
   faviconDomainFor,
-  svglSearch,
-  simpleIconsSearch,
+  thesvgSearch,
+  resetThesvgManifest,
   githubAvatarSearch,
   faviconSearch,
 } from "./logo-provider.mjs";
@@ -27,16 +26,126 @@ test("titleMatches ignores case, spacing, punctuation — and rejects lookalikes
   assert.ok(!titleMatches("Slackware", "slack"));
 });
 
-test("svgl queries include the alias forms the raw entity can't match", () => {
-  assert.ok(svglQueriesFor("nextjs").includes("next.js"));
-  assert.ok(svglQueriesFor("aws").includes("amazon web services"));
-  assert.deepEqual(svglQueriesFor("figma"), ["figma"]);
+// A slice of the real theSVG manifest shape (src/data/icons.json).
+const ICONS = [
+  {
+    slug: "nextdotjs",
+    title: "Next.js",
+    aliases: [],
+    collection: "brands",
+    license: "CC0-1.0",
+    variants: { default: "/icons/nextdotjs/default.svg", mono: "/icons/nextdotjs/mono.svg" },
+  },
+  {
+    slug: "slack-badge",
+    title: "Slack",
+    aliases: [],
+    collection: "auth-badges",
+    license: "CC0-1.0",
+    variants: { default: "/icons/slack-badge/default.svg" },
+  },
+  {
+    slug: "slack",
+    title: "Slack",
+    aliases: [],
+    collection: "brands",
+    license: "CC0-1.0",
+    variants: { default: "/icons/slack/default.svg", wordmark: "/icons/slack/wordmark.svg" },
+  },
+  {
+    slug: "aws",
+    title: "AWS",
+    aliases: ["Amazon Web Services"],
+    collection: "brands",
+    license: "MIT",
+    variants: { default: "/icons/aws/color.svg", mono: "/icons/aws/mono.svg" },
+  },
+  {
+    slug: "coca-cola",
+    title: "Coca-Cola",
+    aliases: [],
+    collection: "brands",
+    license: "CC0-1.0",
+    variants: { default: "/icons/coca-cola/default.svg" },
+  },
+  {
+    slug: "slackware",
+    title: "Slackware",
+    aliases: [],
+    collection: "brands",
+    license: "CC0-1.0",
+    variants: { default: "/icons/slackware/default.svg" },
+  },
+  // Mirrors the real manifest's Microsoft entries verbatim (theSVG's own
+  // "needs maintainer review" wording) — never a valid match.
+  {
+    slug: "power-bi",
+    title: "Power BI",
+    aliases: [],
+    collection: "brands",
+    license:
+      "Microsoft proprietary product icon; no express redistribution license supplied; maintainer review required",
+    variants: { default: "/icons/power-bi/default.svg" },
+  },
+  {
+    slug: "acme-unresolved",
+    title: "Acme Unresolved",
+    aliases: [],
+    collection: "brands",
+    license: "brand-use",
+    variants: { default: "/icons/acme-unresolved/default.svg" },
+  },
+];
+
+test("thesvgMatch finds entries by normalized slug, title, or alias", () => {
+  assert.equal(thesvgMatch(ICONS, "nextjs").slug, "nextdotjs", "title Next.js ≡ nextjs");
+  assert.equal(thesvgMatch(ICONS, "coca cola").slug, "coca-cola");
+  assert.equal(thesvgMatch(ICONS, "amazon web services").slug, "aws", "alias hit");
+  assert.equal(thesvgMatch(ICONS, "zzzbrand"), null);
+});
+
+test("thesvgMatch prefers the brand mark over an auth badge with the same title", () => {
+  assert.equal(thesvgMatch(ICONS, "slack").slug, "slack");
+});
+
+test("thesvgMatch never returns a lookalike", () => {
+  assert.equal(thesvgMatch(ICONS, "slackwa"), null);
+  assert.equal(thesvgMatch(ICONS, ""), null);
+});
+
+test("thesvgMatch skips an entry outside theSVG's ten accepted SPDX licenses", () => {
+  assert.equal(
+    thesvgMatch(ICONS, "power bi"),
+    null,
+    "Microsoft's own 'needs maintainer review' text",
+  );
+  assert.equal(
+    thesvgMatch(ICONS, "acme unresolved"),
+    null,
+    "brand-use is not on the accepted list",
+  );
 });
 
-test("simple-icons slugs cover the renamed entries", () => {
-  assert.ok(simpleIconSlugsFor("nextjs").includes("nextdotjs"));
-  assert.ok(simpleIconSlugsFor("aws").includes("amazonwebservices"));
-  assert.deepEqual(simpleIconSlugsFor("nike"), ["nike"]);
+test("thesvgMatch falls through to a lower-ranked accepted entry when the top match is unlicensed", () => {
+  const icons = [
+    {
+      slug: "acme",
+      title: "Acme",
+      aliases: [],
+      collection: "brands",
+      license: "Proprietary",
+      variants: { default: "/icons/acme/default.svg" },
+    },
+    {
+      slug: "acme-community",
+      title: "Acme",
+      aliases: [],
+      collection: "community",
+      license: "CC0-1.0",
+      variants: { default: "/icons/acme-community/default.svg" },
+    },
+  ];
+  assert.equal(thesvgMatch(icons, "acme").slug, "acme-community");
 });
 
 test("github avatar tier never guesses an org", () => {
@@ -59,45 +168,59 @@ const json = (data) => new Response(JSON.stringify(data), { status: 200 });
 const status = (code) => new Response(null, { status: code });
 const bin = (n) => new Response(new Uint8Array(n), { status: 200 });
 
-test("svglSearch returns the descriptor shape on an exact title hit", async (t) => {
-  t.mock.method(globalThis, "fetch", async () =>
-    json([{ title: "Figma", route: "https://svgl.app/library/figma.svg" }]),
+test("thesvgSearch returns a pinned CDN url for the default variant", async (t) => {
+  resetThesvgManifest();
+  t.mock.method(globalThis, "fetch", async () => json(ICONS));
+  const res = await thesvgSearch("AWS logo", {});
+  assert.match(
+    res.url,
+    /^https:\/\/cdn\.jsdelivr\.net\/gh\/glincker\/thesvg@[0-9a-f]{40}\/public\/icons\/aws\/color\.svg$/,
   );
-  const res = await svglSearch("Figma logo", {});
-  assert.equal(res.url, "https://svgl.app/library/figma.svg");
   assert.equal(res.ext, ".svg");
-  assert.equal(res.metadata.provider, "svgl");
+  assert.equal(res.metadata.provider, "thesvg");
+  assert.equal(res.metadata.provenance.slug, "aws");
+  assert.deepEqual(res.metadata.provenance.variants, ["default", "mono"]);
 });
 
-test("svglSearch skips a non-array payload and retries with the alias query", async (t) => {
-  const seen = [];
-  t.mock.method(globalThis, "fetch", async (url) => {
-    seen.push(decodeURIComponent(String(url)));
-    return seen.length === 1
-      ? json({ error: "unexpected shape" })
-      : json([{ title: "Next.js", route: "https://svgl.app/library/nextjs.svg" }]);
-  });
-  const res = await svglSearch("nextjs logo", {});
-  assert.equal(res.metadata.provenance.query, "next.js", "hit came from the alias query");
-  assert.ok(seen.length >= 2, "raw query then alias");
+test("thesvgSearch fetches the manifest once per process", async (t) => {
+  resetThesvgManifest();
+  const fetchMock = t.mock.method(globalThis, "fetch", async () => json(ICONS));
+  await thesvgSearch("slack logo", {});
+  await thesvgSearch("nextjs logo", {});
+  assert.equal(await thesvgSearch("zzzbrand logo", {}), null);
+  assert.equal(fetchMock.mock.callCount(), 1);
 });
 
-test("svglSearch returns null when the network is down — the cascade falls through", async (t) => {
+test("thesvgSearch returns null when the network is down, then retries next call", async (t) => {
+  resetThesvgManifest();
+  let down = true;
   t.mock.method(globalThis, "fetch", async () => {
-    throw new Error("network down");
+    if (down) throw new Error("network down");
+    return json(ICONS);
   });
-  assert.equal(await svglSearch("figma logo", {}), null);
+  assert.equal(await thesvgSearch("figma logo", {}), null);
+  down = false;
+  assert.equal((await thesvgSearch("slack logo", {})).metadata.provenance.slug, "slack");
 });
 
-test("simpleIconsSearch falls to the next slug on a 404", async (t) => {
-  const seen = [];
-  t.mock.method(globalThis, "fetch", async (url) => {
-    seen.push(String(url));
-    return String(url).includes("amazonwebservices") ? status(200) : status(404);
-  });
-  const res = await simpleIconsSearch("aws logo", {});
-  assert.ok(res.url.endsWith("amazonwebservices.svg"));
-  assert.equal(seen.length, 2, "plain slug 404s first, alias slug hits");
+test("thesvgSearch treats a non-array manifest as a miss", async (t) => {
+  resetThesvgManifest();
+  t.mock.method(globalThis, "fetch", async () => json({ error: "unexpected shape" }));
+  assert.equal(await thesvgSearch("slack logo", {}), null);
+});
+
+test("thesvgSearch rejects a manifest body over the size cap instead of buffering it whole", async (t) => {
+  resetThesvgManifest();
+  t.mock.method(globalThis, "fetch", async () => ({
+    ok: true,
+    status: 200,
+    headers: { get: () => null },
+    // 4 × 6MB > the 20MB cap, no content-length header (matches jsDelivr).
+    body: (async function* () {
+      for (let i = 0; i < 4; i++) yield new Uint8Array(6 * 1024 * 1024);
+    })(),
+  }));
+  assert.equal(await thesvgSearch("slack logo", {}), null);
 });
 
 test("faviconSearch rejects DDG's sub-500B placeholder with null", async (t) => {
@@ -120,13 +243,24 @@ test("githubAvatarSearch never touches the network for an unmapped entity", asyn
   assert.equal(fetchMock.mock.callCount(), 0);
 });
 
+test("the real logo cascade resolves a theSVG brand on tier 1", async (t) => {
+  resetThesvgManifest();
+  t.mock.method(globalThis, "fetch", async (url) => {
+    if (String(url).includes("glincker/thesvg")) return json(ICONS);
+    throw new Error(`unexpected fetch: ${url}`);
+  });
+  const res = await runProviders(getProviders("logo"), "search", "Next.js logo", {});
+  assert.equal(res.metadata.provider, "thesvg");
+  assert.ok(res.url.endsWith("/public/icons/nextdotjs/default.svg"));
+});
+
 test("the real logo cascade falls through tier by tier to the first hit", async (t) => {
+  resetThesvgManifest();
   t.mock.method(globalThis, "fetch", async (url) => {
     const u = String(url);
-    if (u.includes("api.svgl.app")) return json([]); // tier 1: no hit
-    if (u.includes("jsdelivr")) return status(404); // tier 2: no such slug
-    // tier 3 (github) is never called: entity is unmapped
-    if (u.includes("duckduckgo")) return bin(600); // tier 4: real favicon
+    if (u.includes("glincker/thesvg")) return json(ICONS); // tier 1: no entry
+    // tier 2 (github) is never called: entity is unmapped
+    if (u.includes("duckduckgo")) return bin(600); // tier 3: real favicon
     throw new Error(`unexpected fetch: ${u}`);
   });
   const res = await runProviders(getProviders("logo"), "search", "zzzbrand logo", {
@@ -136,19 +270,29 @@ test("the real logo cascade falls through tier by tier to the first hit", async
   assert.equal(res.metadata.provider, "favicon.ddg");
 });
 
-for (const search of [simpleIconsSearch, githubAvatarSearch]) {
-  test(`${search.name} rejects private HEAD redirects`, async (t) => {
-    const seen = [];
-    t.mock.method(globalThis, "fetch", async (url, options) => {
-      seen.push(url);
-      assert.equal(options.method, "HEAD");
-      assert.ok(options.signal);
-      return options.redirect === "manual"
-        ? new Response(null, { status: 302, headers: { location: "http://127.0.0.1/private" } })
-        : new Response(null, { status: 200 });
-    });
-    assert.equal(await search("vercel logo"), null);
-    assert.equal(seen.length, 1);
-    assert.ok(!seen[0].includes("127.0.0.1"));
+test("githubAvatarSearch rejects private HEAD redirects", async (t) => {
+  const seen = [];
+  t.mock.method(globalThis, "fetch", async (url, options) => {
+    seen.push(url);
+    assert.equal(options.method, "HEAD");
+    assert.ok(options.signal);
+    return options.redirect === "manual"
+      ? new Response(null, { status: 302, headers: { location: "http://127.0.0.1/private" } })
+      : new Response(null, { status: 200 });
+  });
+  assert.equal(await githubAvatarSearch("vercel logo"), null);
+  assert.equal(seen.length, 1);
+  assert.ok(!seen[0].includes("127.0.0.1"));
+});
+
+test("thesvgSearch rejects a manifest redirect to a private host", async (t) => {
+  resetThesvgManifest();
+  const seen = [];
+  t.mock.method(globalThis, "fetch", async (url, options) => {
+    seen.push(url);
+    assert.equal(options.redirect, "manual");
+    return new Response(null, { status: 302, headers: { location: "http://127.0.0.1/private" } });
   });
-}
+  assert.equal(await thesvgSearch("vercel logo"), null);
+  assert.equal(seen.length, 1);
+});

package/dist/skills/media-use/scripts/lib/media-fetch.mjs

@@ -69,3 +69,17 @@ export async function fetchMedia(url, { method = "GET", signal, fetchImpl = fetc
   }
   throw new Error("Media download exceeded redirect limit");
 }
+
+// Stream and abort once the cap is crossed, so a lying or chunked body can't buffer past it.
+export async function readCappedBody(res, maxBytes, label) {
+  const declared = Number(res.headers.get("content-length"));
+  if (declared > maxBytes) throw new Error(`${label}: ${declared} bytes exceeds ${maxBytes} cap`);
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of res.body) {
+    total += chunk.length;
+    if (total > maxBytes) throw new Error(`${label}: stream exceeds ${maxBytes} cap`);
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks, total);
+}

package/dist/skills/media-use/scripts/lib/media-fetch.test.mjs

@@ -3,7 +3,7 @@ import { mkdtempSync, readdirSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { test } from "node:test";
-import { fetchMedia, isPublicMediaUrl } from "./media-fetch.mjs";
+import { fetchMedia, isPublicMediaUrl, readCappedBody } from "./media-fetch.mjs";
 import { freezeUrl } from "./freeze.mjs";
 import { downloadTo } from "../../audio/scripts/lib/heygen.mjs";
 import { synthesizeHeygen } from "../../audio/scripts/lib/tts.mjs";
@@ -167,3 +167,31 @@ for (const entry of ["heygen audio", "tts mp3", "tts wav", "favicon"]) {
     }
   });
 }
+
+function streamed(sizes, contentLength = null) {
+  let pulled = 0;
+  const body = (async function* () {
+    for (const n of sizes) {
+      pulled++;
+      yield new Uint8Array(n);
+    }
+  })();
+  return { res: { headers: { get: () => contentLength }, body }, pulled: () => pulled };
+}
+
+test("readCappedBody refuses a declared oversize body before reading a byte", async () => {
+  const { res, pulled } = streamed([10], "101");
+  await assert.rejects(readCappedBody(res, 100, "t"), /t: 101 bytes exceeds 100 cap/);
+  assert.equal(pulled(), 0);
+});
+
+test("readCappedBody aborts a chunked body the moment it crosses the cap", async () => {
+  const { res, pulled } = streamed([60, 60, 60]);
+  await assert.rejects(readCappedBody(res, 100, "t"), /t: stream exceeds 100 cap/);
+  assert.equal(pulled(), 2);
+});
+
+test("readCappedBody returns every byte of a body at the cap", async () => {
+  const { res } = streamed([60, 40]);
+  assert.equal((await readCappedBody(res, 100, "t")).byteLength, 100);
+});

package/dist/skills/media-use/scripts/lib/registry.mjs

@@ -25,12 +25,7 @@ import { sfxProvider } from "./sfx-provider.mjs";
 import { bundledSfxProvider } from "./bundled-sfx-provider.mjs";
 import { imageProvider, iconProvider } from "./image-provider.mjs";
 import { brandProvider } from "./brand-provider.mjs";
-import {
-  svglSearch,
-  simpleIconsSearch,
-  githubAvatarSearch,
-  faviconSearch,
-} from "./logo-provider.mjs";
+import { thesvgSearch, githubAvatarSearch, faviconSearch } from "./logo-provider.mjs";
 import { heygenTtsGenerate } from "./voice-provider.mjs";
 import { heygenVideoGenerate } from "./heygen-video-provider.mjs";
 import { ltxVideoGenerate } from "./ltx-video-provider.mjs";
@@ -65,12 +60,11 @@ const REGISTRY = {
   ],
   icon: [N("heygen.asset.search", { search: iconProvider.search })],
   logo: [
-    // Official brand marks. Tiers verified by a 54-brand stress test (100%
-    // cascade hit); HeyGen asset search is deliberately absent — it returns
-    // generic look-alike icons for brand queries. All free, all network →
-    // --local-only leaves only the cache rungs.
-    N("svgl", { search: svglSearch }),
-    N("simple-icons", { search: simpleIconsSearch }),
+    // Official brand marks: theSVG first, then GitHub org avatar and favicon
+    // for the brands it lacks. HeyGen asset search is deliberately absent — it
+    // returns generic look-alike icons for brand queries. All free, all
+    // network → --local-only leaves only the cache rungs.
+    N("thesvg", { search: thesvgSearch }),
     N("github.avatar", { search: githubAvatarSearch }),
     N("favicon.ddg", { search: faviconSearch }),
   ],

package/dist/skills/media-use/scripts/lib/registry.test.mjs

@@ -43,7 +43,7 @@ test("heygen provider is first for every type it serves except bundled sfx", ()
 
 test("sanctioned providers only: heygen, local mflux/kokoro/ltx, codex, design spec, logo tiers", () => {
   const allowed =
-    /^heygen|^bundled\.sfx$|^mflux\.local$|^kokoro\.local$|^ltx\.local$|^codex\.image_gen$|^design_spec$|^svgl$|^simple-icons$|^github\.avatar$|^favicon\.ddg$|^color_grade\.local$|^cube_lut\.local$/;
+    /^heygen|^bundled\.sfx$|^mflux\.local$|^kokoro\.local$|^ltx\.local$|^codex\.image_gen$|^design_spec$|^thesvg$|^github\.avatar$|^favicon\.ddg$|^color_grade\.local$|^cube_lut\.local$/;
   for (const t of listTypes()) {
     for (const p of getProviders(t)) {
       assert.ok(allowed.test(p.name), `${t} lists unsanctioned provider: ${p.name}`);