Upload MIME and Magic-Byte Validator

{
  "schemaVersion": "1.0",
  "capabilityId": "00000000-0000-4000-8000-000000000013",
  "name": "Upload MIME and Magic-Byte Validator",
  "slug": "upload-mime-magic-byte-validator",
  "summary": "Rejects upload type confusion by comparing declared MIME types, extensions, and bounded magic-byte signatures.",
  "granularity": "primitive",
  "purposes": [
    "file uploads",
    "mime validation",
    "content sniffing",
    "security"
  ],
  "features": [
    "magic-byte signatures",
    "MIME comparison",
    "extension policy",
    "bounded reads"
  ],
  "functionalDescription": "Rejects upload type confusion by comparing declared MIME types, extensions, and bounded magic-byte signatures. The versioned contract documents deterministic behavior, failure modes, configuration, and integration boundaries for production teams.",
  "inputs": [
    {
      "name": "request",
      "contentType": "multipart/form-data",
      "description": "Validated multipart/form-data request payload",
      "required": true
    }
  ],
  "outputs": [
    {
      "name": "result",
      "contentType": "application/json",
      "description": "Typed application/json response with trace metadata",
      "required": true
    }
  ],
  "runtimes": [
    {
      "language": "TypeScript",
      "runtime": "node",
      "versions": [
        "20",
        "22"
      ]
    }
  ],
  "frameworks": [
    "Web Streams"
  ],
  "deploymentTargets": [
    "node-service",
    "aws-lambda",
    "vercel"
  ],
  "dependencies": [
    {
      "name": "zod",
      "version": ">=2",
      "optional": false
    }
  ],
  "permissions": [
    {
      "resource": "temporary-storage",
      "access": "read-write",
      "reason": "Bounded request processing"
    }
  ],
  "dataClassifications": [
    "internal"
  ],
  "complianceClaims": [
    "SBOM available",
    "Dependency scan recorded"
  ],
  "testEvidence": {
    "coveragePercent": 97,
    "tests": 262,
    "lastRun": "2026-07-20T14:00:00.000Z",
    "status": "passing"
  },
  "securityEvidence": {
    "criticalFindings": 0,
    "highFindings": 0,
    "score": 96,
    "scannedAt": "2026-07-19T09:30:00.000Z",
    "scanner": "FixtureScan 1.4"
  },
  "benchmarks": [
    {
      "name": "p95 latency",
      "value": 254,
      "unit": "ms",
      "environment": "2 vCPU / 2 GB fixture runner"
    }
  ],
  "buildBenchmark": {
    "basis": "fixture-directional",
    "sampleSize": 0,
    "referenceTask": "Reimplement the declared upload-mime-magic-byte-validator contract in a compatible greenfield repository",
    "tokenEstimate": {
      "low": 20250,
      "high": 50250
    },
    "agentTimeMinutes": {
      "low": 15.75,
      "high": 44
    },
    "humanReviewHours": {
      "low": 0.3,
      "high": 1
    },
    "observedAt": null,
    "methodology": "Directional fixture derived from declared granularity and integration effort; no coding-agent replay was run.",
    "confidence": "low",
    "disclosure": "Prototype estimate only. It is not an empirical benchmark and must not be presented as measured savings."
  },
  "integration": {
    "estimatedHours": 0.75,
    "packageManager": "pnpm",
    "configurationNotes": [
      "Pin the immutable artifact digest",
      "Configure scoped service credentials"
    ]
  },
  "composition": {
    "composable": true,
    "interface": "in-process-function",
    "compatibleWith": [
      "file-malware-scanning-gateway",
      "email-attachment-classification-service"
    ],
    "requires": [],
    "contractStability": "stable",
    "evidence": "fixture-declared",
    "notes": [
      "Compatibility links are declared fixture metadata and have not been independently integration-tested"
    ]
  },
  "commercialModels": [
    "licensed-artifact",
    "source-license"
  ],
  "licenseOptions": [
    {
      "id": "evaluation",
      "name": "Private evaluation",
      "scope": "evaluation",
      "priceCents": 5,
      "unit": "evaluation",
      "rights": [
        "evaluation"
      ],
      "developerSeats": null,
      "restrictions": [
        "Non-production use only",
        "Results retained for 30 days"
      ]
    },
    {
      "id": "developer",
      "name": "Developer artifact",
      "scope": "individual",
      "priceCents": 1500,
      "unit": "one-time",
      "rights": [
        "artifact-access",
        "commercial-use"
      ],
      "developerSeats": 1,
      "restrictions": [
        "No redistribution",
        "One named developer"
      ]
    },
    {
      "id": "commercial-source",
      "name": "Commercial source",
      "scope": "commercial-source",
      "priceCents": 5900,
      "unit": "one-time",
      "rights": [
        "artifact-access",
        "source-access",
        "modification",
        "commercial-use"
      ],
      "developerSeats": 10,
      "restrictions": [
        "No standalone redistribution",
        "One production application"
      ]
    }
  ],
  "artifactDigests": [
    {
      "algorithm": "sha256",
      "digest": "c396a9cbc08c4e2a7a54732d263f1cff0eeb41ab50fb2758ee688422f581a262",
      "artifactType": "source"
    }
  ],
  "provenance": {
    "builder": "FunctionFoundry demo build service",
    "sourceRevision": "fixture-upload-mime-magic-byte-validator-v1",
    "builtAt": "2026-07-18T12:00:00.000Z",
    "signed": true
  },
  "maintenanceStatus": "active",
  "version": "1.19.0",
  "seller": {
    "name": "Cleanroom Security",
    "verified": true,
    "reputation": 4.6
  },
  "verificationBadges": [
    "Security reviewed",
    "Contract verified",
    "Composition declared"
  ]
}