Build on Plexara

Content-type detection

The Stored Type Is Detected, Not Taken on Faith

Binaries from magic bytes, structured text from bounded heuristics

Images, audio, video, PDF, and archives are recognized from the first 512 bytes. JSON, NDJSON, XML, YAML, CSV, and TSV all look like plain text to a byte sniffer, so each gets its own heuristic over a bounded prefix.

A prefix, never the whole payload

A streaming export stays streaming. The prefix is replayed ahead of the untouched remainder, so detecting the type of a multi-gigabyte export costs the same as detecting the type of a one-line file.

One family, one type string

Aliases normalize, so text/json and application/json both store as one type and everything downstream compares one string. The stored object key follows the detected type, so a bucket listing shows .json rather than .bin.

The original declaration is kept

When detection overrides a declaration, the original is recorded in the asset's provenance as declared_content_type. A stored type that disagrees with its source stays explainable after the fact instead of looking like a mystery.

Addressing an operation

Call It by the Name Discovery Gave You

Invoke by operation_id

{
  "connection": "vendor",
  "operation_id": "getUser",
  "path_params": { "id": "123" }
}

The built-in util connection

A connection named util is present alongside your own, discovered and invoked exactly like any other. Its fetch_url operation reaches a public URL server-side and returns it inline or streams it straight into a saved asset. That closes a real gap: an ordinary gateway call joins a path to a registered base URL, so it cannot follow a one-time presigned download link whose host and token are generated on the spot.

api_invoke_endpoint  vendor  POST /exports          -> job id
api_invoke_endpoint  vendor  GET  /exports/{id}     -> signed download_url
api_export           util    POST /util/fetch       -> saved asset

The URL is used exactly as given and the query string is never re-encoded, so a signature survives byte for byte. No credential is ever attached, only GET and HEAD are accepted, and internal address space is closed: loopback, private ranges, link-local including the cloud metadata endpoint, and internal hostnames. The hostname is resolved first and only the vetted address is dialed, on every redirect hop, so a public name cannot rebind to an internal one between the check and the connection. Like every connection, util is deny-by-default and a persona reaches it only when its rules allow it.