Summary

MIME types extracted from data URIs not validated, allowing invalid strings like image/foo to be passed to providers.

Root Cause

Extraction without validation (line 890): mimeType = match[1]; accepts any string.

Impact

• Invalid MIME types → provider API rejections
• Difficult debugging
• No guidance on supported formats
• Compounds MB-001 issues

Reproduction

Data URI: data:image/invalid-format;base64,abc
Expected: Validation error
Actual: Sent to provider, cryptic error

Fix

Add validation:

const VALID_IMAGE_MIME_TYPES = ['image/jpeg', 'image/png', ...];

function validateImageMimeType(mimeType: string): boolean {
  return VALID_IMAGE_MIME_TYPES.includes(mimeType);
}

// Usage:
mimeType = getValidatedMimeType(match[1], 'image/jpeg');

File: src/lib/utils/messageBuilder.ts
Lines: 886-894

Depends on: MB-001

Acceptance Criteria

• MIME type validation
• Fallback to valid type
• Warning logged
• List of supported formats