Validate Upload Constraints

Overview

You pass managed file references and a declarative upload policy; we resolve each file's size, content-detected MIME type, extension, and optional SHA-256, then report per-file findings and an overall valid flag. We never trust caller-supplied MIME metadata. This is policy enforcement only — a valid result does not certify absence of malware. Do not use this for archive extraction or malware scanning.

Upload validation must rely on content we resolve — not MIME types or sizes your client claims.

When to use it

Scope

Non-goals

• No malware scanning
• No archive extraction
• No network fetch
• Does not certify legal or compliance approval beyond your supplied constraints

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

File limits

Constraints this skill applies to your input and generated files. The “Limited by” column shows the static source of each cap; none of these can be raised by upgrading your plan.

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"file.validate_upload_constraints","input":{"files":[{"ref":"squillify://files/f-1","logicalName":"a.txt"}],"constraints":{"maxBytesPerFile":100}}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("file.validate_upload_constraints", {"constraints":{"maxBytesPerFile":100},"files":[{"ref":"squillify://files/f-1","logicalName":"a.txt"}]});

Errors

Other limits

Limitations

• No malware scanning
• No archive extraction
• No network fetch
• Does not certify legal or compliance approval beyond your supplied constraints
• Malware or virus scanning
• Unpacking ZIP archives (use file.safe_extract_archive after policy pass)

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "file.validate_upload_constraints",
  "input": {
    "constraints": {
      "maxBytesPerFile": 100
    },
    "files": [
      {
        "ref": "squillify://files/f-1",
        "logicalName": "a.txt"
      }
    ]
  }
}

Examples

{
  "constraints": {
    "maxBytesPerFile": 100
  },
  "files": [
    {
      "ref": "squillify://files/f-1",
      "logicalName": "a.txt"
    }
  ]
}

{
  "valid": true,
  "_meta": {
    "validatorProfile": "upload-constraints-1"
  },
  "policyDigest": "c8993d83af6ed71d",
  "files": [
    {
      "findings": [],
      "valid": true,
      "extension": "txt",
      "size": 5,
      "index": 0,
      "logicalName": "a.txt",
      "detectedMime": "text/plain",
      "sha256": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
    }
  ],
  "aggregate": {
    "fileCount": 1,
    "policyFindings": [],
    "totalBytes": 5
  }
}

{
  "constraints": {
    "maxBytesPerFile": 3
  },
  "files": [
    {
      "ref": "squillify://files/f-2",
      "logicalName": "big.txt"
    }
  ]
}

{
  "valid": false,
  "_meta": {
    "validatorProfile": "upload-constraints-1"
  },
  "policyDigest": "9eb4df2ed85b97f1",
  "files": [
    {
      "findings": [
        {
          "code": "UPLOAD_FILE_TOO_LARGE",
          "message": "file exceeds max bytes: big.txt",
          "severity": "error"
        }
      ],
      "valid": false,
      "extension": "txt",
      "size": 10,
      "index": 0,
      "logicalName": "big.txt",
      "detectedMime": "text/plain",
      "sha256": "84d89877f0d4041efb6bf91a16f0248f2fd573e6af05c19f96bedb9f882f7882"
    }
  ],
  "aggregate": {
    "fileCount": 1,
    "policyFindings": [],
    "totalBytes": 10
  }
}

Recommended use cases

• Gate uploads before a downstream workflow runs
• Enforce MIME, extension, size, and filename rules you declare
• Detect duplicate content when allowDuplicateContent is false

Avoid for

• Malware or virus scanning
• Unpacking ZIP archives (use file.safe_extract_archive after policy pass)

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags