Digest-pinned template upload validation ships with the gated device-hooks feature.
What
Every uploaded hook template is checked against the id and digests already registered before its bytes are kept. Unknown ids, digest or version mismatches, oversized bodies and malformed base64 each get their own refusal message, and re-uploading a digest already held answers "already stored" rather than storing it again.
Details
- The request handler caps registration at 64 KiB and uploads at 400 KB, and rejects requests tagged with an out-of-date worker generation.
- Same account-flag and policy gate as the template runner.
Evidence
invalid_upload: request larger than 400 KB
Strings lifted out of the shipped bundle, so the claim above can be checked against them.