Bound the Mastodon response body read and cancel oversized bodies

[NinjaLikesCheez]

What was wrong

discardBody in src/adapters/mastodon/client.ts said it read the response body only to bound memory, but:

• With no content-length (a chunked response), it called response.text(), which buffers the whole body before the size check. An instance (or anything in front of it) streaming a huge body would have it all held in memory.
• With a content-length over the limit, it returned without reading or cancelling the body, leaving the stream and its connection open.

What changed

• A body that declares a content-length over maxResponseBytes (default 64 KiB) is cancelled with body.cancel() without being read.
• Otherwise the body is read through a stream reader that counts bytes and cancels as soon as the total passes the limit. Nothing is buffered or kept; the body is only drained so the connection can be reused.
• A failed cancel is ignored, so a 2xx status is still treated as posted and a non-OK status still throws the same safe MastodonError (status only, with no body and no token).
• Changelog entry under Unreleased / Fixed.

How it was tested

New tests in src/adapters/mastodon/client.test.ts mock HTTP at the client boundary with an instrumented ReadableStream (no live instance):

• an over-limit content-length is cancelled with at most one chunk pulled
• a chunked body is cancelled after passing the cap (at most 3 of 1000 chunks pulled)
• an oversized error body is cancelled and the error is still Mastodon responded with HTTP 500
• a small chunked body is read to the end and not cancelled
• a body-less 204 is accepted
• a cancel that throws is ignored on both paths

Four of the new tests fail against the old code. just check passes.

🤖 Generated with Claude Code