Bound request bodies and artifact uploads (Refs #94)

src/routes/api/autoscaling/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import {
     saveScaling,
     deleteScaling,
@@ -12,7 +13,7 @@ export function GET() {
 }
 export async function POST({ request }: { request: Request }) {
     try {
-        const body = await request.json();
+        const body = await jsonBody(request);
         if (!body || typeof body !== 'object' || Array.isArray(body))
             throw new ScalingError('Provide a policy action.');
         if (body.id !== undefined && typeof body.id !== 'string')
@@ -36,6 +37,7 @@ export async function POST({ request }: { request: Request }) {
         }
         throw new ScalingError('Choose a supported policy action.');
     } catch (error) {
+        if (isHttpError(error, 413)) throw error;
         return json(
             { error: (error as Error).message },
             { status: error instanceof ScalingError ? error.status : 400 }

src/routes/api/betas/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { openBeta, BetaError } from '$lib/server/fleet/beta.js';
 import { betaScriptMetadata } from '$lib/server/fleet/library-metadata.js';
 import { db } from '$lib/server/db/index.js';
@@ -56,7 +57,10 @@ export async function GET({ url }: { url: URL }) {
 // or the legacy form:
 //   { scripts: [{ scriptId, scriptVersionId }], ... }
 export async function POST({ request }: { request: Request }) {
-    const body = (await request.json().catch(() => ({}))) as {
+    const body = (await jsonBody(request).catch((cause) => {
+        if (isHttpError(cause, 413)) throw cause;
+        return {};
+    })) as {
         artifacts?: Array<{ id?: number; versionId?: number }>;
         scripts?: Array<{ scriptId?: number; scriptVersionId?: number }>;
         servers?: string[];

src/routes/api/betas/[id]/promote/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { promoteBeta, previewBetaPromotion, BetaError } from '$lib/server/fleet/beta.js';
 
 function parseId(raw: string): number | null {
@@ -23,7 +24,10 @@ export async function GET({ params }: { params: { id: string } }) {
 export async function POST({ params, request }: { params: { id: string }; request: Request }) {
     const id = parseId(params.id);
     if (id === null) return json({ ok: false, error: 'bad id' }, { status: 400 });
-    const body = await request.json().catch(() => null);
+    const body = await jsonBody(request).catch((cause) => {
+        if (isHttpError(cause, 413)) throw cause;
+        return null;
+    });
     if (typeof body?.previewToken !== 'string')
         return json(
             { ok: false, error: 'Review promotion targets before confirming.' },

src/routes/api/betas/[id]/retry/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { db } from '$lib/server/db/index.js';
 import { emit, type BetaStage } from '$lib/server/pipeline/bus.js';
 import { storedPlan } from '$lib/server/fleet/beta-tests.js';
@@ -24,7 +25,10 @@ export async function POST({ params, request }: { params: { id: string }; reques
             { ok: false, error: 'Use the test plan retry action to collect fresh evidence' },
             { status: 409 }
         );
-    const body = (await request.json().catch(() => ({}))) as { server?: string };
+    const body = (await jsonBody(request).catch((cause) => {
+        if (isHttpError(cause, 413)) throw cause;
+        return {};
+    })) as { server?: string };
     if (!body.server) return json({ ok: false, error: 'server is required' }, { status: 400 });
 
     const row = db()

src/routes/api/betas/[id]/revisions/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { artifactFormBody, BETA_REVISION_FORM_LIMIT } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { BetaError, reviseBeta, type BetaRevisionUpload } from '$lib/server/fleet/beta.js';
 import { ScriptError } from '$lib/server/fleet/scripts.js';
 import { kick } from '$lib/server/pipeline/worker.js';
@@ -8,7 +9,7 @@ export async function POST({ params, request }: { params: { id: string }; reques
     if (!Number.isSafeInteger(id) || id < 1)
         return json({ ok: false, error: 'Invalid beta ID' }, { status: 400 });
     try {
-        const form = await request.formData();
+        const form = await artifactFormBody(request, BETA_REVISION_FORM_LIMIT);
         const expectedRevision = Number(form.get('expectedRevision'));
         if (!Number.isSafeInteger(expectedRevision) || expectedRevision < 1)
             throw new Error('A reviewed revision is required.');
@@ -35,6 +36,7 @@ export async function POST({ params, request }: { params: { id: string }; reques
         void kick();
         return json({ ok: true, result });
     } catch (error) {
+        if (isHttpError(error)) throw error;
         return json(
             { ok: false, error: (error as Error).message },
             { status: error instanceof BetaError || error instanceof ScriptError ? 409 : 400 }

src/routes/api/betas/[id]/test/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { releaseRestartRequest } from '$lib/server/provisioning/index.js';
 import { db } from '$lib/server/db/index.js';
 import { deployBetaServers, getBeta } from '$lib/server/fleet/beta.js';
@@ -27,7 +28,7 @@ export async function POST({ params, request }: { params: { id: string }; reques
     if (!['running', 'ready-promote'].includes(beta.state))
         return json({ error: 'Beta is closed' }, { status: 409 });
     try {
-        const body = await request.json();
+        const body = await jsonBody(request);
         if (
             db()
                 .prepare(
@@ -148,6 +149,7 @@ export async function POST({ params, request }: { params: { id: string }; reques
         void kick();
         return json({ ok: true });
     } catch (error) {
+        if (isHttpError(error, 413)) throw error;
         return json({ ok: false, error: (error as Error).message }, { status: 400 });
     }
 }

src/routes/api/betas/presets/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { db } from '$lib/server/db/index.js';
 import { builtInPlans, parseBetaPlan } from '$lib/beta-plan.js';
 export function GET() {
@@ -14,7 +15,7 @@ export function GET() {
 }
 export async function POST({ request }: { request: Request }) {
     try {
-        const body = await request.json();
+        const body = await jsonBody(request);
         if (typeof body.name !== 'string' || !body.name.trim() || body.name.length > 80)
             throw new Error('Preset name must be 1–80 characters');
         if (builtInPlans.some((p) => p.name === body.name.trim()))
@@ -27,6 +28,7 @@ export async function POST({ request }: { request: Request }) {
             .run(body.name.trim(), JSON.stringify(plan));
         return json({ ok: true });
     } catch (error) {
+        if (isHttpError(error, 413)) throw error;
         return json({ ok: false, error: (error as Error).message }, { status: 400 });
     }
 }

src/routes/api/blueprints/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { listBlueprints, saveBlueprint } from '$lib/server/fleet/launch-recipes.js';
 
 export function GET() {
@@ -7,11 +8,12 @@ export function GET() {
 
 export async function POST({ request }: { request: Request }) {
     try {
-        const body = await request.json();
+        const body = await jsonBody(request);
         if (!body || typeof body !== 'object' || Array.isArray(body))
             throw new Error('Provide a collection name and a launch recipe.');
         return json({ blueprint: saveBlueprint(body) }, { status: 201 });
     } catch (err) {
+        if (isHttpError(err, 413)) throw err;
         return json({ error: (err as Error).message }, { status: 400 });
     }
 }

src/routes/api/blueprints/[id]/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { deleteBlueprint, updateBlueprint } from '$lib/server/fleet/launch-recipes.js';
 
 export function DELETE({ params }: { params: { id: string } }) {
@@ -9,11 +10,12 @@ export function DELETE({ params }: { params: { id: string } }) {
 
 export async function PUT({ params, request }: { params: { id: string }; request: Request }) {
     try {
-        const body = await request.json();
+        const body = await jsonBody(request);
         if (!body || typeof body !== 'object' || Array.isArray(body))
             throw new Error('Provide a collection name and map selections.');
         return json({ blueprint: updateBlueprint(params.id, body) });
     } catch (err) {
+        if (isHttpError(err, 413)) throw err;
         return json({ error: (err as Error).message }, { status: 400 });
     }
 }

src/routes/api/configs/inspect/+server.ts

@@ -1,5 +1,6 @@
+import { jsonBody } from '$lib/server/request-body.js';
 import { getVersionContent } from '$lib/server/fleet/scripts.js';
-import { json } from '@sveltejs/kit';
+import { isHttpError, json } from '@sveltejs/kit';
 import { getServer, listServers } from '$lib/server/fleet/servers.js';
 import {
     getBaselineForScope,
@@ -90,8 +91,9 @@ export async function GET({ url }: { url: URL }) {
 export async function POST({ request }: { request: Request }) {
     let body;
     try {
-        body = await request.json();
-    } catch {
+        body = await jsonBody(request);
+    } catch (cause) {
+        if (isHttpError(cause, 413)) throw cause;
         return json({ error: 'Invalid preview request.' }, { status: 400 });
     }
     if (

src/routes/api/deployment-collections/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { listCollections, queueCollection } from '$lib/server/fleet/collections.js';
 import { kickProvisioning } from '$lib/server/pipeline/worker.js';
 
@@ -8,7 +9,7 @@ export function GET() {
 
 export async function POST({ request }: { request: Request }) {
     try {
-        const body = await request.json();
+        const body = await jsonBody(request);
         if (!body || typeof body !== 'object' || Array.isArray(body))
             throw new Error('Provide a collection preview and its server keys.');
         const result = queueCollection(body);
@@ -22,6 +23,7 @@ export async function POST({ request }: { request: Request }) {
             });
         return json(result, { status: result.collectionId ? 202 : 200 });
     } catch (err) {
+        if (isHttpError(err, 413)) throw err;
         return json({ error: (err as Error).message }, { status: 400 });
     }
 }

src/routes/api/deployment-collections/preview/+server.ts

@@ -1,11 +1,13 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { previewCollection } from '$lib/server/fleet/collections.js';
 
 export async function POST({ request }: { request: Request }) {
     try {
-        const body = await request.json();
+        const body = await jsonBody(request);
         return json(previewCollection(body?.blueprintId, body?.mode, body));
     } catch (err) {
+        if (isHttpError(err, 413)) throw err;
         return json({ error: (err as Error).message }, { status: 400 });
     }
 }

src/routes/api/deployments/house-party/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { housePartyTargets, queueHouseParty } from '$lib/server/fleet/house-party.js';
 import { kick } from '$lib/server/pipeline/worker.js';
 
@@ -7,7 +8,10 @@ export function GET() {
 }
 
 export async function POST({ request }: { request: Request }) {
-    const body = await request.json().catch(() => null);
+    const body = await jsonBody(request).catch((cause) => {
+        if (isHttpError(cause, 413)) throw cause;
+        return null;
+    });
     if (
         !Array.isArray(body?.servers) ||
         !body.servers.every((name: unknown) => typeof name === 'string')

src/routes/api/deployments/preview/+server.ts

@@ -1,9 +1,10 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { previewCreation } from '$lib/server/provisioning/index.js';
 
 export async function POST({ request }: { request: Request }) {
     try {
-        const body = await request.json();
+        const body = await jsonBody(request);
         if (!body || typeof body !== 'object' || Array.isArray(body))
             throw new Error('Provide a launch selection.');
         if (body.blueprintId !== undefined)
@@ -12,6 +13,7 @@ export async function POST({ request }: { request: Request }) {
             );
         return json(previewCreation(body));
     } catch (err) {
+        if (isHttpError(err, 413)) throw err;
         return json({ error: (err as Error).message }, { status: 400 });
     }
 }

src/routes/api/drift/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { previewDrift } from '$lib/server/fleet/drift.js';
 
 // GET returns the current drift plan for the whole fleet without touching disk.
@@ -33,7 +34,10 @@ export async function GET() {
 
 // Legacy previews remain readable. Watchdog owns all new reconciliation requests.
 export async function POST({ request }: { request: Request }) {
-    const body = await request.json().catch(() => null);
+    const body = await jsonBody(request).catch((cause) => {
+        if (isHttpError(cause, 413)) throw cause;
+        return null;
+    });
     if (
         !body ||
         (body.servers !== undefined &&

src/routes/api/maintenance/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { maintenanceOverview } from '$lib/server/maintenance/index.js';
 import { pauseMaintenance, setMaintenancePolicy } from '$lib/server/maintenance/policies.js';
 import { watchdogTick } from '$lib/server/maintenance/recovery.js';
@@ -23,7 +24,10 @@ export function GET(event?: { url: URL }) {
     return json(maintenanceOverview(job ? Number(job) : null));
 }
 export async function POST({ request }: { request: Request }) {
-    const body = await request.json().catch(() => null);
+    const body = await jsonBody(request).catch((cause) => {
+        if (isHttpError(cause, 413)) throw cause;
+        return null;
+    });
     if (!body || typeof body !== 'object' || Array.isArray(body))
         return json({ error: 'Invalid request.' }, { status: 400 });
     let notice: string;

src/routes/api/maintenance/[id]/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { watchdogDetail, updateWatchdogIncident } from '$lib/server/maintenance/recovery.js';
 import { kick } from '$lib/server/pipeline/worker.js';
 
@@ -9,7 +10,10 @@ export function GET({ params }: { params: { id: string } }) {
         : json({ error: 'Maintenance finding not found.' }, { status: 404 });
 }
 export async function POST({ params, request }: { params: { id: string }; request: Request }) {
-    const body = await request.json().catch(() => null);
+    const body = await jsonBody(request).catch((cause) => {
+        if (isHttpError(cause, 413)) throw cause;
+        return null;
+    });
     if (!body || !['retry', 'dismiss'].includes(body.action))
         return json({ error: 'Choose retry or dismiss.' }, { status: 400 });
     const result = updateWatchdogIncident(params.id, body.action);

src/routes/api/plugins/github/import/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { importPluginRelease } from '$lib/server/fleet/plugin-releases.js';
 import { GithubReleaseError } from '$lib/server/integrations/github-releases.js';
 import { ScriptError } from '$lib/server/fleet/scripts.js';
@@ -6,8 +7,9 @@ import { ScriptError } from '$lib/server/fleet/scripts.js';
 export async function POST({ request }: { request: Request }) {
     let input;
     try {
-        input = await request.json();
-    } catch {
+        input = await jsonBody(request);
+    } catch (cause) {
+        if (isHttpError(cause, 413)) throw cause;
         return json({ error: 'Invalid JSON body.' }, { status: 400 });
     }
     if (!input || typeof input !== 'object' || Array.isArray(input))

src/routes/api/plutonium/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { validTimeZone } from '$lib/time-zone.js';
 import {
     cancelMaintenance,
@@ -15,8 +16,9 @@ export function GET() {
 export async function POST({ request }: { request: Request }) {
     let body;
     try {
-        body = await request.json();
-    } catch {
+        body = await jsonBody(request);
+    } catch (cause) {
+        if (isHttpError(cause, 413)) throw cause;
         return json({ error: 'Invalid JSON.' }, { status: 400 });
     }
     if (!body || typeof body !== 'object')

src/routes/api/provisioning/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { deploymentListPage } from '$lib/server/provisioning/history.js';
 import { requestLifecycle } from '$lib/server/provisioning/index.js';
 import {
@@ -32,7 +33,10 @@ export function GET({ url }: { url: URL }) {
 }
 
 export async function POST({ request }: { request: Request }) {
-    const body = await request.json().catch(() => null);
+    const body = await jsonBody(request).catch((cause) => {
+        if (isHttpError(cause, 413)) throw cause;
+        return null;
+    });
     if (
         !body ||
         typeof body.server !== 'string' ||

src/routes/api/rebalancing/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import {
     RebalanceError,
     previewRebalance,
@@ -12,7 +13,7 @@ export function GET() {
 }
 export async function POST({ request }: { request: Request }) {
     try {
-        const body = await request.json();
+        const body = await jsonBody(request);
         if (!body || typeof body !== 'object' || Array.isArray(body))
             throw new RebalanceError('Provide a rebalance action.');
         if (body.action === 'preview') return json({ preview: previewRebalance(body.settings) });
@@ -26,6 +27,7 @@ export async function POST({ request }: { request: Request }) {
             return json({ run: stopRebalance(body.id) });
         throw new RebalanceError('Choose a supported rebalance action.');
     } catch (error) {
+        if (isHttpError(error, 413)) throw error;
         return json(
             { error: (error as Error).message },
             { status: error instanceof RebalanceError ? error.status : 400 }

src/routes/api/scripts/+server.ts

@@ -1,3 +1,4 @@
+import { artifactFormBody } from '$lib/server/request-body.js';
 import { json } from '@sveltejs/kit';
 import {
     createScript,
@@ -38,7 +39,7 @@ export async function GET({ url }: { url: URL }) {
 // name, scopeType, scopeValue, notes, releaseVersion, kind (defaults to 'script'),
 // content (file). Configs may alternatively send `text` as a form field.
 export async function POST({ request, url }: { request: Request; url: URL }) {
-    const form = await request.formData();
+    const form = await artifactFormBody(request);
     const name = String(form.get('name') ?? '').trim();
     const notes = form.get('notes') ? String(form.get('notes')) : undefined;
     let scopeType: ScopeType | null;

src/routes/api/scripts/[id]/scope/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import {
     getScript,
     setScope,
@@ -65,7 +66,10 @@ export async function POST({ params, request }: { params: { id: string }; reques
     const script = getScript(scriptId);
     if (!script) return json({ ok: false, error: 'not found' }, { status: 404 });
 
-    const body = (await request.json().catch(() => ({}))) as {
+    const body = (await jsonBody(request).catch((cause) => {
+        if (isHttpError(cause, 413)) throw cause;
+        return {};
+    })) as {
         scopeType?: ScopeType | null;
         scopeValue?: string | null;
     };

src/routes/api/scripts/[id]/versions/+server.ts

@@ -1,3 +1,4 @@
+import { artifactFormBody } from '$lib/server/request-body.js';
 import { json } from '@sveltejs/kit';
 import { uploadNewVersion, getScript, ScriptError } from '$lib/server/fleet/scripts.js';
 import { createHash } from 'node:crypto';
@@ -28,7 +29,7 @@ export async function POST({ params, request }: { params: { id: string }; reques
         );
     }
 
-    const form = await request.formData();
+    const form = await artifactFormBody(request);
     const notes = form.get('notes') ? String(form.get('notes')) : undefined;
     const file = form.get('content');
     if (!(file instanceof File))

src/routes/api/scripts/inspect/+server.ts

@@ -1,10 +1,11 @@
+import { artifactFormBody } from '$lib/server/request-body.js';
 import { json } from '@sveltejs/kit';
 import { createHash } from 'node:crypto';
 import { db } from '$lib/server/db/index.js';
 
 // Read-only inspection works on HTTP fleet consoles as well as secure origins.
 export async function POST({ request }: { request: Request }) {
-    const form = await request.formData();
+    const form = await artifactFormBody(request);
     const file = form.get('content');
     if (!(file instanceof File) || file.size === 0) {
         return json({ error: 'Choose a non-empty script file.' }, { status: 400 });

src/routes/api/server-keys/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { listServerKeys, saveServerKey, removeServerKey } from '$lib/server/fleet/server-keys.js';
 
 export function GET() {
@@ -6,7 +7,10 @@ export function GET() {
 }
 
 export async function PUT({ request }: { request: Request }) {
-    const body = await request.json().catch(() => null);
+    const body = await jsonBody(request).catch((cause) => {
+        if (isHttpError(cause, 413)) throw cause;
+        return null;
+    });
     try {
         const id = saveServerKey(body?.game, body?.plutoKey, body?.label);
         return json({ ok: true, id });
@@ -16,7 +20,10 @@ export async function PUT({ request }: { request: Request }) {
 }
 
 export async function DELETE({ request }: { request: Request }) {
-    const body = await request.json().catch(() => null);
+    const body = await jsonBody(request).catch((cause) => {
+        if (isHttpError(cause, 413)) throw cause;
+        return null;
+    });
     if (typeof body?.id !== 'string' || !body.id.trim() || body.id.length > 128)
         return json({ error: 'Invalid key ID' }, { status: 400 });
     try {

src/routes/api/servers/+server.ts

@@ -1,6 +1,7 @@
+import { jsonBody } from '$lib/server/request-body.js';
 import { fleetSnapshot } from '$lib/server/fleet/snapshot.js';
 import { kickProvisioning } from '$lib/server/pipeline/worker.js';
-import { json } from '@sveltejs/kit';
+import { isHttpError, json } from '@sveltejs/kit';
 import { queueCreateServer } from '$lib/server/provisioning/index.js';
 import type { GameMode, ZombieGame } from '$lib/server/fleet/map-aliases.js';
 
@@ -9,7 +10,10 @@ export function GET() {
 }
 
 export async function POST({ request }: { request: Request }) {
-    const body = (await request.json().catch(() => ({}))) as {
+    const body = (await jsonBody(request).catch((cause) => {
+        if (isHttpError(cause, 413)) throw cause;
+        return {};
+    })) as {
         hostId?: string;
         libraryId?: string;
         image?: string;

src/routes/api/settings/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { validateFleetSettings, concurrencyKeys, retentionKeys } from '$lib/fleet-settings.js';
 import { fleetSettings, saveFleetSettings } from '$lib/server/settings.js';
 
@@ -9,8 +10,9 @@ export function GET() {
 export async function PUT({ request }: { request: Request }) {
     let settings;
     try {
-        settings = validateFleetSettings(await request.json());
+        settings = validateFleetSettings(await jsonBody(request));
     } catch (error) {
+        if (isHttpError(error, 413)) throw error;
         return json({ error: (error as Error).message }, { status: 400 });
     }
     return json(saveFleetSettings(settings));
@@ -18,7 +20,7 @@ export async function PUT({ request }: { request: Request }) {
 
 export async function PATCH({ request }: { request: Request }) {
     try {
-        const { section, values } = await request.json();
+        const { section, values } = await jsonBody(request);
         const keys =
             section === 'Concurrency'
                 ? concurrencyKeys
@@ -37,6 +39,7 @@ export async function PATCH({ request }: { request: Request }) {
             throw new Error('Provide all settings for one section.');
         return json(saveFleetSettings({ ...fleetSettings(), ...values }));
     } catch (error) {
+        if (isHttpError(error, 413)) throw error;
         return json({ error: (error as Error).message }, { status: 400 });
     }
 }

src/routes/api/settings/retention/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import {
     retentionPreview,
     retentionControls,
@@ -22,9 +23,10 @@ export function GET() {
 }
 export async function POST({ request }: { request: Request }) {
     try {
-        setRetentionControl(await request.json());
+        setRetentionControl(await jsonBody(request));
         return json({ ok: true });
     } catch (error) {
+        if (isHttpError(error, 413)) throw error;
         return json({ error: (error as Error).message }, { status: 400 });
     }
 }

src/routes/api/settings/retention/preview/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { validateFleetSettings } from '$lib/fleet-settings.js';
 import {
     retentionPreview,
@@ -8,7 +9,7 @@ import {
 import { gameFileRetentionPreview } from '$lib/server/game-files/index.js';
 export async function POST({ request }: { request: Request }) {
     try {
-        const settings = validateFleetSettings(await request.json());
+        const settings = validateFleetSettings(await jsonBody(request));
         return json(
             {
                 policies: [
@@ -21,6 +22,7 @@ export async function POST({ request }: { request: Request }) {
             { headers: { 'Cache-Control': 'no-store' } }
         );
     } catch (error) {
+        if (isHttpError(error, 413)) throw error;
         return json({ error: (error as Error).message }, { status: 400 });
     }
 }

src/routes/api/telemetry/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { parseGameEvent, type GameTelemetry } from '$lib/telemetry.js';
 import { getServer } from '$lib/server/fleet/servers.js';
 import { saveTelemetry } from '$lib/server/fleet/telemetry.js';
@@ -26,8 +27,9 @@ export async function POST({ request }: { request: Request }) {
     let value: unknown;
     let malformed = false;
     try {
-        value = await request.json();
-    } catch {
+        value = await jsonBody(request);
+    } catch (cause) {
+        if (isHttpError(cause, 413)) throw cause;
         malformed = true;
     }
 

src/routes/api/watchdog/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { watchdogOverview, watchdogTick, setWatchdogEnabled } from '$lib/server/watchdog/index.js';
 import { kick } from '$lib/server/pipeline/worker.js';
 
@@ -6,7 +7,10 @@ export function GET() {
     return json(watchdogOverview());
 }
 export async function POST({ request }: { request: Request }) {
-    const body = await request.json().catch(() => null);
+    const body = await jsonBody(request).catch((cause) => {
+        if (isHttpError(cause, 413)) throw cause;
+        return null;
+    });
     if (
         !body ||
         typeof body !== 'object' ||

src/routes/api/watchdog/[id]/+server.ts

@@ -1,4 +1,5 @@
-import { json } from '@sveltejs/kit';
+import { jsonBody } from '$lib/server/request-body.js';
+import { isHttpError, json } from '@sveltejs/kit';
 import { watchdogDetail, updateWatchdogIncident } from '$lib/server/watchdog/index.js';
 import { kick } from '$lib/server/pipeline/worker.js';
 
@@ -7,7 +8,10 @@ export function GET({ params }: { params: { id: string } }) {
     return detail ? json(detail) : json({ error: 'Watchdog incident not found.' }, { status: 404 });
 }
 export async function POST({ params, request }: { params: { id: string }; request: Request }) {
-    const body = await request.json().catch(() => null);
+    const body = await jsonBody(request).catch((cause) => {
+        if (isHttpError(cause, 413)) throw cause;
+        return null;
+    });
     if (!body || !['retry', 'dismiss'].includes(body.action))
         return json({ error: 'Choose retry or dismiss.' }, { status: 400 });
     const result = updateWatchdogIncident(params.id, body.action);