fix: skip body parsers for multipart/form-data requests

express.json() and express.urlencoded() consume the request stream before
multer can read it, causing "Unexpected end of form" on media upload.
Skip these parsers when content-type is multipart/form-data.

lib/mastodon/router.js

@@ -67,9 +67,18 @@ export function createMastodonRouter({ collections, pluginOptions = {} }) {
 
   // ─── Body parsers ───────────────────────────────────────────────────────
   // Mastodon clients send JSON, form-urlencoded, and occasionally text/plain.
-  // These must be applied before route handlers.
-  router.use("/api", express.json());
-  router.use("/api", express.urlencoded({ extended: true }));
+  // Skip multipart/form-data requests — multer handles those in media routes.
+  // If express.json/urlencoded consume the stream first, multer gets nothing.
+  const jsonParser = express.json();
+  const urlencodedParser = express.urlencoded({ extended: true });
+  router.use("/api", (req, res, next) => {
+    if (req.is("multipart/form-data")) return next();
+    jsonParser(req, res, next);
+  });
+  router.use("/api", (req, res, next) => {
+    if (req.is("multipart/form-data")) return next();
+    urlencodedParser(req, res, next);
+  });
   router.use("/oauth", express.json());
   router.use("/oauth", express.urlencoded({ extended: true }));
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.11.1",
+  "version": "3.11.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@rmdes/indiekit-endpoint-activitypub",
-      "version": "3.11.1",
+      "version": "3.11.2",
       "license": "MIT",
       "dependencies": {
         "@fedify/debugger": "^2.1.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-activitypub",
-  "version": "3.11.1",
+  "version": "3.11.2",
   "description": "ActivityPub federation endpoint for Indiekit via Fedify. Adds full fediverse support: actor, inbox, outbox, followers, following, syndication, and Mastodon migration.",
   "keywords": [
     "indiekit",