Function read_capped 

pub async fn read_capped(
    store: &Arc<dyn ObjectStore>,
    key: &Path,
    max_bytes: u64,
) -> Result<Bytes, ObjectStoreError>

Read a whole object, and reject it if its size exceeds max_bytes.

The function does a head() first, so it refuses an oversized object before it buffers any bytes. This is the guard against OOM on a corrupt or malicious object. The GET uses the HEAD version and etag when available. Its response size and streamed chunks are also checked, so an overwrite cannot bypass the cap.

Errors

• ObjectStoreError::TooLarge if the object is larger than max_bytes.
• ObjectStoreError::NotFound if the object does not exist.
• ObjectStoreError::Precondition if its etag changed after the HEAD.
• ObjectStoreError::Backend for any other backend failure.