cursedbelt-core 2.10.0 → 2.12.0

package/dist/core/navigation/navigationSelectors.d.ts

@@ -4,6 +4,12 @@ import { type GateFn, type NavDomain, type NavGroup, type NavItem, type Navigati
  * `#tab=…` in-page target), and a trailing slash. `'/'` stays `'/'`. Used so a tab
  * variant (`/tools#tab=curl`) matches the base route (`/tools`) and `/lists/`
  * matches `/lists`.
+ *
+ * 🔴 A HASH ROUTE is the route, not an in-page target: `#/queue` and `/#/queue/x.md` are
+ * matched on `/queue` and `/queue/x.md`. Until 2.12.0 they were cut at the `#` like a tab
+ * variant, so every place of a hash-routed app normalized to `/` and `SideNav` lit ALL of them
+ * (station's first `AppShell`, 2026-10-02). The fragment is the route only when nothing but `/`
+ * stands before it and it starts with `/` — `/tools#tab=curl` is still `/tools`.
  */
 export declare function normalizeNavPath(path: string): string;
 /** A flattened, gated catalogue entry — a leaf plus where it lives (for grouping). */

package/dist/core/navigation/navigationSelectors.js

@@ -9,12 +9,22 @@ import { allowAllGate, } from './navigationModel.js';
  * `#tab=…` in-page target), and a trailing slash. `'/'` stays `'/'`. Used so a tab
  * variant (`/tools#tab=curl`) matches the base route (`/tools`) and `/lists/`
  * matches `/lists`.
+ *
+ * 🔴 A HASH ROUTE is the route, not an in-page target: `#/queue` and `/#/queue/x.md` are
+ * matched on `/queue` and `/queue/x.md`. Until 2.12.0 they were cut at the `#` like a tab
+ * variant, so every place of a hash-routed app normalized to `/` and `SideNav` lit ALL of them
+ * (station's first `AppShell`, 2026-10-02). The fragment is the route only when nothing but `/`
+ * stands before it and it starts with `/` — `/tools#tab=curl` is still `/tools`.
  */
 export function normalizeNavPath(path) {
     // Null-safe: a nav selector must never throw (a breadcrumb derivation crashing
     // white-screens the whole page). Coerce a missing/non-string path to ''.
     const s = typeof path === 'string' ? path : '';
-    let p = (s.split('#')[0] ?? '').split('?')[0]?.trim() ?? '';
+    const hashAt = s.indexOf('#');
+    const before = hashAt === -1 ? s : s.slice(0, hashAt);
+    const fragment = hashAt === -1 ? '' : s.slice(hashAt + 1);
+    const route = (before === '' || before === '/') && fragment.startsWith('/') ? fragment : before;
+    let p = route.split('?')[0]?.trim() ?? '';
     if (p.length > 1 && p.endsWith('/'))
         p = p.slice(0, -1);
     return p || '/';

package/dist/core/searchPattern.d.ts

@@ -112,4 +112,4 @@ export declare function createSearchMatcher(raw: string, options?: SearchSyntaxO
  * Case is left as typed. SQLite's `LIKE` is already case-insensitive for ASCII;
  * a database whose `LIKE` is not (Postgres) should use `ILIKE` with the same string.
  */
-export declare function searchPatternToLike(pattern: SearchPattern, escape?: string): string | null;
+export declare function searchPatternToLike(pattern: SearchPattern, escapeChar?: string): string | null;

package/dist/core/searchPattern.js

@@ -132,9 +132,9 @@ export function createSearchMatcher(raw, options = {}) {
  * Case is left as typed. SQLite's `LIKE` is already case-insensitive for ASCII;
  * a database whose `LIKE` is not (Postgres) should use `ILIKE` with the same string.
  */
-export function searchPatternToLike(pattern, escape = '\\') {
-    const literal = (text) => text.replace(/[%_]/g, (c) => `${escape}${c}`);
-    const escapeAll = (text) => literal(text.split(escape).join(`${escape}${escape}`));
+export function searchPatternToLike(pattern, escapeChar = '\\') {
+    const literal = (text) => text.replace(/[%_]/g, (c) => `${escapeChar}${c}`);
+    const escapeAll = (text) => literal(text.split(escapeChar).join(`${escapeChar}${escapeChar}`));
     switch (pattern.kind) {
         case 'plain':
             return `%${escapeAll(pattern.text)}%`;

package/dist/ctgrClient/convertRequest.js

@@ -8,9 +8,10 @@
  */
 import { encodeRequest, METHOD_TO_ABBREV, toBase64, } from '../ctgr/index.js';
 import { isCtgrModeOn } from './ctgrConfig.js';
-// 10 MB per-file cap for GET-only mode. base64 + URL transport inflates each file and
-// needs many sequential GETs per MB; beyond this the upload hangs/OOMs on mobile.
-const CTGR_MAX_FILE_BYTES = 10 * 1024 * 1024;
+// 7 MB per-file cap for GET-only mode. A file rides as base64 inside JSON — a third
+// larger — and both chunk stores refuse a payload over 10 MB, so a 10 MB file was let
+// through here only to be refused by the server after its first chunk.
+const CTGR_MAX_FILE_BYTES = 7 * 1024 * 1024;
 const SAFE_METHODS = new Set(['GET', 'HEAD']);
 /**
  * Convert one request for the tunnel. Returns the chunked GET requests to send in

package/dist/ctgrClient/ctgrGuard.js

@@ -70,13 +70,11 @@ export const installCtgrGuard = () => {
     // ── XMLHttpRequest ───────────────────────────────────────────────────────────
     if (typeof XMLHttpRequest !== 'undefined') {
         const originalOpen = XMLHttpRequest.prototype.open;
-        // biome-ignore lint/suspicious/noExplicitAny: matching XHR.open's variadic overloads
         XMLHttpRequest.prototype.open = function open(method, url, ...rest) {
             const upper = String(method).toUpperCase();
             if (isCtgrModeOn() && !SAFE_METHODS.has(upper) && isGuardedPath(String(url))) {
                 throw block();
             }
-            // biome-ignore lint/suspicious/noExplicitAny: forwarding the original variadic call
             return originalOpen.call(this, method, url, ...rest);
         };
     }

package/dist/ctgrClient/index.d.ts

@@ -1,3 +1,4 @@
 export { applyCtgrFromLocation, applyCtgrIntent, isCtgrModeOn, readCtgrIntent, setCtgrMode, } from './ctgrConfig.js';
 export { type CtgrFetchRequest, convertIfOnlyGETRequests } from './convertRequest.js';
 export { installCtgrGuard } from './ctgrGuard.js';
+export { CTGR_INCOMPLETE_STATUS, type CtgrSend, type SendCtgrOptions, sendCtgrRequests, } from './sendRequests.js';

package/dist/ctgrClient/index.js

@@ -3,13 +3,15 @@
  * GET-only client:
  *   • the per-device mode flag + the `?ctgr=t|f` boot toggle (`ctgrConfig`),
  *   • the request converter that rewrites a mutation into `/ctgr<xx>` GET twins,
+ *   • the sender that puts those twins on the wire and answers with the one real response,
  *   • the network-boundary guard that blocks a stray raw verb.
  *
  * The wire codec is `cursedbelt-core/ctgr`; the server that decodes the twins is
  * `cursedbelt-server` (`mountCtgrTunnel`). A site opts in with two boot calls —
  * `applyCtgrFromLocation()` then `installCtgrGuard()` — and routes its requests
- * through `convertIfOnlyGETRequests`.
+ * through `convertIfOnlyGETRequests`, then `sendCtgrRequests`.
  */
 export { applyCtgrFromLocation, applyCtgrIntent, isCtgrModeOn, readCtgrIntent, setCtgrMode, } from './ctgrConfig.js';
 export { convertIfOnlyGETRequests } from './convertRequest.js';
 export { installCtgrGuard } from './ctgrGuard.js';
+export { CTGR_INCOMPLETE_STATUS, sendCtgrRequests, } from './sendRequests.js';

package/dist/ctgrClient/sendRequests.d.ts

@@ -0,0 +1,12 @@
+import type { CtgrFetchRequest } from './convertRequest.js';
+/** How the caller puts one request on the wire — its own `fetch`, with its own headers. */
+export type CtgrSend = (request: CtgrFetchRequest) => Promise<Response>;
+export interface SendCtgrOptions {
+    /** Chunks in flight at once. Default 4 — fast, and gentle on an edge's rate limits. */
+    concurrency?: number;
+    /** Told after each chunk is acknowledged, for a progress bar: `(sent, total)`. */
+    onProgress?: (sent: number, total: number) => void;
+}
+/** The status a last chunk is given when the server still answers "waiting for more". */
+export declare const CTGR_INCOMPLETE_STATUS = 502;
+export declare function sendCtgrRequests(requests: readonly CtgrFetchRequest[], send: CtgrSend, options?: SendCtgrOptions): Promise<Response>;

package/dist/ctgrClient/sendRequests.js

@@ -0,0 +1,44 @@
+/** The status a last chunk is given when the server still answers "waiting for more". */
+export const CTGR_INCOMPLETE_STATUS = 502;
+export async function sendCtgrRequests(requests, send, options = {}) {
+    const first = requests[0];
+    if (!first)
+        throw new Error('ctgr: no request to send');
+    const total = requests.length;
+    if (total === 1) {
+        const only = await send(first);
+        options.onProgress?.(1, 1);
+        return only;
+    }
+    const concurrency = Math.max(1, Math.floor(options.concurrency ?? 4));
+    const pieces = requests.slice(0, -1);
+    let next = 0;
+    let sent = 0;
+    let refusal = null;
+    const worker = async () => {
+        while (refusal === null && next < pieces.length) {
+            const piece = pieces[next++];
+            const response = await send(piece);
+            if (response.status !== 202 && !response.ok) {
+                refusal ??= response;
+                return;
+            }
+            // An intermediate's body is `{acknowledged:true}`; read it so the connection frees.
+            await response.body?.cancel().catch(() => undefined);
+            options.onProgress?.(++sent, total);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(concurrency, pieces.length) }, worker));
+    if (refusal)
+        return refusal;
+    const last = await send(requests[total - 1]);
+    if (last.status === 202) {
+        await last.body?.cancel().catch(() => undefined);
+        return Response.json({
+            error: 'The server did not receive every piece of this request — nothing was saved. Send it again.',
+            code: 'CTGR_INCOMPLETE',
+        }, { status: CTGR_INCOMPLETE_STATUS });
+    }
+    options.onProgress?.(total, total);
+    return last;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-core",
-	"version": "2.10.0",
+	"version": "2.12.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "Framework-agnostic core of the cursedbelt split — isomorphic domain logic. cwip below it, cursedbelt-server and cursedbelt (react) above it.",
@@ -23,7 +23,8 @@
 		"paths": "bun run scripts/paths.ts",
 		"verify": "bun run gate",
 		"prepublishOnly": "bun run gate --force",
-		"gate": "bun run scripts/paths.ts --only gate.ts"
+		"gate": "bun run scripts/paths.ts --only gate.ts",
+		"lint": "biome check --error-on-warnings ."
 	},
 	"files": [
 		"dist",
@@ -393,19 +394,22 @@
 		"zod": "^4.4.0"
 	},
 	"devDependencies": {
-		"@biomejs/biome": "^2.5.0",
+		"@biomejs/biome": "^2.5.14",
+		"@happy-dom/global-registrator": "^20.10.6",
 		"@types/bun": "^1.3.14",
 		"@types/node": "^24",
+		"hono": "4.12.28",
 		"typescript": "^6.0.3",
-		"zod": "4.4.3",
-		"@happy-dom/global-registrator": "^20.10.6",
-		"hono": "4.12.28"
+		"zod": "4.4.3"
 	},
 	"gate": {
 		"stages": [
 			{
 				"script": "paths"
 			},
+			{
+				"script": "lint"
+			},
 			{
 				"script": "typecheck"
 			},

package/src/core/navigation/navigation.spec.ts

@@ -131,6 +131,16 @@ describe('normalizeNavPath', () => {
     expect(normalizeNavPath('/')).toBe('/');
     expect(normalizeNavPath('/admin/users')).toBe('/admin/users');
   });
+
+  test('a hash route IS the route — every place of a hash-routed app must not collapse to /', () => {
+    expect(normalizeNavPath('#/queue')).toBe('/queue');
+    expect(normalizeNavPath('/#/queue/Not_Started/x.md')).toBe('/queue/Not_Started/x.md');
+    expect(normalizeNavPath('#/queue?folder=Blocked')).toBe('/queue');
+    expect(normalizeNavPath('#/')).toBe('/');
+    // An in-page target after a real path is still a tab variant, not a route.
+    expect(normalizeNavPath('/tools#/not-a-route')).toBe('/tools');
+    expect(normalizeNavPath('#section')).toBe('/');
+  });
 });
 
 describe('deriveSideNavDomains', () => {

package/src/core/navigation/navigationSelectors.ts

@@ -18,12 +18,22 @@ import {
  * `#tab=…` in-page target), and a trailing slash. `'/'` stays `'/'`. Used so a tab
  * variant (`/tools#tab=curl`) matches the base route (`/tools`) and `/lists/`
  * matches `/lists`.
+ *
+ * 🔴 A HASH ROUTE is the route, not an in-page target: `#/queue` and `/#/queue/x.md` are
+ * matched on `/queue` and `/queue/x.md`. Until 2.12.0 they were cut at the `#` like a tab
+ * variant, so every place of a hash-routed app normalized to `/` and `SideNav` lit ALL of them
+ * (station's first `AppShell`, 2026-10-02). The fragment is the route only when nothing but `/`
+ * stands before it and it starts with `/` — `/tools#tab=curl` is still `/tools`.
  */
 export function normalizeNavPath(path: string): string {
   // Null-safe: a nav selector must never throw (a breadcrumb derivation crashing
   // white-screens the whole page). Coerce a missing/non-string path to ''.
   const s = typeof path === 'string' ? path : '';
-  let p = (s.split('#')[0] ?? '').split('?')[0]?.trim() ?? '';
+  const hashAt = s.indexOf('#');
+  const before = hashAt === -1 ? s : s.slice(0, hashAt);
+  const fragment = hashAt === -1 ? '' : s.slice(hashAt + 1);
+  const route = (before === '' || before === '/') && fragment.startsWith('/') ? fragment : before;
+  let p = route.split('?')[0]?.trim() ?? '';
   if (p.length > 1 && p.endsWith('/')) p = p.slice(0, -1);
   return p || '/';
 }

package/src/core/searchPattern.ts

@@ -165,9 +165,9 @@ export function createSearchMatcher(
  * Case is left as typed. SQLite's `LIKE` is already case-insensitive for ASCII;
  * a database whose `LIKE` is not (Postgres) should use `ILIKE` with the same string.
  */
-export function searchPatternToLike(pattern: SearchPattern, escape = '\\'): string | null {
-	const literal = (text: string) => text.replace(/[%_]/g, (c) => `${escape}${c}`);
-	const escapeAll = (text: string) => literal(text.split(escape).join(`${escape}${escape}`));
+export function searchPatternToLike(pattern: SearchPattern, escapeChar = '\\'): string | null {
+	const literal = (text: string) => text.replace(/[%_]/g, (c) => `${escapeChar}${c}`);
+	const escapeAll = (text: string) => literal(text.split(escapeChar).join(`${escapeChar}${escapeChar}`));
 	switch (pattern.kind) {
 		case 'plain':
 			return `%${escapeAll(pattern.text)}%`;

package/src/ctgrClient/convertRequest.ts

@@ -22,9 +22,10 @@ export interface CtgrFetchRequest {
   init: RequestInit;
 }
 
-// 10 MB per-file cap for GET-only mode. base64 + URL transport inflates each file and
-// needs many sequential GETs per MB; beyond this the upload hangs/OOMs on mobile.
-const CTGR_MAX_FILE_BYTES = 10 * 1024 * 1024;
+// 7 MB per-file cap for GET-only mode. A file rides as base64 inside JSON — a third
+// larger — and both chunk stores refuse a payload over 10 MB, so a 10 MB file was let
+// through here only to be refused by the server after its first chunk.
+const CTGR_MAX_FILE_BYTES = 7 * 1024 * 1024;
 
 const SAFE_METHODS = new Set(['GET', 'HEAD']);
 

package/src/ctgrClient/ctgrGuard.ts

@@ -73,13 +73,11 @@ export const installCtgrGuard = (): void => {
   // ── XMLHttpRequest ───────────────────────────────────────────────────────────
   if (typeof XMLHttpRequest !== 'undefined') {
     const originalOpen = XMLHttpRequest.prototype.open;
-    // biome-ignore lint/suspicious/noExplicitAny: matching XHR.open's variadic overloads
     XMLHttpRequest.prototype.open = function open(method: string, url: string, ...rest: any[]) {
       const upper = String(method).toUpperCase();
       if (isCtgrModeOn() && !SAFE_METHODS.has(upper) && isGuardedPath(String(url))) {
         throw block();
       }
-      // biome-ignore lint/suspicious/noExplicitAny: forwarding the original variadic call
       return (originalOpen as any).call(this, method, url, ...rest);
     };
   }

package/src/ctgrClient/index.ts

@@ -3,12 +3,13 @@
  * GET-only client:
  *   • the per-device mode flag + the `?ctgr=t|f` boot toggle (`ctgrConfig`),
  *   • the request converter that rewrites a mutation into `/ctgr<xx>` GET twins,
+ *   • the sender that puts those twins on the wire and answers with the one real response,
  *   • the network-boundary guard that blocks a stray raw verb.
  *
  * The wire codec is `cursedbelt-core/ctgr`; the server that decodes the twins is
  * `cursedbelt-server` (`mountCtgrTunnel`). A site opts in with two boot calls —
  * `applyCtgrFromLocation()` then `installCtgrGuard()` — and routes its requests
- * through `convertIfOnlyGETRequests`.
+ * through `convertIfOnlyGETRequests`, then `sendCtgrRequests`.
  */
 export {
   applyCtgrFromLocation,
@@ -19,3 +20,9 @@ export {
 } from './ctgrConfig.js';
 export { type CtgrFetchRequest, convertIfOnlyGETRequests } from './convertRequest.js';
 export { installCtgrGuard } from './ctgrGuard.js';
+export {
+  CTGR_INCOMPLETE_STATUS,
+  type CtgrSend,
+  type SendCtgrOptions,
+  sendCtgrRequests,
+} from './sendRequests.js';

package/src/ctgrClient/sendRequests.spec.ts

@@ -0,0 +1,85 @@
+import { beforeEach, describe, expect, test } from 'bun:test';
+import { ChunkStore } from '../ctgr/chunkStore.js';
+import { type CtgrFetchRequest, convertIfOnlyGETRequests, sendCtgrRequests, setCtgrMode } from './index.js';
+
+beforeEach(() => {
+  localStorage.clear();
+  setCtgrMode(true);
+});
+
+/** A multi-chunk upload: random bytes do not gzip, so 40 KB is a couple of dozen chunks. */
+async function upload(): Promise<CtgrFetchRequest[]> {
+  const bytes = new Uint8Array(40_000);
+  crypto.getRandomValues(bytes);
+  const form = new FormData();
+  form.append('file', new File([bytes], 'shot.png', { type: 'image/png' }));
+  const { requests } = await convertIfOnlyGETRequests('/api/v1/library/assets', { method: 'POST', body: form });
+  expect(requests.length).toBeGreaterThan(10);
+  return requests;
+}
+
+/** The server half, as `mountCtgrTunnel` answers: 202 per piece, the real response at the end. */
+function server(store = new ChunkStore()) {
+  let inFlight = 0;
+  let peak = 0;
+  const seen: number[] = [];
+  const send = async (request: CtgrFetchRequest): Promise<Response> => {
+    inFlight++;
+    peak = Math.max(peak, inFlight);
+    await Bun.sleep(Math.random() * 3);
+    const params = new URL(request.url, 'http://x').searchParams;
+    seen.push(Number(params.get('_ci')));
+    const result = await store.add(params);
+    inFlight--;
+    if (result === false) return Response.json({ acknowledged: true }, { status: 202 });
+    if (result instanceof Error) return Response.json({ error: result.message }, { status: 400 });
+    return Response.json({ id: 'asset-1', name: result.files?.[0]?.originalname }, { status: 201 });
+  };
+  return { send, seen, peak: () => peak };
+}
+
+describe('sendCtgrRequests', () => {
+  test('sends the pieces several at a time and answers with the real response', async () => {
+    const requests = await upload();
+    const { send, seen, peak } = server();
+    const progress: number[] = [];
+    const response = await sendCtgrRequests(requests, send, { onProgress: (sent) => progress.push(sent) });
+    expect(response.status).toBe(201);
+    expect(await response.json()).toEqual({ id: 'asset-1', name: 'shot.png' });
+    expect(peak()).toBe(4);
+    expect(seen.at(-1)).toBe(requests.length - 1);
+    expect(progress.at(-1)).toBe(requests.length);
+  });
+
+  test('🔴 a piece the server lost is a 502, never the 202 `{acknowledged:true}` a caller would read as the result', async () => {
+    const requests = await upload();
+    const { send } = server();
+    const losing = (request: CtgrFetchRequest): Promise<Response> =>
+      new URL(request.url, 'http://x').searchParams.get('_ci') === '3'
+        ? Promise.resolve(Response.json({ acknowledged: true }, { status: 202 }))
+        : send(request);
+    const response = await sendCtgrRequests(requests, losing);
+    expect(response.ok).toBe(false);
+    expect(response.status).toBe(502);
+    expect(((await response.json()) as { code: string }).code).toBe('CTGR_INCOMPLETE');
+  });
+
+  test('the first refusal stops the send and is the answer', async () => {
+    const requests = await upload();
+    let calls = 0;
+    const refusing = async (request: CtgrFetchRequest): Promise<Response> => {
+      calls++;
+      return new URL(request.url, 'http://x').searchParams.get('_ci') === '0'
+        ? Response.json({ error: 'nope' }, { status: 503 })
+        : Response.json({ acknowledged: true }, { status: 202 });
+    };
+    const response = await sendCtgrRequests(requests, refusing, { concurrency: 1 });
+    expect(response.status).toBe(503);
+    expect(calls).toBe(1);
+  });
+
+  test('one request is sent as it is', async () => {
+    const response = await sendCtgrRequests([{ url: '/api/v1/x', init: { method: 'GET' } }], async () => new Response('hi'));
+    expect(await response.text()).toBe('hi');
+  });
+});

package/src/ctgrClient/sendRequests.ts

@@ -0,0 +1,87 @@
+/*
+ * Send what `convertIfOnlyGETRequests` produced, and answer with the ONE response that
+ * stands for the original request.
+ *
+ * Every client used to write this as `for (const req of requests) res = await fetch(…)`,
+ * and that loop had two faults that together made a GET-only upload vanish (desk, task
+ * "component attachment not attached", 2026-10-01):
+ *
+ *  1. **A 202 read as success.** The server answers 202 `{acknowledged:true}` to every
+ *     chunk until it holds them all. If one chunk is refused (a 400, a 503 from the chunk
+ *     store) or a partial is lost (an evicted object, a deploy), the loop kept going and
+ *     the LAST chunk answered 202 — `ok` — so the caller parsed `{acknowledged:true}` as
+ *     the created thing. desk stored an attachment id of `undefined`: no error, no file.
+ *  2. **One round trip per 1.8 KB, in series.** A 2 MB screenshot is ~1,500 GETs; at a
+ *     remote device's ~100 ms each that is minutes with nothing to show for it.
+ *
+ * So: every chunk but the last goes out `concurrency` at a time (both chunk stores accept
+ * chunks in any order — `ChunkStore` and the Worker's `CtgrChunkObject` file each by
+ * `_ci`), the first refusal stops the send and IS the answer, and the last chunk goes
+ * alone once the rest are acknowledged. A last chunk that still answers 202 means the
+ * server lost pieces, and that becomes a 502 the caller's ordinary error path reports.
+ */
+import type { CtgrFetchRequest } from './convertRequest.js';
+
+/** How the caller puts one request on the wire — its own `fetch`, with its own headers. */
+export type CtgrSend = (request: CtgrFetchRequest) => Promise<Response>;
+
+export interface SendCtgrOptions {
+  /** Chunks in flight at once. Default 4 — fast, and gentle on an edge's rate limits. */
+  concurrency?: number;
+  /** Told after each chunk is acknowledged, for a progress bar: `(sent, total)`. */
+  onProgress?: (sent: number, total: number) => void;
+}
+
+/** The status a last chunk is given when the server still answers "waiting for more". */
+export const CTGR_INCOMPLETE_STATUS = 502;
+
+export async function sendCtgrRequests(
+  requests: readonly CtgrFetchRequest[],
+  send: CtgrSend,
+  options: SendCtgrOptions = {},
+): Promise<Response> {
+  const first = requests[0];
+  if (!first) throw new Error('ctgr: no request to send');
+  const total = requests.length;
+  if (total === 1) {
+    const only = await send(first);
+    options.onProgress?.(1, 1);
+    return only;
+  }
+
+  const concurrency = Math.max(1, Math.floor(options.concurrency ?? 4));
+  const pieces = requests.slice(0, -1);
+  let next = 0;
+  let sent = 0;
+  let refusal: Response | null = null;
+
+  const worker = async (): Promise<void> => {
+    while (refusal === null && next < pieces.length) {
+      const piece = pieces[next++] as CtgrFetchRequest;
+      const response = await send(piece);
+      if (response.status !== 202 && !response.ok) {
+        refusal ??= response;
+        return;
+      }
+      // An intermediate's body is `{acknowledged:true}`; read it so the connection frees.
+      await response.body?.cancel().catch(() => undefined);
+      options.onProgress?.(++sent, total);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(concurrency, pieces.length) }, worker));
+  if (refusal) return refusal;
+
+  const last = await send(requests[total - 1] as CtgrFetchRequest);
+  if (last.status === 202) {
+    await last.body?.cancel().catch(() => undefined);
+    return Response.json(
+      {
+        error: 'The server did not receive every piece of this request — nothing was saved. Send it again.',
+        code: 'CTGR_INCOMPLETE',
+      },
+      { status: CTGR_INCOMPLETE_STATUS },
+    );
+  }
+  options.onProgress?.(total, total);
+  return last;
+}