cursedbelt-server 4.32.1 → 4.33.0

package/dist/server/storage/binaryStore.d.ts

@@ -38,6 +38,18 @@ export interface BinaryStoreConfig {
     absenceTtlMs?: number;
     /** Injected so the memo's expiry is testable without a real clock. */
     now?: () => number;
+    /**
+     * 🔴 How THIS PROCESS sends every request to binary-server. Default: the global `fetch`.
+     *
+     * A Cloudflare Worker on the SAME ZONE as binary-server must pass its service binding to
+     * `binary-server-edge-gate` here (`(input, init) => env.BINARY_SERVER.fetch(input, init)`).
+     * A same-zone subrequest skips every other Worker's route and goes straight to the zone's
+     * ORIGIN — the byte tunnel into the owner's Mac — so a global `fetch` never reached the edge
+     * Worker, its R2 reads or its cache. Measured 2026-09-25: the owner powered the Mac off and
+     * every face on family's tree was gone, although family's bytes rest in R2. Auth met the same
+     * trap first (task 2150); this is the byte half of it.
+     */
+    fetch?: (input: string | Request, init?: RequestInit) => Promise<Response>;
 }
 /**
  * Which keys this process has read from the wire far too often, worst first —

package/dist/server/storage/binaryStore.js

@@ -260,6 +260,7 @@ export function createBinaryStore(cfg) {
      * and is named as the remaining gap.
      */
     const internalBaseUrl = (cfg.internalBaseUrl ?? cfg.baseUrl).replace(/\/+$/, '');
+    const send = cfg.fetch ?? ((input, init) => fetch(input, init));
     const autoChunkBytes = cfg.autoChunkBytes ?? AUTO_CHUNK_THRESHOLD_BYTES;
     const now = cfg.now ?? Date.now;
     const absenceTtlMs = cfg.absenceTtlMs ?? BINARY_ABSENCE_TTL_MS;
@@ -425,7 +426,7 @@ export function createBinaryStore(cfg) {
             const title = opts?.title?.trim();
             const titleQs = title ? `&title=${encodeURIComponent(title)}` : '';
             const immutableQs = opts?.immutable ? '&immutable=1' : '';
-            const res = await fetch(`${baseUrl}/upload/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}${titleQs}${immutableQs}`, {
+            const res = await send(`${baseUrl}/upload/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}${titleQs}${immutableQs}`, {
                 method: 'PUT',
                 headers: mime ? { 'content-type': mime } : undefined,
                 body: bytes,
@@ -494,7 +495,7 @@ export function createBinaryStore(cfg) {
                 const slice = new Uint8Array(await blob
                     .slice(ci * chunkBytes, Math.min((ci + 1) * chunkBytes, blob.size))
                     .arrayBuffer());
-                const res = await fetch(`${baseUrl}/upload-chunk/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}${titleQs}${immutableQs}`, {
+                const res = await send(`${baseUrl}/upload-chunk/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}${titleQs}${immutableQs}`, {
                     method: 'PUT',
                     headers: mime ? { 'content-type': mime } : undefined,
                     body: slice,
@@ -513,7 +514,7 @@ export function createBinaryStore(cfg) {
             if (!opts?.fresh && knownAbsent(key))
                 return null;
             countWireRead(key);
-            const res = await fetch(await internalMediaUrl(key));
+            const res = await send(await internalMediaUrl(key));
             if (res.status === 404) {
                 rememberAbsent(key);
                 return null;
@@ -572,7 +573,7 @@ export function createBinaryStore(cfg) {
             // of the URL, so a fresh one per request would defeat every cache between here and
             // the object — see MediaUrlOptions.stableWindowSeconds.
             const url = await internalMediaUrl(key, { stableWindowSeconds: 60 * 60 });
-            return await fetch(url, {
+            return await send(url, {
                 method: init?.method ?? 'GET',
                 // 🔴 Only when the caller HAS one. `Range: undefined` is fine, but a literal
                 // empty string is a malformed header that some origins answer 416 to.
@@ -589,7 +590,7 @@ export function createBinaryStore(cfg) {
                     return null;
             }
             countWireRead(key);
-            const res = await fetch(await metaUrl(key));
+            const res = await send(await metaUrl(key));
             if (res.status === 404) {
                 rememberAbsent(key);
                 return null;
@@ -633,7 +634,7 @@ export function createBinaryStore(cfg) {
                 // A transport/5xx failure — the probe below is the second opinion.
             }
             countWireRead(key);
-            const res = await fetch(await internalMediaUrl(key), { headers: { Range: 'bytes=0-0' } });
+            const res = await send(await internalMediaUrl(key), { headers: { Range: 'bytes=0-0' } });
             if (res.status === 404) {
                 rememberAbsent(key);
                 return null;
@@ -658,7 +659,7 @@ export function createBinaryStore(cfg) {
             // (owner ruling #10). `internalHeaders()` throws first if no secret is configured.
             const headers = internalHeaders();
             const token = await signToken({ k: appKey(key), op: 'delete' }, DELETE_TOKEN_TTL_SECONDS);
-            const res = await fetch(`${baseUrl}/media/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}`, { method: 'DELETE', headers });
+            const res = await send(`${baseUrl}/media/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}`, { method: 'DELETE', headers });
             if (!res.ok && res.status !== 404) {
                 throw new Error(`[binary-store] remove ${key}: ${res.status}`);
             }
@@ -671,7 +672,7 @@ export function createBinaryStore(cfg) {
             // and the `?container=1` flag. Same two-barrier gate as remove().
             const headers = internalHeaders();
             const token = await signToken({ k: appKey(prefix), op: 'delete' }, DELETE_TOKEN_TTL_SECONDS);
-            const res = await fetch(`${baseUrl}/media/${encodeKeyPath(appKey(prefix))}?container=1&token=${encodeURIComponent(token)}`, { method: 'DELETE', headers });
+            const res = await send(`${baseUrl}/media/${encodeKeyPath(appKey(prefix))}?container=1&token=${encodeURIComponent(token)}`, { method: 'DELETE', headers });
             if (!res.ok && res.status !== 404) {
                 throw new Error(`[binary-store] removePrefix ${prefix}: ${res.status}`);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.32.1",
+	"version": "4.33.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split — storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -380,7 +380,7 @@
 		"@node-rs/argon2": "^2.0.2",
 		"@types/bun": "^1.3.14",
 		"@types/node": "^24",
-		"cursedbelt": "^5.7.2",
+		"cursedbelt": "^5.9.0",
 		"hono": "4.12.28",
 		"kysely": "^0.28.17",
 		"kysely-bun-sqlite": "^0.4.0",

package/src/server/storage/binaryStore.spec.ts

@@ -673,6 +673,42 @@ describe('internalBaseUrl — reading bytes without leaving the box', () => {
   });
 });
 
+describe('🔴 fetch — a same-zone Worker reads through its service binding, never the tunnel', () => {
+  it('sends EVERY method through the injected fetch and none through the global one', async () => {
+    // 2026-09-25: family's Worker read portraits with the global fetch, which on the
+    // cursedalchemy.com zone skips the edge Worker and lands on the Mac's byte tunnel —
+    // the owner turned the Mac off and every face on the tree went with it.
+    const bound: string[] = [];
+    const store = makeStore({
+      internalSecret: 's',
+      fetch: (input, init) => {
+        bound.push(`${init?.method ?? (input instanceof Request ? input.method : 'GET')} ${typeof input === 'string' ? input : input.url}`);
+        const url = typeof input === 'string' ? input : input.url;
+        if (url.includes('/meta/')) return Promise.resolve(json({ size: 1 }));
+        return Promise.resolve(ok(new Uint8Array([1]), { headers: { 'content-range': 'bytes 0-0/1' } }));
+      },
+    });
+    await store.put('a', new Uint8Array([1]));
+    await store.get('b');
+    await store.meta('c');
+    await store.stat('d');
+    await store.has('e');
+    await store.fetchMedia('f');
+    await store.remove('g');
+    await store.removePrefix('h/');
+    expect(calls).toEqual([]);
+    expect(bound.length).toBeGreaterThanOrEqual(8);
+    for (const line of bound) expect(line).toContain(BASE);
+  });
+
+  it('defaults to the global fetch when nothing is injected (a Bun host on the Mac)', async () => {
+    const store = makeStore();
+    reply = () => ok(new Uint8Array([1]));
+    await store.get('b');
+    expect(calls).toHaveLength(1);
+  });
+});
+
 describe('fetchMedia', () => {
   it('forwards a Range header untouched — Range IS seeking', async () => {
     const store = makeStore({ internalBaseUrl: INTERNAL });

package/src/server/storage/binaryStore.ts

@@ -83,6 +83,18 @@ export interface BinaryStoreConfig {
   absenceTtlMs?: number;
   /** Injected so the memo's expiry is testable without a real clock. */
   now?: () => number;
+  /**
+   * 🔴 How THIS PROCESS sends every request to binary-server. Default: the global `fetch`.
+   *
+   * A Cloudflare Worker on the SAME ZONE as binary-server must pass its service binding to
+   * `binary-server-edge-gate` here (`(input, init) => env.BINARY_SERVER.fetch(input, init)`).
+   * A same-zone subrequest skips every other Worker's route and goes straight to the zone's
+   * ORIGIN — the byte tunnel into the owner's Mac — so a global `fetch` never reached the edge
+   * Worker, its R2 reads or its cache. Measured 2026-09-25: the owner powered the Mac off and
+   * every face on family's tree was gone, although family's bytes rest in R2. Auth met the same
+   * trap first (task 2150); this is the byte half of it.
+   */
+  fetch?: (input: string | Request, init?: RequestInit) => Promise<Response>;
 }
 
 /*
@@ -511,6 +523,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
    * and is named as the remaining gap.
    */
   const internalBaseUrl = (cfg.internalBaseUrl ?? cfg.baseUrl).replace(/\/+$/, '');
+  const send = cfg.fetch ?? ((input: string | Request, init?: RequestInit) => fetch(input, init));
   const autoChunkBytes = cfg.autoChunkBytes ?? AUTO_CHUNK_THRESHOLD_BYTES;
   const now = cfg.now ?? Date.now;
   const absenceTtlMs = cfg.absenceTtlMs ?? BINARY_ABSENCE_TTL_MS;
@@ -705,7 +718,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
       const title = opts?.title?.trim();
       const titleQs = title ? `&title=${encodeURIComponent(title)}` : '';
       const immutableQs = opts?.immutable ? '&immutable=1' : '';
-      const res = await fetch(
+      const res = await send(
         `${baseUrl}/upload/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}${titleQs}${immutableQs}`,
         {
           method: 'PUT',
@@ -785,7 +798,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
             .slice(ci * chunkBytes, Math.min((ci + 1) * chunkBytes, blob.size))
             .arrayBuffer(),
         );
-        const res = await fetch(
+        const res = await send(
           `${baseUrl}/upload-chunk/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}${titleQs}${immutableQs}`,
           {
             method: 'PUT',
@@ -807,7 +820,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
       // short-circuit here — we want the bytes, and only the store has them.
       if (!opts?.fresh && knownAbsent(key)) return null;
       countWireRead(key);
-      const res = await fetch(await internalMediaUrl(key));
+      const res = await send(await internalMediaUrl(key));
       if (res.status === 404) {
         rememberAbsent(key);
         return null;
@@ -868,7 +881,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
       // of the URL, so a fresh one per request would defeat every cache between here and
       // the object — see MediaUrlOptions.stableWindowSeconds.
       const url = await internalMediaUrl(key, { stableWindowSeconds: 60 * 60 });
-      return await fetch(url, {
+      return await send(url, {
         method: init?.method ?? 'GET',
         // 🔴 Only when the caller HAS one. `Range: undefined` is fine, but a literal
         // empty string is a malformed header that some origins answer 416 to.
@@ -884,7 +897,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
         if (knownAbsent(key)) return null;
       }
       countWireRead(key);
-      const res = await fetch(await metaUrl(key));
+      const res = await send(await metaUrl(key));
       if (res.status === 404) {
         rememberAbsent(key);
         return null;
@@ -925,7 +938,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
         // A transport/5xx failure — the probe below is the second opinion.
       }
       countWireRead(key);
-      const res = await fetch(await internalMediaUrl(key), { headers: { Range: 'bytes=0-0' } });
+      const res = await send(await internalMediaUrl(key), { headers: { Range: 'bytes=0-0' } });
       if (res.status === 404) {
         rememberAbsent(key);
         return null;
@@ -950,7 +963,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
       // (owner ruling #10). `internalHeaders()` throws first if no secret is configured.
       const headers = internalHeaders();
       const token = await signToken({ k: appKey(key), op: 'delete' }, DELETE_TOKEN_TTL_SECONDS);
-      const res = await fetch(
+      const res = await send(
         `${baseUrl}/media/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}`,
         { method: 'DELETE', headers },
       );
@@ -967,7 +980,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
       // and the `?container=1` flag. Same two-barrier gate as remove().
       const headers = internalHeaders();
       const token = await signToken({ k: appKey(prefix), op: 'delete' }, DELETE_TOKEN_TTL_SECONDS);
-      const res = await fetch(
+      const res = await send(
         `${baseUrl}/media/${encodeKeyPath(appKey(prefix))}?container=1&token=${encodeURIComponent(token)}`,
         { method: 'DELETE', headers },
       );