cursedbelt-server 4.32.1 → 4.33.1

package/dist/server/d1/fakeD1.js

@@ -83,7 +83,8 @@ class FakeD1Statement {
         this.params = params;
     }
     bind(...values) {
-        values.forEach((v, i) => assertD1Bindable(v, i));
+        for (const [i, v] of values.entries())
+            assertD1Bindable(v, i);
         // A real binding stores what it was given; the ArrayBuffer→Uint8Array conversion
         // here is `bun:sqlite`'s requirement, not D1's, and happens below the emulated edge.
         const stored = values.map((v) => (v instanceof ArrayBuffer ? new Uint8Array(v) : v));

package/dist/server/d1/pullD1.d.ts

@@ -129,6 +129,11 @@ export interface PullD1Options {
     /** Run after the rows are loaded — where an app REBUILDS its search index (never copied). */
     afterLoadSql?: string;
     wrangler: Wrangler;
+    /**
+     * Where a page D1 refused is reported (default: stderr). Before 4.33.1 a halving was silent,
+     * so the only symptom of a slow spell was a backup that took hours.
+     */
+    log?: (line: string) => void;
 }
 /** How a table is walked in pages: by a rowid keyset, or — a `WITHOUT ROWID` table — by offset. */
 export interface TablePlan {

package/dist/server/d1/pullD1.js

@@ -202,8 +202,15 @@ export function pageSql(plan, limit, after) {
     const order = plan.order.map(sqlIdent).join(', ');
     return `SELECT ${values} FROM ${sqlIdent(plan.table)} ORDER BY ${order} LIMIT ${limit} OFFSET ${after.offset ?? 0}`;
 }
-/** Every row of one table as `INSERT INTO …;` lines, read in pages that never block D1. */
-function dumpTable(wrangler, database, plan) {
+/**
+ * Every row of one table as `INSERT INTO …;` lines, read in pages that never block D1.
+ *
+ * A page D1 refuses is asked again at half the size, and 🔴 every page that SUCCEEDS doubles the
+ * size back toward {@link PAGE_ROWS}. Before 4.33.1 nothing grew it back: desk's first launchd
+ * backup (2026-09-25) hit a few slow calls early and read its 3,381-row table 15 rows per call —
+ * 225 two-minute calls, on course for hours. Only a refusal at ONE row is fatal.
+ */
+function dumpTable(wrangler, database, plan, log) {
     const into = `INSERT INTO ${sqlIdent(plan.table)} (${plan.columns.map(sqlIdent).join(', ')}) VALUES (`;
     const lines = [];
     let limit = PAGE_ROWS;
@@ -214,11 +221,14 @@ function dumpTable(wrangler, database, plan) {
             page = execute(wrangler, database, pageSql(plan, limit, after))[0] ?? [];
         }
         catch (error) {
+            const message = error.message;
             if (limit > 1) {
-                limit = Math.max(1, Math.floor(limit / 2));
+                const next = Math.max(1, Math.floor(limit / 2));
+                log(`pull D1: \`${plan.table}\` refused a page of ${limit} — asking for ${next}: ${message}`);
+                limit = next;
                 continue;
             }
-            throw new Error(`could not read \`${plan.table}\` from D1: ${error.message}`);
+            throw new Error(`could not read \`${plan.table}\` from D1: ${message}`);
         }
         for (const row of page) {
             const literals = plan.columns.map((_, i) => row[`c${i}`]);
@@ -230,6 +240,7 @@ function dumpTable(wrangler, database, plan) {
         if (page.length < limit)
             break;
         after = plan.key ? { key: Number(page[page.length - 1]?.k) } : { offset: (after.offset ?? 0) + page.length };
+        limit = Math.min(PAGE_ROWS, limit * 2);
     }
     return { text: lines.join('\n'), rows: lines.length };
 }
@@ -243,6 +254,7 @@ function dumpTable(wrangler, database, plan) {
  */
 export async function pullD1ToSqlite(options) {
     const { destination, database, wrangler } = options;
+    const log = options.log ?? ((line) => console.error(line));
     let rows;
     try {
         rows = (execute(wrangler, database, "select name, sql from sqlite_master where type = 'table'")[0] ?? []);
@@ -265,7 +277,7 @@ export async function pullD1ToSqlite(options) {
     const dumps = tables.map((table, i) => {
         const cols = (columnSets[i] ?? []);
         const plan = tablePlan(table, rows.find((r) => r.name === table)?.sql ?? null, cols);
-        return { table, ...dumpTable(wrangler, database, plan) };
+        return { table, ...dumpTable(wrangler, database, plan, log) };
     });
     if (dumps.every((d) => d.rows === 0)) {
         throw new Error('the D1 pull contains no rows — refusing to snapshot an empty database as if it were the library');

package/dist/server/storage/binaryStore.d.ts

@@ -38,6 +38,18 @@ export interface BinaryStoreConfig {
     absenceTtlMs?: number;
     /** Injected so the memo's expiry is testable without a real clock. */
     now?: () => number;
+    /**
+     * 🔴 How THIS PROCESS sends every request to binary-server. Default: the global `fetch`.
+     *
+     * A Cloudflare Worker on the SAME ZONE as binary-server must pass its service binding to
+     * `binary-server-edge-gate` here (`(input, init) => env.BINARY_SERVER.fetch(input, init)`).
+     * A same-zone subrequest skips every other Worker's route and goes straight to the zone's
+     * ORIGIN — the byte tunnel into the owner's Mac — so a global `fetch` never reached the edge
+     * Worker, its R2 reads or its cache. Measured 2026-09-25: the owner powered the Mac off and
+     * every face on family's tree was gone, although family's bytes rest in R2. Auth met the same
+     * trap first (task 2150); this is the byte half of it.
+     */
+    fetch?: (input: string | Request, init?: RequestInit) => Promise<Response>;
 }
 /**
  * Which keys this process has read from the wire far too often, worst first —

package/dist/server/storage/binaryStore.js

@@ -260,6 +260,7 @@ export function createBinaryStore(cfg) {
      * and is named as the remaining gap.
      */
     const internalBaseUrl = (cfg.internalBaseUrl ?? cfg.baseUrl).replace(/\/+$/, '');
+    const send = cfg.fetch ?? ((input, init) => fetch(input, init));
     const autoChunkBytes = cfg.autoChunkBytes ?? AUTO_CHUNK_THRESHOLD_BYTES;
     const now = cfg.now ?? Date.now;
     const absenceTtlMs = cfg.absenceTtlMs ?? BINARY_ABSENCE_TTL_MS;
@@ -425,7 +426,7 @@ export function createBinaryStore(cfg) {
             const title = opts?.title?.trim();
             const titleQs = title ? `&title=${encodeURIComponent(title)}` : '';
             const immutableQs = opts?.immutable ? '&immutable=1' : '';
-            const res = await fetch(`${baseUrl}/upload/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}${titleQs}${immutableQs}`, {
+            const res = await send(`${baseUrl}/upload/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}${titleQs}${immutableQs}`, {
                 method: 'PUT',
                 headers: mime ? { 'content-type': mime } : undefined,
                 body: bytes,
@@ -494,7 +495,7 @@ export function createBinaryStore(cfg) {
                 const slice = new Uint8Array(await blob
                     .slice(ci * chunkBytes, Math.min((ci + 1) * chunkBytes, blob.size))
                     .arrayBuffer());
-                const res = await fetch(`${baseUrl}/upload-chunk/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}${titleQs}${immutableQs}`, {
+                const res = await send(`${baseUrl}/upload-chunk/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}${titleQs}${immutableQs}`, {
                     method: 'PUT',
                     headers: mime ? { 'content-type': mime } : undefined,
                     body: slice,
@@ -513,7 +514,7 @@ export function createBinaryStore(cfg) {
             if (!opts?.fresh && knownAbsent(key))
                 return null;
             countWireRead(key);
-            const res = await fetch(await internalMediaUrl(key));
+            const res = await send(await internalMediaUrl(key));
             if (res.status === 404) {
                 rememberAbsent(key);
                 return null;
@@ -572,7 +573,7 @@ export function createBinaryStore(cfg) {
             // of the URL, so a fresh one per request would defeat every cache between here and
             // the object — see MediaUrlOptions.stableWindowSeconds.
             const url = await internalMediaUrl(key, { stableWindowSeconds: 60 * 60 });
-            return await fetch(url, {
+            return await send(url, {
                 method: init?.method ?? 'GET',
                 // 🔴 Only when the caller HAS one. `Range: undefined` is fine, but a literal
                 // empty string is a malformed header that some origins answer 416 to.
@@ -589,7 +590,7 @@ export function createBinaryStore(cfg) {
                     return null;
             }
             countWireRead(key);
-            const res = await fetch(await metaUrl(key));
+            const res = await send(await metaUrl(key));
             if (res.status === 404) {
                 rememberAbsent(key);
                 return null;
@@ -633,7 +634,7 @@ export function createBinaryStore(cfg) {
                 // A transport/5xx failure — the probe below is the second opinion.
             }
             countWireRead(key);
-            const res = await fetch(await internalMediaUrl(key), { headers: { Range: 'bytes=0-0' } });
+            const res = await send(await internalMediaUrl(key), { headers: { Range: 'bytes=0-0' } });
             if (res.status === 404) {
                 rememberAbsent(key);
                 return null;
@@ -658,7 +659,7 @@ export function createBinaryStore(cfg) {
             // (owner ruling #10). `internalHeaders()` throws first if no secret is configured.
             const headers = internalHeaders();
             const token = await signToken({ k: appKey(key), op: 'delete' }, DELETE_TOKEN_TTL_SECONDS);
-            const res = await fetch(`${baseUrl}/media/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}`, { method: 'DELETE', headers });
+            const res = await send(`${baseUrl}/media/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}`, { method: 'DELETE', headers });
             if (!res.ok && res.status !== 404) {
                 throw new Error(`[binary-store] remove ${key}: ${res.status}`);
             }
@@ -671,7 +672,7 @@ export function createBinaryStore(cfg) {
             // and the `?container=1` flag. Same two-barrier gate as remove().
             const headers = internalHeaders();
             const token = await signToken({ k: appKey(prefix), op: 'delete' }, DELETE_TOKEN_TTL_SECONDS);
-            const res = await fetch(`${baseUrl}/media/${encodeKeyPath(appKey(prefix))}?container=1&token=${encodeURIComponent(token)}`, { method: 'DELETE', headers });
+            const res = await send(`${baseUrl}/media/${encodeKeyPath(appKey(prefix))}?container=1&token=${encodeURIComponent(token)}`, { method: 'DELETE', headers });
             if (!res.ok && res.status !== 404) {
                 throw new Error(`[binary-store] removePrefix ${prefix}: ${res.status}`);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.32.1",
+	"version": "4.33.1",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split — storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -380,7 +380,7 @@
 		"@node-rs/argon2": "^2.0.2",
 		"@types/bun": "^1.3.14",
 		"@types/node": "^24",
-		"cursedbelt": "^5.7.2",
+		"cursedbelt": "^5.9.0",
 		"hono": "4.12.28",
 		"kysely": "^0.28.17",
 		"kysely-bun-sqlite": "^0.4.0",

package/src/server/d1/fakeD1.ts

@@ -88,7 +88,7 @@ class FakeD1Statement implements D1BindingStatement {
 	) {}
 
 	bind(...values: unknown[]): D1BindingStatement {
-		values.forEach((v, i) => assertD1Bindable(v, i));
+		for (const [i, v] of values.entries()) assertD1Bindable(v, i);
 		// A real binding stores what it was given; the ArrayBuffer→Uint8Array conversion
 		// here is `bun:sqlite`'s requirement, not D1's, and happens below the emulated edge.
 		const stored = values.map((v) => (v instanceof ArrayBuffer ? new Uint8Array(v) : v));

package/src/server/d1/pullD1.spec.ts

@@ -144,6 +144,7 @@ describe('pulling D1 down — paged SELECTs, table by table, never an export', (
 			requiredTable: 'items',
 			afterLoadSql: REBUILD,
 			wrangler: run,
+			log: () => {},
 		});
 	const opened = (dir: string) => new Database(join(dir, 'pulled.sqlite'), { readonly: true });
 
@@ -222,6 +223,62 @@ describe('pulling D1 down — paged SELECTs, table by table, never an export', (
 		);
 	});
 
+	test('🔴 one refused page does not shrink the rest of the table — the size doubles back to PAGE_ROWS (desk, 2026-09-25: 15 rows per call for hours)', async () => {
+		const dir = scratch();
+		const n = PAGE_ROWS * 3 + 7;
+		const source = live(
+			`WITH RECURSIVE s(i) AS (SELECT 1 UNION ALL SELECT i + 1 FROM s WHERE i < ${n}) INSERT INTO items_fts_map (item_id, text) SELECT 'i' || i, 't' FROM s; INSERT INTO items VALUES ('i1', 'x');`,
+		);
+		let failed = false;
+		const { run, seen } = d1(source, {
+			failWhen: (sql) => {
+				if (failed || !sql.includes('FROM "items_fts_map"')) return false;
+				failed = true;
+				return true;
+			},
+		});
+		const logged: string[] = [];
+		await pullD1ToSqlite({
+			destination: join(dir, 'pulled.sqlite'),
+			database: 'collections',
+			schemaSql: SCHEMA,
+			requiredTable: 'items',
+			afterLoadSql: REBUILD,
+			wrangler: run,
+			log: (line) => logged.push(line),
+		});
+		const db = opened(dir);
+		expect((db.query('select count(*) n from items_fts_map').get() as { n: number }).n).toBe(n);
+		db.close();
+		const limits = seen
+			.map((a) => a[a.indexOf('--command') + 1] as string)
+			.filter((sql) => sql.includes('FROM "items_fts_map"'))
+			.map((sql) => Number(/LIMIT (\d+)/.exec(sql)?.[1]));
+		// refused at 500, read at 250, then back to 500 for the rest.
+		expect(limits.slice(0, 3)).toEqual([PAGE_ROWS, PAGE_ROWS / 2, PAGE_ROWS]);
+		expect(limits.slice(2).every((limit) => limit === PAGE_ROWS)).toBe(true);
+		expect(logged).toHaveLength(1);
+		expect(logged[0]).toContain('D1 said no');
+		expect(logged[0]).toContain(`page of ${PAGE_ROWS}`);
+	});
+
+	test('a table D1 refuses on every call still THROWS with D1\'s own words, after logging each halving', async () => {
+		const source = live("INSERT INTO items VALUES ('i1', 'a');");
+		const logged: string[] = [];
+		await expect(
+			pullD1ToSqlite({
+				destination: join(scratch(), 'pulled.sqlite'),
+				database: 'collections',
+				schemaSql: SCHEMA,
+				requiredTable: 'items',
+				wrangler: d1(source, { failWhen: (sql) => sql.includes('FROM "items"') }).run,
+				log: (line) => logged.push(line),
+			}),
+		).rejects.toThrow(/could not read `items` from D1: ✘ D1 said no/);
+		// 500 → 250 → 125 → 62 → 31 → 15 → 7 → 3 → 1: eight halvings, then the refusal at one row.
+		expect(logged).toHaveLength(8);
+	});
+
 	test('🔴 a table D1 holds that the schema does not declare is created from D1\'s own DDL', async () => {
 		const dir = scratch();
 		const ddl = 'CREATE TABLE art_lookups (key TEXT PRIMARY KEY, art_key TEXT)';

package/src/server/d1/pullD1.ts

@@ -202,6 +202,11 @@ export interface PullD1Options {
 	/** Run after the rows are loaded — where an app REBUILDS its search index (never copied). */
 	afterLoadSql?: string;
 	wrangler: Wrangler;
+	/**
+	 * Where a page D1 refused is reported (default: stderr). Before 4.33.1 a halving was silent,
+	 * so the only symptom of a slow spell was a backup that took hours.
+	 */
+	log?: (line: string) => void;
 }
 
 const sqlIdent = (name: string): string => `"${name.replaceAll('"', '""')}"`;
@@ -250,8 +255,20 @@ export function pageSql(plan: TablePlan, limit: number, after: { key?: number; o
 	return `SELECT ${values} FROM ${sqlIdent(plan.table)} ORDER BY ${order} LIMIT ${limit} OFFSET ${after.offset ?? 0}`;
 }
 
-/** Every row of one table as `INSERT INTO …;` lines, read in pages that never block D1. */
-function dumpTable(wrangler: Wrangler, database: string, plan: TablePlan): { text: string; rows: number } {
+/**
+ * Every row of one table as `INSERT INTO …;` lines, read in pages that never block D1.
+ *
+ * A page D1 refuses is asked again at half the size, and 🔴 every page that SUCCEEDS doubles the
+ * size back toward {@link PAGE_ROWS}. Before 4.33.1 nothing grew it back: desk's first launchd
+ * backup (2026-09-25) hit a few slow calls early and read its 3,381-row table 15 rows per call —
+ * 225 two-minute calls, on course for hours. Only a refusal at ONE row is fatal.
+ */
+function dumpTable(
+	wrangler: Wrangler,
+	database: string,
+	plan: TablePlan,
+	log: (line: string) => void,
+): { text: string; rows: number } {
 	const into = `INSERT INTO ${sqlIdent(plan.table)} (${plan.columns.map(sqlIdent).join(', ')}) VALUES (`;
 	const lines: string[] = [];
 	let limit = PAGE_ROWS;
@@ -261,11 +278,14 @@ function dumpTable(wrangler: Wrangler, database: string, plan: TablePlan): { tex
 		try {
 			page = execute(wrangler, database, pageSql(plan, limit, after))[0] ?? [];
 		} catch (error) {
+			const message = (error as Error).message;
 			if (limit > 1) {
-				limit = Math.max(1, Math.floor(limit / 2));
+				const next = Math.max(1, Math.floor(limit / 2));
+				log(`pull D1: \`${plan.table}\` refused a page of ${limit} — asking for ${next}: ${message}`);
+				limit = next;
 				continue;
 			}
-			throw new Error(`could not read \`${plan.table}\` from D1: ${(error as Error).message}`);
+			throw new Error(`could not read \`${plan.table}\` from D1: ${message}`);
 		}
 		for (const row of page) {
 			const literals = plan.columns.map((_, i) => row[`c${i}`]);
@@ -276,6 +296,7 @@ function dumpTable(wrangler: Wrangler, database: string, plan: TablePlan): { tex
 		}
 		if (page.length < limit) break;
 		after = plan.key ? { key: Number(page[page.length - 1]?.k) } : { offset: (after.offset ?? 0) + page.length };
+		limit = Math.min(PAGE_ROWS, limit * 2);
 	}
 	return { text: lines.join('\n'), rows: lines.length };
 }
@@ -290,6 +311,7 @@ function dumpTable(wrangler: Wrangler, database: string, plan: TablePlan): { tex
  */
 export async function pullD1ToSqlite(options: PullD1Options): Promise<void> {
 	const { destination, database, wrangler } = options;
+	const log = options.log ?? ((line: string) => console.error(line));
 	let rows: Array<{ name: string; sql: string | null }>;
 	try {
 		rows = (execute(wrangler, database, "select name, sql from sqlite_master where type = 'table'")[0] ?? []) as typeof rows;
@@ -313,7 +335,7 @@ export async function pullD1ToSqlite(options: PullD1Options): Promise<void> {
 	const dumps = tables.map((table, i) => {
 		const cols = (columnSets[i] ?? []) as Array<{ name: string; pk: number }>;
 		const plan = tablePlan(table, rows.find((r) => r.name === table)?.sql ?? null, cols);
-		return { table, ...dumpTable(wrangler, database, plan) };
+		return { table, ...dumpTable(wrangler, database, plan, log) };
 	});
 	if (dumps.every((d) => d.rows === 0)) {
 		throw new Error('the D1 pull contains no rows — refusing to snapshot an empty database as if it were the library');

package/src/server/storage/binaryStore.spec.ts

@@ -673,6 +673,42 @@ describe('internalBaseUrl — reading bytes without leaving the box', () => {
   });
 });
 
+describe('🔴 fetch — a same-zone Worker reads through its service binding, never the tunnel', () => {
+  it('sends EVERY method through the injected fetch and none through the global one', async () => {
+    // 2026-09-25: family's Worker read portraits with the global fetch, which on the
+    // cursedalchemy.com zone skips the edge Worker and lands on the Mac's byte tunnel —
+    // the owner turned the Mac off and every face on the tree went with it.
+    const bound: string[] = [];
+    const store = makeStore({
+      internalSecret: 's',
+      fetch: (input, init) => {
+        bound.push(`${init?.method ?? (input instanceof Request ? input.method : 'GET')} ${typeof input === 'string' ? input : input.url}`);
+        const url = typeof input === 'string' ? input : input.url;
+        if (url.includes('/meta/')) return Promise.resolve(json({ size: 1 }));
+        return Promise.resolve(ok(new Uint8Array([1]), { headers: { 'content-range': 'bytes 0-0/1' } }));
+      },
+    });
+    await store.put('a', new Uint8Array([1]));
+    await store.get('b');
+    await store.meta('c');
+    await store.stat('d');
+    await store.has('e');
+    await store.fetchMedia('f');
+    await store.remove('g');
+    await store.removePrefix('h/');
+    expect(calls).toEqual([]);
+    expect(bound.length).toBeGreaterThanOrEqual(8);
+    for (const line of bound) expect(line).toContain(BASE);
+  });
+
+  it('defaults to the global fetch when nothing is injected (a Bun host on the Mac)', async () => {
+    const store = makeStore();
+    reply = () => ok(new Uint8Array([1]));
+    await store.get('b');
+    expect(calls).toHaveLength(1);
+  });
+});
+
 describe('fetchMedia', () => {
   it('forwards a Range header untouched — Range IS seeking', async () => {
     const store = makeStore({ internalBaseUrl: INTERNAL });

package/src/server/storage/binaryStore.ts

@@ -83,6 +83,18 @@ export interface BinaryStoreConfig {
   absenceTtlMs?: number;
   /** Injected so the memo's expiry is testable without a real clock. */
   now?: () => number;
+  /**
+   * 🔴 How THIS PROCESS sends every request to binary-server. Default: the global `fetch`.
+   *
+   * A Cloudflare Worker on the SAME ZONE as binary-server must pass its service binding to
+   * `binary-server-edge-gate` here (`(input, init) => env.BINARY_SERVER.fetch(input, init)`).
+   * A same-zone subrequest skips every other Worker's route and goes straight to the zone's
+   * ORIGIN — the byte tunnel into the owner's Mac — so a global `fetch` never reached the edge
+   * Worker, its R2 reads or its cache. Measured 2026-09-25: the owner powered the Mac off and
+   * every face on family's tree was gone, although family's bytes rest in R2. Auth met the same
+   * trap first (task 2150); this is the byte half of it.
+   */
+  fetch?: (input: string | Request, init?: RequestInit) => Promise<Response>;
 }
 
 /*
@@ -511,6 +523,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
    * and is named as the remaining gap.
    */
   const internalBaseUrl = (cfg.internalBaseUrl ?? cfg.baseUrl).replace(/\/+$/, '');
+  const send = cfg.fetch ?? ((input: string | Request, init?: RequestInit) => fetch(input, init));
   const autoChunkBytes = cfg.autoChunkBytes ?? AUTO_CHUNK_THRESHOLD_BYTES;
   const now = cfg.now ?? Date.now;
   const absenceTtlMs = cfg.absenceTtlMs ?? BINARY_ABSENCE_TTL_MS;
@@ -705,7 +718,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
       const title = opts?.title?.trim();
       const titleQs = title ? `&title=${encodeURIComponent(title)}` : '';
       const immutableQs = opts?.immutable ? '&immutable=1' : '';
-      const res = await fetch(
+      const res = await send(
         `${baseUrl}/upload/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}${titleQs}${immutableQs}`,
         {
           method: 'PUT',
@@ -785,7 +798,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
             .slice(ci * chunkBytes, Math.min((ci + 1) * chunkBytes, blob.size))
             .arrayBuffer(),
         );
-        const res = await fetch(
+        const res = await send(
           `${baseUrl}/upload-chunk/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}${titleQs}${immutableQs}`,
           {
             method: 'PUT',
@@ -807,7 +820,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
       // short-circuit here — we want the bytes, and only the store has them.
       if (!opts?.fresh && knownAbsent(key)) return null;
       countWireRead(key);
-      const res = await fetch(await internalMediaUrl(key));
+      const res = await send(await internalMediaUrl(key));
       if (res.status === 404) {
         rememberAbsent(key);
         return null;
@@ -868,7 +881,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
       // of the URL, so a fresh one per request would defeat every cache between here and
       // the object — see MediaUrlOptions.stableWindowSeconds.
       const url = await internalMediaUrl(key, { stableWindowSeconds: 60 * 60 });
-      return await fetch(url, {
+      return await send(url, {
         method: init?.method ?? 'GET',
         // 🔴 Only when the caller HAS one. `Range: undefined` is fine, but a literal
         // empty string is a malformed header that some origins answer 416 to.
@@ -884,7 +897,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
         if (knownAbsent(key)) return null;
       }
       countWireRead(key);
-      const res = await fetch(await metaUrl(key));
+      const res = await send(await metaUrl(key));
       if (res.status === 404) {
         rememberAbsent(key);
         return null;
@@ -925,7 +938,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
         // A transport/5xx failure — the probe below is the second opinion.
       }
       countWireRead(key);
-      const res = await fetch(await internalMediaUrl(key), { headers: { Range: 'bytes=0-0' } });
+      const res = await send(await internalMediaUrl(key), { headers: { Range: 'bytes=0-0' } });
       if (res.status === 404) {
         rememberAbsent(key);
         return null;
@@ -950,7 +963,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
       // (owner ruling #10). `internalHeaders()` throws first if no secret is configured.
       const headers = internalHeaders();
       const token = await signToken({ k: appKey(key), op: 'delete' }, DELETE_TOKEN_TTL_SECONDS);
-      const res = await fetch(
+      const res = await send(
         `${baseUrl}/media/${encodeKeyPath(appKey(key))}?token=${encodeURIComponent(token)}`,
         { method: 'DELETE', headers },
       );
@@ -967,7 +980,7 @@ export function createBinaryStore(cfg: BinaryStoreConfig): BinaryStore {
       // and the `?container=1` flag. Same two-barrier gate as remove().
       const headers = internalHeaders();
       const token = await signToken({ k: appKey(prefix), op: 'delete' }, DELETE_TOKEN_TTL_SECONDS);
-      const res = await fetch(
+      const res = await send(
         `${baseUrl}/media/${encodeKeyPath(appKey(prefix))}?container=1&token=${encodeURIComponent(token)}`,
         { method: 'DELETE', headers },
       );