cursedbelt-core 2.13.2 → 2.14.0

package/dist/core/upload-precheck/sha256.d.ts

@@ -0,0 +1,27 @@
+/**
+ * An INCREMENTAL SHA-256 — fed chunk by chunk, for a Blob too big to hold in one buffer.
+ *
+ * 🔴 Why not `crypto.subtle.digest`: it takes the whole message in one buffer, and a PS2 disc is
+ * up to 8.5 GB, a camera video several. Born in roms (`src/ps2/sha256.ts`, the disc download's
+ * verifier) and moved here so every app's upload pre-check hashes with the same code
+ * (forge task 3579). `sha256.spec.ts` pins it against WebCrypto across every chunk boundary that
+ * matters (55/56/64 bytes, and a 1 MB split at an odd offset).
+ *
+ * Measured on this Mac under Bun, 256 MiB in 8 MiB slices: 184 MiB/s here, 195 MiB/s for
+ * `@noble/hashes`, 1,960 MiB/s for `crypto.subtle` — which is why {@link sha256OfBlob} only falls
+ * back to this past the size it is willing to read into memory at once.
+ */
+export declare class Sha256 {
+    private readonly h;
+    /** Back to the empty message — a download that has to start over. */
+    reset(): this;
+    private readonly w;
+    private readonly tail;
+    private tailLength;
+    /** Total bytes fed, as a double — exact to 2^53, far past any disc. */
+    private length;
+    update(data: Uint8Array): this;
+    /** The digest as lowercase hex. The hasher is spent afterwards. */
+    hex(): string;
+    private block;
+}

package/dist/core/upload-precheck/sha256.js

@@ -0,0 +1,124 @@
+/**
+ * An INCREMENTAL SHA-256 — fed chunk by chunk, for a Blob too big to hold in one buffer.
+ *
+ * 🔴 Why not `crypto.subtle.digest`: it takes the whole message in one buffer, and a PS2 disc is
+ * up to 8.5 GB, a camera video several. Born in roms (`src/ps2/sha256.ts`, the disc download's
+ * verifier) and moved here so every app's upload pre-check hashes with the same code
+ * (forge task 3579). `sha256.spec.ts` pins it against WebCrypto across every chunk boundary that
+ * matters (55/56/64 bytes, and a 1 MB split at an odd offset).
+ *
+ * Measured on this Mac under Bun, 256 MiB in 8 MiB slices: 184 MiB/s here, 195 MiB/s for
+ * `@noble/hashes`, 1,960 MiB/s for `crypto.subtle` — which is why {@link sha256OfBlob} only falls
+ * back to this past the size it is willing to read into memory at once.
+ */
+const K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98,
+    0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+    0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, 0xa831c66d, 0xb00327c8,
+    0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819,
+    0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+    0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7,
+    0xc67178f2,
+]);
+const INITIAL = [0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19];
+export class Sha256 {
+    h = new Uint32Array(INITIAL);
+    /** Back to the empty message — a download that has to start over. */
+    reset() {
+        this.h.set(INITIAL);
+        this.tailLength = 0;
+        this.length = 0;
+        return this;
+    }
+    w = new Uint32Array(64);
+    tail = new Uint8Array(64);
+    tailLength = 0;
+    /** Total bytes fed, as a double — exact to 2^53, far past any disc. */
+    length = 0;
+    update(data) {
+        this.length += data.length;
+        let offset = 0;
+        if (this.tailLength > 0) {
+            const take = Math.min(64 - this.tailLength, data.length);
+            this.tail.set(data.subarray(0, take), this.tailLength);
+            this.tailLength += take;
+            offset = take;
+            if (this.tailLength < 64)
+                return this;
+            this.block(this.tail, 0);
+            this.tailLength = 0;
+        }
+        const whole = data.length - ((data.length - offset) % 64);
+        for (; offset < whole; offset += 64)
+            this.block(data, offset);
+        if (offset < data.length) {
+            this.tail.set(data.subarray(offset), 0);
+            this.tailLength = data.length - offset;
+        }
+        return this;
+    }
+    /** The digest as lowercase hex. The hasher is spent afterwards. */
+    hex() {
+        const bits = this.length * 8;
+        const pad = new Uint8Array(this.tailLength < 56 ? 64 : 128);
+        pad.set(this.tail.subarray(0, this.tailLength));
+        pad[this.tailLength] = 0x80;
+        const view = new DataView(pad.buffer);
+        view.setUint32(pad.length - 8, Math.floor(bits / 2 ** 32));
+        view.setUint32(pad.length - 4, bits >>> 0);
+        for (let offset = 0; offset < pad.length; offset += 64)
+            this.block(pad, offset);
+        let out = "";
+        for (const word of this.h)
+            out += word.toString(16).padStart(8, "0");
+        return out;
+    }
+    block(data, offset) {
+        const w = this.w;
+        for (let i = 0; i < 16; i++) {
+            const j = offset + i * 4;
+            w[i] = (data[j] << 24) | (data[j + 1] << 16) | (data[j + 2] << 8) | data[j + 3];
+        }
+        for (let i = 16; i < 64; i++) {
+            const a = w[i - 15];
+            const b = w[i - 2];
+            const s0 = ((a >>> 7) | (a << 25)) ^ ((a >>> 18) | (a << 14)) ^ (a >>> 3);
+            const s1 = ((b >>> 17) | (b << 15)) ^ ((b >>> 19) | (b << 13)) ^ (b >>> 10);
+            w[i] = (w[i - 16] + s0 + w[i - 7] + s1) | 0;
+        }
+        const h = this.h;
+        let a = h[0];
+        let b = h[1];
+        let c = h[2];
+        let d = h[3];
+        let e = h[4];
+        let f = h[5];
+        let g = h[6];
+        let hh = h[7];
+        for (let i = 0; i < 64; i++) {
+            const S1 = ((e >>> 6) | (e << 26)) ^ ((e >>> 11) | (e << 21)) ^ ((e >>> 25) | (e << 7));
+            const ch = (e & f) ^ (~e & g);
+            const t1 = (hh + S1 + ch + K[i] + w[i]) | 0;
+            const S0 = ((a >>> 2) | (a << 30)) ^ ((a >>> 13) | (a << 19)) ^ ((a >>> 22) | (a << 10));
+            const maj = (a & b) ^ (a & c) ^ (b & c);
+            const t2 = (S0 + maj) | 0;
+            hh = g;
+            g = f;
+            f = e;
+            e = (d + t1) | 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) | 0;
+        }
+        h[0] = (h[0] + a) | 0;
+        h[1] = (h[1] + b) | 0;
+        h[2] = (h[2] + c) | 0;
+        h[3] = (h[3] + d) | 0;
+        h[4] = (h[4] + e) | 0;
+        h[5] = (h[5] + f) | 0;
+        h[6] = (h[6] + g) | 0;
+        h[7] = (h[7] + hh) | 0;
+    }
+}

package/dist/core/wire/__fixtures__/rowsMarshalWorker.js

@@ -1,9 +1,9 @@
 /**
- * A REAL marshalling worker entry, used by `marshalWorker.spec.ts` to prove the
+ * A REAL marshaling worker entry, used by `marshalWorker.spec.ts` to prove the
  * round-trip over an actual OS thread rather than over an injected fake.
  *
  * This is also the shape every production entry has, so it doubles as the
- * reference an app author copies: construct the marshaller, hand it to
+ * reference an app author copies: construct the marshaler, hand it to
  * `serveMarshalWorker`, done. The host never imports this file — it names it,
  * and the worker imports it.
  */

package/dist/core/wire/index.d.ts

@@ -3,7 +3,7 @@
  *
  * This entry exists because of Law #1, for the same reason `client/index.ts`
  * gives that reason for `createWireHub`: an ingress route has to be able to
- * IMPORT the marshalling seam, and a worker entry has to be able to import
+ * IMPORT the marshaling seam, and a worker entry has to be able to import
  * `serveMarshalWorker`. Until the Worker commit (05 §B1) neither symbol had any
  * export path at all — `marshalInbound` was reachable only from inside this
  * package, which is most of why it went three arcs with zero callers.

package/dist/core/wire/index.js

@@ -3,7 +3,7 @@
  *
  * This entry exists because of Law #1, for the same reason `client/index.ts`
  * gives that reason for `createWireHub`: an ingress route has to be able to
- * IMPORT the marshalling seam, and a worker entry has to be able to import
+ * IMPORT the marshaling seam, and a worker entry has to be able to import
  * `serveMarshalWorker`. Until the Worker commit (05 §B1) neither symbol had any
  * export path at all — `marshalInbound` was reachable only from inside this
  * package, which is most of why it went three arcs with zero callers.

package/dist/core/wire/ingress.d.ts

@@ -1,11 +1,11 @@
 import { type MarshallerRegistry } from './marshalling.js';
-/** No marshaller is registered for the token an ingress was asked to feed. */
+/** No marshaler is registered for the token an ingress was asked to feed. */
 export declare const INGRESS_TOKEN_UNKNOWN = "INGRESS_TOKEN_UNKNOWN";
 export interface MarshalledIngressOptions {
     /** The registry the app's wire tokens were registered on. */
     readonly registry: MarshallerRegistry;
     /**
-     * Per-payload worker ceiling. A marshalling worker that hangs would otherwise
+     * Per-payload worker ceiling. A marshaling worker that hangs would otherwise
      * hold the request open for as long as the client is willing to wait.
      */
     readonly workerTimeoutMs?: number;
@@ -21,12 +21,12 @@ export interface MarshalledIngress {
      *
      * @throws {AppError} `INGRESS_TOKEN_UNKNOWN` (404) when nothing is registered;
      *   `MARSHALLER_PAYLOAD_TOO_LARGE` (413/503), `MARSHALLER_VALIDATION_FAILED`
-     *   (400) or `MARSHALLER_SCHEMA_VIOLATION` (502) from the marshaller itself.
+     *   (400) or `MARSHALLER_SCHEMA_VIOLATION` (502) from the marshaler itself.
      */
     ingest<Out = unknown>(tokenId: string, payload: unknown): Promise<Out>;
     /**
      * Read a `Request` body and marshal it for `tokenId`. JSON bodies are parsed;
-     * anything else is handed to the marshaller as bytes, because a marshaller for
+     * anything else is handed to the marshaler as bytes, because a marshaler for
      * a CSV or a binary feed wants the bytes and re-encoding them would be lossy.
      */
     ingestRequest<Out = unknown>(tokenId: string, request: Request): Promise<Out>;

package/dist/core/wire/ingress.js

@@ -13,25 +13,25 @@
  * webhook endpoint that no product asked for would create a new orphan seam of
  * exactly the kind Law #1 exists to prevent, and it would guess wrong about the
  * part that actually differs between a webhook and an import (authentication,
- * routing, what the marshalled value is handed to). What does NOT differ — and
+ * routing, what the marshaled value is handed to). What does NOT differ — and
  * what every ingress would otherwise re-derive, differently — is this:
  *
  *   1. reading the body as bytes without buffering a stream into RAM twice;
- *   2. finding the marshaller for the token being fed;
+ *   2. finding the marshaler for the token being fed;
  *   3. owning a worker per `workerEntry` — a live OS thread, so exactly one
  *      thing must own disposing of it — and resolving it lazily and cached;
  *   4. handing those failures up as errors that already KNOW their HTTP status,
- *      so no route re-derives the mapping. The marshalling tier's codes are
+ *      so no route re-derives the mapping. The marshaling tier's codes are
  *      unchanged and deliberately distinct: 413 over the declared ceiling, 400
  *      for a payload `validate` refuses (the caller's shape is wrong), 502 when
  *      the TRANSFORM OUTPUT violates the token's canonical schema (an upstream
  *      provider changed shape under us — not our error budget), 503 for a
- *      payload that needs offload from a marshaller with no worker.
+ *      payload that needs offload from a marshaler with no worker.
  *
  * Step 3 is the one that would go wrong. `createMarshalWorkerClient` spawns a
  * thread per call; a route handler that called it per request would leak one
  * OS thread per webhook, and the symptom would be a server that gets slower for
- * a week and then dies. Nothing about that is discoverable from the marshalling
+ * a week and then dies. Nothing about that is discoverable from the marshaling
  * API, which is precisely why it belongs here once instead of in each ingress.
  *
  * ## Adding an ingress later
@@ -47,13 +47,13 @@
  * });
  * ```
  *
- * A CSV import is the same three lines with a different marshaller and a
+ * A CSV import is the same three lines with a different marshaler and a
  * different service call. Neither needs to know that a worker exists.
  */
 import { AppError } from '../../shared/errors.js';
 import { createMarshalWorkerClient } from './marshalWorker.js';
 import { marshalInbound, } from './marshalling.js';
-/** No marshaller is registered for the token an ingress was asked to feed. */
+/** No marshaler is registered for the token an ingress was asked to feed. */
 export const INGRESS_TOKEN_UNKNOWN = 'INGRESS_TOKEN_UNKNOWN';
 /**
  * Build the ingress. One per app — it caches a worker per `workerEntry`, and two
@@ -68,7 +68,7 @@ export const createMarshalledIngress = (options) => {
         if (entry === undefined)
             return undefined;
         if (disposed)
-            throw new AppError('This ingress has been disposed and cannot spawn a marshalling worker.', {
+            throw new AppError('This ingress has been disposed and cannot spawn a marshaling worker.', {
                 code: 'INGRESS_DISPOSED',
                 status: 503,
                 isOperational: false,
@@ -88,10 +88,10 @@ export const createMarshalledIngress = (options) => {
     const marshallerFor = (tokenId) => {
         const marshaller = options.registry.forToken(tokenId);
         if (!marshaller)
-            // 404, not 400: from outside, a token with no marshaller and a token that
+            // 404, not 400: from outside, a token with no marshaler and a token that
             // does not exist are the same fact, and distinguishing them would make
             // this endpoint an enumeration oracle for the app's wire surface.
-            throw new AppError(`No marshaller is registered for wire token '${tokenId}'.`, {
+            throw new AppError(`No marshaler is registered for wire token '${tokenId}'.`, {
                 code: INGRESS_TOKEN_UNKNOWN,
                 status: 404,
                 context: { tokenId },
@@ -106,8 +106,8 @@ export const createMarshalledIngress = (options) => {
         },
         async ingestRequest(tokenId, request) {
             const contentType = request.headers.get('content-type') ?? '';
-            // JSON is parsed here so the marshaller sees a value rather than a string
-            // it would have to parse itself (and parse DIFFERENTLY per marshaller).
+            // JSON is parsed here so the marshaler sees a value rather than a string
+            // it would have to parse itself (and parse DIFFERENTLY per marshaler).
             // A malformed body is the CALLER's error — 400 — and must not read as a
             // validation failure of a payload we never managed to decode.
             const payload = contentType.includes('application/json')

package/dist/core/wire/marshalWorker.d.ts

@@ -58,7 +58,7 @@ export interface MarshalWorkerClient extends MarshalWorker {
     dispose(): Promise<void>;
 }
 /**
- * A long-lived worker for ONE marshaller, multiplexing concurrent payloads.
+ * A long-lived worker for ONE marshaler, multiplexing concurrent payloads.
  *
  * Long-lived rather than one-worker-per-payload deliberately: thread startup
  * plus module load is tens of milliseconds, which on a burst of imports would

package/dist/core/wire/marshalWorker.js

@@ -1,5 +1,5 @@
 /**
- * The marshalling Worker (05 §B1, second half) — `validate` + `transform` for a
+ * The marshaling Worker (05 §B1, second half) — `validate` + `transform` for a
  * large inbound payload, off the thread that has to answer requests.
  *
  * `marshalling.ts` has always had the SIZE BOUNDARY and the injection seam; what
@@ -8,19 +8,19 @@
  * the missing half: a real, long-lived worker with a request/response protocol,
  * on both runtimes cursedbelt ships to.
  *
- * ## Why the marshaller names its own worker entry
+ * ## Why the marshaler names its own worker entry
  *
- * A marshaller is mostly FUNCTIONS (`validate`, `transform`, a Zod schema), and
+ * A marshaler is mostly FUNCTIONS (`validate`, `transform`, a Zod schema), and
  * functions do not survive structured clone — a worker cannot be handed one, it
  * has to `import` it. The obvious design (one shared worker that resolves any
- * marshaller by id from a registry module) needs the host to declare, register
- * and keep in sync a second module listing every marshaller, and it gives that
+ * marshaler by id from a registry module) needs the host to declare, register
+ * and keep in sync a second module listing every marshaler, and it gives that
  * one worker the authority to run all of them.
  *
- * Instead each marshaller declares `workerEntry`: the module that constructs
- * exactly that marshaller and calls {@link serveMarshalWorker}. The worker can
- * therefore only ever run the one marshaller it was built for, the host wires
- * nothing, and — the part that matters for the gate — "can this marshaller
+ * Instead each marshaler declares `workerEntry`: the module that constructs
+ * exactly that marshaler and calls {@link serveMarshalWorker}. The worker can
+ * therefore only ever run the one marshaler it was built for, the host wires
+ * nothing, and — the part that matters for the gate — "can this marshaler
  * offload?" stops being a boolean somebody remembered to set and becomes a
  * question about an artifact that either exists or does not. V3 checks it
  * statically (`marshaller-worker-offload-missing`), so the 503 path below is
@@ -94,7 +94,7 @@ export async function serveMarshalWorker(marshaller) {
                     id: request.id,
                     ok: false,
                     code: MARSHALLER_VALIDATION_FAILED,
-                    message: `Inbound payload rejected by marshaller '${marshaller.id}'.`,
+                    message: `Inbound payload rejected by marshaler '${marshaller.id}'.`,
                 });
                 return;
             }
@@ -185,7 +185,7 @@ function spawnHostWorker(entry) {
     };
 }
 /**
- * A long-lived worker for ONE marshaller, multiplexing concurrent payloads.
+ * A long-lived worker for ONE marshaler, multiplexing concurrent payloads.
  *
  * Long-lived rather than one-worker-per-payload deliberately: thread startup
  * plus module load is tens of milliseconds, which on a burst of imports would
@@ -229,7 +229,7 @@ export function createMarshalWorkerClient(options) {
     worker.onError((error) => {
         const message = error instanceof Error ? error.message : String(error);
         for (const id of [...pending.keys()])
-            settle(id, (p) => p.reject(new AppError(`Marshalling worker failed: ${message}`, {
+            settle(id, (p) => p.reject(new AppError(`Marshaling worker failed: ${message}`, {
                 code: MARSHALLER_WORKER_FAILED,
                 status: 500,
                 context: { worker: String(options.entry) },
@@ -238,7 +238,7 @@ export function createMarshalWorkerClient(options) {
     return {
         run(_marshallerId, payload) {
             if (disposed)
-                return Promise.reject(new AppError('Marshalling worker has been disposed.', {
+                return Promise.reject(new AppError('Marshaling worker has been disposed.', {
                     code: MARSHALLER_WORKER_FAILED,
                     status: 500,
                     context: { worker: String(options.entry) },
@@ -247,7 +247,7 @@ export function createMarshalWorkerClient(options) {
             return new Promise((resolve, reject) => {
                 const timer = setTimeout(() => {
                     pending.delete(id);
-                    reject(new AppError(`Marshalling worker did not answer within ${timeoutMs}ms.`, {
+                    reject(new AppError(`Marshaling worker did not answer within ${timeoutMs}ms.`, {
                         code: MARSHALLER_WORKER_TIMEOUT,
                         status: 504,
                         context: { worker: String(options.entry), timeoutMs },
@@ -260,7 +260,7 @@ export function createMarshalWorkerClient(options) {
         async dispose() {
             disposed = true;
             for (const id of [...pending.keys()])
-                settle(id, (p) => p.reject(new AppError('Marshalling worker was disposed while a payload was in flight.', {
+                settle(id, (p) => p.reject(new AppError('Marshaling worker was disposed while a payload was in flight.', {
                     code: MARSHALLER_WORKER_FAILED,
                     status: 503,
                     context: { worker: String(options.entry) },

package/dist/core/wire/marshalling.d.ts

@@ -1,8 +1,8 @@
 /**
- * Port marshalling + the 512KB worker gate (02 §7.1).
+ * Port marshaling + the 512KB worker gate (02 §7.1).
  *
  * External payloads — webhooks, third-party feeds, spreadsheet imports — never
- * touch component code. A marshaller registered on the token is the only entry,
+ * touch component code. A marshaler registered on the token is the only entry,
  * and its `transform` output is checked against the token's canonical Zod schema
  * (V3 asserts this statically; here it is enforced at runtime too, because a
  * provider can change its shape without anyone recompiling).
@@ -18,7 +18,7 @@ import type { z } from 'zod';
 /** Above this, `validate` + `transform` are offloaded to a Worker (02 §7.1). */
 export declare const MARSHALLER_WORKER_OFFLOAD_BYTES: number;
 /**
- * The ONE marshaller contract (05 §B1, unified 2026-07-26).
+ * The ONE marshaler contract (05 §B1, unified 2026-07-26).
  *
  * There were TWO interfaces of this name in this package: this one, and a
  * divergent copy in `core/tokens/registry.ts` that additionally required
@@ -32,24 +32,24 @@ export declare const MARSHALLER_WORKER_OFFLOAD_BYTES: number;
  */
 export interface CCWireMarshaller<Inbound = unknown, Out = unknown> {
     id: string;
-    /** The wire token this marshaller feeds — V3 resolves it against the registry. */
+    /** The wire token this marshaler feeds — V3 resolves it against the registry. */
     tokenId: string;
     /** REQUIRED — V3 `marshaller-payload-unbounded` when absent or non-positive. */
     maxPayloadBytes: number;
     /**
-     * The module that runs this marshaller's `validate`+`transform` off the main
+     * The module that runs this marshaler's `validate`+`transform` off the main
      * thread — an entry calling `serveMarshalWorker` (`core/wire/marshalWorker.ts`).
      *
      * **This replaced a `workerOffload: boolean` in the Worker commit (05 §B1).**
      * That flag was authored by hand and asserted a capability the codebase did
-     * not have: every marshaller in the repo set it `true` while no worker
+     * not have: every marshaler in the repo set it `true` while no worker
      * existed anywhere, so the V3 gate it fed was checking that someone had
-     * remembered to type `true`. Whether a marshaller can offload is now a
+     * remembered to type `true`. Whether a marshaler can offload is now a
      * question about an ARTIFACT — this entry either exists or it does not — and
      * whether it NEEDS to is {@link requiresWorkerOffload}, derived from
      * `maxPayloadBytes`. Neither is a promise anyone can make by hand.
      *
-     * Optional because a marshaller whose `maxPayloadBytes` sits under the
+     * Optional because a marshaler whose `maxPayloadBytes` sits under the
      * main-thread limit can never reach the offload path; V3 requires it of
      * exactly those that can.
      */
@@ -60,9 +60,9 @@ export interface CCWireMarshaller<Inbound = unknown, Out = unknown> {
     targetZodSchema: z.ZodType<Out>;
 }
 /**
- * Can this marshaller ever reach the offload path? A DERIVED fact (05 §B1).
+ * Can this marshaler ever reach the offload path? A DERIVED fact (05 §B1).
  *
- * A marshaller that refuses anything over 256KB can never produce a payload
+ * A marshaler that refuses anything over 256KB can never produce a payload
  * above the 512KB main-thread limit, so it needs no worker and demanding one
  * would be noise. One whose ceiling is 2MB certainly can, and without a
  * `workerEntry` its large payloads are a guaranteed 503 — which is why V3
@@ -87,13 +87,13 @@ export interface MarshalWorker {
 }
 export interface MarshalOptions {
     /**
-     * Use THIS worker instead of the one the marshaller's `workerEntry` names.
+     * Use THIS worker instead of the one the marshaler's `workerEntry` names.
      * Left unset in production: offload is the default path, resolved from the
-     * marshaller itself, so an ingress route needs no worker wiring of its own.
+     * marshaler itself, so an ingress route needs no worker wiring of its own.
      */
     worker?: MarshalWorker;
     /**
-     * Resolves a worker for a marshaller that declares a `workerEntry`. The host
+     * Resolves a worker for a marshaler that declares a `workerEntry`. The host
      * supplies this once (`createMarshalWorkerClient`, cached per entry) — it is a
      * parameter rather than a module-level singleton because a worker is a live
      * OS thread, and something has to own disposing of it.
@@ -103,14 +103,14 @@ export interface MarshalOptions {
     offloadThresholdBytes?: number;
 }
 /**
- * Run a payload through its marshaller, offloading past the size gate.
+ * Run a payload through its marshaler, offloading past the size gate.
  *
- * Order matters: the marshaller's OWN `maxPayloadBytes` is checked first, so an
+ * Order matters: the marshaler's OWN `maxPayloadBytes` is checked first, so an
  * oversized payload is refused with a typed diagnostic before any work — worker
  * or otherwise — is scheduled for it.
  */
 export declare function marshalInbound<Inbound, Out>(marshaller: CCWireMarshaller<Inbound, Out>, payload: Inbound, options?: MarshalOptions): Promise<Out>;
-/** The registry of marshallers, keyed by token id (02 §7.1: registered ON the token). */
+/** The registry of marshalers, keyed by token id (02 §7.1: registered ON the token). */
 export interface MarshallerRegistry {
     register(tokenId: string, marshaller: CCWireMarshaller): void;
     forToken(tokenId: string): CCWireMarshaller | undefined;

package/dist/core/wire/marshalling.js

@@ -2,9 +2,9 @@ import { AppError } from '../../shared/errors.js';
 /** Above this, `validate` + `transform` are offloaded to a Worker (02 §7.1). */
 export const MARSHALLER_WORKER_OFFLOAD_BYTES = 512 * 1024;
 /**
- * Can this marshaller ever reach the offload path? A DERIVED fact (05 §B1).
+ * Can this marshaler ever reach the offload path? A DERIVED fact (05 §B1).
  *
- * A marshaller that refuses anything over 256KB can never produce a payload
+ * A marshaler that refuses anything over 256KB can never produce a payload
  * above the 512KB main-thread limit, so it needs no worker and demanding one
  * would be noise. One whose ceiling is 2MB certainly can, and without a
  * `workerEntry` its large payloads are a guaranteed 503 — which is why V3
@@ -41,16 +41,16 @@ export function payloadBytes(payload) {
     }
 }
 /**
- * Run a payload through its marshaller, offloading past the size gate.
+ * Run a payload through its marshaler, offloading past the size gate.
  *
- * Order matters: the marshaller's OWN `maxPayloadBytes` is checked first, so an
+ * Order matters: the marshaler's OWN `maxPayloadBytes` is checked first, so an
  * oversized payload is refused with a typed diagnostic before any work — worker
  * or otherwise — is scheduled for it.
  */
 export async function marshalInbound(marshaller, payload, options = {}) {
     const bytes = payloadBytes(payload);
     if (bytes > marshaller.maxPayloadBytes)
-        throw new AppError(`Payload of ${bytes} bytes exceeds marshaller '${marshaller.id}' limit of ${marshaller.maxPayloadBytes}.`, {
+        throw new AppError(`Payload of ${bytes} bytes exceeds marshaler '${marshaller.id}' limit of ${marshaller.maxPayloadBytes}.`, {
             code: MARSHALLER_PAYLOAD_TOO_LARGE,
             status: 413,
             context: { marshaller: marshaller.id, bytes, maxPayloadBytes: marshaller.maxPayloadBytes },
@@ -58,13 +58,13 @@ export async function marshalInbound(marshaller, payload, options = {}) {
     const threshold = options.offloadThresholdBytes ?? MARSHALLER_WORKER_OFFLOAD_BYTES;
     if (bytes > threshold) {
         // Offload is the DEFAULT path (05 §B1): an explicitly injected worker wins,
-        // otherwise the marshaller's own `workerEntry` is resolved through the host's
-        // resolver. Neither present means this marshaller has no offload path at all
+        // otherwise the marshaler's own `workerEntry` is resolved through the host's
+        // resolver. Neither present means this marshaler has no offload path at all
         // — which V3 refuses to verify, so a verified app never reaches this throw.
         const worker = options.worker ??
             (marshaller.workerEntry ? options.resolveWorker?.(marshaller) : undefined);
         if (!worker)
-            throw new AppError(`Payload of ${bytes} bytes exceeds the ${threshold}-byte main-thread limit and marshaller '${marshaller.id}' has no marshalling worker.`, {
+            throw new AppError(`Payload of ${bytes} bytes exceeds the ${threshold}-byte main-thread limit and marshaler '${marshaller.id}' has no marshaling worker.`, {
                 code: MARSHALLER_PAYLOAD_TOO_LARGE,
                 status: 503,
                 context: {
@@ -73,8 +73,8 @@ export async function marshalInbound(marshaller, payload, options = {}) {
                     threshold,
                     workerEntry: marshaller.workerEntry ?? null,
                     hint: marshaller.workerEntry
-                        ? 'The marshaller declares a workerEntry but no resolveWorker was supplied — pass createMarshalWorkerClient through MarshalOptions.resolveWorker.'
-                        : 'Give the marshaller a workerEntry (a module calling serveMarshalWorker), or lower maxPayloadBytes below the main-thread limit.',
+                        ? 'The marshaler declares a workerEntry but no resolveWorker was supplied — pass createMarshalWorkerClient through MarshalOptions.resolveWorker.'
+                        : 'Give the marshaler a workerEntry (a module calling serveMarshalWorker), or lower maxPayloadBytes below the main-thread limit.',
                 },
             });
         // The worker validates AND transforms; the result still gets schema-checked
@@ -83,7 +83,7 @@ export async function marshalInbound(marshaller, payload, options = {}) {
         return assertSchema(marshaller, result);
     }
     if (!marshaller.validate(payload))
-        throw new AppError(`Inbound payload rejected by marshaller '${marshaller.id}'.`, {
+        throw new AppError(`Inbound payload rejected by marshaler '${marshaller.id}'.`, {
             code: MARSHALLER_VALIDATION_FAILED,
             status: 400,
             context: { marshaller: marshaller.id },
@@ -98,7 +98,7 @@ export async function marshalInbound(marshaller, payload, options = {}) {
 function assertSchema(marshaller, value) {
     const parsed = marshaller.targetZodSchema.safeParse(value);
     if (!parsed.success)
-        throw new AppError(`Marshaller '${marshaller.id}' produced output that violates its token's schema.`, {
+        throw new AppError(`Marshaler '${marshaller.id}' produced output that violates its token's schema.`, {
             code: MARSHALLER_SCHEMA_VIOLATION,
             status: 502,
             context: {
@@ -113,7 +113,7 @@ export function createMarshallerRegistry() {
     return {
         register(tokenId, marshaller) {
             if (marshaller.maxPayloadBytes === undefined || marshaller.maxPayloadBytes <= 0)
-                throw new AppError(`Marshaller '${marshaller.id}' must declare a positive maxPayloadBytes.`, {
+                throw new AppError(`Marshaler '${marshaller.id}' must declare a positive maxPayloadBytes.`, {
                     code: 'marshaller-payload-unbounded',
                     status: 500,
                     context: { marshaller: marshaller.id, tokenId },

package/dist/ctgrClient/convertRequest.js

@@ -66,7 +66,7 @@ async function formDataToBody(formData) {
  * The request body as a JS value: a JSON string is parsed, a plain string rides as itself.
  *
  * 🔴 Anything else is REFUSED. The tunnel carries a JSON value or a form's files; a `File`, a
- * `Blob`, bytes, a stream or `URLSearchParams` handed through here was JSON-serialised as `{}` —
+ * `Blob`, bytes, a stream or `URLSearchParams` handed through here was JSON-serialized as `{}` —
  * desk's import preview posted a 3.4 MB workbook and the server described "a JSON file" with `{}`
  * as its sample (forge task 3443). A loud error at the call is the bug; a silent `{}` is data loss.
  * Send an upload as `FormData`, which is carried whole.
@@ -75,7 +75,7 @@ function bodyFromInit(body, method, url) {
     if (body === null || body === undefined)
         return undefined;
     if (typeof body !== 'string') {
-        // A plain object or array a caller cast to `BodyInit` serialises as itself — carried as before.
+        // A plain object or array a caller cast to `BodyInit` serializes as itself — carried as before.
         const proto = Object.getPrototypeOf(body);
         if (Array.isArray(body) || proto === Object.prototype || proto === null)
             return body;

package/dist/testing/bytes.d.ts

@@ -28,5 +28,5 @@
 export declare const asBody: (bytes: Uint8Array) => Uint8Array<ArrayBuffer>;
 /** `new Response(bytes)` with the assertion applied — the common case. */
 export declare const bytesResponse: (bytes: Uint8Array, init?: ResponseInit) => Response;
-/** A readable stream of `bytes` — what the media catalogue's ingest paths take. */
+/** A readable stream of `bytes` — what the media catalog's ingest paths take. */
 export declare const bytesStream: (bytes: Uint8Array | string) => ReadableStream<Uint8Array>;

package/dist/testing/bytes.js

@@ -28,6 +28,6 @@
 export const asBody = (bytes) => bytes;
 /** `new Response(bytes)` with the assertion applied — the common case. */
 export const bytesResponse = (bytes, init) => new Response(asBody(bytes), init);
-/** A readable stream of `bytes` — what the media catalogue's ingest paths take. */
+/** A readable stream of `bytes` — what the media catalog's ingest paths take. */
 export const bytesStream = (bytes) => new Response(typeof bytes === 'string' ? asBody(new TextEncoder().encode(bytes)) : asBody(bytes))
     .body;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-core",
-	"version": "2.13.2",
+	"version": "2.14.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "Framework-agnostic core of the cursedbelt split — isomorphic domain logic. cwip below it, cursedbelt-server and cursedbelt (react) above it.",
@@ -133,6 +133,12 @@
 			"source": "./src/core/duplicates/index.ts",
 			"import": "./dist/core/duplicates/index.js"
 		},
+		"./upload-precheck": {
+			"types": "./dist/core/upload-precheck/index.d.ts",
+			"bun": "./src/core/upload-precheck/index.ts",
+			"source": "./src/core/upload-precheck/index.ts",
+			"import": "./dist/core/upload-precheck/index.js"
+		},
 		"./errors": {
 			"types": "./dist/shared/errors.d.ts",
 			"bun": "./src/shared/errors.ts",

package/src/core/analytics/range.spec.ts

@@ -18,7 +18,7 @@ import {
   unitForSpan,
 } from './range.js';
 
-/** 2026-08-13 14:30 LOCAL — the tests are about local calendar behaviour. */
+/** 2026-08-13 14:30 LOCAL — the tests are about local calendar behavior. */
 const NOW = new Date(2026, 7, 13, 14, 30, 0).getTime();
 
 describe('the presets', () => {