@githolon/testing 0.24.1 → 0.26.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@githolon/testing",
-  "version": "0.24.1",
+  "version": "0.26.0",
   "type": "module",
   "description": "@githolon/testing — law TDD for Nomos domains: boot the REAL engine plane in-process (the exact machinery every cloud DO, heavy container and web client runs), dispatch directives, assert rows, assert TYPED REFUSALS, fork for what-ifs — fully offline inside vitest.",
   "license": "SEE LICENSE IN LICENSE.md",

package/vendor/engine/engine.mjs

@@ -1036,8 +1036,14 @@ export async function admitIntentOffers(eng, ws, ledger, offers, { receiptFence
     let blob = offer?.blob instanceof Uint8Array ? offer.blob : null;
     try {
       if (!blob && typeof offer?.intentB64 === "string") blob = Uint8Array.from(atob(offer.intentB64), (c) => c.charCodeAt(0));
-      if (!blob || blob.byteLength === 0 || blob.byteLength > 256 * 1024) {
-        rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: "intent offer must carry intentB64 <= 256 KiB" });
+      // 8 MiB matches the worker's `/offer` + `/gw-offer` ceilings (worker.mjs) — it must, or a SIGNED
+      // DEPLOY (a nomos/installDomain offer carrying the whole package: the esbuild engine lump + USD-IR,
+      // ~1.4 MiB for the guestbook, multi-MiB for co2-scale law) the worker relayed would be silently
+      // rejected HERE, the one place the offer actually folds. The 256 KiB this used to be predated signed
+      // deploy (every package embeds the engine lump, so EVERY real install exceeds it); a true DoS is the
+      // transport rate-limit's job, not this fold-time bound.
+      if (!blob || blob.byteLength === 0 || blob.byteLength > 8 * 1024 * 1024) {
+        rec.rejected.push({ oid: String(offer?.oid || "").slice(0, 10), error: "intent offer must carry intentB64 <= 8 MiB" });
         continue;
       }
       let doc = null;