fix(ci): green the test suite — pnpm 10 build scripts, libsodium ESM, stale time fixtures

CI has been red since the pnpm 10 migration. Four independent causes:

- better-sqlite3: pnpm 10 blocks dependency build scripts by default, so the
  native binding was never compiled on CI. Allowlist it via
  onlyBuiltDependencies in pnpm-workspace.yaml.
- libsodium-wrappers-sumo 0.7.16: the published ESM wrapper does
  `import "./libsodium-sumo.mjs"` but the tarball does not ship that file
  (it lives in the libsodium-sumo package). Patch the import to the bare
  specifier; local runs only worked because of a hand-copied file in
  node_modules.
- tx-accept/claim [live] tests: the live path checks deadlines against
  Date.now(), and the fixed fixture timestamps expired in June. Freeze the
  clock inside the fixture windows with vi.useFakeTimers.
- CML set_exunits panic ("RuntimeError: unreachable"): with
  localUPLCEval: false the provider asks Ogmios for ex-units; the test mocks
  answered `{}`, so the provider fell back to a spend redeemer at index 0
  while the escrow input sorts to index 1 — CML panics on the unknown
  redeemer key. Mock evaluateTransaction with the true index like real
  Ogmios.

Also regenerate the advert-datum golden: the fixture builders passed plain JS
numbers to cbor-x (minimal ints, float64 for the timestamp) while the
production codec — whose output is live on mainnet — emits full-width uint64.
Builders now encode integer fields as BigInt so builders, codec, and golden
agree byte-for-byte.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/fixtures/buyer-side/advert-datum-builders.ts

@@ -118,15 +118,17 @@ export function encodeSampleAdvertDatumHex(): string {
     hexToBytes(datum.supplier_pkh),
     utf8Bytes(datum.capability_id),
     utf8Bytes(datum.model),
-    datum.max_output_tokens,
-    datum.max_processing_ms,
+    // BigInt so cbor-x emits uint64 (0x1b) like the production codec — plain
+    // numbers encode minimally (or as float64 past 2^32) and break golden parity.
+    BigInt(datum.max_output_tokens),
+    BigInt(datum.max_processing_ms),
     datum.price_lovelace,
     datum.supplier_bond_lovelace,
     datum.buyer_bond_lovelace,
     utf8Bytes(datum.endpoint_url),
     utf8Bytes(datum.detail_uri),
     hexToBytes(datum.detail_hash),
-    datum.advertised_at,
+    BigInt(datum.advertised_at),
     statusTag,
   ]);
 

tests/fixtures/golden/advert-datum-sample.hex

@@ -1 +1 @@
-d8798d581cabcdef0123456789abcdef0123456789abcdef0123456789abcdef01546c6c6d2e746578742e67656e65726174652e76314c7177656e322e353a302e356219020019ea601b00000000001e84801b00000000000f42401b00000000000f4240581f68747470733a2f2f737570706c6965722e6578616d706c652e636f6d2f76315835697066733a2f2f516d597741504a7a7635435a736e4136323573335866326e656d7459675070486457457a37396f6a576e506264475820aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaafb4279667e84f00000d87980
+d8798d581cabcdef0123456789abcdef0123456789abcdef0123456789abcdef01546c6c6d2e746578742e67656e65726174652e76314c7177656e322e353a302e35621b00000000000002001b000000000000ea601b00000000001e84801b00000000000f42401b00000000000f4240581f68747470733a2f2f737570706c6965722e6578616d706c652e636f6d2f76315835697066733a2f2f516d597741504a7a7635435a736e4136323573335866326e656d7459675070486457457a37396f6a576e506264475820aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa1b0000019667e84f00d87980

tests/fixtures/supplier-side/advert-datum-builders.ts

@@ -107,15 +107,17 @@ export function encodeSampleAdvertDatumHex(): string {
     hexToBytes(datum.supplier_pkh),
     utf8Bytes(datum.capability_id),
     utf8Bytes(datum.model),
-    datum.max_output_tokens,
-    datum.max_processing_ms,
+    // BigInt so cbor-x emits uint64 (0x1b) like the production codec — plain
+    // numbers encode minimally (or as float64 past 2^32) and break golden parity.
+    BigInt(datum.max_output_tokens),
+    BigInt(datum.max_processing_ms),
     datum.price_lovelace,
     datum.supplier_bond_lovelace,
     datum.buyer_bond_lovelace,
     utf8Bytes(datum.endpoint_url),
     utf8Bytes(datum.detail_uri),
     hexToBytes(datum.detail_hash),
-    datum.advertised_at,
+    BigInt(datum.advertised_at),
     statusTag,
   ]);
 

tests/unit/post-advert-flow-live-time.test.ts

@@ -86,28 +86,23 @@ function protocolParamsResponse() {
 }
 
 /**
- * Attempt to extract and decode the AdvertDatum from a submitted test-tx hex.
+ * Attempt to extract and decode the AdvertDatum from a submitted tx CBOR hex.
  *
- * The test tx format produced by encodeTxBody:
- *   - First 8 hex chars: big-endian uint32 byte length of JSON payload
- *   - Next (length * 2) hex chars: JSON UTF-8 encoded payload
+ * The live path emits real Cardano (Conway) CBOR. The advert datum rides in
+ * the script output as an inline datum: datum_option = [1, #6.24(bytes)], so
+ * in hex it appears as "d818" (tag 24) followed by a definite-length byte
+ * string (0x58 <len> or 0x59 <len16>) holding the raw AdvertDatum CBOR.
  *
- * The JSON has shape { type, outputs: [{..., datumHex: "<hex>"}], ... }
- * We extract the first output's datumHex and decode it with decodeAdvertDatum.
- *
- * Returns null if the hex is not in this format or has no datum.
+ * Returns null if no tag-24 wrapped datum is found or decoding fails.
  */
 function extractAdvertisedAtFromTxCbor(txCborHex: string): number | null {
   try {
-    if (txCborHex.length < 8) return null;
-    const lenHex = txCborHex.slice(0, 8);
-    const jsonLen = parseInt(lenHex, 16);
-    if (!Number.isFinite(jsonLen) || jsonLen <= 0) return null;
-    const jsonHex = txCborHex.slice(8, 8 + jsonLen * 2);
-    const jsonStr = Buffer.from(jsonHex, "hex").toString("utf8");
-    const body = JSON.parse(jsonStr) as { outputs?: Array<{ datumHex?: string }> };
-    const datumHex = body.outputs?.[0]?.datumHex;
-    if (!datumHex) return null;
+    const m = /d818(?:58([0-9a-f]{2})|59([0-9a-f]{4}))/i.exec(txCborHex);
+    if (!m) return null;
+    const byteLen = parseInt(m[1] ?? m[2]!, 16);
+    const start = m.index + m[0].length;
+    const datumHex = txCborHex.slice(start, start + byteLen * 2);
+    if (datumHex.length !== byteLen * 2) return null;
     const datum = decodeAdvertDatum(datumHex);
     return datum.advertised_at;
   } catch {

tests/unit/tx-accept-live-time.test.ts

@@ -120,6 +120,13 @@ function setupAcceptLiveHappyPath(escrowDatumHex: string): void {
     }
     // Tip slot is LOW — live path uses Date.now() for the window check
     if (method === "queryNetwork/tip") return rpcOk({ slot: 100_000, id: "a".repeat(64) });
+    // Like real Ogmios, return the script-spend redeemer with its true index:
+    // the escrow input ("ff…") sorts after the wallet input ("cc…"), so the
+    // spend redeemer index is 1. The provider's index-0 fallback for empty
+    // mock responses makes CML's set_exunits panic ("unreachable").
+    if (method === "evaluateTransaction") {
+      return rpcOk([{ validator: { purpose: "spend", index: 1 }, budget: { memory: 1_000_000, cpu: 500_000_000 } }]);
+    }
     if (method === "submitTransaction") return rpcOk({ transaction: { id: "d".repeat(64) } });
     return rpcOk({});
   });

tests/unit/tx-accept-live.test.ts

@@ -11,7 +11,7 @@
  * M1-F-4 RED — tests fail until Catherine implements the live CBOR path.
  */
 
-import { describe, it, expect, vi, beforeEach } from "vitest";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { LiveOgmiosProvider } from "../../packages/shared/src/chain/LiveOgmiosProvider.js";
 import { buildAcceptTx, ACCEPT_WINDOW_MS } from "../../packages/shared/src/tx/escrow/accept.js";
 import { TxConstructionError } from "../../packages/shared/src/tx/types.js";
@@ -36,8 +36,20 @@ const COLLATERAL_LOVELACE = 100_000_000;
 
 const mockFetch = vi.fn();
 
+// Freeze Date.now() inside the fixture's accept window: the live path checks
+// submitted_at + ACCEPT_WINDOW_MS against wall-clock time, and the fixture
+// timestamps are fixed POSIX values that would otherwise expire as real time
+// passes.
+const FAKE_NOW_MS = SUBMITTED_AT + 60_000;
+
 beforeEach(() => {
   mockFetch.mockReset();
+  vi.useFakeTimers();
+  vi.setSystemTime(FAKE_NOW_MS);
+});
+
+afterEach(() => {
+  vi.useRealTimers();
 });
 
 function rpcOk<T>(result: T) {
@@ -89,6 +101,13 @@ function setupAcceptHappyPath(escrowDatumHex: string): void {
       return rpcOk([makeOgmiosUtxo("c".repeat(64), 0, buyer.address, COLLATERAL_LOVELACE)]);
     }
     if (method === "queryNetwork/tip") return rpcOk({ slot: tipSlot, id: "a".repeat(64) });
+    // Like real Ogmios, return the script-spend redeemer with its true index:
+    // the escrow input ("ff…") sorts after the wallet input ("cc…"), so the
+    // spend redeemer index is 1. The provider's index-0 fallback for empty
+    // mock responses makes CML's set_exunits panic ("unreachable").
+    if (method === "evaluateTransaction") {
+      return rpcOk([{ validator: { purpose: "spend", index: 1 }, budget: { memory: 1_000_000, cpu: 500_000_000 } }]);
+    }
     if (method === "submitTransaction") return rpcOk({ transaction: { id: "d".repeat(64) } });
     return rpcOk({});
   });

tests/unit/tx-claim-live-time.test.ts

@@ -115,6 +115,13 @@ function setupClaimLiveHappyPath(escrowDatumHex: string): void {
     if (method === "queryNetwork/tip") {
       return rpcOk({ slot: 100_000, id: "a".repeat(64) });
     }
+    // Like real Ogmios, return the script-spend redeemer with its true index:
+    // the escrow input ("ff…") sorts after the wallet input ("cc…"), so the
+    // spend redeemer index is 1. The provider's index-0 fallback for empty
+    // mock responses makes CML's set_exunits panic ("unreachable").
+    if (method === "evaluateTransaction") {
+      return rpcOk([{ validator: { purpose: "spend", index: 1 }, budget: { memory: 1_000_000, cpu: 500_000_000 } }]);
+    }
     if (method === "submitTransaction") return rpcOk({ transaction: { id: "d".repeat(64) } });
     return rpcOk({});
   });

tests/unit/tx-claim-live.test.ts

@@ -10,7 +10,7 @@
  * M1-F-4 RED — tests fail until Catherine implements the live CBOR path.
  */
 
-import { describe, it, expect, vi, beforeEach } from "vitest";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { LiveOgmiosProvider } from "../../packages/shared/src/chain/LiveOgmiosProvider.js";
 import { buildClaimTx } from "../../packages/shared/src/tx/escrow/claim.js";
 import { TxConstructionError } from "../../packages/shared/src/tx/types.js";
@@ -32,8 +32,19 @@ const COLLATERAL_LOVELACE = 100_000_000;
 
 const mockFetch = vi.fn();
 
+// Freeze Date.now() inside the fixture's claim window: the live path checks
+// deliver_by against wall-clock time, and the fixture deadlines are fixed
+// POSIX timestamps that would otherwise expire as real time passes.
+const FAKE_NOW_MS = DELIVER_BY - 30_000;
+
 beforeEach(() => {
   mockFetch.mockReset();
+  vi.useFakeTimers();
+  vi.setSystemTime(FAKE_NOW_MS);
+});
+
+afterEach(() => {
+  vi.useRealTimers();
 });
 
 function rpcOk<T>(result: T) {
@@ -87,6 +98,13 @@ function setupClaimHappyPath(escrowDatumHex: string): void {
       // Tip well before deliver_by
       return rpcOk({ slot: Math.floor((DELIVER_BY - 60_000) / 1000), id: "a".repeat(64) });
     }
+    // Like real Ogmios, return the script-spend redeemer with its true index:
+    // the escrow input ("ff…") sorts after the wallet input ("cc…"), so the
+    // spend redeemer index is 1. The provider's index-0 fallback for empty
+    // mock responses makes CML's set_exunits panic ("unreachable").
+    if (method === "evaluateTransaction") {
+      return rpcOk([{ validator: { purpose: "spend", index: 1 }, budget: { memory: 1_000_000, cpu: 500_000_000 } }]);
+    }
     if (method === "submitTransaction") return rpcOk({ transaction: { id: "d".repeat(64) } });
     return rpcOk({});
   });