fix(provider): rebuild Koios native reference scripts from their JSON value (#571)

[Kshot3000]

Fixes part of #571: the Koios provider dropping native reference scripts.

The bug

toUTxO in Koios.ts only set scriptRef when reference_script.bytes was present, and its switch handled only the timelock native type. But db-sync stores no CBOR for native scripts before the Dijkstra era, so Koios returns bytes: null for timelock and multisig reference scripts — those UTxOs came back with no scriptRef and no error, and a multisig script was dropped even when its bytes were present.

The fix

• For a native (timelock or multisig) reference script with bytes: null, the script is rebuilt from reference_script.value — which is the db-sync script.json (verified in the Koios/gREST source: reference_script is built as hash / bytes / value = script.json / type / size, and the JSON is the cardano-cli native-script form the SDK already models as NativeScriptJSON). The rebuild is recursive (sig / before / after / all / any / atLeast) and goes through the existing NativeJSONSchema.
• The rebuilt script is checked against the hash Koios reports, as Koios: native reference scripts are dropped #571 prescribes: a mismatch throws an error naming both hashes, and a value that does not decode as a native script throws a clear "could not be rebuilt" error — the script is never silently dropped or attached unchecked. This follows toUTxO's existing contract, whose other decoders (fromBech32, fromCBORHex) also throw on malformed input.
• multisig is added to the bytes path alongside timelock, keeping the bytes path for Dijkstra-era outputs.

Left out, deliberately: the related question in #571 about /utxo_info returning spent outputs. The Provider interface does not specify the expected behaviour, so that is a maintainer decision, not something to pick in a drive-by fix.

Tests

Five new tests in KoiosLovelace.test.ts, each verified red on unmodified main (the script came back undefined, or nothing threw), one -t filter at a time:

• a timelock all [sig, any [sig, before]] script rebuilt from its value — asserted against a hand-encoded CBOR oracle and an independently computed blake2b-224 script hash (Python hashlib, 0x00 || CBOR), not against the SDK's own encoder alone;
• a multisig script rebuilt from its value;
• a multisig script decoded from bytes when present;
• a hash mismatch throws;
• a malformed value throws instead of being silently dropped.

Koios test file: 34/34. Full package suite: 1683 passed / 75 skipped / 0 failed (test files 101 passed / 1 skipped of 102; main baseline 1678 + the 5 new tests). tsc --noEmit and eslint clean; both touched files' prettier diff-line counts exactly equal unmodified main's (they fail --check on main too — no unrelated formatter hunks).

Changeset added (patch).

---

Independent builder — not affiliated with the Cardano Foundation, IOG or Intersect.

@Kshot9000 — https://x.com/kshot9000
ADA donations: addr1q8hnl6vl5a6k3rw3n5g3jtte696zcl76kfatzv7gpswa9r0dj7fma6klq55y4ffm7tf0em09udnyhuk4ah92pl5x9jpqjae44v

cc @cardano-foundation @IntersectMBO