fix(evolution): decode CBOR tags with 4- and 8-byte headers (#580 part 1)

[Kshot3000]

What this fixes

Part 1 of #580: CBOR tags written with a 4- or 8-byte header fail to decode.

decodeTagAt in packages/evolution/src/CBOR.ts had branches only for additional info < 24, 24 (1-byte) and 25 (2-byte), so a transaction that writes tag 258 as da00000102 — a form the node accepts and CML round-trips byte for byte — threw:

CBORError: Unsupported tag encoding: 26

The fix

Two new branches in decodeTagAt, mirroring how decodeUintAt already reads 4- and 8-byte integers in the same file:

• additional info 26 reads the tag value from the next 4 bytes (with an Insufficient data for 4-byte tag bound check);
• additional info 27 accumulates the next 8 bytes as a bigint before converting to the number the Tag schema models (with an Insufficient data for 8-byte tag bound check).

No encoder change was needed: the width is already recorded from additionalInfoToByteSize (26 → 4, 27 → 8) and encodeTagSync already replays a captured tag width through encodeIntHeader, so a decoded wide-header tag re-encodes with the same width.

Tests

Reproduced red on main first — each new test failed with Unsupported tag encoding: 26 / 27 (the truncated-header tests failed because the old code reported the encoding as unsupported rather than the data as insufficient):

• CBOR-with-format.test.ts: round-trip vectors for tag 258 in a 4-byte header (da000001028100) and an 8-byte header (db00000000000001028100), in both the hex and bytes suites; plain decode of both widths; a tag value that needs the 4-byte header (1,000,000) and one that needs the 8-byte header (2^32); a bignum tag (tag 2) written with a 4-byte header; truncated 4- and 8-byte headers rejected with the new bound errors.
• Transaction-with-format.test.ts: the issue's regression shape — the existing non-canonical test transaction with its inputs-set tag 258 written as da00000102 — round-trips byte for byte, body included.

Full @evolution-sdk/evolution suite: 1690 passed / 75 skipped / 0 failed (test files 101 passed / 1 skipped of 102; main baseline 1678 passed + the 12 new tests). tsc --noEmit and eslint are clean. Prettier: CBOR.ts already fails the check on unmodified main; this branch's prettier diff-line count for the file is identical to main's, and both test files are prettier-clean.

Left out, deliberately

• Part 2 of CBOR: tags with 4- and 8-byte headers fail to decode, and two smaller preservation gaps #580 (an empty indefinite witness set written back as a0) belongs to CBOR: Plutus data encodings change on re-encode, breaking the script data hash and the transaction id #576's fix, as the issue itself states — it is not in this change.
• Part 3 (a wording fix in the CBOR guide comment) is a docs-only change, kept out of this decoder fix.

---

Independent builder — not affiliated with the Cardano Foundation, IOG or Intersect.

— Kyle Cox, @Kshot9000 (https://x.com/kshot9000)

Tips: ADA addr1q8hnl6vl5a6k3rw3n5g3jtte696zcl76kfatzv7gpswa9r0dj7fma6klq55y4ffm7tf0em09udnyhuk4ah92pl5x9jpqjae44v