[holmesworcester]

Every Tests run on main since early August has failed at Install and build, before any test runs:

packages/crypto postbuild: src/symmetric.ts(150,39): error TS2554: Expected 3-4 arguments, but got 2.
packages/crypto postbuild: src/symmetric.ts(152,32): error TS2339: Property 'tag' does not exist on type
  '(false | { message: Uint8Array; tag: number }) & (false | { message: string; tag: number })'.

Cause

pnpm-lock.yaml is lockfileVersion: '9.0', written by pnpm 10. The workflow installs with pnpm 8, which cannot read that format, so each run silently re-resolves from scratch — the install rewrites the lockfile by +10377/−14965 lines — and picks up libsodium-wrappers-sumo 0.7.16 instead of the locked 0.7.13. 0.7.16's bundled types changed the signature of crypto_secretstream_xchacha20poly1305_pull, and packages/crypto/src/symmetric.ts no longer type-checks against them.

Reproduced locally on a clean copy of release/10.0.0:

node	pnpm	install	resolved sumo	pnpm build
18.20.4	8	pnpm install	0.7.16	fails, identical four errors
20.20.1	10	pnpm install --frozen-lockfile	0.7.13	builds

Change

.github/workflows/tests.yaml: pnpm 8 → 10, node 18 → 20, pnpm install → pnpm install --frozen-lockfile (so a stale lockfile fails loudly instead of drifting), and the three actions bumped to their node20 releases.

Nothing in the code changes. Whether symmetric.ts should also be made to compile against sumo 0.7.16 is a separate question — this PR only makes CI test what the lockfile says.

Once this lands, re-running the Tests check on #40 should go green: pull_request runs use the workflow from the merge of head and base.

🤖 Generated with Claude Code