refactor(test): swap sinon for vitest's native vi.fn / vi.spyOn

Replaces ~1,500 sinon call sites across 45 test files with vitest's
native mocking API. Drops `sinon` + `@types/sinon` devDeps from
pure-vitest packages. Hybrid packages (sdk, rebalancer, cli, infra,
svm-sdk, tron-sdk, relayer) keep sinon for hardhat/e2e paths that
stay on mocha.

## Mapping

### Stubs / spies
- `sinon.stub()` → `vi.fn()`
- `sinon.stub(obj, 'm')` → `vi.spyOn(obj, 'm').mockImplementation(...)`
- `sinon.spy(obj, 'm')` → `vi.spyOn(obj, 'm')`
- `.returns(x)` → `.mockReturnValue(x)`
- `.resolves(x)` → `.mockResolvedValue(x)`  (argument now required —
  `.mockResolvedValue(undefined)` for void-returning stubs)
- `.rejects(err)` → `.mockRejectedValue(err)`
- `.callsFake(fn)` → `.mockImplementation(fn)`
- `.onFirstCall().X()` / `.onSecondCall().X()` chains →
  `.mockXOnce(...).mockXOnce(...)`

### Assertions
- `sinon.assert.calledOnce(s)` → `expect(s).toHaveBeenCalledOnce()`
- `sinon.assert.calledTwice(s)` → `expect(s).toHaveBeenCalledTimes(2)`
- `sinon.assert.callCount(s, n)` → `expect(s).toHaveBeenCalledTimes(n)`
- `sinon.assert.calledWith(s, ...args)` → `expect(s).toHaveBeenCalledWith(...args)`
- `sinon.assert.calledOnceWithExactly(s, ...a)` →
  `expect(s).toHaveBeenCalledExactlyOnceWith(...a)`
- `sinon.assert.calledWithMatch(s, obj)` →
  `expect(s).toHaveBeenCalledWith(expect.objectContaining(obj))`
- `sinon.assert.notCalled(s)` → `expect(s).not.toHaveBeenCalled()`
- `s.callCount` → `s.mock.calls.length`
- `s.firstCall.args[n]` / `s.getCall(n).args[m]` → `s.mock.calls[n][m]`
- `s.returnValues[n]` → `s.mock.results[n].value`

### Matchers
- `sinon.match.any` → `expect.anything()`
- `sinon.match.string` → `expect.any(String)`
- `sinon.match.object` → `expect.any(Object)` / `expect.objectContaining(...)`

### Sandbox lifecycle
7 files in sdk previously used `sandbox = sinon.createSandbox()` +
`sandbox.stub(...)` + `sandbox.restore()`. Converted to direct
`vi.spyOn(...)` calls with `afterEach(() => vi.restoreAllMocks())`.

### Fake timers (11 sites in http-registry-server)
- `sinon.useFakeTimers({ now: date })` → `vi.useFakeTimers({ now: date })`
- `clock.tick(ms)` → `vi.advanceTimersByTime(ms)`
- `clock.restore()` → `vi.useRealTimers()`
- The local `clock` variable is dropped — vitest uses module-level
  `vi` accessors.

### Restoration
- `sinon.restore()` → `vi.restoreAllMocks()`
- `stub.restore()` → `stub.mockRestore()`
- `stub.resetHistory()` → `stub.mockClear()`
- `stub.reset()` → `stub.mockReset()`

### Types
- `sinon.SinonStub` → `MockInstance` from `vitest`
- `sinon.SinonStub<[Args], Ret>` → `MockInstance<(...args: Args) => Ret>`
- `sinon.SinonSandbox` — removed (no vitest equivalent)
- `sinon.SinonFakeTimers` — removed (vi is module-level)

## Tricky patterns

### `sinon.createStubInstance(Class)` (http-registry-server, rebalancer, keyfunder)
Replaced with hand-rolled partial mocks typed as the class interface:
```ts
// Before: const mock = sinon.createStubInstance(Registry);
// After:
const mock = { getUri: vi.fn(), getChains: vi.fn(), ... } as unknown as IRegistry;
```
For MultiProvider/MultiProtocolProvider (rebalancer) a prototype-walking
helper auto-mocks every prototype method with `vi.fn()`.

### `.withArgs(x).returns(y)` (rebalancer, cli)
No vitest equivalent. Replaced with a single `mockImplementation` that
branches on the argument:
```ts
vi.fn(async (id) => routes[id]?.coreConfig)
```

### Typed factory pattern for mock objects (rebalancer)
`createMockActionTracker()` now returns a mapped type
`{ [K in keyof IActionTracker]: Mock<IActionTracker[K]> }` so callers
can invoke `actionTracker.syncTransfers.mockRejectedValue(err)` without
casts.

### `IExternalBridge` mock (rebalancer)
`bridge: any` retained in `InventoryRebalancer.test.ts` — the existing
pre-migration typing. Downstream annotations use targeted `unknown[]`
+ narrow `as QuoteParams` rather than `any` for `.mock.calls` access.

### `getChainMetadata` stub (rebalancer RebalancerContextFactory)
SUT reads only `.protocol` off the return. Rather than fabricating a
full `ChainMetadata`, cast the partial return `as unknown as ChainMetadata`
to make the mock's intent explicit.

## cli setup file fix

Previous PR deleted `vitest.setup.ts` but the cli's `vitest.config.ts`
still referenced it. Dropped the `../../vitest.setup.ts` entry from
cli's setupFiles — only `./src/tests/test-setup.ts` remains.

## devDeps dropped (pure-vitest packages)

ccip-server, deploy-sdk, http-registry-server, keyfunder, metrics,
provider-sdk (no sinon usage), utils, warp-monitor.

Hybrid packages retain `sinon` + `@types/sinon` for hardhat/e2e:
sdk, rebalancer, cli, infra, svm-sdk, tron-sdk, relayer.

Catalog: `sinon` and `@types/sinon` entries retained (still used by
hybrid packages' mocha-run test paths).

## Tests

All 1,654+ migrated vitest tests pass. `pnpm build` green at repo root.
`pnpm format:check` + `pnpm lint` clean.

Author: paulbalaji

pnpm-lock.yaml

@@ -54,11 +54,9 @@
     "@types/node": "catalog:",
     "@types/pg": "^8.16.0",
     "@types/pino-http": "^5.8.4",
-    "@types/sinon": "catalog:",
     "@vercel/ncc": "catalog:",
     "nodemon": "^3.0.3",
     "pino-pretty": "catalog:",
-    "sinon": "catalog:",
     "tsx": "catalog:",
     "typescript": "catalog:",
     "vite": "catalog:",

typescript/ccip-server/package.json

@@ -1,5 +1,4 @@
-import sinon from 'sinon';
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 
 import {
   PostCallsSchema,
@@ -11,20 +10,22 @@ import {
 import { CallCommitmentsService } from '../../src/services/CallCommitmentsService.js';
 
 function mockLogger() {
-  return {
-    info: sinon.stub(),
-    warn: sinon.stub(),
-    error: sinon.stub(),
-    debug: sinon.stub(),
-    setBindings: sinon.stub(),
-    child: sinon.stub().returnsThis(),
+  const logger: Record<string, ReturnType<typeof vi.fn>> = {
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    debug: vi.fn(),
+    setBindings: vi.fn(),
+    child: vi.fn(),
   };
+  logger.child.mockReturnValue(logger);
+  return logger;
 }
 
 function mockRes() {
-  const json = sinon.stub();
-  const status = sinon.stub().returns({ json });
-  const sendStatus = sinon.stub();
+  const json = vi.fn();
+  const status = vi.fn().mockReturnValue({ json });
+  const sendStatus = vi.fn();
   return { status, json, sendStatus };
 }
 
@@ -113,36 +114,36 @@ describe('CallCommitmentsService.handleCommitment', () => {
 
     await service.handleCommitment(req, res);
 
-    expect(res.status.calledWith(400)).toBe(true);
-    expect(res.json.called).toBe(true);
+    expect(res.status).toHaveBeenCalledWith(400);
+    expect(res.json).toHaveBeenCalled();
   });
 
   it('routes ICA payload to deriveIcaFromConfig', async () => {
     const mockIca = '0x' + 'ff'.repeat(20);
     const icaApp = {
-      getAccount: sinon.stub().resolves(mockIca),
+      getAccount: vi.fn().mockResolvedValue(mockIca),
     };
     const multiProvider = {
-      getChainName: sinon.stub().returns('ethereum'),
-      getProvider: sinon.stub(),
+      getChainName: vi.fn().mockReturnValue('ethereum'),
+      getProvider: vi.fn(),
     };
     const service = createService({ icaApp, multiProvider });
-    service.upsertCommitmentInDB = sinon.stub().resolves();
+    service.upsertCommitmentInDB = vi.fn().mockResolvedValue(undefined);
 
     const req = { body: icaPayload, log: mockLogger() };
     const res = mockRes();
 
     await service.handleCommitment(req, res);
 
-    expect(icaApp.getAccount.called).toBe(true);
-    expect(res.sendStatus.calledWith(200)).toBe(true);
+    expect(icaApp.getAccount).toHaveBeenCalled();
+    expect(res.sendStatus).toHaveBeenCalledWith(200);
   });
 
   it('routes legacy payload to deriveIcaFromDispatchTx', async () => {
     const multiProvider = {
-      getChainName: sinon.stub().returns('ethereum'),
-      getProvider: sinon.stub().returns({
-        getTransactionReceipt: sinon.stub().resolves(null),
+      getChainName: vi.fn().mockReturnValue('ethereum'),
+      getProvider: vi.fn().mockReturnValue({
+        getTransactionReceipt: vi.fn().mockResolvedValue(null),
       }),
     };
     const service = createService({ multiProvider });
@@ -153,10 +154,10 @@ describe('CallCommitmentsService.handleCommitment', () => {
     await service.handleCommitment(req, res);
 
     // Should fail because receipt is null, returning 400
-    expect(res.status.calledWith(400)).toBe(true);
-    expect(
-      multiProvider.getProvider.calledWith(legacyPayload.originDomain),
-    ).toBe(true);
+    expect(res.status).toHaveBeenCalledWith(400);
+    expect(multiProvider.getProvider).toHaveBeenCalledWith(
+      legacyPayload.originDomain,
+    );
   });
 });
 

typescript/ccip-server/tests/services/CallCommitmentsService.test.ts

@@ -1,5 +1,4 @@
-import { expect } from 'vitest';
-import sinon from 'sinon';
+import { expect, vi } from 'vitest';
 
 import {
   ProtocolType,
@@ -48,16 +47,15 @@ function buildCrossCollateralToken({
 function buildContext(
   routes: Record<string, { coreConfig: WarpCoreConfig; deployConfig: any }>,
 ) {
-  const getWarpRoute = sinon.stub();
-  const getWarpDeployConfig = sinon.stub();
+  const getWarpRoute = vi.fn(
+    async (routeId: string) => routes[routeId]?.coreConfig,
+  );
+  const getWarpDeployConfig = vi.fn(
+    async (routeId: string) => routes[routeId]?.deployConfig,
+  );
 
-  for (const [id, route] of Object.entries(routes)) {
-    getWarpRoute.withArgs(id).resolves(route.coreConfig);
-    getWarpDeployConfig.withArgs(id).resolves(route.deployConfig);
-  }
-
-  const addWarpRouteConfig = sinon.stub().resolves();
-  const addWarpRoute = sinon.stub().resolves();
+  const addWarpRouteConfig = vi.fn().mockResolvedValue(undefined);
+  const addWarpRoute = vi.fn().mockResolvedValue(undefined);
 
   return {
     context: {
@@ -87,7 +85,7 @@ describe('runWarpRouteCombine', () => {
   const ROUTER_C = '0x3333333333333333333333333333333333333333';
 
   afterEach(() => {
-    sinon.restore();
+    vi.restoreAllMocks();
   });
 
   it('warns when combine will remove previously enrolled routers', async () => {
@@ -137,16 +135,16 @@ describe('runWarpRouteCombine', () => {
       'route-a': routeA,
       'route-b': routeB,
     });
-    const warnSpy = sinon.spy(rootLogger, 'warn');
+    const warnSpy = vi.spyOn(rootLogger, 'warn');
 
     await runWarpRouteCombine({
       context,
       routeIds: ['route-a', 'route-b'],
       outputWarpRouteId: 'MULTI/test',
     });
 
-    expect(warnSpy.called).toBe(true);
-    const warnings = warnSpy.getCalls().map((call) => String(call.args[0]));
+    expect(warnSpy).toHaveBeenCalled();
+    const warnings = warnSpy.mock.calls.map((args) => String(args[0]));
     expect(
       warnings.some(
         (warning) =>
@@ -155,7 +153,7 @@ describe('runWarpRouteCombine', () => {
       ),
     ).toBe(true);
 
-    const updatedRouteAConfig = addWarpRouteConfig.getCall(0).args[0];
+    const updatedRouteAConfig = addWarpRouteConfig.mock.calls[0][0];
     expect(updatedRouteAConfig.anvil2.crossCollateralRouters).toEqual({
       [DOMAIN_BY_CHAIN.anvil3.toString()]: [addressToBytes32(ROUTER_B)],
     });

typescript/cli/src/deploy/warp.test.ts

@@ -1,5 +1,4 @@
-import { expect } from 'vitest';
-import sinon from 'sinon';
+import { expect, vi } from 'vitest';
 
 import {
   type AltVM,
@@ -60,7 +59,7 @@ describe('createAltVMSigners', () => {
   beforeEach(() => {
     capturedConfigs.length = 0;
     delete process.env.HYP_ACCOUNT_ADDRESS_STARKNET;
-    sinon.restore();
+    vi.restoreAllMocks();
   });
 
   function getProtocolRegistry(): NonNullable<
@@ -213,9 +212,9 @@ describe('createAltVMSigners', () => {
   });
 
   it('prompts for private key when strategy omits it', async () => {
-    const privateKeyPrompt = sinon
-      .stub(altVmPrompts, 'password')
-      .resolves('0xprompted-key');
+    const privateKeyPrompt = vi
+      .spyOn(altVmPrompts, 'password')
+      .mockResolvedValue('0xprompted-key');
 
     const strategy: Partial<ExtendedChainSubmissionStrategy> = {
       starknetsepolia: {
@@ -235,7 +234,7 @@ describe('createAltVMSigners', () => {
       getProtocolRegistry(),
     );
 
-    expect(privateKeyPrompt.calledOnce).toBe(true);
+    expect(privateKeyPrompt).toHaveBeenCalledOnce();
     expect(capturedConfigs).toHaveLength(1);
     expect(capturedConfigs[0]).toEqual({
       privateKey: '0xprompted-key',
@@ -244,7 +243,7 @@ describe('createAltVMSigners', () => {
   });
 
   it('throws for non-Starknet jsonRpc strategies without a private key', async () => {
-    const privateKeyPrompt = sinon.stub(altVmPrompts, 'password');
+    const privateKeyPrompt = vi.spyOn(altVmPrompts, 'password');
 
     const strategy: Partial<ExtendedChainSubmissionStrategy> = {
       radix: {
@@ -272,12 +271,12 @@ describe('createAltVMSigners', () => {
         );
       });
 
-    expect(privateKeyPrompt.called).toBe(false);
+    expect(privateKeyPrompt).not.toHaveBeenCalled();
     expect(capturedConfigs).toHaveLength(0);
   });
 
   it('throws for non-jsonRpc strategies instead of prompting for a private key', async () => {
-    const privateKeyPrompt = sinon.stub(altVmPrompts, 'password');
+    const privateKeyPrompt = vi.spyOn(altVmPrompts, 'password');
 
     const strategy: Partial<ExtendedChainSubmissionStrategy> = {
       radix: {
@@ -306,14 +305,14 @@ describe('createAltVMSigners', () => {
         );
       });
 
-    expect(privateKeyPrompt.called).toBe(false);
+    expect(privateKeyPrompt).not.toHaveBeenCalled();
     expect(capturedConfigs).toHaveLength(0);
   });
 
   it('prefers explicit per-chain strategy key over prompted fallback', async () => {
-    const privateKeyPrompt = sinon
-      .stub(altVmPrompts, 'password')
-      .resolves('0xprompted-key');
+    const privateKeyPrompt = vi
+      .spyOn(altVmPrompts, 'password')
+      .mockResolvedValue('0xprompted-key');
 
     const strategy: Partial<ExtendedChainSubmissionStrategy> = {
       starknetsepolia: {
@@ -341,7 +340,7 @@ describe('createAltVMSigners', () => {
       getProtocolRegistry(),
     );
 
-    expect(privateKeyPrompt.calledOnce).toBe(true);
+    expect(privateKeyPrompt).toHaveBeenCalledOnce();
     expect(capturedConfigs).toHaveLength(2);
     expect(capturedConfigs[0]).toEqual({
       privateKey: '0xprompted-key',
@@ -354,12 +353,10 @@ describe('createAltVMSigners', () => {
   });
 
   it('does not reuse a prompted Starknet account address across chains', async () => {
-    const accountPrompt = sinon
-      .stub(altVmPrompts, 'input')
-      .onFirstCall()
-      .resolves('0xaaa')
-      .onSecondCall()
-      .resolves('0xbbb');
+    const accountPrompt = vi
+      .spyOn(altVmPrompts, 'input')
+      .mockResolvedValueOnce('0xaaa')
+      .mockResolvedValueOnce('0xbbb');
 
     const keys: SignerKeyProtocolMap = {
       [ProtocolType.Starknet]: '0xkey',
@@ -373,7 +370,7 @@ describe('createAltVMSigners', () => {
       getProtocolRegistry(),
     );
 
-    expect(accountPrompt.callCount).toBe(2);
+    expect(accountPrompt).toHaveBeenCalledTimes(2);
     expect(capturedConfigs).toHaveLength(2);
     expect(capturedConfigs[0].accountAddress).toBe('0xaaa');
     expect(capturedConfigs[1].accountAddress).toBe('0xbbb');

typescript/cli/src/tests/context/create-altvm-signers.test.ts

@@ -51,10 +51,8 @@
   "devDependencies": {
     "@hyperlane-xyz/tsconfig": "workspace:^",
     "@types/node": "catalog:",
-    "@types/sinon": "catalog:",
     "@vercel/ncc": "catalog:",
     "oxfmt": "catalog:",
-    "sinon": "catalog:",
     "tsx": "catalog:",
     "typescript": "catalog:",
     "vite": "catalog:",