chore(config): pin npm to 12.0.2 and add supply-chain cooldown

[gilescope]

Supply-chain hardening following the 2026-08-04 keyv/cacheable npm worm (868+ packages compromised via preinstall payloads published through legitimate maintainer accounts).

• Pin the npm CLI to 12.0.2 in CI (npm 12 blocks dependency lifecycle scripts by default behind allowScripts) instead of floating npm@latest/setup-node default
• Bump node-version where npm 12 requires it (engines: ^22.22.2 || ^24.15.0 || >=26)
• Add .npmrc cooldown: min-release-age=7 so freshly-published (potentially wormed) versions can't resolve for 7 days; @midnight-ntwrk/* and @midnightntwrk/* exempt so same-day internal releases still install
• Renovate: npm CLI pins in workflows/Earthfiles are matched by new custom managers in midnightntwrk/renovate-config, so this pin stays bumpable automatically

[github-actions]

Unit Test Results - MidnightJS

   28 files  ±0    150 suites  ±0   5m 27s ⏱️ -1s
1 203 tests ±0  1 201 ✅ ±0  2 💤 ±0  0 ❌ ±0 
2 424 runs  ±0  2 420 ✅ ±0  4 💤 ±0  0 ❌ ±0 

Results for commit 1d64df1. ± Comparison against base commit 8de4562.

♻️ This comment has been updated with latest results.

[MidnightCI]

E2E Tests Results

e2e_tests_reports: Run #4676

Tests 📝	Passed ✅	Failed ❌	Skipped ⏭️	Pending ⏳	Other ❓	Flaky 🍂	Duration ⏱️
147	142	0	5	0	0	0	32m 31s

🎉 All tests passed!

Suites

142 passed, 0 failed, and 5 other

Suite	Passed	Failed	Other	Duration
✅ testkit-js/testkit-js-e2e/test/contracts.blocktime.it.test.ts         ✅ Block Time Contract Tests 1 > blockTimeLt tests > should succeed when both device time and node time are less than future time         ✅ Block Time Contract Tests 1 > blockTimeLt tests > should fail immediately on device when device time is already past the check time         ⏭️ Block Time Contract Tests 1 > blockTimeLt tests > should succeed on device but fail on node when submission is delayed         ✅ Block Time Contract Tests 1 > blockTimeLt tests > should succeed when both device time and node time are greater than past time         ✅ Block Time Contract Tests 1 > blockTimeLt tests > should fail immediately on device when device time is less than check time         ✅ Block Time Contract Tests 1 > blockTimeLt tests > should succeed even with submission delay when checking past time         ✅ Block Time Contract Tests 1 > blockTimeLt tests > should succeed when both device time and node time are greater than past time         ✅ Block Time Contract Tests 1 > blockTimeLt tests > should fail when device time is not greater than check time         ✅ Block Time Contract Tests 1 > blockTimeLt tests > should succeed when both device time and node time are less than or equal to future time         ✅ Block Time Contract Tests 1 > blockTimeLt tests > should fail immediately on device when device time exceeds check time         ⏭️ Block Time Contract Tests 1 > blockTimeLt tests > should succeed on device but fail on node when submission delay causes time to exceed threshold         ✅ Block Time Contract Tests 1 > blockTimeLt tests > should demonstrate different failure points for Lt check > Immediate past time - fails on device         ⏭️ Block Time Contract Tests 1 > blockTimeLt tests > should demonstrate different failure points for Lt check > Near future time with delay - succeeds on device, fails on node         ✅ Block Time Contract Tests 1 > blockTimeLt tests > should demonstrate different failure points for Lt check > Far future time - succeeds on both device and node         ✅ Block Time Contract Tests 1 > blockTimeLt tests > should handle maximum time values         ✅ Block Time Contract Tests 1 > blockTimeLt tests > should handle zero time value	✅ 13	❌ 0	⏭️ 3	2m 47s
✅ testkit-js/testkit-js-e2e/test/contracts.blocktime2.it.test.ts         ✅ Block Time Contract Tests 2 > blockTimeLt tests > should demonstrate different failure points for Lt check > Immediate past time - fails on device         ⏭️ Block Time Contract Tests 2 > blockTimeLt tests > should demonstrate different failure points for Lt check > Near future time with delay - succeeds on device, fails on node         ✅ Block Time Contract Tests 2 > blockTimeLt tests > should demonstrate different failure points for Lt check > Far future time - succeeds on both device and node         ✅ Block Time Contract Tests 2 > blockTimeLt tests > should handle maximum time values         ✅ Block Time Contract Tests 2 > blockTimeLt tests > should handle zero time value	✅ 4	❌ 0	⏭️ 1	1m 11s
✅ testkit-js/testkit-js-e2e/test/contracts.events.provider.it.test.ts         ✅ Contract events — provider read surface (E2E) > query filters > omitted types returns the full corpus         ✅ Contract events — provider read surface (E2E) > query filters > a single-type filter returns exactly that type         ✅ Contract events — provider read surface (E2E) > query filters > a multi-type filter returns exactly the requested types         ✅ Contract events — provider read surface (E2E) > query filters > a matching fieldPrefix returns the event with the full field value         ✅ Contract events — provider read surface (E2E) > query filters > a non-matching fieldPrefix returns an empty array, not an error         ✅ Contract events — provider read surface (E2E) > query filters > an empty-string prefix matches every event of the filtered type         ✅ Contract events — provider read surface (E2E) > query filters > toBlock before the first emission returns an empty array         ✅ Contract events — provider read surface (E2E) > query filters > fromBlock excludes events emitted in earlier blocks         ✅ Contract events — provider read surface (E2E) > query filters > an inclusive fromBlock/toBlock window returns exactly the events inside it         ✅ Contract events — provider read surface (E2E) > subscription > replays historical events in emission order         ✅ Contract events — provider read surface (E2E) > subscription > delivers an event emitted after the subscription opened         ✅ Contract events — provider read surface (E2E) > subscription > startAt { fromId } resumes inclusively at that event         ✅ Contract events — provider read surface (E2E) > subscription > toBlock bounds the stream and completes it server-side         ⏭️ Contract events — provider read surface (E2E) > emits a Misc event with the full structure and emitted values	✅ 13	❌ 0	⏭️ 1	29.4s
✅ testkit-js/testkit-js-e2e/test/contracts.events.unshielded.it.test.ts         ✅ Contract events — Unshielded* (E2E) > emits an UnshieldedSpend event with sender, token type and amount         ✅ Contract events — Unshielded* (E2E) > emits an UnshieldedReceive event with recipient, token type and amount         ✅ Contract events — Unshielded* (E2E) > emits an UnshieldedBurn event with sender, token type and amount	✅ 3	❌ 0	⏭️ 0	1m 29s
✅ testkit-js/testkit-js-e2e/test/contracts.it.test.ts         ✅ Contracts API > should create unproven call and deploy transactions for contract with private state         ✅ Contracts API > should deploy contract on the chain [@slow]         ✅ Contracts API > should return deployed contract if it exists on specific address         ✅ Contracts API > should return deployed contract if it exists on specific address without initialPrivateState         ✅ Contracts API > should throw error if contract address has wrong format - length         ✅ Contracts API > should return deployed contract if it exists on specific address with initialPrivateState and empty local private state store         ✅ Contracts API > should return deployed contract if it exists on specific address with different initialPrivateState         ✅ Contracts API > should wait indefinitely until contract exists on specific address [@slow]         ✅ Contracts API > should throw for incompatible contract types that differ by circuit ids         ✅ Contracts API > should throw for incompatible contract types with same shape but different verifier keys         ✅ Contracts API > should return contract interface and execute circuit operations [@slow]         ✅ Contracts API > should throw error on undefined public state at wrong address         ✅ Contracts API > should submit a deploy transaction [@slow]         ✅ Contracts API > should submit transaction that calls circuit in contract [@slow]         ✅ Contracts API > should throw error if private state is undefined         ✅ Contracts API > should throw error if public state is undefined         ✅ Contracts API > should throw error if contract address has wrong format - not hex         ✅ Contracts API > should return the latest observed state of a deployed contract and is independent of the chain state         ✅ Contracts API > should wait indefinitely until state change, if stopped returns last contract state [@slow]	✅ 19	❌ 0	⏭️ 0	3m 23s
✅ testkit-js/testkit-js-e2e/test/contracts.scopedtx.it.test.ts         ✅ Scoped Transaction Contract Tests > should submit scoped transaction that calls circuit in contract [@slow]         ✅ Scoped Transaction Contract Tests > should submit scoped transaction that calls 2 different circuits in contract [@slow]         ✅ Scoped Transaction Contract Tests > should submit scoped transaction that calls 2 circuits in contract and DOES NOT preserve execution order [@slow]         ✅ Scoped Transaction Contract Tests > should not submit scoped transaction when one circuit call fails [@slow]	✅ 4	❌ 0	⏭️ 0	53.7s
✅ testkit-js/testkit-js-e2e/test/contracts.signing-key.it.test.ts         ✅ Contract maintenance authority signing keys > should replace the contract maintenance authority across schnorr and ecdsa signing keys [@slow]         ✅ Contract maintenance authority signing keys > should replace the contract maintenance authority using ecdsa signing keys [@slow]         ✅ Contract maintenance authority signing keys > should remove and re-insert a verifier key authorized by an ecdsa signing key [@slow]	✅ 3	❌ 0	⏭️ 0	2m 25s
✅ testkit-js/testkit-js-e2e/test/contracts.singlecontract.nostate.it.test.ts         ✅ Contracts API > should deploy and find contracts with no private state [@slow]         ✅ Contracts API > should create unproven call and deploy transactions for contract with no private state         ✅ Contracts API > should submit deploy and call transactions for contracts with no private state [@slow]	✅ 3	❌ 0	⏭️ 0	1m 31s
✅ testkit-js/testkit-js-e2e/test/contracts.snarkupgrade.it.test.ts         ✅ Contracts API Snark Upgrade [dedicated contract] [@slow] > should successfully remove verifier key using submitRemoveVerifierKeyTx         ✅ Contracts API Snark Upgrade [dedicated contract] [@slow] > should successfully remove verifier key using createContractMaintenanceTxInterface         ✅ Contracts API Snark Upgrade [dedicated contract] [@slow] > should successfully remove verifier key and disable circuit operation         ✅ Contracts API Snark Upgrade [dedicated contract] [@slow] > should succeed on verifier key insertion retry after removal         ✅ Contracts API Snark Upgrade [dedicated contract] [@slow] > should fail when inserting verifier key for wrong circuit after removal	✅ 5	❌ 0	⏭️ 0	3m 18s
✅ testkit-js/testkit-js-e2e/test/contracts.snarkupgrade.singlecontract.it.test.ts         ✅ Contracts API Snark Upgrade [single contract] > submitReplaceAuthorityTx - successful replace authority with new key[@slow]         ✅ Contracts API Snark Upgrade [single contract] > submitReplaceAuthorityTx - successful replace authority with same key [@slow]         ✅ Contracts API Snark Upgrade [single contract] > submitReplaceAuthorityTx - should fail on replace contract that is not deployed to contract address         ✅ Contracts API Snark Upgrade [single contract] > submitReplaceAuthorityTx - should fail when signing key for contract address does not exist         ✅ Contracts API Snark Upgrade [single contract] > submitInsertVerifierKeyTx - should fail on invalid verifier key         ✅ Contracts API Snark Upgrade [single contract] > submitInsertVerifierKeyTx - successful insert on not present circuitId [@slow]         ✅ Contracts API Snark Upgrade [single contract] > submitInsertVerifierKeyTx - should fail on contract not present on contract address         ✅ Contracts API Snark Upgrade [single contract] > submitInsertVerifierKeyTx - should fail on providers for different contract with different API         ✅ Contracts API Snark Upgrade [single contract] > submitRemoveVerifierKeyTx - should fail on not present circuitId         ✅ Contracts API Snark Upgrade [single contract] > submitRemoveVerifierKeyTx - should fail on contract not present on contract address         ✅ Contracts API Snark Upgrade [single contract] > submitRemoveVerifierKeyTx - should fail on providers for different contract with different API         ✅ Contracts API Snark Upgrade [single contract] > createContractMaintenanceTxInterface - replaceAuthority - successful replace authority with the new one [@slow]         ✅ Contracts API Snark Upgrade [single contract] > createContractMaintenanceTxInterface - replaceAuthority - successful replace authority with the same one [@slow]         ✅ Contracts API Snark Upgrade [single contract] > createContractMaintenanceTxInterface - replaceAuthority - should fail on contract not present on contract address         ✅ Contracts API Snark Upgrade [single contract] > createContractMaintenanceTxInterface - insertVerifierKey - fail when key is still present         ✅ Contracts API Snark Upgrade [single contract] > createContractMaintenanceTxInterface - insertVerifierKey - success when no key present [@slow]         ✅ Contracts API Snark Upgrade [single contract] > createCircuitMaintenanceTxInterfaces - insertVerifierKey - fail when key is already present         ✅ Contracts API Snark Upgrade [single contract] > createCircuitMaintenanceTxInterfaces - insertVerifierKey - success when no key present [@slow]         ✅ Contracts API Snark Upgrade [single contract] > createCircuitMaintenanceTxInterfaces - removeVerifierKey - should fail on contract not present on contract address	✅ 19	❌ 0	⏭️ 0	3m 34s
✅ testkit-js/testkit-js-e2e/test/contracts.snarkupgrade.smoke.it.test.ts         ✅ Contracts API Snark Upgrade [@slow][@smoke] > should update verifier keys from one contract to another [@smoke]         ✅ Contracts API Snark Upgrade [@slow][@smoke] > should fail on operate with previous authority after replacement	✅ 2	❌ 0	⏭️ 0	3m 37s
✅ testkit-js/testkit-js-e2e/test/dapp-connector-proving.it.test.ts         ✅ DApp Connector Proving > should deploy and call contract using dapp-connector-proof-provider with wallet-delegated proving [@slow]	✅ 1	❌ 0	⏭️ 0	40.1s
✅ testkit-js/testkit-js-e2e/test/fee-mint.segment-routing.it.test.ts         ✅ Fee-mint segment routing — regression #731 > mintShieldedToken + receiveUnshielded: minted output shares the fallible segment with the unshielded fee         ✅ Fee-mint segment routing — regression #731 > mintShieldedToken + receiveShielded: minted output shares the fallible segment with the shielded fee	✅ 2	❌ 0	⏭️ 0	327ms
✅ testkit-js/testkit-js-e2e/test/indexer-public-data-provider.observable1.it.test.ts         ✅ Indexer API > should return the history of states starting from defined blockHash (inclusive:true, expected:1,2) [@slow]         ✅ Indexer API > should return the history of states starting from defined blockHash (inclusive:false, expected:2) [@slow]         ✅ Indexer API > should return the history of states starting from defined txId (inclusive:true, expected states:1,2) [@slow]         ✅ Indexer API > should return the history of states starting from defined txId (inclusive:false, expected states:2) [@slow]	✅ 4	❌ 0	⏭️ 0	3m 34s
✅ testkit-js/testkit-js-e2e/test/indexer-public-data-provider.observable2.it.test.ts         ✅ Indexer API > should return the history of states starting from defined blockHeight (inclusive:true, expected states:1,2) [@slow]         ✅ Indexer API > should return the history of states starting from defined blockHeight (inclusive:false, expected states:2) [@slow]         ✅ Indexer API > should return the entire history of states of the contract with the given address (config:{ type: 'all' }, expected states:0,1,2) [@slow]         ✅ Indexer API > should return the history of states of the contract with the given address, starting with the most recent state (config:{ type: 'latest' }, expected states:1,2) [@slow]	✅ 4	❌ 0	⏭️ 0	3m 36s
✅ testkit-js/testkit-js-e2e/test/indexer-public-data-provider.singlecontract.it.test.ts         ✅ Indexer API > queryDeployContractState - should return a contract state equivalent to the initial contract state produced during deployment construction         ✅ Indexer API > queryContractState - should return the current contract state of a deployed contract         ✅ Indexer API > queryContractState - should return the current contract state of a deployed contract at defined block height         ✅ Indexer API > queryContractState - should return the current contract state of a deployed contract at defined block hash         ✅ Indexer API > queryContractState - should return null on no contract at contract address         ✅ Indexer API > queryZSwapAndContractState - should return the current ZSwap chain state and contract state of a deployed contract         ✅ Indexer API > queryZSwapAndContractState - should return null on no contract at contract address         ✅ Indexer API > watchForDeployTxData - should return the data of the transaction containing the deployment of the contract with the given address         ✅ Indexer API > watchForTxData - should return the data of the transaction containing the contract call with the given transaction id         ✅ Indexer API > watchForContractState - should immediately return the current state of a deployed contract	✅ 10	❌ 0	⏭️ 0	133ms
✅ testkit-js/testkit-js-e2e/test/level-private-state-provider.it.test.ts         ✅ Level Private State Provider - Export/Import Integration > should preserve private state after database recreation [@slow]	✅ 1	❌ 0	⏭️ 0	52.8s
✅ testkit-js/testkit-js-e2e/test/nodejs.it.test.ts         ✅ Ledger API - NodeJS Integration Tests > should run ESM module successfully         ✅ Ledger API - NodeJS Integration Tests > should run CJS module with expected exit code	✅ 2	❌ 0	⏭️ 0	1m 32s
✅ testkit-js/testkit-js-e2e/test/proof-server.it.test.ts         ✅ Proof server integration > should create proofs successfully for deploy and call transactions         ✅ Proof server integration > should create proofs with transactions that has succesfull well-formedness         ✅ Proof server integration > should execute 5 proveTx calls in parallel without errors	✅ 3	❌ 0	⏭️ 0	380ms
✅ testkit-js/testkit-js-e2e/test/shielded.advanced.it.test.ts         ✅ Shielded tokens - advanced operations > should mint and send immediate shielded tokens         ✅ Shielded tokens - advanced operations > should mint and burn shielded tokens	✅ 2	❌ 0	⏭️ 0	1m 11s
✅ testkit-js/testkit-js-e2e/test/shielded.fallible-segment-routing.it.test.ts         ✅ Shielded segment routing — regression #876 > user-bound shielded coin lands in the fallible offer when the circuit is fallible	✅ 1	❌ 0	⏭️ 0	279ms
✅ testkit-js/testkit-js-e2e/test/shielded.transfer.it.test.ts         ✅ Shielded tokens > should mint tokens         ✅ Shielded tokens > should deposit shielded coin via receiveShielded (issue #686)	✅ 2	❌ 0	⏭️ 0	1m 23s
✅ testkit-js/testkit-js-e2e/test/unshielded.balance.it.test.ts         ✅ Unshielded tokens - balance > should get balance of tokens - 0 value         ✅ Unshielded tokens - balance > should get balance of tokens - minted amount         ✅ Unshielded tokens - balance > should get balance of tokens - greater than - false         ✅ Unshielded tokens - balance > should get balance of tokens - greater than - true         ✅ Unshielded tokens - balance > should get balance of tokens - less than - false         ✅ Unshielded tokens - balance > should get balance of tokens - less than - true         ✅ Unshielded tokens - balance > should get balance of tokens - greater than or equal - true (equal)         ✅ Unshielded tokens - balance > should get balance of tokens - greater than or equal - false         ✅ Unshielded tokens - balance > should get balance of tokens - less than or equal - true (equal)         ✅ Unshielded tokens - balance > should get balance of tokens - less than or equal - false	✅ 10	❌ 0	⏭️ 0	3m
✅ testkit-js/testkit-js-e2e/test/unshielded.cross-wallet-transfer.it.test.ts         ✅ Unshielded cross-wallet transfer (issue #720) > should send night tokens to different wallet via right<>(disclose(addr))         ✅ Unshielded cross-wallet transfer (issue #720) > should send night tokens to different wallet via disclose(recipient) (issue #720)	✅ 2	❌ 0	⏭️ 0	36.0s
✅ testkit-js/testkit-js-e2e/test/unshielded.mint-and-send.it.test.ts         ✅ Unshielded tokens - mint and send variants > should mint tokens to contract address (self)         ✅ Unshielded tokens - mint and send variants > should mint tokens to user address         ✅ Unshielded tokens - mint and send variants > should send tokens to self         ✅ Unshielded tokens - mint and send variants > should send tokens to contract address (self)	✅ 4	❌ 0	⏭️ 0	2m 10s
✅ testkit-js/testkit-js-e2e/test/unshielded.transfer.it.test.ts         ✅ Unshielded tokens > Custom color > should mint different tokens         ✅ Unshielded tokens > Custom color > should receive tokens - invalid         ✅ Unshielded tokens > Custom color > should send tokens to wallet         ✅ Unshielded tokens > Custom color > should receive tokens from wallet         ✅ Unshielded tokens > Native color > should transfer night from wallet to contract - receiveNightTokens         ✅ Unshielded tokens > Native color > should transfer night to wallet - sendNightTokensToUser	✅ 6	❌ 0	⏭️ 0	2m 6s

Github Test Reporter by CTRF 💚

🔄 This comment has been updated