midnight-wallet-cli 0.6.0-rc.7 → 0.6.0-rc.8

package/README.md

@@ -106,14 +106,28 @@ midnight transfer mn_addr_preprod1... 100
 | Network | Description |
 |---------|-------------|
 | `undeployed` | Local network. On this build: a ledger-9 stack you run yourself (`midnight localnet up` is refused) |
-| `preprod` | Midnight pre-production testnet (ledger 8 today: refused by this build, use 0.5.x) |
+| `preprod` | Midnight pre-production testnet (ledger 8 today: refused by this build, use 0.5.x). Its indexer and node are served by Blockfrost: needs a project id |
 | `preview` | Midnight preview testnet (ledger 8 today: refused by this build, use 0.5.x) |
 
 Wallets are network-agnostic — one seed derives addresses for all three networks. Use `--network <name>` on any command, or persist it with `midnight config set network preview`.
 
+### Preprod and Blockfrost
+
+Midnight shut its own preprod indexer down on 2026-10-09; [Blockfrost serves it now](https://docs.midnight.network/guides/networks-and-environments), along with the node RPC, and every request needs your own project id. Create a project for Midnight Preprod at [blockfrost.io](https://blockfrost.io) and give mn its id:
+
+```bash
+midnight config set blockfrost-project-id <project id>   # or: export BLOCKFROST_PROJECT_ID=<project id>  (MN_BLOCKFROST_PROJECT_ID wins if both are set)
+```
+
+- Without one, a command that reaches preprod stops with `BLOCKFROST_PROJECT_ID_REQUIRED` and these instructions. A refused id is `BLOCKFROST_PROJECT_ID_REJECTED`. Requests count against your Blockfrost plan. (On this ledger-9 build preprod is then refused as a ledger-8 chain, until it forks.)
+- The project id is a secret. mn keeps it in `~/.midnight/config.json` (mode 0600), shows it masked in `config get`, and hides it in everything it prints, errors and `--verbose` logs included.
+- `mn serve` gives a connected dApp the wallet's indexer and node URLs (the DApp connector's `getConfiguration`), and on preprod those carry your project id: connect only dApps you trust with it.
+- An old `indexer-ws` setting that points at `indexer.preprod.midnight.network` fails with `ENDPOINT_SHUT_DOWN`: remove it with `midnight config unset indexer-ws --network preprod`.
+- Preview and the local network need no project id.
+
 ## Native dust acceleration
 
-The first dust sync for a wallet on a hosted network replays the chain's full dust event history, the slow part of a cold start. On 0.5.x a native (Rust) accelerator does this about 5× faster than the WASM reader (a ~1.45M-event preprod prime drops from ~22 min to ~4.5 min), installed as a per-platform `optionalDependency` (`@nel349/dust-sync-<os>-<arch>`).
+The first dust sync for a wallet on a hosted network replays the chain's full dust event history, the slow part of a cold start. On 0.5.x a native (Rust) reader does this several times faster than the WASM one (preprod's 1.6M events in about 5 minutes; preview's 144k in about 30 seconds against about 2 minutes), installed as a per-platform `optionalDependency` (`@nel349/dust-sync-<os>-<arch>`).
 
 **Not on this ledger-9 build.** The accelerator is built against ledger 8, so this prerelease does not ship it (no `@nel349/dust-sync-*` dependencies) and never runs it: dust sync always uses the WASM reader, and `MN_DUST_SYNC_BIN` and `MN_DISABLE_NATIVE_DUST` are ignored.
 
@@ -134,7 +148,7 @@ midnight serve --approve-fees
 
 Read methods never prompt. Every write prompts in the terminal (and is rejected without one), balancing included: `balanceUnsealedTransaction` / `balanceSealedTransaction` reserve the wallet's coins, sign, and return a finished transaction the dApp could submit through any node itself.
 
-`--approve-fees` is for an agent that builds and proves its own ledger-9 transaction (its own value already balanced) and only needs the Dust fee paid. `balanceUnsealedTransaction` / `balanceSealedTransaction` then add only Dust, and are auto-approved only when the transaction spends none of this wallet's funds, has no unsigned unshielded input, needs no non-Dust value and is not a rewards claim; otherwise they are refused, listing every reason. `submitTransaction` is auto-approved only for a transaction this server balanced that way on the same connection. Everything else still prompts in the terminal (and is rejected without one). It cannot be combined with `--approve-all`. Two limits bound what an agent can cost the wallet: `--max-fee <DUST>` refuses a transaction whose total Dust fee (the agent's transaction plus the wallet's balancing) is higher (default 10 DUST; a simple contract call costs about 0.5), and `--max-pending <n>` refuses new balances while n balanced transactions wait to be submitted (default 2). Both are checked before any Dust is reserved. Each balanced transaction reserves a whole Dust coin until it is submitted and on chain (about 20 seconds on a 6-second-block localnet) or released, so a fee wallet serves as many agents at once as it has Dust coins: one per NIGHT UTXO registered for Dust generation. A request that finds none free waits for one, then fails with an error saying so. With `--json`, the line `mn serve` prints once it is listening includes the approval policy (`"approval": {"reads": "auto", "balancing": "fee-only", "writes": "fee-only", "feeLimits": {"maxFeeSpecks": "10000000000000000", "maxPending": 2}}`), so whoever started it can check what it will approve.
+`--approve-fees` is for an agent that builds and proves its own ledger-9 transaction (its own value already balanced) and only needs the Dust fee paid. `balanceUnsealedTransaction` / `balanceSealedTransaction` then add only Dust, and are auto-approved only when the transaction spends none of this wallet's funds, has no unsigned unshielded input, needs no non-Dust value and is not a rewards claim; otherwise they are refused, listing every reason. `submitTransaction` is auto-approved only for a transaction this server balanced that way on the same connection. Everything else still prompts in the terminal (and is rejected without one). It cannot be combined with `--approve-all`. Two limits bound what an agent can cost the wallet: `--max-fee <DUST>` refuses a transaction whose total Dust fee (the agent's transaction plus the wallet's balancing) is higher (default 10 DUST; a simple contract call costs about 0.5), and `--max-pending <n>` refuses new balances while n balanced transactions wait to be submitted (default 2). Both are checked before any Dust is reserved. Each balanced transaction reserves a whole Dust coin until it is submitted and on chain (about 20 seconds on a 6-second-block localnet) or released, so a fee wallet serves as many agents at once as it has Dust coins: one per NIGHT UTXO registered for Dust generation. A request that finds none free waits for one, then fails with an error saying so. A fee the wallet's Dust doesn't cover yet is another case: the wallet's NIGHT is still generating it. `mn serve` works out what the fee takes and waits when the rest is at most two minutes away; when it is further, it refuses at once with `DUST_REQUIRED` and the time ("the wallet has 0.18 DUST and the fee takes 1.65. Its registered NIGHT generates the rest in about 4 minutes"), so an agent knows when to retry. With `--json`, the line `mn serve` prints once it is listening includes the approval policy (`"approval": {"reads": "auto", "balancing": "fee-only", "writes": "fee-only", "feeLimits": {"maxFeeSpecks": "10000000000000000", "maxPending": 2}}`), so whoever started it can check what it will approve.
 
 To connect from your DApp, install the connector package:
 
@@ -253,7 +267,7 @@ Add to `~/.codeium/windsurf/mcp_config.json`:
 
 ### Available MCP Tools
 
-Once connected, your AI agent gets access to 30 tools:
+Once connected, your AI agent gets access to 38 tools:
 
 | Tool | Description |
 |------|-------------|
@@ -287,6 +301,14 @@ Once connected, your AI agent gets access to 30 tools:
 | `midnight_contract_deploy` | Deploy a compiled contract (returns pending token; confirm with `midnight_confirm_operation`) |
 | `midnight_contract_call` | Call a circuit on a deployed contract (returns pending token; auto-coerces numbers/`"123n"` strings to BigInt and `[0–255]` arrays to Uint8Array) |
 | `midnight_test_create` | Generate a CLI or browser test scaffold from the compiled contract |
+| `midnight_grant_status` | Experimental. The wallet's account: address, owner key, what it holds, number of grants |
+| `midnight_grant_list` | Experimental. Every grant on the account, with its limits and whether it is live |
+| `midnight_grant_request` | Experimental. What issuing from an agent's grant request link would grant (who spends, who they can pay, the limits); issues nothing |
+| `midnight_grant_deploy` | Experimental. Deploy the wallet's account and activate its owner key (returns pending token) |
+| `midnight_grant_deposit` | Experimental. Move shielded NIGHT from the wallet into its account, for grants to spend (returns pending token) |
+| `midnight_grant_issue` | Experimental. Issue the grant a request link asks for (returns pending token) |
+| `midnight_grant_revoke` | Experimental. Revoke one grant by id or slot (returns pending token) |
+| `midnight_grant_revoke_all` | Experimental. Revoke every grant on the account (returns pending token) |
 
 Every response carries `_serverVersion` so a stale MCP server (CLI on disk says X, responses still say Y) is detectable — see "Stale MCP server" in `docs/SKILL.md`.