Feat/ts v4.11.0

[gummy789j]

Summary

Brings the TypeScript CLI to the 4.11.0 release line: TRON multi-signature support end to end, gas-free token transfers, and local utilities (contacts, keypair generation, encoding conversion, account lifecycle, receive QR).

Command surface grows 52 → 66, and all 66 now have a reference page.

Scope is ts/ only, apart from a one-line version constant in Java.

Base: release_v4.11.0 · 15 commits · 159 files, +12,991 / −216

Multi-signature

The CLI can now participate in a multi-sig account for the whole lifecycle: configure permissions, collect signatures from several keys, broadcast once the threshold is met.

Command	Purpose
permission show / update	Inspect groups with decoded operation bitmaps; replace the full structure
tx sign --hex/--file	Append a signature, preserving prior ones (--check verifies online)
tx approvals	Who signed, accumulated weight, missing weight, expiry
tx multisig	Collect signatures via the TronLink service (--create / --sign / --watch)
tx broadcast --hex/--file	Validates threshold and expiry before submitting

Signatures travel either offline as a hex artifact passed between signers, or through the TronLink service as a shared queue.

Safety properties worth review:

• tx sign on an artifact is offline by default; permission membership is only claimed with --check.
• tx broadcast refuses a transaction below threshold (not_authorized) or expired (tx_expired) — it
• permission update rejects rather than normalizes (invalid_permission), emits lockout warnings, and re-reads after confirmation. A bitmap cannot silently widen a permission: unnamed set bits must be declared in unknownOperationIds.
• TronLink responses are untrusted — the tx hash is re-derived and contract type, owner, weights, and signature progress cross-checked (provider_error). --watch receives a count only, never content.

GasFree

gasfree info / transfer / trace — move USDT and other supported tokens with no TRX, by signing a TIP-712 PermitTransfer and letting the provider broadcast for a fee in the transferred token.
Balance and fees are checked up front; the signed digest is recomputed and the recovered signer verified against the selected account (signing_rejected); provider metadata is validated (gasfree_integrity). --dry-run prices without unlocking, --wait reports settled rather than estimated amounts. Mainnet and Nile only; Shasta returns

Local utilities

Command	Purpose
contact add / list / remove	Recipient names usable as tx send --to and `gasfree transfer --to
address generate	Keypair generated locally, not added to the wallet
encoding convert	base58 ⇄ 41… hex ⇄ 0x EVM, and hex / Base64 / Base58Check
account activate / set	Activate an account; set the one-time on-chain name or ID
current --qr	Terminal receive QR for the selected address

• The address book is re-validated on every read (regular file, owner, mode 0600); names resembling an to` can't be reinterpreted.
• address generate writes the key to an exclusively created 0600 file and never overwrites; stdout requires explicit --print-secret.
• encoding convert refuses any 32-byte input — indistinguishable from a private key, and argv is visibl
• current --qr encodes exactly the address and never draws a partial QR (a truncated code could scan as a different address).

Architecture & config

New ports keep hexagonal boundaries intact: contact-repository, gasfree-provider, keypair-writer, qr-encoder, tronlink-collaboration. New pure-domain modules: contact, encoding, gasfree, permission.

Five new optional config keys — tronlinkSecretId / SecretKey / Channel and gasfreeApiKey / ApiSecret. Both secrets are masked on read and write (********, including the echoed input), so a config write is safe to log;
unset keys are omitted entirely.

Documentation

19 new pages, 9 updated, following the existing layout. New groups permission/, gasfree/, contact/,new pages tx/approvals, tx/multisig, account/activate, account/set; updated tx/index (multi-siglifecycle), tx/broadcast, tx/send, current, config, README, and the agent SKILL.md.

Written against the command registry and domain rules with examples taken from real output. Verified mechanically: all 66 commands have a page, and every relative link and anchor resolves.

Version

0.2.0 → 4.11.0 for the ts package, aligning it with the Java release line. Java Utils.VERSION moves v4.10.0 → v4.11.0.

Verification

tsc --noEmit     clean
vitest run       98 files, 675 passed, 2 skipped
depcruise src    no violations (303 modules, 817 dependencies)

41 test files added or updated.

Behaviour changes

• tx send --to accepts a contact name; resolution is surfaced in the receipt and data.toContact.
• tx send auth is now conditional — --build-only builds unsigned without unlocking.
• tx broadcast validates before submitting, so some transactions now fail locally instead of on-chain.
• current honours --account, so data.active is no longer always true.
• Signing commands gain --build-only, --permission-id, --expiration.