@vultisig/cli 7.5.0 → 7.7.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @vultisig/cli
 
+## 7.7.0
+
+### Patch Changes
+
+- [#2384](https://github.com/vultisig/vultisig-sdk/pull/2384) [`c5021d3`](https://github.com/vultisig/vultisig-sdk/commit/c5021d389795ab1c617f04d779b9f2216584717d) Thanks [@Ehsan-saradar](https://github.com/Ehsan-saradar)! - Bittensor sends now encode `Balances.transfer_keep_alive` (pallet 5, call 3) instead of `transfer_allow_death`, so a normal TAO transfer can no longer reap the sender — matching the extrinsic iOS and Android already sign, which restores mixed-vault co-signing. `getMaxSendableAmount` (new in `@vultisig/core-chain/amount`) keeps the 500 rao existential deposit back on top of the fee, and both `getMaxSendAmount`/`getMaxSendAmountFromKeys` and the keysign amount refinement use it, so a MAX quoted as `balance - fee` is clamped to what a keep-alive transfer accepts. A dust send that would leave the destination below the existential deposit is rejected before the ceremony with `BuildKeysignPayloadError('bittensor-destination-below-existential-deposit')`. `buildBittensorSigningPayload` takes an explicit `allowDeath` opt-in for a future empty-the-account flow.
+
+  The SDK is now a compatible co-signer for an explicit "empty the account" send: `PolkadotSpecific.allowDeath` (commondata) carries that intent from the initiator, and the Polkadot and Bittensor signing resolvers encode `transfer_allow_death` only when the payload says so, so the SDK signs the same bytes as an initiator that set it. Payloads that predate the field decode as keep-alive. The SDK does not offer the option to initiators yet; that waits until every platform's signer reads the field.
+
+- Updated dependencies [[`c76da49`](https://github.com/vultisig/vultisig-sdk/commit/c76da49a67abbbf9fa18fd6f667187b3f24ef4ee), [`ba9674d`](https://github.com/vultisig/vultisig-sdk/commit/ba9674d09e67c9510210325ec75d59d802cce995), [`17e72f4`](https://github.com/vultisig/vultisig-sdk/commit/17e72f42d33543612556ae2736d3f85e9190bed0), [`4969690`](https://github.com/vultisig/vultisig-sdk/commit/4969690ba037185a3ae873e295fd97cef71fec6a), [`43a81cd`](https://github.com/vultisig/vultisig-sdk/commit/43a81cd1d2435cf6cb0dc50b56965772b2f26f07), [`c5021d3`](https://github.com/vultisig/vultisig-sdk/commit/c5021d389795ab1c617f04d779b9f2216584717d), [`5c934c5`](https://github.com/vultisig/vultisig-sdk/commit/5c934c5c2d4a063729ef79f7d32d3af31f0232f5), [`dec0385`](https://github.com/vultisig/vultisig-sdk/commit/dec0385a8e3bf3a5a82e29853322bc84b834b5ff), [`7d6428d`](https://github.com/vultisig/vultisig-sdk/commit/7d6428d05b04fc5f4e9e911127a93d8dff0b7161), [`fde308a`](https://github.com/vultisig/vultisig-sdk/commit/fde308a19566fe9daeebae3b458c8677a9627528), [`ac8b001`](https://github.com/vultisig/vultisig-sdk/commit/ac8b00134d01790217f38f316058b5f025f6508a), [`6063180`](https://github.com/vultisig/vultisig-sdk/commit/60631809016b0a3d8e304af424887e18ab10dafe)]:
+  - @vultisig/core-chain@5.5.1
+  - @vultisig/sdk@7.7.0
+  - @vultisig/rujira@71.0.1
+
+## 7.6.0
+
+### Patch Changes
+
+- [#2389](https://github.com/vultisig/vultisig-sdk/pull/2389) [`a7b4efa`](https://github.com/vultisig/vultisig-sdk/commit/a7b4efa3ffc11889c50593483ea240f414d94bdc) Thanks [@aminsato](https://github.com/aminsato)! - `buildSendKeysignPayload` now refuses known burn / program destinations (`assertSafeDestination`) on every chain, so a wallet send to the Solana System Program, the EVM zero address, a Bitcoin eater address or an XRPL black-hole account is rejected before the ceremony — the same guard the SDK's vault-free agent prep helpers already applied. The rejection surfaces as `BuildKeysignPayloadError('dangerous-destination')`; fee estimation through `getSendFeeEstimate` rejects the same destinations.
+
+- Updated dependencies [[`b06ffc7`](https://github.com/vultisig/vultisig-sdk/commit/b06ffc7ad86d5c1f5d1d149748005a3b9a42c5d6), [`4e7e0d7`](https://github.com/vultisig/vultisig-sdk/commit/4e7e0d79f516e49f68ee3ff4acc6f3d65c43e23e), [`b8e3e9d`](https://github.com/vultisig/vultisig-sdk/commit/b8e3e9d236710e4ca9c8a4e9c27f98a9f5dec0d2), [`bdb9634`](https://github.com/vultisig/vultisig-sdk/commit/bdb96345b9f8914f508a10dca2952bf223aa3db2), [`5fc8468`](https://github.com/vultisig/vultisig-sdk/commit/5fc8468f3e64cc688981c836740a3b73541ec89e), [`a7b4efa`](https://github.com/vultisig/vultisig-sdk/commit/a7b4efa3ffc11889c50593483ea240f414d94bdc), [`38bc8d4`](https://github.com/vultisig/vultisig-sdk/commit/38bc8d4bbae344cff8c6d5fd6b56bbf760831792), [`735299d`](https://github.com/vultisig/vultisig-sdk/commit/735299d1ad4206853b0442c17f7a5c90770d71be)]:
+  - @vultisig/sdk@7.6.0
+  - @vultisig/core-chain@5.5.0
+
 ## 7.5.0
 
 ### Patch Changes

package/dist/index.js

@@ -19660,7 +19660,7 @@ var cachedVersion = null;
 function getVersion() {
   if (cachedVersion) return cachedVersion;
   if (true) {
-    cachedVersion = "7.5.0";
+    cachedVersion = "7.7.0";
     return cachedVersion;
   }
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vultisig/cli",
-  "version": "7.5.0",
+  "version": "7.7.0",
   "description": "The self-custody MPC wallet CLI for AI coding agents (Claude Code, Cursor, OpenCode). Natural-language agent mode, 36+ chains, DKLS23 threshold signatures. Seedless.",
   "type": "module",
   "bin": {
@@ -74,9 +74,9 @@
     "@napi-rs/keyring": "^1.3.0",
     "@noble/hashes": "^2.2.0",
     "@vultisig/client-shared": "^0.3.6",
-    "@vultisig/core-chain": "^5.4.3",
-    "@vultisig/rujira": "^71.0.0",
-    "@vultisig/sdk": "^7.5.0",
+    "@vultisig/core-chain": "^5.5.1",
+    "@vultisig/rujira": "^71.0.1",
+    "@vultisig/sdk": "^7.7.0",
     "chalk": "^5.6.2",
     "cli-table3": "^0.6.5",
     "commander": "^15.0.0",
@@ -94,7 +94,7 @@
     "@types/node": "^26.1.1",
     "@types/tabtab": "^3.0.4",
     "@types/ws": "^8.18.1",
-    "@vultisig/core-mpc": "^3.2.4",
+    "@vultisig/core-mpc": "^3.3.1",
     "esbuild": "^0.28.1",
     "ethers": "^6.17.0",
     "node-pty": "^1.1.0",