@blockula/sdk 0.3.0 → 1.0.0

package/dist/index.d.ts

@@ -1,10 +1,276 @@
-import { type Action, type Tx, type UnsignedTx } from "./tx.js";
+import { type SeanceClaimRef, type Action, type BaseFee, type ProposalKind, type ProgramPolicy, type Tx, type UnsignedTx } from "./tx.js";
+import { type ProofResponse, type ProvenRecord } from "./proof.js";
+import { type ProgramCodeInfo, type ProgramCost, type ProgramFuel, type ProgramInfo, type ProgramInterfaceInfo, type ProgramParams, type ProgramReceipt, type ProgramViewResult } from "./programs.js";
+import { type NetworkName } from "./networks.js";
 export * from "./tx.js";
+export * from "./proof.js";
+export * from "./distribution.js";
+export * from "./release.js";
+export * from "./describe.js";
+export * from "./networks.js";
+export * from "./payments.js";
+export * from "./programs.js";
 export declare const DEFAULT_RPC = "http://localhost:7070";
-export declare function addressFromPublicKey(publicKey: Uint8Array): string;
+/** Address prefixes: `boo` on mainnet (and dev chains), `tboo` on public testnets. */
+export declare const KNOWN_PREFIXES: readonly ["boo", "tboo"];
+export declare const DEFAULT_PREFIX = "boo";
+/** Mainnet's chain id (node/src/chain.rs `MAINNET_CHAIN_ID`). */
+export declare const MAINNET_CHAIN_ID = "blockula-1";
+/** How long a transaction stays valid by default: 600 blocks (10 minutes at 1 s blocks). */
+export declare const DEFAULT_VALID_FOR_BLOCKS = 600;
+/** The address of a public key: bech32m(prefix, BLAKE3(public key)). */
+export declare function addressFromPublicKey(publicKey: Uint8Array, prefix?: string): string;
 /** A key's id: BLAKE3(public key) as hex. Same 32 bytes as inside the `boo1…` address it derives. */
 export declare function keyId(publicKey: Uint8Array): string;
-export declare function isAddress(s: string): boolean;
+/** The prefix of a canonical address (`boo`, `tboo`), or `undefined` if `s` isn't one. */
+export declare function addressPrefix(s: string): string | undefined;
+/** Whether `s` is an address: with any known prefix, or exactly `prefix` when given. */
+export declare function isAddress(s: string, prefix?: string): boolean;
+/**
+ * An amount of FANG: a decimal string ("1.5") or bigint drops (1 FANG = 10⁹ drops).
+ * A JS number is still accepted, but that form is deprecated and will be dropped: floats can't
+ * hold most decimal amounts exactly (`0.1 + 0.2`). Pass a string.
+ */
+export type Amount = string | number | bigint;
+/** A `.boo` name as the chain stores it (node/src/types.rs `normalize_name`): lowercase, without the suffix. */
+export declare function bareName(name: string): string;
+/**
+ * The most `Wallet.propose` bonds by default without being told (audit gap-7-5): mainnet's genesis
+ * `proposal_deposit` (node/src/params.rs). A node reporting more is refused; pass `deposit`.
+ */
+export declare const DEFAULT_MAX_PROPOSAL_DEPOSIT: bigint;
+/** Highest vote conviction (node/src/params.rs `MAX_CONVICTION`). */
+export declare const MAX_CONVICTION = 6;
+/** Lock periods a vote at each conviction locks its amount for (params.rs `CONVICTION_PERIODS`) … */
+export declare const CONVICTION_PERIODS: readonly [0, 1, 2, 4, 8, 16, 32];
+/** … and its weight in tenths of the amount (`CONVICTION_TENTHS`): 0.1× with no lock, then 1×–6×. */
+export declare const CONVICTION_TENTHS: readonly [1, 10, 20, 30, 40, 50, 60];
+/** A vote's weight in drops: `amount` × the conviction multiplier (params.rs `vote_weight`). */
+export declare function convictionWeight(amount: Amount, conviction: number): bigint;
+/**
+ * Builders for `Wallet.propose` kinds (node/src/types.rs `ProposalKind`). Amounts are FANG (or
+ * bigint drops), Soul is in Soul ("2.5"); names in `to`/`account` are resolved when proposing.
+ */
+export declare const proposal: {
+    /** Set a governance parameter (a key of `/api/params`, e.g. "max_validators") to a raw value (drops, blocks, bps …), within its bounds. */
+    paramChange(key: string, value: bigint | number | string): ProposalKind;
+    /** Pay from the treasury (spends above a share of the treasury need a supermajority). */
+    treasurySpend(to: string, amount: Amount): ProposalKind;
+    /**
+     * Open a community distribution of `total`, claimable with Merkle proofs against `merkleRoot` until block `claimUntil`.
+     * `distributionId` is the id the tree was built for (`buildDistribution(id, …)`): one no distribution has yet,
+     * at most 1,000 past the next proposal id (`client.proposals()`'s `next_distribution_id` is free, and
+     * `max_distribution_id` is the largest allowed; the range only grows). Other proposals landing first don't change
+     * it, so a multisig can take its time approving; if a distribution with that id opens first, the node refuses this
+     * one (nothing is escrowed), or it fails when it runs. Claims close at most 730 days after the proposal's vote ends.
+     */
+    distribution(distributionId: number, merkleRoot: string, total: Amount, claimUntil: number): ProposalKind;
+    /** Put a repo in the contribution pool (weight 1–100; 0 removes it). */
+    setRepo(repo: string, weight: number): ProposalKind;
+    /** Grant Soul (in Soul, "2.5"; at most 100 per grant). */
+    grantSoul(to: string, soul: string | number, reason: string): ProposalKind;
+    flagSybil(account: string, reason: string): ProposalKind;
+    /** Lift a sybil flag: the appeal path for `flagSybil` (nothing the flag took comes back). */
+    unflagSybil(account: string, reason: string): ProposalKind;
+    rejectClaim(claimId: number, reason: string): ProposalKind;
+    clawback(account: string, reason: string): ProposalKind;
+    unlinkGithub(handle: string): ProposalKind;
+    /** Refund every funder of a hunt (escrow can be refunded, never redirected). */
+    refundHunt(huntId: number): ProposalKind;
+    /**
+     * Switch to protocol `version` at block `activationHeight` (needs a supermajority). The version is newer than
+     * every one scheduled or withdrawn (`client.upgrade()`'s `withdrawn.highest_version`) and at most 16 past the
+     * newest scheduled, withdrawn or superseded (`next_version` is the number to use); the activation is at most
+     * 365 days after the proposal's vote ends.
+     */
+    scheduleUpgrade(version: number, activationHeight: number): ProposalKind;
+    /**
+     * Withdraw the upgrade to protocol `version` scheduled at block `activationHeight` (see
+     * `client.upgrade()`), and any scheduled after it, before it activates. Needs a supermajority;
+     * there's no timelock (it runs the block after its vote), and it must run at least 64 blocks
+     * before the activation height, so propose it at least `voting_blocks + 65` blocks ahead.
+     */
+    cancelUpgrade(version: number, activationHeight: number): ProposalKind;
+    /** Turn on a feature flag (e.g. "ghost"). */
+    activateFeature(feature: string): ProposalKind;
+    deactivateFeature(feature: string): ProposalKind;
+    /** A signal with no on-chain effect. */
+    text(): ProposalKind;
+};
+/** One pool an account has stake in (`/api/staking/{account}` `delegations[]`). */
+export interface StakeDelegation {
+    validator: string;
+    validator_name: string | null;
+    /** Pool shares held (what `undelegate` takes). */
+    shares: string;
+    /** Their current value, in drops. */
+    value: string;
+    /** What went in, less what sales and slashes took (value above it is earnings). */
+    principal: string;
+    /** This is the validator's owner's self-bond. */
+    self_bond: boolean;
+}
+/** Stake on its way out (`entries[]` of type `unbonding`): paid out by `withdrawUnbonded` from `completes_at`. */
+export interface StakeUnbonding {
+    id: number;
+    validator: string;
+    amount: string;
+    started_at: number;
+    completes_at: number;
+    ready: boolean;
+}
+/** Stake moved between pools (`entries[]` of type `redelegation`): slashable by `from` until `completes_at`. */
+export interface StakeRedelegation {
+    id: number;
+    from: string;
+    to: string;
+    amount: string;
+    completes_at: number;
+}
+/** An account's stake, from `/api/staking/{account}`. */
+export interface StakeSummary {
+    delegations: StakeDelegation[];
+    unbonding: StakeUnbonding[];
+    redelegations: StakeRedelegation[];
+    /** Total value staked, in drops. */
+    bonded: string;
+    /** Total unbonding, in drops. */
+    unbonding_total: string;
+    /** Unbonding that has finished (what `withdrawUnbonded` pays now), in drops. */
+    withdrawable: string;
+    /** The node's plain-English summary. */
+    summary: string;
+}
+export declare function stakeSummary(raw: unknown): StakeSummary;
+/**
+ * Shares worth about `value` drops in a delegation (rounded down, at most all of them), at the
+ * value the delegation reports. That's a node's word: to unbond an amount, pass
+ * `wallet.undelegate(validator, { amount })`, which the chain converts itself (audit gap-7-5).
+ */
+export declare function sharesFor(d: StakeDelegation, value: Amount): bigint;
+/** `/api/params`' governance parameters as a key → value map (values as strings: amounts can exceed 2^53). */
+export declare function paramsOf(raw: unknown): Record<string, string>;
+/** A proposal, from `/api/proposals` (`proposals[]`) or `/api/proposal/{id}`. Amounts are in drops. */
+export interface ProposalSummary {
+    id: number;
+    title: string;
+    url: string;
+    /**
+     * The node's own summary text. No digest covers it, so a lying node can make it say anything
+     * (audit gap-7-6): show `does` instead, and never present this as what the proposal does.
+     */
+    summary: string;
+    /** What it does, rendered here from `kind` (`describeKind`): what a vote on it binds. */
+    does: string;
+    kind: ProposalKind | null;
+    /**
+     * `proposalDigest(kind, title, url)`: what a vote binds. `null` when this client can't compute
+     * it exactly (`digest_error` says why, e.g. a number past 2^53): it can't vote on it either.
+     */
+    digest: string | null;
+    digest_error?: string;
+    proposer: string | null;
+    proposer_name: string | null;
+    /** `voting`, `queued`, `rejected`, `executed` or `failed`. */
+    status: string;
+    deposit: string;
+    /** Conviction-weighted ayes and nays (what the majority counts) … */
+    aye: string;
+    nay: string;
+    /** … and the raw FANG behind them (what quorum counts). */
+    aye_amount: string;
+    nay_amount: string;
+    /** aye_amount + nay_amount. */
+    turnout: string;
+    voters: number;
+    /** The quorum it had to reach and whether it did: known once voting closed. */
+    quorum?: string;
+    quorum_reached?: boolean;
+    /** Bootstrap-council votes so far (one per validator); `of` is the set's size at the close. */
+    council: {
+        ayes: number;
+        nays: number;
+        of?: number;
+    };
+    /** Whether it needs `supermajority_bps` of the weight (upgrades, feature activations, issuance parameters, large spends). */
+    supermajority: boolean;
+    /** Last block votes count in, and when a passed proposal runs (after the timelock). */
+    voting_ends_at: number;
+    executes_at?: number;
+    /** Why it was rejected or failed, or what it did. */
+    outcome: string;
+    /** With `rules` (`/api/proposals`' `params`): the share of the weight its ayes need, in basis points. */
+    threshold_bps?: number;
+}
+export declare function proposalSummary(raw: unknown, rules?: {
+    supermajority_bps?: number;
+}): ProposalSummary;
+/** Per-transaction options. */
+export interface TxOptions {
+    /** Paid to the block's proposer on top of the base fee: FANG ("0.001") or bigint drops. Default: the wallet's `tip` (0). At most `tip_cap_multiple` (20) × the base fee (`maxTip`), from transferable FANG. */
+    tip?: string | number | bigint;
+    /** Blocks from now the tx stays valid (at most the chain's `max_tx_validity_blocks`, an hour of blocks). Default: the wallet's `validForBlocks` (600). */
+    validForBlocks?: number;
+    /**
+     * Room for the base fee to rise before the tx is included (TR-6): its `fee` becomes this many
+     * times the base fee `/api/fees` fixes for the next 17 blocks (`suggested`), plus the tip. Only
+     * the including block's base fee and the tip are charged, so headroom costs nothing; without it a
+     * tx queued behind full blocks for longer than that can stop covering the base fee and be
+     * dropped (with every later tx from the account). 1 to 100; default the wallet's `feeHeadroom` (1).
+     */
+    feeHeadroom?: number;
+    /**
+     * The tx's `fee` outright (FANG, or bigint drops): the most it may be charged, base fee plus tip.
+     * At least what it costs at `suggested` now. Overrides `feeHeadroom`.
+     */
+    maxFee?: Amount;
+}
+/** `Wallet.send`'s options. */
+export interface SendOptions extends TxOptions {
+    /** Public, up to 256 bytes, written by the payer: an order or user id you issued. */
+    memo?: string;
+    /** Wait for it to finalize (default true); `false` returns as soon as a node admitted it. */
+    wait?: boolean;
+    /**
+     * Called with the signed tx and its id before it's submitted, in the wallet's queue (so parallel
+     * sends still get one nonce each): store both here, and every outcome is recoverable by
+     * resubmitting the same bytes (`client.post(tx)`). If it throws, nothing is submitted, the
+     * error is passed on, and the next tx takes the nonce.
+     */
+    onSigned?: (tx: Tx, id: string) => void | Promise<void>;
+}
+/** The most `feeHeadroom` a tx may ask for: 100 × the base fee. */
+export declare const MAX_FEE_HEADROOM = 100;
+/** The least a payment that opens an account must carry: 0.01 FANG (node/src/types.rs `MIN_NEW_ACCOUNT`). */
+export declare const MIN_NEW_ACCOUNT = 10000000n;
+/** `Wallet.build`'s options: a tx's, plus the resolutions of names it carries as addresses. */
+export interface BuildOptions extends TxOptions {
+    /** `Client.resolution`s of names in `action`'s address fields (refused on mainnet unless proven). */
+    resolutions?: Resolution[];
+}
+/**
+ * A key's consent to being added to one account (audit gap-7-2): its public key and its
+ * signature over `keyPopMessage(chain_id, genesis_hash, account, key_id)` (context
+ * `KEY_POP_CONTEXT`). The key's holder makes it (`Wallet.keyGrant`) and hands it to the account's
+ * owner (`encodeKeyGrant`: a grant code to paste), who adds the key with it (`addOwnerKey`,
+ * `addSessionKey`). Nobody can put a key on an account without it, so `/api/key` lists only
+ * accounts the key agreed to.
+ */
+export interface KeyGrant {
+    /** The account the key agrees to join. */
+    account: string;
+    key_id: string;
+    /** Hex ML-DSA-65 public key. */
+    public_key: string;
+    /** Hex proof of possession. */
+    pop: string;
+}
+/** A grant as one pasteable string: `bkgrant1.<account>.<base64url(public key ‖ pop)>`. */
+export declare function encodeKeyGrant(g: KeyGrant): string;
+/** Parses a grant code (`encodeKeyGrant`). Whitespace is ignored, so a wrapped paste works. */
+export declare function decodeKeyGrant(code: string): KeyGrant;
+/** Whether `g` is a valid consent by its key to join `g.account` on the chain `(chainId, genesisHash)`. */
+export declare function verifyKeyGrant(g: KeyGrant, chainId: string, genesisHash: string): boolean;
 /**
  * Wallet = one ML-DSA-65 key (from a 32-byte seed, FIPS 204 ξ) acting for one account.
  * By default the account is the key's own address. Call `actAs(account)` to use a key that
@@ -14,16 +280,39 @@ export declare class Wallet {
     readonly seed: Uint8Array;
     client: Client;
     readonly publicKey: Uint8Array;
-    /** This key's own address. */
-    readonly address: string;
-    /** The account this wallet acts for (defaults to `address`). */
-    account: string;
     /** WebAuthn credential id, when the wallet was unlocked by a passkey. Not secret. */
     credentialId?: Uint8Array;
+    /** Default tip (drops) for this wallet's transactions. */
+    tip: bigint;
+    /** Default validity (blocks from now) for this wallet's transactions. */
+    validForBlocks: number;
+    /** Default `feeHeadroom` for this wallet's transactions (1: none). See `TxOptions.feeHeadroom`. */
+    feeHeadroom: number;
     private readonly secretKey;
+    /**
+     * This wallet's txs are signed and submitted one at a time, in nonce order (DEV-3): parallel
+     * `send`s from one wallet would otherwise read the same next nonce and all but one be refused.
+     */
+    private queue;
+    /** The nonce after the last tx this wallet submitted, for one chain and account, and that tx. */
+    private cursor?;
+    private acting?;
+    /** How `actAs` found the account, when that was one node's unproven word (checked when signing on mainnet). */
+    private actingUnproven?;
     private constructor();
+    /** This key's own address, with the chain's prefix once the client knows it (`await client.addressPrefix()`). */
+    get address(): string;
+    /** The account this wallet acts for (defaults to `address`). */
+    get account(): string;
+    set account(account: string);
     get keyId(): string;
-    /** Act for another account this key has been authorized on. Accepts a name or address. */
+    /**
+     * Act for another account this key has been authorized on. Accepts a name or address. A name
+     * needs an address here (every tx names the account it acts for), so it's resolved: proven with
+     * the client's witnesses. Without them it's one node's word, and on mainnet nothing is signed
+     * for an account found that way (`UnprovenNameError`): check the address and pass it instead
+     * (audit gap-7-1).
+     */
     actAs(account: string): Promise<this>;
     static generate(client?: Client): Wallet;
     static fromSeed(seed: string | Uint8Array, client?: Client): Wallet;
@@ -34,30 +323,170 @@ export declare class Wallet {
     static fromPasskeyPrf(prfOutput: Uint8Array, client?: Client): Wallet;
     get seedHex(): string;
     sign(tx: UnsignedTx): Tx;
-    build(action: Action, memo?: string): Promise<Tx>;
-    /** Send FANG to a `.boo` name or `boo1…` address. `amount` is in FANG ("1.5") or bigint drops. */
-    send(to: string, amount: string | number | bigint, opts?: {
+    /**
+     * This key's consent to being added to `account` (an address, or a name resolved by the
+     * client: proven when it has witnesses; on mainnet an unproven name is refused, pass the address)
+     * on the client's chain: hand `encodeKeyGrant(grant)` to the account's owner, who adds the key
+     * with it. Pass `chain` to sign offline.
+     */
+    keyGrant(account: string | Resolution, chain?: {
+        chainId: string;
+        genesisHash: string;
+    }): Promise<KeyGrant>;
+    /**
+     * The `add_key` action for a grant (an object or its code): it must be for this account and
+     * verify on the client's chain, so a wrong or damaged code fails here, before anything is signed.
+     */
+    private grantAction;
+    /**
+     * Builds and signs a tx: `fee` = the highest base fee already fixed for the next blocks
+     * (`/api/fees` `suggested`) + `tip`, `valid_until` = the current height + `validForBlocks`, and
+     * the chain's id and genesis hash from `/api/status`. Only the base fee of the block that
+     * includes it (+ the tip) is charged. A tip above `tip_cap_multiple` × the lowest upcoming base
+     * fee (`/api/fees` `lowest`, see `maxTip`) is refused here, as nodes would refuse it. To sign
+     * offline, build an `UnsignedTx` yourself (with the chain's `genesis_hash`) and `sign` it.
+     *
+     * `action` may be a function of the height `valid_until` is counted from, for actions that
+     * carry an absolute block height of their own (a session key's or a hunt's expiry): computed
+     * from the same status read, a node that lies about the height can stretch them by at most
+     * `max_tx_validity_blocks`, since validators refuse a `valid_until` further ahead than that
+     * (audit gap-7-3).
+     *
+     * That height is checked first (`Client.checkSigningHeight`: against the witnesses' heads and,
+     * when the client knows its genesis clock, the clock), since a node reporting one the chain
+     * hasn't reached gets a tx it can hold and release later.
+     *
+     * `opts.resolutions`: how names in fields that need an address got into `action` (their
+     * `Client.resolution`s). On mainnet a tx carrying one that only one node vouched for isn't
+     * signed (`UnprovenNameError`), checked against the very status the tx is signed for, as the
+     * helpers do (audit gap-7-1). Fields the chain resolves itself take `Client.recipient(x).signed`.
+     */
+    build(action: Action | ((height: number) => Action), memo?: string, opts?: BuildOptions): Promise<Tx>;
+    /**
+     * `build`, refusing on mainnet a tx that carries an address only one node vouched for: `unproven`
+     * (the helpers' resolutions of names in fields that need an address) or the account `actAs`
+     * found that way (audit gap-7-1). Checked against the very status the tx is signed for.
+     */
+    private buildChecked;
+    /**
+     * A tx's `fee`: the base fee at `suggested` for its size (and, for a program transaction, its
+     * fuel fee at the suggested rate: `fuelFee`), times the headroom, plus the tip; or `maxFee`
+     * outright, which must cover at least that base fee plus the tip.
+     */
+    private feeFor;
+    /**
+     * The nonce for this wallet's next tx on chain/account `key`: the node's `next_nonce` (which
+     * counts the txs it holds), or one past the last tx this wallet submitted when that's higher
+     * and the tx may still run: still pending on its way through the network, or not yet counted
+     * by a node writing a block (DEV-3). A tx that was dropped, or can't run any more
+     * (`valid_until` passed), gives its nonce back: the node's word is used again. A nonce handed to
+     * a tx a node admitted is never handed out again while that tx may run.
+     */
+    private nonceFor;
+    /** Runs `job` after every job queued before it (its outcome doesn't stop the next one). */
+    private enqueue;
+    /**
+     * Builds, signs and submits one tx in this wallet's queue (`enqueue`): one at a time, so each
+     * is admitted before the next is signed, in nonce order (DEV-3). Waits for it after leaving the
+     * queue, so parallel calls are only serialized for the moment it takes to sign and submit.
+     *
+     * What a failure does to the next nonce: refused by the node (a 4xx answer: it wasn't admitted),
+     * the nonce is used for the next tx, which can't be paid twice since only one tx per nonce ever
+     * runs; on "bad nonce" the same signed bytes are tried again once (a node writing a block can
+     * misjudge a correct nonce for a moment), then the node's next nonce is used. Anything else
+     * (a timeout, a 5xx, a broken connection) may have been admitted, so its nonce isn't reused.
+     */
+    private submitQueued;
+    /**
+     * Send FANG to a `.boo` name or an address. `amount` is in FANG ("1.5") or bigint drops. A name
+     * is signed as its proven owner's address when the client has witnesses (who you checked is who
+     * gets paid, even if the name changes hands before the tx runs), and as the name itself when it
+     * doesn't: the chain then pays whoever owns it when the tx runs. A lying node can't point it at
+     * another account now, but it can hold the signed tx until its validity window, which counts
+     * from the height the node reported, and release it later, by when the name may have lapsed
+     * and been registered again (audit gap-7-1, review-r3-clients-2). See `Client.recipient`.
+     */
+    send(to: string, amount: Amount, opts?: SendOptions): Promise<any>;
+    /**
+     * `send`, with the batch's retry policy. An amount of 0 is refused before anything is signed
+     * (DEV-14): it moves nothing and only pays a fee. A payment that opens an account must carry at
+     * least 0.01 FANG and burns `creation_fee` (0.1 FANG) from this account on top; the result of a
+     * finalized payment that did says so (`opened_account`, `creation_fee`), since its `summary` and
+     * `fee` don't (DEV-7).
+     */
+    private pay;
+    /**
+     * Whether a payment to `address` would open its account, and what that burns from the payer
+     * (`/api/account`'s `exists` and `creation_fee`; on nodes without them, an account with no
+     * balance and no nonce counts as new). `undefined` when the node didn't say.
+     */
+    private openingCost;
+    /**
+     * Whether finalized payment `tx` opened `address`'s account (it had none when the payment was
+     * signed): no other finalized tx naming it ran before this one. From its newest history, so a
+     * flood of more than 25 txs to a brand-new account within seconds can hide an earlier one.
+     */
+    private opened;
+    /**
+     * What paying `amount` to `to` would cost this account, before anything is signed (DEV-7):
+     * - `fee`: the base fee for this payment's size at what `/api/fees` fixes for the next 17 blocks
+     *   (`suggested`), plus the tip. On a chain that isn't busy, what it's charged;
+     * - `maxFee`: the most it can be charged (`fee`, or more with `feeHeadroom` / `maxFee`);
+     * - `creationFee`: burned from this account when the payment opens the recipient's account
+     *   (0.1 FANG on chains with genesis defaults), on top of `amount`;
+     * - `total`: `amount + fee + creationFee`;
+     * - `transferableAfter`: what this account could still move afterwards, counting `maxFee`
+     *   (negative: it can't pay this). Amounts are bigint drops; `display` has them as FANG text.
+     * `recipient` is how `to` gets signed (`Client.recipient`): show `recipient.how` before paying.
+     * Refuses (throws) a 0 amount, and less than 0.01 FANG to an account that doesn't exist yet.
+     */
+    quote(to: string, amount: Amount, opts?: {
         memo?: string;
+    } & TxOptions): Promise<Quote>;
+    /**
+     * Many payments from this account (TR-5), with at most `concurrency` (default 16, at most 64,
+     * the chain's limit of pending txs per sender) waiting to finalize at once. They're signed in
+     * turn, one nonce after the other. A node that answers 429 (rate limited) or "too many pending
+     * transactions" gets the same signed bytes again once it says to retry (`Retry-After`), for up
+     * to `patienceMs` (default 2 minutes); resubmitting the same bytes can't pay twice.
+     *
+     * Every payment gets a result, in order: `{ ok: true, tx }` or `{ ok: false, error }`. A refused
+     * payment (the node said no: insufficient balance, a bad name) used no nonce, and the rest go on.
+     * A payment that failed for another reason (`TxPendingError`, `TxFailedError` with `dropped`, a
+     * timeout) may still run: check it (`client.tx`) before paying it again, and note that when the
+     * chain drops a tx it drops every later one from the account too. `onSigned` is called with
+     * each signed tx before it's submitted, as with `send`.
+     */
+    sendMany(payments: PaymentOrder[], opts?: {
+        concurrency?: number;
         wait?: boolean;
-    }): Promise<any>;
+        patienceMs?: number;
+        onSigned?: SendOptions["onSigned"];
+    } & TxOptions): Promise<PaymentResult[]>;
     registerName(name: string, opts?: {
         wait?: boolean;
-    }): Promise<any>;
-    /** Authorize another device's key (e.g. a second passkey) with full control. */
-    addOwnerKey(keyIdHex: string, label: string): Promise<any>;
+    } & TxOptions): Promise<any>;
     /**
-     * Let an agent/app key spend from this account, transfers only, within a limit.
-     * Example: `addSessionKey(agentKeyId, "claude", { limit: "10", periodBlocks: 86_400, expiresInBlocks: 30 * 86_400 })`.
+     * Authorize another device's key (e.g. a second passkey) with full control. `grant` is the
+     * key's consent to this account (`keyGrant` on that device, or its grant code).
      */
-    addSessionKey(keyIdHex: string, label: string, opts: {
+    addOwnerKey(grant: KeyGrant | string, label: string): Promise<any>;
+    /**
+     * Let an agent/app key spend from this account, transfers only, within a limit. `grant` is the
+     * key's consent to this account (the agent's grant code).
+     * Example: `addSessionKey(grantCode, "claude", { limit: "10", periodBlocks: 86_400, expiresInBlocks: 30 * 86_400 })`.
+     */
+    addSessionKey(grant: KeyGrant | string, label: string, opts: {
         limit: string | number | bigint;
         periodBlocks: number;
         expiresInBlocks: number;
     }): Promise<any>;
     removeKey(keyIdHex: string): Promise<any>;
     /**
-     * Offer a validator: bonds `bond` FANG from this account. `consensusKeyHex` is the validator
-     * node's ML-DSA-65 public key (see `blockula validator init`). Pending until an admin approves.
+     * Register a validator owned by this account, self-bonding `bond` FANG into its stake pool (at
+     * least the chain's `min_self_bond`). `consensusKey` is the validator node's ML-DSA-65 public
+     * key and `pop` its proof of possession (see `blockula validator init`). It's a candidate: at
+     * each epoch boundary the top `max_validators` pools by stake form the next active set.
      */
     registerValidator(opts: {
         consensusKey: string;
@@ -66,9 +495,9 @@ export declare class Wallet {
         bond: string | number | bigint;
         pop: string;
     }): Promise<any>;
-    /** Season 0 admins only. */
+    /** Dev and test chains with admins only: pin a validator into the set ahead of stake. */
     approveValidator(validator: string): Promise<any>;
-    /** Season 0 admins only. */
+    /** Dev and test chains with admins only: take a validator out of the set for good. */
     removeValidator(validator: string): Promise<any>;
     /** Claim a GitHub handle. Verify it by creating a public gist (as that user) containing this account's address. */
     linkGithub(handle: string, gistId: string): Promise<any>;
@@ -82,51 +511,1059 @@ export declare class Wallet {
         expiresInBlocks: number;
     }): Promise<any>;
     fundHunt(huntId: number, amount: string | number | bigint): Promise<any>;
-    /** Pay a hunt's bounty (creator or admin). `to` may be a .boo name; it's resolved and the address is signed. */
+    /** Pay a hunt's bounty (creator or admin). `to` may be a .boo name: signed as `Client.recipient` says (the proven address, or the name for the chain to resolve). */
     awardHunt(huntId: number, to: string, pr: number, familiarKey?: string): Promise<any>;
     cancelHunt(huntId: number): Promise<any>;
     /** Mark one of this account's session keys (an agent) as a Familiar. */
     registerFamiliar(keyIdHex: string, label: string): Promise<any>;
+    /** Claim a merged PR (authored by this account's linked GitHub handle) for the contribution pool. Bonded; validators check it on GitHub. */
+    submitClaim(repo: string, pr: number, familiarKey?: string): Promise<any>;
+    /** Stake 10 FANG on a newcomer being a real, distinct person (needs 10 Soul). */
+    vouch(account: string): Promise<any>;
+    /** Withdraw your vouch for `account` (after the lock), or pass your own account to decline one. */
+    unvouch(account: string): Promise<any>;
+    /** Join (or top up) the Séance juror pool. Needs 5 Soul; owner keys only. */
+    joinJury(bond?: string | number | bigint): Promise<any>;
+    leaveJury(): Promise<any>;
+    /**
+     * Seal a Séance judgment: one of "a", "b" or "=" per assigned pair (see `client.seance(id)`),
+     * plus claim ids you think are spam. Keep the returned `salt`: `revealVotes` needs it.
+     *
+     * The judgment binds the pairs it was made on (audit gap-7-6): pass `pairs`, the claims (id,
+     * repo, PR) you showed the juror in order, or they're read from the client (`seancePairs`). A
+     * node that showed other pairs or PRs makes the commitment fail instead of misdirecting it.
+     */
+    sealVotes(seanceId: number, votes: string, spam?: number[], salt?: string, opts?: {
+        pairs?: [SeanceClaimRef, SeanceClaimRef][];
+    }): Promise<{
+        tx: any;
+        salt: string;
+        votes: string;
+        spam: number[];
+    }>;
+    revealVotes(seanceId: number, votes: string, spam: number[], salt: string): Promise<any>;
+    fundPool(amount: string | number | bigint): Promise<any>;
+    /** Withdraw every contribution reward that has vested so far. */
+    withdrawVested(): Promise<any>;
+    /** Admins of dev and test chains only (elsewhere: a governance proposal). Weight 1–100; 0 removes the repo. */
+    setRepo(repo: string, weight: number): Promise<any>;
+    /** Admins of dev and test chains only (elsewhere: a governance proposal). `soul` in Soul ("2.5"), up to 100 per grant. */
+    grantSoul(to: string, soul: string | number, reason: string): Promise<any>;
+    /** Admins of dev and test chains only (elsewhere: a governance proposal). */
+    rejectClaim(claimId: number, reason: string): Promise<any>;
+    /** Admins of dev and test chains only (elsewhere: a governance proposal). */
+    flagSybil(account: string, reason: string): Promise<any>;
+    /** Admins of dev and test chains only (elsewhere: a governance proposal). */
+    clawback(account: string, reason: string): Promise<any>;
     /** Reclaim the bond of a removed validator this account owns. */
     unbond(validator: string): Promise<any>;
+    /** Submits one action (the shared tail of the helpers below); `unproven`: see `buildChecked`. */
+    private act;
+    /**
+     * A validator by address, or by a `.boo` name its account holds. Staking needs the address, so
+     * a name is resolved (proven with the client's witnesses); on mainnet a tx with an unproven one
+     * isn't signed (audit gap-7-1): pass the validator's address.
+     */
+    private validatorAddress;
+    /** `r`, unless it's an unproven name on mainnet (`UnprovenNameError`); `buildChecked` checks again against the signing status. */
+    private addressNeeded;
+    /** Stake `amount` (FANG, or bigint drops) in a validator's pool. Your stake earns its share of issuance and is slashed with the pool. */
+    delegate(validator: string, amount: Amount, opts?: TxOptions): Promise<any>;
+    /**
+     * Start unbonding stake in a validator's pool: `{ amount }` (FANG, or bigint drops), `shares`,
+     * or `"all"` (every share you hold there, read from `/api/staking`). An amount is signed as an
+     * amount and the chain converts it at the pool's price when the tx runs, so no node's report of
+     * the stake decides how much unbonds (audit gap-7-5); prefer it to `sharesFor`. It stops
+     * earning now and can be withdrawn with `withdrawUnbonded` once the unbonding period (21 days
+     * on mainnet) is over.
+     */
+    undelegate(validator: string, shares: bigint | string | "all" | {
+        amount: Amount;
+    }, opts?: TxOptions): Promise<any>;
+    /** Move `shares` (or `"all"`) from one pool to another without waiting out the unbonding period. */
+    redelegate(fromValidator: string, toValidator: string, shares: bigint | string | "all", opts?: TxOptions): Promise<any>;
+    /** Pay out every unbonding entry that has finished unbonding. */
+    withdrawUnbonded(opts?: TxOptions): Promise<any>;
+    /** A validator's owner: set the pool's commission (basis points, 0–10000; it moves a little per epoch at most) and, optionally, new addresses. */
+    updateValidator(opts: {
+        commissionBps: number;
+        p2pAddr?: string;
+        httpAddr?: string;
+    } & TxOptions): Promise<any>;
+    /** Bring a jailed validator back (its owner, after the jail period). */
+    unjail(validator: string, opts?: TxOptions): Promise<any>;
+    /** Low-level (nodes do this automatically): two conflicting signed votes, hex-encoded as the node's evidence reporter emits them. */
+    reportEquivocation(evidenceHex: string, opts?: TxOptions): Promise<any>;
+    /** Low-level (validator nodes do this automatically): commit to a beacon secret for `epoch`. */
+    beaconCommit(epoch: number, commitmentHex: string, opts?: TxOptions): Promise<any>;
+    /** Low-level (validator nodes do this automatically): reveal the beacon secret committed for `epoch`. */
+    beaconReveal(epoch: number, secretHex: string, opts?: TxOptions): Promise<any>;
+    /**
+     * A member of a set of one or two, signing with its consensus key: admit candidate `validator`
+     * into the set at the end of `epoch` (default: the epoch the next block is in; the tx fails in
+     * any other). The newcomer will be needed for every quorum, so this is the operator's decision,
+     * once an epoch per member; it joins once a quorum of the members admitted it and its node
+     * showed up (`validatorReady`).
+     */
+    admitValidator(validator: string, opts?: {
+        epoch?: number;
+    } & TxOptions): Promise<any>;
+    /** Low-level (candidate nodes do this automatically, in the epoch's last tenth, once a set of one or two admitted them): a candidate's consensus key signals its node is running in `epoch`. */
+    validatorReady(epoch: number, opts?: TxOptions): Promise<any>;
+    /**
+     * Put a proposal to a vote (build `kind` with `proposal.*`). Bonds `deposit` (default: the
+     * chain's `proposal_deposit`), refunded once the proposal reaches quorum and burned if it
+     * doesn't. Names in the kind (`to`, `account`) are signed as `Client.recipient` says: the proven
+     * address with witnesses, else the name, which the chain resolves when the proposal is made
+     * (it stores the address, which voters then see and bind).
+     *
+     * The default deposit is what the node reports, and a node can report anything, so it's
+     * bounded (audit gap-7-5): every witness of the client must report the same value, and it may
+     * be at most `maxDeposit` (default `DEFAULT_MAX_PROPOSAL_DEPOSIT`, mainnet's 1,000 FANG).
+     * Pass `deposit` to bond an amount you checked yourself.
+     */
+    propose(kind: ProposalKind, opts: {
+        title: string;
+        url?: string;
+        deposit?: Amount;
+        maxDeposit?: Amount;
+    } & TxOptions): Promise<any>;
+    /**
+     * Vote on a proposal with `amount` of your unlocked holdings (liquid, staked or unbonding;
+     * unvested tokens can't vote). `conviction` 0–6 locks `amount` for 0, 1, 2, 4, 8, 16 or 32 lock
+     * periods after the vote ends, for 0.1×, 1×, 2× … 6× the weight (see `convictionWeight`).
+     * Voting again replaces your vote. A validator's consensus key or owner voting before the
+     * bootstrap council ends also casts that validator's council vote.
+     *
+     * The vote binds the proposal's content (audit gap-7-6): pass `proposal`, the kind, title and
+     * link you showed the voter (e.g. the `client.proposal(id)` object you rendered, described with
+     * `describeKind`), or it's read from the client. A node that showed another proposal's content
+     * makes the vote fail. If you showed it earlier and only kept its digest
+     * (`proposalSummary(raw).digest`), pass `digest`: a proposal that reads differently now is
+     * refused before anything is signed.
+     */
+    vote(proposalId: number, aye: boolean, amount: Amount, conviction?: number, opts?: TxOptions & {
+        proposal?: {
+            kind: ProposalKind;
+            title: string;
+            url?: string;
+        };
+        digest?: string;
+    }): Promise<any>;
+    /** Release every vote lock that has expired. */
+    unlock(opts?: TxOptions): Promise<any>;
+    /**
+     * Make this account an M-of-N multisig of its owner keys (`ownerKeyIds`): owner-only actions
+     * then need `multisigPropose` plus approvals up to `threshold`. Session keys keep working
+     * within their limits.
+     */
+    multisigCreate(ownerKeyIds: string[], threshold: number, opts?: TxOptions): Promise<any>;
+    /** Propose an action for this multisig account; it runs once enough owners approve. */
+    multisigPropose(action: Action, opts?: TxOptions): Promise<any>;
+    /**
+     * Approve open multisig proposal `id`. The approval binds the action (audit gap-7-6): pass
+     * `action`, the one you showed the approver (decode it and describe it with `describeAction`,
+     * don't trust a summary), or it's read from `client.multisig(account)`. A node that showed
+     * another action makes the approval fail. `digest`: the `actionDigest` of what you showed, if
+     * that's all you kept; an action that reads differently now is refused before anything is signed.
+     * A `vote` binds its proposal by digest, not by id: show it with `reviewAction(action, {
+     * proposal: await client.proposal(action.proposal_id) })`, which describes the proposal only if
+     * its content has that digest, and don't offer the approval unless it's `readable` (gap-7-6).
+     * Pass that proposal read as `proposal` here: approving a vote is refused, before anything is
+     * signed, unless the proposal shown (else one read now) has exactly the content the vote binds.
+     * The approval counts on this wallet's account (`actAs`), which the digest doesn't bind: on
+     * mainnet act for an address you checked, not a name one node resolved.
+     */
+    multisigApprove(id: number, opts?: TxOptions & {
+        action?: Action;
+        digest?: string;
+        proposal?: unknown;
+    }): Promise<any>;
+    /** Extend a name you own by `years` (1–10), at the chain's renewal price per year. */
+    renewName(name: string, years?: number, opts?: TxOptions): Promise<any>;
+    /**
+     * Offer a name you own to another account (a `.boo` name or address, signed as `Client.recipient` says). It
+     * stays yours until they accept it (`acceptName`); offering it again replaces the offer, and
+     * `withdrawNameOffer` withdraws it. Nobody can be given a name without saying yes.
+     */
+    transferName(name: string, to: string, opts?: TxOptions): Promise<any>;
+    /** Accept a name offered to the account you act for (`client.name(n).offered_to`): it becomes yours. */
+    acceptName(name: string, opts?: TxOptions): Promise<any>;
+    /** Withdraw your offer of a name you own (the same tx as `acceptName`: the chain tells them apart by who owns the name). */
+    withdrawNameOffer(name: string, opts?: TxOptions): Promise<any>;
+    /** Give up a name you own; anyone can register it afterwards. */
+    releaseName(name: string, opts?: TxOptions): Promise<any>;
+    /** Claim your share of a community distribution with the Merkle proof published alongside it (hex hashes). */
+    claimDistribution(distributionId: number, amount: Amount, proof: string[], opts?: TxOptions): Promise<any>;
+    /** Low-level (validator nodes do this automatically): a matured claim's PR was reverted by commit `revertSha`. */
+    attestRevert(claimId: number, revertSha: string, opts?: TxOptions): Promise<any>;
+    /** The chain's fuel prices, with programs required to be on (`ProgramsOffError`) and to admit this kind of transaction now. */
+    private programsFor;
+    /** Waits (up to `waitMs`) for the node's head to pass `height`: what block `height` stored is usable from the next one (§2.1). */
+    private waitPast;
+    /**
+     * Runs what follows a transaction that was submitted and is final, saying so if it fails: `what` names
+     * the transaction (its id, and what it made), which was sent and ran, so the failure is of the receipt,
+     * the wait or the read after it, and the transaction must not be sent again. The typed error stays
+     * as `cause`; its reason is quoted stripped of hidden characters (it may hold a node's text). `what` may be a function
+     * so the name can grow as `run` learns more (the address a create made).
+     */
+    private finalThen;
+    /**
+     * Waits (up to `waitMs`) until `read` finds what it names (`null`: not there yet) stored in a block
+     * before the node's head, which is when it's usable (§2.1: a create, or a call, signed earlier is
+     * refused by the mempool). Says what was waited for if it never is.
+     */
+    private waitUsable;
+    /** A program as a call needs it: usable (stored in an earlier block), its digest recomputed from its own record, and proven against the client's witnesses when it has some. */
+    private programForCall;
+    /**
+     * The bindings of a transaction (`ProgramBindingInput`s): each program read (usable, checked, proven
+     * with witnesses), its version digest filled with the version in force now when none is given (never
+     * "any version", 64 zeros, unless asked: `ANY_PROGRAM_VERSION`), and its code added to `declared`,
+     * which load fuel is counted on.
+     */
+    private resolveBindings;
+    /**
+     * Signs and submits a program transaction (reserving `reservation` fuel: its fee is priced with it),
+     * waits for it, checks its receipt (programs.ts `checkReceipt`) and returns it with what it cost.
+     * One that ran and failed throws `ProgramFailedError` (its fee was charged; `storageLimit` names
+     * the limit it signed, for the hint a `storage_limit` trap needs).
+     *
+     * Once the transaction is submitted and the node reports it final, **every failure says so**
+     * (`finalThen`): a receipt or answer that doesn't check isn't "nothing happened, ask another node",
+     * since the transaction ran, and a payable call sent again pays twice. The typed error is the `cause`.
+     */
+    private sendProgram;
+    /**
+     * Uploads a program's code (WebAssembly 1.0) and its interface (format 1: `blockula program interface
+     * encode`, or the `.iface` files beside the guests), bonding a storage deposit for each that isn't
+     * stored yet: the deposit at today's price (`programUploadDeposit`), which v0 never gives back. `storageLimit`
+     * (FANG, default that deposit plus 10%) is the most the upload may bond; below the deposit it's
+     * refused before signing, as the upload would fail and still be charged. Fuel is priced at the
+     * node's suggested rate. Resolves once the upload is final **and the block after it has been sealed**,
+     * when the code is usable (a create signed sooner is refused, §2.1), with its receipt and what it
+     * cost: the fee, and the deposit, which `receipt.facts.outside_vm` holds apart from the VM's diff.
+     */
+    uploadCode(wasm: Uint8Array | string, iface: Uint8Array | string, opts?: ProgramTxOptions & {
+        storageLimit?: Amount;
+    }): Promise<UploadedCode>;
+    /**
+     * Creates a program from stored code and interface (`uploadCode`'s hashes), at the address made from
+     * this account and the transaction's nonce, which is returned **only once the create has applied**
+     * and the block after it has been sealed (the program is then usable), never predicted ahead of it:
+     * FANG sent to a program's address before its create is final is stranded for good if the create
+     * fails (§2.3). It first waits for the code and interface to be usable (an upload a block ago).
+     *
+     * `init` runs the interface's `Init` method with its `input` and `value`, present exactly when the
+     * interface declares one; it runs under `fuelLimit` (default `program_max_tx_fuel`, 0 without `init`).
+     * `storageLimit` (FANG) is the most the record's deposit and what the initializer's writes bond may
+     * be: default the record's deposit plus 10%, which a program whose initializer writes needs more than.
+     * `authority` (an address, never a name) may upgrade it once a protocol version adds upgrades, with
+     * `delayBlocks` of notice (default and least: `program_min_upgrade_delay_blocks`) and an upgrade
+     * `policy`; without one the program is immutable. `bindings` are programs the initializer may reach.
+     * The receipt's `outside_vm` holds the record deposit and the account creation fee the create burns
+     * when the program's address held no account yet.
+     */
+    createProgram(opts: CreateProgramOptions): Promise<CreatedProgram>;
+    /**
+     * Calls programs: 1 to 8 calls run in order, all or nothing, sharing `fuelLimit` (default
+     * `program_max_tx_fuel`) and `storageLimit` (FANG): **the default is 0, which consents to no new
+     * storage**, so a call whose writes bond a deposit traps `storage_limit` and still pays its fee
+     * (`ProgramFailedError` says so): pass a limit for any method that writes.
+     *
+     * Each call binds the `versionDigest` of the program it's calling: when you pass the digest you
+     * showed the user (`ProgramCallInput.versionDigest`) the call is refused if the program's code,
+     * interface or version isn't the one that digest names; without it, it's recomputed from the
+     * program's record (proven against the client's witnesses when it has any), never taken from the
+     * node's `version_digest`. Fuel is priced at the node's suggested rate on what's reserved (fuel to
+     * run, plus the load of the code the calls and `bindings` declare) and refused when no block
+     * could carry it (`FuelReservationError`). Waits for each program to be usable (created a block ago).
+     * The receipt's `claims` are what the programs say happened: the chain checks none of it.
+     */
+    callProgram(calls: ProgramCallInput[], opts?: ProgramCallOptions): Promise<ProgramTxResult>;
+    /**
+     * One call: `program`'s `method` (a `call` method of its interface; read a `view` with
+     * `client.view`) with `input` (bytes, or lowercase hex) and `value` FANG attached (only to a
+     * payable method). It reads the program first, so a method its interface doesn't have, a view,
+     * an initializer, or FANG sent to a method that isn't payable is refused before anything is signed
+     * (the chain refuses them too, and charges the fee), and signs its `version_digest`: see `callProgram`,
+     * whose options it takes, including the 0 default of `storageLimit`.
+     */
+    call(program: string, method: string, input?: Uint8Array | string, opts?: ProgramCallOptions & {
+        value?: Amount;
+        versionDigest?: string;
+    }): Promise<ProgramTxResult>;
+    /**
+     * For a validator: signs a vote to pause programs (tag 69), from the validator's own account with
+     * its key (build the wallet from `validator.key`'s seed and `actAs` nothing: it signs as itself).
+     * Programs pause from the block after f + 1 of the epoch's validators have signed, for days, with
+     * no undo, so check `client.params()`' `programs` section (the live `votes`, `pause_signed` and
+     * `fix_pending`) first, or use `blockula program pause`, which does.
+     *
+     * It signs and lets the chain's admission decide: a signature the chain refuses (this validator
+     * signed one recently, or has a live vote of its own, or isn't in the active set) is an `ApiError`
+     * 400 and is never charged. It reserves no fuel and prices none, so its fee is a plain
+     * transaction's; it only needs programs to have been switched on (`/api/fees` has a `fuel` section:
+     * `ProgramsOffError` otherwise), not any fuel schedule this SDK knows, since a pause must not depend on one.
+     */
+    programsPause(opts?: TxOptions & {
+        onSigned?: SendOptions["onSigned"];
+    }): Promise<any>;
+    /** This account's shares in a validator's pool, for `"all"`; anything else is parsed and checked. */
+    private sharesOf;
+    /** A proposal kind with its accounts as `Client.recipient` signs them (the chain resolves names when the proposal is made). */
+    private resolveKind;
+    /**
+     * Everything this account holds, as FANG text ("12.5 FANG"), locked or not: `balances()` says
+     * what it can pay. "0 FANG" only for an account that doesn't exist yet; anything else that goes
+     * wrong (the node is down or rate limited, a timeout, another chain) throws (DEV-2), so a
+     * failure never reads as an empty account.
+     */
     balance(): Promise<string>;
+    /**
+     * This account's balances, in bigint drops (DEV-2):
+     * - `balance`: everything it holds;
+     * - `transferable`: what it can pay or send now, fees and tips included: the "can pay" number;
+     * - `locked`: what vesting and vote locks hold (their `until` is in `client.account(…).locks`).
+     * Staked FANG isn't in `balance` (see `client.staking`). `exists` is false for an account the
+     * chain hasn't opened yet (all zeros). Errors propagate, like `balance()`.
+     */
+    balances(): Promise<Balances>;
     /** Dev/test chains only: drip 100 FANG to this wallet. */
     faucet(wait?: boolean): Promise<any>;
 }
-/** An error response from a Blockula node. `status` is the HTTP status (429 = rate limited). */
+/**
+ * An error response from a Blockula node. `status` is the HTTP status (429 = rate limited);
+ * `retryAfterMs`, when the node said how long to wait (`Retry-After`, or "try again in N minutes").
+ */
 export declare class ApiError extends Error {
     readonly status: number;
-    constructor(status: number, message: string);
+    readonly retryAfterMs?: number | undefined;
+    constructor(status: number, message: string, retryAfterMs?: number | undefined);
+}
+/**
+ * The node says it's on blockula-1, and this client isn't pinned to that chain (DEV-1). Nothing
+ * was signed. A client signs there only with a `chainId: "blockula-1"` pin.
+ */
+export declare class MainnetNotAllowedError extends Error {
+    readonly rpc: string;
+    constructor(rpc: string);
+}
+/** The most txs a node holds pending from one sender (node/src/chain.rs `MAX_PENDING_PER_SENDER`). */
+export declare const MAX_PENDING_PER_SENDER = 64;
+/** `Wallet.balances()`: an account's balances in bigint drops, and as FANG text. */
+export interface Balances {
+    /** Everything the account holds (staked FANG isn't in it). */
+    balance: bigint;
+    /** What it can pay or send now, fees included: the "can pay" number. */
+    transferable: bigint;
+    /** What vesting and vote locks hold. */
+    locked: bigint;
+    /** Whether the chain has opened this account yet. */
+    exists: boolean;
+    display: {
+        balance: string;
+        transferable: string;
+        locked: string;
+    };
 }
-/** A transaction that was rejected at execution (fee charged) or dropped from the mempool. */
+/** `Wallet.quote()`: what a payment would cost, in bigint drops (see `quote`). */
+export interface Quote {
+    amount: bigint;
+    /** The base fee at `suggested` for its size, plus the tip. */
+    fee: bigint;
+    /** The most it can be charged (its `fee` field). */
+    maxFee: bigint;
+    /** Burned from the payer when the payment opens the recipient's account; 0 otherwise. */
+    creationFee: bigint;
+    /** amount + fee + creationFee. */
+    total: bigint;
+    /** What the payer could still move afterwards, counting `maxFee`; negative when it can't pay. */
+    transferableAfter: bigint;
+    enough: boolean;
+    /** The recipient has no account yet: this payment opens it. */
+    opensAccount: boolean;
+    /** How the recipient gets signed: show `how` before paying. */
+    recipient: Recipient;
+    display: {
+        amount: string;
+        fee: string;
+        maxFee: string;
+        creationFee: string;
+        total: string;
+        transferableAfter: string;
+    };
+}
+/** One payment for `Wallet.sendMany`. */
+export type PaymentOrder = {
+    to: string;
+    amount: Amount;
+    memo?: string;
+} & Omit<TxOptions, "maxFee">;
+/** What happened to one payment of `Wallet.sendMany`. */
+export type PaymentResult = {
+    ok: true;
+    to: string;
+    amount: Amount;
+    tx: any;
+} | {
+    ok: false;
+    to: string;
+    amount: Amount;
+    error: unknown;
+};
+/**
+ * The node reports a transaction as failed. Two different things (audit review-fix-clients-2):
+ * - `dropped` false: it executed in block `tx.height` and failed there. Its fee was charged; it
+ *   can't execute again.
+ * - `dropped` true: this node dropped it from its mempool without running it (evicted by a
+ *   higher tip, replaced, not included, or an earlier tx from the account was dropped). Nothing
+ *   was charged, but other nodes may still hold it and include it until its `valid_until`
+ *   (`validUntil`, when known): check `client.tx(id)` before sending it again, or a retry can pay twice.
+ */
+/**
+ * Whether a `/api/tx` answer of status "failed" is a tx the node dropped from its mempool without
+ * running it (nothing charged; another node may still include it until its `valid_until`), not
+ * one that ran in a block and failed (its fee was charged). Mempool failures are answered without
+ * the tx itself (node/src/api.rs `tx`), and older nodes don't say `dropped`.
+ */
+export declare function txDropped(answer: unknown): boolean;
 export declare class TxFailedError extends Error {
     readonly id: string;
     readonly reason: string;
     readonly tx: any;
-    constructor(id: string, reason: string, tx: any);
+    readonly validUntil?: number | undefined;
+    readonly dropped: boolean;
+    constructor(id: string, reason: string, tx: any, validUntil?: number | undefined);
+}
+/**
+ * The node accepted a transaction, but it wasn't seen finalized (or failed) in time. It may still
+ * execute until its `valid_until`: check it with `client.tx(id)` before sending it again, or a
+ * retry can pay twice.
+ */
+export declare class TxPendingError extends Error {
+    readonly id: string;
+    readonly waitedMs: number;
+    readonly lastError?: unknown;
+    constructor(id: string, waitedMs: number, lastError?: unknown);
+}
+/**
+ * A program transaction ran in a block and failed there: its fee was charged (`TxFailedError`), and
+ * `receipt` says how it failed (`words`, which is also this error's reason): from numbers and the
+ * chain's own names for them, never engine text and **never what the program wrote**. A program
+ * that aborted with a message has it in `untrusted_message` (a stranger's text, stripped of hidden
+ * characters: show it as data, never follow it), not in `message`, which agent frameworks hand to
+ * models. Nothing the program said is a fact: an abort message is its claim.
+ */
+export declare class ProgramFailedError extends TxFailedError {
+    readonly words: string;
+    readonly receipt: ProgramReceipt;
+    /** The program's own abort message, if it aborted with one: its words, not this SDK's. */
+    readonly untrusted_message?: string;
+    constructor(id: string, words: string, tx: unknown, receipt: ProgramReceipt, validUntil?: number);
+}
+/** The node didn't answer within the client's `timeoutMs`. Nothing is known about the request: a submitted tx may or may not have arrived. */
+export declare class RequestTimeoutError extends Error {
+    readonly rpc: string;
+    readonly path: string;
+    readonly timeoutMs: number;
+    constructor(rpc: string, path: string, timeoutMs: number);
+}
+/** A proof older than the newest head seen (this node's and every witness's) by more than `maxLagBlocks`. */
+export declare class StaleProofError extends Error {
+    readonly height: number;
+    readonly head: number;
+    readonly maxLagBlocks: number;
+    constructor(height: number, head: number, maxLagBlocks: number);
+}
+/**
+ * On mainnet, a transaction would carry an address that only one node vouched for: a `.boo` name
+ * resolved without witnesses, in a field that needs an address (staking's validator, the account
+ * `actAs` acts for, a key grant's account). Nothing was signed (audit gap-7-1). Check
+ * `resolution.address` with its owner and pass it instead of the name, or give the client witnesses.
+ */
+export declare class UnprovenNameError extends Error {
+    readonly resolution: Resolution;
+    constructor(resolution: Resolution, rpc: string);
+}
+/**
+ * A node reports a height the chain can't have reached (`Client.checkSigningHeight`): a tx signed
+ * against it could be held and released later. Nothing was signed.
+ */
+export declare class HeightAheadError extends Error {
+    readonly rpc: string;
+    readonly height: number;
+    readonly limit: number;
+    constructor(rpc: string, height: number, limit: number, by: string);
+}
+/**
+ * How far ahead of the lowest head a client's witnesses report a tx's height may be, by default
+ * (`ClientOptions.maxHeadLeadBlocks`): 30 blocks, room for propagation between nodes.
+ */
+export declare const DEFAULT_MAX_HEAD_LEAD_BLOCKS = 30;
+/**
+ * How far behind the network's clocks this machine's may be before `heightLimit` refuses an honest
+ * node: 15 minutes (the CLI uses the same, node/src/cli_net.rs `HEIGHT_CLOCK_TOLERANCE_MS`).
+ */
+export declare const HEIGHT_CLOCK_TOLERANCE_MS: number;
+/**
+ * The highest height a chain can have reached at `nowMs` (node/src/cli_net.rs `height_limit`):
+ * every block's timestamp is at least its parent's plus the block time, and validators refuse one
+ * more than a second ahead of their clocks, so block h is stamped no earlier than genesis + h ×
+ * block time. A chain that ran slower than its block time is below this by that much, so it
+ * refuses only heights the chain can't have, not every lie.
+ */
+export declare function heightLimit(createdAtMs: number, blockTimeMs: number, nowMs: number): number;
+/** The node reports a different chain than the client is pinned to (`ClientOptions`). */
+export declare class ChainMismatchError extends Error {
+    readonly rpc: string;
+    readonly field: "chain_id" | "genesis_hash" | "address_prefix";
+    readonly expected: string;
+    readonly reported: string | undefined;
+    constructor(rpc: string, field: "chain_id" | "genesis_hash" | "address_prefix", expected: string, reported: string | undefined);
+}
+/** What a `Client` requires of the node. Every `/api/status` (including the one `Wallet.build` signs against) is checked. */
+export interface ClientOptions {
+    /**
+     * A network this SDK knows (`NETWORKS`): its public RPC (when no URL is given) and every pin it
+     * has (chain id, genesis hash, address prefix, genesis clock), set up front. Pins you pass too
+     * must agree with it.
+     */
+    network?: NetworkName;
+    /**
+     * Submit txs in their wire form (`txBytes`, `application/octet-stream`): about half the bytes
+     * of JSON. Off by default: the JSON form is refused outright when it has a field the node doesn't
+     * know (422), where the wire form leaves such a field out.
+     */
+    wireTxs?: boolean;
+    /** The address prefix you expect (`boo` or `tboo`). */
+    prefix?: string;
+    /**
+     * The chain id the node must report (e.g. `blockula-testnet-2`). Wallets sign on `blockula-1`
+     * only through a client pinned to it (`MainnetNotAllowedError`).
+     */
+    chainId?: string;
+    /** The genesis hash (hex) the node must report. */
+    genesisHash?: string;
+    /** How long one request may take before it fails with `RequestTimeoutError` (default 15 s, at most `MAX_TIMEOUT_MS`). */
+    timeoutMs?: number;
+    /**
+     * Clients for independent nodes of the same chain. With witnesses, every name this client
+     * resolves for a signature is a proven read (`provenName`): the record's Merkle proof must check
+     * out against a state root each witness reports for that block, and be fresh. Without them
+     * (audit gap-7-1):
+     * - where the chain resolves names itself (`Wallet.send`, `awardHunt`, `vouch`/`unvouch`,
+     *   `grantSoul`, `flagSybil`, `clawback`, `transferName`, proposal targets), the name is signed
+     *   as the name (`recipient`): the chain pays whoever owns it when the tx runs, so a lying node
+     *   can't point it at another account now, only hold it within its validity window;
+     * - where an address is needed (`delegate`/`undelegate`/`redelegate`/`unjail`, `actAs`,
+     *   `keyGrant`), a name is one node's unproven answer, and on mainnet nothing is signed with it
+     *   (`UnprovenNameError`): pass the address.
+     */
+    witnesses?: Client[];
+    /** Refuse to resolve a `.boo` name for a signature unless it's proven (needs `witnesses`). */
+    requireProvenNames?: boolean;
+    /**
+     * With witnesses: how far ahead of the lowest head they report the height a tx is signed
+     * against may be (default `DEFAULT_MAX_HEAD_LEAD_BLOCKS`). See `Client.checkSigningHeight`.
+     */
+    maxHeadLeadBlocks?: number;
+    /**
+     * The chain's genesis time and block time (`created_at_ms` and `block_time_ms` of the
+     * genesis.json that hashes to `genesisHash`, as published with it), as pins: with them, a
+     * status claiming a height the chain can't have reached by this machine's clock is refused
+     * before anything is signed (`Client.checkSigningHeight`). Not the node's word, so don't take
+     * them from it.
+     */
+    genesisClock?: {
+        createdAtMs: number;
+        blockTimeMs: number;
+    };
+}
+/** Where a recipient (a `.boo` name or an address) goes, and how sure that is (`Client.resolution`). */
+export interface Resolution {
+    /** What was asked for. */
+    input: string;
+    /** The address that gets signed. */
+    address: string;
+    /** The bare name, when `input` was one. */
+    name: string | null;
+    /** An address as given, or a name proven against the client's witnesses; `false`: one node's word. */
+    proven: boolean;
+    /** How it was resolved, in plain English (show it with the address before signing). */
+    how: string;
+    /** The block a proven name was read at. */
+    height?: number;
+}
+/** A recipient in a field the chain resolves itself, as it gets signed (`Client.recipient`). */
+export interface Recipient extends Resolution {
+    /**
+     * What goes into the action: an address as given, a name's proven owner (with witnesses), or
+     * the name itself (`alice.boo`) when nothing proved it.
+     */
+    signed: string;
+    /**
+     * `signed` is the name: the chain resolves it to whoever owns it when the tx runs, so no node
+     * can point it at another account now (one holding the signed tx can still release it later,
+     * by when the name may have changed hands: see `recipient`). `address` is then just the node's
+     * current answer, for display.
+     */
+    byChain: boolean;
+}
+/** Default per-request timeout of a `Client`. */
+export declare const DEFAULT_TIMEOUT_MS = 15000;
+/**
+ * The longest timeout a `Client` takes: 2^31 − 1 ms (about 24.8 days). Timers store their delay
+ * as a signed 32-bit number, and a longer one fires at once (audit review-fix-clients-1).
+ */
+export declare const MAX_TIMEOUT_MS = 2147483647;
+/** `ms` as a timeout: a whole number of milliseconds from 1 to `MAX_TIMEOUT_MS`, or an error naming `what`. */
+export declare function checkTimeoutMs(ms: number, what?: string): number;
+/**
+ * How far behind the newest head (the node's own and each witness's `/api/status` height) a
+ * proven read's proof may be, by default: 10 blocks (10 s at 1 s blocks), room for propagation
+ * between nodes. Older proofs are refused (`StaleProofError`), so a node can't answer with a
+ * genuine but outdated record (a name's previous owner, a balance before a spend, a removed key).
+ */
+export declare const DEFAULT_MAX_PROOF_LAG_BLOCKS = 10;
+/** Options of the proven reads (`provenRecord`, `provenAccount`, `provenName`). */
+export interface ProvenOptions {
+    /** Clients for independent nodes: each must report the same state root for the proof's block, and its head bounds how old the proof may be. */
+    witnesses?: Client[];
+    /** How long to wait for a witness that hasn't reached the proof's block yet (default 5 s). */
+    waitMs?: number;
+    /** How many blocks the proof may be behind the newest head seen (default `DEFAULT_MAX_PROOF_LAG_BLOCKS`). */
+    maxLagBlocks?: number;
+}
+/** Options of a program transaction (`Wallet.uploadCode`, `createProgram`, `callProgram`, `call`): a tx's, and how long to wait. */
+export interface ProgramTxOptions extends TxOptions {
+    /** Called with the signed tx and its id before it's submitted (as `SendOptions.onSigned`): store them, and every outcome is recoverable. */
+    onSigned?: SendOptions["onSigned"];
+    /** How long to wait (ms) for what the transaction needs to be usable, and for the block after its own (default 60 s). */
+    waitMs?: number;
+}
+/** What `callProgram` and `call` take beyond a tx's options. */
+export interface ProgramCallOptions extends ProgramTxOptions {
+    /** Fuel to run the calls, at most `program_max_tx_fuel` (default that). Reserved fuel is paid for and never refunded. */
+    fuelLimit?: number;
+    /** The most the calls' storage deposits may bond (FANG). Default 0: no new storage; a method that writes needs a limit. */
+    storageLimit?: Amount;
+    /** Programs the calls may reach besides their own. */
+    bindings?: ProgramBindingInput[];
+}
+/** A program the transaction may reach: by address, at the version digest given, or the version in force now when none is (`ANY_PROGRAM_VERSION` for any). */
+export interface ProgramBindingInput {
+    program: string;
+    versionDigest?: string;
+}
+/** One call of `callProgram`. */
+export interface ProgramCallInput {
+    /** The program's address, never a name. */
+    program: string;
+    /** A `call` method of its interface. */
+    method: string;
+    /** What the method reads: bytes, or lowercase hex. Default none. */
+    input?: Uint8Array | string;
+    /** FANG sent with the call (only to a payable method). */
+    value?: Amount;
+    /** The version digest the user was shown for this program: the call is refused if the program isn't the one it names. */
+    versionDigest?: string;
+}
+/** What a finalized program transaction gave: the node's answer, its checked receipt, and what it cost its signer. */
+export interface ProgramTxResult {
+    tx: any;
+    receipt: ProgramReceipt;
+    cost: ProgramCost;
+}
+/** `Wallet.uploadCode`'s result. */
+export interface UploadedCode extends ProgramTxResult {
+    wasmHash: string;
+    interfaceHash: string;
+    /** What this upload bonded (drops): 0 when both were stored already. */
+    deposit: bigint;
+}
+/** What `Wallet.createProgram` takes. */
+export interface CreateProgramOptions extends ProgramTxOptions {
+    /** The stored code's hash and the stored interface's (`uploadCode` returns them). */
+    wasmHash: string;
+    interfaceHash: string;
+    /** Run the interface's `Init` method as the program is created (present exactly when the interface has one). */
+    init?: {
+        method: string;
+        input?: Uint8Array | string;
+        value?: Amount;
+    };
+    /** Fuel for the initializer, at most `program_max_tx_fuel` (default that). */
+    fuelLimit?: number;
+    /** The most the record's deposit and the initializer's writes may bond (FANG; default the record's deposit plus 10%). */
+    storageLimit?: Amount;
+    bindings?: ProgramBindingInput[];
+    /** An account (an address) that may upgrade the program once upgrades exist; without it the program is immutable. */
+    authority?: string;
+    delayBlocks?: number;
+    policy?: ProgramPolicy;
+    /** The program takes plain transfers to its address. */
+    acceptsTransfers?: boolean;
+}
+/** `Wallet.createProgram`'s result: the program's address, only once the create has applied. */
+export interface CreatedProgram extends ProgramTxResult {
+    address: string;
+    /** The program as the node reads it a block after the create. */
+    program: ProgramInfo;
+}
+/** A record proven against a state root, and the newest head height that root was checked against. */
+export type ProvenRead = ProvenRecord & {
+    head: number;
+};
+/** A page of an account's history (`Client.history`), newest first. */
+export interface HistoryPage {
+    /**
+     * Finalized txs sent by the account or naming it, as `/api/tx` shows them (`to` is
+     * `{ address, name }`). Pending ones are in `client.account(id).recent_txs`.
+     */
+    txs: any[];
+    /** The cursor of the next (older) page, for `before`; `null` at the end. */
+    next: string | null;
+    /** The first block the node holds: nothing older is in its history. */
+    history_from?: number;
+    /**
+     * False on a node without paged history (`/api/account/{id}/txs`): `txs` is then `/api/account`'s
+     * `recent_txs` (its pending txs and the newest 25 finalized ones), and there's no `next`.
+     */
+    paged: boolean;
 }
 export declare class Client {
+    /** The chain's address prefix: given, learned from `/api/status`, or `boo` until then. */
+    prefix: string;
+    private prefixKnown;
+    private readonly pinnedPrefix?;
+    private readonly pinnedChainId?;
+    private readonly pinnedGenesis?;
+    /** Per-request timeout (ms). */
+    readonly timeoutMs: number;
+    /** Independent nodes names are proven against (`ClientOptions.witnesses`). */
+    readonly witnesses: Client[];
+    readonly requireProvenNames: boolean;
+    /** See `ClientOptions.maxHeadLeadBlocks`. */
+    readonly maxHeadLeadBlocks: number;
+    /** See `ClientOptions.genesisClock`. */
+    readonly genesisClock?: {
+        createdAtMs: number;
+        blockTimeMs: number;
+    };
+    /** The node's URL. */
     readonly rpc: string;
-    constructor(rpc?: string);
+    /** The network this client was made for (`ClientOptions.network`), if any. */
+    readonly network?: NetworkName;
+    /** See `ClientOptions.wireTxs`. */
+    readonly wireTxs: boolean;
+    /** The public testnet (`NETWORKS.testnet`), every pin set: `Client.testnet({ witnesses })`, or pass your own node's URL as `rpc`. */
+    static testnet(opts?: Omit<ClientOptions, "network"> & {
+        rpc?: string;
+    }): Client;
+    /** A `blockula dev` chain on this machine (`NETWORKS.local`). */
+    static local(opts?: Omit<ClientOptions, "network"> & {
+        rpc?: string;
+    }): Client;
+    /**
+     * `new Client(rpc, opts)`, `new Client({ network: "testnet" })` (the network's public RPC), or
+     * `new Client(rpc, { network })` (your own node, held to that network's pins). The pins
+     * (`opts`, and the network's) are checked on every status: a node reporting another prefix,
+     * chain id or genesis hash is refused with `ChainMismatchError`.
+     */
+    constructor(rpc?: string | ClientOptions, options?: ClientOptions);
+    /**
+     * Refuses (`HeightAheadError`, before anything is signed) a height a tx's validity window would
+     * count from that this client has reason to think the chain hasn't reached: more than
+     * `maxHeadLeadBlocks` past the lowest head its witnesses report, or, with a `genesisClock`, past
+     * what the chain can have reached by this machine's clock (`heightLimit`). A node reporting a
+     * future height gets a tx it can hold and release later, when the window it picked opens; with
+     * a name signed in it, after the name may have changed hands (audit review-r3-clients-2).
+     * Every witness must report its height, as every witness must confirm a proof: one honest
+     * witness is enough to refuse a height the chain hasn't reached, whatever the others say.
+     * Without witnesses or a genesis clock, the height is the node's word.
+     */
+    checkSigningHeight(height: number): Promise<void>;
+    /**
+     * Refuses (`HeightAheadError`) a height the chain can't have reached by this machine's clock and
+     * the `genesisClock` this client was given: the clock half of `checkSigningHeight`, for heights a
+     * node reports that aren't signed against (a read's, a wait's). Without a `genesisClock` the
+     * height is the node's word.
+     */
+    checkHeightClock(height: number): void;
+    /** The chain's address prefix, asking the node once if it isn't known yet. */
+    addressPrefix(): Promise<string>;
+    /**
+     * Throws `MainnetNotAllowedError` for a status on blockula-1 unless this client is pinned to that
+     * chain (`chainPin`). Wallets call it with the very status each tx is signed for (DEV-1).
+     */
+    checkMainnetPin(chainId: unknown): void;
+    /** The chain id this client is pinned to (`ClientOptions.chainId`), if any. A client that pins the chain itself reports its own pin. */
+    protected chainPin(): string | undefined;
+    /** One request, bounded by `timeoutMs` (headers and body): a node that never answers fails with `RequestTimeoutError` instead of hanging. */
     private call;
     status(): Promise<any>;
-    blocks(limit?: number): Promise<any>;
+    /**
+     * Block headers, newest first: `{ height, hash, timestamp_ms, proposer, state_root, tx_count, … }`.
+     * Up to `limit` (at most 100) below height `before` (default: from the head), so a page's
+     * last height is the next page's `before`. Nothing older than the node's `history_from`.
+     * `blocks(20)` still works.
+     */
+    blocks(page?: number | {
+        limit?: number;
+        before?: number;
+    }): Promise<any[]>;
+    /**
+     * An account's history, newest first, a page at a time (TR-3): pass the previous page's `next`
+     * as `before` until it's `null`. Each tx is shown as `/api/tx` shows it. On nodes without paged
+     * history it's the newest 25 and the pending ones, with `paged: false` (see `HistoryPage`).
+     */
+    history(account: string, page?: {
+        before?: string;
+        limit?: number;
+    }): Promise<HistoryPage>;
     block(heightOrHash: number | string): Promise<any>;
     tx(id: string): Promise<any>;
     account(addressOrName: string): Promise<any>;
+    /** A name: `status` (`active`, `grace` (expired; only its owner can renew it), `reserved` or `available`), owner, `expires_at`, `offered_to` (if its owner offered it to an account: theirs once they accept), prices. */
     name(name: string): Promise<any>;
+    /** The base fee: each upcoming block's (`slots`) and `suggested`, which covers any of the next 17 blocks. */
+    fees(): Promise<{
+        height: number;
+        lag: number;
+        slots: ({
+            height: number;
+            max_block_bytes: number;
+        } & BaseFee)[];
+        suggested: BaseFee;
+        lowest?: BaseFee;
+        tip_cap_multiple?: number;
+        account_creation_fee: string;
+        [k: string]: unknown;
+    }>;
+    /** The governance parameters (node/src/params.rs `ChainParams`; amounts as strings) under `params`, genesis constants under `genesis`, and the issuance year. `paramsOf` flattens it. */
+    params(): Promise<any>;
+    /** The chain's genesis.json as this node serves it: the node's word (nothing here checks it against the genesis hash). */
+    genesis(): Promise<any>;
+    /** Upgrades: the protocol version in force, what the node's binary supports, the `schedule` (`[{ version, activation_height, active }]`, what `proposal.cancelUpgrade` names), halts and each validator's readiness signal. */
+    upgrade(): Promise<any>;
     /** Accounts a key is authorized on (its own address, plus any it was added to). */
-    keyAccounts(keyIdHex: string): Promise<any>;
+    /**
+     * Accounts a key is on (`{ key_id, accounts, next }`), a page at a time: pass the previous page's
+     * `next` as `after`. Only accounts the key agreed to join (its grant) can list it (audit gap-7-2).
+     */
+    keyAccounts(keyIdHex: string, page?: {
+        after?: string;
+        limit?: number;
+    }): Promise<any>;
     search(q: string): Promise<any>;
-    /** Active set for the current epoch, pending/approved validators, next-epoch set, epoch timing. */
+    /** The validator set: `active` this epoch, `next_epoch` (with `joining`/`leaving`), `candidates`, `jailed`, `tombstoned` and `removed`, each with stake, self-bond, commission, jail and liveness; epoch timing; the churn limit and slashing parameters. */
     validators(): Promise<any>;
     /** Hunts (bounties on GitHub issues), biggest first. */
     hunts(status?: "open" | "awarded" | "cancelled" | "expired"): Promise<any>;
     hunt(id: number): Promise<any>;
     /** Off-chain check of a GitHub link (gist owned by the handle containing the address). */
     github(handle: string): Promise<any>;
+    /** The contribution pool: balance, repos, rules, the open Séance and recent results. */
+    contributions(): Promise<any>;
+    claims(opts?: {
+        status?: "pending" | "verified" | "in_seance" | "scored" | "spam" | "rejected";
+        account?: string;
+    }): Promise<any>;
+    claim(id: number): Promise<any>;
+    /** A Séance, with each juror's assigned pairs (what they must judge). */
+    seance(id: number): Promise<any>;
+    /** A juror's assigned pairs in Séance `id`, in order, with each claim's repo and PR (what `sealVotes` binds). */
+    seancePairs(id: number, juror: string): Promise<[SeanceClaimRef, SeanceClaimRef][]>;
+    /** Soul leaderboard. */
+    souls(limit?: number): Promise<any>;
+    /** An account's stake: `delegations` (shares, value, principal), `entries` (unbonding and redelegations, with `release_at`), `bonded`, `unbonding` and `withdrawable` totals, the `validators` it runs, a `summary`. */
+    staking(account: string): Promise<any>;
+    /** Governance proposals, newest first (`status`: `voting`, `queued`, `rejected`, `executed`, `failed`), the rules (`params`), treasury and community balances. */
+    proposals(opts?: {
+        status?: string;
+        limit?: number;
+    }): Promise<any>;
+    /** One proposal with its votes. */
+    proposal(id: number): Promise<any>;
+    /** A community distribution: Merkle root, total, claimed so far, claim deadline. */
+    distribution(id: number): Promise<any>;
+    /** A multisig account: owners, threshold, open proposals and their approvals. */
+    multisig(account: string): Promise<any>;
+    /**
+     * The chain's fuel prices and program bounds now (`/api/fees`' `fuel` section), checked.
+     * `ProgramsOffError` when programs have never been switched on there (the section is absent).
+     */
+    programFuel(): Promise<ProgramFuel>;
+    /** The programs parameters a deposit is priced with (`/api/params`' `programs` section), checked. */
+    programParams(): Promise<ProgramParams>;
+    /**
+     * A program by its address (never a name): its record, the version digest a call binds (recomputed
+     * from its code, interface and version: a node whose digest isn't what those compute is refused),
+     * who could upgrade it, what it holds and its methods, whose names are the deployer's
+     * (`untrusted_name`). One node's word (`proven: false`): `provenProgram` proves the record itself.
+     */
+    program(address: string): Promise<ProgramInfo>;
+    /**
+     * A stored code by its hash: its size, who uploaded it and for what deposit, how many programs use
+     * it, when it was stored (usable from the block after) and its exported methods (`untrusted_exports`).
+     * With `wasm`, the code itself too, checked to hash to what was asked for.
+     */
+    code(hash: string, opts?: {
+        wasm?: boolean;
+    }): Promise<ProgramCodeInfo>;
+    /**
+     * A stored interface by its hash: its format-1 bytes (checked to hash to what was asked for) and
+     * the node's JSON reading of them (`untrusted_interface`, every name the deployer's, not checked
+     * against the bytes: this SDK has no interface decoder yet).
+     */
+    interface(hash: string): Promise<ProgramInterfaceInfo>;
+    /**
+     * Runs a program's `view` method on the node, as of its newest block: nothing is signed or paid.
+     * `input` is what the method reads (bytes, or lowercase hex); `bindings` name the other programs
+     * it may reach (a program's address, and the version digest it must be at, or none for "any
+     * version", which a read may take); `fuel` caps the run (the node caps it too). The answer's
+     * `return_data` is the program's own claim, which the chain checks nothing of. Refused views
+     * (`ApiError`: 403 when the node serves none, 429 with `retryAfterMs`, 400/404/422 for a request
+     * the node won't run) never ran.
+     */
+    view(address: string, method: string, input?: Uint8Array | string, opts?: {
+        bindings?: {
+            program: string;
+            versionDigest?: string;
+        }[];
+        fuel?: number;
+    }): Promise<ProgramViewResult>;
+    /**
+     * A program's record, proven: its Merkle proof (namespace 66) checked against the state root the
+     * node reports, which each of `witnesses` must report too, and fresh (see `provenRecord`).
+     * The record is decoded here and its `version_digest` recomputed from its own fields, so a call
+     * built from it binds the code the chain holds. `null` if the program provably doesn't exist.
+     * Without witnesses it's only as sure as this node (it can't be called proven).
+     */
+    provenProgram(address: string, opts?: ProvenOptions): Promise<{
+        creator: string;
+        created_at: number;
+        wasm_hash: string;
+        interface_hash: string;
+        version: number;
+        authority: string | null;
+        upgrade_delay_blocks: number;
+        policy: "open" | "additive";
+        accepts_transfers: boolean;
+        storage: {
+            items: number;
+            bytes: number;
+            deposit: string;
+        };
+        sponsored: string;
+        record_deposit: string;
+        record_payer: string;
+        address: string;
+        version_digest: string;
+        witnesses: number;
+        height: number;
+        root: string;
+        head: number;
+    } | null>;
+    /** `/api/proof/{namespace}/{key}`, unchecked. Prefer `provenRecord`. */
+    proof(namespace: number, key: string | Uint8Array): Promise<ProofResponse>;
+    /**
+     * A record with its Merkle proof checked against the state root the node reports. On its own
+     * that only shows the node is consistent; `witnesses` (clients for independent nodes) must
+     * each report the same state root for that block, so a single lying node can't fake balances,
+     * names or keys. A witness that hasn't reached the block yet is retried for `waitMs`.
+     *
+     * The proof must also be fresh: its block may be at most `maxLagBlocks` behind the newest head
+     * this node and the witnesses report (`StaleProofError` otherwise). Witnesses confirm any
+     * genuine root, old ones included, so without this a lying node could serve a real but outdated
+     * record (a name's previous owner, a balance before a spend, a key since removed). `head` is
+     * the newest head seen. Without witnesses only this node's own head is compared, which a lying
+     * node controls: pass witnesses for anything that matters.
+     */
+    provenRecord(namespace: number, key: string | Uint8Array, opts?: ProvenOptions): Promise<ProvenRead>;
+    /** Throws unless this node's block `height` has state root `root` (waiting up to `waitMs` for it to get there). */
+    confirmStateRoot(height: number, root: string, waitMs?: number): Promise<void>;
+    /** An address's balance, nonce and keys, proven and fresh (see `provenRecord`). `null` if the account provably doesn't exist. */
+    provenAccount(address: string, opts?: ProvenOptions): Promise<{
+        balance: bigint;
+        nonce: number;
+        keys: import("./proof.js").ProvenKey[];
+        address: string;
+        height: number;
+        root: string;
+        head: number;
+    } | null>;
+    /**
+     * Who a `.boo` name resolves to, proven and fresh (see `provenRecord`). `null` if it provably
+     * doesn't resolve: never registered, or expired (`expires_at` passed; in its grace period only
+     * the owner can renew it, and after that anyone can register it). `includeExpired` returns an
+     * expired record too, with `active: false`: never pay its `owner`.
+     */
+    provenName(name: string, opts?: ProvenOptions & {
+        includeExpired?: boolean;
+    }): Promise<{
+        name: string;
+        owner: string;
+        registered_at: number;
+        expires_at: number;
+        offered_to?: string;
+        grace_blocks?: number;
+        active: boolean;
+        height: number;
+        root: string;
+        head: number;
+    } | null>;
+    /**
+     * The address a name or address resolves to, for fields that need an address (see
+     * `resolution`): proven with witnesses, else one node's word. Where the chain resolves names
+     * itself (payments, vouches, name offers…), use `recipient` instead, which signs the name.
+     */
     resolve(nameOrAddress: string): Promise<string>;
+    /**
+     * How to sign a recipient in a field the chain resolves itself (`transfer.to`, `award_hunt.to`,
+     * `vouch`/`unvouch`/`flag_sybil`/`clawback.account`, `grant_soul.to`, `transfer_name.to`, and
+     * proposal targets): an address as given; with witnesses a name's proven owner; without them
+     * the name itself, which the chain resolves to its owner when the tx runs, so a lying node
+     * can't point it at another account now (audit gap-7-1). It can still hold the signed tx and
+     * release it later within its validity window, which counts from the height that node reported
+     * (bounded by `checkSigningHeight` only with witnesses or a `genesisClock`): whoever owns the
+     * name then is paid, so a name that lapses in between pays its next owner (review-r3-clients-2).
+     * Show `how` before signing.
+     */
+    recipient(nameOrAddress: string): Promise<Recipient>;
+    /**
+     * Where a recipient goes and how sure that is: show `address` and `how` before signing. With the
+     * client's `witnesses` a name is a proven, fresh read (`provenName`), so a lying node can't
+     * point it elsewhere; without them it's this node's answer alone (`proven: false`), which a
+     * lying node controls (audit gap-7-1).
+     */
+    resolution(nameOrAddress: string): Promise<Resolution>;
+    /**
+     * Submits a signed tx, then (with `wait`) waits for it. What a failure means:
+     * - `ApiError`: the node refused the tx; it wasn't admitted.
+     * - `RequestTimeoutError` or a network error: unknown; the tx may have arrived.
+     * - `TxFailedError`: it executed and failed (`dropped` false: its fee was charged), or this node
+     *   dropped it unrun (`dropped` true: nothing charged, but it may still execute elsewhere until
+     *   its `valid_until`).
+     * - `TxPendingError`: it was admitted and may still execute. Don't send it again blindly.
+     */
     submit(tx: Tx, wait?: boolean): Promise<any>;
+    /**
+     * Submits a signed tx and returns its id, without reading it back or waiting (`submit` does
+     * both). The same bytes can be posted again safely: a node answers with the same id, and the tx
+     * runs at most once. As JSON, or in its wire form with `wireTxs`. Errors as `submit`'s.
+     */
+    post(tx: Tx): Promise<{
+        id: string;
+    }>;
     faucet(to: string, wait?: boolean): Promise<any>;
-    waitForTx(id: string, timeoutMs?: number): Promise<any>;
+    /**
+     * Polls a tx until it's finalized (returns it) or failed (`TxFailedError`, which says whether it
+     * executed or was dropped unrun). A poll that fails (rate limited, a node error, a timeout, not
+     * visible yet) is retried; after `timeoutMs` it throws `TxPendingError`, since the tx may still
+     * execute. `validUntil` (the tx's, when the caller has it) goes into a dropped tx's error.
+     */
+    waitForTx(id: string, timeoutMs?: number, validUntil?: number): Promise<any>;
 }