@quaivault/sdk 0.1.0

package/dist/index.js

@@ -0,0 +1,4549 @@
+import {
+  Erc1155Abi,
+  Erc20Abi,
+  Erc721Abi,
+  MultiSendCallOnlyAbi,
+  QuaiVaultAbi,
+  QuaiVaultFactoryAbi,
+  QuaiVaultProxyAbi,
+  QuaiVaultProxyBytecode,
+  SocialRecoveryModuleAbi,
+  __export
+} from "./chunk-Y3PVKON6.js";
+
+// src/client.ts
+import { getAddress as getAddress6 } from "quais";
+
+// src/chain/connection.ts
+import { Contract, JsonRpcProvider, Wallet, getZoneForAddress, isQuaiAddress } from "quais";
+
+// src/errors/index.ts
+var QuaiVaultError = class extends Error {
+  code;
+  /** What the caller can do about it, in plain language. */
+  remediation;
+  /** Unix seconds after which retrying could succeed. */
+  retryableAt;
+  cause;
+  constructor(code, message, options = {}) {
+    super(message);
+    this.name = new.target.name;
+    this.code = code;
+    this.remediation = options.remediation;
+    this.retryableAt = options.retryableAt;
+    this.cause = options.cause;
+  }
+  /** Structured form, for logs and machine consumers. */
+  toJSON() {
+    return {
+      name: this.name,
+      code: this.code,
+      message: this.message,
+      remediation: this.remediation,
+      retryableAt: this.retryableAt
+    };
+  }
+};
+var ConfigError = class extends QuaiVaultError {
+  constructor(message, remediation) {
+    super("CONFIG", message, { remediation });
+  }
+};
+var NoSignerError = class extends QuaiVaultError {
+  constructor(operation) {
+    super("NO_SIGNER", `${operation} requires a signer.`, {
+      remediation: "Pass connect({ privateKey }) or connect({ signer }), or set QUAIVAULT_PRIVATE_KEY."
+    });
+  }
+};
+var NoIndexerError = class extends QuaiVaultError {
+  constructor(operation) {
+    super("NO_INDEXER", `${operation} requires the indexer, which is not configured.`, {
+      remediation: "Set QUAIVAULT_INDEXER_URL, QUAIVAULT_INDEXER_ANON_KEY and QUAIVAULT_INDEXER_SCHEMA."
+    });
+  }
+};
+var IndexerQueryError = class extends QuaiVaultError {
+  constructor(message, cause) {
+    super("INDEXER_QUERY", message, { cause });
+  }
+};
+var ValidationError = class extends QuaiVaultError {
+  constructor(message, remediation) {
+    super("VALIDATION", message, { remediation });
+  }
+};
+var NotFoundError = class extends QuaiVaultError {
+  constructor(message) {
+    super("NOT_FOUND", message);
+  }
+};
+var PreconditionError = class extends QuaiVaultError {
+  constructor(message, options = {}) {
+    super("PRECONDITION", message, options);
+  }
+};
+var RevertError = class extends QuaiVaultError {
+  revert;
+  constructor(message, revert, options = {}) {
+    super("REVERT", message, options);
+    this.revert = revert;
+  }
+  toJSON() {
+    return { ...super.toJSON(), revert: this.revert };
+  }
+};
+var SaltMiningError = class extends QuaiVaultError {
+  constructor(message, remediation) {
+    super("SALT_MINING", message, { remediation });
+  }
+};
+var StaleProposalError = class extends QuaiVaultError {
+  constructor(message) {
+    super("STALE_PROPOSAL", message, {
+      remediation: "Cancel this proposal and create a new one against the current module list."
+    });
+  }
+};
+
+// src/chain/connection.ts
+var Connection = class {
+  provider;
+  /** Retry policy for reads. Shared with every contract facade this hands out. */
+  retry;
+  _signer;
+  constructor(config, explicit = {}) {
+    this.retry = config.retry ?? {};
+    this.provider = explicit.provider ?? explicit.signer?.provider ?? new JsonRpcProvider(config.rpcUrl, void 0, { usePathing: true });
+    if (explicit.signer) {
+      this._signer = explicit.signer;
+    } else if (config.privateKey) {
+      this._signer = createPrivateKeySigner(config.privateKey, this.provider);
+    } else {
+      this._signer = null;
+    }
+  }
+  get signer() {
+    return this._signer;
+  }
+  hasSigner() {
+    return this._signer !== null;
+  }
+  /** The signer, or a typed error naming the operation that needs one. */
+  requireSigner(operation) {
+    if (!this._signer) throw new NoSignerError(operation);
+    return this._signer;
+  }
+  async address() {
+    return this.requireSigner("Reading the connected address").getAddress();
+  }
+  /** Connected address, or null when read-only. */
+  async addressOrNull() {
+    return this._signer ? this._signer.getAddress() : null;
+  }
+  vault(address2, write = false) {
+    return new Contract(
+      address2,
+      QuaiVaultAbi,
+      write ? this.requireSigner("This vault write") : this.provider
+    );
+  }
+  factory(address2, write = false) {
+    return new Contract(
+      address2,
+      QuaiVaultFactoryAbi,
+      write ? this.requireSigner("This factory write") : this.provider
+    );
+  }
+  socialRecovery(address2, write = false) {
+    return new Contract(
+      address2,
+      SocialRecoveryModuleAbi,
+      write ? this.requireSigner("This recovery write") : this.provider
+    );
+  }
+};
+function createPrivateKeySigner(privateKey, provider) {
+  const normalized = privateKey.startsWith("0x") ? privateKey : `0x${privateKey}`;
+  if (!/^0x[0-9a-fA-F]{64}$/.test(normalized)) {
+    throw new ConfigError(
+      "Invalid private key: expected 32 bytes of hex (64 characters, with or without a 0x prefix).",
+      "Check QUAIVAULT_PRIVATE_KEY. Never commit a private key or pass one on the command line."
+    );
+  }
+  try {
+    const wallet = new Wallet(normalized, provider);
+    const zone = getZoneForAddress(wallet.address);
+    if (!zone) {
+      throw new ConfigError(
+        `The supplied private key derives ${wallet.address}, which does not fall within any Quai shard prefix, so it cannot hold funds or transact.`,
+        "Use a key from a Quai wallet \u2014 quais HD derivation scans for shard-valid addresses. An arbitrary Ethereum key will not work."
+      );
+    }
+    if (!isQuaiAddress(wallet.address)) {
+      throw new ConfigError(
+        `The supplied private key derives ${wallet.address}, which is a Qi-ledger address. QuaiVault operates on the Quai ledger.`,
+        "Use a Quai-ledger key."
+      );
+    }
+    return wallet;
+  } catch (cause) {
+    if (cause instanceof ConfigError) throw cause;
+    throw new ConfigError(
+      `Could not build a signer from the supplied private key: ${cause instanceof Error ? cause.message : String(cause)}`
+    );
+  }
+}
+function normalizeTxHash(value, label = "transaction hash") {
+  if (typeof value !== "string" || !/^0x[0-9a-fA-F]{64}$/.test(value)) {
+    throw new ValidationError(`Invalid ${label}: expected a 0x-prefixed 32-byte hex string.`);
+  }
+  return value.toLowerCase();
+}
+
+// src/config/resolve.ts
+import { isAddress } from "quais";
+
+// src/config/networks.ts
+var INDEXER_URL = "https://xbftgyuxaxagptudledv.supabase.co";
+var INDEXER_PUBLISHABLE_KEY = "sb_publishable_EO-sTB-jqUzlsiugOEks-Q_qRtHDaHU";
+var mainnet = {
+  name: "mainnet",
+  chainId: 9,
+  rpcUrl: "https://rpc.quai.network",
+  explorerUrl: "https://quaiscan.io",
+  contracts: {
+    implementation: "0x0038E6d84412A10CdcE41b0f62A05350023f1fb6",
+    factory: "0x003613aC5FFd45bFF7B2F0210DA2fF660908c488",
+    socialRecovery: "0x000dbc29Bdd311C29a4008164052fc2E67c0D937",
+    multiSendCallOnly: "0x003f62e6a7f2EB6b94345a9A41671888eC4A3ebA"
+  },
+  indexer: {
+    url: INDEXER_URL,
+    anonKey: INDEXER_PUBLISHABLE_KEY,
+    schema: "mainnet",
+    healthUrl: "https://index.quaivault.org"
+  }
+};
+var testnet = {
+  name: "testnet",
+  chainId: 15e3,
+  // Orchard moved from rpc.orchard.quai.network (now NXDOMAIN) to this hostname.
+  rpcUrl: "https://orchard.rpc.quai.network",
+  explorerUrl: "https://orchard.quaiscan.io",
+  contracts: {
+    implementation: "0x004E539Cf477A5Cb456A56023f083cD91Bc4934e",
+    factory: "0x002d1305D597c157bB975967FA2e5337674b0E5F",
+    socialRecovery: "0x003a465e661D0E44C1e78b7B256D8C37f699E61e",
+    multiSendCallOnly: "0x002ae8A47C2da497fe569AfCF0486410aA1093E0"
+  },
+  indexer: {
+    url: INDEXER_URL,
+    anonKey: INDEXER_PUBLISHABLE_KEY,
+    schema: "testnet",
+    healthUrl: "https://index.devnet.quaivault.org"
+  }
+};
+var networks = { mainnet, testnet };
+function isNetworkName(value) {
+  return typeof value === "string" && value in networks;
+}
+
+// src/config/resolve.ts
+var ENV_VARS = {
+  network: "QUAIVAULT_NETWORK",
+  rpcUrl: "QUAIVAULT_RPC_URL",
+  privateKey: "QUAIVAULT_PRIVATE_KEY",
+  indexerUrl: "QUAIVAULT_INDEXER_URL",
+  indexerAnonKey: "QUAIVAULT_INDEXER_ANON_KEY",
+  indexerSchema: "QUAIVAULT_INDEXER_SCHEMA",
+  indexerHealthUrl: "QUAIVAULT_INDEXER_HEALTH_URL",
+  factory: "QUAIVAULT_FACTORY",
+  implementation: "QUAIVAULT_IMPLEMENTATION",
+  socialRecovery: "QUAIVAULT_SOCIAL_RECOVERY_MODULE",
+  multiSendCallOnly: "QUAIVAULT_MULTISEND_CALL_ONLY",
+  consistency: "QUAIVAULT_CONSISTENCY",
+  maxIndexerLagBlocks: "QUAIVAULT_MAX_INDEXER_LAG_BLOCKS"
+};
+function redactConfig(config) {
+  const { privateKey: _omitted, ...rest } = config;
+  return {
+    ...rest,
+    ...rest.indexer ? { indexer: { ...rest.indexer, anonKey: maskKey(rest.indexer.anonKey) } } : {},
+    // `network` carries its own copy of the indexer block; mask that one as well or
+    // a config dump still prints the key in full.
+    network: rest.network.indexer ? {
+      ...rest.network,
+      indexer: { ...rest.network.indexer, anonKey: maskKey(rest.network.indexer.anonKey) }
+    } : rest.network
+  };
+}
+function maskKey(key) {
+  return key.length <= 12 ? "***" : `${key.slice(0, 8)}\u2026${key.slice(-4)}`;
+}
+function readEnv(useEnv) {
+  if (!useEnv) return {};
+  const proc = globalThis.process;
+  return proc?.env ?? {};
+}
+function pick(...values) {
+  for (const v of values) {
+    if (v !== void 0 && v !== "") return v;
+  }
+  return void 0;
+}
+function requireAddress(value, label, envVar) {
+  if (!value) {
+    throw new ConfigError(
+      `Missing ${label}. Set ${envVar} or pass it via connect({ contracts: { \u2026 } }).`
+    );
+  }
+  if (!isAddress(value)) {
+    throw new ConfigError(`Invalid ${label}: "${value}" is not a valid address.`);
+  }
+  return value;
+}
+function optionalAddress(value, label) {
+  if (!value) return void 0;
+  if (!isAddress(value)) {
+    throw new ConfigError(`Invalid ${label}: "${value}" is not a valid address.`);
+  }
+  return value;
+}
+function parseConsistency(value) {
+  if (value === void 0) return void 0;
+  if (value === "auto" || value === "indexed" || value === "chain") return value;
+  throw new ConfigError(
+    `Invalid consistency "${value}". Expected one of: auto, indexed, chain.`
+  );
+}
+function parseLag(value) {
+  if (value === void 0) return void 0;
+  const n = Number(value);
+  if (!Number.isFinite(n) || n < 0) {
+    throw new ConfigError(`Invalid ${ENV_VARS.maxIndexerLagBlocks}: "${value}". Expected a non-negative number.`);
+  }
+  return n;
+}
+function resolveConfig(options = {}) {
+  const env = readEnv(options.useEnv !== false);
+  const networkInput = options.network ?? env[ENV_VARS.network] ?? "mainnet";
+  let base;
+  if (typeof networkInput === "string") {
+    if (!isNetworkName(networkInput)) {
+      throw new ConfigError(
+        `Unknown network "${networkInput}". Built-in networks: ${Object.keys(networks).join(", ")}. Pass a full NetworkConfig object for a custom deployment.`
+      );
+    }
+    base = networks[networkInput];
+  } else {
+    base = networkInput;
+  }
+  const rpcUrl = pick(options.rpcUrl, env[ENV_VARS.rpcUrl], base.rpcUrl);
+  if (!rpcUrl) {
+    throw new ConfigError(`Missing RPC URL. Set ${ENV_VARS.rpcUrl} or pass connect({ rpcUrl }).`);
+  }
+  const contracts = {
+    factory: requireAddress(
+      pick(options.contracts?.factory, env[ENV_VARS.factory], base.contracts.factory),
+      "factory address",
+      ENV_VARS.factory
+    ),
+    implementation: requireAddress(
+      pick(
+        options.contracts?.implementation,
+        env[ENV_VARS.implementation],
+        base.contracts.implementation
+      ),
+      "implementation address",
+      ENV_VARS.implementation
+    ),
+    socialRecovery: optionalAddress(
+      pick(options.contracts?.socialRecovery, env[ENV_VARS.socialRecovery], base.contracts.socialRecovery),
+      "social recovery module address"
+    ),
+    multiSendCallOnly: optionalAddress(
+      pick(
+        options.contracts?.multiSendCallOnly,
+        env[ENV_VARS.multiSendCallOnly],
+        base.contracts.multiSendCallOnly
+      ),
+      "MultiSendCallOnly address"
+    )
+  };
+  const indexerUrl = pick(options.indexer?.url, env[ENV_VARS.indexerUrl], base.indexer?.url);
+  const anonKey = pick(options.indexer?.anonKey, env[ENV_VARS.indexerAnonKey], base.indexer?.anonKey);
+  const schema = pick(options.indexer?.schema, env[ENV_VARS.indexerSchema], base.indexer?.schema);
+  let indexer;
+  if (indexerUrl && anonKey && schema) {
+    indexer = {
+      url: indexerUrl,
+      anonKey,
+      schema,
+      healthUrl: pick(
+        options.indexer?.healthUrl,
+        env[ENV_VARS.indexerHealthUrl],
+        base.indexer?.healthUrl
+      )
+    };
+  }
+  const consistency = options.consistency ?? parseConsistency(env[ENV_VARS.consistency]) ?? "auto";
+  if (!indexer && consistency === "indexed") {
+    throw new ConfigError(
+      `consistency: 'indexed' requires indexer configuration. Set ${ENV_VARS.indexerUrl}, ${ENV_VARS.indexerAnonKey} and ${ENV_VARS.indexerSchema}.`
+    );
+  }
+  return {
+    network: { ...base, rpcUrl, contracts, ...indexer ? { indexer } : {} },
+    contracts,
+    indexer,
+    rpcUrl,
+    privateKey: pick(options.privateKey, env[ENV_VARS.privateKey]),
+    consistency,
+    maxIndexerLagBlocks: options.maxIndexerLagBlocks ?? parseLag(env[ENV_VARS.maxIndexerLagBlocks]) ?? 50,
+    retry: {
+      ...options.retry?.maxAttempts != null ? { maxAttempts: options.retry.maxAttempts } : {},
+      ...options.retry?.baseDelayMs != null ? { baseDelayMs: options.retry.baseDelayMs } : {},
+      ...options.retry?.maxDelayMs != null ? { maxDelayMs: options.retry.maxDelayMs } : {},
+      ...options.retry?.onRetry ? { onRetry: options.retry.onRetry } : {}
+    }
+  };
+}
+
+// src/factory.ts
+import { Interface as Interface4, getAddress as getAddress2 } from "quais";
+
+// src/address.ts
+import { getAddress, getZoneForAddress as getZoneForAddress2, isAddress as isAddress2, isQiAddress } from "quais";
+function inspectAddress(value) {
+  if (typeof value !== "string" || !isAddress2(value)) {
+    return { valid: false, reason: "not a valid address" };
+  }
+  const checksummed = getAddress(value);
+  const zone = getZoneForAddress2(checksummed);
+  const ledger = isQiAddress(checksummed) ? "qi" : "quai";
+  if (!zone) {
+    return {
+      valid: false,
+      checksummed,
+      ledger,
+      reason: "belongs to no Quai shard (its leading byte is not a valid zone prefix)"
+    };
+  }
+  if (ledger === "qi") {
+    return {
+      valid: false,
+      checksummed,
+      zone,
+      ledger,
+      reason: "is a Qi-ledger address, which cannot interact with smart contracts on Quai"
+    };
+  }
+  return { valid: true, checksummed, zone, ledger };
+}
+function isUsableQuaiAddress(value) {
+  return inspectAddress(value).valid;
+}
+function assertQuaiAddress(value, label = "address") {
+  const check = inspectAddress(value);
+  if (check.valid) return check.checksummed;
+  const shown = typeof value === "string" ? value : String(value);
+  const remediation = check.ledger === "qi" ? "Qi is the UTXO ledger and has no contract execution. Use a Quai-ledger address (the 9th bit of the address \u2014 the high bit of its second byte \u2014 must be clear)." : "Quai addresses must begin with a valid zone prefix: 0x00\u20130x02, 0x10\u20130x12, or 0x20\u20130x22.";
+  throw new ValidationError(`Invalid ${label} "${shown}": it ${check.reason}.`, remediation);
+}
+function assertQuaiAddresses(values, label) {
+  return values.map((value, i) => assertQuaiAddress(value, `${label}[${i}]`));
+}
+
+// src/chain/retry.ts
+var DEFAULTS = {
+  maxAttempts: 3,
+  baseDelayMs: 250,
+  maxDelayMs: 4e3
+};
+var PERMANENT_CODES = /* @__PURE__ */ new Set([
+  "CALL_EXCEPTION",
+  // the call reverted — deterministic
+  "INVALID_ARGUMENT",
+  "MISSING_ARGUMENT",
+  "UNEXPECTED_ARGUMENT",
+  "NOT_IMPLEMENTED",
+  "UNSUPPORTED_OPERATION",
+  "ACTION_REJECTED",
+  // the user declined in their wallet
+  "NONCE_EXPIRED",
+  "INSUFFICIENT_FUNDS",
+  "REPLACEMENT_UNDERPRICED",
+  "TRANSACTION_REPLACED",
+  "VALUE_MISMATCH"
+]);
+var TRANSIENT_CODES = /* @__PURE__ */ new Set(["NETWORK_ERROR", "SERVER_ERROR", "TIMEOUT", "BAD_DATA"]);
+var TRANSIENT_PATTERNS = [
+  "fetch failed",
+  "econnreset",
+  "econnrefused",
+  "etimedout",
+  "epipe",
+  "socket hang up",
+  "network error",
+  "timeout",
+  "timed out",
+  "rate limit",
+  "too many requests",
+  "service unavailable",
+  "bad gateway",
+  "gateway timeout",
+  "temporarily unavailable",
+  "connection terminated",
+  "server error"
+];
+var TRANSIENT_STATUS = /* @__PURE__ */ new Set([408, 425, 429, 500, 502, 503, 504]);
+function statusOf(error) {
+  if (typeof error !== "object" || error === null) return void 0;
+  const e = error;
+  for (const key of ["status", "statusCode"]) {
+    const value = e[key];
+    if (typeof value === "number") return value;
+  }
+  const info = e.info;
+  const response = info?.response;
+  if (typeof response?.status === "number") return response.status;
+  return void 0;
+}
+function isTransient(error) {
+  if (error === null || error === void 0) return false;
+  const code = error.code;
+  if (typeof code === "string") {
+    if (PERMANENT_CODES.has(code)) return false;
+    if (TRANSIENT_CODES.has(code)) return true;
+  }
+  const status = statusOf(error);
+  if (status !== void 0) return TRANSIENT_STATUS.has(status);
+  const message = error instanceof Error ? error.message : String(error);
+  const haystack = message.toLowerCase();
+  if (TRANSIENT_PATTERNS.some((p) => haystack.includes(p))) return true;
+  const cause = error.cause;
+  if (cause && cause !== error) return isTransient(cause);
+  return false;
+}
+var sleep = (ms, signal) => new Promise((resolve, reject) => {
+  if (signal?.aborted) {
+    reject(new Error("Aborted"));
+    return;
+  }
+  const timer = setTimeout(() => {
+    signal?.removeEventListener("abort", onAbort);
+    resolve();
+  }, ms);
+  const onAbort = () => {
+    clearTimeout(timer);
+    reject(new Error("Aborted"));
+  };
+  signal?.addEventListener("abort", onAbort, { once: true });
+});
+async function withRetry(fn, options = {}) {
+  const maxAttempts = options.maxAttempts ?? DEFAULTS.maxAttempts;
+  const baseDelayMs = options.baseDelayMs ?? DEFAULTS.baseDelayMs;
+  const maxDelayMs = options.maxDelayMs ?? DEFAULTS.maxDelayMs;
+  let lastError;
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    if (options.signal?.aborted) throw new Error("Aborted");
+    try {
+      return await fn();
+    } catch (error) {
+      lastError = error;
+      if (attempt === maxAttempts || !isTransient(error)) throw error;
+      const ceiling = Math.min(baseDelayMs * 2 ** (attempt - 1), maxDelayMs);
+      const delayMs = Math.round(Math.random() * ceiling);
+      options.onRetry?.({ attempt, delayMs, error });
+      await sleep(delayMs, options.signal);
+    }
+  }
+  throw lastError;
+}
+
+// src/chain/vault-contract.ts
+var VaultContract = class {
+  constructor(contract, retry = {}) {
+    this.contract = contract;
+    this.retry = retry;
+  }
+  contract;
+  retry;
+  fn(signature) {
+    return this.contract.getFunction(signature);
+  }
+  /**
+   * Reads retry transient RPC failures (see {@link withRetry}); writes never do,
+   * because a resubmit that looks like a timeout may already be in the mempool.
+   */
+  read(signature, ...args) {
+    return withRetry(() => this.fn(signature)(...args), this.retry);
+  }
+  get interface() {
+    return this.contract.interface;
+  }
+  // ---- reads ---------------------------------------------------------------
+  getOwners() {
+    return this.read("getOwners()");
+  }
+  isOwner(address2) {
+    return this.read("isOwner(address)", address2);
+  }
+  threshold() {
+    return this.read("threshold()");
+  }
+  nonce() {
+    return this.read("nonce()");
+  }
+  minExecutionDelay() {
+    return this.read("minExecutionDelay()");
+  }
+  moduleCount() {
+    return this.read("moduleCount()");
+  }
+  getModules() {
+    return this.read("getModules()");
+  }
+  isModuleEnabled(module) {
+    return this.read("isModuleEnabled(address)", module);
+  }
+  delegatecallAllowed(target) {
+    return this.read("delegatecallAllowed(address)", target);
+  }
+  transactions(txHash) {
+    return this.read("transactions(bytes32)", txHash);
+  }
+  /**
+   * Whether an owner's approval currently counts toward the threshold.
+   * Accounts for approval-epoch invalidation from owner removal.
+   */
+  hasApproved(txHash, owner) {
+    return this.read("hasApproved(bytes32,address)", txHash, owner);
+  }
+  /** True when the transaction was closed by `expireTransaction`, not cancelled. */
+  expiredTxs(txHash) {
+    return this.read("expiredTxs(bytes32)", txHash);
+  }
+  getTransactionHash(to, value, data, nonce) {
+    return this.read(
+      "getTransactionHash(address,uint256,bytes,uint256)",
+      to,
+      value,
+      data,
+      nonce
+    );
+  }
+  isValidSignature(hash, signature) {
+    return this.read("isValidSignature(bytes32,bytes)", hash, signature);
+  }
+  // ---- writes --------------------------------------------------------------
+  /**
+   * Overload with expiration and delay. The 3-argument overload is used when
+   * neither is supplied, so a caller that wants no expiry never has to pass 0.
+   */
+  proposeTransactionFull(to, value, data, expiration, executionDelay) {
+    return this.fn("proposeTransaction(address,uint256,bytes,uint48,uint32)")(
+      to,
+      value,
+      data,
+      expiration,
+      executionDelay
+    );
+  }
+  proposeTransactionSimple(to, value, data) {
+    return this.fn("proposeTransaction(address,uint256,bytes)")(
+      to,
+      value,
+      data
+    );
+  }
+  approveTransaction(txHash) {
+    return this.fn("approveTransaction(bytes32)")(txHash);
+  }
+  approveAndExecute(txHash) {
+    return this.fn("approveAndExecute(bytes32)")(txHash);
+  }
+  executeTransaction(txHash) {
+    return this.fn("executeTransaction(bytes32)")(txHash);
+  }
+  revokeApproval(txHash) {
+    return this.fn("revokeApproval(bytes32)")(txHash);
+  }
+  cancelTransaction(txHash) {
+    return this.fn("cancelTransaction(bytes32)")(txHash);
+  }
+  expireTransaction(txHash) {
+    return this.fn("expireTransaction(bytes32)")(txHash);
+  }
+  encode(signature, args) {
+    return this.contract.interface.encodeFunctionData(signature, args);
+  }
+};
+var FactoryContract = class {
+  constructor(contract, retry = {}) {
+    this.contract = contract;
+    this.retry = retry;
+  }
+  contract;
+  retry;
+  fn(signature) {
+    return this.contract.getFunction(signature);
+  }
+  /**
+   * Reads retry transient RPC failures (see {@link withRetry}); writes never do,
+   * because a resubmit that looks like a timeout may already be in the mempool.
+   */
+  read(signature, ...args) {
+    return withRetry(() => this.fn(signature)(...args), this.retry);
+  }
+  get interface() {
+    return this.contract.interface;
+  }
+  implementation() {
+    return this.read("implementation()");
+  }
+  isWallet(address2) {
+    return this.read("isWallet(address)", address2);
+  }
+  getWalletCount() {
+    return this.read("getWalletCount()");
+  }
+  deployedWallets(index) {
+    return this.read("deployedWallets(uint256)", index);
+  }
+  predictWalletAddress(deployer, salt, owners, threshold, minExecutionDelay, initialModules, initialDelegatecallTargets) {
+    return this.read(
+      "predictWalletAddress(address,bytes32,address[],uint256,uint32,address[],address[])",
+      deployer,
+      salt,
+      owners,
+      threshold,
+      minExecutionDelay,
+      initialModules,
+      initialDelegatecallTargets
+    );
+  }
+  /** Full 6-argument overload. The SDK always uses it so mining stays consistent. */
+  createWallet(owners, threshold, salt, minExecutionDelay, initialModules, initialDelegatecallTargets) {
+    return this.fn("createWallet(address[],uint256,bytes32,uint32,address[],address[])")(
+      owners,
+      threshold,
+      salt,
+      minExecutionDelay,
+      initialModules,
+      initialDelegatecallTargets
+    );
+  }
+  registerWallet(wallet) {
+    return this.fn("registerWallet(address)")(wallet);
+  }
+};
+
+// src/errors/decode.ts
+import { Interface, AbiCoder } from "quais";
+var SOLIDITY_ERROR_SELECTOR = "0x08c379a0";
+var SOLIDITY_PANIC_SELECTOR = "0x4e487b71";
+var registry = null;
+function buildRegistry() {
+  const map = /* @__PURE__ */ new Map();
+  for (const abi of [QuaiVaultAbi, QuaiVaultFactoryAbi, SocialRecoveryModuleAbi, QuaiVaultProxyAbi]) {
+    const iface = new Interface(abi);
+    iface.forEachError((fragment) => {
+      if (!map.has(fragment.selector)) map.set(fragment.selector, { fragment, iface });
+    });
+  }
+  return map;
+}
+function getRegistry() {
+  if (!registry) registry = buildRegistry();
+  return registry;
+}
+var REMEDIATION = {
+  // --- QuaiVault: authorisation
+  NotAnOwner: "The calling address is not an owner of this vault.",
+  OnlySelf: "This function can only be invoked as a vault self-call. Propose a transaction targeting the vault itself.",
+  NotAnAuthorizedModule: "The caller is not an enabled module on this vault.",
+  NotProposer: "Only the address that proposed a transaction may cancel it directly.",
+  // --- QuaiVault: transaction lifecycle
+  TransactionDoesNotExist: "No transaction with that hash exists on this vault.",
+  TransactionAlreadyExecuted: "This transaction has already been executed and is terminal.",
+  TransactionAlreadyCancelled: "This transaction has already been cancelled or expired.",
+  TransactionAlreadyExists: "An identical transaction (same target, value, data and nonce) is already pending.",
+  AlreadyApproved: "This owner has already approved the transaction.",
+  NotApproved: "This owner has no active approval to revoke.",
+  NotEnoughApprovals: "The approval threshold has not been reached yet.",
+  CannotCancelApprovedTransaction: "The transaction reached quorum, which permanently locks proposer-cancel. Propose a cancelByConsensus self-call instead.",
+  TransactionIsExpired: "The transaction passed its expiration timestamp and can no longer execute.",
+  TransactionNotExpired: "The transaction has not passed its expiration timestamp yet.",
+  TimelockNotElapsed: "The execution delay has not elapsed. Retry after the timelock expires.",
+  ExpirationTooSoon: "The expiration must be later than now plus the execution delay, so at least one execution attempt is possible.",
+  SelfCallCannotHaveValue: "Self-calls must have value 0.",
+  InvalidDestinationAddress: "The destination address is the zero address.",
+  CalldataTooShort: "Self-call data must contain at least a 4-byte function selector.",
+  UnrecognizedSelfCall: "The self-call selector is not one the vault dispatches. Check the encoded function against the QuaiVault ABI.",
+  // --- QuaiVault: owners and threshold
+  OwnersRequired: "At least one owner is required.",
+  TooManyOwners: "A vault may have at most 20 owners.",
+  MaxOwnersReached: "This vault already has the maximum of 20 owners.",
+  InvalidThreshold: "The threshold must be between 1 and the number of owners.",
+  InvalidOwnerAddress: "Owner addresses cannot be the zero address, the vault itself, or the sentinel 0x\u202601.",
+  DuplicateOwner: "The owner list contains a duplicate address.",
+  AlreadyAnOwner: "That address is already an owner.",
+  CannotRemoveOwnerWouldFallBelowThreshold: "Removing this owner would leave fewer owners than the threshold. Lower the threshold first.",
+  // --- QuaiVault: modules and delegatecall
+  ModuleAlreadyEnabled: "That module is already enabled.",
+  ModuleNotEnabled: "That module is not enabled on this vault.",
+  InvalidModule: "Module addresses cannot be the zero address or the sentinel 0x\u202601.",
+  InvalidPrevModule: "The predecessor in the module linked list is stale \u2014 the module list changed since the proposal was created.",
+  MaxModulesReached: "This vault already has the maximum of 50 modules.",
+  DelegateCallNotAllowed: "DelegateCall targets must be explicitly whitelisted. Propose addDelegatecallTarget for this address first.",
+  DelegatecallTargetAlreadyAllowed: "That address is already on the DelegateCall whitelist.",
+  DelegatecallTargetNotAllowed: "That address is not on the DelegateCall whitelist.",
+  ImplementationSlotTampered: "A DelegateCall overwrote the ERC1967 implementation slot and was reverted. The target contract is hostile or buggy.",
+  // --- QuaiVault: misc
+  ExecutionDelayTooLong: "The execution delay may not exceed 30 days (2,592,000 seconds).",
+  MessageNotSigned: "That message hash is not currently signed by the vault.",
+  // --- Factory
+  InvalidImplementationAddress: "The implementation address is the zero address.",
+  InvalidWalletAddress: "The vault address is the zero address.",
+  WalletAlreadyRegistered: "That vault is already registered with the factory.",
+  CallerIsNotAnOwner: "Only an owner of the vault may register it with the factory.",
+  InvalidWalletImplementation: "The address is not a QuaiVaultProxy pointing at this factory\u2019s implementation.",
+  // --- SocialRecoveryModule
+  GuardiansRequired: "At least one guardian is required.",
+  TooManyGuardians: "Too many guardians for the recovery configuration.",
+  RecoveryPeriodTooShort: "The recovery period is below the module minimum.",
+  CannotUpdateConfigWhileRecoveriesPending: "Cancel or resolve all pending recoveries before changing the guardian configuration.",
+  InvalidGuardianAddress: "A guardian address is invalid.",
+  DuplicateGuardian: "The guardian list contains a duplicate address.",
+  RecoveryNotConfigured: "This vault has no social recovery configuration.",
+  NotAGuardian: "The calling address is not a guardian of this vault.",
+  RecoveryAlreadyInitiated: "An identical recovery is already pending.",
+  RecoveryNotInitiated: "No recovery with that hash exists.",
+  RecoveryAlreadyExecuted: "That recovery has already been executed.",
+  RecoveryPeriodNotElapsed: "The recovery time lock has not elapsed yet.",
+  RecoveryExpired: "The recovery passed its expiration deadline.",
+  RecoveryNotExpired: "The recovery has not expired yet.",
+  TooManyPendingRecoveries: "This vault has reached its cap on concurrent pending recoveries.",
+  RecoveryExceedsMaxOwners: "Applying this recovery would temporarily exceed the 20-owner maximum during the add-before-remove sequence.",
+  MustBeCalledByWallet: "This function must be called by the vault itself."
+};
+function formatArgs(fragment, args) {
+  if (args.length === 0) return "";
+  const parts = fragment.inputs.map((input, i) => {
+    const value = args[i];
+    const rendered = typeof value === "bigint" ? value.toString() : String(value);
+    return input.name ? `${input.name}: ${rendered}` : rendered;
+  });
+  return `(${parts.join(", ")})`;
+}
+function decodeRevert(data) {
+  if (typeof data !== "string" || !data.startsWith("0x") || data.length < 10) return void 0;
+  const selector = data.slice(0, 10).toLowerCase();
+  const coder = AbiCoder.defaultAbiCoder();
+  if (selector === SOLIDITY_ERROR_SELECTOR) {
+    try {
+      const [reason] = coder.decode(["string"], "0x" + data.slice(10));
+      return {
+        name: "Error",
+        args: [reason],
+        selector,
+        message: String(reason)
+      };
+    } catch {
+      return void 0;
+    }
+  }
+  if (selector === SOLIDITY_PANIC_SELECTOR) {
+    try {
+      const [code] = coder.decode(["uint256"], "0x" + data.slice(10));
+      return {
+        name: "Panic",
+        args: [code],
+        selector,
+        message: `Panic(0x${BigInt(code).toString(16)}) \u2014 arithmetic or assertion failure in the target contract`
+      };
+    } catch {
+      return void 0;
+    }
+  }
+  const entry = getRegistry().get(selector);
+  if (!entry) return void 0;
+  let args = [];
+  try {
+    args = Array.from(entry.iface.decodeErrorResult(entry.fragment, data));
+  } catch {
+  }
+  const name = entry.fragment.name;
+  const remediation = REMEDIATION[name];
+  const rendered = `${name}${formatArgs(entry.fragment, args)}`;
+  return {
+    name,
+    args,
+    selector,
+    message: remediation ? `${rendered} \u2014 ${remediation}` : rendered
+  };
+}
+function remediationFor(errorName) {
+  return REMEDIATION[errorName];
+}
+function decodeRevertFromError(error) {
+  const seen = /* @__PURE__ */ new Set();
+  const walk = (node, depth) => {
+    if (node == null || depth > 6 || seen.has(node)) return void 0;
+    if (typeof node === "string") return decodeRevert(node);
+    if (typeof node !== "object") return void 0;
+    seen.add(node);
+    const obj = node;
+    for (const key of ["data", "errorData", "return", "returnData"]) {
+      const decoded = decodeRevert(obj[key]);
+      if (decoded) return decoded;
+    }
+    for (const key of ["error", "cause", "info", "body", "value"]) {
+      const decoded = walk(obj[key], depth + 1);
+      if (decoded) return decoded;
+    }
+    return void 0;
+  };
+  return walk(error, 0);
+}
+function knownErrorSelectors() {
+  return Array.from(getRegistry().entries()).map(([selector, { fragment }]) => ({
+    selector,
+    signature: fragment.format("sighash")
+  }));
+}
+
+// src/encode/index.ts
+import { AbiCoder as AbiCoder2, Interface as Interface2, concat, getBytes, solidityPacked, zeroPadValue, toBeHex } from "quais";
+
+// src/types.ts
+var Operation = /* @__PURE__ */ ((Operation2) => {
+  Operation2[Operation2["Call"] = 0] = "Call";
+  Operation2[Operation2["DelegateCall"] = 1] = "DelegateCall";
+  return Operation2;
+})(Operation || {});
+
+// src/encode/index.ts
+var vault = new Interface2(QuaiVaultAbi);
+var recovery = new Interface2(SocialRecoveryModuleAbi);
+var multiSend = new Interface2(MultiSendCallOnlyAbi);
+var erc20 = new Interface2(Erc20Abi);
+var erc721 = new Interface2(Erc721Abi);
+var erc1155 = new Interface2(Erc1155Abi);
+var interfaces = { vault, recovery, multiSend, erc20, erc721, erc1155 };
+var MAX_EXECUTION_DELAY = 30 * 24 * 60 * 60;
+var MAX_OWNERS = 20;
+var MAX_MODULES = 50;
+var SENTINEL_MODULES = "0x0000000000000000000000000000000000000001";
+var selfCall = {
+  addOwner: (owner) => vault.encodeFunctionData("addOwner", [owner]),
+  removeOwner: (owner) => vault.encodeFunctionData("removeOwner", [owner]),
+  changeThreshold: (threshold) => {
+    if (!Number.isInteger(threshold) || threshold < 1) {
+      throw new ValidationError(`Invalid threshold ${threshold}: must be an integer >= 1.`);
+    }
+    return vault.encodeFunctionData("changeThreshold", [threshold]);
+  },
+  enableModule: (module) => vault.encodeFunctionData("enableModule", [module]),
+  /**
+   * Disable a module.
+   *
+   * `prevModule` is the predecessor in the Zodiac linked list and must be resolved
+   * against the live list — a proposal built against a stale list can never execute.
+   * Prefer `Vault.propose.disableModule`, which resolves it for you.
+   */
+  disableModule: (prevModule, module) => vault.encodeFunctionData("disableModule", [prevModule, module]),
+  setMinExecutionDelay: (seconds) => {
+    if (!Number.isInteger(seconds) || seconds < 0 || seconds > MAX_EXECUTION_DELAY) {
+      throw new ValidationError(
+        `Invalid execution delay ${seconds}: must be an integer between 0 and ${MAX_EXECUTION_DELAY} (30 days).`
+      );
+    }
+    return vault.encodeFunctionData("setMinExecutionDelay", [seconds]);
+  },
+  addDelegatecallTarget: (target) => vault.encodeFunctionData("addDelegatecallTarget", [target]),
+  removeDelegatecallTarget: (target) => vault.encodeFunctionData("removeDelegatecallTarget", [target]),
+  cancelByConsensus: (txHash) => vault.encodeFunctionData("cancelByConsensus", [txHash]),
+  /** Sign arbitrary bytes. For EIP-1271 hash pre-approval use {@link approveHashForEip1271}. */
+  signMessage: (data) => vault.encodeFunctionData("signMessage", [data]),
+  unsignMessage: (data) => vault.encodeFunctionData("unsignMessage", [data]),
+  /**
+   * Pre-approve a hash so `isValidSignature(hash, …)` returns the EIP-1271 magic value.
+   *
+   * `isValidSignature(h)` checks `signedMessages[getMessageHash(abi.encode(h))]`, while
+   * `signMessage(data)` stores `getMessageHash(data)`. Because `abi.encode` of a static
+   * `bytes32` is the identity on its 32 bytes, this produces calldata identical to
+   * `signMessage(hash)` — the encoding step is a no-op for a well-formed hash.
+   *
+   * It is a separate helper because the *length* is what matters: signing an
+   * arbitrary-length message `M` does NOT make `isValidSignature(keccak256(M))`
+   * validate, since EIP-1271 hashes the 32-byte dataHash, not `M`. This entry point
+   * enforces the 32-byte precondition and states the intent, so that mistake is
+   * caught here rather than discovered when a counterparty's check silently fails.
+   */
+  approveHashForEip1271: (hash) => {
+    if (!/^0x[0-9a-fA-F]{64}$/.test(hash)) {
+      throw new ValidationError("approveHashForEip1271 expects a 32-byte hash.");
+    }
+    const encoded = AbiCoder2.defaultAbiCoder().encode(["bytes32"], [hash]);
+    return vault.encodeFunctionData("signMessage", [encoded]);
+  },
+  /** Revoke a hash previously approved via {@link approveHashForEip1271}. */
+  revokeHashForEip1271: (hash) => {
+    if (!/^0x[0-9a-fA-F]{64}$/.test(hash)) {
+      throw new ValidationError("revokeHashForEip1271 expects a 32-byte hash.");
+    }
+    const encoded = AbiCoder2.defaultAbiCoder().encode(["bytes32"], [hash]);
+    return vault.encodeFunctionData("unsignMessage", [encoded]);
+  }
+};
+var token = {
+  erc20Transfer: (to, amount) => erc20.encodeFunctionData("transfer", [to, amount]),
+  erc20Approve: (spender, amount) => erc20.encodeFunctionData("approve", [spender, amount]),
+  erc721Transfer: (from, to, tokenId) => erc721.encodeFunctionData("safeTransferFrom(address,address,uint256)", [from, to, tokenId]),
+  erc1155Transfer: (from, to, id, amount, data = "0x") => erc1155.encodeFunctionData("safeTransferFrom", [from, to, id, amount, data]),
+  erc1155BatchTransfer: (from, to, ids, amounts, data = "0x") => {
+    if (ids.length !== amounts.length) {
+      throw new ValidationError("erc1155BatchTransfer: ids and amounts must be the same length.");
+    }
+    return erc1155.encodeFunctionData("safeBatchTransferFrom", [from, to, ids, amounts, data]);
+  }
+};
+var recoveryCall = {
+  /** Encoded for a vault-proposed call to the module (not a self-call). */
+  setupRecovery: (vaultAddress, guardians, threshold, recoveryPeriodSeconds) => {
+    if (guardians.length === 0) throw new ValidationError("At least one guardian is required.");
+    if (!Number.isInteger(threshold) || threshold < 1 || threshold > guardians.length) {
+      throw new ValidationError(
+        `Invalid guardian threshold ${threshold}: must be between 1 and ${guardians.length}.`
+      );
+    }
+    return recovery.encodeFunctionData("setupRecovery", [
+      vaultAddress,
+      guardians,
+      threshold,
+      recoveryPeriodSeconds
+    ]);
+  }
+};
+function encodeMultiSendPayload(calls) {
+  if (calls.length === 0) throw new ValidationError("encodeMultiSendPayload: no calls supplied.");
+  const parts = calls.map((call) => {
+    const data = call.data ?? "0x";
+    const bytes = getBytes(data);
+    return solidityPacked(
+      ["uint8", "address", "uint256", "uint256", "bytes"],
+      [0 /* Call */, call.to, call.value ?? 0n, bytes.length, bytes]
+    );
+  });
+  return concat(parts);
+}
+function encodeMultiSend(calls) {
+  return multiSend.encodeFunctionData("multiSend", [encodeMultiSendPayload(calls)]);
+}
+function minimumExpiration(effectiveDelaySeconds, marginSeconds = 300, at = Math.floor(Date.now() / 1e3)) {
+  return at + effectiveDelaySeconds + marginSeconds;
+}
+
+// src/salt/mine.ts
+import { getCreate2Address as getCreate2Address2, hexlify, isQuaiAddress as isQuaiAddress2, keccak256 as keccak2562, randomBytes, solidityPacked as solidityPacked3 } from "quais";
+
+// src/salt/predict.ts
+import { AbiCoder as AbiCoder3, Interface as Interface3, concat as concat2, getCreate2Address, keccak256, solidityPacked as solidityPacked2 } from "quais";
+var vaultInterface = new Interface3(QuaiVaultAbi);
+function encodeInitData(params) {
+  return vaultInterface.encodeFunctionData("initialize", [
+    params.owners,
+    params.threshold,
+    params.minExecutionDelay ?? 0,
+    params.initialModules ?? [],
+    params.initialDelegatecallTargets ?? []
+  ]);
+}
+function computeBytecodeHash(implementation, initData) {
+  const encodedArgs = AbiCoder3.defaultAbiCoder().encode(
+    ["address", "bytes"],
+    [implementation, initData]
+  );
+  return keccak256(concat2([QuaiVaultProxyBytecode, encodedArgs]));
+}
+function computeFullSalt(deployer, userSalt) {
+  return keccak256(solidityPacked2(["address", "bytes32"], [deployer, userSalt]));
+}
+function predictVaultAddress(args) {
+  const initData = encodeInitData(args.params);
+  const bytecodeHash = computeBytecodeHash(args.implementation, initData);
+  const fullSalt = computeFullSalt(args.deployer, args.salt);
+  return getCreate2Address(args.factory, fullSalt, bytecodeHash);
+}
+function shardPrefixOf(address2) {
+  if (typeof address2 !== "string" || !address2.startsWith("0x") || address2.length < 4) {
+    throw new ValidationError(`Cannot derive a shard prefix from "${address2}".`);
+  }
+  return address2.slice(0, 4).toLowerCase();
+}
+
+// src/salt/mine.ts
+var DEFAULT_MAX_ATTEMPTS = 5e5;
+var DEFAULT_TIMEOUT_MS = 12e4;
+var PROGRESS_INTERVAL = 1e3;
+var CHUNK = 250;
+function tryOne(factory, deployer, bytecodeHash, targetPrefix) {
+  const salt = hexlify(randomBytes(32));
+  const fullSalt = keccak2562(solidityPacked3(["address", "bytes32"], [deployer, salt]));
+  const address2 = getCreate2Address2(factory, fullSalt, bytecodeHash);
+  if (address2.toLowerCase().startsWith(targetPrefix) && isQuaiAddress2(address2)) {
+    return { salt, address: address2 };
+  }
+  return null;
+}
+var syncStrategy = {
+  name: "sync",
+  async mine({ factory, deployer, bytecodeHash, targetPrefix, maxAttempts, timeoutMs, onProgress, signal }) {
+    const startedAt = Date.now();
+    for (let attempts = 0; attempts < maxAttempts; ) {
+      if (signal?.aborted) throw new SaltMiningError("Salt mining was aborted.");
+      if (Date.now() - startedAt > timeoutMs) {
+        throw new SaltMiningError(
+          `Salt mining timed out after ${timeoutMs} ms (${attempts} attempts).`,
+          "Raise timeoutMs, or use the worker_threads strategy on Node for more throughput."
+        );
+      }
+      const chunkEnd = Math.min(attempts + CHUNK, maxAttempts);
+      for (; attempts < chunkEnd; attempts++) {
+        const hit = tryOne(factory, deployer, bytecodeHash, targetPrefix);
+        if (hit) {
+          return {
+            salt: hit.salt,
+            predictedAddress: hit.address,
+            attempts: attempts + 1,
+            durationMs: Date.now() - startedAt
+          };
+        }
+        if ((attempts + 1) % PROGRESS_INTERVAL === 0) onProgress?.(attempts + 1);
+      }
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    }
+    throw new SaltMiningError(
+      `No valid salt found for prefix ${targetPrefix} after ${maxAttempts} attempts.`,
+      "Raise maxAttempts, or confirm the deployer address is on the shard you expect."
+    );
+  }
+};
+var workerThreadsStrategy = {
+  name: "worker_threads",
+  async mine(job) {
+    let Worker;
+    let availableParallelism;
+    try {
+      ({ Worker } = await import("worker_threads"));
+      const os = await import("os");
+      availableParallelism = os.availableParallelism ?? (() => os.cpus().length);
+    } catch {
+      return syncStrategy.mine(job);
+    }
+    const { factory, deployer, bytecodeHash, targetPrefix, maxAttempts, timeoutMs, onProgress, signal } = job;
+    const workerCount = Math.max(1, Math.min(8, availableParallelism() - 1));
+    const perWorker = Math.ceil(maxAttempts / workerCount);
+    const startedAt = Date.now();
+    const workerSource = `
+      const { parentPort, workerData } = require('node:worker_threads');
+      const { getCreate2Address, hexlify, isQuaiAddress, keccak256, randomBytes, solidityPacked } = require('quais');
+      const { factory, deployer, bytecodeHash, targetPrefix, maxAttempts } = workerData;
+      for (let i = 0; i < maxAttempts; i++) {
+        const salt = hexlify(randomBytes(32));
+        const fullSalt = keccak256(solidityPacked(['address', 'bytes32'], [deployer, salt]));
+        const address = getCreate2Address(factory, fullSalt, bytecodeHash);
+        if (address.toLowerCase().startsWith(targetPrefix) && isQuaiAddress(address)) {
+          parentPort.postMessage({ type: 'result', salt, address, attempts: i + 1 });
+          return;
+        }
+        if ((i + 1) % ${PROGRESS_INTERVAL} === 0) parentPort.postMessage({ type: 'progress', attempts: i + 1 });
+      }
+      parentPort.postMessage({ type: 'exhausted', attempts: maxAttempts });
+    `;
+    return new Promise((resolve, reject) => {
+      const workers = [];
+      let settled = false;
+      let exhausted = 0;
+      let totalAttempts = 0;
+      const progressByWorker = new Array(workerCount).fill(0);
+      const cleanup = () => {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", onAbort);
+        for (const w of workers) void w.terminate();
+      };
+      const settle = (fn) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        fn();
+      };
+      const timer = setTimeout(
+        () => settle(
+          () => reject(
+            new SaltMiningError(
+              `Salt mining timed out after ${timeoutMs} ms (~${totalAttempts} attempts across ${workerCount} workers).`,
+              "Raise timeoutMs or maxAttempts."
+            )
+          )
+        ),
+        timeoutMs
+      );
+      const onAbort = () => settle(() => reject(new SaltMiningError("Salt mining was aborted.")));
+      signal?.addEventListener("abort", onAbort, { once: true });
+      for (let i = 0; i < workerCount; i++) {
+        const worker = new Worker(workerSource, {
+          eval: true,
+          workerData: { factory, deployer, bytecodeHash, targetPrefix, maxAttempts: perWorker }
+        });
+        workers.push(worker);
+        worker.on("message", (msg) => {
+          if (msg.type === "progress") {
+            progressByWorker[i] = msg.attempts ?? 0;
+            totalAttempts = progressByWorker.reduce((a, b) => a + b, 0);
+            onProgress?.(totalAttempts);
+          } else if (msg.type === "result") {
+            settle(
+              () => resolve({
+                salt: msg.salt,
+                predictedAddress: msg.address,
+                attempts: totalAttempts + (msg.attempts ?? 0),
+                durationMs: Date.now() - startedAt
+              })
+            );
+          } else if (msg.type === "exhausted") {
+            if (++exhausted === workerCount) {
+              settle(
+                () => reject(
+                  new SaltMiningError(
+                    `No valid salt found for prefix ${targetPrefix} after ${maxAttempts} attempts.`,
+                    "Raise maxAttempts, or confirm the deployer address is on the shard you expect."
+                  )
+                )
+              );
+            }
+          }
+        });
+        worker.on(
+          "error",
+          (err) => settle(() => reject(new SaltMiningError(`Salt mining worker failed: ${err.message}`)))
+        );
+      }
+    });
+  }
+};
+function defaultStrategy() {
+  const hasNode = typeof globalThis.process?.versions?.node === "string";
+  return hasNode ? workerThreadsStrategy : syncStrategy;
+}
+async function mineSalt(options, strategy = defaultStrategy()) {
+  const targetPrefix = (options.targetPrefix ?? shardPrefixOf(options.deployer)).toLowerCase();
+  const initData = encodeInitData(options.params);
+  const bytecodeHash = computeBytecodeHash(options.implementation, initData);
+  return strategy.mine({
+    factory: options.factory,
+    deployer: options.deployer,
+    bytecodeHash,
+    targetPrefix,
+    maxAttempts: options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS,
+    timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+    onProgress: options.onProgress,
+    signal: options.signal
+  });
+}
+
+// src/factory.ts
+var factoryInterface = new Interface4(QuaiVaultFactoryAbi);
+var Factory = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  get address() {
+    return this.ctx.contracts.factory;
+  }
+  contract(write = false) {
+    return new FactoryContract(this.ctx.connection.factory(this.address, write), this.ctx.connection.retry);
+  }
+  /** The implementation every proxy from this factory delegates to. */
+  async implementation() {
+    return getAddress2(await this.contract().implementation());
+  }
+  /** Whether the factory has this vault in its registry. */
+  async isRegistered(vault2) {
+    return this.contract().isWallet(getAddress2(vault2));
+  }
+  async vaultCount() {
+    return Number(await this.contract().getWalletCount());
+  }
+  async vaultAt(index) {
+    return getAddress2(await this.contract().deployedWallets(index));
+  }
+  /**
+   * Verify the configured implementation address matches what the factory reports.
+   *
+   * A mismatch means salt mining will predict addresses the factory will not deploy
+   * to, so it is worth catching before a deployment rather than after.
+   */
+  async verify() {
+    const errors = [];
+    try {
+      const onChain = await this.implementation();
+      if (onChain.toLowerCase() !== this.ctx.contracts.implementation.toLowerCase()) {
+        errors.push(
+          `Configured implementation ${this.ctx.contracts.implementation} does not match the factory's ${onChain}. Address prediction and salt mining will be wrong.`
+        );
+      }
+      const code = await this.ctx.connection.provider.getCode(onChain);
+      if (code === "0x") errors.push(`No contract code at implementation ${onChain}.`);
+    } catch (err) {
+      errors.push(
+        `Could not reach the factory at ${this.address}: ` + (err instanceof Error ? err.message : String(err))
+      );
+    }
+    return { valid: errors.length === 0, errors };
+  }
+  /** Off-chain CREATE2 prediction. Identical to `factory.predictWalletAddress`. */
+  predictAddress(deployer, salt, params) {
+    validateCreateParams(params);
+    return predictVaultAddress({
+      factory: this.address,
+      implementation: this.ctx.contracts.implementation,
+      deployer: getAddress2(deployer),
+      salt,
+      params
+    });
+  }
+  /**
+   * Mine a CREATE2 salt placing the vault on the deployer's shard.
+   *
+   * Quai addresses are shard-scoped, so an arbitrary salt usually produces a vault
+   * the deployer cannot reach. The mined salt is only valid for these exact create
+   * params — changing owners, threshold, delay, modules or delegatecall targets
+   * changes the predicted address.
+   */
+  async mineSalt(params, options = {}, strategy) {
+    validateCreateParams(params);
+    const deployer = options.deployer ?? await this.ctx.connection.address();
+    return mineSalt(
+      {
+        factory: this.address,
+        implementation: this.ctx.contracts.implementation,
+        deployer: getAddress2(deployer),
+        params,
+        ...options
+      },
+      strategy
+    );
+  }
+  /**
+   * Deploy a vault, mining a salt first when one is not supplied.
+   *
+   * Always uses the 6-argument `createWallet` overload so the deployed bytecode
+   * matches what mining predicted, whatever combination of modules and delegatecall
+   * targets is requested.
+   */
+  async create(params, options = {}) {
+    const { onProgress } = options;
+    validateCreateParams(params);
+    onProgress?.({ step: "validating", message: "Checking factory configuration\u2026" });
+    const verification = await this.verify();
+    if (!verification.valid) {
+      throw new PreconditionError(verification.errors.join(" "), {
+        remediation: "Check the configured factory and implementation addresses for this network."
+      });
+    }
+    const deployer = getAddress2(await this.ctx.connection.address());
+    let salt = params.salt;
+    let predictedAddress;
+    if (salt) {
+      predictedAddress = this.predictAddress(deployer, salt, params);
+    } else {
+      onProgress?.({ step: "mining", message: "Mining a salt for your shard\u2026" });
+      const mined = await this.mineSalt(
+        params,
+        {
+          deployer,
+          ...options.maxAttempts != null ? { maxAttempts: options.maxAttempts } : {},
+          ...options.timeoutMs != null ? { timeoutMs: options.timeoutMs } : {},
+          onProgress: (attempts) => onProgress?.({ step: "mining", message: `Mining\u2026 ${attempts} attempts`, attempts })
+        },
+        options.miningStrategy
+      );
+      salt = mined.salt;
+      predictedAddress = mined.predictedAddress;
+      onProgress?.({
+        step: "mining",
+        message: `Found ${mined.predictedAddress} after ${mined.attempts} attempts`,
+        attempts: mined.attempts,
+        predictedAddress: mined.predictedAddress
+      });
+    }
+    onProgress?.({ step: "deploying", message: "Submitting the deployment\u2026", predictedAddress });
+    const factory = this.contract(true);
+    let receipt;
+    let chainTxHash;
+    try {
+      const sent = await factory.createWallet(
+        params.owners.map((o) => getAddress2(o)),
+        params.threshold,
+        salt,
+        params.minExecutionDelay ?? 0,
+        (params.initialModules ?? []).map((m) => getAddress2(m)),
+        (params.initialDelegatecallTargets ?? []).map((t) => getAddress2(t))
+      );
+      chainTxHash = sent.hash;
+      onProgress?.({ step: "confirming", message: "Waiting for confirmation\u2026", chainTxHash });
+      receipt = await sent.wait();
+    } catch (err) {
+      const decoded = decodeRevertFromError(err);
+      throw new RevertError(
+        `Vault creation failed${decoded ? `: ${decoded.message}` : ""}`,
+        decoded,
+        { cause: err }
+      );
+    }
+    if (!receipt || receipt.status === 0) {
+      throw new RevertError("The deployment transaction reverted.");
+    }
+    const address2 = extractCreatedVault(receipt, this.address);
+    if (!address2) {
+      throw new RevertError(
+        "The deployment was mined but no WalletCreated event was found."
+      );
+    }
+    onProgress?.({ step: "done", message: `Vault deployed at ${address2}`, chainTxHash });
+    return {
+      address: address2,
+      chainTxHash,
+      salt,
+      predictionMatched: predictedAddress !== void 0 && predictedAddress.toLowerCase() === address2.toLowerCase()
+    };
+  }
+  /** Register an externally deployed proxy. Callable only by one of its owners. */
+  async register(vault2) {
+    const factory = this.contract(true);
+    try {
+      const sent = await factory.registerWallet(getAddress2(vault2));
+      const receipt = await sent.wait();
+      if (!receipt || receipt.status === 0) {
+        throw new RevertError("Registration reverted.");
+      }
+      return { chainTxHash: receipt.hash ?? receipt.transactionHash ?? "" };
+    } catch (err) {
+      if (err instanceof RevertError) throw err;
+      const decoded = decodeRevertFromError(err);
+      throw new RevertError(
+        `Registering the vault failed${decoded ? `: ${decoded.message}` : ""}`,
+        decoded,
+        { cause: err }
+      );
+    }
+  }
+};
+function validateCreateParams(params) {
+  const { owners, threshold } = params;
+  if (!Array.isArray(owners) || owners.length === 0) {
+    throw new ValidationError("At least one owner is required.");
+  }
+  if (owners.length > MAX_OWNERS) {
+    throw new ValidationError(`A vault may have at most ${MAX_OWNERS} owners (got ${owners.length}).`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  owners.forEach((owner, i) => {
+    assertQuaiAddress(owner, `owner[${i}]`);
+    const key = owner.toLowerCase();
+    if (key === "0x0000000000000000000000000000000000000000" || key === "0x0000000000000000000000000000000000000001") {
+      throw new ValidationError(
+        `Owner ${owner} is reserved \u2014 the zero address and the module sentinel 0x\u202601 are rejected.`
+      );
+    }
+    if (seen.has(key)) throw new ValidationError(`Duplicate owner: ${owner}.`);
+    seen.add(key);
+  });
+  if (params.initialModules?.length) {
+    assertQuaiAddresses(params.initialModules, "initialModules");
+  }
+  if (params.initialDelegatecallTargets?.length) {
+    assertQuaiAddresses(params.initialDelegatecallTargets, "initialDelegatecallTargets");
+  }
+  if (!Number.isInteger(threshold) || threshold < 1 || threshold > owners.length) {
+    throw new ValidationError(
+      `Invalid threshold ${threshold}: must be an integer between 1 and ${owners.length}.`
+    );
+  }
+  const delay = params.minExecutionDelay ?? 0;
+  if (!Number.isInteger(delay) || delay < 0 || delay > MAX_EXECUTION_DELAY) {
+    throw new ValidationError(
+      `Invalid minExecutionDelay ${delay}: must be between 0 and ${MAX_EXECUTION_DELAY} seconds (30 days).`
+    );
+  }
+}
+function extractCreatedVault(receipt, factoryAddress) {
+  const target = factoryAddress.toLowerCase();
+  for (const log of receipt.logs ?? []) {
+    if (log.address && log.address.toLowerCase() !== target) continue;
+    try {
+      const parsed = factoryInterface.parseLog({
+        topics: Array.from(log.topics),
+        data: log.data
+      });
+      if (parsed?.name === "WalletCreated") {
+        return getAddress2(String(parsed.args[0]));
+      }
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+
+// src/indexer/client.ts
+import { createClient } from "@supabase/supabase-js";
+
+// src/indexer/schemas.ts
+var schemas_exports = {};
+__export(schemas_exports, {
+  ConfirmationSchema: () => ConfirmationSchema,
+  DelegatecallTargetSchema: () => DelegatecallTargetSchema,
+  DepositSchema: () => DepositSchema,
+  IndexerStateSchema: () => IndexerStateSchema,
+  RecoveryApprovalSchema: () => RecoveryApprovalSchema,
+  RecoveryConfigSchema: () => RecoveryConfigSchema,
+  RecoveryGuardianSchema: () => RecoveryGuardianSchema,
+  RecoverySchema: () => RecoverySchema,
+  SignedMessageSchema: () => SignedMessageSchema,
+  TokenSchema: () => TokenSchema,
+  TokenTransferSchema: () => TokenTransferSchema,
+  TransactionSchema: () => TransactionSchema,
+  TransactionStatusEnum: () => TransactionStatusEnum,
+  WalletModuleSchema: () => WalletModuleSchema,
+  WalletOwnerSchema: () => WalletOwnerSchema,
+  WalletSchema: () => WalletSchema,
+  toNumber: () => toNumber
+});
+import { z } from "zod";
+var address = z.string();
+var nullableNumber = z.union([z.number(), z.string()]).nullable().optional();
+var WalletSchema = z.object({
+  address,
+  name: z.string().nullable().optional(),
+  threshold: z.number(),
+  owner_count: z.number(),
+  created_at_block: z.union([z.number(), z.string()]),
+  created_at_tx: z.string(),
+  min_execution_delay: z.number().nullable().optional(),
+  created_at: z.string().nullable().optional(),
+  updated_at: z.string().nullable().optional()
+});
+var WalletOwnerSchema = z.object({
+  wallet_address: address,
+  owner_address: address,
+  added_at_block: z.union([z.number(), z.string()]),
+  added_at_tx: z.string(),
+  removed_at_block: nullableNumber,
+  removed_at_tx: z.string().nullable().optional(),
+  is_active: z.boolean()
+});
+var TransactionStatusEnum = z.enum([
+  "pending",
+  "executed",
+  "cancelled",
+  "expired",
+  "failed"
+]);
+var TransactionSchema = z.object({
+  wallet_address: address,
+  tx_hash: z.string(),
+  to_address: address,
+  value: z.string(),
+  data: z.string().nullable().optional(),
+  transaction_type: z.string(),
+  decoded_params: z.unknown().nullable().optional(),
+  status: TransactionStatusEnum,
+  confirmation_count: z.number().nullable().optional(),
+  submitted_by: address,
+  submitted_at_block: z.union([z.number(), z.string()]),
+  submitted_at_tx: z.string(),
+  executed_at_block: nullableNumber,
+  executed_at_tx: z.string().nullable().optional(),
+  executed_by: z.string().nullable().optional(),
+  cancelled_at_block: nullableNumber,
+  cancelled_at_tx: z.string().nullable().optional(),
+  expiration: z.union([z.number(), z.string()]).nullable().optional(),
+  execution_delay: z.number().nullable().optional(),
+  approved_at: z.union([z.number(), z.string()]).nullable().optional(),
+  executable_after: z.union([z.number(), z.string()]).nullable().optional(),
+  is_expired: z.boolean().nullable().optional(),
+  failed_return_data: z.string().nullable().optional(),
+  created_at: z.string().nullable().optional(),
+  updated_at: z.string().nullable().optional()
+});
+var ConfirmationSchema = z.object({
+  wallet_address: address,
+  tx_hash: z.string(),
+  owner_address: address,
+  confirmed_at_block: z.union([z.number(), z.string()]),
+  confirmed_at_tx: z.string(),
+  revoked_at_block: nullableNumber,
+  revoked_at_tx: z.string().nullable().optional(),
+  is_active: z.boolean()
+});
+var WalletModuleSchema = z.object({
+  wallet_address: address,
+  module_address: address,
+  enabled_at_block: z.union([z.number(), z.string()]),
+  enabled_at_tx: z.string(),
+  disabled_at_block: nullableNumber,
+  disabled_at_tx: z.string().nullable().optional(),
+  is_active: z.boolean()
+});
+var DelegatecallTargetSchema = z.object({
+  wallet_address: address,
+  target_address: address,
+  added_at_block: z.union([z.number(), z.string()]),
+  added_at_tx: z.string(),
+  removed_at_block: nullableNumber,
+  removed_at_tx: z.string().nullable().optional(),
+  is_active: z.boolean()
+});
+var DepositSchema = z.object({
+  wallet_address: address,
+  sender_address: address,
+  amount: z.string(),
+  deposited_at_block: z.union([z.number(), z.string()]),
+  deposited_at_tx: z.string(),
+  created_at: z.string().nullable().optional()
+});
+var TokenSchema = z.object({
+  address,
+  standard: z.enum(["ERC20", "ERC721", "ERC1155"]),
+  symbol: z.string(),
+  name: z.string(),
+  decimals: z.number(),
+  discovered_at_block: nullableNumber,
+  discovered_via: z.string().nullable().optional()
+});
+var TokenTransferSchema = z.object({
+  token_address: address,
+  wallet_address: address,
+  from_address: address,
+  to_address: address,
+  value: z.string(),
+  token_id: z.string().nullable().optional(),
+  batch_index: z.number().nullable().optional(),
+  direction: z.enum(["inflow", "outflow"]),
+  block_number: z.union([z.number(), z.string()]),
+  transaction_hash: z.string(),
+  log_index: z.number()
+});
+var SignedMessageSchema = z.object({
+  wallet_address: address,
+  msg_hash: z.string(),
+  data: z.string().nullable().optional(),
+  signed_at_block: z.union([z.number(), z.string()]),
+  signed_at_tx: z.string(),
+  unsigned_at_block: nullableNumber,
+  unsigned_at_tx: z.string().nullable().optional(),
+  is_active: z.boolean()
+});
+var IndexerStateSchema = z.object({
+  id: z.string(),
+  last_indexed_block: z.union([z.number(), z.string()]),
+  last_block_hash: z.string().nullable().optional(),
+  last_indexed_at: z.string().nullable().optional(),
+  is_syncing: z.boolean().nullable().optional()
+});
+var RecoveryConfigSchema = z.object({
+  wallet_address: address,
+  threshold: z.number(),
+  recovery_period: z.union([z.number(), z.string()]),
+  setup_at_block: z.union([z.number(), z.string()]),
+  setup_at_tx: z.string(),
+  is_active: z.boolean()
+});
+var RecoveryGuardianSchema = z.object({
+  wallet_address: address,
+  guardian_address: address,
+  added_at_block: z.union([z.number(), z.string()]),
+  added_at_tx: z.string(),
+  is_active: z.boolean()
+});
+var RecoverySchema = z.object({
+  wallet_address: address,
+  recovery_hash: z.string(),
+  new_owners: z.array(address),
+  new_threshold: z.number(),
+  initiator_address: address,
+  approval_count: z.number().nullable().optional(),
+  required_threshold: z.number(),
+  execution_time: z.union([z.number(), z.string()]),
+  status: z.enum(["pending", "executed", "cancelled", "invalidated", "expired"]),
+  initiated_at_block: z.union([z.number(), z.string()]),
+  initiated_at_tx: z.string(),
+  expiration: z.union([z.number(), z.string()]).nullable().optional()
+});
+var RecoveryApprovalSchema = z.object({
+  wallet_address: address,
+  recovery_hash: z.string(),
+  guardian_address: address,
+  approved_at_block: z.union([z.number(), z.string()]),
+  approved_at_tx: z.string(),
+  is_active: z.boolean()
+});
+function toNumber(value, fallback = 0) {
+  if (value === null || value === void 0) return fallback;
+  const n = typeof value === "string" ? Number(value) : value;
+  return Number.isFinite(n) ? n : fallback;
+}
+
+// src/indexer/client.ts
+var SDK_VERSION = "0.1.0";
+var IndexerClient = class {
+  config;
+  client;
+  healthCache = null;
+  inflightHealth = null;
+  /** Health results are reused for this long to keep read paths cheap. */
+  healthCacheMs;
+  constructor(config, options = {}) {
+    this.config = config;
+    this.healthCacheMs = options.healthCacheMs ?? 5e3;
+    this.client = createClient(config.url, config.anonKey, {
+      db: { schema: config.schema },
+      auth: { persistSession: false, autoRefreshToken: false },
+      global: { headers: { "x-client-info": `quaivault-sdk/${SDK_VERSION}` } }
+    });
+  }
+  /** Raw Supabase client, for queries the SDK does not wrap. */
+  get raw() {
+    return this.client;
+  }
+  from(table) {
+    return this.client.from(table);
+  }
+  /**
+   * Run a query, parse each row, and surface failures as `IndexerQueryError`.
+   *
+   * No retry wrapper here on purpose. `postgrest-js` already retries GET/HEAD/OPTIONS
+   * internally (3 attempts, retryable statuses and fetch errors, honouring
+   * `Retry-After`), and it reports failures as a resolved `{ error }` value rather
+   * than a rejection — so an outer `withRetry` would be dead code that silently
+   * multiplied attempts if it were ever made to work. Chain reads, which do reject,
+   * are retried in `src/chain/retry.ts`.
+   */
+  async select(table, schema, build) {
+    const { data, error } = await build(this.client.from(table));
+    if (error) {
+      throw new IndexerQueryError(`Indexer query on "${table}" failed: ${error.message}`, error);
+    }
+    return (data ?? []).map((row) => schema.parse(row));
+  }
+  /** Single-row variant. Returns null for PostgREST's "no rows" code. */
+  async selectOne(table, schema, build) {
+    const { data, error } = await build(this.client.from(table));
+    if (error) {
+      if (error.code === "PGRST116") return null;
+      throw new IndexerQueryError(`Indexer query on "${table}" failed: ${error.message}`, error);
+    }
+    return data === null ? null : schema.parse(data);
+  }
+  /** The indexer's sync head, straight from the `indexer_state` table. */
+  async state() {
+    const row = await this.selectOne(
+      "indexer_state",
+      IndexerStateSchema,
+      (q) => q.select("*").eq("id", "main").single()
+    );
+    if (!row) return null;
+    return {
+      lastIndexedBlock: toNumber(row.last_indexed_block),
+      isSyncing: row.is_syncing ?? false
+    };
+  }
+  /**
+   * Liveness and lag. Prefers the HTTP health endpoint (which knows the chain head)
+   * and falls back to the `indexer_state` table when it is unreachable.
+   */
+  async health(force = false) {
+    const now = Date.now();
+    if (!force && this.healthCache && now - this.healthCache.at < this.healthCacheMs) {
+      return this.healthCache.value;
+    }
+    if (this.inflightHealth) return this.inflightHealth;
+    this.inflightHealth = this.probeHealth().then((value) => {
+      this.healthCache = { value, at: Date.now() };
+      return value;
+    }).finally(() => {
+      this.inflightHealth = null;
+    });
+    return this.inflightHealth;
+  }
+  /**
+   * Block until the indexer has processed `blockNumber`.
+   *
+   * Closes the write-then-read race: a transaction confirmed at block N is not
+   * queryable until the indexer reaches N, so `propose()` immediately followed by
+   * `pendingTransactions()` will silently miss it. Await this in between.
+   *
+   * Resolves immediately when the head is already at or past the target.
+   */
+  async waitForBlock(blockNumber, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 6e4;
+    const pollIntervalMs = options.pollIntervalMs ?? 1500;
+    const deadline = Date.now() + timeoutMs;
+    for (; ; ) {
+      if (options.signal?.aborted) throw new Error("Aborted");
+      const state = await this.state();
+      const head = state?.lastIndexedBlock ?? 0;
+      if (head >= blockNumber) return { reached: true, lastIndexedBlock: head };
+      if (Date.now() + pollIntervalMs > deadline) {
+        return { reached: false, lastIndexedBlock: head };
+      }
+      await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    }
+  }
+  async probeHealth() {
+    if (this.config.healthUrl) {
+      try {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 5e3);
+        const res = await fetch(new URL("/health", this.config.healthUrl), {
+          signal: controller.signal
+        }).finally(() => clearTimeout(timer));
+        const body = await res.json();
+        const d = body.details ?? {};
+        return {
+          available: res.ok && body.status === "healthy",
+          lastIndexedBlock: d.lastIndexedBlock ?? 0,
+          chainHead: d.currentBlock,
+          blocksBehind: d.blocksBehind,
+          isSyncing: d.isSyncing ?? false,
+          ...res.ok ? {} : { error: `health endpoint returned ${res.status}` }
+        };
+      } catch {
+      }
+    }
+    try {
+      const state = await this.state();
+      if (!state) {
+        return { available: false, lastIndexedBlock: 0, isSyncing: false, error: "no indexer_state row" };
+      }
+      return {
+        available: true,
+        lastIndexedBlock: state.lastIndexedBlock,
+        isSyncing: state.isSyncing
+      };
+    } catch (err) {
+      return {
+        available: false,
+        lastIndexedBlock: 0,
+        isSyncing: false,
+        error: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+};
+
+// src/indexer/queries.ts
+var DEFAULT_LIMIT = 50;
+var MAX_LIMIT = 200;
+function lower(address2) {
+  return address2.toLowerCase();
+}
+function bounds(options = {}) {
+  const limit = Math.min(Math.max(options.limit ?? DEFAULT_LIMIT, 1), MAX_LIMIT);
+  const offset = Math.max(options.offset ?? 0, 0);
+  return { limit, offset };
+}
+var IndexerQueries = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  // ---- wallets -------------------------------------------------------------
+  async wallet(address2) {
+    return this.client.selectOne(
+      "wallets",
+      WalletSchema,
+      (q) => q.select("*").eq("address", lower(address2)).single()
+    );
+  }
+  /** Active owner addresses, lowercased as stored. */
+  async owners(address2) {
+    const rows = await this.client.select(
+      "wallet_owners",
+      WalletOwnerSchema,
+      (q) => q.select("*").eq("wallet_address", lower(address2)).eq("is_active", true)
+    );
+    return rows.map((r) => r.owner_address);
+  }
+  async vaultsForOwner(owner, options = {}) {
+    const { limit, offset } = bounds(options);
+    const { data, error } = await this.client.from("wallet_owners").select("wallet_address, wallets (*)").eq("owner_address", lower(owner)).eq("is_active", true).range(offset, offset + limit - 1);
+    if (error) throw new IndexerQueryError(`Indexer query failed: ${error.message}`, error);
+    return extractJoined(data, WalletSchema);
+  }
+  async vaultsForGuardian(guardian, options = {}) {
+    const { limit, offset } = bounds(options);
+    const { data, error } = await this.client.from("social_recovery_guardians").select("wallet_address, wallets (*)").eq("guardian_address", lower(guardian)).eq("is_active", true).range(offset, offset + limit - 1);
+    if (error) throw new IndexerQueryError(`Indexer query failed: ${error.message}`, error);
+    return extractJoined(data, WalletSchema);
+  }
+  // ---- transactions --------------------------------------------------------
+  async pendingTransactions(vault2, options = {}) {
+    const { limit, offset } = bounds(options);
+    return this.client.select(
+      "transactions",
+      TransactionSchema,
+      (q) => q.select("*").eq("wallet_address", lower(vault2)).eq("status", "pending").order("submitted_at_block", { ascending: false }).range(offset, offset + limit - 1)
+    );
+  }
+  async transaction(vault2, txHash) {
+    return this.client.selectOne(
+      "transactions",
+      TransactionSchema,
+      (q) => q.select("*").eq("wallet_address", lower(vault2)).eq("tx_hash", txHash.toLowerCase()).single()
+    );
+  }
+  async transactionHistory(vault2, options = {}) {
+    const { limit, offset } = bounds(options);
+    const statuses = options.status ?? ["executed", "cancelled", "expired", "failed"];
+    const { data, error, count } = await this.client.from("transactions").select("*", { count: "exact" }).eq("wallet_address", lower(vault2)).in("status", statuses).order("submitted_at_block", { ascending: false }).range(offset, offset + limit - 1);
+    if (error) throw new IndexerQueryError(`Indexer query failed: ${error.message}`, error);
+    const rows = (data ?? []).map((r) => TransactionSchema.parse(r));
+    const total = count ?? rows.length;
+    return { data: rows, total, hasMore: offset + rows.length < total };
+  }
+  /** All confirmations for one transaction, including revoked ones. */
+  async confirmations(vault2, txHash) {
+    return this.client.select(
+      "confirmations",
+      ConfirmationSchema,
+      (q) => q.select("*").eq("wallet_address", lower(vault2)).eq("tx_hash", txHash.toLowerCase()).order("confirmed_at_block", { ascending: true })
+    );
+  }
+  /**
+   * Active confirmations for many transactions in one round trip.
+   *
+   * "Active" here means not revoked. It does NOT mean the confirming address is
+   * still an owner — the indexer does not deactivate confirmations when an owner is
+   * removed, while the contract invalidates them via approval epochs. Callers must
+   * intersect with the active owner set; `Vault` does this for you.
+   */
+  async activeConfirmationsBatch(vault2, txHashes) {
+    const result = /* @__PURE__ */ new Map();
+    for (const hash of txHashes) result.set(hash.toLowerCase(), []);
+    if (txHashes.length === 0) return result;
+    const rows = await this.client.select(
+      "confirmations",
+      ConfirmationSchema,
+      (q) => q.select("*").eq("wallet_address", lower(vault2)).in(
+        "tx_hash",
+        txHashes.map((h) => h.toLowerCase())
+      ).eq("is_active", true)
+    );
+    for (const row of rows) {
+      const key = row.tx_hash.toLowerCase();
+      const list = result.get(key);
+      if (list) list.push(row);
+      else result.set(key, [row]);
+    }
+    return result;
+  }
+  // ---- modules and delegatecall --------------------------------------------
+  async modules(vault2) {
+    const rows = await this.client.select(
+      "wallet_modules",
+      WalletModuleSchema,
+      (q) => q.select("*").eq("wallet_address", lower(vault2)).eq("is_active", true)
+    );
+    return rows.map((r) => r.module_address);
+  }
+  async delegatecallTargets(vault2) {
+    const rows = await this.client.select(
+      "wallet_delegatecall_targets",
+      DelegatecallTargetSchema,
+      (q) => q.select("*").eq("wallet_address", lower(vault2)).eq("is_active", true)
+    );
+    return rows.map((r) => r.target_address);
+  }
+  // ---- value movement ------------------------------------------------------
+  async deposits(vault2, options = {}) {
+    const { limit, offset } = bounds(options);
+    const { data, error, count } = await this.client.from("deposits").select("*", { count: "exact" }).eq("wallet_address", lower(vault2)).order("deposited_at_block", { ascending: false }).range(offset, offset + limit - 1);
+    if (error) throw new IndexerQueryError(`Indexer query failed: ${error.message}`, error);
+    const rows = (data ?? []).map((r) => DepositSchema.parse(r));
+    const total = count ?? rows.length;
+    return { data: rows, total, hasMore: offset + rows.length < total };
+  }
+  async tokenTransfers(vault2, options = {}) {
+    const { limit, offset } = bounds(options);
+    const { data, error, count } = await this.client.from("token_transfers").select("*", { count: "exact" }).eq("wallet_address", lower(vault2)).order("block_number", { ascending: false }).range(offset, offset + limit - 1);
+    if (error) throw new IndexerQueryError(`Indexer query failed: ${error.message}`, error);
+    const rows = (data ?? []).map((r) => TokenTransferSchema.parse(r));
+    const total = count ?? rows.length;
+    return { data: rows, total, hasMore: offset + rows.length < total };
+  }
+  async tokens(addresses) {
+    if (addresses.length === 0) return [];
+    return this.client.select(
+      "tokens",
+      TokenSchema,
+      (q) => q.select("*").in("address", addresses.map(lower))
+    );
+  }
+  async signedMessages(vault2) {
+    return this.client.select(
+      "signed_messages",
+      SignedMessageSchema,
+      (q) => q.select("*").eq("wallet_address", lower(vault2)).eq("is_active", true)
+    );
+  }
+  // ---- social recovery -----------------------------------------------------
+  async recoveryConfig(vault2) {
+    const config = await this.client.selectOne(
+      "social_recovery_configs",
+      RecoveryConfigSchema,
+      (q) => q.select("*").eq("wallet_address", lower(vault2)).eq("is_active", true).single()
+    );
+    if (!config) return null;
+    const guardians = await this.client.select(
+      "social_recovery_guardians",
+      RecoveryGuardianSchema,
+      (q) => q.select("*").eq("wallet_address", lower(vault2)).eq("is_active", true)
+    );
+    return {
+      threshold: config.threshold,
+      recoveryPeriod: Number(config.recovery_period),
+      guardians: guardians.map((g) => g.guardian_address)
+    };
+  }
+  async pendingRecoveries(vault2) {
+    return this.client.select(
+      "social_recoveries",
+      RecoverySchema,
+      (q) => q.select("*").eq("wallet_address", lower(vault2)).eq("status", "pending")
+    );
+  }
+  async recoveryHistory(vault2, options = {}) {
+    const { limit, offset } = bounds(options);
+    return this.client.select(
+      "social_recoveries",
+      RecoverySchema,
+      (q) => q.select("*").eq("wallet_address", lower(vault2)).order("initiated_at_block", { ascending: false }).range(offset, offset + limit - 1)
+    );
+  }
+  async recoveryApprovals(vault2, recoveryHash) {
+    return this.client.select(
+      "social_recovery_approvals",
+      RecoveryApprovalSchema,
+      (q) => q.select("*").eq("wallet_address", lower(vault2)).eq("recovery_hash", recoveryHash.toLowerCase()).eq("is_active", true)
+    );
+  }
+};
+function extractJoined(data, schema) {
+  const out = [];
+  for (const row of data ?? []) {
+    const embedded = row.wallets;
+    if (!embedded) continue;
+    const candidates = Array.isArray(embedded) ? embedded : [embedded];
+    for (const candidate of candidates) {
+      try {
+        out.push(schema.parse(candidate));
+      } catch {
+        continue;
+      }
+    }
+  }
+  return out;
+}
+
+// src/vault.ts
+import { formatQuai as formatQuai2, getAddress as getAddress5, getZoneForAddress as getZoneForAddress3, toShard } from "quais";
+
+// src/recovery.ts
+import { getAddress as getAddress3 } from "quais";
+
+// src/chain/recovery-contract.ts
+var RecoveryContract = class {
+  constructor(contract, retry = {}) {
+    this.contract = contract;
+    this.retry = retry;
+  }
+  contract;
+  retry;
+  fn(signature) {
+    return this.contract.getFunction(signature);
+  }
+  /**
+   * Reads retry transient RPC failures (see {@link withRetry}); writes never do,
+   * because a resubmit that looks like a timeout may already be in the mempool.
+   */
+  read(signature, ...args) {
+    return withRetry(() => this.fn(signature)(...args), this.retry);
+  }
+  get interface() {
+    return this.contract.interface;
+  }
+  // ---- reads ---------------------------------------------------------------
+  getRecoveryConfig(vault2) {
+    return this.read("getRecoveryConfig(address)", vault2);
+  }
+  getRecovery(vault2, recoveryHash) {
+    return this.read("getRecovery(address,bytes32)", vault2, recoveryHash);
+  }
+  isGuardian(vault2, guardian) {
+    return this.read("isGuardian(address,address)", vault2, guardian);
+  }
+  getPendingRecoveryHashes(vault2) {
+    return this.read("getPendingRecoveryHashes(address)", vault2);
+  }
+  hasPendingRecoveries(vault2) {
+    return this.read("hasPendingRecoveries(address)", vault2);
+  }
+  recoveryApprovals(vault2, recoveryHash, guardian) {
+    return this.read(
+      "recoveryApprovals(address,bytes32,address)",
+      vault2,
+      recoveryHash,
+      guardian
+    );
+  }
+  recoveryNonces(vault2) {
+    return this.read("recoveryNonces(address)", vault2);
+  }
+  maxGuardians() {
+    return this.read("MAX_GUARDIANS()");
+  }
+  /** Hash for an explicit nonce. Use {@link predictNextRecoveryHash} for the next one. */
+  getRecoveryHash(vault2, newOwners, newThreshold, nonce) {
+    return this.read(
+      "getRecoveryHash(address,address[],uint256,uint256)",
+      vault2,
+      newOwners,
+      newThreshold,
+      nonce
+    );
+  }
+  /** Hash the next `initiateRecovery` would produce, at the current nonce. */
+  predictNextRecoveryHash(vault2, newOwners, newThreshold) {
+    return this.read(
+      "predictNextRecoveryHash(address,address[],uint256)",
+      vault2,
+      newOwners,
+      newThreshold
+    );
+  }
+  // ---- writes --------------------------------------------------------------
+  initiateRecovery(vault2, newOwners, newThreshold) {
+    return this.fn("initiateRecovery(address,address[],uint256)")(
+      vault2,
+      newOwners,
+      newThreshold
+    );
+  }
+  approveRecovery(vault2, recoveryHash) {
+    return this.fn("approveRecovery(address,bytes32)")(
+      vault2,
+      recoveryHash
+    );
+  }
+  revokeRecoveryApproval(vault2, recoveryHash) {
+    return this.fn("revokeRecoveryApproval(address,bytes32)")(
+      vault2,
+      recoveryHash
+    );
+  }
+  executeRecovery(vault2, recoveryHash) {
+    return this.fn("executeRecovery(address,bytes32)")(
+      vault2,
+      recoveryHash
+    );
+  }
+  cancelRecovery(vault2, recoveryHash) {
+    return this.fn("cancelRecovery(address,bytes32)")(
+      vault2,
+      recoveryHash
+    );
+  }
+  expireRecovery(vault2, recoveryHash) {
+    return this.fn("expireRecovery(address,bytes32)")(
+      vault2,
+      recoveryHash
+    );
+  }
+};
+
+// src/lifecycle/status.ts
+function nowSeconds() {
+  return Math.floor(Date.now() / 1e3);
+}
+function executableAfterOf(approvedAt, executionDelay) {
+  return approvedAt > 0 ? approvedAt + executionDelay : 0;
+}
+function deriveStatus(state, at = nowSeconds()) {
+  if (state.failed) return "failed";
+  if (state.executed) return "executed";
+  if (state.cancelled) return state.isExpired ? "expired" : "cancelled";
+  if (state.expiration > 0 && at > state.expiration) return "expired";
+  if (state.approvalCount < state.threshold) return "pending";
+  const executableAfter = executableAfterOf(state.approvedAt, state.executionDelay);
+  if (state.executionDelay > 0 && (state.approvedAt === 0 || at < executableAfter)) {
+    return "timelocked";
+  }
+  return "ready";
+}
+function isTerminal(status) {
+  return status === "executed" || status === "failed" || status === "cancelled" || status === "expired";
+}
+function deriveRecoveryStatus(state, at = nowSeconds()) {
+  if (state.executed) return "executed";
+  if (state.expiration > 0 && at > state.expiration) return "expired";
+  if (state.approvalCount < state.requiredThreshold) return "pending";
+  if (at < state.executionTime) return "timelocked";
+  return "ready";
+}
+
+// src/recovery.ts
+var SENTINEL = "0x0000000000000000000000000000000000000001";
+var ZERO = "0x0000000000000000000000000000000000000000";
+var RecoveryModule = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  /** The module address, or a typed error naming the variable to set. */
+  get address() {
+    if (!this.ctx.moduleAddress) {
+      throw new ValidationError(
+        "No SocialRecoveryModule address is configured for this network.",
+        "Set QUAIVAULT_SOCIAL_RECOVERY_MODULE or pass contracts.socialRecovery."
+      );
+    }
+    return this.ctx.moduleAddress;
+  }
+  contract(write = false) {
+    return new RecoveryContract(this.ctx.connection.socialRecovery(this.address, write), this.ctx.connection.retry);
+  }
+  get vault() {
+    return this.ctx.vaultAddress;
+  }
+  // =========================================================================
+  // Reads
+  // =========================================================================
+  /** Whether the module is currently enabled on the vault. */
+  async isEnabled() {
+    if (!this.ctx.moduleAddress) return false;
+    const vault2 = this.ctx.connection.vault(this.vault);
+    return vault2.getFunction("isModuleEnabled(address)")(this.address);
+  }
+  async config() {
+    const raw = await this.contract().getRecoveryConfig(this.vault);
+    const guardians = Array.from(raw.guardians ?? []).map((g) => getAddress3(String(g)));
+    return {
+      guardians,
+      threshold: Number(raw.threshold ?? 0),
+      recoveryPeriod: Number(raw.recoveryPeriod ?? 0),
+      configured: guardians.length > 0
+    };
+  }
+  async isGuardian(address2) {
+    return this.contract().isGuardian(this.vault, getAddress3(address2));
+  }
+  /** Hashes of recoveries the module still tracks as pending. */
+  async pendingHashes() {
+    return (await this.contract().getPendingRecoveryHashes(this.vault)).map((h) => String(h));
+  }
+  async hasPending() {
+    return this.contract().hasPendingRecoveries(this.vault);
+  }
+  /**
+   * One recovery request, read from chain.
+   *
+   * Throws `NotFoundError` for a hash that was never initiated *or* was cancelled —
+   * `cancelRecovery` deletes the struct, so the two are indistinguishable on chain.
+   * Use {@link history} for cancelled recoveries.
+   */
+  async get(recoveryHash) {
+    const hash = normalizeTxHash(recoveryHash, "recovery hash");
+    const raw = await this.contract().getRecovery(this.vault, hash);
+    if (Number(raw.executionTime ?? 0) === 0) {
+      throw new NotFoundError(
+        `No active recovery ${hash} on vault ${this.vault}. It was never initiated, or it was cancelled (cancellation deletes the on-chain record).`
+      );
+    }
+    return this.buildFromChain(hash, raw);
+  }
+  /** Every recovery the module still tracks as pending, hydrated. */
+  async pending() {
+    const hashes = await this.pendingHashes();
+    const contract = this.contract();
+    const results = await Promise.all(
+      hashes.map(async (hash) => {
+        const raw = await contract.getRecovery(this.vault, hash);
+        if (Number(raw.executionTime ?? 0) === 0) return null;
+        return this.buildFromChain(hash, raw);
+      })
+    );
+    return results.filter((r) => r !== null);
+  }
+  /**
+   * Full recovery history including executed, cancelled and expired requests.
+   * Indexer-only — the chain retains no record of cancelled recoveries.
+   */
+  async history(options = {}) {
+    const queries = this.ctx.queries;
+    if (!queries) return [];
+    const rows = await queries.recoveryHistory(this.vault, options);
+    return rows.map((row) => ({
+      hash: row.recovery_hash,
+      vault: this.vault,
+      newOwners: row.new_owners.map((o) => getAddress3(o)),
+      newThreshold: row.new_threshold,
+      approvalCount: row.approval_count ?? 0,
+      requiredThreshold: row.required_threshold,
+      executionTime: Number(row.execution_time),
+      expiration: Number(row.expiration ?? 0),
+      // Trust the indexer only for states it alone can observe (cancelled /
+      // invalidated); derive everything else, since an un-cleaned recovery stays
+      // 'pending' in the database long after its deadline.
+      status: row.status === "cancelled" || row.status === "invalidated" ? "cancelled" : deriveRecoveryStatus({
+        executed: row.status === "executed",
+        approvalCount: row.approval_count ?? 0,
+        requiredThreshold: row.required_threshold,
+        executionTime: Number(row.execution_time),
+        expiration: Number(row.expiration ?? 0)
+      }),
+      executed: row.status === "executed",
+      initiator: getAddress3(row.initiator_address),
+      source: "indexer"
+    }));
+  }
+  /** Guardians who have an active approval on a recovery. */
+  async approvals(recoveryHash) {
+    const hash = normalizeTxHash(recoveryHash, "recovery hash");
+    const { guardians } = await this.config();
+    const contract = this.contract();
+    const flags = await Promise.all(
+      guardians.map((g) => contract.recoveryApprovals(this.vault, hash, g))
+    );
+    return guardians.filter((_, i) => flags[i] === true);
+  }
+  /** Hash the next `initiate` with these parameters would produce. */
+  async predictHash(newOwners, newThreshold) {
+    return this.contract().predictNextRecoveryHash(
+      this.vault,
+      newOwners.map((o) => getAddress3(o)),
+      newThreshold
+    );
+  }
+  // =========================================================================
+  // Writes
+  // =========================================================================
+  /**
+   * Initiate a recovery. Guardians only.
+   *
+   * Returns the recovery hash, read from the `RecoveryInitiated` event — the function's
+   * return value is not recoverable from a receipt.
+   */
+  async initiate(params) {
+    const newOwners = params.newOwners.map((o, i) => assertQuaiAddress(o, `newOwners[${i}]`));
+    this.validateNewOwners(newOwners, params.newThreshold);
+    const caller = await this.ctx.connection.address();
+    await this.assertEnabled("Initiating a recovery");
+    const config = await this.config();
+    if (!config.configured) {
+      throw new PreconditionError("This vault has no social recovery configuration.", {
+        remediation: "Owners must first propose and execute setupRecovery via vault.propose.setupRecovery()."
+      });
+    }
+    if (!await this.isGuardian(caller)) {
+      throw new PreconditionError(`${caller} is not a guardian of this vault.`);
+    }
+    const contract = this.contract(true);
+    try {
+      const sent = await contract.initiateRecovery(this.vault, newOwners, params.newThreshold);
+      const receipt = await sent.wait();
+      if (!receipt || receipt.status === 0) {
+        throw new RevertError("The recovery initiation reverted.");
+      }
+      const recoveryHash = this.extractRecoveryHash(receipt);
+      if (!recoveryHash) {
+        throw new RevertError(
+          "The recovery was initiated but no RecoveryInitiated event was found."
+        );
+      }
+      return { recoveryHash, chainTxHash: receipt.hash ?? receipt.transactionHash ?? "" };
+    } catch (err) {
+      throw this.toRevert(err, "Initiating the recovery failed");
+    }
+  }
+  /** Approve a recovery. Guardians only. */
+  async approve(recoveryHash) {
+    const hash = normalizeTxHash(recoveryHash, "recovery hash");
+    const caller = await this.ctx.connection.address();
+    await this.assertEnabled("Approving a recovery");
+    if (!await this.isGuardian(caller)) {
+      throw new PreconditionError(`${caller} is not a guardian of this vault.`);
+    }
+    const request = await this.get(hash);
+    this.assertLive(request);
+    if (await this.contract().recoveryApprovals(this.vault, hash, caller)) {
+      throw new PreconditionError("You have already approved this recovery.");
+    }
+    return this.send((c) => c.approveRecovery(this.vault, hash), "Approving the recovery failed");
+  }
+  /** Withdraw a guardian approval before the recovery executes. */
+  async revokeApproval(recoveryHash) {
+    const hash = normalizeTxHash(recoveryHash, "recovery hash");
+    const caller = await this.ctx.connection.address();
+    if (!await this.isGuardian(caller)) {
+      throw new PreconditionError(`${caller} is not a guardian of this vault.`);
+    }
+    if (!await this.contract().recoveryApprovals(this.vault, hash, caller)) {
+      throw new PreconditionError("You have no active approval on this recovery to revoke.");
+    }
+    return this.send(
+      (c) => c.revokeRecoveryApproval(this.vault, hash),
+      "Revoking the recovery approval failed"
+    );
+  }
+  /**
+   * Execute a recovery, replacing the vault's owner set. Permissionless once the
+   * guardian threshold is met and the recovery period has elapsed.
+   */
+  async execute(recoveryHash) {
+    const hash = normalizeTxHash(recoveryHash, "recovery hash");
+    await this.assertEnabled("Executing a recovery");
+    const request = await this.get(hash);
+    this.assertLive(request);
+    if (request.approvalCount < request.requiredThreshold) {
+      throw new PreconditionError(
+        `Not enough guardian approvals: ${request.approvalCount} of ${request.requiredThreshold}.`
+      );
+    }
+    const now = nowSeconds();
+    if (now < request.executionTime) {
+      throw new PreconditionError(
+        `The recovery period has not elapsed. Executable after ${new Date(request.executionTime * 1e3).toISOString()}.`,
+        { retryableAt: request.executionTime }
+      );
+    }
+    const vault2 = this.ctx.connection.vault(this.vault);
+    const currentOwners = await vault2.getFunction("getOwners()")();
+    const current = new Set(Array.from(currentOwners).map((o) => String(o).toLowerCase()));
+    const overlap = request.newOwners.filter((o) => current.has(o.toLowerCase())).length;
+    const peak = current.size + request.newOwners.length - overlap;
+    if (peak > 20) {
+      throw new PreconditionError(
+        `Executing this recovery would transiently hold ${peak} owners, above the 20-owner maximum \u2014 new owners are added before old ones are removed.`,
+        {
+          remediation: "Run a recovery that retains at least one existing owner, then a second recovery to replace it."
+        }
+      );
+    }
+    return this.send((c) => c.executeRecovery(this.vault, hash), "Executing the recovery failed");
+  }
+  /**
+   * Cancel a recovery. Callable by any current vault owner — this is the owners'
+   * defence against a hostile or mistaken guardian action.
+   */
+  async cancel(recoveryHash) {
+    const hash = normalizeTxHash(recoveryHash, "recovery hash");
+    const caller = await this.ctx.connection.address();
+    const vault2 = this.ctx.connection.vault(this.vault);
+    const isOwner = await vault2.getFunction("isOwner(address)")(caller);
+    if (!isOwner) {
+      throw new PreconditionError(
+        `Only a current owner of the vault can cancel a recovery. ${caller} is not one.`
+      );
+    }
+    return this.send((c) => c.cancelRecovery(this.vault, hash), "Cancelling the recovery failed");
+  }
+  /** Clean up a recovery past its deadline. Permissionless. */
+  async expire(recoveryHash) {
+    const hash = normalizeTxHash(recoveryHash, "recovery hash");
+    return this.send((c) => c.expireRecovery(this.vault, hash), "Expiring the recovery failed");
+  }
+  // =========================================================================
+  // Affordances
+  // =========================================================================
+  /** What `caller` may do to a recovery right now, and when blocked actions unlock. */
+  async affordances(recoveryHash, caller) {
+    const hash = normalizeTxHash(recoveryHash, "recovery hash");
+    const who = caller ?? await this.ctx.connection.addressOrNull();
+    if (!who) {
+      throw new ValidationError(
+        "affordances() needs a caller address when the client has no signer."
+      );
+    }
+    const address2 = getAddress3(who);
+    const [request, isGuardian, hasApproved, enabled, isOwner] = await Promise.all([
+      this.get(hash),
+      this.isGuardian(address2),
+      this.contract().recoveryApprovals(this.vault, hash, address2),
+      this.isEnabled(),
+      this.ctx.connection.vault(this.vault).getFunction("isOwner(address)")(address2)
+    ]);
+    const now = nowSeconds();
+    const terminal = request.status === "executed" || request.status === "cancelled";
+    const expired = now > request.expiration && request.expiration > 0;
+    const quorum = request.approvalCount >= request.requiredThreshold;
+    const out = [];
+    const blocked = (action, reason, blockedBy, availableAt) => ({
+      action,
+      allowed: false,
+      reason,
+      blockedBy,
+      ...availableAt !== void 0 ? { availableAt } : {}
+    });
+    if (terminal) out.push(blocked("approve", terminalReason(request), "terminal_state"));
+    else if (expired) out.push(blocked("approve", "The recovery has expired.", "expired"));
+    else if (!enabled) {
+      out.push(blocked("approve", "The recovery module is not enabled on this vault.", "module_disabled"));
+    } else if (!isGuardian) {
+      out.push(blocked("approve", "Only guardians can approve a recovery.", "not_guardian"));
+    } else if (hasApproved) {
+      out.push(blocked("approve", "You have already approved this recovery.", "already_approved"));
+    } else {
+      out.push({ action: "approve", allowed: true, reason: "You can approve this recovery." });
+    }
+    if (terminal) out.push(blocked("revokeApproval", terminalReason(request), "terminal_state"));
+    else if (!isGuardian) {
+      out.push(blocked("revokeApproval", "Only guardians can revoke a recovery approval.", "not_guardian"));
+    } else if (!hasApproved) {
+      out.push(blocked("revokeApproval", "You have no active approval to revoke.", "not_approved"));
+    } else {
+      out.push({ action: "revokeApproval", allowed: true, reason: "You can revoke your approval." });
+    }
+    if (terminal) out.push(blocked("execute", terminalReason(request), "terminal_state"));
+    else if (expired) out.push(blocked("execute", "The recovery has expired.", "expired"));
+    else if (!enabled) {
+      out.push(blocked("execute", "The recovery module is not enabled on this vault.", "module_disabled"));
+    } else if (!quorum) {
+      out.push(
+        blocked(
+          "execute",
+          `Needs ${request.requiredThreshold} guardian approvals, has ${request.approvalCount}.`,
+          "threshold"
+        )
+      );
+    } else if (now < request.executionTime) {
+      out.push(
+        blocked(
+          "execute",
+          `Recovery period ends ${new Date(request.executionTime * 1e3).toISOString()}.`,
+          "timelock",
+          request.executionTime
+        )
+      );
+    } else {
+      out.push({
+        action: "execute",
+        allowed: true,
+        reason: "This recovery is ready to execute and will replace the vault owner set."
+      });
+    }
+    if (terminal) out.push(blocked("cancel", terminalReason(request), "terminal_state"));
+    else if (!isOwner) {
+      out.push(blocked("cancel", "Only a current vault owner can cancel a recovery.", "not_owner"));
+    } else {
+      out.push({
+        action: "cancel",
+        allowed: true,
+        reason: "As a vault owner you can cancel this recovery."
+      });
+    }
+    if (terminal) out.push(blocked("expire", terminalReason(request), "terminal_state"));
+    else if (!expired) {
+      out.push(
+        blocked(
+          "expire",
+          `Not expired yet. Expires ${new Date(request.expiration * 1e3).toISOString()}.`,
+          "not_expired",
+          request.expiration + 1
+        )
+      );
+    } else {
+      out.push({
+        action: "expire",
+        allowed: true,
+        reason: "Past its deadline \u2014 anyone can clean it up, which also unblocks setupRecovery."
+      });
+    }
+    return out;
+  }
+  // =========================================================================
+  // Internals
+  // =========================================================================
+  buildFromChain(hash, raw) {
+    const executionTime = Number(raw.executionTime ?? 0);
+    const expiration = Number(raw.expiration ?? 0);
+    const approvalCount = Number(raw.approvalCount ?? 0);
+    const requiredThreshold = Number(raw.requiredThreshold ?? 0);
+    const executed = Boolean(raw.executed);
+    const status = deriveRecoveryStatus({
+      executed,
+      approvalCount,
+      requiredThreshold,
+      executionTime,
+      expiration
+    });
+    return {
+      hash,
+      vault: this.vault,
+      newOwners: Array.from(raw.newOwners ?? []).map((o) => getAddress3(String(o))),
+      newThreshold: Number(raw.newThreshold ?? 0),
+      approvalCount,
+      requiredThreshold,
+      executionTime,
+      expiration,
+      status,
+      executed,
+      source: "chain"
+    };
+  }
+  validateNewOwners(newOwners, newThreshold) {
+    if (newOwners.length === 0) throw new ValidationError("At least one new owner is required.");
+    const seen = /* @__PURE__ */ new Set();
+    for (const owner of newOwners) {
+      const key = owner.toLowerCase();
+      if (key === ZERO || key === SENTINEL) {
+        throw new ValidationError(
+          `New owner ${owner} is reserved \u2014 the zero address and the module sentinel 0x\u202601 are rejected.`
+        );
+      }
+      if (key === this.vault.toLowerCase()) {
+        throw new ValidationError("The vault cannot be an owner of itself.");
+      }
+      if (seen.has(key)) throw new ValidationError(`Duplicate new owner: ${owner}.`);
+      seen.add(key);
+    }
+    if (!Number.isInteger(newThreshold) || newThreshold < 1 || newThreshold > newOwners.length) {
+      throw new ValidationError(
+        `Invalid new threshold ${newThreshold}: must be between 1 and ${newOwners.length}.`
+      );
+    }
+  }
+  assertLive(request) {
+    if (request.executed) {
+      throw new PreconditionError("This recovery has already been executed.");
+    }
+    if (request.expiration > 0 && nowSeconds() > request.expiration) {
+      throw new PreconditionError("This recovery has expired.", {
+        remediation: "Call expire() to clean it up, then initiate a new recovery."
+      });
+    }
+  }
+  async assertEnabled(operation) {
+    if (!await this.isEnabled()) {
+      throw new PreconditionError(
+        `${operation} requires the SocialRecoveryModule to be enabled on this vault.`,
+        {
+          remediation: "Owners must propose and execute enableModule for the recovery module first."
+        }
+      );
+    }
+  }
+  async send(call, context) {
+    try {
+      const sent = await call(this.contract(true));
+      const receipt = await sent.wait();
+      if (!receipt || receipt.status === 0) throw new RevertError(`${context}: reverted.`);
+      return { chainTxHash: receipt.hash ?? receipt.transactionHash ?? "" };
+    } catch (err) {
+      throw this.toRevert(err, context);
+    }
+  }
+  extractRecoveryHash(receipt) {
+    const iface = this.contract().interface;
+    const target = this.address.toLowerCase();
+    for (const log of receipt.logs ?? []) {
+      if (log.address && log.address.toLowerCase() !== target) continue;
+      try {
+        const parsed = iface.parseLog({ topics: Array.from(log.topics), data: log.data });
+        if (parsed?.name === "RecoveryInitiated") {
+          const index = parsed.fragment.inputs.findIndex((i) => i.name === "recoveryHash");
+          const value = index >= 0 ? parsed.args[index] : void 0;
+          if (typeof value === "string") return value;
+        }
+      } catch {
+        continue;
+      }
+    }
+    return null;
+  }
+  toRevert(err, context) {
+    if (err instanceof RevertError || err instanceof PreconditionError) return err;
+    const decoded = decodeRevertFromError(err);
+    const base = err instanceof Error ? err.message : String(err);
+    return new RevertError(`${context}${decoded ? `: ${decoded.message}` : `: ${base}`}`, decoded, {
+      cause: err
+    });
+  }
+};
+function terminalReason(request) {
+  if (request.executed) return "This recovery has already been executed.";
+  if (request.status === "cancelled") return "This recovery was cancelled.";
+  return "This recovery is in a terminal state.";
+}
+
+// src/balances.ts
+import { Contract as Contract2, getAddress as getAddress4 } from "quais";
+async function loadBalances(connection, queries, vault2, options = {}) {
+  const verify = options.verify !== false;
+  const maxTokens = options.maxTokens ?? 50;
+  const transferScanLimit = options.transferScanLimit ?? 500;
+  const maxTokenIdChecks = options.maxTokenIdChecks ?? 100;
+  const address2 = getAddress4(vault2);
+  const native = BigInt(await connection.provider.getBalance(address2));
+  if (!queries) return { native, tokens: [] };
+  const transfers = await queries.tokenTransfers(address2, { limit: transferScanLimit });
+  const seen = /* @__PURE__ */ new Map();
+  for (const row of transfers.data) {
+    const key = row.token_address.toLowerCase();
+    const list = seen.get(key);
+    if (list) list.push(row);
+    else seen.set(key, [row]);
+  }
+  const allCandidates = Array.from(seen.keys());
+  const candidates = allCandidates.slice(0, maxTokens);
+  const truncated = {
+    ...transfers.hasMore ? { transfers: true } : {},
+    ...allCandidates.length > maxTokens ? { tokens: true } : {}
+  };
+  if (candidates.length === 0) {
+    return { native, tokens: [], ...Object.keys(truncated).length ? { truncated } : {} };
+  }
+  const metadata = await queries.tokens(candidates);
+  const byAddress = new Map(metadata.map((t) => [t.address.toLowerCase(), t]));
+  const balances = await Promise.all(
+    candidates.map(
+      (token2) => buildBalance(
+        connection,
+        address2,
+        token2,
+        byAddress.get(token2),
+        seen.get(token2) ?? [],
+        verify,
+        maxTokenIdChecks
+      )
+    )
+  );
+  return {
+    native,
+    // Drop dust and fully-exited positions so callers get a holdings view, not a history.
+    tokens: balances.filter((b) => b !== null && b.balance > 0n),
+    ...Object.keys(truncated).length ? { truncated } : {}
+  };
+}
+async function buildBalance(connection, vault2, token2, meta, transfers, verify, maxTokenIdChecks) {
+  const standard = meta?.standard ?? inferStandard(transfers);
+  const replayed = replayBalance(transfers, standard);
+  const base = {
+    token: getAddress4(token2),
+    standard,
+    symbol: meta?.symbol ?? "???",
+    name: meta?.name ?? "Unknown token",
+    decimals: meta?.decimals ?? (standard === "ERC20" ? 18 : 0),
+    balance: replayed.balance,
+    ...replayed.tokenIds.length > 0 ? { tokenIds: replayed.tokenIds } : {},
+    verified: false
+  };
+  if (!verify) return base;
+  try {
+    if (standard === "ERC20") {
+      const contract2 = new Contract2(token2, Erc20Abi, connection.provider);
+      const balance = await contract2.getFunction("balanceOf(address)")(vault2);
+      return { ...base, balance: BigInt(balance), verified: true };
+    }
+    if (standard === "ERC721") {
+      const contract2 = new Contract2(token2, Erc721Abi, connection.provider);
+      const count = await contract2.getFunction("balanceOf(address)")(vault2);
+      const owned = await filterOwned(contract2, vault2, replayed.tokenIds, maxTokenIdChecks);
+      return {
+        ...base,
+        balance: BigInt(count),
+        ...owned.length > 0 ? { tokenIds: owned } : {},
+        ...replayed.tokenIds.length > maxTokenIdChecks ? { tokenIdsTruncated: true } : {},
+        verified: true
+      };
+    }
+    const contract = new Contract2(token2, Erc1155Abi, connection.provider);
+    const ids = replayed.tokenIds;
+    if (ids.length === 0) return { ...base, verified: true };
+    const amounts = await contract.getFunction("balanceOfBatch(address[],uint256[])")(
+      ids.map(() => vault2),
+      ids
+    );
+    const held = [];
+    let total = 0n;
+    ids.forEach((id, i) => {
+      const amount = BigInt(amounts[i] ?? 0);
+      if (amount > 0n) {
+        held.push(id);
+        total += amount;
+      }
+    });
+    return { ...base, balance: total, ...held.length > 0 ? { tokenIds: held } : {}, verified: true };
+  } catch {
+    return base;
+  }
+}
+function replayBalance(transfers, standard) {
+  if (standard === "ERC20") {
+    let balance2 = 0n;
+    for (const t of transfers) {
+      const value = safeBigInt(t.value);
+      balance2 += t.direction === "inflow" ? value : -value;
+    }
+    return { balance: balance2 > 0n ? balance2 : 0n, tokenIds: [] };
+  }
+  const perId = /* @__PURE__ */ new Map();
+  const ordered = [...transfers].sort((a, b) => Number(a.block_number) - Number(b.block_number));
+  for (const t of ordered) {
+    const id = t.token_id ?? "0";
+    const amount = standard === "ERC721" ? 1n : safeBigInt(t.value);
+    const current = perId.get(id) ?? 0n;
+    perId.set(id, current + (t.direction === "inflow" ? amount : -amount));
+  }
+  const tokenIds = [];
+  let balance = 0n;
+  for (const [id, amount] of perId) {
+    if (amount > 0n) {
+      tokenIds.push(id);
+      balance += amount;
+    }
+  }
+  return { balance, tokenIds };
+}
+async function filterOwned(contract, vault2, ids, limit) {
+  if (ids.length === 0) return [];
+  const results = await Promise.all(
+    ids.slice(0, limit).map(async (id) => {
+      try {
+        const owner = await contract.getFunction("ownerOf(uint256)")(id);
+        return owner.toLowerCase() === vault2.toLowerCase() ? id : null;
+      } catch {
+        return null;
+      }
+    })
+  );
+  return results.filter((id) => id !== null);
+}
+function inferStandard(transfers) {
+  const withId = transfers.find((t) => t.token_id != null);
+  if (!withId) return "ERC20";
+  return transfers.some((t) => (t.batch_index ?? 0) > 0) ? "ERC1155" : "ERC721";
+}
+function safeBigInt(value) {
+  try {
+    return BigInt(value);
+  } catch {
+    return 0n;
+  }
+}
+
+// src/indexer/watch.ts
+import { isAddress as isAddress3 } from "quais";
+var TABLE_FOR = {
+  transactions: "transactions",
+  confirmations: "confirmations",
+  owners: "wallet_owners",
+  modules: "wallet_modules",
+  deposits: "deposits",
+  tokenTransfers: "token_transfers",
+  recoveries: "social_recoveries",
+  signedMessages: "signed_messages"
+};
+var DEFAULT_TOPICS = ["transactions", "confirmations", "owners"];
+function watchVault(client, vault2, handler, options = {}) {
+  if (!isAddress3(vault2)) {
+    throw new ValidationError(`Invalid vault address for subscription: "${vault2}".`);
+  }
+  const topics = options.topics ?? DEFAULT_TOPICS;
+  const address2 = vault2.toLowerCase();
+  const schema = client.config.schema;
+  const channel = client.raw.channel(`quaivault:${schema}:${address2}`);
+  for (const topic of topics) {
+    const table = TABLE_FOR[topic];
+    channel.on(
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      "postgres_changes",
+      {
+        event: "*",
+        schema,
+        table,
+        // Every watched table keys the vault on wallet_address.
+        filter: `wallet_address=eq.${address2}`
+      },
+      (payload) => {
+        handler({
+          topic,
+          table,
+          type: payload.eventType,
+          row: payload.new && Object.keys(payload.new).length > 0 ? payload.new : null,
+          previous: payload.old && Object.keys(payload.old).length > 0 ? payload.old : null
+        });
+      }
+    );
+  }
+  channel.subscribe((status, err) => {
+    options.onStatus?.(status, err instanceof Error ? err : void 0);
+  });
+  return {
+    topics,
+    async unsubscribe() {
+      await client.raw.removeChannel(channel);
+    }
+  };
+}
+
+// src/decode/index.ts
+import { formatQuai, getBytes as getBytes2 } from "quais";
+var SELF_CALL_ADMIN = /* @__PURE__ */ new Set([
+  "addOwner",
+  "removeOwner",
+  "changeThreshold",
+  "enableModule",
+  "disableModule",
+  "cancelByConsensus",
+  "setMinExecutionDelay",
+  "addDelegatecallTarget",
+  "removeDelegatecallTarget"
+]);
+var MESSAGE_SIGNING = /* @__PURE__ */ new Set(["signMessage", "unsignMessage"]);
+function short(address2) {
+  return address2.length > 12 ? `${address2.slice(0, 6)}\u2026${address2.slice(-4)}` : address2;
+}
+function formatDuration(seconds) {
+  if (seconds === 0) return "none";
+  const units = [
+    [86400, "day"],
+    [3600, "hour"],
+    [60, "minute"]
+  ];
+  for (const [size, label] of units) {
+    if (seconds >= size) {
+      const n = Math.floor(seconds / size);
+      return `${n} ${label}${n === 1 ? "" : "s"}`;
+    }
+  }
+  return `${seconds} seconds`;
+}
+function namedArgs(fragmentInputs, args) {
+  const out = {};
+  fragmentInputs.forEach((input, i) => {
+    out[input.name || `arg${i}`] = args[i];
+  });
+  return out;
+}
+function decodeCall(ctx) {
+  const { vault: vault2, to, value, data } = ctx;
+  const isSelfCall = to.toLowerCase() === vault2.toLowerCase();
+  const hasData = typeof data === "string" && data !== "0x" && data.length > 2;
+  if (!hasData) {
+    return {
+      kind: "transfer",
+      summary: `Transfer ${formatQuai(value)} QUAI to ${short(to)}`
+    };
+  }
+  if (isSelfCall) {
+    const parsed = tryParse(interfaces.vault, data);
+    if (parsed) {
+      const decoded = {
+        name: parsed.name,
+        signature: parsed.signature,
+        args: parsed.args,
+        target: "vault"
+      };
+      if (MESSAGE_SIGNING.has(parsed.name)) {
+        return {
+          kind: "message_signing",
+          decoded,
+          summary: parsed.name === "signMessage" ? "Sign a message on behalf of the vault (EIP-1271)" : "Revoke a previously signed message (EIP-1271)"
+        };
+      }
+      if (SELF_CALL_ADMIN.has(parsed.name)) {
+        return { kind: "wallet_admin", decoded, summary: describeAdmin(parsed.name, parsed.args) };
+      }
+      return { kind: "wallet_admin", decoded, summary: `Vault self-call: ${parsed.name}` };
+    }
+  }
+  if (ctx.socialRecovery && to.toLowerCase() === ctx.socialRecovery.toLowerCase()) {
+    const parsed = tryParse(interfaces.recovery, data);
+    if (parsed) {
+      const decoded = { ...parsed, target: "socialRecovery" };
+      if (parsed.name === "setupRecovery") {
+        const guardians = parsed.args.guardians;
+        const threshold = parsed.args.threshold;
+        return {
+          kind: "recovery_setup",
+          decoded,
+          summary: `Configure social recovery: ${guardians?.length ?? "?"} guardians, ${String(
+            threshold ?? "?"
+          )} required`
+        };
+      }
+      return { kind: "module_config", decoded, summary: `Social recovery: ${parsed.name}` };
+    }
+  }
+  if (ctx.multiSendCallOnly && to.toLowerCase() === ctx.multiSendCallOnly.toLowerCase()) {
+    const parsed = tryParse(interfaces.multiSend, data);
+    if (parsed?.name === "multiSend") {
+      const inner = decodeMultiSendPayload(parsed.args.transactions);
+      return {
+        kind: "batched_call",
+        decoded: { ...parsed, target: "multiSend" },
+        summary: `Batched call: ${inner.length} sub-transaction${inner.length === 1 ? "" : "s"}`
+      };
+    }
+  }
+  const asVault = tryParse(interfaces.vault, data);
+  if (asVault?.name.startsWith("execTransactionFromModule")) {
+    return {
+      kind: "module_execution",
+      decoded: { ...asVault, target: "vault" },
+      summary: `Module execution against ${short(String(asVault.args.to ?? to))}`
+    };
+  }
+  const erc202 = tryParse(interfaces.erc20, data);
+  if (erc202 && ["transfer", "approve", "transferFrom"].includes(erc202.name)) {
+    return {
+      kind: "erc20_transfer",
+      decoded: { ...erc202, target: "erc20" },
+      summary: describeErc20(erc202.name, erc202.args, to)
+    };
+  }
+  const erc11552 = tryParse(interfaces.erc1155, data);
+  if (erc11552 && erc11552.name.startsWith("safe")) {
+    return {
+      kind: "erc1155_transfer",
+      decoded: { ...erc11552, target: "erc1155" },
+      summary: erc11552.name === "safeBatchTransferFrom" ? `Transfer a batch of ERC1155 tokens from ${short(to)}` : `Transfer ERC1155 token #${String(erc11552.args.id ?? "?")} from ${short(to)}`
+    };
+  }
+  const erc7212 = tryParse(interfaces.erc721, data);
+  if (erc7212 && erc7212.name === "safeTransferFrom") {
+    return {
+      kind: "erc721_transfer",
+      decoded: { ...erc7212, target: "erc721" },
+      summary: `Transfer NFT #${String(erc7212.args.tokenId ?? "?")} to ${short(
+        String(erc7212.args.to ?? "?")
+      )}`
+    };
+  }
+  const selector = data.slice(0, 10);
+  return {
+    kind: "external_call",
+    summary: `Call ${short(to)} (selector ${selector})` + (value > 0n ? ` with ${formatQuai(value)} QUAI` : "")
+  };
+}
+function tryParse(iface, data) {
+  try {
+    const parsed = iface.parseTransaction({ data });
+    if (!parsed) return null;
+    return {
+      name: parsed.name,
+      signature: parsed.fragment.format("sighash"),
+      args: namedArgs(parsed.fragment.inputs, parsed.args)
+    };
+  } catch {
+    return null;
+  }
+}
+function describeAdmin(name, args) {
+  switch (name) {
+    case "addOwner":
+      return `Add owner ${short(String(args.owner))}`;
+    case "removeOwner":
+      return `Remove owner ${short(String(args.owner))}`;
+    case "changeThreshold":
+      return `Change approval threshold to ${String(args._threshold ?? args.threshold)}`;
+    case "enableModule":
+      return `Enable module ${short(String(args.module))}`;
+    case "disableModule":
+      return `Disable module ${short(String(args.module))}`;
+    case "setMinExecutionDelay":
+      return `Set minimum execution delay to ${formatDuration(Number(args.delay ?? 0))}`;
+    case "addDelegatecallTarget":
+      return `Whitelist ${short(String(args.target))} as a DelegateCall target`;
+    case "removeDelegatecallTarget":
+      return `Remove ${short(String(args.target))} from the DelegateCall whitelist`;
+    case "cancelByConsensus":
+      return `Cancel transaction ${short(String(args.txHash))} by consensus`;
+    default:
+      return `Vault admin: ${name}`;
+  }
+}
+function describeErc20(name, args, tokenAddress) {
+  switch (name) {
+    case "transfer":
+      return `Transfer ${String(args.amount)} units of token ${short(tokenAddress)} to ${short(
+        String(args.to)
+      )}`;
+    case "approve":
+      return `Approve ${short(String(args.spender))} to spend ${String(args.amount)} units of ${short(
+        tokenAddress
+      )}`;
+    default:
+      return `ERC20 ${name} on ${short(tokenAddress)}`;
+  }
+}
+function decodeMultiSendPayload(payload) {
+  const bytes = getBytes2(payload);
+  const out = [];
+  let offset = 0;
+  while (offset < bytes.length) {
+    if (offset + 85 > bytes.length) break;
+    const operation = bytes[offset];
+    offset += 1;
+    const to = hexOf(bytes.subarray(offset, offset + 20));
+    offset += 20;
+    const value = BigInt(hexOf(bytes.subarray(offset, offset + 32)));
+    offset += 32;
+    const length = Number(BigInt(hexOf(bytes.subarray(offset, offset + 32))));
+    offset += 32;
+    if (offset + length > bytes.length) break;
+    const data = hexOf(bytes.subarray(offset, offset + length));
+    offset += length;
+    out.push({ operation, to, value, data });
+  }
+  return out;
+}
+function hexOf(bytes) {
+  let s = "0x";
+  for (const b of bytes) s += b.toString(16).padStart(2, "0");
+  return s;
+}
+
+// src/lifecycle/affordances.ts
+function terminalReason2(tx) {
+  switch (tx.status) {
+    case "executed":
+      return "The transaction has already been executed.";
+    case "failed":
+      return "The transaction executed but its target call reverted. This state is terminal.";
+    case "cancelled":
+      return "The transaction has been cancelled.";
+    case "expired":
+      return "The transaction passed its expiration timestamp.";
+    default:
+      return "The transaction is in a terminal state.";
+  }
+}
+function computeAffordances(ctx) {
+  const { tx, isOwner, hasApproved } = ctx;
+  const at = ctx.at ?? nowSeconds();
+  const terminal = isTerminal(tx.status);
+  const quorum = tx.approvalCount >= tx.threshold;
+  const isSelfCall = tx.to.toLowerCase() === tx.vault.toLowerCase();
+  const executableAfter = executableAfterOf(tx.approvedAt, tx.executionDelay);
+  const timelockActive = !isSelfCall && tx.executionDelay > 0 && (tx.approvedAt === 0 || at < executableAfter);
+  const isProposer = tx.proposer.toLowerCase() === ctx.caller.toLowerCase();
+  const out = [];
+  const notOwner = (action) => ({
+    action,
+    allowed: false,
+    reason: "Only owners of this vault may take this action.",
+    blockedBy: "not_owner"
+  });
+  const isTerminalBlocked = (action) => ({
+    action,
+    allowed: false,
+    reason: terminalReason2(tx),
+    blockedBy: "terminal_state"
+  });
+  if (terminal) out.push(isTerminalBlocked("approve"));
+  else if (!isOwner) out.push(notOwner("approve"));
+  else if (hasApproved) {
+    out.push({
+      action: "approve",
+      allowed: false,
+      reason: "You have already approved this transaction.",
+      blockedBy: "already_approved"
+    });
+  } else {
+    out.push({ action: "approve", allowed: true, reason: "You can approve this transaction." });
+  }
+  if (terminal) out.push(isTerminalBlocked("revokeApproval"));
+  else if (!isOwner) out.push(notOwner("revokeApproval"));
+  else if (!hasApproved) {
+    out.push({
+      action: "revokeApproval",
+      allowed: false,
+      reason: "You have no active approval on this transaction to revoke.",
+      blockedBy: "not_approved"
+    });
+  } else {
+    out.push({
+      action: "revokeApproval",
+      allowed: true,
+      reason: tx.approvedAt > 0 ? "You can revoke your approval. Note that quorum was already reached, so the timelock clock keeps running and the proposer still cannot cancel." : "You can revoke your approval."
+    });
+  }
+  if (terminal) out.push(isTerminalBlocked("execute"));
+  else if (!isOwner) out.push(notOwner("execute"));
+  else if (!quorum) {
+    out.push({
+      action: "execute",
+      allowed: false,
+      reason: `Needs ${tx.threshold} approvals, has ${tx.approvalCount}.`,
+      blockedBy: "threshold"
+    });
+  } else if (timelockActive) {
+    out.push({
+      action: "execute",
+      allowed: false,
+      reason: tx.approvedAt === 0 ? `Quorum is met but the timelock clock has not started. The next execute call will start it and return without executing; you must call execute again ${tx.executionDelay}s later.` : `Timelocked until ${new Date(executableAfter * 1e3).toISOString()}.`,
+      blockedBy: "timelock",
+      ...tx.approvedAt > 0 ? { availableAt: executableAfter } : {}
+    });
+  } else {
+    out.push({ action: "execute", allowed: true, reason: "This transaction is ready to execute." });
+  }
+  if (terminal) out.push(isTerminalBlocked("approveAndExecute"));
+  else if (!isOwner) out.push(notOwner("approveAndExecute"));
+  else if (hasApproved) {
+    out.push({
+      action: "approveAndExecute",
+      allowed: false,
+      reason: "You have already approved. Use execute instead.",
+      blockedBy: "already_approved"
+    });
+  } else {
+    const wouldReachQuorum = tx.approvalCount + 1 >= tx.threshold;
+    out.push({
+      action: "approveAndExecute",
+      allowed: true,
+      reason: !wouldReachQuorum ? `Your approval will be recorded, but execution needs ${tx.threshold} approvals (would be ${tx.approvalCount + 1}). The call returns without executing.` : timelockActive ? "Your approval will be recorded and will start the timelock, but the call returns without executing. Execute again after the delay elapses." : "Your approval meets the threshold and the transaction will execute in the same call."
+    });
+  }
+  if (terminal) out.push(isTerminalBlocked("cancel"));
+  else if (!isOwner) out.push(notOwner("cancel"));
+  else if (!isProposer) {
+    out.push({
+      action: "cancel",
+      allowed: false,
+      reason: "Only the proposer can cancel directly. Others need a cancelByConsensus proposal.",
+      blockedBy: "not_proposer"
+    });
+  } else if (tx.approvedAt !== 0) {
+    out.push({
+      action: "cancel",
+      allowed: false,
+      reason: "This transaction reached quorum, which permanently blocks proposer-cancel \u2014 even though approvals may since have been revoked. Use a cancelByConsensus proposal instead.",
+      blockedBy: "quorum_locked"
+    });
+  } else {
+    out.push({ action: "cancel", allowed: true, reason: "You proposed this and can cancel it." });
+  }
+  if (tx.status === "executed" || tx.status === "failed" || tx.status === "cancelled") {
+    out.push(isTerminalBlocked("expire"));
+  } else if (tx.expiration === 0) {
+    out.push({
+      action: "expire",
+      allowed: false,
+      reason: "This transaction has no expiration and can never be expired.",
+      blockedBy: "no_expiration"
+    });
+  } else if (at <= tx.expiration) {
+    out.push({
+      action: "expire",
+      allowed: false,
+      reason: `Not expired yet. Expires at ${new Date(tx.expiration * 1e3).toISOString()}.`,
+      blockedBy: "expired",
+      availableAt: tx.expiration + 1
+    });
+  } else {
+    out.push({
+      action: "expire",
+      allowed: true,
+      reason: "Past its expiration \u2014 anyone may close it out and reclaim approval storage."
+    });
+  }
+  if (terminal) out.push(isTerminalBlocked("proposeCancelByConsensus"));
+  else if (!isOwner) out.push(notOwner("proposeCancelByConsensus"));
+  else {
+    out.push({
+      action: "proposeCancelByConsensus",
+      allowed: true,
+      reason: "You can propose a cancelByConsensus self-call. It needs the same threshold as executing the original transaction, but self-calls bypass the timelock, so it always resolves faster."
+    });
+  }
+  return out;
+}
+function allowedActions(affordances) {
+  return affordances.filter((a) => a.allowed);
+}
+
+// src/lifecycle/outcome.ts
+import { Interface as Interface5 } from "quais";
+var vaultInterface2 = new Interface5(QuaiVaultAbi);
+function parseVaultEvents(receipt, vault2) {
+  const out = [];
+  const target = vault2.toLowerCase();
+  for (const log of receipt.logs ?? []) {
+    if (log.address && log.address.toLowerCase() !== target) continue;
+    try {
+      const parsed = vaultInterface2.parseLog({
+        topics: Array.from(log.topics),
+        data: log.data
+      });
+      if (!parsed) continue;
+      const args = {};
+      parsed.fragment.inputs.forEach((input, i) => {
+        if (input.name) args[input.name] = parsed.args[i];
+      });
+      out.push({ name: parsed.name, args });
+    } catch {
+    }
+  }
+  return out;
+}
+function eventFor(events, name, txHash) {
+  const wanted = txHash.toLowerCase();
+  return events.find(
+    (e) => e.name === name && String(e.args.txHash ?? "").toLowerCase() === wanted
+  );
+}
+function toNumber2(value) {
+  if (typeof value === "bigint") return Number(value);
+  if (typeof value === "number") return value;
+  return Number(value ?? 0);
+}
+function classifyExecution(receipt, vault2, txHash) {
+  const chainTxHash = receipt.hash ?? receipt.transactionHash ?? "";
+  const base = {
+    txHash,
+    chainTxHash,
+    blockNumber: toNumber2(receipt.blockNumber),
+    gasUsed: BigInt(receipt.gasUsed ?? 0)
+  };
+  const events = parseVaultEvents(receipt, vault2);
+  const executed = eventFor(events, "TransactionExecuted", txHash);
+  if (executed) {
+    return {
+      ...base,
+      outcome: "executed",
+      message: "Transaction executed successfully."
+    };
+  }
+  const failed = eventFor(events, "TransactionFailed", txHash);
+  if (failed) {
+    const returnData = String(failed.args.returnData ?? "0x");
+    const decodedRevert = decodeRevert(returnData);
+    return {
+      ...base,
+      outcome: "failed",
+      returnData,
+      decodedRevert,
+      message: `The vault executed the transaction but the target call reverted` + (decodedRevert ? `: ${decodedRevert.message}` : ".") + " This state is terminal \u2014 the transaction is permanently marked executed and cannot be retried. Propose a new transaction to try again."
+    };
+  }
+  const thresholdReached = eventFor(events, "ThresholdReached", txHash);
+  if (thresholdReached) {
+    const executableAfter = toNumber2(thresholdReached.args.executableAfter);
+    if (executableAfter > Math.floor(Date.now() / 1e3)) {
+      return {
+        ...base,
+        outcome: "timelock_started",
+        executableAfter,
+        message: `Quorum was reached and the execution delay started. Nothing has executed yet. Call execute again after ${new Date(executableAfter * 1e3).toISOString()}.`
+      };
+    }
+    return {
+      ...base,
+      outcome: "approved_only",
+      executableAfter,
+      message: "Quorum was reached but the transaction did not execute in this call. Call execute again."
+    };
+  }
+  const approved = eventFor(events, "TransactionApproved", txHash);
+  return {
+    ...base,
+    outcome: "approved_only",
+    message: approved ? "Your approval was recorded, but the transaction did not execute \u2014 the threshold is not yet met." : "The transaction did not execute. It may be timelocked, or already approved by this owner without the threshold being met."
+  };
+}
+function extractProposedTxHash(receipt, vault2) {
+  const events = parseVaultEvents(receipt, vault2);
+  const proposed = events.find((e) => e.name === "TransactionProposed");
+  const hash = proposed?.args.txHash;
+  return typeof hash === "string" ? hash : null;
+}
+
+// src/vault.ts
+var Vault = class {
+  address;
+  /** Guardian-based recovery for this vault. */
+  recovery;
+  ctx;
+  constructor(address2, ctx) {
+    this.address = assertQuaiAddress(address2, "vault address");
+    this.ctx = ctx;
+    this.recovery = new RecoveryModule({
+      connection: ctx.connection,
+      queries: ctx.queries,
+      vaultAddress: this.address,
+      moduleAddress: ctx.contracts.socialRecovery
+    });
+  }
+  // =========================================================================
+  // Read resolution
+  // =========================================================================
+  /**
+   * Whether an indexer read is acceptable right now.
+   *
+   * `auto` uses the indexer only while it is live and within the configured lag
+   * budget, so a stalled indexer silently degrades to chain reads instead of
+   * serving stale state.
+   */
+  async useIndexer() {
+    if (this.ctx.consistency === "chain") return false;
+    if (!this.ctx.indexer || !this.ctx.queries) {
+      if (this.ctx.consistency === "indexed") throw new NoIndexerError("This read");
+      return false;
+    }
+    if (this.ctx.consistency === "indexed") return true;
+    const health = await this.ctx.indexer.health();
+    if (!health.available) return false;
+    if (health.blocksBehind !== void 0 && health.blocksBehind > this.ctx.maxIndexerLagBlocks) {
+      return false;
+    }
+    return true;
+  }
+  requireQueries(operation) {
+    if (!this.ctx.queries) throw new NoIndexerError(operation);
+    return this.ctx.queries;
+  }
+  contract(write = false) {
+    return new VaultContract(this.ctx.connection.vault(this.address, write), this.ctx.connection.retry);
+  }
+  // =========================================================================
+  // Vault state
+  // =========================================================================
+  /** Owners, threshold, timelock floor, nonce and balance. Always read from chain. */
+  async info() {
+    const vault2 = this.contract();
+    const [owners, threshold, minExecutionDelay, nonce, moduleCount, balance] = await Promise.all([
+      vault2.getOwners(),
+      vault2.threshold(),
+      vault2.minExecutionDelay(),
+      vault2.nonce(),
+      vault2.moduleCount(),
+      this.ctx.connection.provider.getBalance(this.address)
+    ]);
+    return {
+      address: this.address,
+      owners: Array.from(owners).map((o) => getAddress5(String(o))),
+      threshold: Number(threshold),
+      minExecutionDelay: Number(minExecutionDelay),
+      nonce: Number(nonce),
+      moduleCount: Number(moduleCount),
+      balance: BigInt(balance)
+    };
+  }
+  /** Active owners. Prefers the indexer, falls back to chain. */
+  async owners() {
+    if (await this.useIndexer()) {
+      try {
+        const owners = await this.requireQueries("owners").owners(this.address);
+        if (owners.length > 0) return owners.map((o) => getAddress5(o));
+      } catch {
+      }
+    }
+    return (await this.contract().getOwners()).map((o) => getAddress5(String(o)));
+  }
+  async isOwner(address2) {
+    return this.contract().isOwner(getAddress5(address2));
+  }
+  async threshold() {
+    return Number(await this.contract().threshold());
+  }
+  async balance() {
+    return BigInt(await this.ctx.connection.provider.getBalance(this.address));
+  }
+  /**
+   * Enabled modules, in linked-list order.
+   *
+   * Order matters: `disableModule` needs each module's predecessor, so this always
+   * reads the chain rather than the indexer (which stores an unordered set).
+   */
+  async modules() {
+    return (await this.contract().getModules()).map((m) => getAddress5(String(m)));
+  }
+  async isModuleEnabled(module) {
+    return this.contract().isModuleEnabled(getAddress5(module));
+  }
+  /** Addresses permitted as DelegateCall targets. Empty means DelegateCall is disabled. */
+  async delegatecallTargets() {
+    const targets = await this.requireQueries("Listing DelegateCall targets").delegatecallTargets(
+      this.address
+    );
+    return targets.map((t) => getAddress5(t));
+  }
+  async isDelegatecallAllowed(target) {
+    return this.contract().delegatecallAllowed(getAddress5(target));
+  }
+  /** Whether a hash has been pre-approved for EIP-1271 validation. */
+  async isValidSignature(hash) {
+    const magic = await this.contract().isValidSignature(normalizeTxHash(hash, "hash"), "0x");
+    return magic.toLowerCase() === "0x1626ba7e";
+  }
+  // =========================================================================
+  // Transactions
+  // =========================================================================
+  /** The vault-transaction hash for a given call, at a given nonce. */
+  async transactionHash(to, value, data, nonce) {
+    const vault2 = this.contract();
+    const n = nonce ?? Number(await vault2.nonce());
+    return vault2.getTransactionHash(getAddress5(to), value, data, n);
+  }
+  async transaction(txHash) {
+    const hash = normalizeTxHash(txHash);
+    if (await this.useIndexer()) {
+      try {
+        const tx = await this.fromIndexer(hash);
+        if (tx) return tx;
+      } catch {
+      }
+    }
+    return this.fromChain(hash);
+  }
+  async pendingTransactions(options = {}) {
+    const queries = this.requireQueries("Listing pending transactions");
+    const [rows, owners, threshold] = await Promise.all([
+      queries.pendingTransactions(this.address, options),
+      this.owners(),
+      this.threshold()
+    ]);
+    return this.hydrateRows(rows, owners, threshold);
+  }
+  async transactionHistory(options = {}) {
+    const queries = this.requireQueries("Listing transaction history");
+    const [page, owners, threshold] = await Promise.all([
+      queries.transactionHistory(this.address, options),
+      this.owners(),
+      this.threshold()
+    ]);
+    return {
+      data: await this.hydrateRows(page.data, owners, threshold),
+      total: page.total,
+      hasMore: page.hasMore
+    };
+  }
+  // ---- hydration -----------------------------------------------------------
+  async hydrateRows(rows, owners, threshold) {
+    if (rows.length === 0) return [];
+    const queries = this.requireQueries("Loading confirmations");
+    const confirmations = await queries.activeConfirmationsBatch(
+      this.address,
+      rows.map((r) => r.tx_hash)
+    );
+    const indexedAtBlock = (await this.ctx.indexer?.state())?.lastIndexedBlock;
+    return rows.map((row) => {
+      const confirmed = (confirmations.get(row.tx_hash.toLowerCase()) ?? []).map(
+        (c) => c.owner_address
+      );
+      return this.buildTransaction({
+        row,
+        confirmedBy: confirmed,
+        owners,
+        threshold,
+        indexedAtBlock
+      });
+    });
+  }
+  async fromIndexer(hash) {
+    const queries = this.requireQueries("Reading a transaction");
+    const [row, owners, threshold] = await Promise.all([
+      queries.transaction(this.address, hash),
+      this.owners(),
+      this.threshold()
+    ]);
+    if (!row) return null;
+    const confirmations = await queries.confirmations(this.address, hash);
+    const indexedAtBlock = (await this.ctx.indexer?.state())?.lastIndexedBlock;
+    return this.buildTransaction({
+      row,
+      confirmedBy: confirmations.filter((c) => c.is_active).map((c) => c.owner_address),
+      owners,
+      threshold,
+      indexedAtBlock
+    });
+  }
+  /**
+   * Build a `VaultTransaction` from an indexed row.
+   *
+   * Approval counting intersects the indexer's confirmations with the current owner
+   * set. The indexer marks a confirmation inactive only on an explicit
+   * `ApprovalRevoked`; it does not react to `OwnerRemoved`. On chain, removing an
+   * owner bumps `ownerVersions` and invalidates every approval that address made, so
+   * the stored `confirmation_count` over-reports after any removal. Intersecting here
+   * reproduces the contract's `_countValidApprovals`.
+   */
+  buildTransaction(input) {
+    const { row, owners, threshold, indexedAtBlock } = input;
+    const ownerSet = new Set(owners.map((o) => o.toLowerCase()));
+    const confirmedSet = new Set(input.confirmedBy.map((c) => c.toLowerCase()));
+    const approvals = owners.filter((o) => confirmedSet.has(o.toLowerCase())).map((o) => ({ owner: o, active: true }));
+    for (const confirmed of confirmedSet) {
+      if (!ownerSet.has(confirmed)) {
+        approvals.push({ owner: getAddress5(confirmed), active: false });
+      }
+    }
+    const approvalCount = approvals.filter((a) => a.active).length;
+    const value = BigInt(row.value);
+    const data = row.data ?? "0x";
+    const to = getAddress5(row.to_address);
+    const decodeResult = decodeCall({
+      vault: this.address,
+      to,
+      value,
+      data,
+      socialRecovery: this.ctx.contracts.socialRecovery,
+      multiSendCallOnly: this.ctx.contracts.multiSendCallOnly
+    });
+    const expiration = toNumber(row.expiration);
+    const executionDelay = toNumber(row.execution_delay);
+    const approvedAt = toNumber(row.approved_at);
+    const status = deriveStatus({
+      executed: row.status === "executed" || row.status === "failed",
+      cancelled: row.status === "cancelled" || row.status === "expired",
+      isExpired: row.is_expired ?? row.status === "expired",
+      expiration,
+      executionDelay,
+      approvedAt,
+      approvalCount,
+      threshold,
+      failed: row.status === "failed"
+    });
+    const failedReturnData = row.failed_return_data ?? void 0;
+    return {
+      hash: row.tx_hash,
+      vault: this.address,
+      to,
+      value,
+      data,
+      proposer: getAddress5(row.submitted_by),
+      proposedAt: toNumber(row.submitted_at_block),
+      kind: decodeResult.kind,
+      decoded: decodeResult.decoded,
+      summary: decodeResult.summary,
+      status,
+      approvals,
+      approvalCount,
+      threshold,
+      expiration,
+      executionDelay,
+      approvedAt,
+      executableAfter: executableAfterOf(approvedAt, executionDelay),
+      failedReturnData,
+      decodedRevert: failedReturnData ? decodeRevert(failedReturnData) : void 0,
+      source: "indexer",
+      indexedAtBlock
+    };
+  }
+  /** Authoritative read: the struct plus a `hasApproved` probe per current owner. */
+  async fromChain(hash) {
+    const vault2 = this.contract();
+    const [raw, owners, threshold, isExpired] = await Promise.all([
+      vault2.transactions(hash),
+      vault2.getOwners(),
+      vault2.threshold(),
+      vault2.expiredTxs(hash)
+    ]);
+    const to = String(raw.to);
+    if (!to || to === "0x0000000000000000000000000000000000000000") {
+      throw new NotFoundError(`No transaction ${hash} on vault ${this.address}.`);
+    }
+    const ownerList = owners.map((o) => getAddress5(String(o)));
+    const approvalFlags = await Promise.all(
+      ownerList.map((owner) => vault2.hasApproved(hash, owner))
+    );
+    const approvals = ownerList.map((owner, i) => ({ owner, active: approvalFlags[i] === true })).filter((a) => a.active);
+    const value = BigInt(raw.value ?? 0);
+    const data = String(raw.data ?? "0x");
+    const expiration = Number(raw.expiration ?? 0);
+    const executionDelay = Number(raw.executionDelay ?? 0);
+    const approvedAt = Number(raw.approvedAt ?? 0);
+    const executed = Boolean(raw.executed);
+    const cancelled = Boolean(raw.cancelled);
+    const decodeResult = decodeCall({
+      vault: this.address,
+      to: getAddress5(to),
+      value,
+      data,
+      socialRecovery: this.ctx.contracts.socialRecovery,
+      multiSendCallOnly: this.ctx.contracts.multiSendCallOnly
+    });
+    return {
+      hash,
+      vault: this.address,
+      to: getAddress5(to),
+      value,
+      data,
+      proposer: getAddress5(String(raw.proposer)),
+      proposedAt: Number(raw.timestamp ?? 0),
+      kind: decodeResult.kind,
+      decoded: decodeResult.decoded,
+      summary: decodeResult.summary,
+      status: deriveStatus({
+        executed,
+        cancelled,
+        isExpired,
+        expiration,
+        executionDelay,
+        approvedAt,
+        approvalCount: approvals.length,
+        threshold: Number(threshold)
+      }),
+      approvals,
+      approvalCount: approvals.length,
+      threshold: Number(threshold),
+      expiration,
+      executionDelay,
+      approvedAt,
+      executableAfter: executableAfterOf(approvedAt, executionDelay),
+      source: "chain"
+    };
+  }
+  // =========================================================================
+  // Affordances
+  // =========================================================================
+  /**
+   * What `caller` may legally do to `txHash` right now, and when blocked actions
+   * become available. Defaults to the connected signer's address.
+   */
+  async affordances(txHash, caller) {
+    const hash = normalizeTxHash(txHash);
+    const who = caller ?? await this.ctx.connection.addressOrNull();
+    if (!who) {
+      throw new ValidationError(
+        "affordances() needs a caller address when the client has no signer."
+      );
+    }
+    const vault2 = this.contract();
+    const [tx, isOwner, hasApproved] = await Promise.all([
+      this.transaction(hash),
+      vault2.isOwner(getAddress5(who)),
+      vault2.hasApproved(hash, getAddress5(who))
+    ]);
+    return computeAffordances({ tx, caller: getAddress5(who), isOwner, hasApproved });
+  }
+  // =========================================================================
+  // Proposals
+  // =========================================================================
+  /**
+   * Proposal builders.
+   *
+   * Every method here is async, including the ones whose work is purely local. Mixing
+   * synchronous throws with rejected promises is a footgun: `propose.addOwner(bad)`
+   * would throw before `.catch()` could attach. Validation failures are always
+   * rejections.
+   */
+  propose = {
+    /** Propose an arbitrary call. Every other `propose.*` helper routes through this. */
+    call: async (params) => this.proposeCall({
+      to: assertQuaiAddress(params.to, "target"),
+      value: params.value,
+      data: params.data,
+      ...proposeOptionsOf(params)
+    }),
+    /** Send native QUAI. */
+    transfer: async (params) => this.proposeCall({
+      // Native value sent to a Qi address leaves the Quai ledger and is unrecoverable.
+      to: assertQuaiAddress(params.to, "recipient"),
+      value: params.amount,
+      data: "0x",
+      ...proposeOptionsOf(params)
+    }),
+    erc20Transfer: async (params) => this.proposeCall({
+      to: assertQuaiAddress(params.token, "token"),
+      value: 0n,
+      data: token.erc20Transfer(assertQuaiAddress(params.to, "recipient"), params.amount),
+      ...proposeOptionsOf(params)
+    }),
+    erc721Transfer: async (params) => this.proposeCall({
+      to: assertQuaiAddress(params.token, "token"),
+      value: 0n,
+      data: token.erc721Transfer(
+        this.address,
+        assertQuaiAddress(params.to, "recipient"),
+        params.tokenId
+      ),
+      ...proposeOptionsOf(params)
+    }),
+    erc1155Transfer: async (params) => this.proposeCall({
+      to: assertQuaiAddress(params.token, "token"),
+      value: 0n,
+      data: token.erc1155Transfer(
+        this.address,
+        assertQuaiAddress(params.to, "recipient"),
+        params.id,
+        params.amount,
+        params.data ?? "0x"
+      ),
+      ...proposeOptionsOf(params)
+    }),
+    /**
+     * Batch several calls through MultiSendCallOnly.
+     *
+     * Requires MultiSendCallOnly to be on this vault's DelegateCall whitelist, which
+     * is empty by default. The precondition is checked before signing so the failure
+     * names the missing `addDelegatecallTarget` proposal instead of reverting.
+     */
+    batch: async (calls, options = {}) => {
+      const multiSend2 = this.ctx.contracts.multiSendCallOnly;
+      if (!multiSend2) {
+        throw new ValidationError(
+          "No MultiSendCallOnly address is configured for this network.",
+          "Set QUAIVAULT_MULTISEND_CALL_ONLY or pass contracts.multiSendCallOnly."
+        );
+      }
+      if (!await this.isDelegatecallAllowed(multiSend2)) {
+        throw new PreconditionError(
+          `MultiSendCallOnly (${multiSend2}) is not on this vault's DelegateCall whitelist, so a batched call cannot execute.`,
+          {
+            remediation: `Propose and execute addDelegatecallTarget(${multiSend2}) first \u2014 it requires full owner consensus, by design.`
+          }
+        );
+      }
+      calls.forEach((call, i) => assertQuaiAddress(call.to, `calls[${i}].to`));
+      return this.proposeCall({
+        to: multiSend2,
+        value: 0n,
+        data: encodeMultiSend(calls),
+        ...proposeOptionsOf(options)
+      });
+    },
+    // --- self-calls -------------------------------------------------------
+    addOwner: async (owner, options = {}) => this.proposeSelfCall(selfCall.addOwner(assertQuaiAddress(owner, "owner")), options),
+    removeOwner: async (owner, options = {}) => {
+      const [owners, threshold] = await Promise.all([this.owners(), this.threshold()]);
+      if (!owners.some((o) => o.toLowerCase() === owner.toLowerCase())) {
+        throw new PreconditionError(`${owner} is not an owner of this vault.`);
+      }
+      if (owners.length - 1 < threshold) {
+        throw new PreconditionError(
+          `Removing an owner would leave ${owners.length - 1} owners, below the threshold of ${threshold}.`,
+          { remediation: "Lower the threshold first, in a separate proposal." }
+        );
+      }
+      return this.proposeSelfCall(selfCall.removeOwner(getAddress5(owner)), options);
+    },
+    changeThreshold: async (threshold, options = {}) => {
+      const owners = await this.owners();
+      if (threshold < 1 || threshold > owners.length) {
+        throw new ValidationError(
+          `Invalid threshold ${threshold}: this vault has ${owners.length} owners.`
+        );
+      }
+      return this.proposeSelfCall(selfCall.changeThreshold(threshold), options);
+    },
+    setMinExecutionDelay: async (seconds, options = {}) => this.proposeSelfCall(selfCall.setMinExecutionDelay(seconds), options),
+    enableModule: async (module, options = {}) => this.proposeSelfCall(selfCall.enableModule(assertQuaiAddress(module, "module")), options),
+    /**
+     * Disable a module, resolving its predecessor in the Zodiac linked list.
+     *
+     * The predecessor is baked into the proposal, so any module added or removed
+     * before this executes invalidates it. `execute` re-checks and raises
+     * `StaleProposalError` rather than letting it revert on chain.
+     */
+    disableModule: async (module, options = {}) => {
+      const prev = await this.previousModule(getAddress5(module));
+      return this.proposeSelfCall(selfCall.disableModule(prev, getAddress5(module)), options);
+    },
+    addDelegatecallTarget: async (target, options = {}) => this.proposeSelfCall(
+      selfCall.addDelegatecallTarget(assertQuaiAddress(target, "delegatecall target")),
+      options
+    ),
+    removeDelegatecallTarget: async (target, options = {}) => this.proposeSelfCall(selfCall.removeDelegatecallTarget(getAddress5(target)), options),
+    /** Cancel a transaction that has already reached quorum. Needs full consensus. */
+    cancelByConsensus: async (txHash, options = {}) => this.proposeSelfCall(selfCall.cancelByConsensus(normalizeTxHash(txHash)), options),
+    /** Sign arbitrary bytes. For EIP-1271 hash approval use `approveHashForEip1271`. */
+    signMessage: async (message, options = {}) => this.proposeSelfCall(selfCall.signMessage(message), options),
+    unsignMessage: async (message, options = {}) => this.proposeSelfCall(selfCall.unsignMessage(message), options),
+    /**
+     * Make `isValidSignature(hash, …)` return the EIP-1271 magic value.
+     *
+     * Enforces the 32-byte precondition: signing an arbitrary-length message `M`
+     * does not make `isValidSignature(keccak256(M))` validate, because EIP-1271
+     * hashes the dataHash itself, not `M`.
+     */
+    approveHashForEip1271: async (hash, options = {}) => this.proposeSelfCall(selfCall.approveHashForEip1271(normalizeTxHash(hash, "hash")), options),
+    revokeHashForEip1271: async (hash, options = {}) => this.proposeSelfCall(selfCall.revokeHashForEip1271(normalizeTxHash(hash, "hash")), options),
+    /** Configure social recovery. A call to the module, not a self-call. */
+    setupRecovery: async (params) => {
+      const module = this.ctx.contracts.socialRecovery;
+      if (!module) {
+        throw new ValidationError(
+          "No SocialRecoveryModule address is configured for this network.",
+          "Set QUAIVAULT_SOCIAL_RECOVERY_MODULE or pass contracts.socialRecovery."
+        );
+      }
+      return this.proposeCall({
+        to: module,
+        value: 0n,
+        data: recoveryCall.setupRecovery(
+          this.address,
+          // A Qi guardian could never approve a recovery.
+          assertQuaiAddresses(params.guardians, "guardians"),
+          params.threshold,
+          params.recoveryPeriodSeconds
+        ),
+        ...proposeOptionsOf(params)
+      });
+    }
+  };
+  /** Predecessor of `module` in the Zodiac linked list, for `disableModule`. */
+  async previousModule(module) {
+    const modules = await this.modules();
+    const index = modules.findIndex((m) => m.toLowerCase() === module.toLowerCase());
+    if (index === -1) {
+      throw new PreconditionError(`Module ${module} is not enabled on this vault.`);
+    }
+    return index === 0 ? SENTINEL_MODULES : modules[index - 1];
+  }
+  proposeSelfCall(data, options) {
+    if (options.executionDelay) {
+      throw new ValidationError(
+        "Self-calls always execute immediately \u2014 the vault forces executionDelay to 0 for them."
+      );
+    }
+    return this.proposeCall({
+      to: this.address,
+      value: 0n,
+      data,
+      ...proposeOptionsOf(options)
+    });
+  }
+  async proposeCall(params) {
+    const to = getAddress5(params.to);
+    const value = params.value ?? 0n;
+    const data = params.data ?? "0x";
+    if (data !== "0x" && !/^0x([0-9a-fA-F]{2})*$/.test(data)) {
+      throw new ValidationError("Transaction data must be 0x-prefixed hex with an even length.");
+    }
+    const isSelfCall = to.toLowerCase() === this.address.toLowerCase();
+    if (isSelfCall && value > 0n) {
+      throw new ValidationError(
+        "Self-calls cannot carry value \u2014 the vault rejects them at proposal time."
+      );
+    }
+    const expiration = params.expiration ?? 0;
+    const executionDelay = params.executionDelay ?? 0;
+    if (executionDelay > MAX_EXECUTION_DELAY) {
+      throw new ValidationError(
+        `executionDelay ${executionDelay}s exceeds the 30-day maximum (${MAX_EXECUTION_DELAY}s).`
+      );
+    }
+    if (expiration > 0) {
+      const floor = isSelfCall ? 0 : Math.max(executionDelay, await this.minExecutionDelay());
+      const earliest = minimumExpiration(floor, 0);
+      if (expiration <= earliest) {
+        throw new ValidationError(
+          `expiration ${expiration} is too soon: with an effective delay of ${floor}s the vault requires an expiration after ${earliest}.`,
+          `Use at least ${minimumExpiration(floor)} to leave a margin for block time.`
+        );
+      }
+    }
+    const useFullOverload = params.expiration != null || params.executionDelay != null;
+    if (params.dryRun) {
+      const readVault = this.contract();
+      const encoded = useFullOverload ? readVault.encode("proposeTransaction(address,uint256,bytes,uint48,uint32)", [
+        to,
+        value,
+        data,
+        expiration,
+        executionDelay
+      ]) : readVault.encode("proposeTransaction(address,uint256,bytes)", [to, value, data]);
+      let gasEstimate = null;
+      let wouldRevert;
+      const from = await this.ctx.connection.addressOrNull();
+      if (from) {
+        try {
+          gasEstimate = BigInt(
+            await this.ctx.connection.provider.estimateGas({
+              to: this.address,
+              data: encoded,
+              from
+            })
+          );
+        } catch (err) {
+          wouldRevert = decodeRevertFromError(err);
+        }
+      }
+      const decoded = decodeCall({
+        vault: this.address,
+        to,
+        value,
+        data,
+        socialRecovery: this.ctx.contracts.socialRecovery,
+        multiSendCallOnly: this.ctx.contracts.multiSendCallOnly
+      });
+      return {
+        dryRun: true,
+        to: this.address,
+        data: encoded,
+        value: 0n,
+        gasEstimate,
+        wouldRevert,
+        description: `Propose: ${decoded.summary}`
+      };
+    }
+    await this.assertCallerIsOwner("Proposing a transaction");
+    const writeVault = this.contract(true);
+    let receipt;
+    try {
+      const sent = useFullOverload ? await writeVault.proposeTransactionFull(to, value, data, expiration, executionDelay) : await writeVault.proposeTransactionSimple(to, value, data);
+      receipt = await sent.wait();
+    } catch (err) {
+      throw toRevertError(err, "Transaction proposal failed");
+    }
+    assertReceipt(receipt, "Proposal", "The proposal transaction reverted.");
+    const txHash = extractProposedTxHash(receipt, this.address);
+    if (!txHash) {
+      throw new RevertError(
+        "The proposal was mined but no TransactionProposed event was found. Check that the vault address is correct."
+      );
+    }
+    return {
+      txHash,
+      chainTxHash: receipt.hash ?? receipt.transactionHash ?? "",
+      to,
+      value,
+      data
+    };
+  }
+  async minExecutionDelay() {
+    return Number(await this.contract().minExecutionDelay());
+  }
+  // =========================================================================
+  // Lifecycle writes
+  // =========================================================================
+  async approve(txHash) {
+    const hash = normalizeTxHash(txHash);
+    const caller = await this.assertCallerIsOwner("Approving a transaction");
+    const vault2 = this.contract(true);
+    if (await vault2.hasApproved(hash, caller)) {
+      throw new PreconditionError("You have already approved this transaction.");
+    }
+    try {
+      const sent = await vault2.approveTransaction(hash);
+      const receipt = await sent.wait();
+      assertReceipt(receipt, "Approval", "The approval transaction reverted.");
+      return { chainTxHash: receipt.hash ?? receipt.transactionHash ?? "" };
+    } catch (err) {
+      throw toRevertError(err, "Approval failed");
+    }
+  }
+  async revokeApproval(txHash) {
+    const hash = normalizeTxHash(txHash);
+    const caller = await this.assertCallerIsOwner("Revoking an approval");
+    const vault2 = this.contract(true);
+    if (!await vault2.hasApproved(hash, caller)) {
+      throw new PreconditionError("You have no active approval on this transaction to revoke.");
+    }
+    try {
+      const sent = await vault2.revokeApproval(hash);
+      const receipt = await sent.wait();
+      assertReceipt(receipt, "Revocation", "The revocation transaction reverted.");
+      return { chainTxHash: receipt.hash ?? receipt.transactionHash ?? "" };
+    } catch (err) {
+      throw toRevertError(err, "Revoking the approval failed");
+    }
+  }
+  /**
+   * Execute a transaction that has reached quorum.
+   *
+   * The returned {@link ExecuteResult} says what actually happened. A successful
+   * receipt does not imply execution — see {@link classifyExecution}.
+   */
+  async execute(txHash) {
+    const hash = normalizeTxHash(txHash);
+    await this.assertCallerIsOwner("Executing a transaction");
+    await this.assertExecutable(hash);
+    const vault2 = this.contract(true);
+    try {
+      const sent = await vault2.executeTransaction(hash);
+      const receipt = await sent.wait();
+      assertReceipt(receipt, "Execution", "The execution transaction reverted.");
+      return classifyExecution(receipt, this.address, hash);
+    } catch (err) {
+      throw toRevertError(err, "Execution failed");
+    }
+  }
+  /** Approve and, if that meets quorum and the timelock allows, execute in one call. */
+  async approveAndExecute(txHash) {
+    const hash = normalizeTxHash(txHash);
+    const caller = await this.assertCallerIsOwner("Approving and executing");
+    const vault2 = this.contract(true);
+    if (await vault2.hasApproved(hash, caller)) {
+      throw new PreconditionError("You have already approved this transaction.", {
+        remediation: "Use execute() instead."
+      });
+    }
+    try {
+      const sent = await vault2.approveAndExecute(hash);
+      const receipt = await sent.wait();
+      assertReceipt(receipt, "Approve-and-execute", "The transaction reverted.");
+      return classifyExecution(receipt, this.address, hash);
+    } catch (err) {
+      throw toRevertError(err, "Approve-and-execute failed");
+    }
+  }
+  /** Cancel a transaction you proposed, before it ever reaches quorum. */
+  async cancel(txHash) {
+    const hash = normalizeTxHash(txHash);
+    const caller = await this.assertCallerIsOwner("Cancelling a transaction");
+    const tx = await this.fromChain(hash);
+    if (tx.proposer.toLowerCase() !== caller.toLowerCase()) {
+      throw new PreconditionError("Only the proposer can cancel a transaction directly.", {
+        remediation: "Propose a cancelByConsensus self-call instead."
+      });
+    }
+    if (tx.approvedAt !== 0) {
+      throw new PreconditionError(
+        "This transaction reached quorum, which permanently blocks proposer-cancel.",
+        { remediation: "Use propose.cancelByConsensus() instead." }
+      );
+    }
+    try {
+      const sent = await this.contract(true).cancelTransaction(hash);
+      const receipt = await sent.wait();
+      assertReceipt(receipt, "Cancellation", "The cancellation reverted.");
+      return { chainTxHash: receipt.hash ?? receipt.transactionHash ?? "" };
+    } catch (err) {
+      throw toRevertError(err, "Cancellation failed");
+    }
+  }
+  /** Close out an expired transaction. Permissionless — no ownership required. */
+  async expire(txHash) {
+    const hash = normalizeTxHash(txHash);
+    try {
+      const sent = await this.contract(true).expireTransaction(hash);
+      const receipt = await sent.wait();
+      assertReceipt(receipt, "Expiry", "The expiry transaction reverted.");
+      return { chainTxHash: receipt.hash ?? receipt.transactionHash ?? "" };
+    } catch (err) {
+      throw toRevertError(err, "Expiring the transaction failed");
+    }
+  }
+  // =========================================================================
+  // Preconditions
+  // =========================================================================
+  async assertCallerIsOwner(operation) {
+    const caller = await this.ctx.connection.address();
+    const isOwner = await this.contract().isOwner(caller);
+    if (!isOwner) {
+      throw new PreconditionError(`${operation} requires an owner. ${caller} is not one.`);
+    }
+    return getAddress5(caller);
+  }
+  /**
+   * Re-validate on chain immediately before signing an execute.
+   *
+   * Reads always go through the chain here, never the indexer: indexed approval
+   * counts can over-report after an owner removal, and a stale count must never gate
+   * a signature.
+   */
+  async assertExecutable(hash) {
+    const tx = await this.fromChain(hash);
+    if (tx.status === "executed" || tx.status === "failed") {
+      throw new PreconditionError("This transaction has already been executed.");
+    }
+    if (tx.status === "cancelled") {
+      throw new PreconditionError("This transaction has been cancelled.");
+    }
+    if (tx.status === "expired") {
+      throw new PreconditionError("This transaction has expired and can no longer execute.", {
+        remediation: "Call expire() to close it out, then propose a replacement."
+      });
+    }
+    if (tx.approvalCount < tx.threshold) {
+      throw new PreconditionError(
+        `Not enough approvals: ${tx.approvalCount} of ${tx.threshold}.`
+      );
+    }
+    if (tx.decoded?.name === "disableModule" && tx.decoded.target === "vault") {
+      const module = String(tx.decoded.args.module ?? "");
+      const bakedPrev = String(tx.decoded.args.prevModule ?? "");
+      const modules = await this.modules();
+      const index = modules.findIndex((m) => m.toLowerCase() === module.toLowerCase());
+      if (index === -1) {
+        throw new StaleProposalError(
+          `This proposal disables module ${module}, which is no longer enabled.`
+        );
+      }
+      const expectedPrev = index === 0 ? SENTINEL_MODULES : modules[index - 1];
+      if (expectedPrev.toLowerCase() !== bakedPrev.toLowerCase()) {
+        throw new StaleProposalError(
+          `The module list changed since this proposal was created: it names ${bakedPrev} as the predecessor of ${module}, but the current predecessor is ${expectedPrev}.`
+        );
+      }
+    }
+  }
+  // =========================================================================
+  // Holdings and activity
+  // =========================================================================
+  /**
+   * Native and token holdings.
+   *
+   * Token discovery needs the indexer — the chain cannot answer "which contracts has
+   * this address touched" without scanning every log. Amounts are verified on chain
+   * by default; pass `{ verify: false }` to accept replayed transfer totals instead.
+   */
+  async balances(options = {}) {
+    return loadBalances(this.ctx.connection, this.ctx.queries, this.address, options);
+  }
+  /** Native QUAI received by the vault. Indexer-only. */
+  async deposits(options = {}) {
+    return this.requireQueries("Listing deposits").deposits(this.address, options);
+  }
+  /** ERC20/721/1155 transfers involving this vault. Indexer-only. */
+  async tokenTransfers(options = {}) {
+    return this.requireQueries("Listing token transfers").tokenTransfers(this.address, options);
+  }
+  /** Message hashes currently signed by the vault for EIP-1271. Indexer-only. */
+  async signedMessages() {
+    return this.requireQueries("Listing signed messages").signedMessages(this.address);
+  }
+  /**
+   * Follow indexer changes for this vault over Supabase Realtime.
+   *
+   * Events fire after the indexer processes a block, so treat them as a signal to
+   * re-read rather than as state themselves — re-read through this handle so approval
+   * counts stay intersected with the current owner set.
+   *
+   * ```ts
+   * const sub = vault.watch((e) => console.log(e.topic, e.type));
+   * // …later
+   * await sub.unsubscribe();
+   * ```
+   */
+  watch(handler, options = {}) {
+    if (!this.ctx.indexer) throw new NoIndexerError("Watching a vault");
+    return watchVault(this.ctx.indexer, this.address, handler, options);
+  }
+  // =========================================================================
+  // Waiting
+  // =========================================================================
+  /**
+   * Block until the indexer has caught up to `blockNumber` (or to the chain head
+   * when omitted), so a subsequent indexed read reflects a write you just made.
+   *
+   * Returns `reached: false` on timeout rather than throwing — a lagging indexer is
+   * an expected operating condition, and the caller may reasonably fall back to a
+   * chain read. Requires an indexer; without one there is nothing to wait for.
+   */
+  async waitForIndexer(blockNumber, options = {}) {
+    if (!this.ctx.indexer) throw new NoIndexerError("Waiting for the indexer");
+    let target = blockNumber;
+    if (target === void 0) {
+      const zone = getZoneForAddress3(this.address);
+      if (!zone) {
+        throw new ValidationError(
+          `Cannot determine the Quai zone for vault ${this.address}; pass an explicit block number.`
+        );
+      }
+      target = Number(await this.ctx.connection.provider.getBlockNumber(toShard(zone)));
+    }
+    return this.ctx.indexer.waitForBlock(target, options);
+  }
+  /**
+   * Poll until a transaction is executable, then resolve with its current state.
+   *
+   * Lets a caller express "run this when it can run" instead of reimplementing the
+   * timelock arithmetic. Resolves as soon as the status reaches `ready`; rejects if
+   * the transaction reaches a terminal state first, or if the deadline passes.
+   *
+   * Reads go through the chain so the answer is authoritative — a `ready` verdict
+   * here is immediately actionable.
+   */
+  async waitForExecutable(txHash, options = {}) {
+    const hash = normalizeTxHash(txHash);
+    const timeoutMs = options.timeoutMs ?? 60 * 60 * 1e3;
+    const pollIntervalMs = options.pollIntervalMs ?? 15e3;
+    const deadline = Date.now() + timeoutMs;
+    for (; ; ) {
+      if (options.signal?.aborted) {
+        throw new PreconditionError("Waiting for the transaction was aborted.");
+      }
+      const tx = await this.fromChain(hash);
+      options.onPoll?.(tx);
+      if (tx.status === "ready") return tx;
+      if (tx.status === "executed" || tx.status === "failed") {
+        throw new PreconditionError(`Transaction ${hash} has already been executed.`);
+      }
+      if (tx.status === "cancelled" || tx.status === "expired") {
+        throw new PreconditionError(`Transaction ${hash} is ${tx.status} and can never execute.`);
+      }
+      if (tx.approvalCount < tx.threshold) {
+        throw new PreconditionError(
+          `Transaction ${hash} needs ${tx.threshold} approvals and has ${tx.approvalCount}. Waiting cannot resolve this.`,
+          { remediation: "Collect the remaining approvals, then wait for the timelock." }
+        );
+      }
+      const untilExecutable = tx.executableAfter > 0 ? tx.executableAfter * 1e3 - Date.now() : pollIntervalMs;
+      const wait = Math.max(1e3, Math.min(untilExecutable, pollIntervalMs));
+      if (Date.now() + wait > deadline) {
+        throw new PreconditionError(
+          `Timed out after ${timeoutMs}ms waiting for ${hash} to become executable.`,
+          {
+            ...tx.executableAfter > 0 ? { retryableAt: tx.executableAfter } : {},
+            remediation: tx.executableAfter > 0 ? `Executable after ${new Date(tx.executableAfter * 1e3).toISOString()}.` : "The timelock clock has not started yet."
+          }
+        );
+      }
+      await new Promise((resolve) => setTimeout(resolve, wait));
+    }
+  }
+  // =========================================================================
+  // Presentation
+  // =========================================================================
+  /** Compact human-readable summary of a transaction's state. */
+  async describe(txHash, caller) {
+    const tx = await this.transaction(txHash);
+    const lines = [
+      `Transaction ${tx.hash}`,
+      `  ${tx.summary}`,
+      `  status: ${tx.status} (${tx.approvalCount}/${tx.threshold} approvals)`
+    ];
+    if (tx.value > 0n) lines.push(`  value: ${formatQuai2(tx.value)} QUAI`);
+    if (tx.approvedAt > 0) {
+      lines.push(`  quorum reached: ${new Date(tx.approvedAt * 1e3).toISOString()}`);
+    }
+    if (tx.executableAfter > 0) {
+      const remaining = tx.executableAfter - nowSeconds();
+      lines.push(
+        `  executable after: ${new Date(tx.executableAfter * 1e3).toISOString()}` + (remaining > 0 ? ` (in ${remaining}s)` : " (now)")
+      );
+    }
+    if (tx.expiration > 0) {
+      lines.push(`  expires: ${new Date(tx.expiration * 1e3).toISOString()}`);
+    }
+    if (tx.decodedRevert) lines.push(`  revert: ${tx.decodedRevert.message}`);
+    lines.push(`  source: ${tx.source}`);
+    if (caller || this.ctx.connection.hasSigner()) {
+      const affordances = await this.affordances(txHash, caller);
+      const allowed = affordances.filter((a) => a.allowed).map((a) => a.action);
+      lines.push(`  you can: ${allowed.length > 0 ? allowed.join(", ") : "nothing right now"}`);
+    }
+    return lines.join("\n");
+  }
+};
+function assertReceipt(receipt, operation, revertMessage) {
+  if (!receipt) {
+    throw new RevertError(
+      `${operation} produced no receipt \u2014 the transaction was replaced or dropped before it was mined.`,
+      void 0,
+      { remediation: "Check the mempool for a replacement, then retry if it never landed." }
+    );
+  }
+  if (receipt.status === 0) throw new RevertError(revertMessage);
+}
+function proposeOptionsOf(options) {
+  return {
+    ...options.expiration != null ? { expiration: options.expiration } : {},
+    ...options.executionDelay != null ? { executionDelay: options.executionDelay } : {},
+    ...options.dryRun != null ? { dryRun: options.dryRun } : {}
+  };
+}
+function toRevertError(err, context) {
+  if (err instanceof RevertError || err instanceof PreconditionError) return err;
+  const decoded = decodeRevertFromError(err);
+  const detail = decoded ? `: ${decoded.message}` : "";
+  const base = err instanceof Error ? err.message : String(err);
+  return new RevertError(`${context}${detail || `: ${base}`}`, decoded, { cause: err });
+}
+
+// src/client.ts
+var QuaiVaultClient = class {
+  /**
+   * Resolved configuration, with the private key stripped and the indexer key
+   * masked — safe to log. The key itself is consumed once when building the signer.
+   */
+  config;
+  connection;
+  factory;
+  indexer;
+  queries;
+  constructor(options = {}) {
+    const resolved = resolveConfig(options);
+    this.config = redactConfig(resolved);
+    this.connection = new Connection(resolved, {
+      ...options.provider ? { provider: options.provider } : {},
+      ...options.signer ? { signer: options.signer } : {}
+    });
+    this.indexer = resolved.indexer ? new IndexerClient(resolved.indexer) : null;
+    this.queries = this.indexer ? new IndexerQueries(this.indexer) : null;
+    this.factory = new Factory({
+      connection: this.connection,
+      contracts: this.config.contracts
+    });
+  }
+  get network() {
+    return this.config.network;
+  }
+  get provider() {
+    return this.connection.provider;
+  }
+  get signer() {
+    return this.connection.signer;
+  }
+  /** The connected address, or null when read-only. */
+  async address() {
+    return this.connection.addressOrNull();
+  }
+  /** A handle to one vault. No I/O. */
+  vault(address2) {
+    return new Vault(address2, this.vaultContext());
+  }
+  vaultContext() {
+    return {
+      connection: this.connection,
+      indexer: this.indexer,
+      queries: this.queries,
+      contracts: this.config.contracts,
+      consistency: this.config.consistency,
+      maxIndexerLagBlocks: this.config.maxIndexerLagBlocks
+    };
+  }
+  /** Vault discovery. Requires the indexer — there is no on-chain reverse index. */
+  vaults = {
+    /**
+     * Vaults where `owner` is an active owner.
+     *
+     * Indexer-only: `factory.getWalletsByCreator` was removed from the contracts for
+     * gas reasons, and the factory registry is not indexed by owner.
+     */
+    forOwner: async (owner, options = {}) => {
+      const queries = this.requireQueries("Looking up vaults by owner");
+      const rows = await queries.vaultsForOwner(getAddress6(owner), options);
+      return rows.map((r) => getAddress6(r.address));
+    },
+    /** Vaults where `guardian` is an active social-recovery guardian. */
+    forGuardian: async (guardian, options = {}) => {
+      const queries = this.requireQueries("Looking up vaults by guardian");
+      const rows = await queries.vaultsForGuardian(getAddress6(guardian), options);
+      return rows.map((r) => getAddress6(r.address));
+    },
+    /** Whether an address is a vault this factory deployed or registered. */
+    exists: async (address2) => {
+      return this.factory.isRegistered(getAddress6(address2));
+    },
+    get: (address2) => this.vault(address2)
+  };
+  requireQueries(operation) {
+    if (!this.queries) throw new NoIndexerError(operation);
+    return this.queries;
+  }
+  /** Indexer liveness and lag. Reports unavailable when no indexer is configured. */
+  async indexerHealth() {
+    if (!this.indexer) {
+      return {
+        available: false,
+        lastIndexedBlock: 0,
+        isSyncing: false,
+        error: "no indexer configured"
+      };
+    }
+    return this.indexer.health();
+  }
+};
+function connect(options = {}) {
+  return new QuaiVaultClient(options);
+}
+var QuaiVault = { connect };
+export {
+  ConfigError,
+  Connection,
+  ENV_VARS,
+  Erc1155Abi,
+  Erc20Abi,
+  Erc721Abi,
+  Factory,
+  FactoryContract,
+  IndexerClient,
+  IndexerQueries,
+  IndexerQueryError,
+  MAX_EXECUTION_DELAY,
+  MAX_MODULES,
+  MAX_OWNERS,
+  MultiSendCallOnlyAbi,
+  NoIndexerError,
+  NoSignerError,
+  NotFoundError,
+  Operation,
+  PreconditionError,
+  QuaiVault,
+  QuaiVaultAbi,
+  QuaiVaultClient,
+  QuaiVaultError,
+  QuaiVaultFactoryAbi,
+  QuaiVaultProxyAbi,
+  QuaiVaultProxyBytecode,
+  RecoveryContract,
+  RecoveryModule,
+  RevertError,
+  SENTINEL_MODULES,
+  SaltMiningError,
+  SocialRecoveryModuleAbi,
+  StaleProposalError,
+  ValidationError,
+  Vault,
+  VaultContract,
+  allowedActions,
+  assertQuaiAddress,
+  assertQuaiAddresses,
+  classifyExecution,
+  computeAffordances,
+  computeBytecodeHash,
+  computeFullSalt,
+  connect,
+  decodeCall,
+  decodeMultiSendPayload,
+  decodeRevert,
+  decodeRevertFromError,
+  defaultStrategy,
+  deriveRecoveryStatus,
+  deriveStatus,
+  encodeInitData,
+  encodeMultiSend,
+  encodeMultiSendPayload,
+  executableAfterOf,
+  extractProposedTxHash,
+  schemas_exports as indexerSchemas,
+  inspectAddress,
+  interfaces,
+  isNetworkName,
+  isTerminal,
+  isTransient,
+  isUsableQuaiAddress,
+  knownErrorSelectors,
+  loadBalances,
+  mainnet,
+  mineSalt,
+  minimumExpiration,
+  networks,
+  nowSeconds,
+  predictVaultAddress,
+  recoveryCall,
+  remediationFor,
+  resolveConfig,
+  selfCall,
+  shardPrefixOf,
+  syncStrategy,
+  testnet,
+  token as tokenCalls,
+  watchVault,
+  withRetry,
+  workerThreadsStrategy
+};
+//# sourceMappingURL=index.js.map