@quaivault/sdk 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,2271 @@
+import * as quais from 'quais';
+import { Provider, Signer, Contract, Interface } from 'quais';
+export { Provider, Signer } from 'quais';
+import * as _supabase_postgrest_js from '@supabase/postgrest-js';
+import { SupabaseClient } from '@supabase/supabase-js';
+import { z } from 'zod';
+export { Erc1155Abi, Erc20Abi, Erc721Abi, MultiSendCallOnlyAbi, QuaiVaultAbi, QuaiVaultFactoryAbi, QuaiVaultProxyAbi, QuaiVaultProxyBytecode, SocialRecoveryModuleAbi } from './abi/index.js';
+
+declare const mainnet: NetworkConfig;
+declare const testnet: NetworkConfig;
+declare const networks: {
+    readonly mainnet: NetworkConfig;
+    readonly testnet: NetworkConfig;
+};
+type NetworkName = keyof typeof networks;
+declare function isNetworkName(value: unknown): value is NetworkName;
+
+type Address = string;
+type Hex = string;
+type Bytes32 = string;
+
+/** Zodiac IAvatar operation type. Mirrors `Enum.Operation` in the contracts. */
+declare enum Operation {
+    Call = 0,
+    DelegateCall = 1
+}
+interface ContractAddresses {
+    implementation: Address;
+    factory: Address;
+    socialRecovery?: Address;
+    multiSendCallOnly?: Address;
+}
+interface IndexerConfig {
+    /** Supabase project URL. */
+    url: string;
+    /** Public anon key. Read-only by RLS policy — safe to distribute. */
+    anonKey: string;
+    /** Postgres schema for this network (`mainnet`, `testnet`, `dev`). */
+    schema: string;
+    /** Base URL of the indexer health server, used for lag/liveness checks. */
+    healthUrl?: string;
+}
+interface NetworkConfig {
+    name: string;
+    chainId: number;
+    rpcUrl: string;
+    explorerUrl?: string;
+    contracts: ContractAddresses;
+    indexer?: IndexerConfig;
+}
+/**
+ * How reads resolve between the indexer and the chain.
+ *
+ * - `indexed` — indexer only. Fastest; may be stale; fails if the indexer is down.
+ * - `chain`   — RPC only. Authoritative; slower; some history queries are unavailable.
+ * - `auto`    — indexer when it is fresh enough (see {@link ClientOptions.maxIndexerLagBlocks}),
+ *               otherwise the chain. This is the default.
+ *
+ * Write paths always re-validate preconditions against the chain regardless of this
+ * setting — indexed approval counts can diverge from on-chain reality after an owner
+ * is removed (approval epochs), so they must never gate a signature.
+ */
+type Consistency = 'auto' | 'indexed' | 'chain';
+interface ClientOptions {
+    network?: NetworkConfig | keyof typeof networks;
+    provider?: Provider;
+    signer?: Signer;
+    /** Private key for a local signer. Prefer the `QUAIVAULT_PRIVATE_KEY` env var. */
+    privateKey?: string;
+    rpcUrl?: string;
+    indexer?: Partial<IndexerConfig>;
+    contracts?: Partial<ContractAddresses>;
+    consistency?: Consistency;
+    /** Beyond this many blocks behind, `auto` reads fall through to the chain. Default 50. */
+    maxIndexerLagBlocks?: number;
+    /** Read env vars for anything not passed explicitly. Default true. */
+    useEnv?: boolean;
+    /**
+     * Retry policy for transient RPC and indexer failures. Applies to reads only —
+     * writes are never retried, since a resubmit risks a double broadcast.
+     */
+    retry?: {
+        maxAttempts?: number;
+        baseDelayMs?: number;
+        maxDelayMs?: number;
+        onRetry?: (info: {
+            attempt: number;
+            delayMs: number;
+            error: unknown;
+        }) => void;
+    };
+}
+interface VaultInfo {
+    address: Address;
+    owners: Address[];
+    threshold: number;
+    /** Vault-level minimum timelock for external calls, in seconds. 0 = simple quorum. */
+    minExecutionDelay: number;
+    nonce: number;
+    balance: bigint;
+    moduleCount: number;
+}
+type TransactionKind = 'transfer' | 'erc20_transfer' | 'erc721_transfer' | 'erc1155_transfer' | 'wallet_admin' | 'module_config' | 'module_execution' | 'message_signing' | 'recovery_setup' | 'batched_call' | 'external_call' | 'unknown';
+/**
+ * Lifecycle state of a vault transaction.
+ *
+ * `ready` and `timelocked` are SDK-derived refinements of the contract's "pending":
+ * both mean not-yet-executed with quorum reached, differing only on whether the
+ * execution delay has elapsed.
+ */
+type TransactionStatus = 'pending' | 'timelocked' | 'ready' | 'executed' | 'failed' | 'cancelled' | 'expired';
+interface ApprovalRecord {
+    owner: Address;
+    /** Whether this approval currently counts toward the threshold. */
+    active: boolean;
+}
+interface DecodedCall {
+    /** Function name, e.g. `addOwner`. */
+    name: string;
+    signature: string;
+    args: Record<string, unknown>;
+    /** Contract the selector was resolved against. */
+    target: 'vault' | 'socialRecovery' | 'multiSend' | 'erc20' | 'erc721' | 'erc1155';
+}
+interface VaultTransaction {
+    hash: Bytes32;
+    vault: Address;
+    to: Address;
+    value: bigint;
+    data: Hex;
+    proposer: Address;
+    /** Unix seconds when the proposal was recorded on chain. */
+    proposedAt: number;
+    kind: TransactionKind;
+    decoded?: DecodedCall;
+    /** One-line human-readable description. */
+    summary: string;
+    status: TransactionStatus;
+    approvals: ApprovalRecord[];
+    /** Count of approvals that currently count toward the threshold. */
+    approvalCount: number;
+    threshold: number;
+    /** Unix seconds after which the tx can no longer execute. 0 = never expires. */
+    expiration: number;
+    /** Seconds of timelock locked in at proposal time. */
+    executionDelay: number;
+    /** Unix seconds when quorum was first reached. 0 = never reached. */
+    approvedAt: number;
+    /** `approvedAt + executionDelay`, or 0 if the clock has not started. */
+    executableAfter: number;
+    /** Raw revert data from a `TransactionFailed` event. */
+    failedReturnData?: Hex;
+    decodedRevert?: DecodedRevert;
+    /** Where this record came from. */
+    source: 'indexer' | 'chain';
+    /** Indexer head at read time; absent for chain reads. */
+    indexedAtBlock?: number;
+}
+interface DecodedRevert {
+    /** Custom error name, or `Error` / `Panic` for the builtins. */
+    name: string;
+    args: unknown[];
+    selector: Hex;
+    /** Human-readable rendering. */
+    message: string;
+}
+interface ProposeOptions {
+    /** Unix seconds after which the tx can no longer execute. 0 / omitted = no expiry. */
+    expiration?: number;
+    /** Extra delay beyond the vault floor, in seconds. */
+    executionDelay?: number;
+    /** Build and return the call without signing. */
+    dryRun?: boolean;
+}
+interface ProposeResult {
+    /** The vault-transaction hash (bytes32), not the Quai transaction hash. */
+    txHash: Bytes32;
+    /** The on-chain Quai transaction hash that carried the proposal. */
+    chainTxHash: Hex;
+    to: Address;
+    value: bigint;
+    data: Hex;
+}
+/** Result of a dry-run write: everything needed to inspect or submit later. */
+interface DryRunResult {
+    dryRun: true;
+    to: Address;
+    data: Hex;
+    value: bigint;
+    /** Estimated gas, or null if estimation reverted. */
+    gasEstimate: bigint | null;
+    /** Decoded revert if estimation failed. */
+    wouldRevert?: DecodedRevert;
+    description: string;
+}
+/**
+ * Outcome of an execute attempt.
+ *
+ * A successful Quai transaction receipt does NOT imply the vault transaction ran.
+ * See `docs/execution-outcomes.md`.
+ */
+type ExecuteOutcome = 'executed' | 'failed' | 'timelock_started' | 'approved_only';
+interface ExecuteResult {
+    outcome: ExecuteOutcome;
+    txHash: Bytes32;
+    chainTxHash: Hex;
+    blockNumber: number;
+    gasUsed: bigint;
+    /** Set when `outcome === 'failed'`. */
+    returnData?: Hex;
+    decodedRevert?: DecodedRevert;
+    /** Set when `outcome === 'timelock_started'`. Unix seconds. */
+    executableAfter?: number;
+    /** Set when `outcome === 'approved_only'`. */
+    approvalsNeeded?: number;
+    /** Human-readable explanation of what happened and what to do next. */
+    message: string;
+}
+type VaultAction = 'approve' | 'revokeApproval' | 'execute' | 'approveAndExecute' | 'cancel' | 'expire' | 'proposeCancelByConsensus';
+type AffordanceBlocker = 'not_owner' | 'already_approved' | 'not_approved' | 'threshold' | 'timelock' | 'expired' | 'terminal_state' | 'quorum_locked' | 'not_proposer' | 'no_expiration';
+interface Affordance {
+    action: VaultAction;
+    allowed: boolean;
+    /** Plain-language explanation, suitable for surfacing directly to a user. */
+    reason: string;
+    /** Unix seconds when a time gate lifts, if the only blocker is time. */
+    availableAt?: number;
+    blockedBy?: AffordanceBlocker;
+}
+interface CreateVaultParams {
+    owners: Address[];
+    threshold: number;
+    /** Vault-level minimum timelock in seconds. Max 30 days. Default 0. */
+    minExecutionDelay?: number;
+    /** Modules enabled at deploy time. */
+    initialModules?: Address[];
+    /** DelegateCall whitelist entries. Empty (default) means DelegateCall is disabled. */
+    initialDelegatecallTargets?: Address[];
+    /** Pre-mined salt. Omit to mine one automatically. */
+    salt?: Bytes32;
+}
+interface MinedSalt {
+    salt: Bytes32;
+    predictedAddress: Address;
+    attempts: number;
+    durationMs: number;
+}
+interface CreateVaultResult {
+    address: Address;
+    chainTxHash: Hex;
+    salt: Bytes32;
+    /** Whether the deployed address matched the mined prediction. */
+    predictionMatched: boolean;
+}
+interface RecoveryConfig {
+    guardians: Address[];
+    /** Guardian approvals required to execute a recovery. */
+    threshold: number;
+    /** Delay in seconds between initiation and executability. */
+    recoveryPeriod: number;
+    /** False when the vault has no recovery configured. */
+    configured: boolean;
+}
+/**
+ * Lifecycle state of a recovery request.
+ *
+ * `cancelled` is only ever reported from the indexer: `cancelRecovery` deletes the
+ * on-chain struct, so a chain read cannot distinguish a cancelled recovery from one
+ * that never existed.
+ */
+type RecoveryStatus = 'pending' | 'timelocked' | 'ready' | 'executed' | 'cancelled' | 'expired';
+interface RecoveryRequest {
+    hash: Bytes32;
+    vault: Address;
+    newOwners: Address[];
+    newThreshold: number;
+    approvalCount: number;
+    /** Threshold captured at initiation — config changes mid-recovery do not move it. */
+    requiredThreshold: number;
+    /** Unix seconds after which execution is permitted. */
+    executionTime: number;
+    /** Unix seconds after which the recovery is dead and can be cleaned up. */
+    expiration: number;
+    status: RecoveryStatus;
+    executed: boolean;
+    /** Guardians who have approved. Only populated on indexer reads. */
+    approvedBy?: Address[];
+    initiator?: Address;
+    source: 'indexer' | 'chain';
+}
+type RecoveryAction = 'approve' | 'revokeApproval' | 'execute' | 'cancel' | 'expire';
+interface RecoveryAffordance {
+    action: RecoveryAction;
+    allowed: boolean;
+    reason: string;
+    availableAt?: number;
+    blockedBy?: 'not_guardian' | 'not_owner' | 'already_approved' | 'not_approved' | 'threshold' | 'timelock' | 'expired' | 'not_expired' | 'terminal_state' | 'module_disabled';
+}
+interface Pagination {
+    limit?: number;
+    offset?: number;
+}
+interface Page<T> {
+    data: T[];
+    total: number;
+    hasMore: boolean;
+}
+interface IndexerHealth {
+    available: boolean;
+    lastIndexedBlock: number;
+    chainHead?: number;
+    blocksBehind?: number;
+    isSyncing: boolean;
+    /** Reason the indexer was judged unavailable. */
+    error?: string;
+}
+
+/**
+ * Retry policy for transient RPC and indexer failures.
+ *
+ * Scoped deliberately to **reads**. Retrying a write risks broadcasting the same
+ * transaction twice — a resubmit that looks like a timeout to the client may already
+ * be in the mempool — so every write path in this SDK calls through unretried.
+ */
+interface RetryOptions {
+    /** Total attempts including the first. Default 3. */
+    maxAttempts?: number;
+    /** First backoff delay. Doubles each attempt. Default 250ms. */
+    baseDelayMs?: number;
+    /** Ceiling on any single backoff. Default 4000ms. */
+    maxDelayMs?: number;
+    signal?: AbortSignal;
+    onRetry?: (info: {
+        attempt: number;
+        delayMs: number;
+        error: unknown;
+    }) => void;
+}
+/**
+ * Whether an error is worth retrying.
+ *
+ * Errs toward *not* retrying: an unrecognised error is treated as permanent, so a
+ * genuine bug surfaces immediately instead of being masked by three slow attempts.
+ */
+declare function isTransient(error: unknown): boolean;
+/**
+ * Run `fn`, retrying transient failures with exponential backoff and full jitter.
+ *
+ * Jitter matters more than usual here: several vaults refreshing on the same tick
+ * would otherwise retry in lockstep and hammer a rate-limited endpoint in waves.
+ */
+declare function withRetry<T>(fn: () => Promise<T>, options?: RetryOptions): Promise<T>;
+
+/**
+ * Environment variables read when `useEnv` is not disabled.
+ *
+ * Explicit `ClientOptions` always win over the environment; the environment always
+ * wins over the network preset. Nothing here is read at module load — resolution
+ * happens inside `connect()`, so importing the SDK never touches `process.env`.
+ */
+declare const ENV_VARS: {
+    readonly network: "QUAIVAULT_NETWORK";
+    readonly rpcUrl: "QUAIVAULT_RPC_URL";
+    readonly privateKey: "QUAIVAULT_PRIVATE_KEY";
+    readonly indexerUrl: "QUAIVAULT_INDEXER_URL";
+    readonly indexerAnonKey: "QUAIVAULT_INDEXER_ANON_KEY";
+    readonly indexerSchema: "QUAIVAULT_INDEXER_SCHEMA";
+    readonly indexerHealthUrl: "QUAIVAULT_INDEXER_HEALTH_URL";
+    readonly factory: "QUAIVAULT_FACTORY";
+    readonly implementation: "QUAIVAULT_IMPLEMENTATION";
+    readonly socialRecovery: "QUAIVAULT_SOCIAL_RECOVERY_MODULE";
+    readonly multiSendCallOnly: "QUAIVAULT_MULTISEND_CALL_ONLY";
+    readonly consistency: "QUAIVAULT_CONSISTENCY";
+    readonly maxIndexerLagBlocks: "QUAIVAULT_MAX_INDEXER_LAG_BLOCKS";
+};
+interface ResolvedConfig {
+    network: NetworkConfig;
+    contracts: ContractAddresses;
+    indexer?: IndexerConfig;
+    rpcUrl: string;
+    /**
+     * ⚠️ Secret. Consumed once to build a signer and never retained afterwards.
+     *
+     * Never log or serialise a `ResolvedConfig` that still carries this — use
+     * {@link redactConfig}, which is what `QuaiVaultClient.config` exposes.
+     */
+    privateKey?: string;
+    consistency: Consistency;
+    maxIndexerLagBlocks: number;
+    retry: RetryOptions;
+}
+/** A `ResolvedConfig` with the private key removed. Safe to log. */
+type PublicConfig = Omit<ResolvedConfig, 'privateKey'> & {
+    privateKey?: never;
+};
+/**
+ * Merge, in order of decreasing precedence: explicit options → environment →
+ * network preset defaults.
+ */
+declare function resolveConfig(options?: ClientOptions): ResolvedConfig;
+
+/**
+ * Owns the provider/signer pair and hands out contract instances.
+ *
+ * Quai RPC endpoints are shard-pathed (`https://host/cyprus1`), which `quais`
+ * handles via `usePathing: true` — the same setting the indexer uses.
+ */
+declare class Connection {
+    readonly provider: Provider;
+    /** Retry policy for reads. Shared with every contract facade this hands out. */
+    readonly retry: RetryOptions;
+    private readonly _signer;
+    constructor(config: ResolvedConfig, explicit?: {
+        provider?: Provider;
+        signer?: Signer;
+    });
+    get signer(): Signer | null;
+    hasSigner(): boolean;
+    /** The signer, or a typed error naming the operation that needs one. */
+    requireSigner(operation: string): Signer;
+    address(): Promise<Address>;
+    /** Connected address, or null when read-only. */
+    addressOrNull(): Promise<Address | null>;
+    vault(address: Address, write?: boolean): Contract;
+    factory(address: Address, write?: boolean): Contract;
+    socialRecovery(address: Address, write?: boolean): Contract;
+}
+
+interface MineSaltOptions {
+    factory: Address;
+    implementation: Address;
+    /** Address that will call `createWallet`. The mined address lands on its shard. */
+    deployer: Address;
+    params: CreateVaultParams;
+    /** Override the target shard prefix. Defaults to the deployer's. */
+    targetPrefix?: string;
+    maxAttempts?: number;
+    /** Abort after this long. Default 120_000 ms. */
+    timeoutMs?: number;
+    /** Called roughly every 1000 attempts. */
+    onProgress?: (attempts: number) => void;
+    signal?: AbortSignal;
+}
+interface MiningStrategy {
+    readonly name: string;
+    mine(options: Required<Pick<MineSaltOptions, 'factory' | 'deployer'>> & ResolvedMineJob): Promise<MinedSalt>;
+}
+/** Everything the inner loop needs, precomputed once. */
+interface ResolvedMineJob {
+    bytecodeHash: Bytes32;
+    targetPrefix: string;
+    maxAttempts: number;
+    timeoutMs: number;
+    onProgress?: (attempts: number) => void;
+    signal?: AbortSignal;
+}
+/**
+ * Chunked single-threaded miner. Yields to the event loop between chunks so it does
+ * not block a browser UI thread or a Node server's other work.
+ *
+ * Works everywhere, which makes it the safe default.
+ */
+declare const syncStrategy: MiningStrategy;
+/**
+ * Node-only multi-core miner. Falls back to {@link syncStrategy} when
+ * `node:worker_threads` is unavailable (browsers, restricted runtimes).
+ */
+declare const workerThreadsStrategy: MiningStrategy;
+/** Prefer worker_threads on Node; the sync miner degrades gracefully everywhere else. */
+declare function defaultStrategy(): MiningStrategy;
+/**
+ * Mine a CREATE2 salt that deploys a vault onto the deployer's Quai shard.
+ *
+ * The predicted address is a pure function of (factory, implementation, deployer,
+ * salt, create params) — so the caller can mine ahead of time, persist the salt,
+ * and deploy later, as long as every one of those inputs is unchanged.
+ */
+declare function mineSalt(options: MineSaltOptions, strategy?: MiningStrategy): Promise<MinedSalt>;
+
+interface CreateProgress {
+    step: 'validating' | 'mining' | 'deploying' | 'confirming' | 'done';
+    message: string;
+    attempts?: number;
+    predictedAddress?: Address;
+    chainTxHash?: Hex;
+}
+interface FactoryContext {
+    connection: Connection;
+    contracts: ContractAddresses;
+}
+/** Deploy and look up vaults through `QuaiVaultFactory`. */
+declare class Factory {
+    private readonly ctx;
+    constructor(ctx: FactoryContext);
+    get address(): Address;
+    private contract;
+    /** The implementation every proxy from this factory delegates to. */
+    implementation(): Promise<Address>;
+    /** Whether the factory has this vault in its registry. */
+    isRegistered(vault: Address): Promise<boolean>;
+    vaultCount(): Promise<number>;
+    vaultAt(index: number): Promise<Address>;
+    /**
+     * Verify the configured implementation address matches what the factory reports.
+     *
+     * A mismatch means salt mining will predict addresses the factory will not deploy
+     * to, so it is worth catching before a deployment rather than after.
+     */
+    verify(): Promise<{
+        valid: boolean;
+        errors: string[];
+    }>;
+    /** Off-chain CREATE2 prediction. Identical to `factory.predictWalletAddress`. */
+    predictAddress(deployer: Address, salt: Bytes32, params: CreateVaultParams): Address;
+    /**
+     * Mine a CREATE2 salt placing the vault on the deployer's shard.
+     *
+     * Quai addresses are shard-scoped, so an arbitrary salt usually produces a vault
+     * the deployer cannot reach. The mined salt is only valid for these exact create
+     * params — changing owners, threshold, delay, modules or delegatecall targets
+     * changes the predicted address.
+     */
+    mineSalt(params: CreateVaultParams, options?: Partial<Omit<MineSaltOptions, 'factory' | 'implementation' | 'params'>>, strategy?: MiningStrategy): Promise<MinedSalt>;
+    /**
+     * Deploy a vault, mining a salt first when one is not supplied.
+     *
+     * Always uses the 6-argument `createWallet` overload so the deployed bytecode
+     * matches what mining predicted, whatever combination of modules and delegatecall
+     * targets is requested.
+     */
+    create(params: CreateVaultParams, options?: {
+        onProgress?: (progress: CreateProgress) => void;
+        miningStrategy?: MiningStrategy;
+        maxAttempts?: number;
+        timeoutMs?: number;
+    }): Promise<CreateVaultResult>;
+    /** Register an externally deployed proxy. Callable only by one of its owners. */
+    register(vault: Address): Promise<{
+        chainTxHash: Hex;
+    }>;
+}
+
+/**
+ * The indexer uses one Postgres schema per network, chosen at runtime, so the
+ * client cannot be pinned to supabase-js's default `"public"` schema generic.
+ */
+type AnySupabaseClient = SupabaseClient<any, any, any, any, any>;
+/**
+ * Thin wrapper over the indexer's Supabase project.
+ *
+ * The anon key is a public read-only credential: the indexer's RLS grants `anon`
+ * SELECT on every table and nothing else, with all writes reserved for
+ * `service_role`. It carries no authority beyond reading already-public chain data.
+ */
+declare class IndexerClient {
+    readonly config: IndexerConfig;
+    private readonly client;
+    private healthCache;
+    private inflightHealth;
+    /** Health results are reused for this long to keep read paths cheap. */
+    readonly healthCacheMs: number;
+    constructor(config: IndexerConfig, options?: {
+        healthCacheMs?: number;
+    });
+    /** Raw Supabase client, for queries the SDK does not wrap. */
+    get raw(): AnySupabaseClient;
+    from(table: string): _supabase_postgrest_js.PostgrestQueryBuilder<any, any, any, string, unknown>;
+    /**
+     * Run a query, parse each row, and surface failures as `IndexerQueryError`.
+     *
+     * No retry wrapper here on purpose. `postgrest-js` already retries GET/HEAD/OPTIONS
+     * internally (3 attempts, retryable statuses and fetch errors, honouring
+     * `Retry-After`), and it reports failures as a resolved `{ error }` value rather
+     * than a rejection — so an outer `withRetry` would be dead code that silently
+     * multiplied attempts if it were ever made to work. Chain reads, which do reject,
+     * are retried in `src/chain/retry.ts`.
+     */
+    select<S extends z.ZodTypeAny>(table: string, schema: S, build: (q: ReturnType<AnySupabaseClient["from"]>) => PromiseLike<{
+        data: unknown[] | null;
+        error: {
+            message: string;
+            code?: string;
+        } | null;
+    }>): Promise<Array<z.infer<S>>>;
+    /** Single-row variant. Returns null for PostgREST's "no rows" code. */
+    selectOne<S extends z.ZodTypeAny>(table: string, schema: S, build: (q: ReturnType<AnySupabaseClient["from"]>) => PromiseLike<{
+        data: unknown | null;
+        error: {
+            message: string;
+            code?: string;
+        } | null;
+    }>): Promise<z.infer<S> | null>;
+    /** The indexer's sync head, straight from the `indexer_state` table. */
+    state(): Promise<{
+        lastIndexedBlock: number;
+        isSyncing: boolean;
+    } | null>;
+    /**
+     * Liveness and lag. Prefers the HTTP health endpoint (which knows the chain head)
+     * and falls back to the `indexer_state` table when it is unreachable.
+     */
+    health(force?: boolean): Promise<IndexerHealth>;
+    /**
+     * Block until the indexer has processed `blockNumber`.
+     *
+     * Closes the write-then-read race: a transaction confirmed at block N is not
+     * queryable until the indexer reaches N, so `propose()` immediately followed by
+     * `pendingTransactions()` will silently miss it. Await this in between.
+     *
+     * Resolves immediately when the head is already at or past the target.
+     */
+    waitForBlock(blockNumber: number, options?: {
+        timeoutMs?: number;
+        pollIntervalMs?: number;
+        signal?: AbortSignal;
+    }): Promise<{
+        reached: boolean;
+        lastIndexedBlock: number;
+    }>;
+    private probeHealth;
+}
+
+declare const WalletSchema: z.ZodObject<{
+    address: z.ZodString;
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    threshold: z.ZodNumber;
+    owner_count: z.ZodNumber;
+    created_at_block: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    created_at_tx: z.ZodString;
+    min_execution_delay: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    created_at: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    updated_at: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    address: string;
+    threshold: number;
+    owner_count: number;
+    created_at_block: string | number;
+    created_at_tx: string;
+    name?: string | null | undefined;
+    min_execution_delay?: number | null | undefined;
+    created_at?: string | null | undefined;
+    updated_at?: string | null | undefined;
+}, {
+    address: string;
+    threshold: number;
+    owner_count: number;
+    created_at_block: string | number;
+    created_at_tx: string;
+    name?: string | null | undefined;
+    min_execution_delay?: number | null | undefined;
+    created_at?: string | null | undefined;
+    updated_at?: string | null | undefined;
+}>;
+type WalletRow = z.infer<typeof WalletSchema>;
+declare const WalletOwnerSchema: z.ZodObject<{
+    wallet_address: z.ZodString;
+    owner_address: z.ZodString;
+    added_at_block: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    added_at_tx: z.ZodString;
+    removed_at_block: z.ZodOptional<z.ZodNullable<z.ZodUnion<[z.ZodNumber, z.ZodString]>>>;
+    removed_at_tx: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    is_active: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    wallet_address: string;
+    owner_address: string;
+    added_at_block: string | number;
+    added_at_tx: string;
+    is_active: boolean;
+    removed_at_block?: string | number | null | undefined;
+    removed_at_tx?: string | null | undefined;
+}, {
+    wallet_address: string;
+    owner_address: string;
+    added_at_block: string | number;
+    added_at_tx: string;
+    is_active: boolean;
+    removed_at_block?: string | number | null | undefined;
+    removed_at_tx?: string | null | undefined;
+}>;
+type WalletOwnerRow = z.infer<typeof WalletOwnerSchema>;
+declare const TransactionStatusEnum: z.ZodEnum<["pending", "executed", "cancelled", "expired", "failed"]>;
+declare const TransactionSchema: z.ZodObject<{
+    wallet_address: z.ZodString;
+    tx_hash: z.ZodString;
+    to_address: z.ZodString;
+    value: z.ZodString;
+    data: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    transaction_type: z.ZodString;
+    decoded_params: z.ZodOptional<z.ZodNullable<z.ZodUnknown>>;
+    status: z.ZodEnum<["pending", "executed", "cancelled", "expired", "failed"]>;
+    confirmation_count: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    submitted_by: z.ZodString;
+    submitted_at_block: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    submitted_at_tx: z.ZodString;
+    executed_at_block: z.ZodOptional<z.ZodNullable<z.ZodUnion<[z.ZodNumber, z.ZodString]>>>;
+    executed_at_tx: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    executed_by: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    cancelled_at_block: z.ZodOptional<z.ZodNullable<z.ZodUnion<[z.ZodNumber, z.ZodString]>>>;
+    cancelled_at_tx: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    expiration: z.ZodOptional<z.ZodNullable<z.ZodUnion<[z.ZodNumber, z.ZodString]>>>;
+    execution_delay: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    approved_at: z.ZodOptional<z.ZodNullable<z.ZodUnion<[z.ZodNumber, z.ZodString]>>>;
+    executable_after: z.ZodOptional<z.ZodNullable<z.ZodUnion<[z.ZodNumber, z.ZodString]>>>;
+    is_expired: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    failed_return_data: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    created_at: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    updated_at: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    value: string;
+    status: "executed" | "cancelled" | "pending" | "failed" | "expired";
+    wallet_address: string;
+    tx_hash: string;
+    to_address: string;
+    transaction_type: string;
+    submitted_by: string;
+    submitted_at_block: string | number;
+    submitted_at_tx: string;
+    data?: string | null | undefined;
+    expiration?: string | number | null | undefined;
+    created_at?: string | null | undefined;
+    updated_at?: string | null | undefined;
+    decoded_params?: unknown;
+    confirmation_count?: number | null | undefined;
+    executed_at_block?: string | number | null | undefined;
+    executed_at_tx?: string | null | undefined;
+    executed_by?: string | null | undefined;
+    cancelled_at_block?: string | number | null | undefined;
+    cancelled_at_tx?: string | null | undefined;
+    execution_delay?: number | null | undefined;
+    approved_at?: string | number | null | undefined;
+    executable_after?: string | number | null | undefined;
+    is_expired?: boolean | null | undefined;
+    failed_return_data?: string | null | undefined;
+}, {
+    value: string;
+    status: "executed" | "cancelled" | "pending" | "failed" | "expired";
+    wallet_address: string;
+    tx_hash: string;
+    to_address: string;
+    transaction_type: string;
+    submitted_by: string;
+    submitted_at_block: string | number;
+    submitted_at_tx: string;
+    data?: string | null | undefined;
+    expiration?: string | number | null | undefined;
+    created_at?: string | null | undefined;
+    updated_at?: string | null | undefined;
+    decoded_params?: unknown;
+    confirmation_count?: number | null | undefined;
+    executed_at_block?: string | number | null | undefined;
+    executed_at_tx?: string | null | undefined;
+    executed_by?: string | null | undefined;
+    cancelled_at_block?: string | number | null | undefined;
+    cancelled_at_tx?: string | null | undefined;
+    execution_delay?: number | null | undefined;
+    approved_at?: string | number | null | undefined;
+    executable_after?: string | number | null | undefined;
+    is_expired?: boolean | null | undefined;
+    failed_return_data?: string | null | undefined;
+}>;
+type TransactionRow = z.infer<typeof TransactionSchema>;
+declare const ConfirmationSchema: z.ZodObject<{
+    wallet_address: z.ZodString;
+    tx_hash: z.ZodString;
+    owner_address: z.ZodString;
+    confirmed_at_block: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    confirmed_at_tx: z.ZodString;
+    revoked_at_block: z.ZodOptional<z.ZodNullable<z.ZodUnion<[z.ZodNumber, z.ZodString]>>>;
+    revoked_at_tx: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    is_active: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    wallet_address: string;
+    owner_address: string;
+    is_active: boolean;
+    tx_hash: string;
+    confirmed_at_block: string | number;
+    confirmed_at_tx: string;
+    revoked_at_block?: string | number | null | undefined;
+    revoked_at_tx?: string | null | undefined;
+}, {
+    wallet_address: string;
+    owner_address: string;
+    is_active: boolean;
+    tx_hash: string;
+    confirmed_at_block: string | number;
+    confirmed_at_tx: string;
+    revoked_at_block?: string | number | null | undefined;
+    revoked_at_tx?: string | null | undefined;
+}>;
+type ConfirmationRow = z.infer<typeof ConfirmationSchema>;
+declare const WalletModuleSchema: z.ZodObject<{
+    wallet_address: z.ZodString;
+    module_address: z.ZodString;
+    enabled_at_block: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    enabled_at_tx: z.ZodString;
+    disabled_at_block: z.ZodOptional<z.ZodNullable<z.ZodUnion<[z.ZodNumber, z.ZodString]>>>;
+    disabled_at_tx: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    is_active: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    wallet_address: string;
+    is_active: boolean;
+    module_address: string;
+    enabled_at_block: string | number;
+    enabled_at_tx: string;
+    disabled_at_block?: string | number | null | undefined;
+    disabled_at_tx?: string | null | undefined;
+}, {
+    wallet_address: string;
+    is_active: boolean;
+    module_address: string;
+    enabled_at_block: string | number;
+    enabled_at_tx: string;
+    disabled_at_block?: string | number | null | undefined;
+    disabled_at_tx?: string | null | undefined;
+}>;
+type WalletModuleRow = z.infer<typeof WalletModuleSchema>;
+declare const DelegatecallTargetSchema: z.ZodObject<{
+    wallet_address: z.ZodString;
+    target_address: z.ZodString;
+    added_at_block: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    added_at_tx: z.ZodString;
+    removed_at_block: z.ZodOptional<z.ZodNullable<z.ZodUnion<[z.ZodNumber, z.ZodString]>>>;
+    removed_at_tx: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    is_active: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    wallet_address: string;
+    added_at_block: string | number;
+    added_at_tx: string;
+    is_active: boolean;
+    target_address: string;
+    removed_at_block?: string | number | null | undefined;
+    removed_at_tx?: string | null | undefined;
+}, {
+    wallet_address: string;
+    added_at_block: string | number;
+    added_at_tx: string;
+    is_active: boolean;
+    target_address: string;
+    removed_at_block?: string | number | null | undefined;
+    removed_at_tx?: string | null | undefined;
+}>;
+type DelegatecallTargetRow = z.infer<typeof DelegatecallTargetSchema>;
+declare const DepositSchema: z.ZodObject<{
+    wallet_address: z.ZodString;
+    sender_address: z.ZodString;
+    amount: z.ZodString;
+    deposited_at_block: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    deposited_at_tx: z.ZodString;
+    created_at: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    amount: string;
+    wallet_address: string;
+    sender_address: string;
+    deposited_at_block: string | number;
+    deposited_at_tx: string;
+    created_at?: string | null | undefined;
+}, {
+    amount: string;
+    wallet_address: string;
+    sender_address: string;
+    deposited_at_block: string | number;
+    deposited_at_tx: string;
+    created_at?: string | null | undefined;
+}>;
+type DepositRow = z.infer<typeof DepositSchema>;
+declare const TokenSchema: z.ZodObject<{
+    address: z.ZodString;
+    standard: z.ZodEnum<["ERC20", "ERC721", "ERC1155"]>;
+    symbol: z.ZodString;
+    name: z.ZodString;
+    decimals: z.ZodNumber;
+    discovered_at_block: z.ZodOptional<z.ZodNullable<z.ZodUnion<[z.ZodNumber, z.ZodString]>>>;
+    discovered_via: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    symbol: string;
+    address: string;
+    name: string;
+    standard: "ERC20" | "ERC721" | "ERC1155";
+    decimals: number;
+    discovered_at_block?: string | number | null | undefined;
+    discovered_via?: string | null | undefined;
+}, {
+    symbol: string;
+    address: string;
+    name: string;
+    standard: "ERC20" | "ERC721" | "ERC1155";
+    decimals: number;
+    discovered_at_block?: string | number | null | undefined;
+    discovered_via?: string | null | undefined;
+}>;
+type TokenRow = z.infer<typeof TokenSchema>;
+declare const TokenTransferSchema: z.ZodObject<{
+    token_address: z.ZodString;
+    wallet_address: z.ZodString;
+    from_address: z.ZodString;
+    to_address: z.ZodString;
+    value: z.ZodString;
+    token_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    batch_index: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    direction: z.ZodEnum<["inflow", "outflow"]>;
+    block_number: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    transaction_hash: z.ZodString;
+    log_index: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    value: string;
+    wallet_address: string;
+    to_address: string;
+    token_address: string;
+    from_address: string;
+    direction: "inflow" | "outflow";
+    block_number: string | number;
+    transaction_hash: string;
+    log_index: number;
+    token_id?: string | null | undefined;
+    batch_index?: number | null | undefined;
+}, {
+    value: string;
+    wallet_address: string;
+    to_address: string;
+    token_address: string;
+    from_address: string;
+    direction: "inflow" | "outflow";
+    block_number: string | number;
+    transaction_hash: string;
+    log_index: number;
+    token_id?: string | null | undefined;
+    batch_index?: number | null | undefined;
+}>;
+type TokenTransferRow = z.infer<typeof TokenTransferSchema>;
+declare const SignedMessageSchema: z.ZodObject<{
+    wallet_address: z.ZodString;
+    msg_hash: z.ZodString;
+    data: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    signed_at_block: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    signed_at_tx: z.ZodString;
+    unsigned_at_block: z.ZodOptional<z.ZodNullable<z.ZodUnion<[z.ZodNumber, z.ZodString]>>>;
+    unsigned_at_tx: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    is_active: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    wallet_address: string;
+    is_active: boolean;
+    msg_hash: string;
+    signed_at_block: string | number;
+    signed_at_tx: string;
+    data?: string | null | undefined;
+    unsigned_at_block?: string | number | null | undefined;
+    unsigned_at_tx?: string | null | undefined;
+}, {
+    wallet_address: string;
+    is_active: boolean;
+    msg_hash: string;
+    signed_at_block: string | number;
+    signed_at_tx: string;
+    data?: string | null | undefined;
+    unsigned_at_block?: string | number | null | undefined;
+    unsigned_at_tx?: string | null | undefined;
+}>;
+type SignedMessageRow = z.infer<typeof SignedMessageSchema>;
+declare const IndexerStateSchema: z.ZodObject<{
+    id: z.ZodString;
+    last_indexed_block: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    last_block_hash: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    last_indexed_at: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    is_syncing: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    last_indexed_block: string | number;
+    last_block_hash?: string | null | undefined;
+    last_indexed_at?: string | null | undefined;
+    is_syncing?: boolean | null | undefined;
+}, {
+    id: string;
+    last_indexed_block: string | number;
+    last_block_hash?: string | null | undefined;
+    last_indexed_at?: string | null | undefined;
+    is_syncing?: boolean | null | undefined;
+}>;
+type IndexerStateRow = z.infer<typeof IndexerStateSchema>;
+declare const RecoveryConfigSchema: z.ZodObject<{
+    wallet_address: z.ZodString;
+    threshold: z.ZodNumber;
+    recovery_period: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    setup_at_block: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    setup_at_tx: z.ZodString;
+    is_active: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    threshold: number;
+    wallet_address: string;
+    is_active: boolean;
+    recovery_period: string | number;
+    setup_at_block: string | number;
+    setup_at_tx: string;
+}, {
+    threshold: number;
+    wallet_address: string;
+    is_active: boolean;
+    recovery_period: string | number;
+    setup_at_block: string | number;
+    setup_at_tx: string;
+}>;
+type RecoveryConfigRow = z.infer<typeof RecoveryConfigSchema>;
+declare const RecoveryGuardianSchema: z.ZodObject<{
+    wallet_address: z.ZodString;
+    guardian_address: z.ZodString;
+    added_at_block: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    added_at_tx: z.ZodString;
+    is_active: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    wallet_address: string;
+    added_at_block: string | number;
+    added_at_tx: string;
+    is_active: boolean;
+    guardian_address: string;
+}, {
+    wallet_address: string;
+    added_at_block: string | number;
+    added_at_tx: string;
+    is_active: boolean;
+    guardian_address: string;
+}>;
+type RecoveryGuardianRow = z.infer<typeof RecoveryGuardianSchema>;
+declare const RecoverySchema: z.ZodObject<{
+    wallet_address: z.ZodString;
+    recovery_hash: z.ZodString;
+    new_owners: z.ZodArray<z.ZodString, "many">;
+    new_threshold: z.ZodNumber;
+    initiator_address: z.ZodString;
+    approval_count: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    required_threshold: z.ZodNumber;
+    execution_time: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    status: z.ZodEnum<["pending", "executed", "cancelled", "invalidated", "expired"]>;
+    initiated_at_block: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    initiated_at_tx: z.ZodString;
+    expiration: z.ZodOptional<z.ZodNullable<z.ZodUnion<[z.ZodNumber, z.ZodString]>>>;
+}, "strip", z.ZodTypeAny, {
+    status: "executed" | "cancelled" | "pending" | "expired" | "invalidated";
+    wallet_address: string;
+    recovery_hash: string;
+    new_owners: string[];
+    new_threshold: number;
+    initiator_address: string;
+    required_threshold: number;
+    execution_time: string | number;
+    initiated_at_block: string | number;
+    initiated_at_tx: string;
+    expiration?: string | number | null | undefined;
+    approval_count?: number | null | undefined;
+}, {
+    status: "executed" | "cancelled" | "pending" | "expired" | "invalidated";
+    wallet_address: string;
+    recovery_hash: string;
+    new_owners: string[];
+    new_threshold: number;
+    initiator_address: string;
+    required_threshold: number;
+    execution_time: string | number;
+    initiated_at_block: string | number;
+    initiated_at_tx: string;
+    expiration?: string | number | null | undefined;
+    approval_count?: number | null | undefined;
+}>;
+type RecoveryRow = z.infer<typeof RecoverySchema>;
+declare const RecoveryApprovalSchema: z.ZodObject<{
+    wallet_address: z.ZodString;
+    recovery_hash: z.ZodString;
+    guardian_address: z.ZodString;
+    approved_at_block: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    approved_at_tx: z.ZodString;
+    is_active: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    wallet_address: string;
+    is_active: boolean;
+    guardian_address: string;
+    recovery_hash: string;
+    approved_at_block: string | number;
+    approved_at_tx: string;
+}, {
+    wallet_address: string;
+    is_active: boolean;
+    guardian_address: string;
+    recovery_hash: string;
+    approved_at_block: string | number;
+    approved_at_tx: string;
+}>;
+type RecoveryApprovalRow = z.infer<typeof RecoveryApprovalSchema>;
+/** Coerce the bigint-ish columns Postgres returns as strings. */
+declare function toNumber(value: unknown, fallback?: number): number;
+
+type schemas_ConfirmationRow = ConfirmationRow;
+declare const schemas_ConfirmationSchema: typeof ConfirmationSchema;
+type schemas_DelegatecallTargetRow = DelegatecallTargetRow;
+declare const schemas_DelegatecallTargetSchema: typeof DelegatecallTargetSchema;
+type schemas_DepositRow = DepositRow;
+declare const schemas_DepositSchema: typeof DepositSchema;
+type schemas_IndexerStateRow = IndexerStateRow;
+declare const schemas_IndexerStateSchema: typeof IndexerStateSchema;
+type schemas_RecoveryApprovalRow = RecoveryApprovalRow;
+declare const schemas_RecoveryApprovalSchema: typeof RecoveryApprovalSchema;
+type schemas_RecoveryConfigRow = RecoveryConfigRow;
+declare const schemas_RecoveryConfigSchema: typeof RecoveryConfigSchema;
+type schemas_RecoveryGuardianRow = RecoveryGuardianRow;
+declare const schemas_RecoveryGuardianSchema: typeof RecoveryGuardianSchema;
+type schemas_RecoveryRow = RecoveryRow;
+declare const schemas_RecoverySchema: typeof RecoverySchema;
+type schemas_SignedMessageRow = SignedMessageRow;
+declare const schemas_SignedMessageSchema: typeof SignedMessageSchema;
+type schemas_TokenRow = TokenRow;
+declare const schemas_TokenSchema: typeof TokenSchema;
+type schemas_TokenTransferRow = TokenTransferRow;
+declare const schemas_TokenTransferSchema: typeof TokenTransferSchema;
+type schemas_TransactionRow = TransactionRow;
+declare const schemas_TransactionSchema: typeof TransactionSchema;
+declare const schemas_TransactionStatusEnum: typeof TransactionStatusEnum;
+type schemas_WalletModuleRow = WalletModuleRow;
+declare const schemas_WalletModuleSchema: typeof WalletModuleSchema;
+type schemas_WalletOwnerRow = WalletOwnerRow;
+declare const schemas_WalletOwnerSchema: typeof WalletOwnerSchema;
+type schemas_WalletRow = WalletRow;
+declare const schemas_WalletSchema: typeof WalletSchema;
+declare const schemas_toNumber: typeof toNumber;
+declare namespace schemas {
+  export { type schemas_ConfirmationRow as ConfirmationRow, schemas_ConfirmationSchema as ConfirmationSchema, type schemas_DelegatecallTargetRow as DelegatecallTargetRow, schemas_DelegatecallTargetSchema as DelegatecallTargetSchema, type schemas_DepositRow as DepositRow, schemas_DepositSchema as DepositSchema, type schemas_IndexerStateRow as IndexerStateRow, schemas_IndexerStateSchema as IndexerStateSchema, type schemas_RecoveryApprovalRow as RecoveryApprovalRow, schemas_RecoveryApprovalSchema as RecoveryApprovalSchema, type schemas_RecoveryConfigRow as RecoveryConfigRow, schemas_RecoveryConfigSchema as RecoveryConfigSchema, type schemas_RecoveryGuardianRow as RecoveryGuardianRow, schemas_RecoveryGuardianSchema as RecoveryGuardianSchema, type schemas_RecoveryRow as RecoveryRow, schemas_RecoverySchema as RecoverySchema, type schemas_SignedMessageRow as SignedMessageRow, schemas_SignedMessageSchema as SignedMessageSchema, type schemas_TokenRow as TokenRow, schemas_TokenSchema as TokenSchema, type schemas_TokenTransferRow as TokenTransferRow, schemas_TokenTransferSchema as TokenTransferSchema, type schemas_TransactionRow as TransactionRow, schemas_TransactionSchema as TransactionSchema, schemas_TransactionStatusEnum as TransactionStatusEnum, type schemas_WalletModuleRow as WalletModuleRow, schemas_WalletModuleSchema as WalletModuleSchema, type schemas_WalletOwnerRow as WalletOwnerRow, schemas_WalletOwnerSchema as WalletOwnerSchema, type schemas_WalletRow as WalletRow, schemas_WalletSchema as WalletSchema, schemas_toNumber as toNumber };
+}
+
+declare class IndexerQueries {
+    private readonly client;
+    constructor(client: IndexerClient);
+    wallet(address: Address): Promise<WalletRow | null>;
+    /** Active owner addresses, lowercased as stored. */
+    owners(address: Address): Promise<string[]>;
+    vaultsForOwner(owner: Address, options?: Pagination): Promise<WalletRow[]>;
+    vaultsForGuardian(guardian: Address, options?: Pagination): Promise<WalletRow[]>;
+    pendingTransactions(vault: Address, options?: Pagination): Promise<TransactionRow[]>;
+    transaction(vault: Address, txHash: string): Promise<TransactionRow | null>;
+    transactionHistory(vault: Address, options?: Pagination & {
+        status?: string[];
+    }): Promise<Page<TransactionRow>>;
+    /** All confirmations for one transaction, including revoked ones. */
+    confirmations(vault: Address, txHash: string): Promise<ConfirmationRow[]>;
+    /**
+     * Active confirmations for many transactions in one round trip.
+     *
+     * "Active" here means not revoked. It does NOT mean the confirming address is
+     * still an owner — the indexer does not deactivate confirmations when an owner is
+     * removed, while the contract invalidates them via approval epochs. Callers must
+     * intersect with the active owner set; `Vault` does this for you.
+     */
+    activeConfirmationsBatch(vault: Address, txHashes: string[]): Promise<Map<string, ConfirmationRow[]>>;
+    modules(vault: Address): Promise<string[]>;
+    delegatecallTargets(vault: Address): Promise<string[]>;
+    deposits(vault: Address, options?: Pagination): Promise<Page<DepositRow>>;
+    tokenTransfers(vault: Address, options?: Pagination): Promise<Page<TokenTransferRow>>;
+    tokens(addresses: string[]): Promise<TokenRow[]>;
+    signedMessages(vault: Address): Promise<SignedMessageRow[]>;
+    recoveryConfig(vault: Address): Promise<{
+        threshold: number;
+        recoveryPeriod: number;
+        guardians: string[];
+    } | null>;
+    pendingRecoveries(vault: Address): Promise<RecoveryRow[]>;
+    recoveryHistory(vault: Address, options?: Pagination): Promise<RecoveryRow[]>;
+    recoveryApprovals(vault: Address, recoveryHash: string): Promise<RecoveryApprovalRow[]>;
+}
+
+interface RecoveryModuleContext {
+    connection: Connection;
+    queries: IndexerQueries | null;
+    vaultAddress: Address;
+    moduleAddress: Address | undefined;
+}
+/**
+ * Guardian-based recovery for one vault.
+ *
+ * Recovery is an escape hatch that bypasses the owner multisig entirely: enough
+ * guardians can replace the owner set after a delay. Every write here is therefore
+ * gated on the module still being enabled on the vault, which is the vault owners'
+ * only lever once guardians are configured.
+ */
+declare class RecoveryModule {
+    private readonly ctx;
+    constructor(ctx: RecoveryModuleContext);
+    /** The module address, or a typed error naming the variable to set. */
+    get address(): Address;
+    private contract;
+    private get vault();
+    /** Whether the module is currently enabled on the vault. */
+    isEnabled(): Promise<boolean>;
+    config(): Promise<RecoveryConfig>;
+    isGuardian(address: Address): Promise<boolean>;
+    /** Hashes of recoveries the module still tracks as pending. */
+    pendingHashes(): Promise<Bytes32[]>;
+    hasPending(): Promise<boolean>;
+    /**
+     * One recovery request, read from chain.
+     *
+     * Throws `NotFoundError` for a hash that was never initiated *or* was cancelled —
+     * `cancelRecovery` deletes the struct, so the two are indistinguishable on chain.
+     * Use {@link history} for cancelled recoveries.
+     */
+    get(recoveryHash: Bytes32): Promise<RecoveryRequest>;
+    /** Every recovery the module still tracks as pending, hydrated. */
+    pending(): Promise<RecoveryRequest[]>;
+    /**
+     * Full recovery history including executed, cancelled and expired requests.
+     * Indexer-only — the chain retains no record of cancelled recoveries.
+     */
+    history(options?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<RecoveryRequest[]>;
+    /** Guardians who have an active approval on a recovery. */
+    approvals(recoveryHash: Bytes32): Promise<Address[]>;
+    /** Hash the next `initiate` with these parameters would produce. */
+    predictHash(newOwners: Address[], newThreshold: number): Promise<Bytes32>;
+    /**
+     * Initiate a recovery. Guardians only.
+     *
+     * Returns the recovery hash, read from the `RecoveryInitiated` event — the function's
+     * return value is not recoverable from a receipt.
+     */
+    initiate(params: {
+        newOwners: Address[];
+        newThreshold: number;
+    }): Promise<{
+        recoveryHash: Bytes32;
+        chainTxHash: Hex;
+    }>;
+    /** Approve a recovery. Guardians only. */
+    approve(recoveryHash: Bytes32): Promise<{
+        chainTxHash: Hex;
+    }>;
+    /** Withdraw a guardian approval before the recovery executes. */
+    revokeApproval(recoveryHash: Bytes32): Promise<{
+        chainTxHash: Hex;
+    }>;
+    /**
+     * Execute a recovery, replacing the vault's owner set. Permissionless once the
+     * guardian threshold is met and the recovery period has elapsed.
+     */
+    execute(recoveryHash: Bytes32): Promise<{
+        chainTxHash: Hex;
+    }>;
+    /**
+     * Cancel a recovery. Callable by any current vault owner — this is the owners'
+     * defence against a hostile or mistaken guardian action.
+     */
+    cancel(recoveryHash: Bytes32): Promise<{
+        chainTxHash: Hex;
+    }>;
+    /** Clean up a recovery past its deadline. Permissionless. */
+    expire(recoveryHash: Bytes32): Promise<{
+        chainTxHash: Hex;
+    }>;
+    /** What `caller` may do to a recovery right now, and when blocked actions unlock. */
+    affordances(recoveryHash: Bytes32, caller?: Address): Promise<RecoveryAffordance[]>;
+    private buildFromChain;
+    private validateNewOwners;
+    private assertLive;
+    private assertEnabled;
+    private send;
+    private extractRecoveryHash;
+    private toRevert;
+}
+
+interface TokenBalance {
+    token: Address;
+    standard: 'ERC20' | 'ERC721' | 'ERC1155';
+    symbol: string;
+    name: string;
+    decimals: number;
+    /** ERC20: raw units. ERC721: number held. ERC1155: total across ids. */
+    balance: bigint;
+    /** ERC721 / ERC1155 only. */
+    tokenIds?: string[];
+    /** True when the balance came from an on-chain read rather than transfer replay. */
+    verified: boolean;
+    /**
+     * Set when more candidate ids existed than `maxTokenIdChecks` allowed, so
+     * `tokenIds` is a subset. The `balance` is still the authoritative on-chain count.
+     */
+    tokenIdsTruncated?: boolean;
+}
+interface VaultBalances {
+    native: bigint;
+    tokens: TokenBalance[];
+    /**
+     * Set when a scan limit was hit, so the result may be incomplete. Silent
+     * truncation would read as "these are all the holdings" when they are not.
+     */
+    truncated?: {
+        /** More transfer history existed than `transferScanLimit` scanned. */
+        transfers?: boolean;
+        /** More distinct tokens were discovered than `maxTokens` allowed. */
+        tokens?: boolean;
+    };
+}
+interface BalanceOptions {
+    /**
+     * Confirm each candidate balance with an on-chain read. Slower, but authoritative —
+     * a token that moved through a path the indexer does not observe still reports
+     * correctly. Default true.
+     */
+    verify?: boolean;
+    /** Cap on tokens considered, newest activity first. Default 50. */
+    maxTokens?: number;
+    /**
+     * How many recent transfer rows to scan when discovering tokens. Default 500.
+     *
+     * A vault with more transfers than this may not surface its oldest holdings, so
+     * raise it for long-lived vaults. Reported back in {@link VaultBalances.truncated}.
+     */
+    transferScanLimit?: number;
+    /** Cap on ERC721 ids ownership-checked per token. Default 100. */
+    maxTokenIdChecks?: number;
+}
+/**
+ * Aggregate a vault's holdings.
+ *
+ * Discovery is indexer-driven: `token_transfers` tells us which contracts a vault has
+ * ever touched, which the chain cannot answer without scanning every log. Amounts are
+ * then read on chain by default, because replaying transfers misses anything the
+ * indexer did not observe (a token discovered after the transfer, a rebasing balance,
+ * a direct mint). Set `verify: false` to skip the reads and accept replayed totals.
+ */
+declare function loadBalances(connection: Connection, queries: IndexerQueries | null, vault: Address, options?: BalanceOptions): Promise<VaultBalances>;
+
+/** Indexer tables a vault subscription can follow. */
+type WatchTopic = 'transactions' | 'confirmations' | 'owners' | 'modules' | 'deposits' | 'tokenTransfers' | 'recoveries' | 'signedMessages';
+interface WatchEvent {
+    topic: WatchTopic;
+    table: string;
+    /** Postgres operation that produced the event. */
+    type: 'INSERT' | 'UPDATE' | 'DELETE';
+    /** Row after the change. Absent for DELETE. */
+    row: Record<string, unknown> | null;
+    /** Row before the change, when the table's replica identity provides it. */
+    previous: Record<string, unknown> | null;
+}
+interface WatchOptions {
+    topics?: WatchTopic[];
+    /** Called on subscription lifecycle changes, so callers can surface reconnects. */
+    onStatus?: (status: string, error?: Error) => void;
+}
+/** Handle returned by {@link watchVault}. Call `unsubscribe` to release the channel. */
+interface Subscription {
+    unsubscribe(): Promise<void>;
+    readonly topics: WatchTopic[];
+}
+/**
+ * Follow indexer changes for one vault over Supabase Realtime.
+ *
+ * All topics share a single channel — one WebSocket per vault rather than one per
+ * table, which matters because Realtime caps concurrent channels per client.
+ *
+ * Realtime delivers *indexer* writes, so events arrive only after the indexer has
+ * processed the block. It is a change feed, not a chain subscription: use it to know
+ * when to re-read, and re-read through `Vault` so approval counts stay correct.
+ */
+declare function watchVault(client: IndexerClient, vault: Address, handler: (event: WatchEvent) => void, options?: WatchOptions): Subscription;
+
+interface DecodeContext {
+    /** The vault the transaction belongs to — used to detect self-calls. */
+    vault: Address;
+    to: Address;
+    value: bigint;
+    data: Hex;
+    /** Known module addresses, for classifying `module_config` calls. */
+    socialRecovery?: Address;
+    multiSendCallOnly?: Address;
+}
+interface DecodeResult {
+    kind: TransactionKind;
+    decoded?: DecodedCall;
+    summary: string;
+}
+/**
+ * Classify and describe a proposed vault transaction from its calldata.
+ *
+ * Resolution order matters: self-calls are checked against the vault ABI first,
+ * because several vault selectors would otherwise be ambiguous with token calls.
+ */
+declare function decodeCall(ctx: DecodeContext): DecodeResult;
+interface DecodedBatchCall {
+    operation: number;
+    to: Address;
+    value: bigint;
+    data: Hex;
+}
+/**
+ * Unpack a MultiSend payload into its constituent calls.
+ * Layout per call: `operation(1) ‖ to(20) ‖ value(32) ‖ dataLength(32) ‖ data`.
+ */
+declare function decodeMultiSendPayload(payload: Hex): DecodedBatchCall[];
+
+declare const interfaces: {
+    vault: Interface;
+    recovery: Interface;
+    multiSend: Interface;
+    erc20: Interface;
+    erc721: Interface;
+    erc1155: Interface;
+};
+/** Max value the contracts accept for `minExecutionDelay` / `requestedDelay` (30 days). */
+declare const MAX_EXECUTION_DELAY: number;
+declare const MAX_OWNERS = 20;
+declare const MAX_MODULES = 50;
+/** Head of the Zodiac module linked list. */
+declare const SENTINEL_MODULES = "0x0000000000000000000000000000000000000001";
+declare const selfCall: {
+    addOwner: (owner: Address) => Hex;
+    removeOwner: (owner: Address) => Hex;
+    changeThreshold: (threshold: number) => Hex;
+    enableModule: (module: Address) => Hex;
+    /**
+     * Disable a module.
+     *
+     * `prevModule` is the predecessor in the Zodiac linked list and must be resolved
+     * against the live list — a proposal built against a stale list can never execute.
+     * Prefer `Vault.propose.disableModule`, which resolves it for you.
+     */
+    disableModule: (prevModule: Address, module: Address) => Hex;
+    setMinExecutionDelay: (seconds: number) => Hex;
+    addDelegatecallTarget: (target: Address) => Hex;
+    removeDelegatecallTarget: (target: Address) => Hex;
+    cancelByConsensus: (txHash: Hex) => Hex;
+    /** Sign arbitrary bytes. For EIP-1271 hash pre-approval use {@link approveHashForEip1271}. */
+    signMessage: (data: Hex) => Hex;
+    unsignMessage: (data: Hex) => Hex;
+    /**
+     * Pre-approve a hash so `isValidSignature(hash, …)` returns the EIP-1271 magic value.
+     *
+     * `isValidSignature(h)` checks `signedMessages[getMessageHash(abi.encode(h))]`, while
+     * `signMessage(data)` stores `getMessageHash(data)`. Because `abi.encode` of a static
+     * `bytes32` is the identity on its 32 bytes, this produces calldata identical to
+     * `signMessage(hash)` — the encoding step is a no-op for a well-formed hash.
+     *
+     * It is a separate helper because the *length* is what matters: signing an
+     * arbitrary-length message `M` does NOT make `isValidSignature(keccak256(M))`
+     * validate, since EIP-1271 hashes the 32-byte dataHash, not `M`. This entry point
+     * enforces the 32-byte precondition and states the intent, so that mistake is
+     * caught here rather than discovered when a counterparty's check silently fails.
+     */
+    approveHashForEip1271: (hash: Hex) => Hex;
+    /** Revoke a hash previously approved via {@link approveHashForEip1271}. */
+    revokeHashForEip1271: (hash: Hex) => Hex;
+};
+declare const token: {
+    erc20Transfer: (to: Address, amount: bigint) => Hex;
+    erc20Approve: (spender: Address, amount: bigint) => Hex;
+    erc721Transfer: (from: Address, to: Address, tokenId: bigint) => Hex;
+    erc1155Transfer: (from: Address, to: Address, id: bigint, amount: bigint, data?: Hex) => Hex;
+    erc1155BatchTransfer: (from: Address, to: Address, ids: bigint[], amounts: bigint[], data?: Hex) => Hex;
+};
+declare const recoveryCall: {
+    /** Encoded for a vault-proposed call to the module (not a self-call). */
+    setupRecovery: (vaultAddress: Address, guardians: Address[], threshold: number, recoveryPeriodSeconds: number) => Hex;
+};
+interface BatchCall {
+    to: Address;
+    value?: bigint;
+    data?: Hex;
+}
+/**
+ * Pack calls into MultiSendCallOnly's transaction blob:
+ * `operation(1) ‖ to(20) ‖ value(32) ‖ dataLength(32) ‖ data`, concatenated.
+ *
+ * `MultiSendCallOnly` rejects nested DelegateCall, so operation is always 0.
+ */
+declare function encodeMultiSendPayload(calls: BatchCall[]): Hex;
+/** Full `multiSend(bytes)` calldata for a batch of calls. */
+declare function encodeMultiSend(calls: BatchCall[]): Hex;
+/**
+ * Smallest expiration the contract will accept for a given delay.
+ *
+ * `_proposeTransaction` rejects `expiration <= block.timestamp + effectiveDelay` with
+ * `ExpirationTooSoon`, so a proposal must leave at least one execution opportunity
+ * after the timelock elapses. The margin absorbs the gap between building the
+ * proposal and it being mined.
+ */
+declare function minimumExpiration(effectiveDelaySeconds: number, marginSeconds?: number, at?: number): number;
+
+interface VaultContext {
+    connection: Connection;
+    indexer: IndexerClient | null;
+    queries: IndexerQueries | null;
+    contracts: ContractAddresses;
+    consistency: Consistency;
+    maxIndexerLagBlocks: number;
+}
+/** A handle to one deployed vault. Cheap to construct; performs no I/O until used. */
+declare class Vault {
+    readonly address: Address;
+    /** Guardian-based recovery for this vault. */
+    readonly recovery: RecoveryModule;
+    private readonly ctx;
+    constructor(address: Address, ctx: VaultContext);
+    /**
+     * Whether an indexer read is acceptable right now.
+     *
+     * `auto` uses the indexer only while it is live and within the configured lag
+     * budget, so a stalled indexer silently degrades to chain reads instead of
+     * serving stale state.
+     */
+    private useIndexer;
+    private requireQueries;
+    private contract;
+    /** Owners, threshold, timelock floor, nonce and balance. Always read from chain. */
+    info(): Promise<VaultInfo>;
+    /** Active owners. Prefers the indexer, falls back to chain. */
+    owners(): Promise<Address[]>;
+    isOwner(address: Address): Promise<boolean>;
+    threshold(): Promise<number>;
+    balance(): Promise<bigint>;
+    /**
+     * Enabled modules, in linked-list order.
+     *
+     * Order matters: `disableModule` needs each module's predecessor, so this always
+     * reads the chain rather than the indexer (which stores an unordered set).
+     */
+    modules(): Promise<Address[]>;
+    isModuleEnabled(module: Address): Promise<boolean>;
+    /** Addresses permitted as DelegateCall targets. Empty means DelegateCall is disabled. */
+    delegatecallTargets(): Promise<Address[]>;
+    isDelegatecallAllowed(target: Address): Promise<boolean>;
+    /** Whether a hash has been pre-approved for EIP-1271 validation. */
+    isValidSignature(hash: Bytes32): Promise<boolean>;
+    /** The vault-transaction hash for a given call, at a given nonce. */
+    transactionHash(to: Address, value: bigint, data: Hex, nonce?: number): Promise<Bytes32>;
+    transaction(txHash: Bytes32): Promise<VaultTransaction>;
+    pendingTransactions(options?: Pagination): Promise<VaultTransaction[]>;
+    transactionHistory(options?: Pagination & {
+        status?: string[];
+    }): Promise<Page<VaultTransaction>>;
+    private hydrateRows;
+    private fromIndexer;
+    /**
+     * Build a `VaultTransaction` from an indexed row.
+     *
+     * Approval counting intersects the indexer's confirmations with the current owner
+     * set. The indexer marks a confirmation inactive only on an explicit
+     * `ApprovalRevoked`; it does not react to `OwnerRemoved`. On chain, removing an
+     * owner bumps `ownerVersions` and invalidates every approval that address made, so
+     * the stored `confirmation_count` over-reports after any removal. Intersecting here
+     * reproduces the contract's `_countValidApprovals`.
+     */
+    private buildTransaction;
+    /** Authoritative read: the struct plus a `hasApproved` probe per current owner. */
+    private fromChain;
+    /**
+     * What `caller` may legally do to `txHash` right now, and when blocked actions
+     * become available. Defaults to the connected signer's address.
+     */
+    affordances(txHash: Bytes32, caller?: Address): Promise<Affordance[]>;
+    /**
+     * Proposal builders.
+     *
+     * Every method here is async, including the ones whose work is purely local. Mixing
+     * synchronous throws with rejected promises is a footgun: `propose.addOwner(bad)`
+     * would throw before `.catch()` could attach. Validation failures are always
+     * rejections.
+     */
+    readonly propose: {
+        /** Propose an arbitrary call. Every other `propose.*` helper routes through this. */
+        call: (params: {
+            to: Address;
+            value?: bigint;
+            data?: Hex;
+        } & ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        /** Send native QUAI. */
+        transfer: (params: {
+            to: Address;
+            amount: bigint;
+        } & ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        erc20Transfer: (params: {
+            token: Address;
+            to: Address;
+            amount: bigint;
+        } & ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        erc721Transfer: (params: {
+            token: Address;
+            to: Address;
+            tokenId: bigint;
+        } & ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        erc1155Transfer: (params: {
+            token: Address;
+            to: Address;
+            id: bigint;
+            amount: bigint;
+            data?: Hex;
+        } & ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        /**
+         * Batch several calls through MultiSendCallOnly.
+         *
+         * Requires MultiSendCallOnly to be on this vault's DelegateCall whitelist, which
+         * is empty by default. The precondition is checked before signing so the failure
+         * names the missing `addDelegatecallTarget` proposal instead of reverting.
+         */
+        batch: (calls: BatchCall[], options?: ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        addOwner: (owner: Address, options?: ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        removeOwner: (owner: Address, options?: ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        changeThreshold: (threshold: number, options?: ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        setMinExecutionDelay: (seconds: number, options?: ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        enableModule: (module: Address, options?: ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        /**
+         * Disable a module, resolving its predecessor in the Zodiac linked list.
+         *
+         * The predecessor is baked into the proposal, so any module added or removed
+         * before this executes invalidates it. `execute` re-checks and raises
+         * `StaleProposalError` rather than letting it revert on chain.
+         */
+        disableModule: (module: Address, options?: ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        addDelegatecallTarget: (target: Address, options?: ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        removeDelegatecallTarget: (target: Address, options?: ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        /** Cancel a transaction that has already reached quorum. Needs full consensus. */
+        cancelByConsensus: (txHash: Bytes32, options?: ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        /** Sign arbitrary bytes. For EIP-1271 hash approval use `approveHashForEip1271`. */
+        signMessage: (message: Hex, options?: ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        unsignMessage: (message: Hex, options?: ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        /**
+         * Make `isValidSignature(hash, …)` return the EIP-1271 magic value.
+         *
+         * Enforces the 32-byte precondition: signing an arbitrary-length message `M`
+         * does not make `isValidSignature(keccak256(M))` validate, because EIP-1271
+         * hashes the dataHash itself, not `M`.
+         */
+        approveHashForEip1271: (hash: Bytes32, options?: ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        revokeHashForEip1271: (hash: Bytes32, options?: ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+        /** Configure social recovery. A call to the module, not a self-call. */
+        setupRecovery: (params: {
+            guardians: Address[];
+            threshold: number;
+            recoveryPeriodSeconds: number;
+        } & ProposeOptions) => Promise<ProposeResult | DryRunResult>;
+    };
+    /** Predecessor of `module` in the Zodiac linked list, for `disableModule`. */
+    previousModule(module: Address): Promise<Address>;
+    private proposeSelfCall;
+    private proposeCall;
+    private minExecutionDelay;
+    approve(txHash: Bytes32): Promise<{
+        chainTxHash: Hex;
+    }>;
+    revokeApproval(txHash: Bytes32): Promise<{
+        chainTxHash: Hex;
+    }>;
+    /**
+     * Execute a transaction that has reached quorum.
+     *
+     * The returned {@link ExecuteResult} says what actually happened. A successful
+     * receipt does not imply execution — see {@link classifyExecution}.
+     */
+    execute(txHash: Bytes32): Promise<ExecuteResult>;
+    /** Approve and, if that meets quorum and the timelock allows, execute in one call. */
+    approveAndExecute(txHash: Bytes32): Promise<ExecuteResult>;
+    /** Cancel a transaction you proposed, before it ever reaches quorum. */
+    cancel(txHash: Bytes32): Promise<{
+        chainTxHash: Hex;
+    }>;
+    /** Close out an expired transaction. Permissionless — no ownership required. */
+    expire(txHash: Bytes32): Promise<{
+        chainTxHash: Hex;
+    }>;
+    private assertCallerIsOwner;
+    /**
+     * Re-validate on chain immediately before signing an execute.
+     *
+     * Reads always go through the chain here, never the indexer: indexed approval
+     * counts can over-report after an owner removal, and a stale count must never gate
+     * a signature.
+     */
+    private assertExecutable;
+    /**
+     * Native and token holdings.
+     *
+     * Token discovery needs the indexer — the chain cannot answer "which contracts has
+     * this address touched" without scanning every log. Amounts are verified on chain
+     * by default; pass `{ verify: false }` to accept replayed transfer totals instead.
+     */
+    balances(options?: BalanceOptions): Promise<VaultBalances>;
+    /** Native QUAI received by the vault. Indexer-only. */
+    deposits(options?: Pagination): Promise<Page<{
+        amount: string;
+        wallet_address: string;
+        sender_address: string;
+        deposited_at_block: string | number;
+        deposited_at_tx: string;
+        created_at?: string | null | undefined;
+    }>>;
+    /** ERC20/721/1155 transfers involving this vault. Indexer-only. */
+    tokenTransfers(options?: Pagination): Promise<Page<{
+        value: string;
+        wallet_address: string;
+        to_address: string;
+        token_address: string;
+        from_address: string;
+        direction: "inflow" | "outflow";
+        block_number: string | number;
+        transaction_hash: string;
+        log_index: number;
+        token_id?: string | null | undefined;
+        batch_index?: number | null | undefined;
+    }>>;
+    /** Message hashes currently signed by the vault for EIP-1271. Indexer-only. */
+    signedMessages(): Promise<{
+        wallet_address: string;
+        is_active: boolean;
+        msg_hash: string;
+        signed_at_block: string | number;
+        signed_at_tx: string;
+        data?: string | null | undefined;
+        unsigned_at_block?: string | number | null | undefined;
+        unsigned_at_tx?: string | null | undefined;
+    }[]>;
+    /**
+     * Follow indexer changes for this vault over Supabase Realtime.
+     *
+     * Events fire after the indexer processes a block, so treat them as a signal to
+     * re-read rather than as state themselves — re-read through this handle so approval
+     * counts stay intersected with the current owner set.
+     *
+     * ```ts
+     * const sub = vault.watch((e) => console.log(e.topic, e.type));
+     * // …later
+     * await sub.unsubscribe();
+     * ```
+     */
+    watch(handler: (event: WatchEvent) => void, options?: WatchOptions): Subscription;
+    /**
+     * Block until the indexer has caught up to `blockNumber` (or to the chain head
+     * when omitted), so a subsequent indexed read reflects a write you just made.
+     *
+     * Returns `reached: false` on timeout rather than throwing — a lagging indexer is
+     * an expected operating condition, and the caller may reasonably fall back to a
+     * chain read. Requires an indexer; without one there is nothing to wait for.
+     */
+    waitForIndexer(blockNumber?: number, options?: {
+        timeoutMs?: number;
+        pollIntervalMs?: number;
+        signal?: AbortSignal;
+    }): Promise<{
+        reached: boolean;
+        lastIndexedBlock: number;
+    }>;
+    /**
+     * Poll until a transaction is executable, then resolve with its current state.
+     *
+     * Lets a caller express "run this when it can run" instead of reimplementing the
+     * timelock arithmetic. Resolves as soon as the status reaches `ready`; rejects if
+     * the transaction reaches a terminal state first, or if the deadline passes.
+     *
+     * Reads go through the chain so the answer is authoritative — a `ready` verdict
+     * here is immediately actionable.
+     */
+    waitForExecutable(txHash: Bytes32, options?: {
+        /** Give up after this long. Default 1 hour. */
+        timeoutMs?: number;
+        /** Poll interval. Default 15s, roughly three Quai blocks. */
+        pollIntervalMs?: number;
+        signal?: AbortSignal;
+        onPoll?: (tx: VaultTransaction) => void;
+    }): Promise<VaultTransaction>;
+    /** Compact human-readable summary of a transaction's state. */
+    describe(txHash: Bytes32, caller?: Address): Promise<string>;
+}
+
+/**
+ * Entry point to the SDK.
+ *
+ * Construct with {@link connect}. Nothing here performs I/O until a method is
+ * called, so building a client is cheap and safe at module scope.
+ */
+declare class QuaiVaultClient {
+    /**
+     * Resolved configuration, with the private key stripped and the indexer key
+     * masked — safe to log. The key itself is consumed once when building the signer.
+     */
+    readonly config: PublicConfig;
+    readonly connection: Connection;
+    readonly factory: Factory;
+    readonly indexer: IndexerClient | null;
+    readonly queries: IndexerQueries | null;
+    constructor(options?: ClientOptions);
+    get network(): NetworkConfig;
+    get provider(): Provider;
+    get signer(): Signer | null;
+    /** The connected address, or null when read-only. */
+    address(): Promise<Address | null>;
+    /** A handle to one vault. No I/O. */
+    vault(address: Address): Vault;
+    private vaultContext;
+    /** Vault discovery. Requires the indexer — there is no on-chain reverse index. */
+    readonly vaults: {
+        /**
+         * Vaults where `owner` is an active owner.
+         *
+         * Indexer-only: `factory.getWalletsByCreator` was removed from the contracts for
+         * gas reasons, and the factory registry is not indexed by owner.
+         */
+        forOwner: (owner: Address, options?: Pagination) => Promise<Address[]>;
+        /** Vaults where `guardian` is an active social-recovery guardian. */
+        forGuardian: (guardian: Address, options?: Pagination) => Promise<Address[]>;
+        /** Whether an address is a vault this factory deployed or registered. */
+        exists: (address: Address) => Promise<boolean>;
+        get: (address: Address) => Vault;
+    };
+    private requireQueries;
+    /** Indexer liveness and lag. Reports unavailable when no indexer is configured. */
+    indexerHealth(): Promise<IndexerHealth>;
+}
+/**
+ * Create a client.
+ *
+ * Configuration resolves in order of decreasing precedence: explicit options,
+ * environment variables, then the network preset. With nothing supplied it targets
+ * mainnet over the public RPC in read-only mode.
+ *
+ * ```ts
+ * // read-only, from env (QUAIVAULT_NETWORK, QUAIVAULT_INDEXER_ANON_KEY, …)
+ * const qv = connect();
+ *
+ * // read-write against testnet
+ * const qv = connect({ network: 'testnet', privateKey: process.env.KEY });
+ * ```
+ */
+declare function connect(options?: ClientOptions): QuaiVaultClient;
+/** Namespace form, for callers who prefer `QuaiVault.connect(…)`. */
+declare const QuaiVault: {
+    connect: typeof connect;
+};
+
+/**
+ * Raw `Transaction` struct as returned by `QuaiVault.transactions(bytes32)`.
+ * Field names match the Solidity struct.
+ */
+interface RawTransactionStruct {
+    to: string;
+    timestamp: bigint;
+    expiration: bigint;
+    proposer: string;
+    executed: boolean;
+    cancelled: boolean;
+    approvedAt: bigint;
+    executionDelay: bigint;
+    value: bigint;
+    data: string;
+}
+/**
+ * Typed facade over the generated `Contract`.
+ *
+ * `quais` types its dynamic method accessor as possibly-undefined and cannot
+ * disambiguate overloads by arity, so every call here goes through `getFunction`
+ * with an explicit signature. Keeping that in one place means callers get real
+ * types and overload selection is stated once, next to the ABI it depends on.
+ */
+declare class VaultContract {
+    readonly contract: Contract;
+    private readonly retry;
+    constructor(contract: Contract, retry?: RetryOptions);
+    private fn;
+    /**
+     * Reads retry transient RPC failures (see {@link withRetry}); writes never do,
+     * because a resubmit that looks like a timeout may already be in the mempool.
+     */
+    private read;
+    get interface(): quais.Interface;
+    getOwners(): Promise<string[]>;
+    isOwner(address: Address): Promise<boolean>;
+    threshold(): Promise<bigint>;
+    nonce(): Promise<bigint>;
+    minExecutionDelay(): Promise<bigint>;
+    moduleCount(): Promise<bigint>;
+    getModules(): Promise<string[]>;
+    isModuleEnabled(module: Address): Promise<boolean>;
+    delegatecallAllowed(target: Address): Promise<boolean>;
+    transactions(txHash: Bytes32): Promise<RawTransactionStruct>;
+    /**
+     * Whether an owner's approval currently counts toward the threshold.
+     * Accounts for approval-epoch invalidation from owner removal.
+     */
+    hasApproved(txHash: Bytes32, owner: Address): Promise<boolean>;
+    /** True when the transaction was closed by `expireTransaction`, not cancelled. */
+    expiredTxs(txHash: Bytes32): Promise<boolean>;
+    getTransactionHash(to: Address, value: bigint, data: Hex, nonce: number | bigint): Promise<Bytes32>;
+    isValidSignature(hash: Bytes32, signature: Hex): Promise<string>;
+    /**
+     * Overload with expiration and delay. The 3-argument overload is used when
+     * neither is supplied, so a caller that wants no expiry never has to pass 0.
+     */
+    proposeTransactionFull(to: Address, value: bigint, data: Hex, expiration: number, executionDelay: number): Promise<ContractTransactionResponse>;
+    proposeTransactionSimple(to: Address, value: bigint, data: Hex): Promise<ContractTransactionResponse>;
+    approveTransaction(txHash: Bytes32): Promise<ContractTransactionResponse>;
+    approveAndExecute(txHash: Bytes32): Promise<ContractTransactionResponse>;
+    executeTransaction(txHash: Bytes32): Promise<ContractTransactionResponse>;
+    revokeApproval(txHash: Bytes32): Promise<ContractTransactionResponse>;
+    cancelTransaction(txHash: Bytes32): Promise<ContractTransactionResponse>;
+    expireTransaction(txHash: Bytes32): Promise<ContractTransactionResponse>;
+    encode(signature: string, args: unknown[]): Hex;
+}
+/** Minimal shape of a sent transaction — enough to await a receipt. */
+interface ContractTransactionResponse {
+    hash: string;
+    wait(confirmations?: number): Promise<unknown>;
+}
+/** Typed facade over `QuaiVaultFactory`. */
+declare class FactoryContract {
+    readonly contract: Contract;
+    private readonly retry;
+    constructor(contract: Contract, retry?: RetryOptions);
+    private fn;
+    /**
+     * Reads retry transient RPC failures (see {@link withRetry}); writes never do,
+     * because a resubmit that looks like a timeout may already be in the mempool.
+     */
+    private read;
+    get interface(): quais.Interface;
+    implementation(): Promise<string>;
+    isWallet(address: Address): Promise<boolean>;
+    getWalletCount(): Promise<bigint>;
+    deployedWallets(index: number | bigint): Promise<string>;
+    predictWalletAddress(deployer: Address, salt: Bytes32, owners: Address[], threshold: number, minExecutionDelay: number, initialModules: Address[], initialDelegatecallTargets: Address[]): Promise<string>;
+    /** Full 6-argument overload. The SDK always uses it so mining stays consistent. */
+    createWallet(owners: Address[], threshold: number, salt: Bytes32, minExecutionDelay: number, initialModules: Address[], initialDelegatecallTargets: Address[]): Promise<ContractTransactionResponse>;
+    registerWallet(wallet: Address): Promise<ContractTransactionResponse>;
+}
+
+/** Raw `RecoveryConfig` struct from `getRecoveryConfig(address)`. */
+interface RawRecoveryConfig {
+    guardians: string[];
+    threshold: bigint;
+    recoveryPeriod: bigint;
+}
+/** Raw `Recovery` struct from `getRecovery(address,bytes32)`. */
+interface RawRecovery {
+    newOwners: string[];
+    newThreshold: bigint;
+    approvalCount: bigint;
+    executionTime: bigint;
+    expiration: bigint;
+    requiredThreshold: bigint;
+    executed: boolean;
+}
+/**
+ * Typed facade over `SocialRecoveryModule`.
+ *
+ * Every function is wallet-scoped: one module deployment serves every vault, so the
+ * vault address is always the first argument.
+ */
+declare class RecoveryContract {
+    readonly contract: Contract;
+    private readonly retry;
+    constructor(contract: Contract, retry?: RetryOptions);
+    private fn;
+    /**
+     * Reads retry transient RPC failures (see {@link withRetry}); writes never do,
+     * because a resubmit that looks like a timeout may already be in the mempool.
+     */
+    private read;
+    get interface(): quais.Interface;
+    getRecoveryConfig(vault: Address): Promise<RawRecoveryConfig>;
+    getRecovery(vault: Address, recoveryHash: Bytes32): Promise<RawRecovery>;
+    isGuardian(vault: Address, guardian: Address): Promise<boolean>;
+    getPendingRecoveryHashes(vault: Address): Promise<string[]>;
+    hasPendingRecoveries(vault: Address): Promise<boolean>;
+    recoveryApprovals(vault: Address, recoveryHash: Bytes32, guardian: Address): Promise<boolean>;
+    recoveryNonces(vault: Address): Promise<bigint>;
+    maxGuardians(): Promise<bigint>;
+    /** Hash for an explicit nonce. Use {@link predictNextRecoveryHash} for the next one. */
+    getRecoveryHash(vault: Address, newOwners: Address[], newThreshold: number, nonce: bigint | number): Promise<Bytes32>;
+    /** Hash the next `initiateRecovery` would produce, at the current nonce. */
+    predictNextRecoveryHash(vault: Address, newOwners: Address[], newThreshold: number): Promise<Bytes32>;
+    initiateRecovery(vault: Address, newOwners: Address[], newThreshold: number): Promise<ContractTransactionResponse>;
+    approveRecovery(vault: Address, recoveryHash: Bytes32): Promise<ContractTransactionResponse>;
+    revokeRecoveryApproval(vault: Address, recoveryHash: Bytes32): Promise<ContractTransactionResponse>;
+    executeRecovery(vault: Address, recoveryHash: Bytes32): Promise<ContractTransactionResponse>;
+    cancelRecovery(vault: Address, recoveryHash: Bytes32): Promise<ContractTransactionResponse>;
+    expireRecovery(vault: Address, recoveryHash: Bytes32): Promise<ContractTransactionResponse>;
+}
+
+interface ReceiptLike {
+    hash?: string;
+    transactionHash?: string;
+    blockNumber?: number | bigint | null;
+    gasUsed?: bigint | number | null;
+    status?: number | null;
+    logs: ReadonlyArray<{
+        topics: ReadonlyArray<string>;
+        data: string;
+        address?: string;
+    }>;
+}
+/**
+ * Classify what actually happened to a vault transaction, from the receipt of the
+ * Quai transaction that carried `execute` / `approveAndExecute`.
+ *
+ * This exists because `receipt.status === 1` does NOT mean the vault transaction ran.
+ * Three cases produce a successful receipt with no execution:
+ *
+ * 1. **Lazy timelock clock** — `executeTransaction` on a timelocked transaction whose
+ *    `approvedAt` was never set (e.g. the threshold was lowered after owners approved)
+ *    sets `approvedAt`, emits `ThresholdReached`, and returns without executing. It
+ *    deliberately does not revert, because a revert would roll back the clock start.
+ * 2. **`approveAndExecute` returned false** — the threshold is unmet, or the timelock
+ *    has not elapsed. A boolean return value is invisible in a receipt.
+ * 3. **External call failure (Option B)** — the vault marks the transaction `executed`
+ *    permanently and emits `TransactionFailed` instead of reverting. The vault
+ *    transaction is dead; the receipt says success.
+ */
+declare function classifyExecution(receipt: ReceiptLike, vault: string, txHash: Bytes32): ExecuteResult;
+/**
+ * Pull the vault-transaction hash out of a `proposeTransaction` receipt.
+ * The `TransactionProposed` event is the only reliable source — `proposeTransaction`
+ * returns the hash, but return values are not available from a receipt.
+ */
+declare function extractProposedTxHash(receipt: ReceiptLike, vault: string): Bytes32 | null;
+
+interface RawTransactionState {
+    executed: boolean;
+    cancelled: boolean;
+    /** From `expiredTxs[txHash]` — distinguishes expiry from voluntary cancellation. */
+    isExpired?: boolean;
+    expiration: number;
+    executionDelay: number;
+    approvedAt: number;
+    approvalCount: number;
+    threshold: number;
+    /** Set when a TransactionFailed event was indexed. */
+    failed?: boolean;
+}
+declare function nowSeconds(): number;
+/**
+ * `approvedAt + executionDelay`, or 0 when the timelock clock has not started.
+ *
+ * `approvedAt` is written once, on the first threshold crossing, and is never
+ * cleared — revoking approvals below the threshold does not reset the clock.
+ */
+declare function executableAfterOf(approvedAt: number, executionDelay: number): number;
+/**
+ * Derive the lifecycle status from raw contract state.
+ *
+ * `ready` and `timelocked` refine the contract's "pending": both mean not yet
+ * executed with quorum reached, differing only on whether the delay has elapsed.
+ * The contract has no such distinction — it is computed here so callers do not
+ * have to reimplement the timelock arithmetic.
+ */
+declare function deriveStatus(state: RawTransactionState, at?: number): TransactionStatus;
+/** Whether the status admits no further state transitions. */
+declare function isTerminal(status: TransactionStatus): boolean;
+interface RawRecoveryState {
+    executed: boolean;
+    approvalCount: number;
+    /** Threshold captured at initiation, not the current config. */
+    requiredThreshold: number;
+    executionTime: number;
+    expiration: number;
+}
+/**
+ * Derive a recovery's lifecycle status from raw module state.
+ *
+ * Expiry is computed from `expiration` rather than taken from a stored flag, because
+ * nothing transitions a recovery to expired on its own — `expireRecovery` is a
+ * permissionless cleanup call somebody has to make. The indexer only writes an
+ * expired status when it sees `RecoveryExpiredEvent`, so an un-cleaned recovery reads
+ * as `pending` there long after it died. Computing it here keeps the SDK honest
+ * regardless of which side the data came from.
+ *
+ * `cancelled` is never returned: `cancelRecovery` deletes the on-chain struct, so it
+ * is only observable through indexed history.
+ */
+declare function deriveRecoveryStatus(state: RawRecoveryState, at?: number): Exclude<RecoveryStatus, 'cancelled'>;
+
+interface AffordanceContext {
+    tx: VaultTransaction;
+    caller: Address;
+    isOwner: boolean;
+    /** Whether `caller` currently has a threshold-counting approval. */
+    hasApproved: boolean;
+    at?: number;
+}
+/**
+ * Enumerate which actions `caller` may legally take on `tx` right now, and when a
+ * blocked action becomes available.
+ *
+ * Every rule here mirrors an on-chain check, so callers can plan instead of
+ * discovering constraints through reverted transactions:
+ *
+ * - `onlyOwner` on approve / revoke / execute / cancel
+ * - epoch-based approvals (`_approvalValid`) for already-approved / not-approved
+ * - `approvedAt != 0` permanently locking proposer-cancel, even after revocations
+ * - the timelock on external calls (self-calls bypass it)
+ * - expiration, and the permissionless `expireTransaction` cleanup path
+ */
+declare function computeAffordances(ctx: AffordanceContext): Affordance[];
+/** The subset of actions currently allowed. */
+declare function allowedActions(affordances: Affordance[]): Affordance[];
+
+/**
+ * Encode the `initialize` call the factory delegatecalls from the proxy constructor.
+ *
+ * This MUST match `QuaiVaultFactory._createWallet` exactly — including the module and
+ * delegatecall-target arrays. Encoding `[]` for those while deploying with a non-empty
+ * array yields a different bytecode hash, so the mined address will not be the address
+ * the factory actually deploys to.
+ */
+declare function encodeInitData(params: {
+    owners: Address[];
+    threshold: number;
+    minExecutionDelay?: number;
+    initialModules?: Address[];
+    initialDelegatecallTargets?: Address[];
+}): string;
+/**
+ * keccak256 of the full proxy creation bytecode (creation code + ABI-encoded
+ * constructor args), which is the third input to CREATE2.
+ *
+ * Constant for a given set of create params, so it is computed once and reused
+ * across every mining attempt.
+ */
+declare function computeBytecodeHash(implementation: Address, initData: string): Bytes32;
+/**
+ * The factory namespaces user salts by caller:
+ * `fullSalt = keccak256(abi.encodePacked(msg.sender, userSalt))`.
+ * Two deployers using the same user salt therefore get different addresses.
+ */
+declare function computeFullSalt(deployer: Address, userSalt: Bytes32): Bytes32;
+/**
+ * Reproduce `QuaiVaultFactory.predictWalletAddress` off-chain — no RPC needed.
+ */
+declare function predictVaultAddress(args: {
+    factory: Address;
+    implementation: Address;
+    deployer: Address;
+    salt: Bytes32;
+    params: CreateVaultParams;
+}): Address;
+/**
+ * The shard prefix of a Quai address: `0x` plus the leading byte.
+ *
+ * Quai addresses are shard-scoped. A vault deployed outside the deployer's shard is
+ * unreachable from it, which is why deployment requires mining a salt rather than
+ * picking one at random.
+ */
+declare function shardPrefixOf(address: Address): string;
+
+/**
+ * Address validation for Quai's dual-ledger, sharded address space.
+ *
+ * Two independent properties are encoded in a Quai address:
+ *
+ * - **Zone** — the first byte (`0x00`–`0x02`, `0x10`–`0x12`, `0x20`–`0x22`). An address
+ *   outside those ranges belongs to no shard and cannot hold state.
+ * - **Ledger** — the 9th bit, i.e. the high bit of the *second* byte. Set means Qi (the
+ *   UTXO ledger); clear means Quai (the EVM account ledger).
+ *
+ * They are genuinely orthogonal: `0x008111…` sits in zone `0x00` yet is a Qi address, so
+ * a zone check alone is not enough.
+ *
+ * **Qi addresses cannot interact with smart contracts.** A Qi owner could never sign a
+ * vault transaction, a Qi guardian could never approve a recovery, and native value sent
+ * to one leaves the Quai ledger. The contracts do not check for this — `_addOwner` only
+ * rejects the zero address, the vault itself and the module sentinel — so admitting one
+ * permanently reduces the number of addresses able to reach the threshold, and enough of
+ * them bricks the vault. The SDK therefore rejects Qi addresses wherever an address is
+ * committed to a role or receives value.
+ */
+type AddressLedger = 'quai' | 'qi';
+interface AddressCheck {
+    valid: boolean;
+    checksummed?: Address;
+    /** Zone prefix, e.g. `0x00`. Absent when the address belongs to no shard. */
+    zone?: string;
+    ledger?: AddressLedger;
+    reason?: string;
+}
+/** Inspect an address without throwing. */
+declare function inspectAddress(value: unknown): AddressCheck;
+/** Whether an address is shard-valid and on the Quai ledger. */
+declare function isUsableQuaiAddress(value: unknown): boolean;
+/**
+ * Assert an address can participate in Quai smart-contract calls, returning it
+ * checksummed.
+ *
+ * Use for any address being committed to a role (owner, guardian, module, delegatecall
+ * target) or receiving value. Do **not** use it for addresses being *removed* — a Qi
+ * address that predates this check must still be removable — nor for read-only lookups,
+ * where rejecting the query is less useful than answering it.
+ */
+declare function assertQuaiAddress(value: unknown, label?: string): Address;
+/** Assert every address in a list, reporting the offending index. */
+declare function assertQuaiAddresses(values: readonly unknown[], label: string): Address[];
+
+/** Machine-readable error codes. Stable across releases. */
+type QuaiVaultErrorCode = 'CONFIG' | 'NOT_CONNECTED' | 'NO_SIGNER' | 'NO_INDEXER' | 'INDEXER_QUERY' | 'INDEXER_STALE' | 'VALIDATION' | 'NOT_FOUND' | 'PRECONDITION' | 'REVERT' | 'SALT_MINING' | 'STALE_PROPOSAL' | 'UNSUPPORTED';
+declare class QuaiVaultError extends Error {
+    readonly code: QuaiVaultErrorCode;
+    /** What the caller can do about it, in plain language. */
+    readonly remediation?: string;
+    /** Unix seconds after which retrying could succeed. */
+    readonly retryableAt?: number;
+    readonly cause?: unknown;
+    constructor(code: QuaiVaultErrorCode, message: string, options?: {
+        remediation?: string;
+        retryableAt?: number;
+        cause?: unknown;
+    });
+    /** Structured form, for logs and machine consumers. */
+    toJSON(): Record<string, unknown>;
+}
+declare class ConfigError extends QuaiVaultError {
+    constructor(message: string, remediation?: string);
+}
+declare class NoSignerError extends QuaiVaultError {
+    constructor(operation: string);
+}
+declare class NoIndexerError extends QuaiVaultError {
+    constructor(operation: string);
+}
+declare class IndexerQueryError extends QuaiVaultError {
+    constructor(message: string, cause?: unknown);
+}
+declare class ValidationError extends QuaiVaultError {
+    constructor(message: string, remediation?: string);
+}
+declare class NotFoundError extends QuaiVaultError {
+    constructor(message: string);
+}
+/** A precondition the contract enforces would fail — checked before signing. */
+declare class PreconditionError extends QuaiVaultError {
+    constructor(message: string, options?: {
+        remediation?: string;
+        retryableAt?: number;
+    });
+}
+/** A contract call reverted. Carries the decoded custom error when resolvable. */
+declare class RevertError extends QuaiVaultError {
+    readonly revert?: DecodedRevert;
+    constructor(message: string, revert?: DecodedRevert, options?: {
+        remediation?: string;
+        cause?: unknown;
+    });
+    toJSON(): Record<string, unknown>;
+}
+declare class SaltMiningError extends QuaiVaultError {
+    constructor(message: string, remediation?: string);
+}
+/**
+ * A `disableModule` proposal whose baked-in `prevModule` no longer matches the
+ * live linked list. The proposal can never execute and must be replaced.
+ */
+declare class StaleProposalError extends QuaiVaultError {
+    constructor(message: string);
+}
+
+/**
+ * Decode revert data against every QuaiVault ABI, plus the two Solidity builtins.
+ * Returns `undefined` for empty data or an unrecognised selector.
+ */
+declare function decodeRevert(data: unknown): DecodedRevert | undefined;
+/** Remediation text for a custom error name, if the SDK knows one. */
+declare function remediationFor(errorName: string): string | undefined;
+/**
+ * Pull revert data out of the many shapes providers use, then decode it.
+ * Handles quais/ethers `CALL_EXCEPTION` errors, raw RPC error bodies and nested causes.
+ */
+declare function decodeRevertFromError(error: unknown): DecodedRevert | undefined;
+/** All known custom error selectors. Exposed for tooling and tests. */
+declare function knownErrorSelectors(): Array<{
+    selector: Hex;
+    signature: string;
+}>;
+
+export { type Address, type AddressCheck, type AddressLedger, type Affordance, type AffordanceBlocker, type AffordanceContext, type ApprovalRecord, type BalanceOptions, type BatchCall, type Bytes32, type ClientOptions, ConfigError, Connection, type Consistency, type ContractAddresses, type CreateProgress, type CreateVaultParams, type CreateVaultResult, type DecodeContext, type DecodeResult, type DecodedBatchCall, type DecodedCall, type DecodedRevert, type DryRunResult, ENV_VARS, type ExecuteOutcome, type ExecuteResult, Factory, type FactoryContext, FactoryContract, type Hex, IndexerClient, type IndexerConfig, type IndexerHealth, IndexerQueries, IndexerQueryError, MAX_EXECUTION_DELAY, MAX_MODULES, MAX_OWNERS, type MineSaltOptions, type MinedSalt, type MiningStrategy, type NetworkConfig, type NetworkName, NoIndexerError, NoSignerError, NotFoundError, Operation, type Page, type Pagination, PreconditionError, type ProposeOptions, type ProposeResult, QuaiVault, QuaiVaultClient, QuaiVaultError, type QuaiVaultErrorCode, type RawRecovery, type RawRecoveryConfig, type RawRecoveryState, type RawTransactionState, type RawTransactionStruct, type ReceiptLike, type RecoveryAction, type RecoveryAffordance, type RecoveryConfig, RecoveryContract, RecoveryModule, type RecoveryModuleContext, type RecoveryRequest, type RecoveryStatus, type ResolvedConfig, type RetryOptions, RevertError, SENTINEL_MODULES, SaltMiningError, StaleProposalError, type Subscription, type TokenBalance, type TransactionKind, type TransactionStatus, ValidationError, Vault, type VaultAction, type VaultBalances, type VaultContext, VaultContract, type VaultInfo, type VaultTransaction, type WatchEvent, type WatchOptions, type WatchTopic, allowedActions, assertQuaiAddress, assertQuaiAddresses, classifyExecution, computeAffordances, computeBytecodeHash, computeFullSalt, connect, decodeCall, decodeMultiSendPayload, decodeRevert, decodeRevertFromError, defaultStrategy, deriveRecoveryStatus, deriveStatus, encodeInitData, encodeMultiSend, encodeMultiSendPayload, executableAfterOf, extractProposedTxHash, schemas as indexerSchemas, inspectAddress, interfaces, isNetworkName, isTerminal, isTransient, isUsableQuaiAddress, knownErrorSelectors, loadBalances, mainnet, mineSalt, minimumExpiration, networks, nowSeconds, predictVaultAddress, recoveryCall, remediationFor, resolveConfig, selfCall, shardPrefixOf, syncStrategy, testnet, token as tokenCalls, watchVault, withRetry, workerThreadsStrategy };