@zama-fhe/sdk 3.5.0-alpha.7 → 3.5.0-alpha.8

package/dist/esm/{index-BNeNpxpl.d.ts → index-CLhOMZFu.d.ts}

@@ -2,9 +2,9 @@ import { d as FheChain } from "./index-B0XC8EfF.js";
 import { D as GenericSigner, O as WalletAccount, Qt as DecryptPublicValuesResult, S as TransactionKind, Xt as TransactionResult, Zt as ClearValue, _ as PrepareTransactionRequest, _t as UnwrapResult, bt as TransferCallbacks, c as GenericStorage, g as PrepareOptions, gt as UnshieldOptions, ht as TransferOptions, i as ZamaConfig, in as EncryptedValue, l as GenericProvider, nn as EncryptParams, o as ZamaConfigGeneric, pt as ShieldOptions, rn as EncryptResult, sn as FhevmRelayerOptions, un as RelayerSDK, v as PreparedFor, vt as WrapOptions, xt as UnshieldCallbacks } from "./types-GctypAZx.js";
 import "./cleartext-BEXEaFxR.js";
 import "./types-CDEEf-TG.js";
+import "./base-signer-CMcmGqJV.js";
 import "./types-CViUZmxp.js";
-import "./index-DE92igPK.js";
-import { Address, Hex } from "viem";
+import { Address, Address as Address$1, Hex, Hex as Hex$1 } from "viem";
 import { z } from "zod/mini";
 import { MutationFunctionContext, QueryKey, QueryObserverOptions, skipToken } from "@tanstack/query-core";
 //#region src/config/create.d.ts
@@ -19355,768 +19355,180 @@ declare class Delegations {
   }): Promise<DelegationStatus>;
 }
 //#endregion
-//#region src/query/utils.d.ts
-/** Union of TanStack Query option keys stripped by {@link filterQueryOptions}, leaving only domain parameters. */
-type StrippedQueryOptionKeys = "gcTime" | "staleTime" | "enabled" | "select" | "refetchInterval" | "refetchOnMount" | "refetchOnWindowFocus" | "refetchOnReconnect" | "retry" | "retryDelay" | "retryOnMount" | "queryFn" | "queryKey" | "queryKeyHashFn" | "initialData" | "initialDataUpdatedAt" | "placeholderData" | "structuralSharing" | "throwOnError" | "meta" | "query" | "pollingInterval";
-/**
- * Remove TanStack behavioral options from a query config object so only domain
- * parameters remain for the lower-level factory.
- *
- * @example
- * ```ts
- * const params = filterQueryOptions({
- *   query: { enabled: false },
- *   gcTime: 60_000,
- *   owner: "0xabc",
- * });
- * // => { owner: "0xabc" }
- * ```
- */
-declare function filterQueryOptions<TOptions extends Record<string, unknown>>(options: TOptions): Omit<TOptions, StrippedQueryOptionKeys>;
-/**
- * Stable hash function for query keys.
- * Sorts object keys recursively and converts bigint values to strings.
- *
- * @remarks
- * bigint values are serialized as decimal strings, so `42n` and `"42"` hash to
- * the same token when they occupy the same position. This collision is accepted
- * by design for the current query-key conventions in this package.
- */
-declare function hashFn(queryKey: readonly unknown[]): string;
-//#endregion
-//#region src/query/factory-types.d.ts
+//#region src/namespaces/offline.d.ts
 /**
- * TanStack Query options object returned by the SDK's `*QueryOptions` factories:
- * `QueryObserverOptions` with `queryKey` and `queryFn` required and the
- * cache-internal keys (`queryHash`, `queryKeyHashFn`, `throwOnError`) removed.
+ * Namespace for the offline-signing pipeline —
+ * `prepare → [external sign + self-publish]` — for institutional custody, HSM
+ * ceremonies, and policy-engine workflows where signing runs out-of-process and
+ * cannot happen synchronously in a single Promise.
  */
-type QueryFactoryOptions<TQueryFnData = unknown, TError = Error, TData = TQueryFnData, TQueryKey extends QueryKey = QueryKey> = Omit<Omit<QueryObserverOptions<TQueryFnData, TError, TData, TQueryFnData, TQueryKey>, "queryKey"> & Required<Pick<QueryObserverOptions<TQueryFnData, TError, TData, TQueryFnData, TQueryKey>, "queryKey">>, "queryFn" | "queryHash" | "queryKeyHashFn" | "throwOnError"> & {
-  queryFn: Exclude<QueryObserverOptions<TQueryFnData, TError, TData, TQueryFnData, TQueryKey>["queryFn"], typeof skipToken | undefined>;
-};
-/** TanStack Query mutation options object returned by the SDK's `*MutationOptions` factories. */
-interface MutationFactoryOptions<TMutationKey extends readonly unknown[], TVariables, TData, TOnMutateResult = unknown> {
-  /** Cache key identifying the mutation. */
-  mutationKey: TMutationKey;
-  /** Runs the mutation for the given variables. */
-  mutationFn: (variables: TVariables) => Promise<TData>;
-  /** Optional callback invoked after the mutation succeeds. */
-  onSuccess?: (data: TData, variables: TVariables, onMutateResult: TOnMutateResult, context: MutationFunctionContext) => void;
+declare class Offline {
+  #private;
+  /**
+   * Build an RLP-encoded unsigned transaction for the given request. The
+   * caller signs it externally — via an HSM ceremony, an out-of-process
+   * custodian, or any signer holding the key — and broadcasts the signed bytes
+   * through its own channel.
+   *
+   * Signer-optional: works without a configured signer (canonical shape for
+   * cross-process custody — the back-end signer service consumes
+   * `prepared.unsignedTx` and returns signed bytes).
+   *
+   * @remarks
+   * `request.from` is only a declaration — the SDK does not prove the caller
+   * controls it, and an EIP-1559 unsigned tx carries no `from` field at all
+   * (the on-chain sender is whichever key signs the bytes). Point `from` at
+   * the account the custodian will sign with; custodians enforce key-control
+   * at sign time — a signing request for a key the credential can't use fails
+   * there — so a mismatched `from` cannot make the custodian sign from an
+   * account you don't control. Verifying control of `from` up front is still
+   * the application's responsibility.
+   */
+  prepare<K extends TransactionKind>(request: Extract<PrepareTransactionRequest, {
+    kind: K;
+  }>, options?: PrepareOptions): Promise<PreparedFor<K>>;
 }
 //#endregion
-//#region src/query/signer-query-context.d.ts
-/** Connected-wallet context threaded into query factories to scope cache keys and gate signer-dependent queries. */
-interface SignerQueryContext {
-  /** Connected wallet account; queries that need a signer stay disabled until it is set. */
-  walletAccount?: WalletAccount;
+//#region src/token/token.d.ts
+/** Options for {@link Token.batchDecryptBalancesAs}. */
+interface BatchDecryptAsOptions {
+  /** The address of the account that delegated decryption rights. */
+  delegatorAddress: Address;
+  /** Pre-fetched encrypted values. When omitted, they are fetched from the chain. */
+  encryptedValues?: EncryptedValue[];
+  /**
+   * The account whose on-chain balance to read. Defaults to the delegator
+   * address, which is the common case (the delegator grants permission to
+   * decrypt their own balance). Only set this when the account differs
+   * from the delegator.
+   *
+   * Matches the `account` parameter of `confidentialBalanceOf(account)` on-chain.
+   */
+  accountAddress?: Address;
+  /** Maximum number of concurrent decrypt calls. Default: 10. */
+  maxConcurrency?: number;
+  /** Called when decryption fails for a single token. Return a fallback bigint. */
+  onError?: (error: Error, address: Address) => bigint;
+}
+/** Result of {@link Token.batchBalancesOf}. */
+interface BatchBalancesResult {
+  /** Successfully decrypted balances, keyed by token address. */
+  results: Map<Address, bigint>;
+  /** Per-token errors for tokens that failed to decrypt. */
+  errors: Map<Address, ZamaError>;
 }
-//#endregion
-//#region src/query/query-keys.d.ts
 /**
- * Canonical query-key namespace for `@zama-fhe/sdk/query`.
+ * High-level interface for an ERC-7984 confidential token.
+ * Hides FHE complexity (encryption, decryption, EIP-712 signing) behind
+ * familiar ERC-20-like methods.
  *
- * @example
- * ```ts
- * queryClient.invalidateQueries({
- *   queryKey: zamaQueryKeys.confidentialBalance.token("0xToken"),
- * });
- * ```
+ * For ERC-7984 wrappers (shield/unshield), use {@link WrappedToken} instead —
+ * it extends `Token` with wrapper-specific operations.
+ *
+ * Decryption, credentials, caching, and event emission are handled by the
+ * owning {@link ZamaSDK} — this class only exposes token-scoped helpers
+ * that delegate to `sdk.decryption.decryptValues` and `sdk.permits.grantPermit`.
  */
-declare const zamaQueryKeys: {
-  readonly confidentialBalance: {
-    readonly all: readonly ["zama.confidentialBalance"];
-    readonly token: (tokenAddress: Address) => readonly ["zama.confidentialBalance", {
-      readonly tokenAddress: `0x${string}`;
-    }];
-    readonly owner: (tokenAddress: Address, owner?: Address, walletAccount?: WalletAccount) => readonly ["zama.confidentialBalance", {
-      readonly owner?: `0x${string}` | undefined;
-      readonly walletAddress: `0x${string}`;
-      readonly walletChainId: number;
-      readonly tokenAddress: `0x${string}`;
-    } | {
-      readonly owner?: `0x${string}` | undefined;
-      readonly walletAddress?: undefined;
-      readonly walletChainId?: undefined;
-      readonly tokenAddress: `0x${string}`;
-    }];
-  };
-  readonly confidentialBalances: {
-    readonly all: readonly ["zama.confidentialBalances"];
-    readonly tokens: (tokenAddresses: Address[], owner?: Address, walletAccount?: WalletAccount) => readonly ["zama.confidentialBalances", {
-      readonly owner?: `0x${string}` | undefined;
-      readonly walletAddress: `0x${string}`;
-      readonly walletChainId: number;
-      readonly tokenAddresses: `0x${string}`[];
-    } | {
-      readonly owner?: `0x${string}` | undefined;
-      readonly walletAddress?: undefined;
-      readonly walletChainId?: undefined;
-      readonly tokenAddresses: `0x${string}`[];
-    }];
-  };
-  readonly tokenMetadata: {
-    readonly all: readonly ["zama.tokenMetadata"];
-    readonly token: (tokenAddress: Address) => readonly ["zama.tokenMetadata", {
-      readonly tokenAddress: `0x${string}`;
-    }];
-  };
-  readonly isConfidential: {
-    readonly all: readonly ["zama.isConfidential"];
-    readonly token: (tokenAddress: Address) => readonly ["zama.isConfidential", {
-      readonly tokenAddress: `0x${string}`;
-    }];
-  };
-  readonly isWrapper: {
-    readonly all: readonly ["zama.isWrapper"];
-    readonly token: (tokenAddress: Address) => readonly ["zama.isWrapper", {
-      readonly tokenAddress: `0x${string}`;
-    }];
-  };
-  readonly wrapperDiscovery: {
-    readonly all: readonly ["zama.wrapperDiscovery"];
-    readonly token: (tokenAddress?: Address, erc20Address?: Address, registryAddress?: Address) => readonly ["zama.wrapperDiscovery", {
-      readonly registryAddress?: `0x${string}` | undefined;
-      readonly erc20Address?: `0x${string}` | undefined;
-      readonly tokenAddress?: `0x${string}` | undefined;
-    }];
-  };
-  readonly underlyingAllowance: {
-    readonly all: readonly ["zama.underlyingAllowance"];
-    readonly token: (tokenAddress: Address) => readonly ["zama.underlyingAllowance", {
-      readonly tokenAddress: `0x${string}`;
-    }];
-    readonly scope: (tokenAddress: Address, owner?: Address) => readonly ["zama.underlyingAllowance", {
-      readonly owner?: `0x${string}` | undefined;
-      readonly tokenAddress: `0x${string}`;
-    }];
-  };
-  readonly confidentialIsOperator: {
-    readonly all: readonly ["zama.confidentialIsOperator"];
-    readonly token: (tokenAddress?: Address) => readonly ["zama.confidentialIsOperator", {
-      tokenAddress: `0x${string}`;
-    } | {
-      tokenAddress?: undefined;
-    }];
-    readonly scope: (tokenAddress?: Address, holder?: Address, spender?: Address) => readonly ["zama.confidentialIsOperator", {
-      readonly spender?: `0x${string}` | undefined;
-      readonly holder?: `0x${string}` | undefined;
-      readonly tokenAddress?: `0x${string}` | undefined;
-    }];
-  };
-  readonly totalSupply: {
-    readonly all: readonly ["zama.totalSupply"];
-    readonly token: (tokenAddress: Address) => readonly ["zama.totalSupply", {
-      readonly tokenAddress: `0x${string}`;
-    }];
-  };
-  readonly pendingUnshield: {
-    readonly all: readonly ["zama.pendingUnshield"];
-    readonly token: (tokenAddress: Address) => readonly ["zama.pendingUnshield", {
-      readonly tokenAddress: `0x${string}`;
-    }];
-  };
-  readonly hasPermit: {
-    readonly all: readonly ["zama.hasPermit"];
-    readonly scope: (contractAddresses: Address[], walletAccount?: WalletAccount) => readonly ["zama.hasPermit", {
-      readonly contractAddresses: `0x${string}`[];
-      readonly walletAddress: `0x${string}`;
-      readonly walletChainId: number;
-    } | {
-      readonly contractAddresses: `0x${string}`[];
-      readonly walletAddress?: undefined;
-      readonly walletChainId?: undefined;
-    }];
-  };
-  readonly delegationStatus: {
-    readonly all: readonly ["zama.delegationStatus"];
-    readonly contract: (contractAddress?: Address) => readonly ["zama.delegationStatus", {
-      contractAddress: `0x${string}`;
-    } | {
-      contractAddress?: undefined;
-    }];
-    readonly scope: (contractAddress?: Address, delegator?: Address, delegate?: Address) => readonly ["zama.delegationStatus", {
-      readonly delegateAddress?: `0x${string}` | undefined;
-      readonly delegatorAddress?: `0x${string}` | undefined;
-      readonly contractAddress?: `0x${string}` | undefined;
-    }];
-  };
-  readonly decryption: {
-    readonly all: readonly ["zama.decryption"];
-    readonly encryptedValue: (encryptedValue: string, contractAddress?: Address) => readonly ["zama.decryption", {
-      readonly contractAddress?: `0x${string}` | undefined;
-      readonly encryptedValue: string;
-    }];
-    readonly encryptedInputs: (encryptedInputs: readonly {
-      encryptedValue: string;
-      contractAddress: Address;
-    }[], walletAccount?: WalletAccount) => readonly ["zama.decryption", {
-      readonly encryptedInputs: {
-        encryptedValue: Hex;
-        contractAddress: `0x${string}`;
-      }[];
-      readonly walletAddress: `0x${string}`;
-      readonly walletChainId: number;
-    } | {
-      readonly encryptedInputs: {
-        encryptedValue: Hex;
-        contractAddress: `0x${string}`;
-      }[];
-      readonly walletAddress?: undefined;
-      readonly walletChainId?: undefined;
-    }];
-  };
-  readonly wrappersRegistry: {
-    readonly all: readonly ["zama.wrappersRegistry"];
-    readonly chainId: () => readonly ["zama.wrappersRegistry", {
-      readonly type: "chainId";
-    }];
-    readonly tokenPairs: (registryAddress: Address) => readonly ["zama.wrappersRegistry", {
-      readonly type: "tokenPairs";
-      readonly registryAddress: `0x${string}`;
-    }];
-    readonly confidentialTokenAddress: (registryAddress: Address, tokenAddress: Address) => readonly ["zama.wrappersRegistry", {
-      readonly type: "confidentialTokenAddress";
-      readonly registryAddress: `0x${string}`;
-      readonly tokenAddress: `0x${string}`;
-    }];
-    readonly tokenAddress: (registryAddress: Address, confidentialTokenAddress: Address) => readonly ["zama.wrappersRegistry", {
-      readonly type: "tokenAddress";
-      readonly registryAddress: `0x${string}`;
-      readonly confidentialTokenAddress: `0x${string}`;
-    }];
-    readonly tokenPairsLength: (registryAddress: Address) => readonly ["zama.wrappersRegistry", {
-      readonly type: "tokenPairsLength";
-      readonly registryAddress: `0x${string}`;
-    }];
-    readonly tokenPairsSlice: (registryAddress: Address, fromIndex: string, toIndex: string) => readonly ["zama.wrappersRegistry", {
-      readonly type: "tokenPairsSlice";
-      readonly registryAddress: `0x${string}`;
-      readonly fromIndex: string;
-      readonly toIndex: string;
-    }];
-    readonly tokenPair: (registryAddress: Address, index: string) => readonly ["zama.wrappersRegistry", {
-      readonly type: "tokenPair";
-      readonly registryAddress: `0x${string}`;
-      readonly index: string;
-    }];
-    readonly isConfidentialTokenValid: (registryAddress: Address, confidentialTokenAddress: Address) => readonly ["zama.wrappersRegistry", {
-      readonly type: "isConfidentialTokenValid";
-      readonly registryAddress: `0x${string}`;
-      readonly confidentialTokenAddress: `0x${string}`;
-    }];
-    readonly listPairs: (registryAddress: Address, page: number, pageSize: number, metadata: boolean) => readonly ["zama.wrappersRegistry", {
-      readonly type: "listPairs";
-      readonly registryAddress: `0x${string}`;
-      readonly page: number;
-      readonly pageSize: number;
-      readonly metadata: boolean;
-    }];
-  };
-};
-//#endregion
-//#region src/query/invalidation.d.ts
-/** Minimal query shape read by the invalidation predicates. */
-interface QueryLike {
-  /** The query's cache key. */
-  queryKey: readonly unknown[];
-}
-/** Minimal filter shape accepted by the invalidation helpers, matching TanStack Query's `QueryFilters`. */
-interface QueryFilterLike {
-  /** Match queries whose key starts with this prefix. */
-  queryKey?: readonly unknown[];
-  /** Match queries for which this returns `true`. */
-  predicate?: (query: QueryLike) => boolean;
-}
-/** Minimal `QueryClient` surface used by the invalidation helpers. */
-interface QueryClientLike {
-  /** Mark matching queries stale so they refetch. */
-  invalidateQueries(filters: QueryFilterLike): void | Promise<void>;
-  /** Remove matching queries from the cache entirely. */
-  removeQueries(filters: QueryFilterLike): void;
-}
-/** Invalidates the caches affected by an unwrap: confidential balances, underlying allowance, and pending unshields. */
-declare function invalidateAfterUnwrap(queryClient: QueryClientLike, tokenAddress: Address): void;
-/** Invalidates the caches affected by a wrap: confidential balances and underlying allowance. */
-declare function invalidateAfterWrap(queryClient: QueryClientLike, tokenAddress: Address): void;
-/** Invalidates the confidential balance queries for a token (single-token and batched). */
-declare function invalidateBalanceQueries(queryClient: QueryClientLike, tokenAddress: Address): void;
-/** Invalidates the caches affected by a shield: confidential balances and underlying allowance. */
-declare function invalidateAfterShield(queryClient: QueryClientLike, tokenAddress: Address): void;
-/** Invalidates the caches affected by an unshield request: confidential balances, underlying allowance, and pending unshields. */
-declare function invalidateAfterUnshield(queryClient: QueryClientLike, tokenAddress: Address): void;
-/** Invalidates the pending-unshield cache once an unshield has settled on-chain. */
-declare function invalidateAfterUnshieldSettled(queryClient: QueryClientLike, tokenAddress: Address): void;
-/** Invalidates the confidential balance caches affected by a transfer. */
-declare function invalidateAfterTransfer(queryClient: QueryClientLike, tokenAddress: Address): void;
-/** Invalidates the underlying-allowance cache after approving the underlying ERC-20. */
-declare function invalidateAfterApproveUnderlying(queryClient: QueryClientLike, tokenAddress: Address): void;
-/** Invalidates the operator-status cache after changing a token operator. */
-declare function invalidateAfterSetOperator(queryClient: QueryClientLike, tokenAddress: Address): void;
-/** Invalidates any wagmi `useBalance`/`readContract` balance queries so ERC-20 balances refresh. */
-declare function invalidateWagmiBalanceQueries(queryClient: QueryClientLike): void;
-/** Clears wallet-local caches (decryption, permits) and invalidates all Zama queries — call on wallet connect/disconnect so a stale entitlement can't leak across accounts. */
-declare function invalidateWalletLifecycleQueries(queryClient: QueryClientLike): void;
-//#endregion
-//#region src/query/token-metadata.d.ts
-/** ERC-20 token metadata returned by {@link tokenMetadataQueryOptions}. */
-interface TokenMetadata {
-  /** Human-readable token name. */
-  name: string;
-  /** Token ticker symbol. */
-  symbol: string;
-  /** Number of decimals the token uses. */
-  decimals: number;
-}
-/** Configuration for {@link tokenMetadataQueryOptions}. */
-interface TokenMetadataQueryConfig {
-  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
-  query?: Record<string, unknown>;
-}
-/** Builds TanStack Query options for reading an ERC-20 token's name, symbol, and decimals. */
-declare function tokenMetadataQueryOptions(sdk: ZamaSDK, tokenAddress: Address, config?: TokenMetadataQueryConfig): QueryFactoryOptions<TokenMetadata, Error, TokenMetadata, ReturnType<typeof zamaQueryKeys.tokenMetadata.token>>;
-//#endregion
-//#region src/query/is-confidential.d.ts
-/** Configuration for {@link isConfidentialQueryOptions} and {@link isWrapperQueryOptions}. */
-interface IsConfidentialQueryConfig {
-  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
-  query?: Record<string, unknown>;
-}
-/** Builds TanStack Query options for reading whether a token address implements the confidential (ERC-7984) token interface. */
-declare function isConfidentialQueryOptions(sdk: ZamaSDK, tokenAddress: Address, config?: IsConfidentialQueryConfig): QueryFactoryOptions<boolean, Error, boolean, ReturnType<typeof zamaQueryKeys.isConfidential.token>>;
-/** Builds TanStack Query options for reading whether a token address is a confidential wrapper (ERC-7984 wrapper) contract. */
-declare function isWrapperQueryOptions(sdk: ZamaSDK, tokenAddress: Address, config?: IsConfidentialQueryConfig): QueryFactoryOptions<boolean, Error, boolean, ReturnType<typeof zamaQueryKeys.isWrapper.token>>;
-//#endregion
-//#region src/query/total-supply.d.ts
-/** Configuration for {@link totalSupplyQueryOptions}. */
-interface TotalSupplyQueryConfig {
-  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
-  query?: Record<string, unknown>;
-}
-/** Builds TanStack Query options for reading a token's total supply. */
-declare function totalSupplyQueryOptions(sdk: ZamaSDK, tokenAddress: Address, config?: TotalSupplyQueryConfig): QueryFactoryOptions<bigint, Error, bigint, ReturnType<typeof zamaQueryKeys.totalSupply.token>>;
-//#endregion
-//#region src/wrappers-registry.d.ts
-/**
- * Default wrappers registry addresses for known chains.
- * Only includes chains where a registry is deployed (excludes Hardhat).
- *
- * @deprecated Read `registryAddress` from the chain presets instead (e.g.
- * `sepolia.registryAddress`). Will be removed in the next major version.
- */
-declare const DefaultRegistryAddresses: Record<number, Address>;
-/** Configuration for {@link WrappersRegistry}. */
-interface WrappersRegistryConfig {
-  /** Read-only chain provider used for every registry lookup. */
-  provider: GenericProvider;
-  /**
-   * Per-chain registry address overrides, merged on top of
-   * {@link DefaultRegistryAddresses}. Use this to supply a registry
-   * address for custom or local chains (e.g. Hardhat).
-   *
-   * @example
-   * ```ts
-   * new WrappersRegistry({
-   *   provider,
-   *   registryAddresses: { [31337]: "0xYourHardhatRegistry" },
-   * });
-   * ```
-   */
-  registryAddresses?: Record<number, Address>;
-  /**
-   * How long cached registry results remain valid, in seconds.
-   * Default: `86400` (24 hours).
-   */
-  registryTTL?: number;
-}
-/** Options for {@link WrappersRegistry.listPairs}. */
-interface ListPairsOptions {
-  /** Page number (1-indexed). Default: `1`. */
-  page?: number;
-  /** Number of items per page. Default: `100`. */
-  pageSize?: number;
-  /**
-   * When `true`, fetches on-chain metadata (name, symbol, decimals) for both
-   * the ERC-20 and confidential token, plus totalSupply for the ERC-20.
-   * Default: `false`.
-   */
-  metadata?: boolean;
-}
-/**
- * High-level interface for the on-chain token wrappers registry.
- *
- * Uses the configured {@link GenericProvider} to resolve the correct registry
- * contract address for the current chain and exposes typed read helpers for
- * every registry query. Results are cached in memory with a configurable TTL
- * (default 24 hours).
- *
- * @example
- * ```ts
- * const registry = new WrappersRegistry({ provider });
- *
- * // Paginated listing
- * const page1 = await registry.listPairs({ page: 1, pageSize: 20 });
- *
- * // Structured lookups
- * const result = await registry.getConfidentialToken(erc20Address);
- * if (result) console.log(result.confidentialTokenAddress);
- *
- * // Force refresh
- * registry.refresh();
- * ```
- */
-declare class WrappersRegistry {
+declare class Token {
   #private;
-  /** Read-only chain access used for registry contract reads. */
-  readonly provider: GenericProvider;
-  constructor(config: WrappersRegistryConfig);
-  /**
-   * Synchronous lookup of the registry address for a given chain ID.
-   * Returns `undefined` if no address is configured for that chain.
-   */
-  getAddress(chainId: number): Address | undefined;
+  /** The SDK instance this token operates through. */
+  readonly sdk: ZamaSDK;
+  /** Checksummed address of the confidential token contract. */
+  readonly address: Address;
+  constructor(sdk: ZamaSDK, address: Address);
+  /** Read the token name from the contract. */
+  name(): Promise<string>;
+  /** Read the token symbol from the contract. */
+  symbol(): Promise<string>;
+  /** Read the token decimals from the contract. */
+  decimals(): Promise<number>;
   /**
-   * Force-invalidate the in-memory cache. The next call to any read method
-   * will fetch fresh data from the chain.
+   * ERC-165 check for {@link ERC7984_INTERFACE_ID} support.
+   *
+   * @returns `true` if the contract implements the ERC-7984 confidential token interface.
    */
-  refresh(): void;
+  isConfidential(): Promise<boolean>;
   /**
-   * The cache TTL in milliseconds.
-   * Exposed so query option factories can set a matching `staleTime`.
+   * ERC-165 check for IERC7984ERC20Wrapper support.
+   *
+   * @returns `true` if the contract implements the ERC-7984 wrapper interface
+   *   ({@link ERC7984_WRAPPER_INTERFACE_ID}, `0x1f1c62b2`).
    */
-  get ttlMs(): number;
+  isWrapper(): Promise<boolean>;
   /**
-   * Resolve the registry contract address for the current chain.
+   * Decrypt and return the plaintext balance for the given owner.
+   * Acquires FHE credentials via a wallet signature if none are cached.
    *
-   * Priority: `registryAddresses[chainId]` \> built-in default.
+   * @param owner - Balance owner address.
+   * @returns The decrypted plaintext balance as a bigint.
+   * @throws if FHE decryption fails. {@link DecryptionFailedError}
    *
-   * @returns The registry contract address for the connected chain.
-   * @throws if no address is configured for the chain. {@link ConfigurationError}
+   * @example
+   * ```ts
+   * const balance = await token.balanceOf("0xOwner");
+   * ```
    */
-  getRegistryAddress(): Promise<Address>;
+  balanceOf(owner: Address): Promise<bigint>;
   /**
-   * List token wrapper pairs with page-based pagination.
-   *
-   * Internally maps to `getTokenConfidentialTokenPairsSlice` on-chain.
+   * Return the raw encrypted balance without decrypting.
    *
-   * @param options - Pagination and enrichment options.
-   * @returns A {@link PaginatedResult} of pairs.
+   * @param owner - Balance owner address.
+   * @returns The encrypted balance as a hex string.
    *
    * @example
    * ```ts
-   * const result = await registry.listPairs({ page: 1, pageSize: 20 });
-   * console.log(`${result.total} pairs, showing page ${result.page}`);
-   *
-   * // With on-chain metadata
-   * const withMeta = await registry.listPairs({ metadata: true, pageSize: 10 });
-   * for (const pair of withMeta.items) {
-   *   console.log(pair.underlying.symbol, "→", pair.confidential.symbol);
-   * }
+   * const encryptedValue = await token.confidentialBalanceOf("0xOwner");
    * ```
    */
-  listPairs(options: ListPairsOptions & {
-    metadata: true;
-  }): Promise<PaginatedResult<TokenWrapperPairWithMetadata>>;
-  /** Lists registered underlying/confidential token pairs; pass `{ metadata: true }` to include on-chain token metadata. */
-  listPairs(options?: ListPairsOptions): Promise<PaginatedResult<TokenWrapperPair>>;
+  confidentialBalanceOf(owner: Address): Promise<EncryptedValue>;
   /**
-   * Look up the confidential token for a given plain ERC-20 address.
+   * Decrypt the balance of a delegator using delegated decryption credentials.
+   * The connected signer acts as the delegatee who has been granted permission
+   * by the delegator to decrypt their balance.
    *
-   * @param tokenAddress - The plain ERC-20 token address.
-   * @returns The lookup result, or `null` if the token has never been registered.
-   *   **Note:** revoked tokens (registered then invalidated) return a non-null result
-   *   with `isValid: false`. Check `result.isValid` explicitly rather than using
-   *   `if (result)` to guard against processing revoked tokens.
+   * Clear values are cached in storage keyed by `(account, token, encryptedValue)`.
+   * Because every on-chain balance change produces a new encrypted value,
+   * stale cache entries are never served. Cache write failures are silently
+   * ignored — they do not affect the returned value.
+   *
+   * @param delegatorAddress - The address of the account that delegated decryption rights.
+   * @param accountAddress - The account whose on-chain balance to read. Defaults
+   *   to the delegator address.
+   * @returns The decrypted plaintext balance as a bigint.
+   * @throws if no active delegation exists. {@link DelegationNotFoundError}
+   * @throws if the delegation has expired. {@link DelegationExpiredError}
+   * @throws if delegated decryption fails. {@link DecryptionFailedError}
    *
    * @example
    * ```ts
-   * const result = await registry.getConfidentialToken(usdcAddress);
-   * if (result?.isValid) {
-   *   console.log(result.confidentialTokenAddress);
-   * }
+   * const balance = await token.decryptBalanceAs({
+   *   delegatorAddress: "0xDelegator",
+   * });
    * ```
    */
-  getConfidentialToken(tokenAddress: Address): Promise<{
-    confidentialTokenAddress: Address;
-    isValid: boolean;
-  } | null>;
+  decryptBalanceAs({ delegatorAddress, accountAddress }: {
+    delegatorAddress: Address;
+    accountAddress?: Address;
+  }): Promise<bigint>;
   /**
-   * Reverse lookup — find the plain ERC-20 for a given confidential token.
+   * Decrypt confidential balances for multiple tokens in parallel, returning
+   * successes and per-token errors separately. Pre-authorizes all token
+   * addresses in a single wallet signature, then delegates each decrypt to
+   * `sdk.decryption.decryptValues`.
    *
-   * @param confidentialTokenAddress - The confidential token address.
-   * @returns The lookup result, or `null` if no pair is registered.
+   * Tokens that fail to decrypt land in `errors` rather than aborting the
+   * whole batch — caller decides how to surface them.
+   *
+   * @param tokens - Array of {@link Token} instances bound to the same SDK.
+   * @param owner - Balance owner address.
+   * @returns `{ results, errors }` partitioning the per-token outcomes.
    *
    * @example
    * ```ts
-   * const result = await registry.getUnderlyingToken(cUsdcAddress);
-   * if (result) {
-   *   console.log(result.tokenAddress, result.isValid);
-   * }
+   * const { results, errors } = await Token.batchBalancesOf(tokens, owner);
    * ```
    */
-  getUnderlyingToken(confidentialTokenAddress: Address): Promise<{
-    tokenAddress: Address;
-    isValid: boolean;
-  } | null>;
-  /**
-   * Fetch all token wrapper pairs from the registry.
-   *
-   * @returns All registered `TokenWrapperPair` entries.
-   */
-  getTokenPairs(): Promise<readonly TokenWrapperPair[]>;
-  /**
-   * Get the total number of token wrapper pairs.
-   *
-   * @returns The count as a bigint.
-   */
-  getTokenPairsLength(): Promise<bigint>;
-  /**
-   * Fetch a range of token wrapper pairs (paginated by index).
-   *
-   * @param fromIndex - Start index (inclusive).
-   * @param toIndex - End index (exclusive).
-   * @returns The slice of `TokenWrapperPair` entries.
-   */
-  getTokenPairsSlice(fromIndex: bigint, toIndex: bigint): Promise<readonly TokenWrapperPair[]>;
-  /**
-   * Fetch a single token wrapper pair by index.
-   *
-   * @param index - Zero-based pair index.
-   * @returns The `TokenWrapperPair` at that index.
-   */
-  getTokenPair(index: bigint): Promise<TokenWrapperPair>;
-  /**
-   * Look up the confidential token address for a given plain ERC-20 token.
-   *
-   * @param tokenAddress - The plain ERC-20 token address.
-   * @returns A tuple `[isValid, confidentialTokenAddress]`. `isValid` is `true` only for a
-   *   registered, non-revoked wrapper. The address is the zero address when no pair is registered.
-   *   A non-zero address with `isValid=false` means the wrapper was registered but later revoked.
-   */
-  getConfidentialTokenAddress(tokenAddress: Address): Promise<readonly [boolean, Address]>;
-  /**
-   * Reverse lookup — find the plain ERC-20 for a given confidential token.
-   *
-   * @param confidentialTokenAddress - The confidential token address.
-   * @returns A tuple `[isValid, tokenAddress]`. `isValid` is `true` only for a registered,
-   *   non-revoked wrapper. The address is the zero address when no pair is registered.
-   *   A non-zero address with `isValid=false` means the wrapper was registered but later revoked.
-   */
-  getTokenAddress(confidentialTokenAddress: Address): Promise<readonly [boolean, Address]>;
-  /**
-   * Check whether a confidential token is registered and valid.
-   *
-   * @param confidentialTokenAddress - The confidential token address to check.
-   * @returns `true` if the token is a known valid wrapper in the registry.
-   */
-  isConfidentialTokenValid(confidentialTokenAddress: Address): Promise<boolean>;
-}
-//#endregion
-//#region src/query/wrapper-discovery.d.ts
-/** Configuration for {@link wrapperDiscoveryQueryOptions}. */
-interface WrapperDiscoveryQueryConfig {
-  /**
-   * Address of any confidential token you control.
-   * Used to scope the query cache key and to gate whether the query
-   * is enabled — it does not affect which wrapper the registry returns.
-   */
-  tokenAddress?: Address;
-  /**
-   * The ERC-20 token address to discover the confidential wrapper for.
-   * The registry is resolved automatically from chain config.
-   */
-  erc20Address?: Address;
-  /**
-   * The resolved registry contract address for the current chain.
-   * Included in the query key so that switching chains invalidates
-   * stale cached results. Pass `undefined` when the chain ID is not
-   * yet known — the query will be disabled.
-   */
-  registryAddress?: Address;
-  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
-  query?: Record<string, unknown>;
-}
-/** Builds TanStack Query options for discovering the confidential wrapper address for a given ERC-20 token (resolves to `null` when none is registered). */
-declare function wrapperDiscoveryQueryOptions(registry: WrappersRegistry, config: WrapperDiscoveryQueryConfig): QueryFactoryOptions<Address | null, Error, Address | null, ReturnType<typeof zamaQueryKeys.wrapperDiscovery.token>>;
-//#endregion
-//#region src/query/underlying-allowance.d.ts
-/** Configuration for {@link underlyingAllowanceQueryOptions}. */
-interface UnderlyingAllowanceQueryConfig {
-  /** Owner whose underlying-token allowance to read; the query stays disabled until provided. */
-  owner?: Address;
-  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
-  query?: Record<string, unknown>;
-}
-/** Builds TanStack Query options for reading the ERC-20 allowance the owner has granted a confidential wrapper on its underlying token. */
-declare function underlyingAllowanceQueryOptions(sdk: ZamaSDK, tokenAddress: Address, config: UnderlyingAllowanceQueryConfig): QueryFactoryOptions<bigint, Error, bigint, ReturnType<typeof zamaQueryKeys.underlyingAllowance.scope>>;
-//#endregion
-//#region src/query/pending-unshield.d.ts
-/** Configuration for {@link pendingUnshieldQueryOptions}. */
-interface PendingUnshieldQueryConfig {
-  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
-  query?: Record<string, unknown>;
-}
-/**
- * Query options for reading the unwrap tx hash of an unshield that was
- * interrupted between its two phases (returns `null` if none is pending).
- *
- * Backed by {@link ZamaSDK} storage via `WrappedToken.getPendingUnshield()`.
- * `staleTime: 0` so the value reflects storage on mount; the unshield/unwrap
- * mutations also invalidate this key on success.
- */
-declare function pendingUnshieldQueryOptions(sdk: ZamaSDK, tokenAddress: Address, config?: PendingUnshieldQueryConfig): QueryFactoryOptions<Hex | null, Error, Hex | null, ReturnType<typeof zamaQueryKeys.pendingUnshield.token>>;
-//#endregion
-//#region src/query/confidential-is-operator.d.ts
-/** Configuration for {@link confidentialIsOperatorQueryOptions}. */
-interface ConfidentialIsOperatorQueryConfig {
-  /** Token holder whose operator authorization to check; the query stays disabled until provided. */
-  holder?: Address;
-  /** Spender address to check for operator authorization; the query stays disabled until provided. */
-  spender?: Address;
-  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
-  query?: Record<string, unknown>;
-}
-/** Builds TanStack Query options for reading whether a spender is an authorized operator of a holder on a confidential token. */
-declare function confidentialIsOperatorQueryOptions(sdk: ZamaSDK, tokenAddress: Address | undefined, config: ConfidentialIsOperatorQueryConfig): QueryFactoryOptions<boolean, Error, boolean, ReturnType<typeof zamaQueryKeys.confidentialIsOperator.scope>>;
-//#endregion
-//#region src/token/token.d.ts
-/** Options for {@link Token.batchDecryptBalancesAs}. */
-interface BatchDecryptAsOptions {
-  /** The address of the account that delegated decryption rights. */
-  delegatorAddress: Address;
-  /** Pre-fetched encrypted values. When omitted, they are fetched from the chain. */
-  encryptedValues?: EncryptedValue[];
-  /**
-   * The account whose on-chain balance to read. Defaults to the delegator
-   * address, which is the common case (the delegator grants permission to
-   * decrypt their own balance). Only set this when the account differs
-   * from the delegator.
-   *
-   * Matches the `account` parameter of `confidentialBalanceOf(account)` on-chain.
-   */
-  accountAddress?: Address;
-  /** Maximum number of concurrent decrypt calls. Default: 10. */
-  maxConcurrency?: number;
-  /** Called when decryption fails for a single token. Return a fallback bigint. */
-  onError?: (error: Error, address: Address) => bigint;
-}
-/** Result of {@link Token.batchBalancesOf}. */
-interface BatchBalancesResult {
-  /** Successfully decrypted balances, keyed by token address. */
-  results: Map<Address, bigint>;
-  /** Per-token errors for tokens that failed to decrypt. */
-  errors: Map<Address, ZamaError>;
-}
-/**
- * High-level interface for an ERC-7984 confidential token.
- * Hides FHE complexity (encryption, decryption, EIP-712 signing) behind
- * familiar ERC-20-like methods.
- *
- * For ERC-7984 wrappers (shield/unshield), use {@link WrappedToken} instead —
- * it extends `Token` with wrapper-specific operations.
- *
- * Decryption, credentials, caching, and event emission are handled by the
- * owning {@link ZamaSDK} — this class only exposes token-scoped helpers
- * that delegate to `sdk.decryption.decryptValues` and `sdk.permits.grantPermit`.
- */
-declare class Token {
-  #private;
-  /** The SDK instance this token operates through. */
-  readonly sdk: ZamaSDK;
-  /** Checksummed address of the confidential token contract. */
-  readonly address: Address;
-  constructor(sdk: ZamaSDK, address: Address);
-  /** Read the token name from the contract. */
-  name(): Promise<string>;
-  /** Read the token symbol from the contract. */
-  symbol(): Promise<string>;
-  /** Read the token decimals from the contract. */
-  decimals(): Promise<number>;
-  /**
-   * ERC-165 check for {@link ERC7984_INTERFACE_ID} support.
-   *
-   * @returns `true` if the contract implements the ERC-7984 confidential token interface.
-   */
-  isConfidential(): Promise<boolean>;
-  /**
-   * ERC-165 check for IERC7984ERC20Wrapper support.
-   *
-   * @returns `true` if the contract implements the ERC-7984 wrapper interface
-   *   ({@link ERC7984_WRAPPER_INTERFACE_ID}, `0x1f1c62b2`).
-   */
-  isWrapper(): Promise<boolean>;
-  /**
-   * Decrypt and return the plaintext balance for the given owner.
-   * Acquires FHE credentials via a wallet signature if none are cached.
-   *
-   * @param owner - Balance owner address.
-   * @returns The decrypted plaintext balance as a bigint.
-   * @throws if FHE decryption fails. {@link DecryptionFailedError}
-   *
-   * @example
-   * ```ts
-   * const balance = await token.balanceOf("0xOwner");
-   * ```
-   */
-  balanceOf(owner: Address): Promise<bigint>;
-  /**
-   * Return the raw encrypted balance without decrypting.
-   *
-   * @param owner - Balance owner address.
-   * @returns The encrypted balance as a hex string.
-   *
-   * @example
-   * ```ts
-   * const encryptedValue = await token.confidentialBalanceOf("0xOwner");
-   * ```
-   */
-  confidentialBalanceOf(owner: Address): Promise<EncryptedValue>;
-  /**
-   * Decrypt the balance of a delegator using delegated decryption credentials.
-   * The connected signer acts as the delegatee who has been granted permission
-   * by the delegator to decrypt their balance.
-   *
-   * Clear values are cached in storage keyed by `(account, token, encryptedValue)`.
-   * Because every on-chain balance change produces a new encrypted value,
-   * stale cache entries are never served. Cache write failures are silently
-   * ignored — they do not affect the returned value.
-   *
-   * @param delegatorAddress - The address of the account that delegated decryption rights.
-   * @param accountAddress - The account whose on-chain balance to read. Defaults
-   *   to the delegator address.
-   * @returns The decrypted plaintext balance as a bigint.
-   * @throws if no active delegation exists. {@link DelegationNotFoundError}
-   * @throws if the delegation has expired. {@link DelegationExpiredError}
-   * @throws if delegated decryption fails. {@link DecryptionFailedError}
-   *
-   * @example
-   * ```ts
-   * const balance = await token.decryptBalanceAs({
-   *   delegatorAddress: "0xDelegator",
-   * });
-   * ```
-   */
-  decryptBalanceAs({ delegatorAddress, accountAddress }: {
-    delegatorAddress: Address;
-    accountAddress?: Address;
-  }): Promise<bigint>;
-  /**
-   * Decrypt confidential balances for multiple tokens in parallel, returning
-   * successes and per-token errors separately. Pre-authorizes all token
-   * addresses in a single wallet signature, then delegates each decrypt to
-   * `sdk.decryption.decryptValues`.
-   *
-   * Tokens that fail to decrypt land in `errors` rather than aborting the
-   * whole batch — caller decides how to surface them.
-   *
-   * @param tokens - Array of {@link Token} instances bound to the same SDK.
-   * @param owner - Balance owner address.
-   * @returns `{ results, errors }` partitioning the per-token outcomes.
-   *
-   * @example
-   * ```ts
-   * const { results, errors } = await Token.batchBalancesOf(tokens, owner);
-   * ```
-   */
-  static batchBalancesOf(tokens: Token[], owner: Address): Promise<BatchBalancesResult>;
+  static batchBalancesOf(tokens: Token[], owner: Address): Promise<BatchBalancesResult>;
   /**
    * Batch decrypt confidential balances as a delegate across multiple tokens.
    * Mirrors {@link batchBalancesOf} but uses delegated credentials.
@@ -20488,343 +19900,607 @@ declare class WrappedToken extends Token {
   finalizeUnwrap(unwrapRequestId: EncryptedValue): Promise<TransactionResult>;
 }
 //#endregion
-//#region src/query/confidential-balance.d.ts
-/** Configuration for {@link confidentialBalanceQueryOptions}. */
-interface ConfidentialBalanceQueryConfig {
-  /** Address of the confidential token to read the balance of. */
-  tokenAddress: Address;
-  /** Account whose confidential balance to read; the query stays disabled until provided. */
-  account?: Address;
-  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
-  query?: Record<string, unknown>;
-}
-/** Query options for a single confidential token balance. Auto-gated on `account`. */
-declare function confidentialBalanceQueryOptions(token: Token, config: ConfidentialBalanceQueryConfig, signerContext?: SignerQueryContext): QueryFactoryOptions<bigint, Error, bigint, ReturnType<typeof zamaQueryKeys.confidentialBalance.owner>>;
-//#endregion
-//#region src/query/confidential-balances.d.ts
-/** Configuration for {@link confidentialBalancesQueryOptions}. */
-interface ConfidentialBalancesQueryConfig {
-  /** Account whose confidential balances to read; the query stays disabled until provided. */
-  account?: Address;
-  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
-  query?: Record<string, unknown>;
-}
-/** Builds TanStack Query options for reading the confidential balances of several tokens for one account in a single batch. */
-declare function confidentialBalancesQueryOptions(tokens: Token[], config?: ConfidentialBalancesQueryConfig, signerContext?: SignerQueryContext): QueryFactoryOptions<BatchBalancesResult, Error, BatchBalancesResult, ReturnType<typeof zamaQueryKeys.confidentialBalances.tokens>>;
-//#endregion
-//#region src/query/wrappers-registry.d.ts
-/** Base configuration shared by the wrappers-registry query option factories. */
-interface WrappersRegistryQueryConfig {
-  /** Registry contract address for the current chain; used as a query key discriminator. */
-  registryAddress: Address | undefined;
-  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
-  query?: Record<string, unknown>;
-}
-/** Builds TanStack Query options for reading all token wrapper pairs registered in the wrappers registry. */
-declare function tokenPairsQueryOptions(sdk: ZamaSDK, config: WrappersRegistryQueryConfig): QueryFactoryOptions<readonly TokenWrapperPair[], Error, readonly TokenWrapperPair[], ReturnType<typeof zamaQueryKeys.wrappersRegistry.tokenPairs>>;
-/** Configuration for {@link confidentialTokenAddressQueryOptions}. */
-interface ConfidentialTokenAddressQueryConfig extends WrappersRegistryQueryConfig {
-  /** Underlying ERC-20 token address whose confidential counterpart to look up. */
-  tokenAddress?: Address;
-}
-/** Builds TanStack Query options for reading the confidential token address registered for a given underlying ERC-20 token. */
-declare function confidentialTokenAddressQueryOptions(sdk: ZamaSDK, config: ConfidentialTokenAddressQueryConfig): QueryFactoryOptions<readonly [boolean, Address], Error, readonly [boolean, Address], ReturnType<typeof zamaQueryKeys.wrappersRegistry.confidentialTokenAddress>>;
-/** Configuration for {@link tokenAddressQueryOptions}. */
-interface TokenAddressQueryConfig extends WrappersRegistryQueryConfig {
-  /** Confidential token address whose underlying ERC-20 counterpart to look up. */
-  confidentialTokenAddress?: Address;
-}
-/** Builds TanStack Query options for reading the underlying ERC-20 token address registered for a given confidential token. */
-declare function tokenAddressQueryOptions(sdk: ZamaSDK, config: TokenAddressQueryConfig): QueryFactoryOptions<readonly [boolean, Address], Error, readonly [boolean, Address], ReturnType<typeof zamaQueryKeys.wrappersRegistry.tokenAddress>>;
-/** Builds TanStack Query options for reading the total number of token wrapper pairs in the registry. */
-declare function tokenPairsLengthQueryOptions(sdk: ZamaSDK, config: WrappersRegistryQueryConfig): QueryFactoryOptions<bigint, Error, bigint, ReturnType<typeof zamaQueryKeys.wrappersRegistry.tokenPairsLength>>;
-/** Configuration for {@link tokenPairsSliceQueryOptions}. */
-interface TokenPairsSliceQueryConfig extends WrappersRegistryQueryConfig {
-  /** Zero-based index of the first pair in the slice (inclusive). */
-  fromIndex?: bigint;
-  /** Index bounding the end of the slice. */
-  toIndex?: bigint;
-}
-/** Builds TanStack Query options for reading a contiguous slice of the registry's token wrapper pairs. */
-declare function tokenPairsSliceQueryOptions(sdk: ZamaSDK, config: TokenPairsSliceQueryConfig): QueryFactoryOptions<readonly TokenWrapperPair[], Error, readonly TokenWrapperPair[], ReturnType<typeof zamaQueryKeys.wrappersRegistry.tokenPairsSlice>>;
-/** Configuration for {@link tokenPairQueryOptions}. */
-interface TokenPairQueryConfig extends WrappersRegistryQueryConfig {
-  /** Zero-based index of the token wrapper pair to read. */
-  index?: bigint;
-}
-/** Builds TanStack Query options for reading a single token wrapper pair by its index in the registry. */
-declare function tokenPairQueryOptions(sdk: ZamaSDK, config: TokenPairQueryConfig): QueryFactoryOptions<TokenWrapperPair, Error, TokenWrapperPair, ReturnType<typeof zamaQueryKeys.wrappersRegistry.tokenPair>>;
-/** Configuration for {@link isConfidentialTokenValidQueryOptions}. */
-interface IsConfidentialTokenValidQueryConfig extends WrappersRegistryQueryConfig {
-  /** Confidential token address to validate against the registry. */
-  confidentialTokenAddress?: Address;
-}
-/** Builds TanStack Query options for checking whether a confidential token is registered and valid in the registry. */
-declare function isConfidentialTokenValidQueryOptions(sdk: ZamaSDK, config: IsConfidentialTokenValidQueryConfig): QueryFactoryOptions<boolean, Error, boolean, ReturnType<typeof zamaQueryKeys.wrappersRegistry.isConfidentialTokenValid>>;
-/** Configuration for {@link listPairsQueryOptions}. */
-interface ListPairsQueryConfig {
-  /**
-   * The registry address for this chain — used as a query key discriminator.
-   * The registry instance already knows how to resolve the address for the
-   * current chain; this field just keeps the TanStack Query cache isolated
-   * per registry contract.
-   */
-  registryAddress: Address | undefined;
-  /** 1-based page number to fetch; defaults to `1`. */
-  page?: number;
-  /** Number of pairs per page; defaults to `100`. */
-  pageSize?: number;
-  /** When `true`, resolve each pair's on-chain metadata; defaults to `false`. */
-  metadata?: boolean;
-  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
-  query?: Record<string, unknown>;
-}
+//#region src/wrappers-registry.d.ts
 /**
- * Query options for paginated listing of token wrapper pairs.
+ * Default wrappers registry addresses for known chains.
+ * Only includes chains where a registry is deployed (excludes Hardhat).
  *
- * Accepts a {@link WrappersRegistry} instance rather than a raw provider so that the
- * class-level TTL cache is shared across multiple `queryFn` executions. Pass
- * `sdk.registry` (the ZamaSDK lazy singleton) to ensure a single shared cache.
+ * @deprecated Read `registryAddress` from the chain presets instead (e.g.
+ * `sepolia.registryAddress`). Will be removed in the next major version.
  */
-declare function listPairsQueryOptions(registry: WrappersRegistry, config: ListPairsQueryConfig): QueryFactoryOptions<PaginatedResult<TokenWrapperPair | TokenWrapperPairWithMetadata>, Error, PaginatedResult<TokenWrapperPair | TokenWrapperPairWithMetadata>, ReturnType<typeof zamaQueryKeys.wrappersRegistry.listPairs>>;
-//#endregion
-//#region src/query/shield.d.ts
-/** Variables for {@link shieldMutationOptions}. */
-interface ShieldParams extends ShieldOptions {
-  /** Amount of the public ERC-20 to shield, in the token's base units. */
-  amount: bigint;
+declare const DefaultRegistryAddresses: Record<number, Address>;
+/** Configuration for {@link WrappersRegistry}. */
+interface WrappersRegistryConfig {
+  /** Read-only chain provider used for every registry lookup. */
+  provider: GenericProvider;
+  /**
+   * Per-chain registry address overrides, merged on top of
+   * {@link DefaultRegistryAddresses}. Use this to supply a registry
+   * address for custom or local chains (e.g. Hardhat).
+   *
+   * @example
+   * ```ts
+   * new WrappersRegistry({
+   *   provider,
+   *   registryAddresses: { [31337]: "0xYourHardhatRegistry" },
+   * });
+   * ```
+   */
+  registryAddresses?: Record<number, Address>;
+  /**
+   * How long cached registry results remain valid, in seconds.
+   * Default: `86400` (24 hours).
+   */
+  registryTTL?: number;
 }
-/** Builds TanStack Query mutation options for {@link WrappedToken.shield | shielding} a public ERC-20 into its confidential form. @see {@link ShieldParams} */
-declare function shieldMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.shield", Address], ShieldParams, TransactionResult>;
-//#endregion
-//#region src/query/transfer.d.ts
-/** Variables for {@link confidentialTransferMutationOptions}. */
-interface ConfidentialTransferParams extends TransferOptions {
-  /** Recipient address. */
-  to: Address;
-  /** Amount of tokens to transfer, in the token's base units. */
-  amount: bigint;
-}
-/** Builds TanStack Query mutation options for {@link Token.confidentialTransfer | transferring} confidential tokens. @see {@link ConfidentialTransferParams} */
-declare function confidentialTransferMutationOptions(token: Token): MutationFactoryOptions<readonly ["zama.confidentialTransfer", Address], ConfidentialTransferParams, TransactionResult>;
-//#endregion
-//#region src/query/transfer-and-call.d.ts
-/** Variables for {@link confidentialTransferAndCallMutationOptions}. */
-interface ConfidentialTransferAndCallParams extends TransferOptions {
-  /** Recipient address. */
-  to: Address;
-  /** Amount of tokens to transfer, in the token's base units. */
-  amount: bigint;
-  /** Opaque bytes forwarded to the recipient's ERC-7984 receiver hook. */
-  data: Hex;
-}
-/** Builds TanStack Query mutation options for {@link Token.confidentialTransferAndCall | transferring} confidential tokens and invoking the recipient's receiver hook. @see {@link ConfidentialTransferAndCallParams} */
-declare function confidentialTransferAndCallMutationOptions(token: Token): MutationFactoryOptions<readonly ["zama.confidentialTransferAndCall", Address], ConfidentialTransferAndCallParams, TransactionResult>;
-//#endregion
-//#region src/query/transfer-from.d.ts
-/** Variables for {@link confidentialTransferFromMutationOptions}. */
-interface ConfidentialTransferFromParams {
-  /** Address to transfer from. */
-  from: Address;
-  /** Recipient address. */
-  to: Address;
-  /** Amount of tokens to transfer, in the token's base units. */
-  amount: bigint;
-  /** Optional progress callbacks for the multi-step transfer flow. */
-  callbacks?: TransferCallbacks;
-}
-/** Builds TanStack Query mutation options for {@link Token.confidentialTransferFrom | transferring} confidential tokens from another account (operator flow). @see {@link ConfidentialTransferFromParams} */
-declare function confidentialTransferFromMutationOptions(token: Token): MutationFactoryOptions<readonly ["zama.confidentialTransferFrom", Address], ConfidentialTransferFromParams, TransactionResult>;
-//#endregion
-//#region src/query/transfer-from-and-call.d.ts
-/** Variables for {@link confidentialTransferFromAndCallMutationOptions}. */
-interface ConfidentialTransferFromAndCallParams {
-  /** Address to transfer from. */
-  from: Address;
-  /** Recipient address. */
-  to: Address;
-  /** Amount of tokens to transfer, in the token's base units. */
-  amount: bigint;
-  /** Opaque bytes forwarded to the recipient's ERC-7984 receiver hook. */
-  data: Hex;
-  /** Optional progress callbacks for the multi-step transfer flow. */
-  callbacks?: TransferCallbacks;
-}
-/** Builds TanStack Query mutation options for {@link Token.confidentialTransferFromAndCall | transferring} confidential tokens from another account and invoking the recipient's receiver hook. @see {@link ConfidentialTransferFromAndCallParams} */
-declare function confidentialTransferFromAndCallMutationOptions(token: Token): MutationFactoryOptions<readonly ["zama.confidentialTransferFromAndCall", Address], ConfidentialTransferFromAndCallParams, TransactionResult>;
-//#endregion
-//#region src/query/set-operator.d.ts
-/** Variables for {@link confidentialSetOperatorMutationOptions}. */
-interface ConfidentialSetOperatorParams {
-  /** Operator address to authorize. */
-  operator: Address;
-  /** Unix timestamp (seconds) when the operator authorization expires; defaults to one hour from now. */
-  until?: number;
-}
-/** Builds TanStack Query mutation options for {@link Token.setOperator | authorizing} an operator on a confidential token. @see {@link ConfidentialSetOperatorParams} */
-declare function confidentialSetOperatorMutationOptions(token: Token): MutationFactoryOptions<readonly ["zama.confidentialSetOperator", Address], ConfidentialSetOperatorParams, TransactionResult>;
-//#endregion
-//#region src/query/approve-underlying.d.ts
-/** Variables for {@link approveUnderlyingMutationOptions}. */
-interface ApproveUnderlyingParams {
-  /** Amount of the underlying ERC-20 to approve, in its base units; omit for a max approval. */
-  amount?: bigint;
-}
-/** Builds TanStack Query mutation options for {@link WrappedToken.approveUnderlying | approving} the wrapper to spend the underlying ERC-20. @see {@link ApproveUnderlyingParams} */
-declare function approveUnderlyingMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.approveUnderlying", Address], ApproveUnderlyingParams, TransactionResult>;
-//#endregion
-//#region src/query/unshield.d.ts
-/** Variables for {@link unshieldMutationOptions}. */
-interface UnshieldParams extends UnshieldOptions {
-  /** Amount of tokens to unshield, in the token's base units. */
-  amount: bigint;
-}
-/** Builds TanStack Query mutation options for {@link WrappedToken.unshield | unshielding} a confidential token back into its public ERC-20. @see {@link UnshieldParams} */
-declare function unshieldMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.unshield", Address], UnshieldParams, TransactionResult>;
-//#endregion
-//#region src/query/unshield-all.d.ts
-/** Variables for {@link unshieldAllMutationOptions}. */
-interface UnshieldAllParams extends UnshieldCallbacks {}
-/** Builds TanStack Query mutation options for {@link WrappedToken.unshieldAll | unshielding} the entire confidential balance back into the public ERC-20. @see {@link UnshieldAllParams} */
-declare function unshieldAllMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.unshieldAll", Address], UnshieldAllParams | void, TransactionResult>;
-//#endregion
-//#region src/query/resume-unshield.d.ts
-/** Variables for {@link resumeUnshieldMutationOptions}. */
-interface ResumeUnshieldParams extends UnshieldCallbacks {
-  /** Hash of the earlier unwrap request transaction to resume from. */
-  unwrapTxHash: Hex;
-}
-/** Builds TanStack Query mutation options for {@link WrappedToken.resumeUnshield | resuming} an interrupted unshield from its unwrap request transaction. @see {@link ResumeUnshieldParams} */
-declare function resumeUnshieldMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.resumeUnshield", Address], ResumeUnshieldParams, TransactionResult>;
-//#endregion
-//#region src/query/unwrap.d.ts
-/** Variables for {@link unwrapMutationOptions}. */
-interface UnwrapParams {
-  /** Amount of tokens to unwrap, in the token's base units. */
-  amount: bigint;
+/** Options for {@link WrappersRegistry.listPairs}. */
+interface ListPairsOptions {
+  /** Page number (1-indexed). Default: `1`. */
+  page?: number;
+  /** Number of items per page. Default: `100`. */
+  pageSize?: number;
+  /**
+   * When `true`, fetches on-chain metadata (name, symbol, decimals) for both
+   * the ERC-20 and confidential token, plus totalSupply for the ERC-20.
+   * Default: `false`.
+   */
+  metadata?: boolean;
 }
-/** Builds TanStack Query mutation options for {@link WrappedToken.unwrap | unwrapping} a confidential token (request phase of the two-phase unwrap). @see {@link UnwrapParams} */
-declare function unwrapMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.unwrap", Address], UnwrapParams, UnwrapResult>;
-//#endregion
-//#region src/query/wrap.d.ts
-/** Variables for {@link wrapMutationOptions}. */
-interface WrapParams extends WrapOptions {
-  /** Amount of the public ERC-20 to wrap, in the token's base units. */
-  amount: bigint;
+/**
+ * High-level interface for the on-chain token wrappers registry.
+ *
+ * Uses the configured {@link GenericProvider} to resolve the correct registry
+ * contract address for the current chain and exposes typed read helpers for
+ * every registry query. Results are cached in memory with a configurable TTL
+ * (default 24 hours).
+ *
+ * @example
+ * ```ts
+ * const registry = new WrappersRegistry({ provider });
+ *
+ * // Paginated listing
+ * const page1 = await registry.listPairs({ page: 1, pageSize: 20 });
+ *
+ * // Structured lookups
+ * const result = await registry.getConfidentialToken(erc20Address);
+ * if (result) console.log(result.confidentialTokenAddress);
+ *
+ * // Force refresh
+ * registry.refresh();
+ * ```
+ */
+declare class WrappersRegistry {
+  #private;
+  /** Read-only chain access used for registry contract reads. */
+  readonly provider: GenericProvider;
+  constructor(config: WrappersRegistryConfig);
+  /**
+   * Synchronous lookup of the registry address for a given chain ID.
+   * Returns `undefined` if no address is configured for that chain.
+   */
+  getAddress(chainId: number): Address | undefined;
+  /**
+   * Force-invalidate the in-memory cache. The next call to any read method
+   * will fetch fresh data from the chain.
+   */
+  refresh(): void;
+  /**
+   * The cache TTL in milliseconds.
+   * Exposed so query option factories can set a matching `staleTime`.
+   */
+  get ttlMs(): number;
+  /**
+   * Resolve the registry contract address for the current chain.
+   *
+   * Priority: `registryAddresses[chainId]` \> built-in default.
+   *
+   * @returns The registry contract address for the connected chain.
+   * @throws if no address is configured for the chain. {@link ConfigurationError}
+   */
+  getRegistryAddress(): Promise<Address>;
+  /**
+   * List token wrapper pairs with page-based pagination.
+   *
+   * Internally maps to `getTokenConfidentialTokenPairsSlice` on-chain.
+   *
+   * @param options - Pagination and enrichment options.
+   * @returns A {@link PaginatedResult} of pairs.
+   *
+   * @example
+   * ```ts
+   * const result = await registry.listPairs({ page: 1, pageSize: 20 });
+   * console.log(`${result.total} pairs, showing page ${result.page}`);
+   *
+   * // With on-chain metadata
+   * const withMeta = await registry.listPairs({ metadata: true, pageSize: 10 });
+   * for (const pair of withMeta.items) {
+   *   console.log(pair.underlying.symbol, "→", pair.confidential.symbol);
+   * }
+   * ```
+   */
+  listPairs(options: ListPairsOptions & {
+    metadata: true;
+  }): Promise<PaginatedResult<TokenWrapperPairWithMetadata>>;
+  /** Lists registered underlying/confidential token pairs; pass `{ metadata: true }` to include on-chain token metadata. */
+  listPairs(options?: ListPairsOptions): Promise<PaginatedResult<TokenWrapperPair>>;
+  /**
+   * Look up the confidential token for a given plain ERC-20 address.
+   *
+   * @param tokenAddress - The plain ERC-20 token address.
+   * @returns The lookup result, or `null` if the token has never been registered.
+   *   **Note:** revoked tokens (registered then invalidated) return a non-null result
+   *   with `isValid: false`. Check `result.isValid` explicitly rather than using
+   *   `if (result)` to guard against processing revoked tokens.
+   *
+   * @example
+   * ```ts
+   * const result = await registry.getConfidentialToken(usdcAddress);
+   * if (result?.isValid) {
+   *   console.log(result.confidentialTokenAddress);
+   * }
+   * ```
+   */
+  getConfidentialToken(tokenAddress: Address): Promise<{
+    confidentialTokenAddress: Address;
+    isValid: boolean;
+  } | null>;
+  /**
+   * Reverse lookup — find the plain ERC-20 for a given confidential token.
+   *
+   * @param confidentialTokenAddress - The confidential token address.
+   * @returns The lookup result, or `null` if no pair is registered.
+   *
+   * @example
+   * ```ts
+   * const result = await registry.getUnderlyingToken(cUsdcAddress);
+   * if (result) {
+   *   console.log(result.tokenAddress, result.isValid);
+   * }
+   * ```
+   */
+  getUnderlyingToken(confidentialTokenAddress: Address): Promise<{
+    tokenAddress: Address;
+    isValid: boolean;
+  } | null>;
+  /**
+   * Fetch all token wrapper pairs from the registry.
+   *
+   * @returns All registered `TokenWrapperPair` entries.
+   */
+  getTokenPairs(): Promise<readonly TokenWrapperPair[]>;
+  /**
+   * Get the total number of token wrapper pairs.
+   *
+   * @returns The count as a bigint.
+   */
+  getTokenPairsLength(): Promise<bigint>;
+  /**
+   * Fetch a range of token wrapper pairs (paginated by index).
+   *
+   * @param fromIndex - Start index (inclusive).
+   * @param toIndex - End index (exclusive).
+   * @returns The slice of `TokenWrapperPair` entries.
+   */
+  getTokenPairsSlice(fromIndex: bigint, toIndex: bigint): Promise<readonly TokenWrapperPair[]>;
+  /**
+   * Fetch a single token wrapper pair by index.
+   *
+   * @param index - Zero-based pair index.
+   * @returns The `TokenWrapperPair` at that index.
+   */
+  getTokenPair(index: bigint): Promise<TokenWrapperPair>;
+  /**
+   * Look up the confidential token address for a given plain ERC-20 token.
+   *
+   * @param tokenAddress - The plain ERC-20 token address.
+   * @returns A tuple `[isValid, confidentialTokenAddress]`. `isValid` is `true` only for a
+   *   registered, non-revoked wrapper. The address is the zero address when no pair is registered.
+   *   A non-zero address with `isValid=false` means the wrapper was registered but later revoked.
+   */
+  getConfidentialTokenAddress(tokenAddress: Address): Promise<readonly [boolean, Address]>;
+  /**
+   * Reverse lookup — find the plain ERC-20 for a given confidential token.
+   *
+   * @param confidentialTokenAddress - The confidential token address.
+   * @returns A tuple `[isValid, tokenAddress]`. `isValid` is `true` only for a registered,
+   *   non-revoked wrapper. The address is the zero address when no pair is registered.
+   *   A non-zero address with `isValid=false` means the wrapper was registered but later revoked.
+   */
+  getTokenAddress(confidentialTokenAddress: Address): Promise<readonly [boolean, Address]>;
+  /**
+   * Check whether a confidential token is registered and valid.
+   *
+   * @param confidentialTokenAddress - The confidential token address to check.
+   * @returns `true` if the token is a known valid wrapper in the registry.
+   */
+  isConfidentialTokenValid(confidentialTokenAddress: Address): Promise<boolean>;
 }
-/** Builds TanStack Query mutation options for {@link WrappedToken.wrap | wrapping} a public ERC-20 into its confidential form. @see {@link WrapParams} */
-declare function wrapMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.wrap", Address], WrapParams, TransactionResult>;
-//#endregion
-//#region src/query/unwrap-all.d.ts
-/** Builds TanStack Query mutation options for {@link WrappedToken.unwrapAll | unwrapping} the entire confidential balance. */
-declare function unwrapAllMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.unwrapAll", Address], void, UnwrapResult>;
-//#endregion
-//#region src/query/finalize-unwrap.d.ts
-/** Variables for {@link finalizeUnwrapMutationOptions}. */
-type FinalizeUnwrapParams = {
-  /** Identifier from an `UnwrapRequested` event. */
-  unwrapRequestId: EncryptedValue;
-};
-/** Builds TanStack Query mutation options for {@link WrappedToken.finalizeUnwrap | finalizing} a previously requested unwrap. @see {@link FinalizeUnwrapParams} */
-declare function finalizeUnwrapMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.finalizeUnwrap", Address], FinalizeUnwrapParams, TransactionResult>;
 //#endregion
-//#region src/query/encrypt.d.ts
-/** Builds TanStack Query mutation options for {@link ZamaSDK.encrypt | encrypting} plaintext inputs into an encrypted payload. */
-declare function encryptMutationOptions(sdk: ZamaSDK): MutationFactoryOptions<readonly ["zama.encrypt"], EncryptParams, EncryptResult>;
-//#endregion
-//#region src/query/delegated-decrypt.d.ts
-/** Variables for {@link delegatedDecryptValuesMutationOptions}. */
-interface DelegatedDecryptValuesMutationParams {
-  /** Encrypted values (with their contract addresses) to decrypt. */
-  encryptedInputs: EncryptedInput[];
-  /** Address of the account that delegated decryption rights to the connected wallet. */
-  delegatorAddress: Address;
+//#region src/zama-sdk.d.ts
+/** Instance-level options that are deliberately not part of the shareable config object. */
+interface ZamaSDKOptions {
+  /**
+   * Encrypts the transport key pair's private half at rest. Headless environments only
+   * (CLI tools, servers, agents); the constructor rejects it in browser contexts. Supply
+   * at least 32 random bytes, or a string of at least 64 characters, from a CSPRNG or
+   * secrets manager. The SDK copies a Uint8Array secret and zeroizes its own copy after
+   * key import; it never touches your buffer, so zeroize yours after construction.
+   * The SDK never persists or exposes this value. Omit for the default:
+   * plaintext at rest, security delegated to the storage backend.
+   */
+  transportKeyPairDerivationSecret?: string | Uint8Array;
 }
-/** Builds TanStack Query mutation options for {@link Decryption.delegatedDecryptValues | decrypting} encrypted values via delegated decryption credentials. @see {@link DelegatedDecryptValuesMutationParams} */
-declare function delegatedDecryptValuesMutationOptions(sdk: ZamaSDK): MutationFactoryOptions<readonly ["zama.delegatedDecryptValues"], DelegatedDecryptValuesMutationParams, Readonly<Record<EncryptedValue, ClearValue>>>;
-//#endregion
-//#region src/query/public-decrypt.d.ts
-/** Builds TanStack Query mutation options for {@link Decryption.decryptPublicValues | publicly decrypting} encrypted values, caching each clear result. */
-declare function decryptPublicValuesMutationOptions(sdk: ZamaSDK): MutationFactoryOptions<readonly ["zama.decryptPublicValues"], EncryptedValue[], DecryptPublicValuesResult>;
-//#endregion
-//#region src/query/grant-permit.d.ts
-/** Builds TanStack Query mutation options for {@link Permits.grantPermit | granting} decryption permits for the given contract addresses. */
-declare function grantPermitMutationOptions(sdk: ZamaSDK): MutationFactoryOptions<readonly ["zama.grantPermit"], Address[], void>;
-//#endregion
-//#region src/query/has-permit.d.ts
-/** Configuration for {@link hasPermitQueryOptions}. */
-interface HasPermitQueryConfig {
-  /** Contract addresses to check credentials against. */
-  contractAddresses: Address[];
+/**
+ * ZamaSDK — composes a RelayerSDK with contract abstraction.
+ *
+ * Exposes domain namespaces for permits, delegations, decryption, offline
+ * signing, and tokens, plus an unchanged registry, a top-level `encrypt`, and
+ * lifecycle methods. Internal `*Service` classes do the work; the namespace
+ * classes own SDK-level guards (chain alignment, signer requirement, event
+ * emission).
+ */
+declare class ZamaSDK {
+  #private;
+  /** Read-only chain access used for all contract reads. */
+  readonly provider: GenericProvider;
+  /** Wallet signer used for write operations, or `undefined` when the SDK is read-only. */
+  readonly signer: GenericSigner | undefined;
+  /** Storage for cached permits and transport key pairs. */
+  readonly storage: GenericStorage;
+  /**
+   * A {@link WrappersRegistry} instance auto-configured for the current chain.
+   * Uses built-in defaults from chain configs, and the SDK's `registryTTL` if configured.
+   */
+  readonly registry: WrappersRegistry;
+  /** Permit and keypair management. */
+  readonly permits: Permits;
+  /** On-chain decryption-delegation management. */
+  readonly delegations: Delegations;
+  /** FHE decryption (user, delegated user, public). */
+  readonly decryption: Decryption;
+  /** Offline-signing pipeline: `prepare` builds an unsigned tx the caller signs and broadcasts out-of-process — for HSM, policy-engine, and cross-process custody workflows. */
+  readonly offline: Offline;
+  constructor(config: ZamaConfig, options?: ZamaSDKOptions);
+  /**
+   * The single-chain relayer backend for the **currently active** chain.
+   */
+  get relayer(): RelayerSDK;
+  /**
+   * Create a {@link WrappersRegistry} instance bound to this SDK's provider.
+   * Inherits the registry addresses derived from the SDK's chain configs, so
+   * the result is consistent with {@link ZamaSDK.registry}.
+   *
+   * @param registryAddresses - Optional per-chain overrides for this registry instance.
+   * @returns A {@link WrappersRegistry} instance.
+   *
+   * @example
+   * ```ts
+   * // Addresses resolved from the SDK's chain configs
+   * const registry = sdk.createWrappersRegistry();
+   *
+   * // Hardhat or custom chain — override per chain for this registry instance
+   * const registry = sdk.createWrappersRegistry({ [31337]: "0xYourRegistry" });
+   *
+   * const pairs = await registry.getTokenPairs();
+   * ```
+   */
+  createWrappersRegistry(registryAddresses?: Record<number, Address>): WrappersRegistry;
+  /**
+   * Encrypt one or more plaintext values into FHE ciphertexts.
+   *
+   * @param params - Typed FHE inputs, the target contract address, and the user address.
+   * @returns External encrypted values and the input proof for on-chain submission.
+   * @throws if FHE encryption fails. {@link EncryptionFailedError}
+   *
+   * @example
+   * ```ts
+   * const { encryptedValues, inputProof } = await sdk.encrypt({
+   *   values: [{ value: 1000n, type: "euint64" }],
+   *   contractAddress: "0xToken",
+   *   userAddress: "0xUser",
+   * });
+   * ```
+   */
+  encrypt(params: EncryptParams, options?: Pick<FhevmRelayerOptions, "signal" | "timeout">): Promise<EncryptResult>;
+  /**
+   * Create a high-level ERC-20-style interface for an ERC-7984 confidential token.
+   * Supports balance queries, transfers, operator approvals, and decryption.
+   *
+   * For ERC-7984 wrappers (shield/unshield/allowance), use {@link createWrappedToken} instead.
+   *
+   * @param address - The confidential token contract address.
+   * @returns A {@link Token} instance bound to this SDK.
+   *
+   * @example
+   * ```ts
+   * const token = sdk.createToken(cUSDT);
+   * const balance = await token.balanceOf(userAddress);
+   * ```
+   */
+  createToken(address: Address): Token;
+  /**
+   * Create a high-level interface for an ERC-7984 wrapper token.
+   * Extends {@link Token} with shield/unshield/allowance/finalize-unwrap operations.
+   *
+   * @param address - The wrapper token contract address.
+   * @returns A {@link WrappedToken} instance bound to this SDK.
+   *
+   * @example
+   * ```ts
+   * const wrapped = sdk.createWrappedToken(wUSDT);
+   * await wrapped.shield(1_000_000n);
+   * ```
+   */
+  createWrappedToken(address: Address): WrappedToken;
   /**
-   * Standard TanStack query options. `hasPermit` intentionally overrides cache
-   * timing because permit state is wallet-local, not server state: every fetch
-   * should read the SDK credential service directly.
+   * Unsubscribe from signer lifecycle events without terminating the relayer.
+   * Call this when the SDK instance is being replaced but the relayer is shared
+   * (e.g. React provider remount in Strict Mode).
    */
-  query?: Record<string, unknown>;
-}
-/** Builds TanStack Query options for reading whether the connected wallet holds a valid decryption permit for the given contracts. */
-declare function hasPermitQueryOptions(sdk: ZamaSDK, config: HasPermitQueryConfig, signerContext?: SignerQueryContext): QueryFactoryOptions<boolean, Error, boolean, ReturnType<typeof zamaQueryKeys.hasPermit.scope>>;
-//#endregion
-//#region src/query/revoke-permits.d.ts
-/** TanStack Query mutation factory for {@link Permits.revokePermits}. */
-declare function revokePermitsMutationOptions(sdk: ZamaSDK): MutationFactoryOptions<readonly ["zama.revokePermits"], Address[] | void, void>;
-//#endregion
-//#region src/query/clear-credentials.d.ts
-/** TanStack Query mutation factory for {@link Permits.clear}. */
-declare function clearCredentialsMutationOptions(sdk: ZamaSDK): MutationFactoryOptions<readonly ["zama.clearCredentials"], void, void>;
-//#endregion
-//#region src/query/delegate-decryption.d.ts
-/** Variables for {@link delegateDecryptionMutationOptions}. */
-interface DelegateDecryptionParams {
-  /** Address to grant delegated decryption rights to. */
-  delegateAddress: Address;
-  /** When the delegation expires; omit for no expiry. */
-  expirationDate?: Date;
+  dispose(): void;
+  /**
+   * Terminate the relayer backend and clean up resources.
+   * Call this when the SDK is no longer needed (e.g. on unmount or shutdown).
+   */
+  terminate(): void;
+  /**
+   * Implements the TC39 Explicit Resource Management protocol.
+   * Calls {@link terminate} when the `using` binding goes out of scope,
+   * unsubscribing signer events and shutting down the relayer.
+   *
+   * @example
+   * ```ts
+   * {
+   *   using sdk = new ZamaSDK({ relayer, provider, signer, storage });
+   *   await sdk.permits.grantPermit([cUSDT]);
+   *   const balance = await sdk.createToken(cUSDT).balanceOf(userAddress);
+   * } // sdk.terminate() called automatically here
+   * ```
+   */
+  [Symbol.dispose](): void;
 }
-/** Builds TanStack Query mutation options for {@link Delegations.delegateDecryption | granting} delegated decryption rights on a contract. @see {@link DelegateDecryptionParams} */
-declare function delegateDecryptionMutationOptions(sdk: ZamaSDK, contractAddress: Address): MutationFactoryOptions<readonly ["zama.delegateDecryption", Address], DelegateDecryptionParams, TransactionResult>;
 //#endregion
-//#region src/query/decrypt-balance-as.d.ts
-/** Variables for {@link decryptBalanceAsMutationOptions}. */
-interface DecryptBalanceAsParams {
-  /** Address of the account that delegated decryption rights to the connected wallet. */
-  delegatorAddress: Address;
-  /** Account whose on-chain balance to read; defaults to the delegator address. */
-  accountAddress?: Address;
+//#region src/query/factory-types.d.ts
+/**
+ * TanStack Query options object returned by the SDK's `*QueryOptions` factories:
+ * `QueryObserverOptions` with `queryKey` and `queryFn` required and the
+ * cache-internal keys (`queryHash`, `queryKeyHashFn`, `throwOnError`) removed.
+ */
+type QueryFactoryOptions<TQueryFnData = unknown, TError = Error, TData = TQueryFnData, TQueryKey extends QueryKey = QueryKey> = Omit<Omit<QueryObserverOptions<TQueryFnData, TError, TData, TQueryFnData, TQueryKey>, "queryKey"> & Required<Pick<QueryObserverOptions<TQueryFnData, TError, TData, TQueryFnData, TQueryKey>, "queryKey">>, "queryFn" | "queryHash" | "queryKeyHashFn" | "throwOnError"> & {
+  queryFn: Exclude<QueryObserverOptions<TQueryFnData, TError, TData, TQueryFnData, TQueryKey>["queryFn"], typeof skipToken | undefined>;
+};
+/** TanStack Query mutation options object returned by the SDK's `*MutationOptions` factories. */
+interface MutationFactoryOptions<TMutationKey extends readonly unknown[], TVariables, TData, TOnMutateResult = unknown> {
+  /** Cache key identifying the mutation. */
+  mutationKey: TMutationKey;
+  /** Runs the mutation for the given variables. */
+  mutationFn: (variables: TVariables) => Promise<TData>;
+  /** Optional callback invoked after the mutation succeeds. */
+  onSuccess?: (data: TData, variables: TVariables, onMutateResult: TOnMutateResult, context: MutationFunctionContext) => void;
 }
-/** Builds TanStack Query mutation options for {@link Token.decryptBalanceAs | decrypting} a balance via delegated decryption credentials. @see {@link DecryptBalanceAsParams} */
-declare function decryptBalanceAsMutationOptions(token: Token): MutationFactoryOptions<readonly ["zama.decryptBalanceAs", Address], DecryptBalanceAsParams, bigint>;
 //#endregion
-//#region src/query/batch-decrypt-balances-as.d.ts
-/** Variables for {@link batchDecryptBalancesAsMutationOptions}. */
-type BatchDecryptBalancesAsParams = BatchDecryptAsOptions;
-/** Builds TanStack Query mutation options for {@link Token.batchDecryptBalancesAs | decrypting} multiple token balances via delegated decryption credentials. @see {@link BatchDecryptBalancesAsParams} */
-declare function batchDecryptBalancesAsMutationOptions(tokens: Token[]): MutationFactoryOptions<readonly ["zama.batchDecryptBalancesAs", ...Address[]], BatchDecryptBalancesAsParams, Map<Address, bigint>>;
+//#region src/query/query-keys.d.ts
+/**
+ * Canonical query-key namespace for `@zama-fhe/sdk/query`.
+ *
+ * @example
+ * ```ts
+ * queryClient.invalidateQueries({
+ *   queryKey: zamaQueryKeys.confidentialBalance.token("0xToken"),
+ * });
+ * ```
+ */
+declare const zamaQueryKeys: {
+  readonly confidentialBalance: {
+    readonly all: readonly ["zama.confidentialBalance"];
+    readonly token: (tokenAddress: Address) => readonly ["zama.confidentialBalance", {
+      readonly tokenAddress: `0x${string}`;
+    }];
+    readonly owner: (tokenAddress: Address, owner?: Address, walletAccount?: WalletAccount) => readonly ["zama.confidentialBalance", {
+      readonly owner?: `0x${string}` | undefined;
+      readonly walletAddress: `0x${string}`;
+      readonly walletChainId: number;
+      readonly tokenAddress: `0x${string}`;
+    } | {
+      readonly owner?: `0x${string}` | undefined;
+      readonly walletAddress?: undefined;
+      readonly walletChainId?: undefined;
+      readonly tokenAddress: `0x${string}`;
+    }];
+  };
+  readonly confidentialBalances: {
+    readonly all: readonly ["zama.confidentialBalances"];
+    readonly tokens: (tokenAddresses: Address[], owner?: Address, walletAccount?: WalletAccount) => readonly ["zama.confidentialBalances", {
+      readonly owner?: `0x${string}` | undefined;
+      readonly walletAddress: `0x${string}`;
+      readonly walletChainId: number;
+      readonly tokenAddresses: `0x${string}`[];
+    } | {
+      readonly owner?: `0x${string}` | undefined;
+      readonly walletAddress?: undefined;
+      readonly walletChainId?: undefined;
+      readonly tokenAddresses: `0x${string}`[];
+    }];
+  };
+  readonly tokenMetadata: {
+    readonly all: readonly ["zama.tokenMetadata"];
+    readonly token: (tokenAddress: Address) => readonly ["zama.tokenMetadata", {
+      readonly tokenAddress: `0x${string}`;
+    }];
+  };
+  readonly isConfidential: {
+    readonly all: readonly ["zama.isConfidential"];
+    readonly token: (tokenAddress: Address) => readonly ["zama.isConfidential", {
+      readonly tokenAddress: `0x${string}`;
+    }];
+  };
+  readonly isWrapper: {
+    readonly all: readonly ["zama.isWrapper"];
+    readonly token: (tokenAddress: Address) => readonly ["zama.isWrapper", {
+      readonly tokenAddress: `0x${string}`;
+    }];
+  };
+  readonly wrapperDiscovery: {
+    readonly all: readonly ["zama.wrapperDiscovery"];
+    readonly token: (tokenAddress?: Address, erc20Address?: Address, registryAddress?: Address) => readonly ["zama.wrapperDiscovery", {
+      readonly registryAddress?: `0x${string}` | undefined;
+      readonly erc20Address?: `0x${string}` | undefined;
+      readonly tokenAddress?: `0x${string}` | undefined;
+    }];
+  };
+  readonly underlyingAllowance: {
+    readonly all: readonly ["zama.underlyingAllowance"];
+    readonly token: (tokenAddress: Address) => readonly ["zama.underlyingAllowance", {
+      readonly tokenAddress: `0x${string}`;
+    }];
+    readonly scope: (tokenAddress: Address, owner?: Address) => readonly ["zama.underlyingAllowance", {
+      readonly owner?: `0x${string}` | undefined;
+      readonly tokenAddress: `0x${string}`;
+    }];
+  };
+  readonly confidentialIsOperator: {
+    readonly all: readonly ["zama.confidentialIsOperator"];
+    readonly token: (tokenAddress?: Address) => readonly ["zama.confidentialIsOperator", {
+      tokenAddress: `0x${string}`;
+    } | {
+      tokenAddress?: undefined;
+    }];
+    readonly scope: (tokenAddress?: Address, holder?: Address, spender?: Address) => readonly ["zama.confidentialIsOperator", {
+      readonly spender?: `0x${string}` | undefined;
+      readonly holder?: `0x${string}` | undefined;
+      readonly tokenAddress?: `0x${string}` | undefined;
+    }];
+  };
+  readonly totalSupply: {
+    readonly all: readonly ["zama.totalSupply"];
+    readonly token: (tokenAddress: Address) => readonly ["zama.totalSupply", {
+      readonly tokenAddress: `0x${string}`;
+    }];
+  };
+  readonly pendingUnshield: {
+    readonly all: readonly ["zama.pendingUnshield"];
+    readonly token: (tokenAddress: Address) => readonly ["zama.pendingUnshield", {
+      readonly tokenAddress: `0x${string}`;
+    }];
+  };
+  readonly hasPermit: {
+    readonly all: readonly ["zama.hasPermit"];
+    readonly scope: (contractAddresses: Address[], walletAccount?: WalletAccount) => readonly ["zama.hasPermit", {
+      readonly contractAddresses: `0x${string}`[];
+      readonly walletAddress: `0x${string}`;
+      readonly walletChainId: number;
+    } | {
+      readonly contractAddresses: `0x${string}`[];
+      readonly walletAddress?: undefined;
+      readonly walletChainId?: undefined;
+    }];
+  };
+  readonly delegationStatus: {
+    readonly all: readonly ["zama.delegationStatus"];
+    readonly contract: (contractAddress?: Address) => readonly ["zama.delegationStatus", {
+      contractAddress: `0x${string}`;
+    } | {
+      contractAddress?: undefined;
+    }];
+    readonly scope: (contractAddress?: Address, delegator?: Address, delegate?: Address) => readonly ["zama.delegationStatus", {
+      readonly delegateAddress?: `0x${string}` | undefined;
+      readonly delegatorAddress?: `0x${string}` | undefined;
+      readonly contractAddress?: `0x${string}` | undefined;
+    }];
+  };
+  readonly decryption: {
+    readonly all: readonly ["zama.decryption"];
+    readonly encryptedValue: (encryptedValue: string, contractAddress?: Address) => readonly ["zama.decryption", {
+      readonly contractAddress?: `0x${string}` | undefined;
+      readonly encryptedValue: string;
+    }];
+    readonly encryptedInputs: (encryptedInputs: readonly {
+      encryptedValue: string;
+      contractAddress: Address;
+    }[], walletAccount?: WalletAccount) => readonly ["zama.decryption", {
+      readonly encryptedInputs: {
+        encryptedValue: Hex;
+        contractAddress: `0x${string}`;
+      }[];
+      readonly walletAddress: `0x${string}`;
+      readonly walletChainId: number;
+    } | {
+      readonly encryptedInputs: {
+        encryptedValue: Hex;
+        contractAddress: `0x${string}`;
+      }[];
+      readonly walletAddress?: undefined;
+      readonly walletChainId?: undefined;
+    }];
+  };
+  readonly wrappersRegistry: {
+    readonly all: readonly ["zama.wrappersRegistry"];
+    readonly chainId: () => readonly ["zama.wrappersRegistry", {
+      readonly type: "chainId";
+    }];
+    readonly tokenPairs: (registryAddress: Address) => readonly ["zama.wrappersRegistry", {
+      readonly type: "tokenPairs";
+      readonly registryAddress: `0x${string}`;
+    }];
+    readonly confidentialTokenAddress: (registryAddress: Address, tokenAddress: Address) => readonly ["zama.wrappersRegistry", {
+      readonly type: "confidentialTokenAddress";
+      readonly registryAddress: `0x${string}`;
+      readonly tokenAddress: `0x${string}`;
+    }];
+    readonly tokenAddress: (registryAddress: Address, confidentialTokenAddress: Address) => readonly ["zama.wrappersRegistry", {
+      readonly type: "tokenAddress";
+      readonly registryAddress: `0x${string}`;
+      readonly confidentialTokenAddress: `0x${string}`;
+    }];
+    readonly tokenPairsLength: (registryAddress: Address) => readonly ["zama.wrappersRegistry", {
+      readonly type: "tokenPairsLength";
+      readonly registryAddress: `0x${string}`;
+    }];
+    readonly tokenPairsSlice: (registryAddress: Address, fromIndex: string, toIndex: string) => readonly ["zama.wrappersRegistry", {
+      readonly type: "tokenPairsSlice";
+      readonly registryAddress: `0x${string}`;
+      readonly fromIndex: string;
+      readonly toIndex: string;
+    }];
+    readonly tokenPair: (registryAddress: Address, index: string) => readonly ["zama.wrappersRegistry", {
+      readonly type: "tokenPair";
+      readonly registryAddress: `0x${string}`;
+      readonly index: string;
+    }];
+    readonly isConfidentialTokenValid: (registryAddress: Address, confidentialTokenAddress: Address) => readonly ["zama.wrappersRegistry", {
+      readonly type: "isConfidentialTokenValid";
+      readonly registryAddress: `0x${string}`;
+      readonly confidentialTokenAddress: `0x${string}`;
+    }];
+    readonly listPairs: (registryAddress: Address, page: number, pageSize: number, metadata: boolean) => readonly ["zama.wrappersRegistry", {
+      readonly type: "listPairs";
+      readonly registryAddress: `0x${string}`;
+      readonly page: number;
+      readonly pageSize: number;
+      readonly metadata: boolean;
+    }];
+  };
+};
 //#endregion
-//#region src/query/revoke-delegation.d.ts
-/** Variables for {@link revokeDelegationMutationOptions}. */
-interface RevokeDelegationParams {
-  /** Address whose delegated decryption rights to revoke. */
-  delegateAddress: Address;
+//#region src/query/signer-query-context.d.ts
+/** Connected-wallet context threaded into query factories to scope cache keys and gate signer-dependent queries. */
+interface SignerQueryContext {
+  /** Connected wallet account; queries that need a signer stay disabled until it is set. */
+  walletAccount?: WalletAccount;
 }
-/** Builds TanStack Query mutation options for {@link Delegations.revokeDelegation | revoking} delegated decryption rights on a contract. @see {@link RevokeDelegationParams} */
-declare function revokeDelegationMutationOptions(sdk: ZamaSDK, contractAddress: Address): MutationFactoryOptions<readonly ["zama.revokeDelegation", Address], RevokeDelegationParams, TransactionResult>;
 //#endregion
-//#region src/query/delegation-status.d.ts
-/** Configuration for {@link delegationStatusQueryOptions}. */
-interface DelegationStatusQueryConfig {
-  /** Contract the delegation applies to; pass `undefined` to keep the query disabled. */
-  contractAddress: Address | undefined;
-  /** Address granting the delegated decryption rights; the query stays disabled until provided. */
-  delegatorAddress?: Address;
-  /** Address receiving the delegated decryption rights; the query stays disabled until provided. */
-  delegateAddress?: Address;
-  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
-  query?: Record<string, unknown>;
+//#region src/query/user-decrypt.d.ts
+/** A single encrypted value to decrypt, paired with the contract that owns it. */
+interface EncryptedInput {
+  /** Encrypted handle to decrypt. */
+  encryptedValue: EncryptedValue;
+  /** Address of the contract the encrypted value belongs to. */
+  contractAddress: Address;
 }
-/** Builds TanStack Query options for reading the decryption-delegation status between a delegator and a delegate on a contract. */
-declare function delegationStatusQueryOptions(sdk: ZamaSDK, config: DelegationStatusQueryConfig): QueryFactoryOptions<DelegationStatus, Error, DelegationStatus, ReturnType<typeof zamaQueryKeys.delegationStatus.scope>>;
+/** Decrypted clear values keyed by encrypted handle. */
+type DecryptResult = Readonly<Record<EncryptedValue, ClearValue>>;
+/** Builds TanStack Query options for decrypting a batch of encrypted handles into their clear values. */
+declare function decryptValuesQueryOptions(sdk: ZamaSDK, encryptedInputs: EncryptedInput[], signerContext?: SignerQueryContext): QueryFactoryOptions<DecryptResult, Error, DecryptResult, ReturnType<typeof zamaQueryKeys.decryption.encryptedInputs>>;
 //#endregion
 //#region src/services/decryption-service.d.ts
 /** Options shared by the delegated-decrypt entry points. */
@@ -20854,197 +20530,6 @@ interface BatchDecryptResult {
   items: BatchDecryptItem[];
 }
 //#endregion
-//#region src/namespaces/offline.d.ts
-/**
- * Namespace for the offline-signing pipeline —
- * `prepare → [external sign + self-publish]` — for institutional custody, HSM
- * ceremonies, and policy-engine workflows where signing runs out-of-process and
- * cannot happen synchronously in a single Promise.
- */
-declare class Offline {
-  #private;
-  /**
-   * Build an RLP-encoded unsigned transaction for the given request. The
-   * caller signs it externally — via an HSM ceremony, an out-of-process
-   * custodian, or any signer holding the key — and broadcasts the signed bytes
-   * through its own channel.
-   *
-   * Signer-optional: works without a configured signer (canonical shape for
-   * cross-process custody — the back-end signer service consumes
-   * `prepared.unsignedTx` and returns signed bytes).
-   *
-   * @remarks
-   * `request.from` is only a declaration — the SDK does not prove the caller
-   * controls it, and an EIP-1559 unsigned tx carries no `from` field at all
-   * (the on-chain sender is whichever key signs the bytes). Point `from` at
-   * the account the custodian will sign with; custodians enforce key-control
-   * at sign time — a signing request for a key the credential can't use fails
-   * there — so a mismatched `from` cannot make the custodian sign from an
-   * account you don't control. Verifying control of `from` up front is still
-   * the application's responsibility.
-   */
-  prepare<K extends TransactionKind>(request: Extract<PrepareTransactionRequest, {
-    kind: K;
-  }>, options?: PrepareOptions): Promise<PreparedFor<K>>;
-}
-//#endregion
-//#region src/zama-sdk.d.ts
-/** Instance-level options that are deliberately not part of the shareable config object. */
-interface ZamaSDKOptions {
-  /**
-   * Encrypts the transport key pair's private half at rest. Headless environments only
-   * (CLI tools, servers, agents); the constructor rejects it in browser contexts. Supply
-   * at least 32 random bytes, or a string of at least 64 characters, from a CSPRNG or
-   * secrets manager. The SDK copies a Uint8Array secret and zeroizes its own copy after
-   * key import; it never touches your buffer, so zeroize yours after construction.
-   * The SDK never persists or exposes this value. Omit for the default:
-   * plaintext at rest, security delegated to the storage backend.
-   */
-  transportKeyPairDerivationSecret?: string | Uint8Array;
-}
-/**
- * ZamaSDK — composes a RelayerSDK with contract abstraction.
- *
- * Exposes domain namespaces for permits, delegations, decryption, offline
- * signing, and tokens, plus an unchanged registry, a top-level `encrypt`, and
- * lifecycle methods. Internal `*Service` classes do the work; the namespace
- * classes own SDK-level guards (chain alignment, signer requirement, event
- * emission).
- */
-declare class ZamaSDK {
-  #private;
-  /** Read-only chain access used for all contract reads. */
-  readonly provider: GenericProvider;
-  /** Wallet signer used for write operations, or `undefined` when the SDK is read-only. */
-  readonly signer: GenericSigner | undefined;
-  /** Storage for cached permits and transport key pairs. */
-  readonly storage: GenericStorage;
-  /**
-   * A {@link WrappersRegistry} instance auto-configured for the current chain.
-   * Uses built-in defaults from chain configs, and the SDK's `registryTTL` if configured.
-   */
-  readonly registry: WrappersRegistry;
-  /** Permit and keypair management. */
-  readonly permits: Permits;
-  /** On-chain decryption-delegation management. */
-  readonly delegations: Delegations;
-  /** FHE decryption (user, delegated user, public). */
-  readonly decryption: Decryption;
-  /** Offline-signing pipeline: `prepare` builds an unsigned tx the caller signs and broadcasts out-of-process — for HSM, policy-engine, and cross-process custody workflows. */
-  readonly offline: Offline;
-  constructor(config: ZamaConfig, options?: ZamaSDKOptions);
-  /**
-   * The single-chain relayer backend for the **currently active** chain.
-   */
-  get relayer(): RelayerSDK;
-  /**
-   * Create a {@link WrappersRegistry} instance bound to this SDK's provider.
-   * Inherits the registry addresses derived from the SDK's chain configs, so
-   * the result is consistent with {@link ZamaSDK.registry}.
-   *
-   * @param registryAddresses - Optional per-chain overrides for this registry instance.
-   * @returns A {@link WrappersRegistry} instance.
-   *
-   * @example
-   * ```ts
-   * // Addresses resolved from the SDK's chain configs
-   * const registry = sdk.createWrappersRegistry();
-   *
-   * // Hardhat or custom chain — override per chain for this registry instance
-   * const registry = sdk.createWrappersRegistry({ [31337]: "0xYourRegistry" });
-   *
-   * const pairs = await registry.getTokenPairs();
-   * ```
-   */
-  createWrappersRegistry(registryAddresses?: Record<number, Address>): WrappersRegistry;
-  /**
-   * Encrypt one or more plaintext values into FHE ciphertexts.
-   *
-   * @param params - Typed FHE inputs, the target contract address, and the user address.
-   * @returns External encrypted values and the input proof for on-chain submission.
-   * @throws if FHE encryption fails. {@link EncryptionFailedError}
-   *
-   * @example
-   * ```ts
-   * const { encryptedValues, inputProof } = await sdk.encrypt({
-   *   values: [{ value: 1000n, type: "euint64" }],
-   *   contractAddress: "0xToken",
-   *   userAddress: "0xUser",
-   * });
-   * ```
-   */
-  encrypt(params: EncryptParams, options?: Pick<FhevmRelayerOptions, "signal" | "timeout">): Promise<EncryptResult>;
-  /**
-   * Create a high-level ERC-20-style interface for an ERC-7984 confidential token.
-   * Supports balance queries, transfers, operator approvals, and decryption.
-   *
-   * For ERC-7984 wrappers (shield/unshield/allowance), use {@link createWrappedToken} instead.
-   *
-   * @param address - The confidential token contract address.
-   * @returns A {@link Token} instance bound to this SDK.
-   *
-   * @example
-   * ```ts
-   * const token = sdk.createToken(cUSDT);
-   * const balance = await token.balanceOf(userAddress);
-   * ```
-   */
-  createToken(address: Address): Token;
-  /**
-   * Create a high-level interface for an ERC-7984 wrapper token.
-   * Extends {@link Token} with shield/unshield/allowance/finalize-unwrap operations.
-   *
-   * @param address - The wrapper token contract address.
-   * @returns A {@link WrappedToken} instance bound to this SDK.
-   *
-   * @example
-   * ```ts
-   * const wrapped = sdk.createWrappedToken(wUSDT);
-   * await wrapped.shield(1_000_000n);
-   * ```
-   */
-  createWrappedToken(address: Address): WrappedToken;
-  /**
-   * Unsubscribe from signer lifecycle events without terminating the relayer.
-   * Call this when the SDK instance is being replaced but the relayer is shared
-   * (e.g. React provider remount in Strict Mode).
-   */
-  dispose(): void;
-  /**
-   * Terminate the relayer backend and clean up resources.
-   * Call this when the SDK is no longer needed (e.g. on unmount or shutdown).
-   */
-  terminate(): void;
-  /**
-   * Implements the TC39 Explicit Resource Management protocol.
-   * Calls {@link terminate} when the `using` binding goes out of scope,
-   * unsubscribing signer events and shutting down the relayer.
-   *
-   * @example
-   * ```ts
-   * {
-   *   using sdk = new ZamaSDK({ relayer, provider, signer, storage });
-   *   await sdk.permits.grantPermit([cUSDT]);
-   *   const balance = await sdk.createToken(cUSDT).balanceOf(userAddress);
-   * } // sdk.terminate() called automatically here
-   * ```
-   */
-  [Symbol.dispose](): void;
-}
-//#endregion
-//#region src/query/user-decrypt.d.ts
-/** A single encrypted value to decrypt, paired with the contract that owns it. */
-interface EncryptedInput {
-  /** Encrypted handle to decrypt. */
-  encryptedValue: EncryptedValue;
-  /** Address of the contract the encrypted value belongs to. */
-  contractAddress: Address;
-}
-/** Decrypted clear values keyed by encrypted handle. */
-type DecryptResult = Readonly<Record<EncryptedValue, ClearValue>>;
-/** Builds TanStack Query options for decrypting a batch of encrypted handles into their clear values. */
-declare function decryptValuesQueryOptions(sdk: ZamaSDK, encryptedInputs: EncryptedInput[], signerContext?: SignerQueryContext): QueryFactoryOptions<DecryptResult, Error, DecryptResult, ReturnType<typeof zamaQueryKeys.decryption.encryptedInputs>>;
-//#endregion
 //#region src/namespaces/decryption.d.ts
 /**
  * Public namespace for FHE decryption — the canonical way to decrypt.
@@ -21182,5 +20667,94 @@ declare class Decryption {
   } & DelegatedDecryptOptions): Promise<BatchDecryptResult>;
 }
 //#endregion
-export { ConfidentialTransferParams as $, ZamaErrorCode as $n, invalidateAfterUnshield as $t, FinalizeUnwrapParams as A, BalanceErrorDetails as An, balanceOfContract as Ar, UnderlyingAllowanceQueryConfig as At, unshieldAllMutationOptions as B, DelegationDelegateEqualsContractError as Bn, isOperatorContract as Br, IsConfidentialQueryConfig as Bt, HasPermitQueryConfig as C, WalletAccountNotReadyError as Cn, ERC7984_INTERFACE_ID as Cr, BatchBalancesResult as Ct, DelegatedDecryptValuesMutationParams as D, ConfigurationError as Dn, supportsInterfaceContract as Dr, confidentialIsOperatorQueryOptions as Dt, decryptPublicValuesMutationOptions as E, NotEntitledError as En, isConfidentialWrapperContract as Er, ConfidentialIsOperatorQueryConfig as Et, UnwrapParams as F, DecryptionFailedError as Fn, confidentialTotalSupplyContract as Fr, ListPairsOptions as Ft, ConfidentialSetOperatorParams as G, DelegationNotPropagatedError as Gn, unwrapFromBalanceContract as Gr, tokenMetadataQueryOptions as Gt, unshieldMutationOptions as H, DelegationExpiredError as Hn, setOperatorContract as Hr, isWrapperQueryOptions as Ht, unwrapMutationOptions as I, EncryptionFailedError as In, confidentialTransferContract as Ir, WrappersRegistry as It, confidentialTransferFromAndCallMutationOptions as J, KeyWrappingError as Jn, QueryLike as Jt, confidentialSetOperatorMutationOptions as K, DelegationSelfNotAllowedError as Kn, wrapContract as Kr, QueryClientLike as Kt, ResumeUnshieldParams as L, AclPausedError as Ln, confidentialTransferFromContract as Lr, WrappersRegistryConfig as Lt, unwrapAllMutationOptions as M, InsufficientAllowanceError as Mn, nameContract as Mr, WrapperDiscoveryQueryConfig as Mt, WrapParams as N, InsufficientConfidentialBalanceError as Nn, symbolContract as Nr, wrapperDiscoveryQueryOptions as Nt, delegatedDecryptValuesMutationOptions as O, RelayerRequestFailedError as On, allowanceContract as Or, PendingUnshieldQueryConfig as Ot, wrapMutationOptions as P, InsufficientERC20BalanceError as Pn, confidentialBalanceOfContract as Pr, DefaultRegistryAddresses as Pt, confidentialTransferAndCallMutationOptions as Q, ZamaError as Qn, invalidateAfterTransfer as Qt, resumeUnshieldMutationOptions as R, DelegationContractIsSelfError as Rn, finalizeUnwrapContract as Rr, TotalSupplyQueryConfig as Rt, revokePermitsMutationOptions as S, SignerRequiredError as Sn, ERC1363_INTERFACE_ID as Sr, WrappedToken as St, grantPermitMutationOptions as T, RpcRateLimitError as Tn, isConfidentialTokenContract as Tr, Token as Tt, ApproveUnderlyingParams as U, DelegationExpiryUnchangedError as Un, underlyingContract as Ur, TokenMetadata as Ut, UnshieldParams as V, DelegationExpirationTooSoonError as Vn, rateContract as Vr, isConfidentialQueryOptions as Vt, approveUnderlyingMutationOptions as W, DelegationNotFoundError as Wn, unwrapContract as Wr, TokenMetadataQueryConfig as Wt, confidentialTransferFromMutationOptions as X, TransportKeyPairExpiredError as Xn, invalidateAfterSetOperator as Xt, ConfidentialTransferFromParams as Y, NoCiphertextError as Yn, invalidateAfterApproveUnderlying as Yt, ConfidentialTransferAndCallParams as Z, ChainMismatchError as Zn, invalidateAfterShield as Zt, DecryptBalanceAsParams as _, matchZamaError as _n, delegateForUserDecryptionContract as _r, tokenPairsSliceQueryOptions as _t, ZamaSDK as a, invalidateWalletLifecycleQueries as an, SerializedTransportKeyPair as ar, ListPairsQueryConfig as at, delegateDecryptionMutationOptions as b, SigningRejectedError as bn, revokeDelegationContract as br, ConfidentialBalanceQueryConfig as bt, BatchDecryptItem as c, MutationFactoryOptions as cn, TokenWrapperPair as cr, TokenPairsSliceQueryConfig as ct, DelegationStatusQueryConfig as d, filterQueryOptions as dn, getTokenAddressContract as dr, isConfidentialTokenValidQueryOptions as dt, invalidateAfterUnshieldSettled as en, isRetryable as er, confidentialTransferMutationOptions as et, delegationStatusQueryOptions as f, hashFn as fn, getTokenPairContract as fr, listPairsQueryOptions as ft, batchDecryptBalancesAsMutationOptions as g, ErrorForCode as gn, isConfidentialTokenValidContract as gr, tokenPairsQueryOptions as gt, BatchDecryptBalancesAsParams as h, Permits as hn, getTokenPairsSliceContract as hr, tokenPairsLengthQueryOptions as ht, decryptValuesQueryOptions as i, invalidateWagmiBalanceQueries as in, SerializedPermitEip712 as ir, IsConfidentialTokenValidQueryConfig as it, finalizeUnwrapMutationOptions as j, ERC20ReadFailedError as jn, decimalsContract as jr, underlyingAllowanceQueryOptions as jt, encryptMutationOptions as k, BalanceCheckUnavailableError as kn, approveContract as kr, pendingUnshieldQueryOptions as kt, BatchDecryptResult as l, QueryFactoryOptions as ln, TokenWrapperPairWithMetadata as lr, WrappersRegistryQueryConfig as lt, revokeDelegationMutationOptions as m, DelegationStatus as mn, getTokenPairsLengthContract as mr, tokenPairQueryOptions as mt, DecryptResult as n, invalidateAfterWrap as nn, Permission as nr, shieldMutationOptions as nt, ZamaSDKOptions as o, zamaQueryKeys as on, ChecksummedAddress as or, TokenAddressQueryConfig as ot, RevokeDelegationParams as p, Delegations as pn, getTokenPairsContract as pr, tokenAddressQueryOptions as pt, ConfidentialTransferFromAndCallParams as q, InvalidTransportKeyPairError as qn, createConfig as qr, QueryFilterLike as qt, EncryptedInput as r, invalidateBalanceQueries as rn, SerializedPermit as rr, ConfidentialTokenAddressQueryConfig as rt, Offline as s, SignerQueryContext as sn, PaginatedResult as sr, TokenPairQueryConfig as st, Decryption as t, invalidateAfterUnwrap as tn, retryAfterSeconds as tr, ShieldParams as tt, DelegatedDecryptOptions as u, StrippedQueryOptionKeys as un, getConfidentialTokenAddressContract as ur, confidentialTokenAddressQueryOptions as ut, decryptBalanceAsMutationOptions as v, TransactionRevertedError as vn, getDelegationExpiryContract as vr, ConfidentialBalancesQueryConfig as vt, hasPermitQueryOptions as w, WalletNotConnectedError as wn, ERC7984_WRAPPER_INTERFACE_ID as wr, BatchDecryptAsOptions as wt, clearCredentialsMutationOptions as x, SignerNotConfiguredError as xn, transferAndCallContract as xr, confidentialBalanceQueryOptions as xt, DelegateDecryptionParams as y, SigningFailedError as yn, isHandleDelegatedContract as yr, confidentialBalancesQueryOptions as yt, UnshieldAllParams as z, DelegationCooldownError as zn, inferredTotalSupplyContract as zr, totalSupplyQueryOptions as zt };
-//# sourceMappingURL=index-BNeNpxpl.d.ts.map
+//#region src/storage/memory-storage.d.ts
+/** In-memory credential store. Credentials are lost on page reload. */
+declare class MemoryStorage implements GenericStorage {
+  #private;
+  /**
+   * Retrieve a value by key.
+   * @returns The stored value, or `null` if the key does not exist.
+   */
+  get<T = unknown>(key: string): Promise<T | null>;
+  /** Store a value under the given key, overwriting any existing entry. */
+  set<T = unknown>(key: string, value: T): Promise<void>;
+  /** Remove the entry for the given key (no-op if absent). */
+  delete(key: string): Promise<void>;
+}
+/** Default singleton for application-wide use. */
+declare const memoryStorage: MemoryStorage;
+//#endregion
+//#region src/storage/indexeddb-storage.d.ts
+/**
+ * IndexedDB-backed {@link GenericStorage}.
+ *
+ * Stores keypair and permit objects keyed by a hashed wallet address. The
+ * SDK delegates security to the storage backend — values are persisted
+ * verbatim with no SDK-layer encryption.
+ */
+declare class IndexedDBStorage implements GenericStorage {
+  #private;
+  constructor(dbName?: string, dbVersion?: number, storeName?: string);
+  /**
+   * Retrieve a value by key.
+   * @returns The stored value, or `null` if the key does not exist.
+   */
+  get<T = unknown>(key: string): Promise<T | null>;
+  /** Store a value under the given key, overwriting any existing entry. */
+  set<T = unknown>(key: string, value: T): Promise<void>;
+  /** Remove the entry for the given key (no-op if absent). */
+  delete(key: string): Promise<void>;
+  /** Remove all stored entries. */
+  clear(): Promise<void>;
+}
+/** Default singleton for application-wide use. */
+declare const indexedDBStorage: IndexedDBStorage;
+//#endregion
+//#region src/storage/chrome-session-storage.d.ts
+/**
+ * {@link GenericStorage} backed by `chrome.storage.session`.
+ *
+ * Use this in MV3 web extensions so the wallet signature survives
+ * service worker restarts and is shared across popup, background,
+ * and content script contexts.
+ *
+ * @example
+ * ```ts
+ * import { ZamaSDK, indexedDBStorage, chromeSessionStorage } from "@zama-fhe/sdk";
+ * import { createConfig } from "@zama-fhe/sdk/viem";
+ *
+ * const config = createConfig({
+ *   chains: [mySepolia],
+ *   publicClient,
+ *   walletClient,
+ *   relayers: { [mySepolia.id]: web() },
+ *   storage: indexedDBStorage, // encrypted transport key pair — persistent
+ *   permitStorage: chromeSessionStorage, // signed permits — ephemeral
+ * });
+ * const sdk = new ZamaSDK(config);
+ * ```
+ */
+declare class ChromeSessionStorage implements GenericStorage {
+  /**
+   * Retrieve a value by key.
+   * @returns The stored value, or `null` if the key does not exist.
+   */
+  get<T = unknown>(key: string): Promise<T | null>;
+  /** Store a value under the given key, overwriting any existing entry. */
+  set(key: string, value: unknown): Promise<void>;
+  /** Remove the entry for the given key (no-op if absent). */
+  delete(key: string): Promise<void>;
+}
+/** Default singleton for application-wide use. */
+declare const chromeSessionStorage: ChromeSessionStorage;
+//#endregion
+//#region src/utils/handles.d.ts
+/** All-zero encrypted-value sentinel — a 32-byte zero handle representing the cleartext value `0`. */
+declare const ZERO_ENCRYPTED_VALUE: "0x0000000000000000000000000000000000000000000000000000000000000000";
+/**
+ * Check whether an encrypted value represents the zero value.
+ */
+declare function isEncryptedValueZero(encryptedValue: string): boolean;
+//#endregion
+export { InsufficientConfidentialBalanceError as $, symbolContract as $t, BatchDecryptAsOptions as A, getConfidentialTokenAddressContract as At, SigningRejectedError as B, revokeDelegationContract as Bt, ZamaSDKOptions as C, SerializedPermit as Ct, WrappersRegistryConfig as D, PaginatedResult as Dt, WrappersRegistry as E, ChecksummedAddress as Et, Permits as F, getTokenPairsSliceContract as Ft, RpcRateLimitError as G, isConfidentialTokenContract as Gt, SignerRequiredError as H, ERC1363_INTERFACE_ID as Ht, ErrorForCode as I, isConfidentialTokenValidContract as It, RelayerRequestFailedError as J, allowanceContract as Jt, NotEntitledError as K, isConfidentialWrapperContract as Kt, matchZamaError as L, delegateForUserDecryptionContract as Lt, Offline as M, getTokenPairContract as Mt, Delegations as N, getTokenPairsContract as Nt, WrappedToken as O, TokenWrapperPair as Ot, DelegationStatus as P, getTokenPairsLengthContract as Pt, InsufficientAllowanceError as Q, nameContract as Qt, TransactionRevertedError as R, getDelegationExpiryContract as Rt, ZamaSDK as S, Permission as St, ListPairsOptions as T, SerializedTransportKeyPair as Tt, WalletAccountNotReadyError as U, ERC7984_INTERFACE_ID as Ut, SignerNotConfiguredError as V, transferAndCallContract as Vt, WalletNotConnectedError as W, ERC7984_WRAPPER_INTERFACE_ID as Wt, BalanceErrorDetails as X, balanceOfContract as Xt, BalanceCheckUnavailableError as Y, approveContract as Yt, ERC20ReadFailedError as Z, decimalsContract as Zt, decryptValuesQueryOptions as _, ChainMismatchError as _t, ChromeSessionStorage as a, inferredTotalSupplyContract as an, DelegationCooldownError as at, MutationFactoryOptions as b, isRetryable as bt, indexedDBStorage as c, setOperatorContract as cn, DelegationExpiredError as ct, Decryption as d, unwrapFromBalanceContract as dn, DelegationNotPropagatedError as dt, confidentialBalanceOfContract as en, InsufficientERC20BalanceError as et, BatchDecryptItem as f, wrapContract as fn, DelegationSelfNotAllowedError as ft, EncryptedInput as g, TransportKeyPairExpiredError as gt, DecryptResult as h, NoCiphertextError as ht, isEncryptedValueZero as i, finalizeUnwrapContract as in, DelegationContractIsSelfError as it, Token as j, getTokenAddressContract as jt, BatchBalancesResult as k, TokenWrapperPairWithMetadata as kt, MemoryStorage as l, underlyingContract as ln, DelegationExpiryUnchangedError as lt, DelegatedDecryptOptions as m, KeyWrappingError as mt, Hex$1 as n, confidentialTransferContract as nn, EncryptionFailedError as nt, chromeSessionStorage as o, isOperatorContract as on, DelegationDelegateEqualsContractError as ot, BatchDecryptResult as p, createConfig as pn, InvalidTransportKeyPairError as pt, ConfigurationError as q, supportsInterfaceContract as qt, ZERO_ENCRYPTED_VALUE as r, confidentialTransferFromContract as rn, AclPausedError as rt, IndexedDBStorage as s, rateContract as sn, DelegationExpirationTooSoonError as st, Address$1 as t, confidentialTotalSupplyContract as tn, DecryptionFailedError as tt, memoryStorage as u, unwrapContract as un, DelegationNotFoundError as ut, SignerQueryContext as v, ZamaError as vt, DefaultRegistryAddresses as w, SerializedPermitEip712 as wt, QueryFactoryOptions as x, retryAfterSeconds as xt, zamaQueryKeys as y, ZamaErrorCode as yt, SigningFailedError as z, isHandleDelegatedContract as zt };
+//# sourceMappingURL=index-CLhOMZFu.d.ts.map