@zama-fhe/sdk 3.6.0 → 3.7.0-alpha.2

package/dist/esm/{index-BCh3VaZo.d.ts → index-DRrrBtMX.d.ts}

@@ -1,10 +1,10 @@
-import { f as FheChain } from "./index-ijgDL4IC.js";
-import { $t as ClearValue, Ct as UnshieldCallbacks, D as GenericSigner, O as WalletAccount, Qt as TransactionResult, S as TransactionKind, St as TransferCallbacks, _ as PrepareTransactionRequest, _t as TransferOptions, an as EncryptResult, bt as WrapOptions, c as GenericStorage, en as DecryptPublicValuesResult, fn as RelayerSDK, g as PrepareOptions, ht as ShieldOptions, i as ZamaConfig, in as EncryptParams, l as GenericProvider, ln as FhevmRelayerOptions, o as ZamaConfigGeneric, on as EncryptedValue, v as PreparedFor, vt as UnshieldOptions, yt as UnwrapResult } from "./types-D3W3J65M.js";
-import "./cleartext-B2DI8fgm.js";
-import "./types-CFDG6lIJ.js";
-import "./base-signer-Iu5Lszrf.js";
-import "./types-Ce9Lhvrf.js";
-import { Address, Address as Address$1, Hex, Hex as Hex$1 } from "viem";
+import { f as FheChain } from "./index-Gk1S0gjO.js";
+import { $t as TransactionResult, Ct as TransferCallbacks, D as GenericSigner, O as WalletAccount, S as TransactionKind, _ as PrepareTransactionRequest, an as EncryptParams, bt as UnwrapResult, c as GenericStorage, en as ClearValue, g as PrepareOptions, gt as ShieldOptions, i as ZamaConfig, l as GenericProvider, o as ZamaConfigGeneric, on as EncryptResult, pn as RelayerSDK, sn as EncryptedValue, tn as DecryptPublicValuesResult, un as FhevmRelayerOptions, v as PreparedFor, vt as TransferOptions, wt as UnshieldCallbacks, xt as WrapOptions, yt as UnshieldOptions } from "./types-BOyFfG7D.js";
+import "./cleartext-pv2blbFU.js";
+import "./types-OXQqX_kH.js";
+import "./types-BRIpBy9n.js";
+import "./index-tfvbrVa2.js";
+import { Address, Hex } from "viem";
 import { z } from "zod/mini";
 import { MutationFunctionContext, QueryKey, QueryObserverOptions, skipToken } from "@tanstack/query-core";
 //#region src/config/create.d.ts
@@ -17446,6 +17446,16 @@ declare function delegateForUserDecryptionContract(aclAddress: Address, delegate
       readonly internalType: "uint64";
     }];
     readonly stateMutability: "view";
+  }, {
+    readonly type: "function";
+    readonly name: "invalidateDecryptionSignaturesBefore";
+    readonly inputs: readonly [{
+      readonly name: "timestamp";
+      readonly type: "uint256";
+      readonly internalType: "uint256";
+    }];
+    readonly outputs: readonly [];
+    readonly stateMutability: "nonpayable";
   }, {
     readonly type: "function";
     readonly name: "isAccountDenied";
@@ -17664,6 +17674,16 @@ declare function revokeDelegationContract(aclAddress: Address, delegateAddress:
       readonly internalType: "uint64";
     }];
     readonly stateMutability: "view";
+  }, {
+    readonly type: "function";
+    readonly name: "invalidateDecryptionSignaturesBefore";
+    readonly inputs: readonly [{
+      readonly name: "timestamp";
+      readonly type: "uint256";
+      readonly internalType: "uint256";
+    }];
+    readonly outputs: readonly [];
+    readonly stateMutability: "nonpayable";
   }, {
     readonly type: "function";
     readonly name: "isAccountDenied";
@@ -17786,6 +17806,235 @@ declare function revokeDelegationContract(aclAddress: Address, delegateAddress:
   readonly functionName: "revokeDelegationForUserDecryption";
   readonly args: readonly [`0x${string}`, `0x${string}`];
 };
+/**
+ * Returns the contract config to invalidate every decryption signature signed
+ * by `msg.sender` before `timestamp` (`0n` resolves to now on-chain).
+ *
+ * @example
+ * ```ts
+ * const txHash = await signer.writeContract(
+ *   invalidateDecryptionSignaturesBeforeContract(aclAddress, 0n),
+ * );
+ * ```
+ */
+declare function invalidateDecryptionSignaturesBeforeContract(aclAddress: Address, timestamp: bigint): {
+  readonly address: `0x${string}`;
+  readonly abi: readonly [{
+    readonly type: "function";
+    readonly name: "allow";
+    readonly inputs: readonly [{
+      readonly name: "handle";
+      readonly type: "bytes32";
+      readonly internalType: "bytes32";
+    }, {
+      readonly name: "account";
+      readonly type: "address";
+      readonly internalType: "address";
+    }];
+    readonly outputs: readonly [];
+    readonly stateMutability: "nonpayable";
+  }, {
+    readonly type: "function";
+    readonly name: "allowForDecryption";
+    readonly inputs: readonly [{
+      readonly name: "handlesList";
+      readonly type: "bytes32[]";
+      readonly internalType: "bytes32[]";
+    }];
+    readonly outputs: readonly [];
+    readonly stateMutability: "nonpayable";
+  }, {
+    readonly type: "function";
+    readonly name: "allowTransient";
+    readonly inputs: readonly [{
+      readonly name: "ciphertext";
+      readonly type: "bytes32";
+      readonly internalType: "bytes32";
+    }, {
+      readonly name: "account";
+      readonly type: "address";
+      readonly internalType: "address";
+    }];
+    readonly outputs: readonly [];
+    readonly stateMutability: "nonpayable";
+  }, {
+    readonly type: "function";
+    readonly name: "cleanTransientStorage";
+    readonly inputs: readonly [];
+    readonly outputs: readonly [];
+    readonly stateMutability: "nonpayable";
+  }, {
+    readonly type: "function";
+    readonly name: "delegateForUserDecryption";
+    readonly inputs: readonly [{
+      readonly name: "delegate";
+      readonly type: "address";
+      readonly internalType: "address";
+    }, {
+      readonly name: "contractAddress";
+      readonly type: "address";
+      readonly internalType: "address";
+    }, {
+      readonly name: "expirationDate";
+      readonly type: "uint64";
+      readonly internalType: "uint64";
+    }];
+    readonly outputs: readonly [];
+    readonly stateMutability: "nonpayable";
+  }, {
+    readonly type: "function";
+    readonly name: "getUserDecryptionDelegationExpirationDate";
+    readonly inputs: readonly [{
+      readonly name: "delegator";
+      readonly type: "address";
+      readonly internalType: "address";
+    }, {
+      readonly name: "delegate";
+      readonly type: "address";
+      readonly internalType: "address";
+    }, {
+      readonly name: "contractAddress";
+      readonly type: "address";
+      readonly internalType: "address";
+    }];
+    readonly outputs: readonly [{
+      readonly name: "";
+      readonly type: "uint64";
+      readonly internalType: "uint64";
+    }];
+    readonly stateMutability: "view";
+  }, {
+    readonly type: "function";
+    readonly name: "invalidateDecryptionSignaturesBefore";
+    readonly inputs: readonly [{
+      readonly name: "timestamp";
+      readonly type: "uint256";
+      readonly internalType: "uint256";
+    }];
+    readonly outputs: readonly [];
+    readonly stateMutability: "nonpayable";
+  }, {
+    readonly type: "function";
+    readonly name: "isAccountDenied";
+    readonly inputs: readonly [{
+      readonly name: "account";
+      readonly type: "address";
+      readonly internalType: "address";
+    }];
+    readonly outputs: readonly [{
+      readonly name: "";
+      readonly type: "bool";
+      readonly internalType: "bool";
+    }];
+    readonly stateMutability: "view";
+  }, {
+    readonly type: "function";
+    readonly name: "isAllowed";
+    readonly inputs: readonly [{
+      readonly name: "handle";
+      readonly type: "bytes32";
+      readonly internalType: "bytes32";
+    }, {
+      readonly name: "account";
+      readonly type: "address";
+      readonly internalType: "address";
+    }];
+    readonly outputs: readonly [{
+      readonly name: "";
+      readonly type: "bool";
+      readonly internalType: "bool";
+    }];
+    readonly stateMutability: "view";
+  }, {
+    readonly type: "function";
+    readonly name: "isAllowedForDecryption";
+    readonly inputs: readonly [{
+      readonly name: "handle";
+      readonly type: "bytes32";
+      readonly internalType: "bytes32";
+    }];
+    readonly outputs: readonly [{
+      readonly name: "";
+      readonly type: "bool";
+      readonly internalType: "bool";
+    }];
+    readonly stateMutability: "view";
+  }, {
+    readonly type: "function";
+    readonly name: "isHandleDelegatedForUserDecryption";
+    readonly inputs: readonly [{
+      readonly name: "delegator";
+      readonly type: "address";
+      readonly internalType: "address";
+    }, {
+      readonly name: "delegate";
+      readonly type: "address";
+      readonly internalType: "address";
+    }, {
+      readonly name: "contractAddress";
+      readonly type: "address";
+      readonly internalType: "address";
+    }, {
+      readonly name: "handle";
+      readonly type: "bytes32";
+      readonly internalType: "bytes32";
+    }];
+    readonly outputs: readonly [{
+      readonly name: "";
+      readonly type: "bool";
+      readonly internalType: "bool";
+    }];
+    readonly stateMutability: "view";
+  }, {
+    readonly type: "function";
+    readonly name: "multicall";
+    readonly inputs: readonly [{
+      readonly name: "data";
+      readonly type: "bytes[]";
+      readonly internalType: "bytes[]";
+    }];
+    readonly outputs: readonly [{
+      readonly name: "results";
+      readonly type: "bytes[]";
+      readonly internalType: "bytes[]";
+    }];
+    readonly stateMutability: "payable";
+  }, {
+    readonly type: "function";
+    readonly name: "persistAllowed";
+    readonly inputs: readonly [{
+      readonly name: "handle";
+      readonly type: "bytes32";
+      readonly internalType: "bytes32";
+    }, {
+      readonly name: "account";
+      readonly type: "address";
+      readonly internalType: "address";
+    }];
+    readonly outputs: readonly [{
+      readonly name: "";
+      readonly type: "bool";
+      readonly internalType: "bool";
+    }];
+    readonly stateMutability: "view";
+  }, {
+    readonly type: "function";
+    readonly name: "revokeDelegationForUserDecryption";
+    readonly inputs: readonly [{
+      readonly name: "delegate";
+      readonly type: "address";
+      readonly internalType: "address";
+    }, {
+      readonly name: "contractAddress";
+      readonly type: "address";
+      readonly internalType: "address";
+    }];
+    readonly outputs: readonly [];
+    readonly stateMutability: "nonpayable";
+  }];
+  readonly functionName: "invalidateDecryptionSignaturesBefore";
+  readonly args: readonly [bigint];
+};
 /**
  * Returns the contract config to read the delegation expiry date.
  *
@@ -17882,6 +18131,16 @@ declare function getDelegationExpiryContract(aclAddress: Address, delegatorAddre
       readonly internalType: "uint64";
     }];
     readonly stateMutability: "view";
+  }, {
+    readonly type: "function";
+    readonly name: "invalidateDecryptionSignaturesBefore";
+    readonly inputs: readonly [{
+      readonly name: "timestamp";
+      readonly type: "uint256";
+      readonly internalType: "uint256";
+    }];
+    readonly outputs: readonly [];
+    readonly stateMutability: "nonpayable";
   }, {
     readonly type: "function";
     readonly name: "isAccountDenied";
@@ -18100,6 +18359,16 @@ declare function isHandleDelegatedContract(aclAddress: Address, delegatorAddress
       readonly internalType: "uint64";
     }];
     readonly stateMutability: "view";
+  }, {
+    readonly type: "function";
+    readonly name: "invalidateDecryptionSignaturesBefore";
+    readonly inputs: readonly [{
+      readonly name: "timestamp";
+      readonly type: "uint256";
+      readonly internalType: "uint256";
+    }];
+    readonly outputs: readonly [];
+    readonly stateMutability: "nonpayable";
   }, {
     readonly type: "function";
     readonly name: "isAccountDenied";
@@ -19611,9 +19880,28 @@ type ChecksummedAddress = Address & {
   readonly [checksummedTag]: true;
 };
 //#endregion
-//#region src/credentials/types.d.ts
+//#region src/credentials/utils.d.ts
 /**
- * Serialized transport key pair — ML-KEM public + private key as hex, the shape
+ * Sentinel requesting a V2 permissive ("wildcard") permit from
+ * {@link CredentialService.grantPermit} / {@link Permits.grantPermit} /
+ * {@link Permits.grantDelegationPermit} — one permit covering every contract,
+ * present and future, instead of an explicit list. Always an explicit opt-in:
+ * passing a contract list, however large, never signs a wildcard permit.
+ *
+ * @example
+ * ```ts
+ * import { WILDCARD_PERMIT } from "@zama-fhe/sdk";
+ *
+ * await sdk.permits.grantPermit(WILDCARD_PERMIT);
+ * ```
+ */
+declare const WILDCARD_PERMIT: "wildcard";
+/** The type of {@link WILDCARD_PERMIT}. */
+type WildcardPermit = typeof WILDCARD_PERMIT;
+//#endregion
+//#region src/credentials/types.d.ts
+/**
+ * Serialized transport key pair — ML-KEM public + private key as hex, the shape
  * we persist and hand to the decrypt path. Mirrors `@fhevm/sdk`'s
  * `serializeTransportKeyPair` output; the private half is plaintext, so treat it
  * as sensitive.
@@ -19660,27 +19948,54 @@ interface SerializedPermit {
   signature: Hex;
   /** Address that produced the signature. */
   signerAddress: ChecksummedAddress;
+  /**
+   * V2 (unified) permits only — delegation is metadata alongside the signed
+   * message, not part of it. Absent for V1 (where delegation lives inside
+   * `eip712.message`) and for a non-delegated V2 permit.
+   */
+  delegatorAddress?: ChecksummedAddress;
 }
-/**
- * A signed EIP-712 permit binding a signer (and optional delegator) to a set of
- * contract addresses for a bounded time window. Wraps the serialized `@fhevm/sdk`
- * permit ({@link SerializedPermit}) alongside the scope/coverage metadata the
- * permission store indexes on.
- *
- * Mirrors {@link PermissionSchema}; kept in sync by a `.test-d.ts` guard.
- */
-interface Permission {
+/** Fields shared by every permit version, regardless of shape. */
+interface PermissionBase {
   /** Public key of the transport key pair this permit is bound to, hex-encoded. */
   keypairPublicKey: Hex;
-  /** Contract addresses this permit grants decrypt access to. */
+  /**
+   * Contract addresses this permit grants decrypt access to. Never empty for
+   * a V1 permit; an empty list on a V2 permit is a wildcard — see {@link PermissionV2}.
+   */
   contractAddresses: ChecksummedAddress[];
   /** The signed serialized permit. */
   serializedPermit: SerializedPermit;
   /** Unix timestamp (seconds) when the permit becomes valid. */
   startTimestamp: number;
-  /** Validity window length in days from {@link Permission.startTimestamp}. */
+}
+/** A V1 ("legacy") permit — always scoped to a specific, non-empty contract list. */
+interface PermissionV1 extends PermissionBase {
+  /** Discriminant identifying this as a {@link PermissionV1}. */
+  version: 1;
+  /** Validity window length in days from {@link PermissionBase.startTimestamp}. */
   durationDays: number;
 }
+/**
+ * A V2 (unified) permit. `contractAddresses: []` is a *wildcard* (permissive)
+ * permit — it covers every contract, not zero.
+ */
+interface PermissionV2 extends PermissionBase {
+  /** Discriminant identifying this as a {@link PermissionV2}. */
+  version: 2;
+  /** Validity window length in seconds from {@link PermissionBase.startTimestamp}. */
+  durationSeconds: number;
+}
+/**
+ * A signed EIP-712 permit binding a signer (and optional delegator) to a set of
+ * contract addresses for a bounded time window. Wraps the serialized `@fhevm/sdk`
+ * permit ({@link SerializedPermit}) alongside the scope/coverage metadata the
+ * permission store indexes on.
+ *
+ * Discriminated by `version`: {@link PermissionV1} or {@link PermissionV2}.
+ * Mirrors {@link PermissionSchema}; kept in sync by a `.test-d.ts` guard.
+ */
+type Permission = PermissionV1 | PermissionV2;
 /**
  * Offline `preparePermit` request — `grantPermit`'s parameters split around
  * the wallet signature. `signer` and `delegator` are explicit addresses, not
@@ -19690,8 +20005,12 @@ interface Permission {
 interface PreparePermitRequest {
   /** Address that will sign the returned EIP-712 typed data. */
   signer: Address;
-  /** Contract addresses to authorize. Maximum {@link MAX_CONTRACTS_PER_PERMIT} — no chunking. */
-  contracts: readonly Address[];
+  /**
+   * Contract addresses to authorize, or {@link WildcardPermit} to request a
+   * V2 permit covering every contract. Maximum {@link MAX_CONTRACTS_PER_PERMIT}
+   * per call — no chunking. Ignored (and unchecked) when requesting a wildcard.
+   */
+  contracts: readonly Address[] | WildcardPermit;
   /** Delegator address, for a delegated permit. Omit for a self permit. */
   delegator?: Address;
   /** Permit validity window in days. Defaults to the SDK's configured `permitTTL`. */
@@ -19703,24 +20022,40 @@ interface PreparePermitRequest {
  * out-of-process signer returns for it.
  *
  * Deliberately minimal: `chainId`, `contracts`, `startTimestamp`,
- * `durationDays`, and the transport public key are all readable off
- * {@link eip712}'s `domain`/`message` directly (and, once registered, off the
- * signature-verified payload) — carrying separate top-level copies would only
- * create two sources of truth that could disagree. Read them from `eip712`
- * for display/logging use.
+ * `durationDays`/`durationSeconds`, and the transport public key are all
+ * readable off {@link PreparedPermitBase.eip712}'s `domain`/`message` directly
+ * (and, once registered, off the signature-verified payload) — carrying
+ * separate top-level copies would only create two sources of truth that could
+ * disagree. Read them from `eip712` for display/logging use.
  *
- * `version` pins the permit shape (`1` while the SDK targets protocol ≤0.13)
- * so a future V2 flow is additive, not breaking. JSON-safe — ships across a
- * process boundary as-is.
+ * Discriminated by `version`: {@link PreparedPermitV1} (protocol ≤0.13) or
+ * {@link PreparedPermitV2} (protocol ≥0.14, unified/wildcard). JSON-safe —
+ * ships across a process boundary as-is.
  */
-interface PreparedPermit {
-  /** Permit format version. Always `1` while the SDK targets protocol ≤0.13. */
-  version: 1;
+type PreparedPermit = PreparedPermitV1 | PreparedPermitV2;
+/** Fields shared by every prepared-permit version. */
+interface PreparedPermitBase {
   /** The EIP-712 typed data to sign with `eth_signTypedData_v4`. */
   eip712: SerializedPermitEip712;
   /** Address expected to sign {@link eip712}. */
   signerAddress: ChecksummedAddress;
 }
+/** A V1 ("legacy") prepared permit. Delegation, if any, lives inside `eip712.message`. */
+interface PreparedPermitV1 extends PreparedPermitBase {
+  /** Discriminant identifying this as a {@link PreparedPermitV1}. */
+  version: 1;
+}
+/**
+ * A V2 (unified) prepared permit. V2 delegation is post-sign metadata, not
+ * part of the signed message, so a delegated request carries it here instead
+ * of inside `eip712.message`.
+ */
+interface PreparedPermitV2 extends PreparedPermitBase {
+  /** Discriminant identifying this as a {@link PreparedPermitV2}. */
+  version: 2;
+  /** Delegator address, for a delegated permit. Absent for a self permit. */
+  delegatorAddress?: ChecksummedAddress;
+}
 //#endregion
 //#region src/errors/base.d.ts
 /**
@@ -19789,6 +20124,8 @@ declare const ZamaErrorCode: {
   readonly DelegationExpiryUnchanged: "DELEGATION_EXPIRY_UNCHANGED";
   /** Delegate address cannot be the contract address. */
   readonly DelegationDelegateEqualsContract: "DELEGATION_DELEGATE_EQUALS_CONTRACT";
+  /** Delegate address cannot be the wildcard address — it's only valid as `contractAddress`. */
+  readonly DelegationDelegateCannotBeWildcard: "DELEGATION_DELEGATE_CANNOT_BE_WILDCARD";
   /** Contract address cannot be the sender address. */
   readonly DelegationContractIsSelf: "DELEGATION_CONTRACT_IS_SELF";
   /** The ACL contract is paused. */
@@ -19813,6 +20150,14 @@ declare const ZamaErrorCode: {
   readonly PreparedPermitChainMismatch: "PREPARED_PERMIT_CHAIN_MISMATCH";
   /** A prepared permit's validity window elapsed before its signature was registered. */
   readonly PreparedPermitExpired: "PREPARED_PERMIT_EXPIRED";
+  /** V2 (unified) decryption permits — including wildcard permits — need protocol v0.14+; the connected chain hasn't upgraded yet. */
+  readonly UnifiedPermitNotSupported: "UNIFIED_PERMIT_NOT_SUPPORTED";
+  /** A stored V2/wildcard permit's scope is needed, but the connected relayer instance doesn't support unified decryption yet. */
+  readonly UnifiedDecryptionUnsupported: "UNIFIED_DECRYPTION_UNSUPPORTED";
+  /** `invalidateDecryptionSignatures` was given a cutoff at or below the account's current one; the ACL only moves it forward. */
+  readonly InvalidationTimestampTooLow: "INVALIDATION_TIMESTAMP_TOO_LOW";
+  /** `invalidateDecryptionSignatures` was given a cutoff in the future; the ACL only accepts now or earlier. */
+  readonly InvalidationTimestampInFuture: "INVALIDATION_TIMESTAMP_IN_FUTURE";
   /** The unwrap request was already finalized on-chain; there is nothing left to resume. */
   readonly UnshieldAlreadyFinalized: "UNSHIELD_ALREADY_FINALIZED";
 };
@@ -19974,6 +20319,45 @@ declare class PreparedPermitChainMismatchError extends ZamaError {
 declare class PreparedPermitExpiredError extends ZamaError {
   constructor(message: string, options?: ErrorOptions);
 }
+/**
+ * The connected chain doesn't support V2 (unified) decryption permits yet —
+ * including {@link WILDCARD_PERMIT} — because it hasn't upgraded to protocol
+ * v0.14 or later. Thrown before any wallet prompt: the SDK detects this from
+ * the chain's on-chain KMS context, without a signature attempt. V1 permits
+ * (an explicit contract list, not `WILDCARD_PERMIT`) are unaffected — grant
+ * one of those instead, or retry once the network upgrades.
+ */
+declare class UnifiedPermitNotSupportedError extends ZamaError {
+  constructor(message: string, options?: ErrorOptions);
+}
+/**
+ * A stored V2 (unified/wildcard) permit's scope is needed for this decrypt,
+ * but the connected relayer instance hasn't deployed the `/v3/user-decrypt`
+ * route it requires. Distinct from {@link UnifiedPermitNotSupportedError}:
+ * that one fires at *signing* time because the *chain* hasn't upgraded to
+ * protocol v0.14+; this one fires at *decrypt* time even though the chain and
+ * the stored permit are both V2-capable — only this particular relayer
+ * instance hasn't deployed the route yet. Grant a specific-contract (V1)
+ * permit instead, or retry once the relayer upgrades.
+ */
+declare class UnifiedDecryptionUnsupportedError extends ZamaError {
+  constructor(message: string, options?: ErrorOptions);
+}
+/**
+ * The requested invalidation cutoff was not strictly later than the account's
+ * current one. The ACL only ever moves the cutoff forward, so re-sending the
+ * same or an older timestamp always reverts.
+ */
+declare class InvalidationTimestampTooLowError extends ZamaError {
+  constructor(message: string, options?: ErrorOptions);
+}
+/**
+ * The requested invalidation cutoff was in the future. The ACL refuses to
+ * invalidate signatures that have not been produced yet.
+ */
+declare class InvalidationTimestampInFutureError extends ZamaError {
+  constructor(message: string, options?: ErrorOptions);
+}
 //#endregion
 //#region src/errors/delegation.d.ts
 /** Delegation cannot target self (delegate === msg.sender). */
@@ -20000,6 +20384,10 @@ declare class DelegationExpiryUnchangedError extends ZamaError {
 declare class DelegationDelegateEqualsContractError extends ZamaError {
   constructor(message: string, options?: ErrorOptions);
 }
+/** Delegate address cannot be the wildcard address — it's only valid as `contractAddress`. */
+declare class DelegationDelegateCannotBeWildcardError extends ZamaError {
+  constructor(message: string, options?: ErrorOptions);
+}
 /** Contract address cannot be the sender address. */
 declare class DelegationContractIsSelfError extends ZamaError {
   constructor(message: string, options?: ErrorOptions);
@@ -20358,6 +20746,8 @@ interface ErrorForCode {
   [ZamaErrorCode.DelegationExpiryUnchanged]: DelegationExpiryUnchangedError;
   /** Thrown for {@link ZamaErrorCode.DelegationDelegateEqualsContract}. */
   [ZamaErrorCode.DelegationDelegateEqualsContract]: DelegationDelegateEqualsContractError;
+  /** Thrown for {@link ZamaErrorCode.DelegationDelegateCannotBeWildcard}. */
+  [ZamaErrorCode.DelegationDelegateCannotBeWildcard]: DelegationDelegateCannotBeWildcardError;
   /** Thrown for {@link ZamaErrorCode.DelegationContractIsSelf}. */
   [ZamaErrorCode.DelegationContractIsSelf]: DelegationContractIsSelfError;
   /** Thrown for {@link ZamaErrorCode.AclPaused}. */
@@ -20382,6 +20772,14 @@ interface ErrorForCode {
   [ZamaErrorCode.PreparedPermitChainMismatch]: PreparedPermitChainMismatchError;
   /** Thrown for {@link ZamaErrorCode.PreparedPermitExpired}. */
   [ZamaErrorCode.PreparedPermitExpired]: PreparedPermitExpiredError;
+  /** Thrown for {@link ZamaErrorCode.UnifiedPermitNotSupported}. */
+  [ZamaErrorCode.UnifiedPermitNotSupported]: UnifiedPermitNotSupportedError;
+  /** Thrown for {@link ZamaErrorCode.UnifiedDecryptionUnsupported}. */
+  [ZamaErrorCode.UnifiedDecryptionUnsupported]: UnifiedDecryptionUnsupportedError;
+  /** Thrown for {@link ZamaErrorCode.InvalidationTimestampTooLow}. */
+  [ZamaErrorCode.InvalidationTimestampTooLow]: InvalidationTimestampTooLowError;
+  /** Thrown for {@link ZamaErrorCode.InvalidationTimestampInFuture}. */
+  [ZamaErrorCode.InvalidationTimestampInFuture]: InvalidationTimestampInFutureError;
   /** Thrown for {@link ZamaErrorCode.UnshieldAlreadyFinalized}. */
   [ZamaErrorCode.UnshieldAlreadyFinalized]: UnshieldAlreadyFinalizedError;
 }
@@ -20436,21 +20834,29 @@ declare class Permits {
    * rejection is preserved (already-signed chunks are persisted before the
    * next prompt).
    *
-   * @param contracts - Contract addresses to authorize.
+   * Pass {@link WILDCARD_PERMIT} instead of an address list to request a V2
+   * permissive permit covering every contract, present and future — an
+   * explicit opt-in, not something a large address list implies. A stolen
+   * wildcard permit decrypts anything the signer owns until it expires, so
+   * prefer a specific contract list unless the caller genuinely needs
+   * unbounded coverage.
+   *
+   * @param contracts - Contract addresses to authorize, or {@link WILDCARD_PERMIT}.
    * @throws if `transportKeyPairDerivationSecret` is configured and the keypair fails to wrap or
    *   unwrap. {@link KeyWrappingError}
    */
-  grantPermit(contracts: Address[]): Promise<void>;
+  grantPermit(contracts: Address[] | WildcardPermit): Promise<void>;
   /**
    * Sign and store an EIP-712 delegation permit authorizing decryption on
-   * behalf of `delegator`. Same idempotence/chunking semantics as {@link grantPermit}.
+   * behalf of `delegator`. Same idempotence/chunking/wildcard semantics as
+   * {@link grantPermit}.
    *
    * @param delegator - The address that delegated decryption rights to the connected signer.
-   * @param contracts - Contract addresses to authorize.
+   * @param contracts - Contract addresses to authorize, or {@link WILDCARD_PERMIT}.
    * @throws if `transportKeyPairDerivationSecret` is configured and the keypair fails to wrap or
    *   unwrap. {@link KeyWrappingError}
    */
-  grantDelegationPermit(delegator: Address, contracts: Address[]): Promise<void>;
+  grantDelegationPermit(delegator: Address, contracts: Address[] | WildcardPermit): Promise<void>;
   /**
    * Pure store lookup: is there a permit covering `contracts`?
    * No wallet prompt, no transport key pair generation. Returns `false` when no signer
@@ -20498,7 +20904,8 @@ declare class Permits {
    * (and `prepared.delegatorAddress`, if present), not a connected signer.
    *
    * @param prepared - The payload `sdk.offline.preparePermit` returned.
-   * @param signature - The 65-byte `eth_signTypedData_v4` signature over `prepared.eip712`.
+   * @param signature - The `eth_signTypedData_v4` signature over `prepared.eip712`.
+   *   V2 permits also accept a variable-length ERC-1271 (smart-wallet) blob.
    * @throws if `prepared` doesn't match the `PreparedPermit` shape (e.g. it crossed a
    *   process boundary and was corrupted). {@link ConfigurationError}
    * @throws if the chain embedded in `prepared.eip712` doesn't match the active chain. {@link PreparedPermitChainMismatchError}
@@ -20566,10 +20973,32 @@ declare class Permits {
    *   unwrap. {@link KeyWrappingError}
    */
   warmTransportKeyPairScope(scopeId: string): Promise<void>;
+  /**
+   * Invalidate every decryption signature signed before `timestamp`, via
+   * `ACL.invalidateDecryptionSignaturesBefore`. The KMS Connector rejects
+   * any decryption request whose permit predates the new cutoff — the
+   * recourse when a permissive/wildcard permit or its signing key is
+   * compromised, or on a multisig (ERC-1271/Safe) owner rotation. Call this
+   * on every multisig signer rotation and on suspected signing-key compromise.
+   *
+   * On success, this signer's locally-stored permits for the current chain
+   * are cleared automatically — they would now only fail against the KMS
+   * Connector.
+   *
+   * @param timestamp - Oldest timestamp that remains valid. Omit to invalidate
+   *   everything up to now.
+   * @throws if no signer is configured. {@link SignerNotConfiguredError}
+   * @throws if signer and provider are on different chains. {@link ChainMismatchError}
+   * @throws if `timestamp` is not strictly later than the account's current
+   *   cutoff. {@link InvalidationTimestampTooLowError}
+   * @throws if `timestamp` is in the future. {@link InvalidationTimestampInFutureError}
+   * @throws if the invalidation transaction reverts for any other reason. {@link TransactionRevertedError}
+   */
+  invalidateDecryptionSignatures(timestamp?: Date): Promise<TransactionResult>;
 }
 //#endregion
 //#region src/services/delegation-service.d.ts
-/** Delegation activity and expiry, resolved from a single expiry read. */
+/** Delegation activity and expiry, resolved from the active contract or wildcard grant. */
 interface DelegationStatus {
   /** Whether the delegation is currently active (exists and not expired). */
   isActive: boolean;
@@ -20602,7 +21031,8 @@ declare class Delegations {
    * window with a bounded internal retry, so you can decrypt right after this
    * resolves.
    *
-   * @param contractAddress - The confidential contract address to delegate on.
+   * @param contractAddress - The confidential contract address to delegate on, or
+   *   {@link WILDCARD_CONTRACT} to cover every contract with a single delegation.
    * @param delegateAddress - Address to delegate decryption rights to.
    * @param expirationDate - Optional expiration date (defaults to permanent delegation via `uint64.max`).
    * @returns The transaction hash and mined receipt.
@@ -20610,6 +21040,7 @@ declare class Delegations {
    * @throws if signer and provider are on different chains. {@link ChainMismatchError}
    * @throws if `expirationDate` is less than 1 hour in the future. {@link DelegationExpirationTooSoonError}
    * @throws if the delegate equals the connected wallet. {@link DelegationSelfNotAllowedError}
+   * @throws if the delegate is the wildcard address. {@link DelegationDelegateCannotBeWildcardError}
    * @throws if the delegate equals the contract address. {@link DelegationDelegateEqualsContractError}
    * @throws if the new expiry equals the current one. {@link DelegationExpiryUnchangedError}
    * @throws if the delegation transaction reverts. {@link TransactionRevertedError}
@@ -20683,1192 +21114,1517 @@ declare class Delegations {
   }): Promise<DelegationStatus>;
 }
 //#endregion
-//#region src/namespaces/offline.d.ts
+//#region src/query/utils.d.ts
+/** Union of TanStack Query option keys stripped by {@link filterQueryOptions}, leaving only domain parameters. */
+type StrippedQueryOptionKeys = "gcTime" | "staleTime" | "enabled" | "select" | "refetchInterval" | "refetchOnMount" | "refetchOnWindowFocus" | "refetchOnReconnect" | "retry" | "retryDelay" | "retryOnMount" | "queryFn" | "queryKey" | "queryKeyHashFn" | "initialData" | "initialDataUpdatedAt" | "placeholderData" | "structuralSharing" | "throwOnError" | "meta" | "query" | "pollingInterval";
 /**
- * Namespace for the offline-signing pipeline —
- * `prepare → [external sign + self-publish]` — for institutional custody, HSM
- * ceremonies, and policy-engine workflows where signing runs out-of-process and
- * cannot happen synchronously in a single Promise.
+ * Remove TanStack behavioral options from a query config object so only domain
+ * parameters remain for the lower-level factory.
+ *
+ * @example
+ * ```ts
+ * const params = filterQueryOptions({
+ *   query: { enabled: false },
+ *   gcTime: 60_000,
+ *   owner: "0xabc",
+ * });
+ * // => { owner: "0xabc" }
+ * ```
  */
-declare class Offline {
-  #private;
-  /**
-   * Build an RLP-encoded unsigned transaction for the given request. The
-   * caller signs it externally — via an HSM ceremony, an out-of-process
-   * custodian, or any signer holding the key — and broadcasts the signed bytes
-   * through its own channel.
-   *
-   * Signer-optional: works without a configured signer (canonical shape for
-   * cross-process custody — the back-end signer service consumes
-   * `prepared.unsignedTx` and returns signed bytes).
-   *
-   * @remarks
-   * `request.from` is only a declaration — the SDK does not prove the caller
-   * controls it, and an EIP-1559 unsigned tx carries no `from` field at all
-   * (the on-chain sender is whichever key signs the bytes). Point `from` at
-   * the account the custodian will sign with; custodians enforce key-control
-   * at sign time — a signing request for a key the credential can't use fails
-   * there — so a mismatched `from` cannot make the custodian sign from an
-   * account you don't control. Verifying control of `from` up front is still
-   * the application's responsibility.
-   */
-  prepare<K extends TransactionKind>(request: Extract<PrepareTransactionRequest, {
-    kind: K;
-  }>, options?: PrepareOptions): Promise<PreparedFor<K>>;
-  /**
-   * Build the offline-signing payload for a decryption permit: the unsigned
-   * EIP-712 typed data plus everything `sdk.permits.registerPermit` needs to
-   * verify and persist the signature an out-of-process signer returns for it.
-   *
-   * Not a `prepare()` transaction kind: a permit is not a transaction —
-   * nothing is broadcast, and registering the signature is a local operation,
-   * not a relayer round-trip.
-   *
-   * Signer-optional, like {@link prepare}: `request.signer` is an explicit
-   * address, not a connected wallet account. Building the typed data still
-   * reads the chain's KMS signers context on-chain — signer-offline, not
-   * network-offline.
-   *
-   * One permit per call: unlike `sdk.permits.grantPermit`, this never widens
-   * an existing permit or chunks over 10 contracts — `request.contracts` maps
-   * to exactly one signature.
-   *
-   * @throws if `request.contracts` is empty or exceeds 10 addresses, `request.delegator`
-   *   equals `request.signer`, or `request.durationDays` exceeds the V1 permit maximum
-   *   of 365 days. {@link ConfigurationError}
-   * @throws if a concurrent `permits.revokeTransportKeyPair()` rotates the transport key
-   *   pair while this call is generating one. {@link TransportKeyPairChangedError}
-   */
-  preparePermit(request: PreparePermitRequest): Promise<PreparedPermit>;
-}
+declare function filterQueryOptions<TOptions extends Record<string, unknown>>(options: TOptions): Omit<TOptions, StrippedQueryOptionKeys>;
+/**
+ * Stable hash function for query keys.
+ * Sorts object keys recursively and converts bigint values to strings.
+ *
+ * @remarks
+ * bigint values are serialized as decimal strings, so `42n` and `"42"` hash to
+ * the same token when they occupy the same position. This collision is accepted
+ * by design for the current query-key conventions in this package.
+ */
+declare function hashFn(queryKey: readonly unknown[]): string;
 //#endregion
-//#region src/token/token.d.ts
-/** Options for {@link Token.batchDecryptBalancesAs}. */
-interface BatchDecryptAsOptions {
-  /** The address of the account that delegated decryption rights. */
-  delegatorAddress: Address;
-  /** Pre-fetched encrypted values. When omitted, they are fetched from the chain. */
-  encryptedValues?: EncryptedValue[];
-  /**
-   * The account whose on-chain balance to read. Defaults to the delegator
-   * address, which is the common case (the delegator grants permission to
-   * decrypt their own balance). Only set this when the account differs
-   * from the delegator.
-   *
-   * Matches the `account` parameter of `confidentialBalanceOf(account)` on-chain.
-   */
-  accountAddress?: Address;
-  /** Maximum number of concurrent decrypt calls. Default: 10. */
-  maxConcurrency?: number;
-  /** Called when decryption fails for a single token. Return a fallback bigint. */
-  onError?: (error: Error, address: Address) => bigint;
+//#region src/query/factory-types.d.ts
+/**
+ * TanStack Query options object returned by the SDK's `*QueryOptions` factories:
+ * `QueryObserverOptions` with `queryKey` and `queryFn` required and the
+ * cache-internal keys (`queryHash`, `queryKeyHashFn`, `throwOnError`) removed.
+ */
+type QueryFactoryOptions<TQueryFnData = unknown, TError = Error, TData = TQueryFnData, TQueryKey extends QueryKey = QueryKey> = Omit<Omit<QueryObserverOptions<TQueryFnData, TError, TData, TQueryFnData, TQueryKey>, "queryKey"> & Required<Pick<QueryObserverOptions<TQueryFnData, TError, TData, TQueryFnData, TQueryKey>, "queryKey">>, "queryFn" | "queryHash" | "queryKeyHashFn" | "throwOnError"> & {
+  queryFn: Exclude<QueryObserverOptions<TQueryFnData, TError, TData, TQueryFnData, TQueryKey>["queryFn"], typeof skipToken | undefined>;
+};
+/** TanStack Query mutation options object returned by the SDK's `*MutationOptions` factories. */
+interface MutationFactoryOptions<TMutationKey extends readonly unknown[], TVariables, TData, TOnMutateResult = unknown> {
+  /** Cache key identifying the mutation. */
+  mutationKey: TMutationKey;
+  /** Runs the mutation for the given variables. */
+  mutationFn: (variables: TVariables) => Promise<TData>;
+  /** Optional callback invoked after the mutation succeeds. */
+  onSuccess?: (data: TData, variables: TVariables, onMutateResult: TOnMutateResult, context: MutationFunctionContext) => void;
 }
-/** Result of {@link Token.batchBalancesOf}. */
-interface BatchBalancesResult {
-  /** Successfully decrypted balances, keyed by token address. */
-  results: Map<Address, bigint>;
-  /** Per-token errors for tokens that failed to decrypt. */
-  errors: Map<Address, ZamaError>;
+//#endregion
+//#region src/query/signer-query-context.d.ts
+/** Connected-wallet context threaded into query factories to scope cache keys and gate signer-dependent queries. */
+interface SignerQueryContext {
+  /** Connected wallet account; queries that need a signer stay disabled until it is set. */
+  walletAccount?: WalletAccount;
 }
+//#endregion
+//#region src/query/query-keys.d.ts
 /**
- * High-level interface for an ERC-7984 confidential token.
- * Hides FHE complexity (encryption, decryption, EIP-712 signing) behind
- * familiar ERC-20-like methods.
- *
- * For ERC-7984 wrappers (shield/unshield), use {@link WrappedToken} instead —
- * it extends `Token` with wrapper-specific operations.
+ * Canonical query-key namespace for `@zama-fhe/sdk/query`.
  *
- * Decryption, credentials, caching, and event emission are handled by the
- * owning {@link ZamaSDK} — this class only exposes token-scoped helpers
- * that delegate to `sdk.decryption.decryptValues` and `sdk.permits.grantPermit`.
+ * @example
+ * ```ts
+ * queryClient.invalidateQueries({
+ *   queryKey: zamaQueryKeys.confidentialBalance.token("0xToken"),
+ * });
+ * ```
  */
-declare class Token {
-  #private;
-  /** The SDK instance this token operates through. */
-  readonly sdk: ZamaSDK;
-  /** Checksummed address of the confidential token contract. */
-  readonly address: Address;
-  constructor(sdk: ZamaSDK, address: Address);
-  /** Read the token name from the contract. */
-  name(): Promise<string>;
-  /** Read the token symbol from the contract. */
-  symbol(): Promise<string>;
-  /** Read the token decimals from the contract. */
-  decimals(): Promise<number>;
-  /**
-   * ERC-165 check for {@link ERC7984_INTERFACE_ID} support.
-   *
-   * @returns `true` if the contract implements the ERC-7984 confidential token interface.
-   */
-  isConfidential(): Promise<boolean>;
-  /**
-   * ERC-165 check for IERC7984ERC20Wrapper support.
-   *
-   * @returns `true` if the contract implements the ERC-7984 wrapper interface
-   *   ({@link ERC7984_WRAPPER_INTERFACE_ID}, `0x1f1c62b2`).
-   */
-  isWrapper(): Promise<boolean>;
-  /**
-   * Decrypt and return the plaintext balance for the given owner.
-   * Acquires FHE credentials via a wallet signature if none are cached.
-   *
-   * @param owner - Balance owner address.
-   * @returns The decrypted plaintext balance as a bigint.
-   * @throws if FHE decryption fails. {@link DecryptionFailedError}
-   *
-   * @example
-   * ```ts
-   * const balance = await token.balanceOf("0xOwner");
-   * ```
-   */
-  balanceOf(owner: Address): Promise<bigint>;
-  /**
-   * Return the raw encrypted balance without decrypting.
-   *
-   * @param owner - Balance owner address.
-   * @returns The encrypted balance as a hex string.
-   *
-   * @example
-   * ```ts
-   * const encryptedValue = await token.confidentialBalanceOf("0xOwner");
-   * ```
-   */
-  confidentialBalanceOf(owner: Address): Promise<EncryptedValue>;
-  /**
-   * Decrypt the balance of a delegator using delegated decryption credentials.
-   * The connected signer acts as the delegatee who has been granted permission
-   * by the delegator to decrypt their balance.
-   *
-   * Clear values are cached in storage keyed by `(account, token, encryptedValue)`.
-   * Because every on-chain balance change produces a new encrypted value,
-   * stale cache entries are never served. Cache write failures are silently
-   * ignored — they do not affect the returned value.
-   *
-   * @param delegatorAddress - The address of the account that delegated decryption rights.
-   * @param accountAddress - The account whose on-chain balance to read. Defaults
-   *   to the delegator address.
-   * @returns The decrypted plaintext balance as a bigint.
-   * @throws if no active delegation exists. {@link DelegationNotFoundError}
-   * @throws if the delegation has expired. {@link DelegationExpiredError}
-   * @throws if delegated decryption fails. {@link DecryptionFailedError}
+declare const zamaQueryKeys: {
+  readonly confidentialBalance: {
+    readonly all: readonly ["zama.confidentialBalance"];
+    readonly token: (tokenAddress: Address) => readonly ["zama.confidentialBalance", {
+      readonly tokenAddress: `0x${string}`;
+    }];
+    readonly owner: (tokenAddress: Address, owner?: Address, walletAccount?: WalletAccount) => readonly ["zama.confidentialBalance", {
+      readonly owner?: `0x${string}` | undefined;
+      readonly walletAddress: `0x${string}`;
+      readonly walletChainId: number;
+      readonly tokenAddress: `0x${string}`;
+    } | {
+      readonly owner?: `0x${string}` | undefined;
+      readonly walletAddress?: undefined;
+      readonly walletChainId?: undefined;
+      readonly tokenAddress: `0x${string}`;
+    }];
+  };
+  readonly confidentialBalances: {
+    readonly all: readonly ["zama.confidentialBalances"];
+    readonly tokens: (tokenAddresses: Address[], owner?: Address, walletAccount?: WalletAccount) => readonly ["zama.confidentialBalances", {
+      readonly owner?: `0x${string}` | undefined;
+      readonly walletAddress: `0x${string}`;
+      readonly walletChainId: number;
+      readonly tokenAddresses: `0x${string}`[];
+    } | {
+      readonly owner?: `0x${string}` | undefined;
+      readonly walletAddress?: undefined;
+      readonly walletChainId?: undefined;
+      readonly tokenAddresses: `0x${string}`[];
+    }];
+  };
+  readonly tokenMetadata: {
+    readonly all: readonly ["zama.tokenMetadata"];
+    readonly token: (tokenAddress: Address) => readonly ["zama.tokenMetadata", {
+      readonly tokenAddress: `0x${string}`;
+    }];
+  };
+  readonly isConfidential: {
+    readonly all: readonly ["zama.isConfidential"];
+    readonly token: (tokenAddress: Address) => readonly ["zama.isConfidential", {
+      readonly tokenAddress: `0x${string}`;
+    }];
+  };
+  readonly isWrapper: {
+    readonly all: readonly ["zama.isWrapper"];
+    readonly token: (tokenAddress: Address) => readonly ["zama.isWrapper", {
+      readonly tokenAddress: `0x${string}`;
+    }];
+  };
+  readonly wrapperDiscovery: {
+    readonly all: readonly ["zama.wrapperDiscovery"];
+    readonly token: (tokenAddress?: Address, erc20Address?: Address, registryAddress?: Address) => readonly ["zama.wrapperDiscovery", {
+      readonly registryAddress?: `0x${string}` | undefined;
+      readonly erc20Address?: `0x${string}` | undefined;
+      readonly tokenAddress?: `0x${string}` | undefined;
+    }];
+  };
+  readonly underlyingAllowance: {
+    readonly all: readonly ["zama.underlyingAllowance"];
+    readonly token: (tokenAddress: Address) => readonly ["zama.underlyingAllowance", {
+      readonly tokenAddress: `0x${string}`;
+    }];
+    readonly scope: (tokenAddress: Address, owner?: Address) => readonly ["zama.underlyingAllowance", {
+      readonly owner?: `0x${string}` | undefined;
+      readonly tokenAddress: `0x${string}`;
+    }];
+  };
+  readonly confidentialIsOperator: {
+    readonly all: readonly ["zama.confidentialIsOperator"];
+    readonly token: (tokenAddress?: Address) => readonly ["zama.confidentialIsOperator", {
+      tokenAddress: `0x${string}`;
+    } | {
+      tokenAddress?: undefined;
+    }];
+    readonly scope: (tokenAddress?: Address, holder?: Address, spender?: Address) => readonly ["zama.confidentialIsOperator", {
+      readonly spender?: `0x${string}` | undefined;
+      readonly holder?: `0x${string}` | undefined;
+      readonly tokenAddress?: `0x${string}` | undefined;
+    }];
+  };
+  readonly totalSupply: {
+    readonly all: readonly ["zama.totalSupply"];
+    readonly token: (tokenAddress: Address) => readonly ["zama.totalSupply", {
+      readonly tokenAddress: `0x${string}`;
+    }];
+  };
+  readonly pendingUnshield: {
+    readonly all: readonly ["zama.pendingUnshield"];
+    readonly token: (tokenAddress: Address) => readonly ["zama.pendingUnshield", {
+      readonly tokenAddress: `0x${string}`;
+    }];
+  };
+  readonly hasPermit: {
+    readonly all: readonly ["zama.hasPermit"];
+    readonly scope: (contractAddresses: Address[], walletAccount?: WalletAccount) => readonly ["zama.hasPermit", {
+      readonly contractAddresses: `0x${string}`[];
+      readonly walletAddress: `0x${string}`;
+      readonly walletChainId: number;
+    } | {
+      readonly contractAddresses: `0x${string}`[];
+      readonly walletAddress?: undefined;
+      readonly walletChainId?: undefined;
+    }];
+  };
+  readonly delegationStatus: {
+    readonly all: readonly ["zama.delegationStatus"];
+    readonly contract: (contractAddress?: Address) => readonly ["zama.delegationStatus", {
+      contractAddress: `0x${string}`;
+    } | {
+      contractAddress?: undefined;
+    }];
+    readonly scope: (contractAddress?: Address, delegator?: Address, delegate?: Address) => readonly ["zama.delegationStatus", {
+      readonly delegateAddress?: `0x${string}` | undefined;
+      readonly delegatorAddress?: `0x${string}` | undefined;
+      readonly contractAddress?: `0x${string}` | undefined;
+    }];
+  };
+  readonly decryption: {
+    readonly all: readonly ["zama.decryption"];
+    readonly encryptedValue: (encryptedValue: string, contractAddress?: Address) => readonly ["zama.decryption", {
+      readonly contractAddress?: `0x${string}` | undefined;
+      readonly encryptedValue: string;
+    }];
+    readonly encryptedInputs: (encryptedInputs: readonly {
+      encryptedValue: string;
+      contractAddress: Address;
+    }[], walletAccount?: WalletAccount) => readonly ["zama.decryption", {
+      readonly encryptedInputs: {
+        encryptedValue: Hex;
+        contractAddress: `0x${string}`;
+      }[];
+      readonly walletAddress: `0x${string}`;
+      readonly walletChainId: number;
+    } | {
+      readonly encryptedInputs: {
+        encryptedValue: Hex;
+        contractAddress: `0x${string}`;
+      }[];
+      readonly walletAddress?: undefined;
+      readonly walletChainId?: undefined;
+    }];
+  };
+  readonly wrappersRegistry: {
+    readonly all: readonly ["zama.wrappersRegistry"];
+    readonly chainId: () => readonly ["zama.wrappersRegistry", {
+      readonly type: "chainId";
+    }];
+    readonly tokenPairs: (registryAddress: Address) => readonly ["zama.wrappersRegistry", {
+      readonly type: "tokenPairs";
+      readonly registryAddress: `0x${string}`;
+    }];
+    readonly confidentialTokenAddress: (registryAddress: Address, tokenAddress: Address) => readonly ["zama.wrappersRegistry", {
+      readonly type: "confidentialTokenAddress";
+      readonly registryAddress: `0x${string}`;
+      readonly tokenAddress: `0x${string}`;
+    }];
+    readonly tokenAddress: (registryAddress: Address, confidentialTokenAddress: Address) => readonly ["zama.wrappersRegistry", {
+      readonly type: "tokenAddress";
+      readonly registryAddress: `0x${string}`;
+      readonly confidentialTokenAddress: `0x${string}`;
+    }];
+    readonly tokenPairsLength: (registryAddress: Address) => readonly ["zama.wrappersRegistry", {
+      readonly type: "tokenPairsLength";
+      readonly registryAddress: `0x${string}`;
+    }];
+    readonly tokenPairsSlice: (registryAddress: Address, fromIndex: string, toIndex: string) => readonly ["zama.wrappersRegistry", {
+      readonly type: "tokenPairsSlice";
+      readonly registryAddress: `0x${string}`;
+      readonly fromIndex: string;
+      readonly toIndex: string;
+    }];
+    readonly tokenPair: (registryAddress: Address, index: string) => readonly ["zama.wrappersRegistry", {
+      readonly type: "tokenPair";
+      readonly registryAddress: `0x${string}`;
+      readonly index: string;
+    }];
+    readonly isConfidentialTokenValid: (registryAddress: Address, confidentialTokenAddress: Address) => readonly ["zama.wrappersRegistry", {
+      readonly type: "isConfidentialTokenValid";
+      readonly registryAddress: `0x${string}`;
+      readonly confidentialTokenAddress: `0x${string}`;
+    }];
+    readonly listPairs: (registryAddress: Address, page: number, pageSize: number, metadata: boolean) => readonly ["zama.wrappersRegistry", {
+      readonly type: "listPairs";
+      readonly registryAddress: `0x${string}`;
+      readonly page: number;
+      readonly pageSize: number;
+      readonly metadata: boolean;
+    }];
+  };
+};
+//#endregion
+//#region src/query/invalidation.d.ts
+/** Minimal query shape read by the invalidation predicates. */
+interface QueryLike {
+  /** The query's cache key. */
+  queryKey: readonly unknown[];
+}
+/** Minimal filter shape accepted by the invalidation helpers, matching TanStack Query's `QueryFilters`. */
+interface QueryFilterLike {
+  /** Match queries whose key starts with this prefix. */
+  queryKey?: readonly unknown[];
+  /** Match queries for which this returns `true`. */
+  predicate?: (query: QueryLike) => boolean;
+}
+/** Minimal `QueryClient` surface used by the invalidation helpers. */
+interface QueryClientLike {
+  /** Mark matching queries stale so they refetch. */
+  invalidateQueries(filters: QueryFilterLike): void | Promise<void>;
+  /** Remove matching queries from the cache entirely. */
+  removeQueries(filters: QueryFilterLike): void;
+}
+/** Invalidates the caches affected by an unwrap: confidential balances, underlying allowance, and pending unshields. */
+declare function invalidateAfterUnwrap(queryClient: QueryClientLike, tokenAddress: Address): void;
+/** Invalidates the caches affected by a wrap: confidential balances and underlying allowance. */
+declare function invalidateAfterWrap(queryClient: QueryClientLike, tokenAddress: Address): void;
+/** Invalidates the confidential balance queries for a token (single-token and batched). */
+declare function invalidateBalanceQueries(queryClient: QueryClientLike, tokenAddress: Address): void;
+/** Invalidates the caches affected by a shield: confidential balances and underlying allowance. */
+declare function invalidateAfterShield(queryClient: QueryClientLike, tokenAddress: Address): void;
+/** Invalidates the caches affected by an unshield request: confidential balances, underlying allowance, and pending unshields. */
+declare function invalidateAfterUnshield(queryClient: QueryClientLike, tokenAddress: Address): void;
+/** Invalidates the pending-unshield cache once an unshield has settled on-chain. */
+declare function invalidateAfterUnshieldSettled(queryClient: QueryClientLike, tokenAddress: Address): void;
+/** Invalidates the confidential balance caches affected by a transfer. */
+declare function invalidateAfterTransfer(queryClient: QueryClientLike, tokenAddress: Address): void;
+/** Invalidates the underlying-allowance cache after approving the underlying ERC-20. */
+declare function invalidateAfterApproveUnderlying(queryClient: QueryClientLike, tokenAddress: Address): void;
+/** Invalidates the operator-status cache after changing a token operator. */
+declare function invalidateAfterSetOperator(queryClient: QueryClientLike, tokenAddress: Address): void;
+/** Invalidates any wagmi `useBalance`/`readContract` balance queries so ERC-20 balances refresh. */
+declare function invalidateWagmiBalanceQueries(queryClient: QueryClientLike): void;
+/** Clears wallet-local caches (decryption, permits) and invalidates all Zama queries — call on wallet connect/disconnect so a stale entitlement can't leak across accounts. */
+declare function invalidateWalletLifecycleQueries(queryClient: QueryClientLike): void;
+//#endregion
+//#region src/query/token-metadata.d.ts
+/** ERC-20 token metadata returned by {@link tokenMetadataQueryOptions}. */
+interface TokenMetadata {
+  /** Human-readable token name. */
+  name: string;
+  /** Token ticker symbol. */
+  symbol: string;
+  /** Number of decimals the token uses. */
+  decimals: number;
+}
+/** Configuration for {@link tokenMetadataQueryOptions}. */
+interface TokenMetadataQueryConfig {
+  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
+  query?: Record<string, unknown>;
+}
+/** Builds TanStack Query options for reading an ERC-20 token's name, symbol, and decimals. */
+declare function tokenMetadataQueryOptions(sdk: ZamaSDK, tokenAddress: Address, config?: TokenMetadataQueryConfig): QueryFactoryOptions<TokenMetadata, Error, TokenMetadata, ReturnType<typeof zamaQueryKeys.tokenMetadata.token>>;
+//#endregion
+//#region src/query/is-confidential.d.ts
+/** Configuration for {@link isConfidentialQueryOptions} and {@link isWrapperQueryOptions}. */
+interface IsConfidentialQueryConfig {
+  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
+  query?: Record<string, unknown>;
+}
+/** Builds TanStack Query options for reading whether a token address implements the confidential (ERC-7984) token interface. */
+declare function isConfidentialQueryOptions(sdk: ZamaSDK, tokenAddress: Address, config?: IsConfidentialQueryConfig): QueryFactoryOptions<boolean, Error, boolean, ReturnType<typeof zamaQueryKeys.isConfidential.token>>;
+/** Builds TanStack Query options for reading whether a token address is a confidential wrapper (ERC-7984 wrapper) contract. */
+declare function isWrapperQueryOptions(sdk: ZamaSDK, tokenAddress: Address, config?: IsConfidentialQueryConfig): QueryFactoryOptions<boolean, Error, boolean, ReturnType<typeof zamaQueryKeys.isWrapper.token>>;
+//#endregion
+//#region src/query/total-supply.d.ts
+/** Configuration for {@link totalSupplyQueryOptions}. */
+interface TotalSupplyQueryConfig {
+  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
+  query?: Record<string, unknown>;
+}
+/** Builds TanStack Query options for reading a token's total supply. */
+declare function totalSupplyQueryOptions(sdk: ZamaSDK, tokenAddress: Address, config?: TotalSupplyQueryConfig): QueryFactoryOptions<bigint, Error, bigint, ReturnType<typeof zamaQueryKeys.totalSupply.token>>;
+//#endregion
+//#region src/wrappers-registry.d.ts
+/**
+ * Default wrappers registry addresses for known chains.
+ * Only includes chains where a registry is deployed (excludes Hardhat).
+ *
+ * @deprecated Read `registryAddress` from the chain presets instead (e.g.
+ * `sepolia.registryAddress`). Will be removed in the next major version.
+ */
+declare const DefaultRegistryAddresses: Record<number, Address>;
+/** Configuration for {@link WrappersRegistry}. */
+interface WrappersRegistryConfig {
+  /** Read-only chain provider used for every registry lookup. */
+  provider: GenericProvider;
+  /**
+   * Per-chain registry address overrides, merged on top of
+   * {@link DefaultRegistryAddresses}. Use this to supply a registry
+   * address for custom or local chains (e.g. Hardhat).
    *
    * @example
    * ```ts
-   * const balance = await token.decryptBalanceAs({
-   *   delegatorAddress: "0xDelegator",
+   * new WrappersRegistry({
+   *   provider,
+   *   registryAddresses: { [31337]: "0xYourHardhatRegistry" },
    * });
    * ```
    */
-  decryptBalanceAs({ delegatorAddress, accountAddress }: {
-    delegatorAddress: Address;
-    accountAddress?: Address;
-  }): Promise<bigint>;
+  registryAddresses?: Record<number, Address>;
   /**
-   * Decrypt confidential balances for multiple tokens in parallel, returning
-   * successes and per-token errors separately. Pre-authorizes all token
-   * addresses in a single wallet signature, then delegates each decrypt to
-   * `sdk.decryption.decryptValues`.
-   *
-   * Tokens that fail to decrypt land in `errors`; the batch keeps going.
-   *
-   * @param tokens - Array of {@link Token} instances bound to the same SDK.
-   * @param owner - Balance owner address.
-   * @returns `{ results, errors }` partitioning the per-token outcomes.
-   * @throws A failure that affects the whole session (rejected signature,
-   * misconfiguration, RPC rate limit, key unwrapping failure, revoked KMS
-   * context) rejects the call instead of landing in `errors`.
-   *
-   * @example
-   * ```ts
-   * const { results, errors } = await Token.batchBalancesOf(tokens, owner);
-   * ```
+   * How long cached registry results remain valid, in seconds.
+   * Default: `86400` (24 hours).
    */
-  static batchBalancesOf(tokens: Token[], owner: Address): Promise<BatchBalancesResult>;
+  registryTTL?: number;
+}
+/** Options for {@link WrappersRegistry.listPairs}. */
+interface ListPairsOptions {
+  /** Page number (1-indexed). Default: `1`. */
+  page?: number;
+  /** Number of items per page. Default: `100`. */
+  pageSize?: number;
   /**
-   * Batch decrypt confidential balances as a delegate across multiple tokens.
-   * Mirrors {@link batchBalancesOf} but uses delegated credentials.
-   *
-   * **Error handling:** If a per-token decryption fails and no `onError` callback
-   * is provided, errors are collected and thrown as an aggregated
-   * `DecryptionFailedError`. When the relayer returns no value for an encrypted value,
-   * a `DecryptionFailedError` is thrown for that token (never silently returns `0n`).
-   * Pass `onError: () => 0n` to opt into the silent zero behavior.
-   *
-   * @param tokens - Array of Token instances to decrypt balances for.
-   * @param options - Delegated decryption configuration.
-   * @returns A Map from token address to decrypted balance.
-   * @throws if no active delegation exists. {@link DelegationNotFoundError}
-   * @throws if the delegation has expired. {@link DelegationExpiredError}
-   * @throws if any decryption fails and no `onError` is provided. {@link DecryptionFailedError}
-   * @throws A failure that affects the whole session (rejected signature, RPC
-   * rate limit, revoked KMS context) rejects the call even when `onError` is
-   * provided.
-   *
-   * @example
-   * ```ts
-   * const balances = await Token.batchDecryptBalancesAs(tokens, {
-   *   delegatorAddress: "0xDelegator",
-   *   onError: (err, addr) => { console.error(addr, err); return 0n; },
-   * });
-   * ```
+   * When `true`, fetches on-chain metadata (name, symbol, decimals) for both
+   * the ERC-20 and confidential token, plus totalSupply for the ERC-20.
+   * Default: `false`.
    */
-  static batchDecryptBalancesAs(tokens: Token[], options: BatchDecryptAsOptions): Promise<Map<Address, bigint>>;
-  private static readBalanceHandlesBatch;
+  metadata?: boolean;
+}
+/**
+ * High-level interface for the on-chain token wrappers registry.
+ *
+ * Uses the configured {@link GenericProvider} to resolve the correct registry
+ * contract address for the current chain and exposes typed read helpers for
+ * every registry query. Results are cached in memory with a configurable TTL
+ * (default 24 hours).
+ *
+ * @example
+ * ```ts
+ * const registry = new WrappersRegistry({ provider });
+ *
+ * // Paginated listing
+ * const page1 = await registry.listPairs({ page: 1, pageSize: 20 });
+ *
+ * // Structured lookups
+ * const result = await registry.getConfidentialToken(erc20Address);
+ * if (result) console.log(result.confidentialTokenAddress);
+ *
+ * // Force refresh
+ * registry.refresh();
+ * ```
+ */
+declare class WrappersRegistry {
+  #private;
+  /** Read-only chain access used for registry contract reads. */
+  readonly provider: GenericProvider;
+  constructor(config: WrappersRegistryConfig);
   /**
-   * Confidential transfer. Encrypts the amount via FHE, then calls the contract.
-   *
-   * By default, the SDK validates the confidential balance before submitting.
-   * If a cached plaintext balance exists it is used; otherwise, if credentials
-   * are cached, it decrypts on the fly. Set `skipBalanceCheck: true` to bypass
-   * this validation (e.g. for smart wallets).
-   *
-   * @param to - Recipient address.
-   * @param amount - Plaintext amount to transfer (encrypted automatically via FHE).
-   * @param options - Optional: `skipBalanceCheck` (default `false`).
-   * @returns The transaction hash and mined receipt.
-   * @throws if signer and provider are on different chains. {@link ChainMismatchError}
-   * @throws if the balance is less than `amount`. {@link InsufficientConfidentialBalanceError}
-   * @throws if balance validation requires decryption that is not possible. {@link BalanceCheckUnavailableError}
-   * @throws if FHE encryption fails. {@link EncryptionFailedError}
-   * @throws if the on-chain transfer reverts. {@link TransactionRevertedError}
-   *
-   * @example
-   * ```ts
-   * const txHash = await token.confidentialTransfer("0xRecipient", 1000n);
-   * ```
+   * Synchronous lookup of the registry address for a given chain ID.
+   * Returns `undefined` if no address is configured for that chain.
    */
-  confidentialTransfer(to: Address, amount: bigint, options?: TransferOptions): Promise<TransactionResult>;
+  getAddress(chainId: number): Address | undefined;
   /**
-   * Operator encrypted transfer on behalf of another address.
-   * The caller must be an approved operator for `from`.
-   *
-   * @param from - The address to transfer from (caller must be an approved operator).
-   * @param to - Recipient address.
-   * @param amount - Plaintext amount to transfer (encrypted automatically via FHE).
-   * @returns The transaction hash and mined receipt.
-   *
-   * @example
-   * ```ts
-   * const txHash = await token.confidentialTransferFrom("0xFrom", "0xTo", 500n);
-   * ```
+   * Force-invalidate the in-memory cache. The next call to any read method
+   * will fetch fresh data from the chain.
    */
-  confidentialTransferFrom(from: Address, to: Address, amount: bigint, callbacks?: TransferCallbacks): Promise<TransactionResult>;
+  refresh(): void;
   /**
-   * ERC-7984 `confidentialTransferAndCall`: encrypted transfer that also invokes
-   * the recipient's receiver hook (`onConfidentialTransferReceived`) in a single
-   * transaction. The caller crafts the opaque `data` payload — the SDK does not
-   * encode, validate, or interpret it.
-   *
-   * Balance validation follows the same rules as {@link Token.confidentialTransfer}.
-   *
-   * @param to - Recipient address. Must implement the ERC-7984 receiver hook.
-   * @param amount - Plaintext amount to transfer (encrypted automatically via FHE).
-   * @param data - Opaque bytes forwarded to the recipient's receiver hook.
-   * @param options - Optional: `skipBalanceCheck` (default `false`).
-   * @returns The transaction hash and mined receipt.
+   * The cache TTL in milliseconds.
+   * Exposed so query option factories can set a matching `staleTime`.
+   */
+  get ttlMs(): number;
+  /**
+   * Resolve the registry contract address for the current chain.
    *
-   * @throws if signer and provider are on different chains. {@link ChainMismatchError}
-   * @throws if the balance is less than `amount`. {@link InsufficientConfidentialBalanceError}
-   * @throws if balance validation requires decryption that is not possible. {@link BalanceCheckUnavailableError}
-   * @throws if FHE encryption fails. {@link EncryptionFailedError}
-   * @throws if the on-chain transfer reverts. {@link TransactionRevertedError}
+   * Priority: `registryAddresses[chainId]` \> built-in default.
    *
-   * @example
-   * ```ts
-   * const txHash = await token.confidentialTransferAndCall(
-   *   "0xRecipient",
-   *   1000n,
-   *   "0xabcd", // caller-encoded payload forwarded to the receiver hook
-   * );
-   * ```
+   * @returns The registry contract address for the connected chain.
+   * @throws if no address is configured for the chain. {@link ConfigurationError}
    */
-  confidentialTransferAndCall(to: Address, amount: bigint, data: Hex, options?: TransferOptions): Promise<TransactionResult>;
+  getRegistryAddress(): Promise<Address>;
   /**
-   * ERC-7984 `confidentialTransferFromAndCall`: operator-initiated encrypted
-   * transfer that also invokes the recipient's receiver hook in a single
-   * transaction. The caller must be an approved operator for `from` and crafts
-   * the opaque `data` payload — the SDK does not encode or interpret it.
+   * List token wrapper pairs with page-based pagination.
    *
-   * @param from - The address to transfer from (caller must be an approved operator).
-   * @param to - Recipient address. Must implement the ERC-7984 receiver hook.
-   * @param amount - Plaintext amount to transfer (encrypted automatically via FHE).
-   * @param data - Opaque bytes forwarded to the recipient's receiver hook.
-   * @param callbacks - Optional progress callbacks.
-   * @returns The transaction hash and mined receipt.
+   * Internally maps to `getTokenConfidentialTokenPairsSlice` on-chain.
+   *
+   * @param options - Pagination and enrichment options.
+   * @returns A {@link PaginatedResult} of pairs.
    *
    * @example
    * ```ts
-   * const txHash = await token.confidentialTransferFromAndCall(
-   *   "0xFrom",
-   *   "0xRecipient",
-   *   500n,
-   *   "0xabcd",
-   * );
+   * const result = await registry.listPairs({ page: 1, pageSize: 20 });
+   * console.log(`${result.total} pairs, showing page ${result.page}`);
+   *
+   * // With on-chain metadata
+   * const withMeta = await registry.listPairs({ metadata: true, pageSize: 10 });
+   * for (const pair of withMeta.items) {
+   *   console.log(pair.underlying.symbol, "→", pair.confidential.symbol);
+   * }
    * ```
    */
-  confidentialTransferFromAndCall(from: Address, to: Address, amount: bigint, data: Hex, callbacks?: TransferCallbacks): Promise<TransactionResult>;
+  listPairs(options: ListPairsOptions & {
+    metadata: true;
+  }): Promise<PaginatedResult<TokenWrapperPairWithMetadata>>;
+  /** Lists registered underlying/confidential token pairs; pass `{ metadata: true }` to include on-chain token metadata. */
+  listPairs(options?: ListPairsOptions): Promise<PaginatedResult<TokenWrapperPair>>;
   /**
-   * Set operator approval for the confidential token.
-   * Defaults to 1 hour from now if `until` is not specified.
+   * Look up the confidential token for a given plain ERC-20 address.
    *
-   * @param operator - The address to set as an operator.
-   * @param until - Optional Unix timestamp for approval expiry. Defaults to now + 1 hour.
-   * @returns The transaction hash and mined receipt.
+   * @param tokenAddress - The plain ERC-20 token address.
+   * @returns The lookup result, or `null` if the token has never been registered.
+   *   **Note:** revoked tokens (registered then invalidated) return a non-null result
+   *   with `isValid: false`. Check `result.isValid` explicitly rather than using
+   *   `if (result)` to guard against processing revoked tokens.
    *
    * @example
    * ```ts
-   * const txHash = await token.setOperator("0xOperator");
+   * const result = await registry.getConfidentialToken(usdcAddress);
+   * if (result?.isValid) {
+   *   console.log(result.confidentialTokenAddress);
+   * }
    * ```
    */
-  setOperator(operator: Address, until?: number): Promise<TransactionResult>;
+  getConfidentialToken(tokenAddress: Address): Promise<{
+    confidentialTokenAddress: Address;
+    isValid: boolean;
+  } | null>;
   /**
-   * Check if a spender is an approved operator for a given holder.
+   * Reverse lookup — find the plain ERC-20 for a given confidential token.
    *
-   * @param holder - The token holder address.
-   * @param spender - The address to check operator approval for.
-   * @returns `true` if the spender is an approved operator for the holder.
+   * @param confidentialTokenAddress - The confidential token address.
+   * @returns The lookup result, or `null` if no pair is registered.
    *
    * @example
    * ```ts
-   * if (await token.isOperator("0xHolder", "0xSpender")) {
-   *   // spender can call transferFrom on behalf of holder
+   * const result = await registry.getUnderlyingToken(cUsdcAddress);
+   * if (result) {
+   *   console.log(result.tokenAddress, result.isValid);
    * }
    * ```
    */
-  isOperator(holder: Address, spender: Address): Promise<boolean>;
-  /** Verify all tokens share the same SDK instance and return it. */
-  private static assertSameSdk;
-}
-//#endregion
-//#region src/token/wrapped-token.d.ts
-/**
- * Confidential ERC-20 wrapper (ERC-7984 ERC20Wrapper).
- *
- * Extends {@link Token} with wrapper-specific operations:
- * - `shield` / `unshield` — convert between the underlying ERC-20 and confidential balance
- * - `unwrap` / `unwrapAll` / `finalizeUnwrap` — low-level two-phase primitives
- * - `underlying` / `allowance` — wrapper reads
- *
- * `WrappedToken.address` is the wrapper contract address itself — the wrapper
- * IS the confidential token.
- */
-declare class WrappedToken extends Token {
-  #private;
+  getUnderlyingToken(confidentialTokenAddress: Address): Promise<{
+    tokenAddress: Address;
+    isValid: boolean;
+  } | null>;
   /**
-   * Read the underlying ERC-20 token address from the wrapper contract.
+   * Fetch all token wrapper pairs from the registry.
    *
-   * @returns The underlying ERC-20 token address.
+   * @returns All registered `TokenWrapperPair` entries.
    */
-  underlying(): Promise<Address>;
+  getTokenPairs(): Promise<readonly TokenWrapperPair[]>;
   /**
-   * Check whether the underlying ERC-20 supports ERC-1363 (payable token).
-   * Result is cached per WrappedToken instance (negative results included):
-   * once we know an underlying does not support ERC-1363, subsequent shields
-   * go straight to the `approve` + `wrap` path without re-probing.
+   * Get the total number of token wrapper pairs.
+   *
+   * @returns The count as a bigint.
    */
-  isPayable(): Promise<boolean>;
+  getTokenPairsLength(): Promise<bigint>;
   /**
-   * Read the ERC-20 allowance granted by `owner` to this wrapper for the
-   * underlying token.
+   * Fetch a range of token wrapper pairs (paginated by index).
    *
-   * @param owner - The owner address whose allowance to read.
-   * @returns The current allowance as a bigint.
+   * @param fromIndex - Start index (inclusive).
+   * @param toIndex - End index (exclusive).
+   * @returns The slice of `TokenWrapperPair` entries.
    */
-  allowance(owner: Address): Promise<bigint>;
+  getTokenPairsSlice(fromIndex: bigint, toIndex: bigint): Promise<readonly TokenWrapperPair[]>;
   /**
-   * Shield public ERC-20 tokens into confidential tokens.
-   *
-   * The execution path is decided automatically by ERC-165 introspection on
-   * the underlying ERC-20:
-   * - **`transferAndCall`** (single tx): when the underlying supports
-   *   ERC-1363, no approval is required — the wrapper's `onTransferReceived`
-   *   callback mints confidential tokens directly. `approvalStrategy` is
-   *   **ignored** on this path. See {@link ShieldPath}.
-   * - **`approveAndWrap`** (two-tx fallback): otherwise, an `approve` is
-   *   followed by a `wrap`. Approval is controlled by `approvalStrategy`
-   *   (`"exact"` by default, `"max"` for unlimited, `"skip"` to opt out).
-   *
-   * The ERC-20 balance is validated before submitting (public read, no
-   * signing required) so the call works for all wallet types, including
-   * smart wallets.
-   *
-   * @param amount - The plaintext amount to shield.
-   * @param options - Optional: `approvalStrategy`, `to`, callbacks.
-   * @returns The transaction hash and mined receipt.
-   * @throws if signer and provider are on different chains. {@link ChainMismatchError}
-   * @throws if the ERC-20 balance is less than `amount`. {@link InsufficientERC20BalanceError}
-   * @throws if the ERC-20 approval or shield transaction reverts. {@link TransactionRevertedError}
+   * Fetch a single token wrapper pair by index.
    *
-   * @example
-   * ```ts
-   * const txHash = await wrappedToken.shield(1000n);
-   * ```
+   * @param index - Zero-based pair index.
+   * @returns The `TokenWrapperPair` at that index.
    */
-  shield(amount: bigint, options?: ShieldOptions): Promise<TransactionResult>;
+  getTokenPair(index: bigint): Promise<TokenWrapperPair>;
   /**
-   * Wrap already-approved underlying ERC-20 into confidential tokens.
-   *
-   * Escape hatch for splitting shield across two signatures: call
-   * {@link approveUnderlying} first, then `wrap`. Most callers should use
-   * {@link shield}, which routes and orchestrates approval automatically.
-   *
-   * Validates the ERC-20 balance and the allowance granted to this wrapper
-   * (public reads, no signing) and fails early with a clear error.
-   *
-   * @param amount - The plaintext amount to wrap.
-   * @param options - Optional `to` recipient and `onWrapSubmitted` callback.
-   * @returns The transaction hash and mined receipt.
-   * @throws if reading the ERC-20 balance or allowance fails. {@link ERC20ReadFailedError}
-   * @throws if the ERC-20 balance is less than `amount`. {@link InsufficientERC20BalanceError}
-   * @throws if the allowance granted to the wrapper is less than `amount`. {@link InsufficientAllowanceError}
+   * Look up the confidential token address for a given plain ERC-20 token.
    *
-   * @example
-   * ```ts
-   * await wrappedToken.approveUnderlying(1000n);
-   * await wrappedToken.wrap(1000n);
-   * ```
+   * @param tokenAddress - The plain ERC-20 token address.
+   * @returns A tuple `[isValid, confidentialTokenAddress]`. `isValid` is `true` only for a
+   *   registered, non-revoked wrapper. The address is the zero address when no pair is registered.
+   *   A non-zero address with `isValid=false` means the wrapper was registered but later revoked.
    */
-  wrap(amount: bigint, options?: WrapOptions): Promise<TransactionResult>;
+  getConfidentialTokenAddress(tokenAddress: Address): Promise<readonly [boolean, Address]>;
   /**
-   * Approve this wrapper contract to spend the underlying ERC-20.
-   * Defaults to max uint256. Resets to zero first if there's an existing
-   * non-zero allowance (required by tokens like USDT).
-   *
-   * @param amount - Optional approval amount. Defaults to max uint256.
-   * @returns The transaction hash and mined receipt.
+   * Reverse lookup — find the plain ERC-20 for a given confidential token.
    *
-   * @example
-   * ```ts
-   * await wrappedToken.approveUnderlying(); // max approval
-   * await wrappedToken.approveUnderlying(1000n); // exact amount
-   * ```
+   * @param confidentialTokenAddress - The confidential token address.
+   * @returns A tuple `[isValid, tokenAddress]`. `isValid` is `true` only for a registered,
+   *   non-revoked wrapper. The address is the zero address when no pair is registered.
+   *   A non-zero address with `isValid=false` means the wrapper was registered but later revoked.
    */
-  approveUnderlying(amount?: bigint): Promise<TransactionResult>;
+  getTokenAddress(confidentialTokenAddress: Address): Promise<readonly [boolean, Address]>;
   /**
-   * Unshield a specific amount and finalize in one call.
-   * Orchestrates: unshield → wait for receipt → parse event → finalize.
-   *
-   * By default, the SDK validates the confidential balance before submitting.
-   * Set `skipBalanceCheck: true` to bypass this validation (e.g. for smart wallets).
-   *
-   * @param amount - The plaintext amount to unshield.
-   * @param options - Optional: `skipBalanceCheck` (default `false`), callbacks.
-   * @returns The finalize transaction hash and mined receipt.
+   * Check whether a confidential token is registered and valid.
    *
-   * @example
-   * ```ts
-   * const txHash = await wrappedToken.unshield(500n);
-   * ```
+   * @param confidentialTokenAddress - The confidential token address to check.
+   * @returns `true` if the token is a known valid wrapper in the registry.
    */
-  unshield(amount: bigint, options?: UnshieldOptions): Promise<TransactionResult>;
+  isConfidentialTokenValid(confidentialTokenAddress: Address): Promise<boolean>;
+}
+//#endregion
+//#region src/query/wrapper-discovery.d.ts
+/** Configuration for {@link wrapperDiscoveryQueryOptions}. */
+interface WrapperDiscoveryQueryConfig {
   /**
-   * Unshield the entire balance and finalize in one call.
-   * Orchestrates: unshieldAll → wait for receipt → parse event → finalize.
-   *
-   * @param callbacks - Optional progress callbacks for each phase.
-   * @returns The finalize transaction hash and mined receipt.
-   * @throws if the balance is zero. {@link DecryptionFailedError}
+   * Address of any confidential token you control.
+   * Used to scope the query cache key and to gate whether the query
+   * is enabled — it does not affect which wrapper the registry returns.
+   */
+  tokenAddress?: Address;
+  /**
+   * The ERC-20 token address to discover the confidential wrapper for.
+   * The registry is resolved automatically from chain config.
+   */
+  erc20Address?: Address;
+  /**
+   * The resolved registry contract address for the current chain.
+   * Included in the query key so that switching chains invalidates
+   * stale cached results. Pass `undefined` when the chain ID is not
+   * yet known — the query will be disabled.
+   */
+  registryAddress?: Address;
+  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
+  query?: Record<string, unknown>;
+}
+/** Builds TanStack Query options for discovering the confidential wrapper address for a given ERC-20 token (resolves to `null` when none is registered). */
+declare function wrapperDiscoveryQueryOptions(registry: WrappersRegistry, config: WrapperDiscoveryQueryConfig): QueryFactoryOptions<Address | null, Error, Address | null, ReturnType<typeof zamaQueryKeys.wrapperDiscovery.token>>;
+//#endregion
+//#region src/query/underlying-allowance.d.ts
+/** Configuration for {@link underlyingAllowanceQueryOptions}. */
+interface UnderlyingAllowanceQueryConfig {
+  /** Owner whose underlying-token allowance to read; the query stays disabled until provided. */
+  owner?: Address;
+  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
+  query?: Record<string, unknown>;
+}
+/** Builds TanStack Query options for reading the ERC-20 allowance the owner has granted a confidential wrapper on its underlying token. */
+declare function underlyingAllowanceQueryOptions(sdk: ZamaSDK, tokenAddress: Address, config: UnderlyingAllowanceQueryConfig): QueryFactoryOptions<bigint, Error, bigint, ReturnType<typeof zamaQueryKeys.underlyingAllowance.scope>>;
+//#endregion
+//#region src/query/pending-unshield.d.ts
+/** Configuration for {@link pendingUnshieldQueryOptions}. */
+interface PendingUnshieldQueryConfig {
+  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
+  query?: Record<string, unknown>;
+}
+/**
+ * Query options for reading the unwrap tx hash of an unshield that was
+ * interrupted between its two phases (returns `null` if none is pending).
+ *
+ * Backed by {@link ZamaSDK} storage via `WrappedToken.getPendingUnshield()`.
+ * `staleTime: 0` so the value reflects storage on mount; the unshield/unwrap
+ * mutations also invalidate this key on success.
+ */
+declare function pendingUnshieldQueryOptions(sdk: ZamaSDK, tokenAddress: Address, config?: PendingUnshieldQueryConfig): QueryFactoryOptions<Hex | null, Error, Hex | null, ReturnType<typeof zamaQueryKeys.pendingUnshield.token>>;
+//#endregion
+//#region src/query/confidential-is-operator.d.ts
+/** Configuration for {@link confidentialIsOperatorQueryOptions}. */
+interface ConfidentialIsOperatorQueryConfig {
+  /** Token holder whose operator authorization to check; the query stays disabled until provided. */
+  holder?: Address;
+  /** Spender address to check for operator authorization; the query stays disabled until provided. */
+  spender?: Address;
+  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
+  query?: Record<string, unknown>;
+}
+/** Builds TanStack Query options for reading whether a spender is an authorized operator of a holder on a confidential token. */
+declare function confidentialIsOperatorQueryOptions(sdk: ZamaSDK, tokenAddress: Address | undefined, config: ConfidentialIsOperatorQueryConfig): QueryFactoryOptions<boolean, Error, boolean, ReturnType<typeof zamaQueryKeys.confidentialIsOperator.scope>>;
+//#endregion
+//#region src/token/token.d.ts
+/** Options for {@link Token.batchDecryptBalancesAs}. */
+interface BatchDecryptAsOptions {
+  /** The address of the account that delegated decryption rights. */
+  delegatorAddress: Address;
+  /** Pre-fetched encrypted values. When omitted, they are fetched from the chain. */
+  encryptedValues?: EncryptedValue[];
+  /**
+   * The account whose on-chain balance to read. Defaults to the delegator
+   * address, which is the common case (the delegator grants permission to
+   * decrypt their own balance). Only set this when the account differs
+   * from the delegator.
    *
-   * @example
-   * ```ts
-   * const txHash = await wrappedToken.unshieldAll();
-   * ```
+   * Matches the `account` parameter of `confidentialBalanceOf(account)` on-chain.
    */
-  unshieldAll(callbacks?: UnshieldCallbacks): Promise<TransactionResult>;
+  accountAddress?: Address;
+  /** Maximum number of concurrent decrypt calls. Default: 10. */
+  maxConcurrency?: number;
+  /** Called when decryption fails for a single token. Return a fallback bigint. */
+  onError?: (error: Error, address: Address) => bigint;
+}
+/** Result of {@link Token.batchBalancesOf}. */
+interface BatchBalancesResult {
+  /** Successfully decrypted balances, keyed by token address. */
+  results: Map<Address, bigint>;
+  /** Per-token errors for tokens that failed to decrypt. */
+  errors: Map<Address, ZamaError>;
+}
+/**
+ * High-level interface for an ERC-7984 confidential token.
+ * Hides FHE complexity (encryption, decryption, EIP-712 signing) behind
+ * familiar ERC-20-like methods.
+ *
+ * For ERC-7984 wrappers (shield/unshield), use {@link WrappedToken} instead —
+ * it extends `Token` with wrapper-specific operations.
+ *
+ * Decryption, credentials, caching, and event emission are handled by the
+ * owning {@link ZamaSDK} — this class only exposes token-scoped helpers
+ * that delegate to `sdk.decryption.decryptValues` and `sdk.permits.grantPermit`.
+ */
+declare class Token {
+  #private;
+  /** The SDK instance this token operates through. */
+  readonly sdk: ZamaSDK;
+  /** Checksummed address of the confidential token contract. */
+  readonly address: Address;
+  constructor(sdk: ZamaSDK, address: Address);
+  /** Read the token name from the contract. */
+  name(): Promise<string>;
+  /** Read the token symbol from the contract. */
+  symbol(): Promise<string>;
+  /** Read the token decimals from the contract. */
+  decimals(): Promise<number>;
   /**
-   * Resume an in-progress unshield from an existing unwrap tx hash.
-   * Useful when the user already submitted the unwrap but the finalize step
-   * was interrupted (e.g. page reload, network error).
-   *
-   * @param unwrapTxHash - The transaction hash of the previously submitted unwrap.
-   * @param callbacks - Optional progress callbacks.
-   * @returns The finalize transaction hash and mined receipt.
-   * @throws if the unwrap request was already finalized on-chain; the persisted
-   *   pending-unshield state is cleared first. {@link UnshieldAlreadyFinalizedError}
+   * ERC-165 check for {@link ERC7984_INTERFACE_ID} support.
    *
-   * @example
-   * ```ts
-   * const txHash = await wrappedToken.resumeUnshield(previousUnwrapTxHash);
-   * ```
+   * @returns `true` if the contract implements the ERC-7984 confidential token interface.
    */
-  resumeUnshield(unwrapTxHash: Hex, callbacks?: UnshieldCallbacks): Promise<TransactionResult>;
+  isConfidential(): Promise<boolean>;
   /**
-   * Return the unwrap tx hash of an unshield that was interrupted between its
-   * two phases, or `null` if none is pending for this wrapper.
-   *
-   * The SDK persists this automatically when {@link unshield}/{@link unshieldAll}
-   * submit phase 1, and clears it once phase 2 finalizes. Use the returned hash
-   * to surface a "resume" affordance, then pass it to {@link resumeUnshield}.
-   * Resuming is intentionally caller-driven — auto-resuming on load would fire a
-   * wallet transaction unprompted.
-   *
-   * The pointer is verified on-chain before it is reported: if the unwrap
-   * request was already finalized (e.g. the tab closed before the SDK could
-   * clear storage), the stale pointer is cleared and `null` is returned. When
-   * the verification read fails, the pointer is returned unverified: a
-   * network error never deletes recovery state.
-   *
-   * @returns The pending unwrap tx hash, or `null`.
+   * ERC-165 check for IERC7984ERC20Wrapper support.
    *
-   * @example
-   * ```ts
-   * const unwrapTxHash = await wrappedToken.getPendingUnshield();
-   * if (unwrapTxHash) await wrappedToken.resumeUnshield(unwrapTxHash);
-   * ```
+   * @returns `true` if the contract implements the ERC-7984 wrapper interface
+   *   ({@link ERC7984_WRAPPER_INTERFACE_ID}, `0x1f1c62b2`).
    */
-  getPendingUnshield(): Promise<Hex | null>;
+  isWrapper(): Promise<boolean>;
   /**
-   * Request an unwrap for a specific amount. Encrypts the amount first.
-   * Pass the result's `unwrapRequestId` to {@link finalizeUnwrap} once the
-   * request is processed on-chain.
+   * Decrypt and return the plaintext balance for the given owner.
+   * Acquires FHE credentials via a wallet signature if none are cached.
    *
-   * @param amount - The plaintext amount to unwrap (encrypted automatically).
-   * @returns The tx hash, mined receipt, and the `unwrapRequestId` for `finalizeUnwrap`.
+   * @param owner - Balance owner address.
+   * @returns The decrypted plaintext balance as a bigint.
+   * @throws if FHE decryption fails. {@link DecryptionFailedError}
    *
    * @example
    * ```ts
-   * const result = await wrappedToken.unwrap(500n);
-   * await wrappedToken.finalizeUnwrap(result.unwrapRequestId);
+   * const balance = await token.balanceOf("0xOwner");
    * ```
    */
-  unwrap(amount: bigint): Promise<UnwrapResult>;
+  balanceOf(owner: Address): Promise<bigint>;
   /**
-   * Request an unwrap for the entire confidential balance.
-   * Uses the on-chain encrypted balance directly (no encryption needed).
-   * Throws if the balance is zero.
+   * Return the raw encrypted balance without decrypting.
    *
-   * @returns The tx hash, mined receipt, and the `unwrapRequestId` for `finalizeUnwrap`.
-   * @throws if the balance is zero. {@link DecryptionFailedError}
+   * @param owner - Balance owner address.
+   * @returns The encrypted balance as a hex string.
    *
    * @example
    * ```ts
-   * const result = await wrappedToken.unwrapAll();
-   * await wrappedToken.finalizeUnwrap(result.unwrapRequestId);
+   * const encryptedValue = await token.confidentialBalanceOf("0xOwner");
    * ```
    */
-  unwrapAll(): Promise<UnwrapResult>;
+  confidentialBalanceOf(owner: Address): Promise<EncryptedValue>;
   /**
-   * Complete an unwrap by fetching the public decryption proof and finalizing.
-   * Call this once the unwrap request has been processed on-chain.
+   * Decrypt the balance of a delegator using delegated decryption credentials.
+   * The connected signer acts as the delegatee who has been granted permission
+   * by the delegator to decrypt their balance.
    *
-   * @param unwrapRequestId - The `unwrapRequestId` from an {@link UnwrapResult}
-   *   (`result.unwrapRequestId`) returned by {@link unwrap} / {@link unwrapAll},
-   *   or one decoded from an `UnwrapRequested` event (e.g. when finalizing
-   *   across sessions).
-   * @returns The transaction hash and mined receipt.
+   * Clear values are cached in storage keyed by `(account, token, encryptedValue)`.
+   * Because every on-chain balance change produces a new encrypted value,
+   * stale cache entries are never served. Cache write failures are silently
+   * ignored — they do not affect the returned value.
    *
-   * @example
-   * ```ts
-   * const { unwrapRequestId } = await wrappedToken.unwrap(500n);
-   * await wrappedToken.finalizeUnwrap(unwrapRequestId);
-   * ```
-   */
-  finalizeUnwrap(unwrapRequestId: EncryptedValue): Promise<TransactionResult>;
-}
-//#endregion
-//#region src/wrappers-registry.d.ts
-/**
- * Default wrappers registry addresses for known chains.
- * Only includes chains where a registry is deployed (excludes Hardhat).
- *
- * @deprecated Read `registryAddress` from the chain presets instead (e.g.
- * `sepolia.registryAddress`). Will be removed in the next major version.
- */
-declare const DefaultRegistryAddresses: Record<number, Address>;
-/** Configuration for {@link WrappersRegistry}. */
-interface WrappersRegistryConfig {
-  /** Read-only chain provider used for every registry lookup. */
-  provider: GenericProvider;
-  /**
-   * Per-chain registry address overrides, merged on top of
-   * {@link DefaultRegistryAddresses}. Use this to supply a registry
-   * address for custom or local chains (e.g. Hardhat).
+   * @param delegatorAddress - The address of the account that delegated decryption rights.
+   * @param accountAddress - The account whose on-chain balance to read. Defaults
+   *   to the delegator address.
+   * @returns The decrypted plaintext balance as a bigint.
+   * @throws if no active delegation exists. {@link DelegationNotFoundError}
+   * @throws if the delegation has expired. {@link DelegationExpiredError}
+   * @throws if delegated decryption fails. {@link DecryptionFailedError}
    *
    * @example
    * ```ts
-   * new WrappersRegistry({
-   *   provider,
-   *   registryAddresses: { [31337]: "0xYourHardhatRegistry" },
+   * const balance = await token.decryptBalanceAs({
+   *   delegatorAddress: "0xDelegator",
    * });
    * ```
    */
-  registryAddresses?: Record<number, Address>;
-  /**
-   * How long cached registry results remain valid, in seconds.
-   * Default: `86400` (24 hours).
-   */
-  registryTTL?: number;
-}
-/** Options for {@link WrappersRegistry.listPairs}. */
-interface ListPairsOptions {
-  /** Page number (1-indexed). Default: `1`. */
-  page?: number;
-  /** Number of items per page. Default: `100`. */
-  pageSize?: number;
-  /**
-   * When `true`, fetches on-chain metadata (name, symbol, decimals) for both
-   * the ERC-20 and confidential token, plus totalSupply for the ERC-20.
-   * Default: `false`.
-   */
-  metadata?: boolean;
-}
-/**
- * High-level interface for the on-chain token wrappers registry.
- *
- * Uses the configured {@link GenericProvider} to resolve the correct registry
- * contract address for the current chain and exposes typed read helpers for
- * every registry query. Results are cached in memory with a configurable TTL
- * (default 24 hours).
- *
- * @example
- * ```ts
- * const registry = new WrappersRegistry({ provider });
- *
- * // Paginated listing
- * const page1 = await registry.listPairs({ page: 1, pageSize: 20 });
- *
- * // Structured lookups
- * const result = await registry.getConfidentialToken(erc20Address);
- * if (result) console.log(result.confidentialTokenAddress);
- *
- * // Force refresh
- * registry.refresh();
- * ```
- */
-declare class WrappersRegistry {
-  #private;
-  /** Read-only chain access used for registry contract reads. */
-  readonly provider: GenericProvider;
-  constructor(config: WrappersRegistryConfig);
-  /**
-   * Synchronous lookup of the registry address for a given chain ID.
-   * Returns `undefined` if no address is configured for that chain.
-   */
-  getAddress(chainId: number): Address | undefined;
-  /**
-   * Force-invalidate the in-memory cache. The next call to any read method
-   * will fetch fresh data from the chain.
-   */
-  refresh(): void;
-  /**
-   * The cache TTL in milliseconds.
-   * Exposed so query option factories can set a matching `staleTime`.
-   */
-  get ttlMs(): number;
+  decryptBalanceAs({ delegatorAddress, accountAddress }: {
+    delegatorAddress: Address;
+    accountAddress?: Address;
+  }): Promise<bigint>;
   /**
-   * Resolve the registry contract address for the current chain.
+   * Decrypt confidential balances for multiple tokens in parallel, returning
+   * successes and per-token errors separately. Pre-authorizes all token
+   * addresses in a single wallet signature, then delegates each decrypt to
+   * `sdk.decryption.decryptValues`.
    *
-   * Priority: `registryAddresses[chainId]` \> built-in default.
+   * Tokens that fail to decrypt land in `errors`; the batch keeps going.
+   *
+   * @param tokens - Array of {@link Token} instances bound to the same SDK.
+   * @param owner - Balance owner address.
+   * @returns `{ results, errors }` partitioning the per-token outcomes.
+   * @throws A failure that affects the whole session (rejected signature,
+   * misconfiguration, RPC rate limit, key unwrapping failure, revoked KMS
+   * context) rejects the call instead of landing in `errors`.
    *
-   * @returns The registry contract address for the connected chain.
-   * @throws if no address is configured for the chain. {@link ConfigurationError}
+   * @example
+   * ```ts
+   * const { results, errors } = await Token.batchBalancesOf(tokens, owner);
+   * ```
    */
-  getRegistryAddress(): Promise<Address>;
+  static batchBalancesOf(tokens: Token[], owner: Address): Promise<BatchBalancesResult>;
   /**
-   * List token wrapper pairs with page-based pagination.
+   * Batch decrypt confidential balances as a delegate across multiple tokens.
+   * Mirrors {@link batchBalancesOf} but uses delegated credentials.
    *
-   * Internally maps to `getTokenConfidentialTokenPairsSlice` on-chain.
+   * **Error handling:** If a per-token decryption fails and no `onError` callback
+   * is provided, errors are collected and thrown as an aggregated
+   * `DecryptionFailedError`. When the relayer returns no value for an encrypted value,
+   * a `DecryptionFailedError` is thrown for that token (never silently returns `0n`).
+   * Pass `onError: () => 0n` to opt into the silent zero behavior.
    *
-   * @param options - Pagination and enrichment options.
-   * @returns A {@link PaginatedResult} of pairs.
+   * @param tokens - Array of Token instances to decrypt balances for.
+   * @param options - Delegated decryption configuration.
+   * @returns A Map from token address to decrypted balance.
+   * @throws if no active delegation exists. {@link DelegationNotFoundError}
+   * @throws if the delegation has expired. {@link DelegationExpiredError}
+   * @throws if any decryption fails and no `onError` is provided. {@link DecryptionFailedError}
+   * @throws A failure that affects the whole session (rejected signature, RPC
+   * rate limit, revoked KMS context) rejects the call even when `onError` is
+   * provided.
    *
    * @example
    * ```ts
-   * const result = await registry.listPairs({ page: 1, pageSize: 20 });
-   * console.log(`${result.total} pairs, showing page ${result.page}`);
-   *
-   * // With on-chain metadata
-   * const withMeta = await registry.listPairs({ metadata: true, pageSize: 10 });
-   * for (const pair of withMeta.items) {
-   *   console.log(pair.underlying.symbol, "→", pair.confidential.symbol);
-   * }
+   * const balances = await Token.batchDecryptBalancesAs(tokens, {
+   *   delegatorAddress: "0xDelegator",
+   *   onError: (err, addr) => { console.error(addr, err); return 0n; },
+   * });
    * ```
    */
-  listPairs(options: ListPairsOptions & {
-    metadata: true;
-  }): Promise<PaginatedResult<TokenWrapperPairWithMetadata>>;
-  /** Lists registered underlying/confidential token pairs; pass `{ metadata: true }` to include on-chain token metadata. */
-  listPairs(options?: ListPairsOptions): Promise<PaginatedResult<TokenWrapperPair>>;
+  static batchDecryptBalancesAs(tokens: Token[], options: BatchDecryptAsOptions): Promise<Map<Address, bigint>>;
+  private static readBalanceHandlesBatch;
   /**
-   * Look up the confidential token for a given plain ERC-20 address.
+   * Confidential transfer. Encrypts the amount via FHE, then calls the contract.
    *
-   * @param tokenAddress - The plain ERC-20 token address.
-   * @returns The lookup result, or `null` if the token has never been registered.
-   *   **Note:** revoked tokens (registered then invalidated) return a non-null result
-   *   with `isValid: false`. Check `result.isValid` explicitly rather than using
-   *   `if (result)` to guard against processing revoked tokens.
+   * By default, the SDK validates the confidential balance before submitting.
+   * If a cached plaintext balance exists it is used; otherwise, if credentials
+   * are cached, it decrypts on the fly. Set `skipBalanceCheck: true` to bypass
+   * this validation (e.g. for smart wallets).
+   *
+   * @param to - Recipient address.
+   * @param amount - Plaintext amount to transfer (encrypted automatically via FHE).
+   * @param options - Optional: `skipBalanceCheck` (default `false`).
+   * @returns The transaction hash and mined receipt.
+   * @throws if signer and provider are on different chains. {@link ChainMismatchError}
+   * @throws if the balance is less than `amount`. {@link InsufficientConfidentialBalanceError}
+   * @throws if balance validation requires decryption that is not possible. {@link BalanceCheckUnavailableError}
+   * @throws if FHE encryption fails. {@link EncryptionFailedError}
+   * @throws if the on-chain transfer reverts. {@link TransactionRevertedError}
    *
    * @example
    * ```ts
-   * const result = await registry.getConfidentialToken(usdcAddress);
-   * if (result?.isValid) {
-   *   console.log(result.confidentialTokenAddress);
-   * }
+   * const txHash = await token.confidentialTransfer("0xRecipient", 1000n);
    * ```
    */
-  getConfidentialToken(tokenAddress: Address): Promise<{
-    confidentialTokenAddress: Address;
-    isValid: boolean;
-  } | null>;
+  confidentialTransfer(to: Address, amount: bigint, options?: TransferOptions): Promise<TransactionResult>;
   /**
-   * Reverse lookup — find the plain ERC-20 for a given confidential token.
+   * Operator encrypted transfer on behalf of another address.
+   * The caller must be an approved operator for `from`.
    *
-   * @param confidentialTokenAddress - The confidential token address.
-   * @returns The lookup result, or `null` if no pair is registered.
+   * @param from - The address to transfer from (caller must be an approved operator).
+   * @param to - Recipient address.
+   * @param amount - Plaintext amount to transfer (encrypted automatically via FHE).
+   * @returns The transaction hash and mined receipt.
    *
    * @example
    * ```ts
-   * const result = await registry.getUnderlyingToken(cUsdcAddress);
-   * if (result) {
-   *   console.log(result.tokenAddress, result.isValid);
-   * }
+   * const txHash = await token.confidentialTransferFrom("0xFrom", "0xTo", 500n);
    * ```
    */
-  getUnderlyingToken(confidentialTokenAddress: Address): Promise<{
-    tokenAddress: Address;
-    isValid: boolean;
-  } | null>;
+  confidentialTransferFrom(from: Address, to: Address, amount: bigint, callbacks?: TransferCallbacks): Promise<TransactionResult>;
   /**
-   * Fetch all token wrapper pairs from the registry.
+   * ERC-7984 `confidentialTransferAndCall`: encrypted transfer that also invokes
+   * the recipient's receiver hook (`onConfidentialTransferReceived`) in a single
+   * transaction. The caller crafts the opaque `data` payload — the SDK does not
+   * encode, validate, or interpret it.
    *
-   * @returns All registered `TokenWrapperPair` entries.
-   */
-  getTokenPairs(): Promise<readonly TokenWrapperPair[]>;
-  /**
-   * Get the total number of token wrapper pairs.
+   * Balance validation follows the same rules as {@link Token.confidentialTransfer}.
    *
-   * @returns The count as a bigint.
-   */
-  getTokenPairsLength(): Promise<bigint>;
-  /**
-   * Fetch a range of token wrapper pairs (paginated by index).
+   * @param to - Recipient address. Must implement the ERC-7984 receiver hook.
+   * @param amount - Plaintext amount to transfer (encrypted automatically via FHE).
+   * @param data - Opaque bytes forwarded to the recipient's receiver hook.
+   * @param options - Optional: `skipBalanceCheck` (default `false`).
+   * @returns The transaction hash and mined receipt.
    *
-   * @param fromIndex - Start index (inclusive).
-   * @param toIndex - End index (exclusive).
-   * @returns The slice of `TokenWrapperPair` entries.
-   */
-  getTokenPairsSlice(fromIndex: bigint, toIndex: bigint): Promise<readonly TokenWrapperPair[]>;
-  /**
-   * Fetch a single token wrapper pair by index.
+   * @throws if signer and provider are on different chains. {@link ChainMismatchError}
+   * @throws if the balance is less than `amount`. {@link InsufficientConfidentialBalanceError}
+   * @throws if balance validation requires decryption that is not possible. {@link BalanceCheckUnavailableError}
+   * @throws if FHE encryption fails. {@link EncryptionFailedError}
+   * @throws if the on-chain transfer reverts. {@link TransactionRevertedError}
    *
-   * @param index - Zero-based pair index.
-   * @returns The `TokenWrapperPair` at that index.
+   * @example
+   * ```ts
+   * const txHash = await token.confidentialTransferAndCall(
+   *   "0xRecipient",
+   *   1000n,
+   *   "0xabcd", // caller-encoded payload forwarded to the receiver hook
+   * );
+   * ```
    */
-  getTokenPair(index: bigint): Promise<TokenWrapperPair>;
+  confidentialTransferAndCall(to: Address, amount: bigint, data: Hex, options?: TransferOptions): Promise<TransactionResult>;
   /**
-   * Look up the confidential token address for a given plain ERC-20 token.
+   * ERC-7984 `confidentialTransferFromAndCall`: operator-initiated encrypted
+   * transfer that also invokes the recipient's receiver hook in a single
+   * transaction. The caller must be an approved operator for `from` and crafts
+   * the opaque `data` payload — the SDK does not encode or interpret it.
    *
-   * @param tokenAddress - The plain ERC-20 token address.
-   * @returns A tuple `[isValid, confidentialTokenAddress]`. `isValid` is `true` only for a
-   *   registered, non-revoked wrapper. The address is the zero address when no pair is registered.
-   *   A non-zero address with `isValid=false` means the wrapper was registered but later revoked.
+   * @param from - The address to transfer from (caller must be an approved operator).
+   * @param to - Recipient address. Must implement the ERC-7984 receiver hook.
+   * @param amount - Plaintext amount to transfer (encrypted automatically via FHE).
+   * @param data - Opaque bytes forwarded to the recipient's receiver hook.
+   * @param callbacks - Optional progress callbacks.
+   * @returns The transaction hash and mined receipt.
+   *
+   * @example
+   * ```ts
+   * const txHash = await token.confidentialTransferFromAndCall(
+   *   "0xFrom",
+   *   "0xRecipient",
+   *   500n,
+   *   "0xabcd",
+   * );
+   * ```
    */
-  getConfidentialTokenAddress(tokenAddress: Address): Promise<readonly [boolean, Address]>;
+  confidentialTransferFromAndCall(from: Address, to: Address, amount: bigint, data: Hex, callbacks?: TransferCallbacks): Promise<TransactionResult>;
   /**
-   * Reverse lookup — find the plain ERC-20 for a given confidential token.
+   * Set operator approval for the confidential token.
+   * Defaults to 1 hour from now if `until` is not specified.
    *
-   * @param confidentialTokenAddress - The confidential token address.
-   * @returns A tuple `[isValid, tokenAddress]`. `isValid` is `true` only for a registered,
-   *   non-revoked wrapper. The address is the zero address when no pair is registered.
-   *   A non-zero address with `isValid=false` means the wrapper was registered but later revoked.
+   * @param operator - The address to set as an operator.
+   * @param until - Optional Unix timestamp for approval expiry. Defaults to now + 1 hour.
+   * @returns The transaction hash and mined receipt.
+   *
+   * @example
+   * ```ts
+   * const txHash = await token.setOperator("0xOperator");
+   * ```
    */
-  getTokenAddress(confidentialTokenAddress: Address): Promise<readonly [boolean, Address]>;
+  setOperator(operator: Address, until?: number): Promise<TransactionResult>;
   /**
-   * Check whether a confidential token is registered and valid.
+   * Check if a spender is an approved operator for a given holder.
    *
-   * @param confidentialTokenAddress - The confidential token address to check.
-   * @returns `true` if the token is a known valid wrapper in the registry.
+   * @param holder - The token holder address.
+   * @param spender - The address to check operator approval for.
+   * @returns `true` if the spender is an approved operator for the holder.
+   *
+   * @example
+   * ```ts
+   * if (await token.isOperator("0xHolder", "0xSpender")) {
+   *   // spender can call transferFrom on behalf of holder
+   * }
+   * ```
    */
-  isConfidentialTokenValid(confidentialTokenAddress: Address): Promise<boolean>;
+  isOperator(holder: Address, spender: Address): Promise<boolean>;
+  /** Verify all tokens share the same SDK instance and return it. */
+  private static assertSameSdk;
 }
 //#endregion
-//#region src/zama-sdk.d.ts
-/** Instance-level options that are deliberately not part of the shareable config object. */
-interface ZamaSDKOptions {
-  /**
-   * Encrypts the transport key pair's private half at rest. Headless environments only
-   * (CLI tools, servers, agents); the constructor rejects it in browser contexts. Supply
-   * at least 32 random bytes, or a string of at least 64 characters, from a CSPRNG or
-   * secrets manager. The SDK copies a Uint8Array secret and zeroizes its own copy after
-   * key import; it never touches your buffer, so zeroize yours after construction.
-   * The SDK never persists or exposes this value. Omit for the default:
-   * plaintext at rest, security delegated to the storage backend.
-   */
-  transportKeyPairDerivationSecret?: string | Uint8Array;
-}
+//#region src/token/wrapped-token.d.ts
 /**
- * ZamaSDK — composes a RelayerSDK with contract abstraction.
+ * Confidential ERC-20 wrapper (ERC-7984 ERC20Wrapper).
  *
- * Exposes domain namespaces for permits, delegations, decryption, offline
- * signing, and tokens, plus an unchanged registry, a top-level `encrypt`, and
- * lifecycle methods. Internal `*Service` classes do the work; the namespace
- * classes own SDK-level guards (chain alignment, signer requirement, event
- * emission).
+ * Extends {@link Token} with wrapper-specific operations:
+ * - `shield` / `unshield` — convert between the underlying ERC-20 and confidential balance
+ * - `unwrap` / `unwrapAll` / `finalizeUnwrap` — low-level two-phase primitives
+ * - `underlying` / `allowance` — wrapper reads
+ *
+ * `WrappedToken.address` is the wrapper contract address itself — the wrapper
+ * IS the confidential token.
  */
-declare class ZamaSDK {
+declare class WrappedToken extends Token {
   #private;
-  /** Read-only chain access used for all contract reads. */
-  readonly provider: GenericProvider;
-  /** Wallet signer used for write operations, or `undefined` when the SDK is read-only. */
-  readonly signer: GenericSigner | undefined;
-  /** Storage for cached permits and transport key pairs. */
-  readonly storage: GenericStorage;
   /**
-   * A {@link WrappersRegistry} instance auto-configured for the current chain.
-   * Uses built-in defaults from chain configs, and the SDK's `registryTTL` if configured.
+   * Read the underlying ERC-20 token address from the wrapper contract.
+   *
+   * @returns The underlying ERC-20 token address.
+   */
+  underlying(): Promise<Address>;
+  /**
+   * Check whether the underlying ERC-20 supports ERC-1363 (payable token).
+   * Result is cached per WrappedToken instance (negative results included):
+   * once we know an underlying does not support ERC-1363, subsequent shields
+   * go straight to the `approve` + `wrap` path without re-probing.
+   */
+  isPayable(): Promise<boolean>;
+  /**
+   * Read the ERC-20 allowance granted by `owner` to this wrapper for the
+   * underlying token.
+   *
+   * @param owner - The owner address whose allowance to read.
+   * @returns The current allowance as a bigint.
    */
-  readonly registry: WrappersRegistry;
-  /** Permit and keypair management. */
-  readonly permits: Permits;
-  /** On-chain decryption-delegation management. */
-  readonly delegations: Delegations;
-  /** FHE decryption (user, delegated user, public). */
-  readonly decryption: Decryption;
-  /** Offline-signing pipeline: `prepare` builds an unsigned tx the caller signs and broadcasts out-of-process — for HSM, policy-engine, and cross-process custody workflows. */
-  readonly offline: Offline;
-  constructor(config: ZamaConfig, options?: ZamaSDKOptions);
+  allowance(owner: Address): Promise<bigint>;
   /**
-   * The single-chain relayer backend for the **currently active** chain.
+   * Shield public ERC-20 tokens into confidential tokens.
+   *
+   * The execution path is decided automatically by ERC-165 introspection on
+   * the underlying ERC-20:
+   * - **`transferAndCall`** (single tx): when the underlying supports
+   *   ERC-1363, no approval is required — the wrapper's `onTransferReceived`
+   *   callback mints confidential tokens directly. `approvalStrategy` is
+   *   **ignored** on this path. See {@link ShieldPath}.
+   * - **`approveAndWrap`** (two-tx fallback): otherwise, an `approve` is
+   *   followed by a `wrap`. Approval is controlled by `approvalStrategy`
+   *   (`"exact"` by default, `"max"` for unlimited, `"skip"` to opt out).
+   *
+   * The ERC-20 balance is validated before submitting (public read, no
+   * signing required) so the call works for all wallet types, including
+   * smart wallets.
+   *
+   * @param amount - The plaintext amount to shield.
+   * @param options - Optional: `approvalStrategy`, `to`, callbacks.
+   * @returns The transaction hash and mined receipt.
+   * @throws if signer and provider are on different chains. {@link ChainMismatchError}
+   * @throws if the ERC-20 balance is less than `amount`. {@link InsufficientERC20BalanceError}
+   * @throws if the ERC-20 approval or shield transaction reverts. {@link TransactionRevertedError}
+   *
+   * @example
+   * ```ts
+   * const txHash = await wrappedToken.shield(1000n);
+   * ```
    */
-  get relayer(): RelayerSDK;
+  shield(amount: bigint, options?: ShieldOptions): Promise<TransactionResult>;
   /**
-   * Create a {@link WrappersRegistry} instance bound to this SDK's provider.
-   * Inherits the registry addresses derived from the SDK's chain configs, so
-   * the result is consistent with {@link ZamaSDK.registry}.
+   * Wrap already-approved underlying ERC-20 into confidential tokens.
    *
-   * @param registryAddresses - Optional per-chain overrides for this registry instance.
-   * @returns A {@link WrappersRegistry} instance.
+   * Escape hatch for splitting shield across two signatures: call
+   * {@link approveUnderlying} first, then `wrap`. Most callers should use
+   * {@link shield}, which routes and orchestrates approval automatically.
+   *
+   * Validates the ERC-20 balance and the allowance granted to this wrapper
+   * (public reads, no signing) and fails early with a clear error.
+   *
+   * @param amount - The plaintext amount to wrap.
+   * @param options - Optional `to` recipient and `onWrapSubmitted` callback.
+   * @returns The transaction hash and mined receipt.
+   * @throws if reading the ERC-20 balance or allowance fails. {@link ERC20ReadFailedError}
+   * @throws if the ERC-20 balance is less than `amount`. {@link InsufficientERC20BalanceError}
+   * @throws if the allowance granted to the wrapper is less than `amount`. {@link InsufficientAllowanceError}
    *
    * @example
    * ```ts
-   * // Addresses resolved from the SDK's chain configs
-   * const registry = sdk.createWrappersRegistry();
+   * await wrappedToken.approveUnderlying(1000n);
+   * await wrappedToken.wrap(1000n);
+   * ```
+   */
+  wrap(amount: bigint, options?: WrapOptions): Promise<TransactionResult>;
+  /**
+   * Approve this wrapper contract to spend the underlying ERC-20.
+   * Defaults to max uint256. Resets to zero first if there's an existing
+   * non-zero allowance (required by tokens like USDT).
    *
-   * // Hardhat or custom chain — override per chain for this registry instance
-   * const registry = sdk.createWrappersRegistry({ [31337]: "0xYourRegistry" });
+   * @param amount - Optional approval amount. Defaults to max uint256.
+   * @returns The transaction hash and mined receipt.
    *
-   * const pairs = await registry.getTokenPairs();
+   * @example
+   * ```ts
+   * await wrappedToken.approveUnderlying(); // max approval
+   * await wrappedToken.approveUnderlying(1000n); // exact amount
    * ```
    */
-  createWrappersRegistry(registryAddresses?: Record<number, Address>): WrappersRegistry;
+  approveUnderlying(amount?: bigint): Promise<TransactionResult>;
   /**
-   * Encrypt one or more plaintext values into FHE ciphertexts.
+   * Unshield a specific amount and finalize in one call.
+   * Orchestrates: unshield → wait for receipt → parse event → finalize.
    *
-   * @param params - Typed FHE inputs, the target contract address, and the user address.
-   * @returns External encrypted values and the input proof for on-chain submission.
-   * @throws if FHE encryption fails. {@link EncryptionFailedError}
+   * By default, the SDK validates the confidential balance before submitting.
+   * Set `skipBalanceCheck: true` to bypass this validation (e.g. for smart wallets).
+   *
+   * @param amount - The plaintext amount to unshield.
+   * @param options - Optional: `skipBalanceCheck` (default `false`), callbacks.
+   * @returns The finalize transaction hash and mined receipt.
    *
    * @example
    * ```ts
-   * const { encryptedValues, inputProof } = await sdk.encrypt({
-   *   values: [{ value: 1000n, type: "euint64" }],
-   *   contractAddress: "0xToken",
-   *   userAddress: "0xUser",
-   * });
+   * const txHash = await wrappedToken.unshield(500n);
    * ```
    */
-  encrypt(params: EncryptParams, options?: Pick<FhevmRelayerOptions, "signal" | "timeout">): Promise<EncryptResult>;
+  unshield(amount: bigint, options?: UnshieldOptions): Promise<TransactionResult>;
   /**
-   * Create a high-level ERC-20-style interface for an ERC-7984 confidential token.
-   * Supports balance queries, transfers, operator approvals, and decryption.
+   * Unshield the entire balance and finalize in one call.
+   * Orchestrates: unshieldAll → wait for receipt → parse event → finalize.
    *
-   * For ERC-7984 wrappers (shield/unshield/allowance), use {@link createWrappedToken} instead.
+   * @param callbacks - Optional progress callbacks for each phase.
+   * @returns The finalize transaction hash and mined receipt.
+   * @throws if the balance is zero. {@link DecryptionFailedError}
    *
-   * @param address - The confidential token contract address.
-   * @returns A {@link Token} instance bound to this SDK.
+   * @example
+   * ```ts
+   * const txHash = await wrappedToken.unshieldAll();
+   * ```
+   */
+  unshieldAll(callbacks?: UnshieldCallbacks): Promise<TransactionResult>;
+  /**
+   * Resume an in-progress unshield from an existing unwrap tx hash.
+   * Useful when the user already submitted the unwrap but the finalize step
+   * was interrupted (e.g. page reload, network error).
+   *
+   * @param unwrapTxHash - The transaction hash of the previously submitted unwrap.
+   * @param callbacks - Optional progress callbacks.
+   * @returns The finalize transaction hash and mined receipt.
+   * @throws if the unwrap request was already finalized on-chain; the persisted
+   *   pending-unshield state is cleared first. {@link UnshieldAlreadyFinalizedError}
    *
    * @example
    * ```ts
-   * const token = sdk.createToken(cUSDT);
-   * const balance = await token.balanceOf(userAddress);
+   * const txHash = await wrappedToken.resumeUnshield(previousUnwrapTxHash);
    * ```
    */
-  createToken(address: Address): Token;
+  resumeUnshield(unwrapTxHash: Hex, callbacks?: UnshieldCallbacks): Promise<TransactionResult>;
   /**
-   * Create a high-level interface for an ERC-7984 wrapper token.
-   * Extends {@link Token} with shield/unshield/allowance/finalize-unwrap operations.
+   * Return the unwrap tx hash of an unshield that was interrupted between its
+   * two phases, or `null` if none is pending for this wrapper.
    *
-   * @param address - The wrapper token contract address.
-   * @returns A {@link WrappedToken} instance bound to this SDK.
+   * The SDK persists this automatically when {@link unshield}/{@link unshieldAll}
+   * submit phase 1, and clears it once phase 2 finalizes. Use the returned hash
+   * to surface a "resume" affordance, then pass it to {@link resumeUnshield}.
+   * Resuming is intentionally caller-driven — auto-resuming on load would fire a
+   * wallet transaction unprompted.
+   *
+   * The pointer is verified on-chain before it is reported: if the unwrap
+   * request was already finalized (e.g. the tab closed before the SDK could
+   * clear storage), the stale pointer is cleared and `null` is returned. When
+   * the verification read fails, the pointer is returned unverified: a
+   * network error never deletes recovery state.
+   *
+   * @returns The pending unwrap tx hash, or `null`.
    *
    * @example
    * ```ts
-   * const wrapped = sdk.createWrappedToken(wUSDT);
-   * await wrapped.shield(1_000_000n);
+   * const unwrapTxHash = await wrappedToken.getPendingUnshield();
+   * if (unwrapTxHash) await wrappedToken.resumeUnshield(unwrapTxHash);
    * ```
    */
-  createWrappedToken(address: Address): WrappedToken;
+  getPendingUnshield(): Promise<Hex | null>;
   /**
-   * Release the SDK-owned resources: signer lifecycle subscriptions and the
-   * relayer backend's resources, an encrypt worker included. Call this when the
-   * SDK instance is being replaced (e.g. React provider unmount or a Strict Mode
-   * remount). Work already in flight runs to completion, and the instance stays
-   * usable: the next encryption spawns a fresh worker.
+   * Request an unwrap for a specific amount. Encrypts the amount first.
+   * Pass the result's `unwrapRequestId` to {@link finalizeUnwrap} once the
+   * request is processed on-chain.
+   *
+   * @param amount - The plaintext amount to unwrap (encrypted automatically).
+   * @returns The tx hash, mined receipt, and the `unwrapRequestId` for `finalizeUnwrap`.
+   *
+   * @example
+   * ```ts
+   * const result = await wrappedToken.unwrap(500n);
+   * await wrappedToken.finalizeUnwrap(result.unwrapRequestId);
+   * ```
    */
-  dispose(): void;
+  unwrap(amount: bigint): Promise<UnwrapResult>;
   /**
-   * {@link dispose} plus the signer's own disposal. Call this when the SDK is no
-   * longer needed (e.g. on shutdown). Work already in flight runs to completion.
+   * Request an unwrap for the entire confidential balance.
+   * Uses the on-chain encrypted balance directly (no encryption needed).
+   * Throws if the balance is zero.
+   *
+   * @returns The tx hash, mined receipt, and the `unwrapRequestId` for `finalizeUnwrap`.
+   * @throws if the balance is zero. {@link DecryptionFailedError}
+   *
+   * @example
+   * ```ts
+   * const result = await wrappedToken.unwrapAll();
+   * await wrappedToken.finalizeUnwrap(result.unwrapRequestId);
+   * ```
    */
-  terminate(): void;
+  unwrapAll(): Promise<UnwrapResult>;
   /**
-   * Implements the TC39 Explicit Resource Management protocol.
-   * Calls {@link terminate} when the `using` binding goes out of scope,
-   * unsubscribing signer events and releasing the relayer's resources.
+   * Complete an unwrap by fetching the public decryption proof and finalizing.
+   * Call this once the unwrap request has been processed on-chain.
+   *
+   * @param unwrapRequestId - The `unwrapRequestId` from an {@link UnwrapResult}
+   *   (`result.unwrapRequestId`) returned by {@link unwrap} / {@link unwrapAll},
+   *   or one decoded from an `UnwrapRequested` event (e.g. when finalizing
+   *   across sessions).
+   * @returns The transaction hash and mined receipt.
    *
    * @example
    * ```ts
-   * {
-   *   using sdk = new ZamaSDK({ relayer, provider, signer, storage });
-   *   await sdk.permits.grantPermit([cUSDT]);
-   *   const balance = await sdk.createToken(cUSDT).balanceOf(userAddress);
-   * } // sdk.terminate() called automatically here
+   * const { unwrapRequestId } = await wrappedToken.unwrap(500n);
+   * await wrappedToken.finalizeUnwrap(unwrapRequestId);
    * ```
    */
-  [Symbol.dispose](): void;
+  finalizeUnwrap(unwrapRequestId: EncryptedValue): Promise<TransactionResult>;
+}
+//#endregion
+//#region src/query/confidential-balance.d.ts
+/** Configuration for {@link confidentialBalanceQueryOptions}. */
+interface ConfidentialBalanceQueryConfig {
+  /** Address of the confidential token to read the balance of. */
+  tokenAddress: Address;
+  /** Account whose confidential balance to read; the query stays disabled until provided. */
+  account?: Address;
+  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
+  query?: Record<string, unknown>;
+}
+/** Query options for a single confidential token balance. Auto-gated on `account`. */
+declare function confidentialBalanceQueryOptions(token: Token, config: ConfidentialBalanceQueryConfig, signerContext?: SignerQueryContext): QueryFactoryOptions<bigint, Error, bigint, ReturnType<typeof zamaQueryKeys.confidentialBalance.owner>>;
+//#endregion
+//#region src/query/confidential-balances.d.ts
+/** Configuration for {@link confidentialBalancesQueryOptions}. */
+interface ConfidentialBalancesQueryConfig {
+  /** Account whose confidential balances to read; the query stays disabled until provided. */
+  account?: Address;
+  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
+  query?: Record<string, unknown>;
+}
+/** Builds TanStack Query options for reading the confidential balances of several tokens for one account in a single batch. */
+declare function confidentialBalancesQueryOptions(tokens: Token[], config?: ConfidentialBalancesQueryConfig, signerContext?: SignerQueryContext): QueryFactoryOptions<BatchBalancesResult, Error, BatchBalancesResult, ReturnType<typeof zamaQueryKeys.confidentialBalances.tokens>>;
+//#endregion
+//#region src/query/wrappers-registry.d.ts
+/** Base configuration shared by the wrappers-registry query option factories. */
+interface WrappersRegistryQueryConfig {
+  /** Registry contract address for the current chain; used as a query key discriminator. */
+  registryAddress: Address | undefined;
+  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
+  query?: Record<string, unknown>;
+}
+/** Builds TanStack Query options for reading all token wrapper pairs registered in the wrappers registry. */
+declare function tokenPairsQueryOptions(sdk: ZamaSDK, config: WrappersRegistryQueryConfig): QueryFactoryOptions<readonly TokenWrapperPair[], Error, readonly TokenWrapperPair[], ReturnType<typeof zamaQueryKeys.wrappersRegistry.tokenPairs>>;
+/** Configuration for {@link confidentialTokenAddressQueryOptions}. */
+interface ConfidentialTokenAddressQueryConfig extends WrappersRegistryQueryConfig {
+  /** Underlying ERC-20 token address whose confidential counterpart to look up. */
+  tokenAddress?: Address;
+}
+/** Builds TanStack Query options for reading the confidential token address registered for a given underlying ERC-20 token. */
+declare function confidentialTokenAddressQueryOptions(sdk: ZamaSDK, config: ConfidentialTokenAddressQueryConfig): QueryFactoryOptions<readonly [boolean, Address], Error, readonly [boolean, Address], ReturnType<typeof zamaQueryKeys.wrappersRegistry.confidentialTokenAddress>>;
+/** Configuration for {@link tokenAddressQueryOptions}. */
+interface TokenAddressQueryConfig extends WrappersRegistryQueryConfig {
+  /** Confidential token address whose underlying ERC-20 counterpart to look up. */
+  confidentialTokenAddress?: Address;
+}
+/** Builds TanStack Query options for reading the underlying ERC-20 token address registered for a given confidential token. */
+declare function tokenAddressQueryOptions(sdk: ZamaSDK, config: TokenAddressQueryConfig): QueryFactoryOptions<readonly [boolean, Address], Error, readonly [boolean, Address], ReturnType<typeof zamaQueryKeys.wrappersRegistry.tokenAddress>>;
+/** Builds TanStack Query options for reading the total number of token wrapper pairs in the registry. */
+declare function tokenPairsLengthQueryOptions(sdk: ZamaSDK, config: WrappersRegistryQueryConfig): QueryFactoryOptions<bigint, Error, bigint, ReturnType<typeof zamaQueryKeys.wrappersRegistry.tokenPairsLength>>;
+/** Configuration for {@link tokenPairsSliceQueryOptions}. */
+interface TokenPairsSliceQueryConfig extends WrappersRegistryQueryConfig {
+  /** Zero-based index of the first pair in the slice (inclusive). */
+  fromIndex?: bigint;
+  /** Index bounding the end of the slice. */
+  toIndex?: bigint;
+}
+/** Builds TanStack Query options for reading a contiguous slice of the registry's token wrapper pairs. */
+declare function tokenPairsSliceQueryOptions(sdk: ZamaSDK, config: TokenPairsSliceQueryConfig): QueryFactoryOptions<readonly TokenWrapperPair[], Error, readonly TokenWrapperPair[], ReturnType<typeof zamaQueryKeys.wrappersRegistry.tokenPairsSlice>>;
+/** Configuration for {@link tokenPairQueryOptions}. */
+interface TokenPairQueryConfig extends WrappersRegistryQueryConfig {
+  /** Zero-based index of the token wrapper pair to read. */
+  index?: bigint;
+}
+/** Builds TanStack Query options for reading a single token wrapper pair by its index in the registry. */
+declare function tokenPairQueryOptions(sdk: ZamaSDK, config: TokenPairQueryConfig): QueryFactoryOptions<TokenWrapperPair, Error, TokenWrapperPair, ReturnType<typeof zamaQueryKeys.wrappersRegistry.tokenPair>>;
+/** Configuration for {@link isConfidentialTokenValidQueryOptions}. */
+interface IsConfidentialTokenValidQueryConfig extends WrappersRegistryQueryConfig {
+  /** Confidential token address to validate against the registry. */
+  confidentialTokenAddress?: Address;
+}
+/** Builds TanStack Query options for checking whether a confidential token is registered and valid in the registry. */
+declare function isConfidentialTokenValidQueryOptions(sdk: ZamaSDK, config: IsConfidentialTokenValidQueryConfig): QueryFactoryOptions<boolean, Error, boolean, ReturnType<typeof zamaQueryKeys.wrappersRegistry.isConfidentialTokenValid>>;
+/** Configuration for {@link listPairsQueryOptions}. */
+interface ListPairsQueryConfig {
+  /**
+   * The registry address for this chain — used as a query key discriminator.
+   * The registry instance already knows how to resolve the address for the
+   * current chain; this field just keeps the TanStack Query cache isolated
+   * per registry contract.
+   */
+  registryAddress: Address | undefined;
+  /** 1-based page number to fetch; defaults to `1`. */
+  page?: number;
+  /** Number of pairs per page; defaults to `100`. */
+  pageSize?: number;
+  /** When `true`, resolve each pair's on-chain metadata; defaults to `false`. */
+  metadata?: boolean;
+  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
+  query?: Record<string, unknown>;
+}
+/**
+ * Query options for paginated listing of token wrapper pairs.
+ *
+ * Accepts a {@link WrappersRegistry} instance rather than a raw provider so that the
+ * class-level TTL cache is shared across multiple `queryFn` executions. Pass
+ * `sdk.registry` (the ZamaSDK lazy singleton) to ensure a single shared cache.
+ */
+declare function listPairsQueryOptions(registry: WrappersRegistry, config: ListPairsQueryConfig): QueryFactoryOptions<PaginatedResult<TokenWrapperPair | TokenWrapperPairWithMetadata>, Error, PaginatedResult<TokenWrapperPair | TokenWrapperPairWithMetadata>, ReturnType<typeof zamaQueryKeys.wrappersRegistry.listPairs>>;
+//#endregion
+//#region src/query/shield.d.ts
+/** Variables for {@link shieldMutationOptions}. */
+interface ShieldParams extends ShieldOptions {
+  /** Amount of the public ERC-20 to shield, in the token's base units. */
+  amount: bigint;
+}
+/** Builds TanStack Query mutation options for {@link WrappedToken.shield | shielding} a public ERC-20 into its confidential form. @see {@link ShieldParams} */
+declare function shieldMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.shield", Address], ShieldParams, TransactionResult>;
+//#endregion
+//#region src/query/transfer.d.ts
+/** Variables for {@link confidentialTransferMutationOptions}. */
+interface ConfidentialTransferParams extends TransferOptions {
+  /** Recipient address. */
+  to: Address;
+  /** Amount of tokens to transfer, in the token's base units. */
+  amount: bigint;
+}
+/** Builds TanStack Query mutation options for {@link Token.confidentialTransfer | transferring} confidential tokens. @see {@link ConfidentialTransferParams} */
+declare function confidentialTransferMutationOptions(token: Token): MutationFactoryOptions<readonly ["zama.confidentialTransfer", Address], ConfidentialTransferParams, TransactionResult>;
+//#endregion
+//#region src/query/transfer-and-call.d.ts
+/** Variables for {@link confidentialTransferAndCallMutationOptions}. */
+interface ConfidentialTransferAndCallParams extends TransferOptions {
+  /** Recipient address. */
+  to: Address;
+  /** Amount of tokens to transfer, in the token's base units. */
+  amount: bigint;
+  /** Opaque bytes forwarded to the recipient's ERC-7984 receiver hook. */
+  data: Hex;
+}
+/** Builds TanStack Query mutation options for {@link Token.confidentialTransferAndCall | transferring} confidential tokens and invoking the recipient's receiver hook. @see {@link ConfidentialTransferAndCallParams} */
+declare function confidentialTransferAndCallMutationOptions(token: Token): MutationFactoryOptions<readonly ["zama.confidentialTransferAndCall", Address], ConfidentialTransferAndCallParams, TransactionResult>;
+//#endregion
+//#region src/query/transfer-from.d.ts
+/** Variables for {@link confidentialTransferFromMutationOptions}. */
+interface ConfidentialTransferFromParams {
+  /** Address to transfer from. */
+  from: Address;
+  /** Recipient address. */
+  to: Address;
+  /** Amount of tokens to transfer, in the token's base units. */
+  amount: bigint;
+  /** Optional progress callbacks for the multi-step transfer flow. */
+  callbacks?: TransferCallbacks;
+}
+/** Builds TanStack Query mutation options for {@link Token.confidentialTransferFrom | transferring} confidential tokens from another account (operator flow). @see {@link ConfidentialTransferFromParams} */
+declare function confidentialTransferFromMutationOptions(token: Token): MutationFactoryOptions<readonly ["zama.confidentialTransferFrom", Address], ConfidentialTransferFromParams, TransactionResult>;
+//#endregion
+//#region src/query/transfer-from-and-call.d.ts
+/** Variables for {@link confidentialTransferFromAndCallMutationOptions}. */
+interface ConfidentialTransferFromAndCallParams {
+  /** Address to transfer from. */
+  from: Address;
+  /** Recipient address. */
+  to: Address;
+  /** Amount of tokens to transfer, in the token's base units. */
+  amount: bigint;
+  /** Opaque bytes forwarded to the recipient's ERC-7984 receiver hook. */
+  data: Hex;
+  /** Optional progress callbacks for the multi-step transfer flow. */
+  callbacks?: TransferCallbacks;
+}
+/** Builds TanStack Query mutation options for {@link Token.confidentialTransferFromAndCall | transferring} confidential tokens from another account and invoking the recipient's receiver hook. @see {@link ConfidentialTransferFromAndCallParams} */
+declare function confidentialTransferFromAndCallMutationOptions(token: Token): MutationFactoryOptions<readonly ["zama.confidentialTransferFromAndCall", Address], ConfidentialTransferFromAndCallParams, TransactionResult>;
+//#endregion
+//#region src/query/set-operator.d.ts
+/** Variables for {@link confidentialSetOperatorMutationOptions}. */
+interface ConfidentialSetOperatorParams {
+  /** Operator address to authorize. */
+  operator: Address;
+  /** Unix timestamp (seconds) when the operator authorization expires; defaults to one hour from now. */
+  until?: number;
+}
+/** Builds TanStack Query mutation options for {@link Token.setOperator | authorizing} an operator on a confidential token. @see {@link ConfidentialSetOperatorParams} */
+declare function confidentialSetOperatorMutationOptions(token: Token): MutationFactoryOptions<readonly ["zama.confidentialSetOperator", Address], ConfidentialSetOperatorParams, TransactionResult>;
+//#endregion
+//#region src/query/approve-underlying.d.ts
+/** Variables for {@link approveUnderlyingMutationOptions}. */
+interface ApproveUnderlyingParams {
+  /** Amount of the underlying ERC-20 to approve, in its base units; omit for a max approval. */
+  amount?: bigint;
+}
+/** Builds TanStack Query mutation options for {@link WrappedToken.approveUnderlying | approving} the wrapper to spend the underlying ERC-20. @see {@link ApproveUnderlyingParams} */
+declare function approveUnderlyingMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.approveUnderlying", Address], ApproveUnderlyingParams, TransactionResult>;
+//#endregion
+//#region src/query/unshield.d.ts
+/** Variables for {@link unshieldMutationOptions}. */
+interface UnshieldParams extends UnshieldOptions {
+  /** Amount of tokens to unshield, in the token's base units. */
+  amount: bigint;
+}
+/** Builds TanStack Query mutation options for {@link WrappedToken.unshield | unshielding} a confidential token back into its public ERC-20. @see {@link UnshieldParams} */
+declare function unshieldMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.unshield", Address], UnshieldParams, TransactionResult>;
+//#endregion
+//#region src/query/unshield-all.d.ts
+/** Variables for {@link unshieldAllMutationOptions}. */
+interface UnshieldAllParams extends UnshieldCallbacks {}
+/** Builds TanStack Query mutation options for {@link WrappedToken.unshieldAll | unshielding} the entire confidential balance back into the public ERC-20. @see {@link UnshieldAllParams} */
+declare function unshieldAllMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.unshieldAll", Address], UnshieldAllParams | void, TransactionResult>;
+//#endregion
+//#region src/query/resume-unshield.d.ts
+/** Variables for {@link resumeUnshieldMutationOptions}. */
+interface ResumeUnshieldParams extends UnshieldCallbacks {
+  /** Hash of the earlier unwrap request transaction to resume from. */
+  unwrapTxHash: Hex;
 }
+/** Builds TanStack Query mutation options for {@link WrappedToken.resumeUnshield | resuming} an interrupted unshield from its unwrap request transaction. @see {@link ResumeUnshieldParams} */
+declare function resumeUnshieldMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.resumeUnshield", Address], ResumeUnshieldParams, TransactionResult>;
 //#endregion
-//#region src/query/factory-types.d.ts
-/**
- * TanStack Query options object returned by the SDK's `*QueryOptions` factories:
- * `QueryObserverOptions` with `queryKey` and `queryFn` required and the
- * cache-internal keys (`queryHash`, `queryKeyHashFn`, `throwOnError`) removed.
- */
-type QueryFactoryOptions<TQueryFnData = unknown, TError = Error, TData = TQueryFnData, TQueryKey extends QueryKey = QueryKey> = Omit<Omit<QueryObserverOptions<TQueryFnData, TError, TData, TQueryFnData, TQueryKey>, "queryKey"> & Required<Pick<QueryObserverOptions<TQueryFnData, TError, TData, TQueryFnData, TQueryKey>, "queryKey">>, "queryFn" | "queryHash" | "queryKeyHashFn" | "throwOnError"> & {
-  queryFn: Exclude<QueryObserverOptions<TQueryFnData, TError, TData, TQueryFnData, TQueryKey>["queryFn"], typeof skipToken | undefined>;
+//#region src/query/unwrap.d.ts
+/** Variables for {@link unwrapMutationOptions}. */
+interface UnwrapParams {
+  /** Amount of tokens to unwrap, in the token's base units. */
+  amount: bigint;
+}
+/** Builds TanStack Query mutation options for {@link WrappedToken.unwrap | unwrapping} a confidential token (request phase of the two-phase unwrap). @see {@link UnwrapParams} */
+declare function unwrapMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.unwrap", Address], UnwrapParams, UnwrapResult>;
+//#endregion
+//#region src/query/wrap.d.ts
+/** Variables for {@link wrapMutationOptions}. */
+interface WrapParams extends WrapOptions {
+  /** Amount of the public ERC-20 to wrap, in the token's base units. */
+  amount: bigint;
+}
+/** Builds TanStack Query mutation options for {@link WrappedToken.wrap | wrapping} a public ERC-20 into its confidential form. @see {@link WrapParams} */
+declare function wrapMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.wrap", Address], WrapParams, TransactionResult>;
+//#endregion
+//#region src/query/unwrap-all.d.ts
+/** Builds TanStack Query mutation options for {@link WrappedToken.unwrapAll | unwrapping} the entire confidential balance. */
+declare function unwrapAllMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.unwrapAll", Address], void, UnwrapResult>;
+//#endregion
+//#region src/query/finalize-unwrap.d.ts
+/** Variables for {@link finalizeUnwrapMutationOptions}. */
+type FinalizeUnwrapParams = {
+  /** Identifier from an `UnwrapRequested` event. */
+  unwrapRequestId: EncryptedValue;
 };
-/** TanStack Query mutation options object returned by the SDK's `*MutationOptions` factories. */
-interface MutationFactoryOptions<TMutationKey extends readonly unknown[], TVariables, TData, TOnMutateResult = unknown> {
-  /** Cache key identifying the mutation. */
-  mutationKey: TMutationKey;
-  /** Runs the mutation for the given variables. */
-  mutationFn: (variables: TVariables) => Promise<TData>;
-  /** Optional callback invoked after the mutation succeeds. */
-  onSuccess?: (data: TData, variables: TVariables, onMutateResult: TOnMutateResult, context: MutationFunctionContext) => void;
+/** Builds TanStack Query mutation options for {@link WrappedToken.finalizeUnwrap | finalizing} a previously requested unwrap. @see {@link FinalizeUnwrapParams} */
+declare function finalizeUnwrapMutationOptions(token: WrappedToken): MutationFactoryOptions<readonly ["zama.finalizeUnwrap", Address], FinalizeUnwrapParams, TransactionResult>;
+//#endregion
+//#region src/query/encrypt.d.ts
+/** Builds TanStack Query mutation options for {@link ZamaSDK.encrypt | encrypting} plaintext inputs into an encrypted payload. */
+declare function encryptMutationOptions(sdk: ZamaSDK): MutationFactoryOptions<readonly ["zama.encrypt"], EncryptParams, EncryptResult>;
+//#endregion
+//#region src/query/delegated-decrypt.d.ts
+/** Variables for {@link delegatedDecryptValuesMutationOptions}. */
+interface DelegatedDecryptValuesMutationParams {
+  /** Encrypted values (with their contract addresses) to decrypt. */
+  encryptedInputs: EncryptedInput[];
+  /** Address of the account that delegated decryption rights to the connected wallet. */
+  delegatorAddress: Address;
 }
+/** Builds TanStack Query mutation options for {@link Decryption.delegatedDecryptValues | decrypting} encrypted values via delegated decryption credentials. @see {@link DelegatedDecryptValuesMutationParams} */
+declare function delegatedDecryptValuesMutationOptions(sdk: ZamaSDK): MutationFactoryOptions<readonly ["zama.delegatedDecryptValues"], DelegatedDecryptValuesMutationParams, Readonly<Record<EncryptedValue, ClearValue>>>;
 //#endregion
-//#region src/query/query-keys.d.ts
+//#region src/query/public-decrypt.d.ts
+/** Builds TanStack Query mutation options for {@link Decryption.decryptPublicValues | publicly decrypting} encrypted values, caching each clear result. */
+declare function decryptPublicValuesMutationOptions(sdk: ZamaSDK): MutationFactoryOptions<readonly ["zama.decryptPublicValues"], EncryptedValue[], DecryptPublicValuesResult>;
+//#endregion
+//#region src/query/grant-permit.d.ts
 /**
- * Canonical query-key namespace for `@zama-fhe/sdk/query`.
- *
- * @example
- * ```ts
- * queryClient.invalidateQueries({
- *   queryKey: zamaQueryKeys.confidentialBalance.token("0xToken"),
- * });
- * ```
+ * Builds TanStack Query mutation options for {@link Permits.grantPermit | granting}
+ * decryption permits for the given contract addresses, or {@link WILDCARD_PERMIT}
+ * for a permissive V2 permit covering every contract.
  */
-declare const zamaQueryKeys: {
-  readonly confidentialBalance: {
-    readonly all: readonly ["zama.confidentialBalance"];
-    readonly token: (tokenAddress: Address) => readonly ["zama.confidentialBalance", {
-      readonly tokenAddress: `0x${string}`;
-    }];
-    readonly owner: (tokenAddress: Address, owner?: Address, walletAccount?: WalletAccount) => readonly ["zama.confidentialBalance", {
-      readonly owner?: `0x${string}` | undefined;
-      readonly walletAddress: `0x${string}`;
-      readonly walletChainId: number;
-      readonly tokenAddress: `0x${string}`;
-    } | {
-      readonly owner?: `0x${string}` | undefined;
-      readonly walletAddress?: undefined;
-      readonly walletChainId?: undefined;
-      readonly tokenAddress: `0x${string}`;
-    }];
-  };
-  readonly confidentialBalances: {
-    readonly all: readonly ["zama.confidentialBalances"];
-    readonly tokens: (tokenAddresses: Address[], owner?: Address, walletAccount?: WalletAccount) => readonly ["zama.confidentialBalances", {
-      readonly owner?: `0x${string}` | undefined;
-      readonly walletAddress: `0x${string}`;
-      readonly walletChainId: number;
-      readonly tokenAddresses: `0x${string}`[];
-    } | {
-      readonly owner?: `0x${string}` | undefined;
-      readonly walletAddress?: undefined;
-      readonly walletChainId?: undefined;
-      readonly tokenAddresses: `0x${string}`[];
-    }];
-  };
-  readonly tokenMetadata: {
-    readonly all: readonly ["zama.tokenMetadata"];
-    readonly token: (tokenAddress: Address) => readonly ["zama.tokenMetadata", {
-      readonly tokenAddress: `0x${string}`;
-    }];
-  };
-  readonly isConfidential: {
-    readonly all: readonly ["zama.isConfidential"];
-    readonly token: (tokenAddress: Address) => readonly ["zama.isConfidential", {
-      readonly tokenAddress: `0x${string}`;
-    }];
-  };
-  readonly isWrapper: {
-    readonly all: readonly ["zama.isWrapper"];
-    readonly token: (tokenAddress: Address) => readonly ["zama.isWrapper", {
-      readonly tokenAddress: `0x${string}`;
-    }];
-  };
-  readonly wrapperDiscovery: {
-    readonly all: readonly ["zama.wrapperDiscovery"];
-    readonly token: (tokenAddress?: Address, erc20Address?: Address, registryAddress?: Address) => readonly ["zama.wrapperDiscovery", {
-      readonly registryAddress?: `0x${string}` | undefined;
-      readonly erc20Address?: `0x${string}` | undefined;
-      readonly tokenAddress?: `0x${string}` | undefined;
-    }];
-  };
-  readonly underlyingAllowance: {
-    readonly all: readonly ["zama.underlyingAllowance"];
-    readonly token: (tokenAddress: Address) => readonly ["zama.underlyingAllowance", {
-      readonly tokenAddress: `0x${string}`;
-    }];
-    readonly scope: (tokenAddress: Address, owner?: Address) => readonly ["zama.underlyingAllowance", {
-      readonly owner?: `0x${string}` | undefined;
-      readonly tokenAddress: `0x${string}`;
-    }];
-  };
-  readonly confidentialIsOperator: {
-    readonly all: readonly ["zama.confidentialIsOperator"];
-    readonly token: (tokenAddress?: Address) => readonly ["zama.confidentialIsOperator", {
-      tokenAddress: `0x${string}`;
-    } | {
-      tokenAddress?: undefined;
-    }];
-    readonly scope: (tokenAddress?: Address, holder?: Address, spender?: Address) => readonly ["zama.confidentialIsOperator", {
-      readonly spender?: `0x${string}` | undefined;
-      readonly holder?: `0x${string}` | undefined;
-      readonly tokenAddress?: `0x${string}` | undefined;
-    }];
-  };
-  readonly totalSupply: {
-    readonly all: readonly ["zama.totalSupply"];
-    readonly token: (tokenAddress: Address) => readonly ["zama.totalSupply", {
-      readonly tokenAddress: `0x${string}`;
-    }];
-  };
-  readonly pendingUnshield: {
-    readonly all: readonly ["zama.pendingUnshield"];
-    readonly token: (tokenAddress: Address) => readonly ["zama.pendingUnshield", {
-      readonly tokenAddress: `0x${string}`;
-    }];
-  };
-  readonly hasPermit: {
-    readonly all: readonly ["zama.hasPermit"];
-    readonly scope: (contractAddresses: Address[], walletAccount?: WalletAccount) => readonly ["zama.hasPermit", {
-      readonly contractAddresses: `0x${string}`[];
-      readonly walletAddress: `0x${string}`;
-      readonly walletChainId: number;
-    } | {
-      readonly contractAddresses: `0x${string}`[];
-      readonly walletAddress?: undefined;
-      readonly walletChainId?: undefined;
-    }];
-  };
-  readonly delegationStatus: {
-    readonly all: readonly ["zama.delegationStatus"];
-    readonly contract: (contractAddress?: Address) => readonly ["zama.delegationStatus", {
-      contractAddress: `0x${string}`;
-    } | {
-      contractAddress?: undefined;
-    }];
-    readonly scope: (contractAddress?: Address, delegator?: Address, delegate?: Address) => readonly ["zama.delegationStatus", {
-      readonly delegateAddress?: `0x${string}` | undefined;
-      readonly delegatorAddress?: `0x${string}` | undefined;
-      readonly contractAddress?: `0x${string}` | undefined;
-    }];
-  };
-  readonly decryption: {
-    readonly all: readonly ["zama.decryption"];
-    readonly encryptedValue: (encryptedValue: string, contractAddress?: Address) => readonly ["zama.decryption", {
-      readonly contractAddress?: `0x${string}` | undefined;
-      readonly encryptedValue: string;
-    }];
-    readonly encryptedInputs: (encryptedInputs: readonly {
-      encryptedValue: string;
-      contractAddress: Address;
-    }[], walletAccount?: WalletAccount) => readonly ["zama.decryption", {
-      readonly encryptedInputs: {
-        encryptedValue: Hex;
-        contractAddress: `0x${string}`;
-      }[];
-      readonly walletAddress: `0x${string}`;
-      readonly walletChainId: number;
-    } | {
-      readonly encryptedInputs: {
-        encryptedValue: Hex;
-        contractAddress: `0x${string}`;
-      }[];
-      readonly walletAddress?: undefined;
-      readonly walletChainId?: undefined;
-    }];
-  };
-  readonly wrappersRegistry: {
-    readonly all: readonly ["zama.wrappersRegistry"];
-    readonly chainId: () => readonly ["zama.wrappersRegistry", {
-      readonly type: "chainId";
-    }];
-    readonly tokenPairs: (registryAddress: Address) => readonly ["zama.wrappersRegistry", {
-      readonly type: "tokenPairs";
-      readonly registryAddress: `0x${string}`;
-    }];
-    readonly confidentialTokenAddress: (registryAddress: Address, tokenAddress: Address) => readonly ["zama.wrappersRegistry", {
-      readonly type: "confidentialTokenAddress";
-      readonly registryAddress: `0x${string}`;
-      readonly tokenAddress: `0x${string}`;
-    }];
-    readonly tokenAddress: (registryAddress: Address, confidentialTokenAddress: Address) => readonly ["zama.wrappersRegistry", {
-      readonly type: "tokenAddress";
-      readonly registryAddress: `0x${string}`;
-      readonly confidentialTokenAddress: `0x${string}`;
-    }];
-    readonly tokenPairsLength: (registryAddress: Address) => readonly ["zama.wrappersRegistry", {
-      readonly type: "tokenPairsLength";
-      readonly registryAddress: `0x${string}`;
-    }];
-    readonly tokenPairsSlice: (registryAddress: Address, fromIndex: string, toIndex: string) => readonly ["zama.wrappersRegistry", {
-      readonly type: "tokenPairsSlice";
-      readonly registryAddress: `0x${string}`;
-      readonly fromIndex: string;
-      readonly toIndex: string;
-    }];
-    readonly tokenPair: (registryAddress: Address, index: string) => readonly ["zama.wrappersRegistry", {
-      readonly type: "tokenPair";
-      readonly registryAddress: `0x${string}`;
-      readonly index: string;
-    }];
-    readonly isConfidentialTokenValid: (registryAddress: Address, confidentialTokenAddress: Address) => readonly ["zama.wrappersRegistry", {
-      readonly type: "isConfidentialTokenValid";
-      readonly registryAddress: `0x${string}`;
-      readonly confidentialTokenAddress: `0x${string}`;
-    }];
-    readonly listPairs: (registryAddress: Address, page: number, pageSize: number, metadata: boolean) => readonly ["zama.wrappersRegistry", {
-      readonly type: "listPairs";
-      readonly registryAddress: `0x${string}`;
-      readonly page: number;
-      readonly pageSize: number;
-      readonly metadata: boolean;
-    }];
-  };
-};
+declare function grantPermitMutationOptions(sdk: ZamaSDK): MutationFactoryOptions<readonly ["zama.grantPermit"], Address[] | WildcardPermit, void>;
 //#endregion
-//#region src/query/signer-query-context.d.ts
-/** Connected-wallet context threaded into query factories to scope cache keys and gate signer-dependent queries. */
-interface SignerQueryContext {
-  /** Connected wallet account; queries that need a signer stay disabled until it is set. */
-  walletAccount?: WalletAccount;
+//#region src/query/prepare-permit.d.ts
+/** Builds TanStack Query mutation options for {@link Offline.preparePermit | preparing} an offline decryption permit. */
+declare function preparePermitMutationOptions(sdk: ZamaSDK): MutationFactoryOptions<readonly ["zama.preparePermit"], PreparePermitRequest, PreparedPermit>;
+//#endregion
+//#region src/query/register-permit.d.ts
+/** Parameters for {@link registerPermitMutationOptions}. */
+interface RegisterPermitParams {
+  /** The payload `sdk.offline.preparePermit` returned. */
+  prepared: PreparedPermit;
+  /** The `eth_signTypedData_v4` signature over `prepared.eip712`. */
+  signature: Hex;
 }
+/** Builds TanStack Query mutation options for {@link Permits.registerPermit | registering} a signed offline permit. */
+declare function registerPermitMutationOptions(sdk: ZamaSDK): MutationFactoryOptions<readonly ["zama.registerPermit"], RegisterPermitParams, void>;
 //#endregion
-//#region src/query/user-decrypt.d.ts
-/** A single encrypted value to decrypt, paired with the contract that owns it. */
-interface EncryptedInput {
-  /** Encrypted handle to decrypt. */
-  encryptedValue: EncryptedValue;
-  /** Address of the contract the encrypted value belongs to. */
-  contractAddress: Address;
+//#region src/query/has-permit.d.ts
+/** Configuration for {@link hasPermitQueryOptions}. */
+interface HasPermitQueryConfig {
+  /** Contract addresses to check credentials against. */
+  contractAddresses: Address[];
+  /**
+   * Standard TanStack query options. `hasPermit` intentionally overrides cache
+   * timing because permit state is wallet-local, not server state: every fetch
+   * should read the SDK credential service directly.
+   */
+  query?: Record<string, unknown>;
+}
+/** Builds TanStack Query options for reading whether the connected wallet holds a valid decryption permit for the given contracts. */
+declare function hasPermitQueryOptions(sdk: ZamaSDK, config: HasPermitQueryConfig, signerContext?: SignerQueryContext): QueryFactoryOptions<boolean, Error, boolean, ReturnType<typeof zamaQueryKeys.hasPermit.scope>>;
+//#endregion
+//#region src/query/revoke-permits.d.ts
+/** TanStack Query mutation factory for {@link Permits.revokePermits}. */
+declare function revokePermitsMutationOptions(sdk: ZamaSDK): MutationFactoryOptions<readonly ["zama.revokePermits"], Address[] | void, void>;
+//#endregion
+//#region src/query/clear-credentials.d.ts
+/** TanStack Query mutation factory for {@link Permits.clear}. */
+declare function clearCredentialsMutationOptions(sdk: ZamaSDK): MutationFactoryOptions<readonly ["zama.clearCredentials"], void, void>;
+//#endregion
+//#region src/query/delegate-decryption.d.ts
+/** Variables for {@link delegateDecryptionMutationOptions}. */
+interface DelegateDecryptionParams {
+  /** Address to grant delegated decryption rights to. */
+  delegateAddress: Address;
+  /** When the delegation expires; omit for no expiry. */
+  expirationDate?: Date;
+}
+/** Builds TanStack Query mutation options for {@link Delegations.delegateDecryption | granting} delegated decryption rights on a contract. @see {@link DelegateDecryptionParams} */
+declare function delegateDecryptionMutationOptions(sdk: ZamaSDK, contractAddress: Address): MutationFactoryOptions<readonly ["zama.delegateDecryption", Address], DelegateDecryptionParams, TransactionResult>;
+//#endregion
+//#region src/query/decrypt-balance-as.d.ts
+/** Variables for {@link decryptBalanceAsMutationOptions}. */
+interface DecryptBalanceAsParams {
+  /** Address of the account that delegated decryption rights to the connected wallet. */
+  delegatorAddress: Address;
+  /** Account whose on-chain balance to read; defaults to the delegator address. */
+  accountAddress?: Address;
+}
+/** Builds TanStack Query mutation options for {@link Token.decryptBalanceAs | decrypting} a balance via delegated decryption credentials. @see {@link DecryptBalanceAsParams} */
+declare function decryptBalanceAsMutationOptions(token: Token): MutationFactoryOptions<readonly ["zama.decryptBalanceAs", Address], DecryptBalanceAsParams, bigint>;
+//#endregion
+//#region src/query/batch-decrypt-balances-as.d.ts
+/** Variables for {@link batchDecryptBalancesAsMutationOptions}. */
+type BatchDecryptBalancesAsParams = BatchDecryptAsOptions;
+/** Builds TanStack Query mutation options for {@link Token.batchDecryptBalancesAs | decrypting} multiple token balances via delegated decryption credentials. @see {@link BatchDecryptBalancesAsParams} */
+declare function batchDecryptBalancesAsMutationOptions(tokens: Token[]): MutationFactoryOptions<readonly ["zama.batchDecryptBalancesAs", ...Address[]], BatchDecryptBalancesAsParams, Map<Address, bigint>>;
+//#endregion
+//#region src/query/revoke-delegation.d.ts
+/** Variables for {@link revokeDelegationMutationOptions}. */
+interface RevokeDelegationParams {
+  /** Address whose delegated decryption rights to revoke. */
+  delegateAddress: Address;
+}
+/** Builds TanStack Query mutation options for {@link Delegations.revokeDelegation | revoking} delegated decryption rights on a contract. @see {@link RevokeDelegationParams} */
+declare function revokeDelegationMutationOptions(sdk: ZamaSDK, contractAddress: Address): MutationFactoryOptions<readonly ["zama.revokeDelegation", Address], RevokeDelegationParams, TransactionResult>;
+//#endregion
+//#region src/query/invalidate-decryption-signatures.d.ts
+/** Variables for {@link invalidateDecryptionSignaturesMutationOptions}. */
+interface InvalidateDecryptionSignaturesParams {
+  /** Oldest timestamp that remains valid. Omit to invalidate everything up to now. */
+  timestamp?: Date;
 }
-/** Decrypted clear values keyed by encrypted handle. */
-type DecryptResult = Readonly<Record<EncryptedValue, ClearValue>>;
-/** Builds TanStack Query options for decrypting a batch of encrypted handles into their clear values. */
-declare function decryptValuesQueryOptions(sdk: ZamaSDK, encryptedInputs: EncryptedInput[], signerContext?: SignerQueryContext): QueryFactoryOptions<DecryptResult, Error, DecryptResult, ReturnType<typeof zamaQueryKeys.decryption.encryptedInputs>>;
+/** Builds TanStack Query mutation options for {@link Permits.invalidateDecryptionSignatures | invalidating} every decryption signature signed before a timestamp. @see {@link InvalidateDecryptionSignaturesParams} */
+declare function invalidateDecryptionSignaturesMutationOptions(sdk: ZamaSDK): MutationFactoryOptions<readonly ["zama.invalidateDecryptionSignatures"], InvalidateDecryptionSignaturesParams | void, TransactionResult>;
+//#endregion
+//#region src/query/delegation-status.d.ts
+/** Configuration for {@link delegationStatusQueryOptions}. */
+interface DelegationStatusQueryConfig {
+  /** Contract the delegation applies to; pass `undefined` to keep the query disabled. */
+  contractAddress: Address | undefined;
+  /** Address granting the delegated decryption rights; the query stays disabled until provided. */
+  delegatorAddress?: Address;
+  /** Address receiving the delegated decryption rights; the query stays disabled until provided. */
+  delegateAddress?: Address;
+  /** Additional TanStack Query options merged into the generated query (e.g. `staleTime`, `enabled`). */
+  query?: Record<string, unknown>;
+}
+/** Builds TanStack Query options for reading the decryption-delegation status between a delegator and a delegate on a contract. */
+declare function delegationStatusQueryOptions(sdk: ZamaSDK, config: DelegationStatusQueryConfig): QueryFactoryOptions<DelegationStatus, Error, DelegationStatus, ReturnType<typeof zamaQueryKeys.delegationStatus.scope>>;
 //#endregion
 //#region src/services/decryption-service.d.ts
 /** Options shared by the delegated-decrypt entry points. */
@@ -21898,6 +22654,224 @@ interface BatchDecryptResult {
   items: BatchDecryptItem[];
 }
 //#endregion
+//#region src/namespaces/offline.d.ts
+/**
+ * Namespace for the offline-signing pipeline —
+ * `prepare → [external sign + self-publish]` — for institutional custody, HSM
+ * ceremonies, and policy-engine workflows where signing runs out-of-process and
+ * cannot happen synchronously in a single Promise.
+ */
+declare class Offline {
+  #private;
+  /**
+   * Build an RLP-encoded unsigned transaction for the given request. The
+   * caller signs it externally — via an HSM ceremony, an out-of-process
+   * custodian, or any signer holding the key — and broadcasts the signed bytes
+   * through its own channel.
+   *
+   * Signer-optional: works without a configured signer (canonical shape for
+   * cross-process custody — the back-end signer service consumes
+   * `prepared.unsignedTx` and returns signed bytes).
+   *
+   * @remarks
+   * `request.from` is only a declaration — the SDK does not prove the caller
+   * controls it, and an EIP-1559 unsigned tx carries no `from` field at all
+   * (the on-chain sender is whichever key signs the bytes). Point `from` at
+   * the account the custodian will sign with; custodians enforce key-control
+   * at sign time — a signing request for a key the credential can't use fails
+   * there — so a mismatched `from` cannot make the custodian sign from an
+   * account you don't control. Verifying control of `from` up front is still
+   * the application's responsibility.
+   */
+  prepare<K extends TransactionKind>(request: Extract<PrepareTransactionRequest, {
+    kind: K;
+  }>, options?: PrepareOptions): Promise<PreparedFor<K>>;
+  /**
+   * Build the offline-signing payload for a decryption permit: the unsigned
+   * EIP-712 typed data plus everything `sdk.permits.registerPermit` needs to
+   * verify and persist the signature an out-of-process signer returns for it.
+   *
+   * Not a `prepare()` transaction kind: a permit is not a transaction —
+   * nothing is broadcast, and registering the signature is a local operation,
+   * not a relayer round-trip.
+   *
+   * Signer-optional, like {@link prepare}: `request.signer` is an explicit
+   * address, not a connected wallet account. Building the typed data still
+   * reads the chain's KMS signers context on-chain — signer-offline, not
+   * network-offline.
+   *
+   * One permit per call: unlike `sdk.permits.grantPermit`, this never widens
+   * an existing permit or chunks over 10 contracts — `request.contracts` maps
+   * to exactly one signature.
+   *
+   * @throws if `request.contracts` is empty or exceeds 10 addresses, `request.delegator`
+   *   equals `request.signer`, or `request.durationDays` exceeds the V1 permit maximum
+   *   of 365 days. {@link ConfigurationError}
+   * @throws if a concurrent `permits.revokeTransportKeyPair()` rotates the transport key
+   *   pair while this call is generating one. {@link TransportKeyPairChangedError}
+   */
+  preparePermit(request: PreparePermitRequest): Promise<PreparedPermit>;
+}
+//#endregion
+//#region src/zama-sdk.d.ts
+/** Instance-level options that are deliberately not part of the shareable config object. */
+interface ZamaSDKOptions {
+  /**
+   * Encrypts the transport key pair's private half at rest. Headless environments only
+   * (CLI tools, servers, agents); the constructor rejects it in browser contexts. Supply
+   * at least 32 random bytes, or a string of at least 64 characters, from a CSPRNG or
+   * secrets manager. The SDK copies a Uint8Array secret and zeroizes its own copy after
+   * key import; it never touches your buffer, so zeroize yours after construction.
+   * The SDK never persists or exposes this value. Omit for the default:
+   * plaintext at rest, security delegated to the storage backend.
+   */
+  transportKeyPairDerivationSecret?: string | Uint8Array;
+}
+/**
+ * ZamaSDK — composes a RelayerSDK with contract abstraction.
+ *
+ * Exposes domain namespaces for permits, delegations, decryption, offline
+ * signing, and tokens, plus an unchanged registry, a top-level `encrypt`, and
+ * lifecycle methods. Internal `*Service` classes do the work; the namespace
+ * classes own SDK-level guards (chain alignment, signer requirement, event
+ * emission).
+ */
+declare class ZamaSDK {
+  #private;
+  /** Read-only chain access used for all contract reads. */
+  readonly provider: GenericProvider;
+  /** Wallet signer used for write operations, or `undefined` when the SDK is read-only. */
+  readonly signer: GenericSigner | undefined;
+  /** Storage for cached permits and transport key pairs. */
+  readonly storage: GenericStorage;
+  /**
+   * A {@link WrappersRegistry} instance auto-configured for the current chain.
+   * Uses built-in defaults from chain configs, and the SDK's `registryTTL` if configured.
+   */
+  readonly registry: WrappersRegistry;
+  /** Permit and keypair management. */
+  readonly permits: Permits;
+  /** On-chain decryption-delegation management. */
+  readonly delegations: Delegations;
+  /** FHE decryption (user, delegated user, public). */
+  readonly decryption: Decryption;
+  /** Offline-signing pipeline: `prepare` builds an unsigned tx the caller signs and broadcasts out-of-process — for HSM, policy-engine, and cross-process custody workflows. */
+  readonly offline: Offline;
+  constructor(config: ZamaConfig, options?: ZamaSDKOptions);
+  /**
+   * The single-chain relayer backend for the **currently active** chain.
+   */
+  get relayer(): RelayerSDK;
+  /**
+   * Create a {@link WrappersRegistry} instance bound to this SDK's provider.
+   * Inherits the registry addresses derived from the SDK's chain configs, so
+   * the result is consistent with {@link ZamaSDK.registry}.
+   *
+   * @param registryAddresses - Optional per-chain overrides for this registry instance.
+   * @returns A {@link WrappersRegistry} instance.
+   *
+   * @example
+   * ```ts
+   * // Addresses resolved from the SDK's chain configs
+   * const registry = sdk.createWrappersRegistry();
+   *
+   * // Hardhat or custom chain — override per chain for this registry instance
+   * const registry = sdk.createWrappersRegistry({ [31337]: "0xYourRegistry" });
+   *
+   * const pairs = await registry.getTokenPairs();
+   * ```
+   */
+  createWrappersRegistry(registryAddresses?: Record<number, Address>): WrappersRegistry;
+  /**
+   * Encrypt one or more plaintext values into FHE ciphertexts.
+   *
+   * @param params - Typed FHE inputs, the target contract address, and the user address.
+   * @returns External encrypted values and the input proof for on-chain submission.
+   * @throws if FHE encryption fails. {@link EncryptionFailedError}
+   *
+   * @example
+   * ```ts
+   * const { encryptedValues, inputProof } = await sdk.encrypt({
+   *   values: [{ value: 1000n, type: "euint64" }],
+   *   contractAddress: "0xToken",
+   *   userAddress: "0xUser",
+   * });
+   * ```
+   */
+  encrypt(params: EncryptParams, options?: Pick<FhevmRelayerOptions, "signal" | "timeout">): Promise<EncryptResult>;
+  /**
+   * Create a high-level ERC-20-style interface for an ERC-7984 confidential token.
+   * Supports balance queries, transfers, operator approvals, and decryption.
+   *
+   * For ERC-7984 wrappers (shield/unshield/allowance), use {@link createWrappedToken} instead.
+   *
+   * @param address - The confidential token contract address.
+   * @returns A {@link Token} instance bound to this SDK.
+   *
+   * @example
+   * ```ts
+   * const token = sdk.createToken(cUSDT);
+   * const balance = await token.balanceOf(userAddress);
+   * ```
+   */
+  createToken(address: Address): Token;
+  /**
+   * Create a high-level interface for an ERC-7984 wrapper token.
+   * Extends {@link Token} with shield/unshield/allowance/finalize-unwrap operations.
+   *
+   * @param address - The wrapper token contract address.
+   * @returns A {@link WrappedToken} instance bound to this SDK.
+   *
+   * @example
+   * ```ts
+   * const wrapped = sdk.createWrappedToken(wUSDT);
+   * await wrapped.shield(1_000_000n);
+   * ```
+   */
+  createWrappedToken(address: Address): WrappedToken;
+  /**
+   * Release the SDK-owned resources: signer lifecycle subscriptions and the
+   * relayer backend's resources, an encrypt worker included. Call this when the
+   * SDK instance is being replaced (e.g. React provider unmount or a Strict Mode
+   * remount). Work already in flight runs to completion, and the instance stays
+   * usable: the next encryption spawns a fresh worker.
+   */
+  dispose(): void;
+  /**
+   * {@link dispose} plus the signer's own disposal. Call this when the SDK is no
+   * longer needed (e.g. on shutdown). Work already in flight runs to completion.
+   */
+  terminate(): void;
+  /**
+   * Implements the TC39 Explicit Resource Management protocol.
+   * Calls {@link terminate} when the `using` binding goes out of scope,
+   * unsubscribing signer events and releasing the relayer's resources.
+   *
+   * @example
+   * ```ts
+   * {
+   *   using sdk = new ZamaSDK({ relayer, provider, signer, storage });
+   *   await sdk.permits.grantPermit([cUSDT]);
+   *   const balance = await sdk.createToken(cUSDT).balanceOf(userAddress);
+   * } // sdk.terminate() called automatically here
+   * ```
+   */
+  [Symbol.dispose](): void;
+}
+//#endregion
+//#region src/query/user-decrypt.d.ts
+/** A single encrypted value to decrypt, paired with the contract that owns it. */
+interface EncryptedInput {
+  /** Encrypted handle to decrypt. */
+  encryptedValue: EncryptedValue;
+  /** Address of the contract the encrypted value belongs to. */
+  contractAddress: Address;
+}
+/** Decrypted clear values keyed by encrypted handle. */
+type DecryptResult = Readonly<Record<EncryptedValue, ClearValue>>;
+/** Builds TanStack Query options for decrypting a batch of encrypted handles into their clear values. */
+declare function decryptValuesQueryOptions(sdk: ZamaSDK, encryptedInputs: EncryptedInput[], signerContext?: SignerQueryContext): QueryFactoryOptions<DecryptResult, Error, DecryptResult, ReturnType<typeof zamaQueryKeys.decryption.encryptedInputs>>;
+//#endregion
 //#region src/namespaces/decryption.d.ts
 /**
  * Public namespace for FHE decryption — the canonical way to decrypt.
@@ -22038,94 +23012,5 @@ declare class Decryption {
   } & DelegatedDecryptOptions): Promise<BatchDecryptResult>;
 }
 //#endregion
-//#region src/storage/memory-storage.d.ts
-/** In-memory credential store. Credentials are lost on page reload. */
-declare class MemoryStorage implements GenericStorage {
-  #private;
-  /**
-   * Retrieve a value by key.
-   * @returns The stored value, or `null` if the key does not exist.
-   */
-  get<T = unknown>(key: string): Promise<T | null>;
-  /** Store a value under the given key, overwriting any existing entry. */
-  set<T = unknown>(key: string, value: T): Promise<void>;
-  /** Remove the entry for the given key (no-op if absent). */
-  delete(key: string): Promise<void>;
-}
-/** Default singleton for application-wide use. */
-declare const memoryStorage: MemoryStorage;
-//#endregion
-//#region src/storage/indexeddb-storage.d.ts
-/**
- * IndexedDB-backed {@link GenericStorage}.
- *
- * Stores keypair and permit objects keyed by a hashed wallet address. The
- * SDK delegates security to the storage backend — values are persisted
- * verbatim with no SDK-layer encryption.
- */
-declare class IndexedDBStorage implements GenericStorage {
-  #private;
-  constructor(dbName?: string, dbVersion?: number, storeName?: string);
-  /**
-   * Retrieve a value by key.
-   * @returns The stored value, or `null` if the key does not exist.
-   */
-  get<T = unknown>(key: string): Promise<T | null>;
-  /** Store a value under the given key, overwriting any existing entry. */
-  set<T = unknown>(key: string, value: T): Promise<void>;
-  /** Remove the entry for the given key (no-op if absent). */
-  delete(key: string): Promise<void>;
-  /** Remove all stored entries. */
-  clear(): Promise<void>;
-}
-/** Default singleton for application-wide use. */
-declare const indexedDBStorage: IndexedDBStorage;
-//#endregion
-//#region src/storage/chrome-session-storage.d.ts
-/**
- * {@link GenericStorage} backed by `chrome.storage.session`.
- *
- * Use this in MV3 web extensions so the wallet signature survives
- * service worker restarts and is shared across popup, background,
- * and content script contexts.
- *
- * @example
- * ```ts
- * import { ZamaSDK, indexedDBStorage, chromeSessionStorage } from "@zama-fhe/sdk";
- * import { createConfig } from "@zama-fhe/sdk/viem";
- *
- * const config = createConfig({
- *   chains: [mySepolia],
- *   publicClient,
- *   walletClient,
- *   relayers: { [mySepolia.id]: web() },
- *   storage: indexedDBStorage, // encrypted transport key pair — persistent
- *   permitStorage: chromeSessionStorage, // signed permits — ephemeral
- * });
- * const sdk = new ZamaSDK(config);
- * ```
- */
-declare class ChromeSessionStorage implements GenericStorage {
-  /**
-   * Retrieve a value by key.
-   * @returns The stored value, or `null` if the key does not exist.
-   */
-  get<T = unknown>(key: string): Promise<T | null>;
-  /** Store a value under the given key, overwriting any existing entry. */
-  set(key: string, value: unknown): Promise<void>;
-  /** Remove the entry for the given key (no-op if absent). */
-  delete(key: string): Promise<void>;
-}
-/** Default singleton for application-wide use. */
-declare const chromeSessionStorage: ChromeSessionStorage;
-//#endregion
-//#region src/utils/handles.d.ts
-/** All-zero encrypted-value sentinel — a 32-byte zero handle representing the cleartext value `0`. */
-declare const ZERO_ENCRYPTED_VALUE: "0x0000000000000000000000000000000000000000000000000000000000000000";
-/**
- * Check whether an encrypted value represents the zero value.
- */
-declare function isEncryptedValueZero(encryptedValue: string): boolean;
-//#endregion
-export { BalanceErrorDetails as $, ERC7984_INTERFACE_ID as $t, BatchDecryptAsOptions as A, Permission as At, TransactionRevertedError as B, getConfidentialTokenAddressContract as Bt, ZamaSDKOptions as C, wrapContract as Cn, TransportKeyPairChangedError as Ct, WrappersRegistryConfig as D, ZamaErrorCode as Dt, WrappersRegistry as E, ZamaError as Et, Permits as F, SerializedTransportKeyPair as Ft, SignerRequiredError as G, getTokenPairsSliceContract as Gt, SigningFailedError as H, getTokenPairContract as Ht, ErrorForCode as I, ChecksummedAddress as It, RpcRateLimitError as J, getDelegationExpiryContract as Jt, WalletAccountNotReadyError as K, isConfidentialTokenValidContract as Kt, matchZamaError as L, PaginatedResult as Lt, Offline as M, PreparedPermit as Mt, Delegations as N, SerializedPermit as Nt, WrappedToken as O, isRetryable as Ot, DelegationStatus as P, SerializedPermitEip712 as Pt, BalanceCheckUnavailableError as Q, ERC1363_INTERFACE_ID as Qt, UnshieldAlreadyFinalizedDetails as R, TokenWrapperPair as Rt, ZamaSDK as S, unwrapRequesterContract as Sn, RevokedKmsContextError as St, ListPairsOptions as T, ChainMismatchError as Tt, SigningRejectedError as U, getTokenPairsContract as Ut, SigningErrorMetadata as V, getTokenAddressContract as Vt, SignerNotConfiguredError as W, getTokenPairsLengthContract as Wt, ConfigurationError as X, revokeDelegationContract as Xt, NotEntitledError as Y, isHandleDelegatedContract as Yt, RelayerRequestFailedError as Z, transferAndCallContract as Zt, decryptValuesQueryOptions as _, rateContract as _n, InvalidTransportKeyPairError as _t, ChromeSessionStorage as a, approveContract as an, EncryptOffloadUnavailableError as at, MutationFactoryOptions as b, unwrapContract as bn, PreparedPermitChainMismatchError as bt, indexedDBStorage as c, nameContract as cn, DelegationContractIsSelfError as ct, Decryption as d, confidentialTotalSupplyContract as dn, DelegationExpirationTooSoonError as dt, ERC7984_WRAPPER_INTERFACE_ID as en, ERC20ReadFailedError as et, BatchDecryptItem as f, confidentialTransferContract as fn, DelegationExpiredError as ft, EncryptedInput as g, isOperatorContract as gn, DelegationSelfNotAllowedError as gt, DecryptResult as h, inferredTotalSupplyContract as hn, DelegationNotPropagatedError as ht, isEncryptedValueZero as i, allowanceContract as in, DecryptionFailedError as it, Token as j, PreparePermitRequest as jt, BatchBalancesResult as k, retryAfterSeconds as kt, MemoryStorage as l, symbolContract as ln, DelegationCooldownError as lt, DelegatedDecryptOptions as m, finalizeUnwrapContract as mn, DelegationNotFoundError as mt, Hex$1 as n, isConfidentialWrapperContract as nn, InsufficientConfidentialBalanceError as nt, chromeSessionStorage as o, balanceOfContract as on, EncryptionFailedError as ot, BatchDecryptResult as p, confidentialTransferFromContract as pn, DelegationExpiryUnchangedError as pt, WalletNotConnectedError as q, delegateForUserDecryptionContract as qt, ZERO_ENCRYPTED_VALUE as r, supportsInterfaceContract as rn, InsufficientERC20BalanceError as rt, IndexedDBStorage as s, decimalsContract as sn, AclPausedError as st, Address$1 as t, isConfidentialTokenContract as tn, InsufficientAllowanceError as tt, memoryStorage as u, confidentialBalanceOfContract as un, DelegationDelegateEqualsContractError as ut, SignerQueryContext as v, setOperatorContract as vn, KeyWrappingError as vt, DefaultRegistryAddresses as w, createConfig as wn, TransportKeyPairExpiredError as wt, QueryFactoryOptions as x, unwrapFromBalanceContract as xn, PreparedPermitExpiredError as xt, zamaQueryKeys as y, underlyingContract as yn, NoCiphertextError as yt, UnshieldAlreadyFinalizedError as z, TokenWrapperPairWithMetadata as zt };
-//# sourceMappingURL=index-BCh3VaZo.d.ts.map
+export { confidentialTransferFromAndCallMutationOptions as $, DelegationExpiryUnchangedError as $n, ERC7984_WRAPPER_INTERFACE_ID as $r, QueryLike as $t, grantPermitMutationOptions as A, SignerRequiredError as An, SerializedPermitEip712 as Ar, Token as At, UnwrapParams as B, InsufficientAllowanceError as Bn, getTokenPairContract as Br, ListPairsOptions as Bt, clearCredentialsMutationOptions as C, createConfig as Ci, UnshieldAlreadyFinalizedDetails as Cn, PermissionV2 as Cr, ConfidentialBalancesQueryConfig as Ct, RegisterPermitParams as D, SigningFailedError as Dn, PreparedPermitV1 as Dr, WrappedToken as Dt, hasPermitQueryOptions as E, SigningErrorMetadata as En, PreparedPermitBase as Er, confidentialBalanceQueryOptions as Et, FinalizeUnwrapParams as F, ConfigurationError as Fn, PaginatedResult as Fr, UnderlyingAllowanceQueryConfig as Ft, unshieldAllMutationOptions as G, EncryptionFailedError as Gn, delegateForUserDecryptionContract as Gr, IsConfidentialQueryConfig as Gt, ResumeUnshieldParams as H, InsufficientERC20BalanceError as Hn, getTokenPairsLengthContract as Hr, WrappersRegistryConfig as Ht, finalizeUnwrapMutationOptions as I, RelayerRequestFailedError as In, TokenWrapperPair as Ir, underlyingAllowanceQueryOptions as It, ApproveUnderlyingParams as J, DelegationCooldownError as Jn, isHandleDelegatedContract as Jr, TokenMetadata as Jt, UnshieldParams as K, AclPausedError as Kn, getDelegationExpiryContract as Kr, isConfidentialQueryOptions as Kt, unwrapAllMutationOptions as L, BalanceCheckUnavailableError as Ln, TokenWrapperPairWithMetadata as Lr, WrapperDiscoveryQueryConfig as Lt, DelegatedDecryptValuesMutationParams as M, WalletNotConnectedError as Mn, WILDCARD_PERMIT as Mr, confidentialIsOperatorQueryOptions as Mt, delegatedDecryptValuesMutationOptions as N, RpcRateLimitError as Nn, WildcardPermit as Nr, PendingUnshieldQueryConfig as Nt, registerPermitMutationOptions as O, SigningRejectedError as On, PreparedPermitV2 as Or, BatchBalancesResult as Ot, encryptMutationOptions as P, NotEntitledError as Pn, ChecksummedAddress as Pr, pendingUnshieldQueryOptions as Pt, ConfidentialTransferFromAndCallParams as Q, DelegationExpiredError as Qn, ERC7984_INTERFACE_ID as Qr, QueryFilterLike as Qt, WrapParams as R, BalanceErrorDetails as Rn, getConfidentialTokenAddressContract as Rr, wrapperDiscoveryQueryOptions as Rt, delegateDecryptionMutationOptions as S, wrapContract as Si, matchZamaError as Sn, PermissionV1 as Sr, tokenPairsSliceQueryOptions as St, HasPermitQueryConfig as T, TransactionRevertedError as Tn, PreparedPermit as Tr, ConfidentialBalanceQueryConfig as Tt, resumeUnshieldMutationOptions as U, DecryptionFailedError as Un, getTokenPairsSliceContract as Ur, TotalSupplyQueryConfig as Ut, unwrapMutationOptions as V, InsufficientConfidentialBalanceError as Vn, getTokenPairsContract as Vr, WrappersRegistry as Vt, UnshieldAllParams as W, EncryptOffloadUnavailableError as Wn, isConfidentialTokenValidContract as Wr, totalSupplyQueryOptions as Wt, ConfidentialSetOperatorParams as X, DelegationDelegateEqualsContractError as Xn, transferAndCallContract as Xr, tokenMetadataQueryOptions as Xt, approveUnderlyingMutationOptions as Y, DelegationDelegateCannotBeWildcardError as Yn, revokeDelegationContract as Yr, TokenMetadataQueryConfig as Yt, confidentialSetOperatorMutationOptions as Z, DelegationExpirationTooSoonError as Zn, ERC1363_INTERFACE_ID as Zr, QueryClientLike as Zt, BatchDecryptBalancesAsParams as _, setOperatorContract as _i, hashFn as _n, ZamaErrorCode as _r, listPairsQueryOptions as _t, ZamaSDK as a, balanceOfContract as ai, invalidateAfterUnshieldSettled as an, InvalidationTimestampTooLowError as ar, confidentialTransferMutationOptions as at, decryptBalanceAsMutationOptions as b, unwrapFromBalanceContract as bi, Permits as bn, Permission as br, tokenPairsLengthQueryOptions as bt, BatchDecryptItem as c, symbolContract as ci, invalidateBalanceQueries as cn, PreparedPermitChainMismatchError as cr, ConfidentialTokenAddressQueryConfig as ct, DelegationStatusQueryConfig as d, confidentialTransferContract as di, zamaQueryKeys as dn, TransportKeyPairChangedError as dr, TokenAddressQueryConfig as dt, isConfidentialTokenContract as ei, invalidateAfterApproveUnderlying as en, DelegationNotFoundError as er, ConfidentialTransferFromParams as et, delegationStatusQueryOptions as f, confidentialTransferFromContract as fi, SignerQueryContext as fn, TransportKeyPairExpiredError as fr, TokenPairQueryConfig as ft, revokeDelegationMutationOptions as g, rateContract as gi, filterQueryOptions as gn, ZamaError as gr, isConfidentialTokenValidQueryOptions as gt, RevokeDelegationParams as h, isOperatorContract as hi, StrippedQueryOptionKeys as hn, ChainMismatchError as hr, confidentialTokenAddressQueryOptions as ht, decryptValuesQueryOptions as i, approveContract as ii, invalidateAfterUnshield as in, InvalidationTimestampInFutureError as ir, ConfidentialTransferParams as it, decryptPublicValuesMutationOptions as j, WalletAccountNotReadyError as jn, SerializedTransportKeyPair as jr, ConfidentialIsOperatorQueryConfig as jt, preparePermitMutationOptions as k, SignerNotConfiguredError as kn, SerializedPermit as kr, BatchDecryptAsOptions as kt, BatchDecryptResult as l, confidentialBalanceOfContract as li, invalidateWagmiBalanceQueries as ln, PreparedPermitExpiredError as lr, IsConfidentialTokenValidQueryConfig as lt, invalidateDecryptionSignaturesMutationOptions as m, inferredTotalSupplyContract as mi, QueryFactoryOptions as mn, UnifiedPermitNotSupportedError as mr, WrappersRegistryQueryConfig as mt, DecryptResult as n, supportsInterfaceContract as ni, invalidateAfterShield as nn, DelegationSelfNotAllowedError as nr, ConfidentialTransferAndCallParams as nt, ZamaSDKOptions as o, decimalsContract as oi, invalidateAfterUnwrap as on, KeyWrappingError as or, ShieldParams as ot, InvalidateDecryptionSignaturesParams as p, finalizeUnwrapContract as pi, MutationFactoryOptions as pn, UnifiedDecryptionUnsupportedError as pr, TokenPairsSliceQueryConfig as pt, unshieldMutationOptions as q, DelegationContractIsSelfError as qn, invalidateDecryptionSignaturesBeforeContract as qr, isWrapperQueryOptions as qt, EncryptedInput as r, allowanceContract as ri, invalidateAfterTransfer as rn, InvalidTransportKeyPairError as rr, confidentialTransferAndCallMutationOptions as rt, Offline as s, nameContract as si, invalidateAfterWrap as sn, NoCiphertextError as sr, shieldMutationOptions as st, Decryption as t, isConfidentialWrapperContract as ti, invalidateAfterSetOperator as tn, DelegationNotPropagatedError as tr, confidentialTransferFromMutationOptions as tt, DelegatedDecryptOptions as u, confidentialTotalSupplyContract as ui, invalidateWalletLifecycleQueries as un, RevokedKmsContextError as ur, ListPairsQueryConfig as ut, batchDecryptBalancesAsMutationOptions as v, underlyingContract as vi, Delegations as vn, isRetryable as vr, tokenAddressQueryOptions as vt, revokePermitsMutationOptions as w, UnshieldAlreadyFinalizedError as wn, PreparePermitRequest as wr, confidentialBalancesQueryOptions as wt, DelegateDecryptionParams as x, unwrapRequesterContract as xi, ErrorForCode as xn, PermissionBase as xr, tokenPairsQueryOptions as xt, DecryptBalanceAsParams as y, unwrapContract as yi, DelegationStatus as yn, retryAfterSeconds as yr, tokenPairQueryOptions as yt, wrapMutationOptions as z, ERC20ReadFailedError as zn, getTokenAddressContract as zr, DefaultRegistryAddresses as zt };
+//# sourceMappingURL=index-DRrrBtMX.d.ts.map