@tokenops/sdk 1.5.1 → 2.0.0-alpha.1

package/dist/fhe-airdrop/index.js

@@ -1,10 +1,932 @@
-export { AlreadyClaimedError, ClaimNotStartedError, ClaimWindowClosedError, ConfidentialAirdropClient, confidentialAirdropCloneableAbi, createConfidentialAirdropClient } from '../chunk-6R4KNAPK.js';
-export { ConfidentialAirdropFactoryClient, confidentialAirdropFactoryAbi, createConfidentialAirdropFactoryClient, encryptUint64, encryptUint64Batch, resolveEncryptor, signClaimAuthorization } from '../chunk-DUZIIRPF.js';
+export { buildMerkleCampaign, buildMerkleTree, encryptCampaignAmounts, grantInstanceRoles, leafOf, planInstanceRoleSplit, planMerkleCampaign, rotateMerkleRoot, validateCampaignRecipients } from '../chunk-456VDDA3.js';
+export { AirdropBaseClient, CLAIM_TYPEHASH, CLAIM_TYPES, ConfidentialAirdropFactoryClient, EIP712_DOMAIN_NAME, EIP712_DOMAIN_VERSION, EcdsaAirdropClient, FACTORY_ROLE_CONCENTRATION_NOTE, MerkleAirdropClient, airdropFactoryAbi, confidentialAirdropBaseAbi, createAirdropBaseClient, createConfidentialAirdropFactoryClient, createEcdsaAirdropClient, createMerkleAirdropClient, ecdsaConfidentialAirdropAbi, encryptUint64, encryptUint64Batch, merkleConfidentialAirdropAbi, resolveEncryptor, signClaimAuthorization } from '../chunk-GKKDAW44.js';
+import { assertSupportedChain, airdropProductMapper } from '../chunk-O5676ZWY.js';
+export { AIRDROP_CONTRACTS_COMMIT, AlreadyClaimedError, ClaimNotStartedError, ClaimWindowClosedError, DEDUP_MODE, DEPLOYMENT_MODE, DedupIdConsumedError, FeeCollectorSelfAdministeredError, MerkleUupsUnsupportedError, NonStockWrapperError, PredictionDriftError, SaltCollisionError, SignatureExpiredError, UpgradeabilityNotAllowedError, preflightClaim, preflightCreate } from '../chunk-O5676ZWY.js';
+export { ERC7984_OPERATOR_MAX_DEADLINE, revokeOperator, setOperator } from '../chunk-4TSDNZQ3.js';
 import '../chunk-ZWXJTBZO.js';
 export { erc7984OperatorAbi } from '../chunk-7VELUOMI.js';
-import '../chunk-SG65XWH7.js';
-import '../chunk-XGGTQQFH.js';
-import '../chunk-ZA673I3O.js';
-import '../chunk-Q2GP5UDC.js';
-export { asAirdropId, asEncryptedHandle } from '../chunk-KWFFIJYX.js';
+import { SDK_VERSION } from '../chunk-NWFMBLSQ.js';
+import { isContractRevert, mapContractRevert } from '../chunk-4RAAATVY.js';
+import '../chunk-DZHYSUGY.js';
+import { normaliseAddress } from '../chunk-ZA673I3O.js';
+import '../chunk-KWFFIJYX.js';
+import { DeploymentAddressUnavailableError, MissingWalletClientError, MissingAccountError } from '../chunk-QBJ7O2B4.js';
 export { AccessDeniedError, AlreadyInitializedError, BatchTooLargeError, ContractRevertError, DecryptionFailedError, DeploymentAddressUnavailableError, EncryptionFailedError, FeatureDisabledError, FheHandleNotAllowedError, InsufficientBalanceError, InsufficientFeeError, InsufficientGasFundsError, InvalidArgumentError, InvalidSignatureError, MissingAccountError, MissingClientError, MissingEncryptorError, MissingPublicClientError, MissingWalletClientError, NetworkError, OperatorNotApprovedError, PausedError, ReceiptEventAmbiguousError, ReceiptEventNotFoundError, ReentrancyError, RelayerUnreachableError, SigningFailedError, TokenOpsContractError, TokenOpsSdkError, TokenOpsValidationError, TransferFailedError, UnknownWriteFailureError, UnsupportedChainError, UserDecryptNotAllowedError, UserRejectedSignatureError, WalletChainMismatchError, WalletRejectedError, isTokenOpsSdkError } from '../chunk-QBJ7O2B4.js';
+import { withTelemetry } from '../chunk-Q2GP5UDC.js';
+
+// src/fhe-airdrop/abis/compliance.ts
+var complianceRoleManagerAbi = [
+  {
+    inputs: [],
+    stateMutability: "nonpayable",
+    type: "constructor"
+  },
+  {
+    inputs: [],
+    name: "AccessControlBadConfirmation",
+    type: "error"
+  },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "account",
+        type: "address"
+      },
+      {
+        internalType: "bytes32",
+        name: "neededRole",
+        type: "bytes32"
+      }
+    ],
+    name: "AccessControlUnauthorizedAccount",
+    type: "error"
+  },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "airdrop",
+        type: "address"
+      }
+    ],
+    name: "AirdropAndManagerAreSameAddress",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "CannotManageComplianceDelegate",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "DelegateAlreadyAdded",
+    type: "error"
+  },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "delegate",
+        type: "address"
+      }
+    ],
+    name: "DelegateAndAirdropAreSameAddress",
+    type: "error"
+  },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "delegate",
+        type: "address"
+      }
+    ],
+    name: "DelegateAndManagerAreSameAddress",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "DelegateNotFound",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "InvalidInitialization",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "NotInitializing",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "ZamaProtocolUnsupported",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "ZeroAirdrop",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "ZeroClientAdmin",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "ZeroDelegate",
+    type: "error"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      {
+        indexed: true,
+        internalType: "address",
+        name: "delegate",
+        type: "address"
+      }
+    ],
+    name: "ClientDelegateAdded",
+    type: "event"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      {
+        indexed: true,
+        internalType: "address",
+        name: "delegate",
+        type: "address"
+      }
+    ],
+    name: "ClientDelegateRevoked",
+    type: "event"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      {
+        indexed: true,
+        internalType: "address",
+        name: "delegate",
+        type: "address"
+      }
+    ],
+    name: "ComplianceDelegateSet",
+    type: "event"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      {
+        indexed: false,
+        internalType: "uint64",
+        name: "version",
+        type: "uint64"
+      }
+    ],
+    name: "Initialized",
+    type: "event"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      {
+        indexed: true,
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      },
+      {
+        indexed: true,
+        internalType: "bytes32",
+        name: "previousAdminRole",
+        type: "bytes32"
+      },
+      {
+        indexed: true,
+        internalType: "bytes32",
+        name: "newAdminRole",
+        type: "bytes32"
+      }
+    ],
+    name: "RoleAdminChanged",
+    type: "event"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      {
+        indexed: true,
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      },
+      {
+        indexed: true,
+        internalType: "address",
+        name: "account",
+        type: "address"
+      },
+      {
+        indexed: true,
+        internalType: "address",
+        name: "sender",
+        type: "address"
+      }
+    ],
+    name: "RoleGranted",
+    type: "event"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      {
+        indexed: true,
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      },
+      {
+        indexed: true,
+        internalType: "address",
+        name: "account",
+        type: "address"
+      },
+      {
+        indexed: true,
+        internalType: "address",
+        name: "sender",
+        type: "address"
+      }
+    ],
+    name: "RoleRevoked",
+    type: "event"
+  },
+  {
+    inputs: [],
+    name: "DEFAULT_ADMIN_ROLE",
+    outputs: [
+      {
+        internalType: "bytes32",
+        name: "",
+        type: "bytes32"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [],
+    name: "DELEGATION_ADMIN_ROLE",
+    outputs: [
+      {
+        internalType: "bytes32",
+        name: "",
+        type: "bytes32"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "delegate",
+        type: "address"
+      }
+    ],
+    name: "addDelegate",
+    outputs: [],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
+  {
+    inputs: [],
+    name: "airdrop",
+    outputs: [
+      {
+        internalType: "address",
+        name: "",
+        type: "address"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [],
+    name: "clientDelegates",
+    outputs: [
+      {
+        internalType: "address[]",
+        name: "",
+        type: "address[]"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [],
+    name: "complianceDelegate",
+    outputs: [
+      {
+        internalType: "address",
+        name: "",
+        type: "address"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      }
+    ],
+    name: "getRoleAdmin",
+    outputs: [
+      {
+        internalType: "bytes32",
+        name: "",
+        type: "bytes32"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      },
+      {
+        internalType: "uint256",
+        name: "index",
+        type: "uint256"
+      }
+    ],
+    name: "getRoleMember",
+    outputs: [
+      {
+        internalType: "address",
+        name: "",
+        type: "address"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      }
+    ],
+    name: "getRoleMemberCount",
+    outputs: [
+      {
+        internalType: "uint256",
+        name: "",
+        type: "uint256"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      }
+    ],
+    name: "getRoleMembers",
+    outputs: [
+      {
+        internalType: "address[]",
+        name: "",
+        type: "address[]"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      },
+      {
+        internalType: "address",
+        name: "account",
+        type: "address"
+      }
+    ],
+    name: "grantRole",
+    outputs: [],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      },
+      {
+        internalType: "address",
+        name: "account",
+        type: "address"
+      }
+    ],
+    name: "hasRole",
+    outputs: [
+      {
+        internalType: "bool",
+        name: "",
+        type: "bool"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "airdrop_",
+        type: "address"
+      },
+      {
+        internalType: "address",
+        name: "clientAdmin",
+        type: "address"
+      },
+      {
+        internalType: "address",
+        name: "clientDelegate",
+        type: "address"
+      },
+      {
+        internalType: "address",
+        name: "complianceDelegate_",
+        type: "address"
+      }
+    ],
+    name: "initialize",
+    outputs: [],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "delegate",
+        type: "address"
+      }
+    ],
+    name: "isActiveDelegate",
+    outputs: [
+      {
+        internalType: "bool",
+        name: "",
+        type: "bool"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      },
+      {
+        internalType: "address",
+        name: "callerConfirmation",
+        type: "address"
+      }
+    ],
+    name: "renounceRole",
+    outputs: [],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "delegate",
+        type: "address"
+      }
+    ],
+    name: "revokeDelegate",
+    outputs: [],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      },
+      {
+        internalType: "address",
+        name: "account",
+        type: "address"
+      }
+    ],
+    name: "revokeRole",
+    outputs: [],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes4",
+        name: "interfaceId",
+        type: "bytes4"
+      }
+    ],
+    name: "supportsInterface",
+    outputs: [
+      {
+        internalType: "bool",
+        name: "",
+        type: "bool"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  }
+];
+
+// src/fhe-airdrop/compliance.ts
+var ACL_PROPAGATION_CODE = "DELEGATION_NOT_PROPAGATED";
+var ACL_PROPAGATION_ERROR_NAME = "DelegationNotPropagatedError";
+var ACL_PROPAGATION_STATUSES = /* @__PURE__ */ new Set([400, 500]);
+function matchesPropagationMessage(message) {
+  const lower = message.toLowerCase();
+  if (lower.includes("acl check not propagated")) return true;
+  return lower.includes("propagat") && lower.includes("gateway");
+}
+function readRecord(value) {
+  return typeof value === "object" && value !== null ? value : void 0;
+}
+function readNumber(obj, key) {
+  const value = obj?.[key];
+  return typeof value === "number" ? value : void 0;
+}
+function readString(obj, key) {
+  const value = obj?.[key];
+  return typeof value === "string" ? value : void 0;
+}
+function isAclPropagationError(error) {
+  const err = readRecord(error);
+  if (!err) return false;
+  const cause = readRecord(err["cause"]);
+  if (err["code"] === ACL_PROPAGATION_CODE || err["name"] === ACL_PROPAGATION_ERROR_NAME || cause?.["code"] === ACL_PROPAGATION_CODE || cause?.["name"] === ACL_PROPAGATION_ERROR_NAME) {
+    return true;
+  }
+  const status = readNumber(err, "status") ?? readNumber(err, "statusCode") ?? readNumber(cause, "status") ?? readNumber(cause, "statusCode");
+  if (status === void 0 || !ACL_PROPAGATION_STATUSES.has(status)) return false;
+  const errMessage = readString(err, "message");
+  const causeMessage = readString(cause, "message");
+  return errMessage !== void 0 && matchesPropagationMessage(errMessage) || causeMessage !== void 0 && matchesPropagationMessage(causeMessage);
+}
+var ComplianceManagerClient = class {
+  publicClient;
+  walletClient;
+  address;
+  chainId;
+  #telemetry;
+  constructor(config) {
+    this.publicClient = config.publicClient;
+    this.walletClient = config.walletClient;
+    const chainId = config.chainId ?? config.publicClient.chain?.id;
+    if (chainId === void 0) {
+      throw new DeploymentAddressUnavailableError({
+        reason: "chain-id-missing",
+        product: "fheAirdrop",
+        contract: "complianceManager",
+        clientLabel: "ComplianceManagerClient"
+      });
+    }
+    assertSupportedChain(chainId);
+    this.chainId = chainId;
+    this.address = normaliseAddress(config.address);
+    this.#telemetry = config.telemetry;
+    this.#telemetry?.event("fhe-airdrop.client.init", {
+      surface: "compliance",
+      chainId,
+      hasWallet: !!this.walletClient,
+      sdkVersion: SDK_VERSION
+    });
+  }
+  // ============================================================
+  //                    CLIENT DELEGATION MGMT
+  // ============================================================
+  /**
+   * Add a client delegate: grants `delegate` permanent (never-expiring)
+   * user-decryption delegation over this clone's airdrop. Requires
+   * {@link DELEGATION_ADMIN_ROLE}.
+   *
+   * Effective on-chain immediately; see the class TSDoc for the gateway
+   * propagation lag before `delegatedUserDecrypt` catches up.
+   *
+   * @throws {@link InvalidArgumentError} (`argument: "delegate"`) when `delegate` is the zero address
+   *   (`ZeroDelegate`), already an active client delegate (`DelegateAlreadyAdded`), or targets the
+   *   irrevocable platform compliance delegate (`CannotManageComplianceDelegate`).
+   * @returns The transaction hash.
+   */
+  async addDelegate(args) {
+    return withTelemetry(
+      this.#telemetry,
+      "fhe-airdrop.compliance.addDelegate",
+      () => this.#write("addDelegate", [args.delegate], args.account, "addDelegate")
+    );
+  }
+  /**
+   * Revoke a client delegate. Requires {@link DELEGATION_ADMIN_ROLE}.
+   *
+   * Effective on-chain immediately — but off-chain, gateway-served
+   * `delegatedUserDecrypt` calls stop succeeding only once the gateway
+   * observes the revocation, which is not instantaneous either. Cannot target
+   * the platform compliance delegate, which is irrevocable by construction.
+   *
+   * **Not in the same block as {@link addDelegate} for the same delegate.**
+   * The FHEVM ACL rejects an add and a revoke of one delegate within a single
+   * block (`AlreadyDelegatedOrRevokedInSameBlock`), and because that revert
+   * comes from the ACL rather than from this contract, it surfaces as an
+   * opaque {@link ContractRevertError} with no decodable selector — nothing
+   * names the delegate or the cause. Batching an add and a revoke into one
+   * multicall, or sending both inside one block, is the way to hit it; wait a
+   * block between them. This is the sequencing counterpart to the propagation
+   * gotcha on the class TSDoc: that one is the gateway lagging the chain, this
+   * one is the chain refusing two conflicting writes at the same height.
+   *
+   * @throws {@link InvalidArgumentError} (`argument: "delegate"`) when `delegate` is the zero address
+   *   (`ZeroDelegate`), not currently an active client delegate (`DelegateNotFound`), or targets the
+   *   irrevocable platform compliance delegate (`CannotManageComplianceDelegate`).
+   * @returns The transaction hash.
+   */
+  async revokeDelegate(args) {
+    return withTelemetry(
+      this.#telemetry,
+      "fhe-airdrop.compliance.revokeDelegate",
+      () => this.#write("revokeDelegate", [args.delegate], args.account, "revokeDelegate")
+    );
+  }
+  // ============================================================
+  //                            READS
+  // ============================================================
+  /** The one airdrop instance this clone serves — set once, at `initialize`. */
+  async airdrop() {
+    return this.#read("airdrop");
+  }
+  /**
+   * The platform compliance delegate.
+   *
+   * @returns The delegate address, or the zero address when this clone was
+   *   created with the platform compliance policy OFF. Because `initialize`
+   *   always runs atomically before this client can reach the clone (see the
+   *   class TSDoc), a zero return never means "not wired yet" — there is no
+   *   such observable state on this contract. It unambiguously means "no
+   *   platform delegate for this airdrop."
+   */
+  async complianceDelegate() {
+    return this.#read("complianceDelegate");
+  }
+  /** The current set of active client delegates (excludes the platform compliance delegate, if any). */
+  async clientDelegates() {
+    return this.#read("clientDelegates");
+  }
+  /**
+   * Authoritative active-delegate check for `delegate` — reads the ACL
+   * expiration date directly rather than the contract's `EnumerableSet`
+   * mirror, so it reflects the platform compliance delegate too (which never
+   * appears in {@link clientDelegates}).
+   *
+   * On-chain truth only: a `true` result means the delegation is live in the
+   * ACL, not that the gateway has caught up with it yet — see the class
+   * TSDoc's propagation note.
+   */
+  async isActiveDelegate(delegate) {
+    return this.#read("isActiveDelegate", [delegate]);
+  }
+  // Role-constant getters are named for the contract function they read, the
+  // same convention every other client in this module follows: one spelling
+  // per role, whichever client you happen to be holding.
+  /** Gates {@link addDelegate} / {@link revokeDelegate}. */
+  async DELEGATION_ADMIN_ROLE() {
+    return this.#read("DELEGATION_ADMIN_ROLE");
+  }
+  /**
+   * OpenZeppelin's root role (`bytes32(0)`), read from the clone rather than
+   * hard-coded. It administers {@link DELEGATION_ADMIN_ROLE}.
+   */
+  async DEFAULT_ADMIN_ROLE() {
+    return this.#read("DEFAULT_ADMIN_ROLE");
+  }
+  // ============================================================
+  //                     ROLE ADMINISTRATION
+  // ============================================================
+  //
+  // The clone is `AccessControlEnumerableUpgradeable`, so membership is
+  // enumerable as well as checkable. This surface is what makes the delegation
+  // verbs above administrable: without it, whoever the factory named at
+  // `initialize` is the only account that can ever add a delegate, and there
+  // is no way to find out who that is.
+  //
+  // Unlike an airdrop instance, this contract adds no "never empty" floor of
+  // its own - emptying `DEFAULT_ADMIN_ROLE` here permanently freezes the
+  // clone's delegate set at whatever it currently holds.
+  /**
+   * Whether `holder` holds `role`.
+   *
+   * The role subject is called `holder`, not `account`: on the writes below
+   * `account` already means "who sends this transaction", and one key cannot
+   * be both.
+   *
+   * @param args.role A `bytes32` from {@link DELEGATION_ADMIN_ROLE} or {@link DEFAULT_ADMIN_ROLE}.
+   */
+  async hasRole(args) {
+    return this.#read("hasRole", [args.role, args.holder]);
+  }
+  /** The role whose holders may {@link grantRole} and {@link revokeRole} `role`. */
+  async getRoleAdmin(role) {
+    return this.#read("getRoleAdmin", [role]);
+  }
+  /** How many accounts hold `role`. */
+  async getRoleMemberCount(role) {
+    return this.#read("getRoleMemberCount", [role]);
+  }
+  /**
+   * The `index`-th holder of `role`, in `EnumerableSet` order - which is not
+   * stable across grants and revokes. Prefer {@link getRoleMembers}.
+   */
+  async getRoleMember(args) {
+    return this.#read("getRoleMember", [args.role, args.index]);
+  }
+  /**
+   * Every account currently holding `role`.
+   *
+   * With {@link DELEGATION_ADMIN_ROLE} this answers "who may add or revoke a
+   * delegate on this clone?" - the administrative counterpart to
+   * {@link clientDelegates}, which answers "who may currently decrypt?".
+   */
+  async getRoleMembers(role) {
+    return this.#read("getRoleMembers", [role]);
+  }
+  /**
+   * Grant `role` to `holder`. Requires the role's admin role
+   * ({@link getRoleAdmin}).
+   *
+   * This is how a second operator is added to {@link DELEGATION_ADMIN_ROLE} -
+   * the delegation verbs themselves are unaffected, the grant only widens who
+   * may call them.
+   *
+   * @returns The transaction hash.
+   */
+  async grantRole(args) {
+    return withTelemetry(
+      this.#telemetry,
+      "fhe-airdrop.compliance.grantRole",
+      () => this.#write("grantRole", [args.role, args.holder], args.account, "grantRole")
+    );
+  }
+  /**
+   * Revoke `role` from `holder`. Requires the role's admin role.
+   *
+   * Revoking a delegation admin does **not** revoke the delegations they
+   * created: an existing delegate keeps decrypting until
+   * {@link revokeDelegate} is called for it explicitly.
+   *
+   * @returns The transaction hash.
+   */
+  async revokeRole(args) {
+    return withTelemetry(
+      this.#telemetry,
+      "fhe-airdrop.compliance.revokeRole",
+      () => this.#write("revokeRole", [args.role, args.holder], args.account, "revokeRole")
+    );
+  }
+  /**
+   * Give up `role` yourself.
+   *
+   * The contract's signature is `renounceRole(role, callerConfirmation)` and
+   * it reverts `AccessControlBadConfirmation` unless `callerConfirmation` is
+   * the sender, so this method takes no holder and fills the confirmation from
+   * the resolved sending account. Renouncing for somebody else is not a call
+   * that can succeed; use {@link revokeRole} to remove another account's role.
+   *
+   * @returns The transaction hash.
+   */
+  async renounceRole(args) {
+    const method = "renounceRole";
+    const wallet = this.#requireWallet(method);
+    const account = this.#resolveAccount(wallet, args.account, method);
+    return withTelemetry(
+      this.#telemetry,
+      "fhe-airdrop.compliance.renounceRole",
+      () => this.#write(method, [args.role, accountAddress(account)], account, method)
+    );
+  }
+  // ============================================================
+  //                     INTERNALS (private)
+  // ============================================================
+  async #write(functionName, args, account, method) {
+    const wallet = this.#requireWallet(method);
+    const acct = this.#resolveAccount(wallet, account, method);
+    await this.#preflightWrite(method, functionName, args, acct);
+    try {
+      return await wallet.writeContract({
+        address: this.address,
+        abi: complianceRoleManagerAbi,
+        functionName,
+        args,
+        account: acct,
+        chain: wallet.chain
+      });
+    } catch (err) {
+      throw this.#mapRevert(method, err, acct);
+    }
+  }
+  async #read(functionName, args = []) {
+    const result = await this.publicClient.readContract({
+      address: this.address,
+      abi: complianceRoleManagerAbi,
+      functionName,
+      args
+    });
+    return result;
+  }
+  /**
+   * Simulate a write purely to surface typed reverts.
+   *
+   * The simulate's return value is discarded on principle: this contract
+   * returns nothing from `addDelegate` / `revokeDelegate` anyway, but the
+   * pattern is kept identical to every other airdrop v2 client so a revert is
+   * always decoded before the user pays for it.
+   */
+  async #preflightWrite(method, functionName, args, account) {
+    try {
+      await this.publicClient.simulateContract({
+        address: this.address,
+        abi: complianceRoleManagerAbi,
+        functionName,
+        args,
+        account
+      });
+    } catch (err) {
+      if (isContractRevert(err)) {
+        throw this.#mapRevert(method, err, account);
+      }
+    }
+  }
+  /**
+   * Map a viem error to the SDK's typed palette.
+   *
+   * `productContext` deliberately carries only public identifiers — the
+   * caller, the chain. Never an amount: this contract never handles amounts
+   * at all, but the convention is shared across every airdrop v2 client.
+   */
+  #mapRevert(method, err, account) {
+    return mapContractRevert(err, {
+      method,
+      contractAddress: this.address,
+      abi: complianceRoleManagerAbi,
+      productMapper: airdropProductMapper,
+      account: accountAddress(account),
+      productContext: {
+        creator: accountAddress(account),
+        chainId: this.chainId
+      }
+    });
+  }
+  #requireWallet(method) {
+    if (!this.walletClient) {
+      throw new MissingWalletClientError(method);
+    }
+    return this.walletClient;
+  }
+  #resolveAccount(wallet, override, method) {
+    const acct = override ?? wallet.account;
+    if (!acct) {
+      throw new MissingAccountError(method);
+    }
+    return acct;
+  }
+};
+function createComplianceManagerClient(config) {
+  return new ComplianceManagerClient(config);
+}
+function accountAddress(account) {
+  return typeof account === "string" ? account : account.address;
+}
+
+export { ComplianceManagerClient, complianceRoleManagerAbi, createComplianceManagerClient, isAclPropagationError };