@tokenops/sdk 2.0.0-alpha.1 → 2.0.0-alpha.2

package/CHANGELOG.md

@@ -5,6 +5,35 @@ All notable changes to `@tokenops/sdk` will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.0.0-alpha.2] - 2026-09-10
+
+> **Pre-release built against unaudited contracts.** Continues the `2.0.0-alpha` line. `/fhe-airdrop` in this build targets `tokenops-fhe-airdrop-v2`, frozen at commit `7175ac82f467f0f88c05aba1a4536892999b4251`, which has not completed a final security audit. Every Sepolia `fheAirdrop` address moved in this build, and breaking changes may land between any two alpha builds without a major bump (SemVer prerelease semantics). Published on the `alpha` dist-tag; `latest` stays on `1.6.0`. **For internal testing, not production value.**
+>
+> Migration guide: [`docs/migration/airdrop-v1-to-v2.md`](docs/migration/airdrop-v1-to-v2.md). Support policy: [`SUPPORT.md`](SUPPORT.md).
+
+### Changed — BREAKING
+
+- **`MerkleAirdropClient.claim` and `.getClaimAmount` submit an explicit claim identity.** The contracts gained a leading `address account`, which decoupled the leaf/accounting identity from the address the FHE input proof binds to. A relayer can now settle a leaf on a recipient's behalf.
+- **`CampaignEntry` is `{ account, boundTo, handle, inputProof, merkleProof }`.** `recipient` is removed with **no alias**, as are `MerkleLeafInput.recipient` and `LeafOfArgs.recipient`. The field meant "leaf identity and submitter" at once and those are now different addresses, so an alias would have kept compiling while meaning something else. Entries serialised under `2.0.0-alpha.1` must be re-keyed; their handles remain valid, since leaf hashing did not change.
+- **Every Sepolia `fheAirdrop` address moved.** `claim`'s breaking signature forced a fresh Merkle implementation and the deploy script redeploys the whole system, factory included. Instances created through the previous factory are unreachable from this release, and a campaign planned against it now fails `PredictionDriftError`.
+- `claimAndUnwrap` is deliberately **unchanged** and remains submitted for the caller: publishing an allocation as a plain ERC-20 transfer is the recipient's own choice, so a relayed unwrap is unrepresentable rather than rejected. A `submitter`-bound campaign therefore has no unwrap path.
+- `SenderNotAllowedToUseHandle` is gone from the Merkle ABI — that path no longer calls `FHE.fromExternal`.
+
+### Added
+
+- **Batched relayed rosters are chunked at 32 recipients**, the 2048-bit input-ciphertext limit for `euint64`. `@zama-fhe/sdk` does not enforce it client-side, so an unchunked batch would have failed inside the prover; each chunk's proof is bound to the same submitter, so claims are unaffected.
+- **`submitter?: Address` on every campaign builder** (`CampaignSubmitterOption`, accepted by `buildMerkleCampaign`, `encryptCampaignAmounts`, `planMerkleCampaign` and `rotateMerkleRoot`). Omitted keeps per-recipient binding; set binds the whole roster to one address under a single `encryptUint64Batch` call with one shared `inputProof`. The two shapes are mutually exclusive because an input proof carries exactly one `userAddress`, which is why bulk distribution needs a relayer. Shaped so a per-recipient `submitters?: Address[]` stays additive.
+- **`UnauthorizedRedirectError`** (`TOKENOPS_UNAUTHORIZED_REDIRECT`), carrying `account`, `to` and `submitter` — the relation is the error, so blaming a single argument would mislead. Thrown before the write and mapped from the contract revert. `ZeroAccount` maps to `InvalidArgumentError`.
+- **72 React hooks**, completing parity with the headless surface. Recipient, creator, campaign-owner and compliance-manager tiers on `@tokenops/sdk/fhe-airdrop/react`; the factory-admin tier (fee setters, implementation pointers, policy setters) on `@tokenops/sdk/fhe-airdrop/advanced/react`. Includes the encrypted-view mutations (`useAccessMerkleClaimAmount`, `useAccessEcdsaClaimAmount`, `useAdminGetCurrentBalance` and the disclosure family) that submit a transaction and return a handle recovered from the receipt.
+- `useMemoComplianceManagerClient`, so the compliance-manager surface has a hook path at all.
+
+### Fixed
+
+- **`useMerkleClaim` invalidated the wrong account.** It keyed `getClaimedAmount` on the transaction sender; the contract keys `claimedAmount` on the claim identity, so every relayed claim invalidated the relayer's cache entry and left the recipient's read stale.
+- **`getClaimAmount` extracted the ACL handle for the wrong grantee.** The contract grants the outstanding handle to `account`, never the caller, so a relayed preview threw `ReceiptEventNotFoundError` after its transaction had already been mined. Silent on the self-preview path.
+- The vendored local-fixture bytecode was a commit behind the vendored ABIs, so local Merkle suites deployed an implementation carrying the old `claim` selector.
+- The ABI generator now emits `@alpha` itself, instead of relying on a hand-added tag that every regeneration silently dropped.
+
 ## [1.6.0](https://github.com/VestingLabs/tokenops-sdk/compare/v1.5.1...v1.6.0) (2026-07-28)
 
 ### Features

package/README.md

@@ -32,9 +32,9 @@ All subpaths are independently tree-shakeable. The `/react` paths keep React dep
 | `@tokenops/sdk/fhe-vesting/advanced`       | stable                                                        | Pre-mine address prediction (`predictManagerAddress`)                                                                                                    |
 | `@tokenops/sdk/fhe-vesting/advanced/react` | stable                                                        | React hooks for advanced vesting flows                                                                                                                   |
 | `@tokenops/sdk/fhe-airdrop`                | **v2, unaudited** — `alpha` dist-tag, factory live on Sepolia | ECDSA + Merkle confidential airdrop campaigns — see [Compatibility](#compatibility)                                                                      |
-| `@tokenops/sdk/fhe-airdrop/react`          | **v2, unaudited**                                             | React/wagmi hooks for confidential airdrops                                                                                                              |
+| `@tokenops/sdk/fhe-airdrop/react`          | **v2, unaudited**                                             | React/wagmi hooks for recipients, campaign creators, campaign owners and the compliance manager                                                          |
 | `@tokenops/sdk/fhe-airdrop/advanced`       | **v2, unaudited**                                             | Prediction-freshness / salt-availability guards for CREATE2 address prediction (prediction itself is on the headline `ConfidentialAirdropFactoryClient`) |
-| `@tokenops/sdk/fhe-airdrop/advanced/react` | **v2, unaudited**                                             | `usePredictEcdsaAirdropAddress` / `usePredictMerkleAirdropAddress`                                                                                       |
+| `@tokenops/sdk/fhe-airdrop/advanced/react` | **v2, unaudited**                                             | Address-prediction hooks plus the factory-admin tier (fee setters, implementation pointers, policy setters)                                              |
 | `@tokenops/sdk/fhe-disperse`               | singleton live on mainnet + Sepolia                           | DisperseConfidential (singleton + per-user wallet-pair clones)                                                                                           |
 | `@tokenops/sdk/fhe-disperse/react`         | stable                                                        | React/wagmi hooks for confidential disperse                                                                                                              |
 | `@tokenops/sdk/testnet-faucet`             | token pair live on Sepolia                                    | Testnet faucet for the TokenOps test-token pair — TTT (plain ERC-20) + CTTT (ERC-7984 wrapper); open mint                                                |
@@ -48,7 +48,7 @@ Which contract generation a given SDK version talks to, and where that generatio
 
 | SDK             | Airdrop contracts  | Contract commit | Chains  |
 | --------------- | ------------------ | --------------- | ------- |
-| `2.0.0-alpha.x` | v2 (**unaudited**) | `8e5b144`       | Sepolia |
+| `2.0.0-alpha.x` | v2 (**unaudited**) | `7175ac8`       | Sepolia |
 | `1.x`           | v1                 | n/a             | Sepolia |
 
 `2.x`'s `/fhe-airdrop` is a full replacement of v1, not an extension — see
@@ -284,7 +284,7 @@ See [Confidential Vesting — React hooks on docs.tokenops.xyz](https://docs.tok
 
 ## Quickstart — confidential airdrop
 
-> **v2, unaudited.** `/fhe-airdrop` targets `tokenops-fhe-airdrop-v2` (`8e5b144`, Sepolia only, `alpha` dist-tag) — see [Compatibility](#compatibility). Migrating from `1.x`? See [`docs/migration/airdrop-v1-to-v2.md`](docs/migration/airdrop-v1-to-v2.md).
+> **v2, unaudited.** `/fhe-airdrop` targets `tokenops-fhe-airdrop-v2` (`7175ac8`, Sepolia only, `alpha` dist-tag) — see [Compatibility](#compatibility). Migrating from `1.x`? See [`docs/migration/airdrop-v1-to-v2.md`](docs/migration/airdrop-v1-to-v2.md).
 
 Two claim-authorisation variants share one factory: **ECDSA** (an off-chain signature from a `SIGNER_ROLE` holder) and **Merkle** (inclusion in a published tree). The example below is ECDSA — see [`docs/fhe-airdrop/README.md`](docs/fhe-airdrop/README.md#quickstart--merkle-campaign) for the Merkle flow.
 
@@ -524,7 +524,7 @@ function RecipientClaim({
 }
 ```
 
-See [`docs/fhe-airdrop/README.md`](docs/fhe-airdrop/README.md) for the full hook catalogue (including the Merkle-side `useCreateMerkleAirdrop` / `useMerkleClaim` / `useSetMerkleRoot`), encryptor wiring, address overrides, and query-key reference.
+See [`docs/fhe-airdrop/README.md`](docs/fhe-airdrop/README.md) for the full hook catalogue across both import paths (`/fhe-airdrop/react` for recipients, creators, owners and compliance; `/fhe-airdrop/advanced/react` for prediction and factory admin), encryptor wiring, address overrides, and query-key reference.
 
 ## Quickstart — confidential disperse
 

package/dist/{chunk-JZLGCTGK.cjs → chunk-3YHBO2DL.cjs}

@@ -4,7 +4,7 @@ var chunkTEBM66WA_cjs = require('./chunk-TEBM66WA.cjs');
 var chunkFAXIIH5R_cjs = require('./chunk-FAXIIH5R.cjs');
 var chunkUG5RKLU2_cjs = require('./chunk-UG5RKLU2.cjs');
 var chunkMVDQMV25_cjs = require('./chunk-MVDQMV25.cjs');
-var chunk5576FRT3_cjs = require('./chunk-5576FRT3.cjs');
+var chunkFT5H2Q7Y_cjs = require('./chunk-FT5H2Q7Y.cjs');
 var chunkJK4XMMKM_cjs = require('./chunk-JK4XMMKM.cjs');
 var chunk66IHPTOK_cjs = require('./chunk-66IHPTOK.cjs');
 var chunk67OV5CX2_cjs = require('./chunk-67OV5CX2.cjs');
@@ -2052,7 +2052,7 @@ var ConfidentialDisperseClient = class {
     this.#telemetry = config.telemetry;
     const chainId = config.chainId ?? config.publicClient.chain?.id;
     const addressOverride = config.address ? chunkJK4XMMKM_cjs.normaliseAddress(config.address) : void 0;
-    const resolved = addressOverride ?? (chainId === void 0 ? void 0 : chunk5576FRT3_cjs.getFheDisperseSingletonAddress(chainId));
+    const resolved = addressOverride ?? (chainId === void 0 ? void 0 : chunkFT5H2Q7Y_cjs.getFheDisperseSingletonAddress(chainId));
     if (!resolved) {
       throw new chunk67OV5CX2_cjs.DeploymentAddressUnavailableError({
         reason: chainId === void 0 ? "chain-id-missing" : "registry-not-deployed",

package/dist/{chunk-H5POPGOZ.js → chunk-44YJPMQC.js}

@@ -2,7 +2,7 @@ import { mapZamaError } from './chunk-WMACINXO.js';
 import { getFhevmAclAddress, requireFhevmAclAddress, ACL_ALLOWED_EVENT } from './chunk-ZWXJTBZO.js';
 import { SDK_VERSION } from './chunk-NWFMBLSQ.js';
 import { isContractRevert, mapContractRevert } from './chunk-4RAAATVY.js';
-import { getFheDisperseSingletonAddress } from './chunk-DZHYSUGY.js';
+import { getFheDisperseSingletonAddress } from './chunk-A4DCEE33.js';
 import { normaliseAddress } from './chunk-ZA673I3O.js';
 import { asExternalInputProof, asEncryptedHandle } from './chunk-KWFFIJYX.js';
 import { InvalidArgumentError, TokenOpsSdkError, DeploymentAddressUnavailableError, PausedError, InsufficientFeeError, MissingEncryptorError, ReceiptEventAmbiguousError, MissingWalletClientError, MissingAccountError, BatchTooLargeError } from './chunk-QBJ7O2B4.js';

package/dist/{chunk-DZHYSUGY.js → chunk-A4DCEE33.js}

@@ -8,22 +8,28 @@ var DEPLOYED_ADDRESSES = {
       // mainnet omitted — not deployed.
     }
   },
-  // Airdrop v2 (tokenops-fhe-airdrop-v2 @ 8e5b144). The four contracts deploy
+  // Airdrop v2 (tokenops-fhe-airdrop-v2 @ 7175ac8). The four contracts deploy
   // together in one scripted run, so a chain either has all of them or none —
   // which is what `chainsWithDeployment` assumes.
+  //
+  // Every address moved at 7175ac8: `claim`'s breaking signature change forced a
+  // fresh Merkle implementation, and the run redeploys the whole system rather
+  // than repointing one implementation slot. A campaign planned against the old
+  // factory therefore predicts an address the new factory will never produce —
+  // `PredictionDriftError` is what catches that.
   fheAirdrop: {
     airdropFactory: {
-      [sepolia.id]: "0x383083B6f13a0ee513596A6750B511c5E482d2d1"
+      [sepolia.id]: "0x174A7CB40F64aBC4C95CecB4172A066Cf531e4E9"
       // mainnet omitted — ZamaConfig-gated, not deployed.
     },
     ecdsaImplementation: {
-      [sepolia.id]: "0xefE40570C1837210f8E4Ae938635e11bd1ae788E"
+      [sepolia.id]: "0xDeD7AB391f87B8F891F89AaEC64C7c9C800C6645"
     },
     merkleImplementation: {
-      [sepolia.id]: "0x9f3156546744F3ceE98Dc44bed817d98A8b8ae74"
+      [sepolia.id]: "0x815E65Cdd707F07F09332537b47C530d0E87aAf5"
     },
     complianceManagerImplementation: {
-      [sepolia.id]: "0x6adA841250C048364d1d3027958C662Dd4E62136"
+      [sepolia.id]: "0x885474FA494748C85410482244a406C6Ad570CCe"
     }
   },
   fheDisperse: {

package/dist/{chunk-M4IT6DNJ.cjs → chunk-AREQJHKA.cjs}

@@ -5,7 +5,7 @@ var chunk67OV5CX2_cjs = require('./chunk-67OV5CX2.cjs');
 var viem = require('viem');
 
 // src/fhe-airdrop/constants.ts
-var AIRDROP_CONTRACTS_COMMIT = "8e5b144bdbcdf35b9f36b62f5257d795bf954e8e";
+var AIRDROP_CONTRACTS_COMMIT = "7175ac82f467f0f88c05aba1a4536892999b4251";
 var DEPLOYMENT_MODE = { clone: 0, uups: 1 };
 var DEDUP_MODE = { perAddress: 0, perDedupId: 1, both: 2, none: 3 };
 
@@ -37,6 +37,25 @@ var NonStockWrapperError = class extends chunk67OV5CX2_cjs.TokenOpsSdkError {
     );
   }
 };
+var UnauthorizedRedirectError = class extends chunk67OV5CX2_cjs.TokenOpsSdkError {
+  name = "UnauthorizedRedirectError";
+  constructor(args) {
+    const who = args?.submitter ? ` (submitter: ${args.submitter})` : "";
+    super(
+      `Only the claim identity may redirect its own payout${who}: \`to\` (${args?.to ?? "unknown"}) differs from \`account\` (${args?.account ?? "unknown"}) and the submitter is not that account. Leave \`to\` unset (or equal to \`account\`) when submitting on someone else's behalf.`,
+      {
+        code: "TOKENOPS_UNAUTHORIZED_REDIRECT",
+        cause: args?.cause,
+        context: {
+          constraint: "merkle-third-party-redirect",
+          account: args?.account,
+          to: args?.to,
+          submitter: args?.submitter
+        }
+      }
+    );
+  }
+};
 var SaltCollisionError = class extends chunk67OV5CX2_cjs.TokenOpsSdkError {
   name = "SaltCollisionError";
   constructor(args) {
@@ -241,6 +260,22 @@ var airdropProductMapper = (name, errArgs, ctx) => {
       });
     case "RootImmutable":
       return new chunk67OV5CX2_cjs.FeatureDisabledError({ ...ctx, feature: "merkleRootRotation" });
+    case "ZeroAccount":
+      return invalidArg(
+        ctx,
+        "account",
+        name,
+        "the claim identity is mandatory and is never defaulted from the caller"
+      );
+    case "UnauthorizedRedirect": {
+      const account = errArgs?.[0];
+      const to = errArgs?.[1];
+      return new UnauthorizedRedirectError({
+        account,
+        to,
+        submitter: ctx.productContext?.["creator"]
+      });
+    }
     // ---- FHEVM chain config ---------------------------------------------
     case "ZamaProtocolUnsupported": {
       const chainId = ctx.productContext?.["chainId"] ?? 0;
@@ -515,18 +550,86 @@ async function preflightCreate(args) {
   }
   return { ready: blockers.length === 0, blockers };
 }
+function assertMerkleClaimIdentity(args) {
+  const { method, account, submitter, boundTo, to, entrypoint = "claim" } = args;
+  for (const [argument, value] of [
+    ["account", account],
+    ["entry.boundTo", boundTo],
+    ["to", to],
+    ["submitter", submitter]
+  ]) {
+    if (value !== void 0 && !viem.isAddress(value, { strict: false })) {
+      throw new chunk67OV5CX2_cjs.InvalidArgumentError({
+        method,
+        argument,
+        reason: "is not a 20-byte hex address",
+        value
+      });
+    }
+  }
+  if (viem.isAddressEqual(account, viem.zeroAddress)) {
+    throw new chunk67OV5CX2_cjs.InvalidArgumentError({
+      method,
+      argument: "account",
+      reason: "is the zero address; the claim identity is mandatory and is never defaulted from the caller"
+    });
+  }
+  if (boundTo !== void 0 && !viem.isAddressEqual(boundTo, submitter)) {
+    throw new chunk67OV5CX2_cjs.InvalidArgumentError({
+      method,
+      argument: "entry.boundTo",
+      reason: `is ${boundTo}, but this transaction is sent from ${submitter}; the FHE input proof is bound to the sender, so only ${boundTo} can submit this entry`
+    });
+  }
+  if (entrypoint === "claimAndUnwrap") {
+    if (!viem.isAddressEqual(account, submitter)) {
+      throw new chunk67OV5CX2_cjs.InvalidArgumentError({
+        method,
+        argument: "entry.account",
+        reason: `is ${account}, but \`claimAndUnwrap\` is always submitted for the caller (${submitter}); use \`claim\` to settle on someone else's behalf`
+      });
+    }
+    return;
+  }
+  const beneficiary = to === void 0 || viem.isAddressEqual(to, viem.zeroAddress) ? account : to;
+  if (!viem.isAddressEqual(beneficiary, account) && !viem.isAddressEqual(submitter, account)) {
+    throw new UnauthorizedRedirectError({ account, to: beneficiary, submitter });
+  }
+}
 async function preflightClaim(args) {
   const { airdrop, claimant } = args;
   const method = "preflightClaim";
   const blockers = [];
   collect(blockers, () => assertSupportedChain(airdrop.chainId));
-  const [started, ended, paused, fee, balance] = await Promise.all([
+  if (args.account !== void 0 || args.entrypoint !== void 0) {
+    collect(
+      blockers,
+      () => assertMerkleClaimIdentity({
+        method,
+        account: args.account ?? claimant,
+        submitter: claimant,
+        to: args.to,
+        entrypoint: args.entrypoint
+      })
+    );
+  }
+  const [started, ended, paused, fee, balance, unwrappable] = await Promise.all([
     airdrop.hasClaimStarted(),
     airdrop.hasClaimEnded(),
     airdrop.paused(),
     airdrop.gasFee(),
-    airdrop.publicClient.getBalance({ address: claimant })
+    airdrop.publicClient.getBalance({ address: claimant }),
+    args.entrypoint === "claimAndUnwrap" && airdrop.unwrappable ? airdrop.unwrappable() : Promise.resolve(true)
   ]);
+  if (!unwrappable) {
+    blockers.push(
+      new chunk67OV5CX2_cjs.FeatureDisabledError({
+        method,
+        contractAddress: airdrop.address,
+        feature: "claimAndUnwrap"
+      })
+    );
+  }
   if (paused) {
     blockers.push(new chunk67OV5CX2_cjs.PausedError({ method, contractAddress: airdrop.address }));
   }
@@ -597,8 +700,10 @@ exports.NonStockWrapperError = NonStockWrapperError;
 exports.PredictionDriftError = PredictionDriftError;
 exports.SaltCollisionError = SaltCollisionError;
 exports.SignatureExpiredError = SignatureExpiredError;
+exports.UnauthorizedRedirectError = UnauthorizedRedirectError;
 exports.UpgradeabilityNotAllowedError = UpgradeabilityNotAllowedError;
 exports.airdropProductMapper = airdropProductMapper;
+exports.assertMerkleClaimIdentity = assertMerkleClaimIdentity;
 exports.assertMerkleModeSupported = assertMerkleModeSupported;
 exports.assertPredictionFresh = assertPredictionFresh;
 exports.assertSaltAvailable = assertSaltAvailable;

package/dist/chunk-EBLBPUPI.cjs

@@ -0,0 +1,255 @@
+'use strict';
+
+var chunkPZZK3O3S_cjs = require('./chunk-PZZK3O3S.cjs');
+var chunkFT5H2Q7Y_cjs = require('./chunk-FT5H2Q7Y.cjs');
+var chunk67OV5CX2_cjs = require('./chunk-67OV5CX2.cjs');
+var react = require('react');
+var wagmi = require('wagmi');
+
+var FHE_AIRDROP_KEY = "tokenops-sdk";
+var FHE_AIRDROP_NAMESPACE = "fhe-airdrop";
+function airdropQueryKey(params) {
+  return [
+    FHE_AIRDROP_KEY,
+    FHE_AIRDROP_NAMESPACE,
+    params.chainId ?? null,
+    params.address ? normalizeKeyArg(params.address) : null,
+    params.fn,
+    params.args.map(normalizeKeyArg)
+  ];
+}
+function airdropQueryKeyPrefix(params) {
+  const prefix = [
+    FHE_AIRDROP_KEY,
+    FHE_AIRDROP_NAMESPACE,
+    params.chainId ?? null,
+    params.address ? normalizeKeyArg(params.address) : null
+  ];
+  if (params.fn !== void 0) prefix.push(params.fn);
+  return prefix;
+}
+function normalizeKeyArg(value) {
+  if (typeof value === "bigint") return value.toString();
+  if (Array.isArray(value)) return value.map(normalizeKeyArg);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([k, v]) => [k, normalizeKeyArg(v)])
+    );
+  }
+  if (typeof value === "string" && value.startsWith("0x")) return value.toLowerCase();
+  return value;
+}
+function tryResolveAirdropFactoryAddress(override, chainId) {
+  if (override) return override;
+  if (chainId === void 0) return void 0;
+  return chunkFT5H2Q7Y_cjs.getFheAirdropFactoryAddress(chainId);
+}
+function computeAirdropFactoryResolutionError(override, chainId) {
+  if (override) return void 0;
+  if (chainId === void 0) {
+    return new chunk67OV5CX2_cjs.DeploymentAddressUnavailableError({
+      reason: "chain-id-missing",
+      product: "fheAirdrop",
+      contract: "airdropFactory",
+      clientLabel: "ConfidentialAirdropFactoryClient"
+    });
+  }
+  const resolved = chunkFT5H2Q7Y_cjs.getFheAirdropFactoryAddress(chainId);
+  if (!resolved) {
+    return new chunk67OV5CX2_cjs.DeploymentAddressUnavailableError({
+      reason: "registry-not-deployed",
+      product: "fheAirdrop",
+      contract: "airdropFactory",
+      chainId,
+      clientLabel: "ConfidentialAirdropFactoryClient"
+    });
+  }
+  return void 0;
+}
+function useMemoAirdropFactoryClient(opts = {}) {
+  const publicClient = wagmi.usePublicClient({ chainId: opts.chainId });
+  const { data: walletClient } = wagmi.useWalletClient({ chainId: opts.chainId });
+  const chainId = opts.chainId ?? publicClient?.chain?.id;
+  const resolvedAddress = tryResolveAirdropFactoryAddress(opts.address, chainId);
+  const resolutionError = computeAirdropFactoryResolutionError(opts.address, chainId);
+  const encryptorSourceRef = react.useRef(opts.encryptor);
+  encryptorSourceRef.current = opts.encryptor;
+  const telemetry = opts.telemetry;
+  const client = react.useMemo(() => {
+    if (!publicClient) return void 0;
+    if (!resolvedAddress) return void 0;
+    return chunkPZZK3O3S_cjs.createConfidentialAirdropFactoryClient({
+      publicClient,
+      ...walletClient ? { walletClient } : {},
+      address: resolvedAddress,
+      ...chainId !== void 0 ? { chainId } : {},
+      // Lazy — invoked per-encryption inside the headless client.
+      encryptor: () => chunkPZZK3O3S_cjs.resolveEncryptor(encryptorSourceRef.current),
+      ...telemetry ? { telemetry } : {}
+    });
+  }, [publicClient, walletClient, resolvedAddress, chainId, telemetry]);
+  return {
+    client,
+    resolutionError,
+    publicClient,
+    walletClient: walletClient ?? void 0,
+    chainId,
+    resolvedAddress
+  };
+}
+function useMemoAirdropBaseClient(opts) {
+  const publicClient = wagmi.usePublicClient({ chainId: opts.chainId });
+  const { data: walletClient } = wagmi.useWalletClient({ chainId: opts.chainId });
+  const chainId = opts.chainId ?? publicClient?.chain?.id;
+  const telemetry = opts.telemetry;
+  const client = react.useMemo(() => {
+    if (!publicClient) return void 0;
+    if (!opts.address) return void 0;
+    return chunkPZZK3O3S_cjs.createAirdropBaseClient({
+      publicClient,
+      ...walletClient ? { walletClient } : {},
+      address: opts.address,
+      ...chainId !== void 0 ? { chainId } : {},
+      ...telemetry ? { telemetry } : {}
+    });
+  }, [publicClient, walletClient, opts.address, chainId, telemetry]);
+  return { client, publicClient, walletClient: walletClient ?? void 0, chainId };
+}
+function useMemoMerkleAirdropClient(opts) {
+  const publicClient = wagmi.usePublicClient({ chainId: opts.chainId });
+  const { data: walletClient } = wagmi.useWalletClient({ chainId: opts.chainId });
+  const chainId = opts.chainId ?? publicClient?.chain?.id;
+  const telemetry = opts.telemetry;
+  const client = react.useMemo(() => {
+    if (!publicClient) return void 0;
+    if (!opts.address) return void 0;
+    return chunkPZZK3O3S_cjs.createMerkleAirdropClient({
+      publicClient,
+      ...walletClient ? { walletClient } : {},
+      address: opts.address,
+      ...chainId !== void 0 ? { chainId } : {},
+      ...telemetry ? { telemetry } : {}
+    });
+  }, [publicClient, walletClient, opts.address, chainId, telemetry]);
+  return { client, publicClient, walletClient: walletClient ?? void 0, chainId };
+}
+function useMemoComplianceManagerClient(opts) {
+  const publicClient = wagmi.usePublicClient({ chainId: opts.chainId });
+  const { data: walletClient } = wagmi.useWalletClient({ chainId: opts.chainId });
+  const chainId = opts.chainId ?? publicClient?.chain?.id;
+  const telemetry = opts.telemetry;
+  const client = react.useMemo(() => {
+    if (!publicClient) return void 0;
+    if (!opts.address) return void 0;
+    return chunkPZZK3O3S_cjs.createComplianceManagerClient({
+      publicClient,
+      ...walletClient ? { walletClient } : {},
+      address: opts.address,
+      ...chainId !== void 0 ? { chainId } : {},
+      ...telemetry ? { telemetry } : {}
+    });
+  }, [publicClient, walletClient, opts.address, chainId, telemetry]);
+  return { client, publicClient, walletClient: walletClient ?? void 0, chainId };
+}
+function useMemoEcdsaAirdropClient(opts) {
+  const publicClient = wagmi.usePublicClient({ chainId: opts.chainId });
+  const { data: walletClient } = wagmi.useWalletClient({ chainId: opts.chainId });
+  const chainId = opts.chainId ?? publicClient?.chain?.id;
+  const telemetry = opts.telemetry;
+  const client = react.useMemo(() => {
+    if (!publicClient) return void 0;
+    if (!opts.address) return void 0;
+    return chunkPZZK3O3S_cjs.createEcdsaAirdropClient({
+      publicClient,
+      ...walletClient ? { walletClient } : {},
+      address: opts.address,
+      dedupMode: opts.dedupMode,
+      ...chainId !== void 0 ? { chainId } : {},
+      ...telemetry ? { telemetry } : {}
+    });
+  }, [publicClient, walletClient, opts.address, opts.dedupMode, chainId, telemetry]);
+  return { client, publicClient, walletClient: walletClient ?? void 0, chainId };
+}
+
+// src/fhe-airdrop/react/keys.ts
+var AIRDROP_FN = {
+  // instance reads
+  claimedAmount: "getClaimedAmount",
+  paused: "paused",
+  window: "window",
+  config: "config",
+  merkleRoot: "merkleRoot",
+  merkleRootMutable: "isMerkleRootMutable",
+  hasRole: "hasRole",
+  roleMembers: "roleMembers",
+  gasFee: "gasFee",
+  preflightCreate: "preflightCreate",
+  isSignatureValid: "isSignatureValid",
+  // factory reads
+  fees: "fees",
+  registry: "registry",
+  customFee: "customFee",
+  implementations: "implementations",
+  compliancePolicy: "compliancePolicy",
+  upgradeabilityPolicy: "upgradeabilityPolicy",
+  factoryHasRole: "factoryHasRole",
+  factoryRoleMembers: "factoryRoleMembers",
+  // compliance-manager reads
+  complianceInfo: "complianceInfo",
+  activeDelegate: "isActiveDelegate",
+  clientDelegates: "clientDelegates",
+  complianceHasRole: "complianceHasRole",
+  complianceRoleMembers: "complianceRoleMembers"
+};
+var airdropKeys = {
+  /** One account's cumulative delivered total. Keyed on the CLAIM IDENTITY, never the sender. */
+  claimedAmount: (s, account) => airdropQueryKey({ ...s, fn: AIRDROP_FN.claimedAmount, args: [account] }),
+  paused: (s) => airdropQueryKey({ ...s, fn: AIRDROP_FN.paused, args: [] }),
+  window: (s) => airdropQueryKey({ ...s, fn: AIRDROP_FN.window, args: [] }),
+  config: (s) => airdropQueryKey({ ...s, fn: AIRDROP_FN.config, args: [] }),
+  gasFee: (s) => airdropQueryKey({ ...s, fn: AIRDROP_FN.gasFee, args: [] }),
+  merkleRoot: (s) => airdropQueryKey({ ...s, fn: AIRDROP_FN.merkleRoot, args: [] }),
+  merkleRootMutable: (s) => airdropQueryKey({ ...s, fn: AIRDROP_FN.merkleRootMutable, args: [] }),
+  hasRole: (s, role, holder) => airdropQueryKey({ ...s, fn: AIRDROP_FN.hasRole, args: [role, holder] }),
+  /** Every cached `hasRole` for this instance, whatever role/holder pair was queried. */
+  hasRoleAll: (s) => airdropQueryKeyPrefix({ ...s, fn: AIRDROP_FN.hasRole }),
+  roleMembers: (s, role) => airdropQueryKey({ ...s, fn: AIRDROP_FN.roleMembers, args: [role] }),
+  roleMembersAll: (s) => airdropQueryKeyPrefix({ ...s, fn: AIRDROP_FN.roleMembers }),
+  /** Every cached create-preflight, whatever params/mode/salt combination was queried. */
+  preflightCreateAll: (s) => airdropQueryKeyPrefix({ ...s, fn: AIRDROP_FN.preflightCreate }),
+  /** Every cached signature check on this instance; a claim consumes a digest and flips it. */
+  isSignatureValidAll: (s) => airdropQueryKeyPrefix({ ...s, fn: AIRDROP_FN.isSignatureValid }),
+  fees: (s) => airdropQueryKey({ ...s, fn: AIRDROP_FN.fees, args: [] }),
+  customFee: (s, creator) => airdropQueryKey({ ...s, fn: AIRDROP_FN.customFee, args: [creator] }),
+  customFeeAll: (s) => airdropQueryKeyPrefix({ ...s, fn: AIRDROP_FN.customFee }),
+  /** Every registry page, whatever offset/limit was queried. */
+  registryAll: (s) => airdropQueryKeyPrefix({ ...s, fn: AIRDROP_FN.registry }),
+  implementations: (s) => airdropQueryKey({ ...s, fn: AIRDROP_FN.implementations, args: [] }),
+  compliancePolicy: (s, creator) => airdropQueryKey({ ...s, fn: AIRDROP_FN.compliancePolicy, args: [creator] }),
+  compliancePolicyAll: (s) => airdropQueryKeyPrefix({ ...s, fn: AIRDROP_FN.compliancePolicy }),
+  upgradeabilityPolicy: (s, creator) => airdropQueryKey({ ...s, fn: AIRDROP_FN.upgradeabilityPolicy, args: [creator] }),
+  upgradeabilityPolicyAll: (s) => airdropQueryKeyPrefix({ ...s, fn: AIRDROP_FN.upgradeabilityPolicy }),
+  factoryHasRole: (s, role, holder) => airdropQueryKey({ ...s, fn: AIRDROP_FN.factoryHasRole, args: [role, holder] }),
+  factoryHasRoleAll: (s) => airdropQueryKeyPrefix({ ...s, fn: AIRDROP_FN.factoryHasRole }),
+  factoryRoleMembers: (s, role) => airdropQueryKey({ ...s, fn: AIRDROP_FN.factoryRoleMembers, args: [role] }),
+  factoryRoleMembersAll: (s) => airdropQueryKeyPrefix({ ...s, fn: AIRDROP_FN.factoryRoleMembers }),
+  complianceInfo: (s) => airdropQueryKey({ ...s, fn: AIRDROP_FN.complianceInfo, args: [] }),
+  activeDelegate: (s, delegate) => airdropQueryKey({ ...s, fn: AIRDROP_FN.activeDelegate, args: [delegate] }),
+  activeDelegateAll: (s) => airdropQueryKeyPrefix({ ...s, fn: AIRDROP_FN.activeDelegate }),
+  clientDelegates: (s, index) => airdropQueryKey({ ...s, fn: AIRDROP_FN.clientDelegates, args: [index] }),
+  clientDelegatesAll: (s) => airdropQueryKeyPrefix({ ...s, fn: AIRDROP_FN.clientDelegates }),
+  complianceHasRole: (s, role, holder) => airdropQueryKey({ ...s, fn: AIRDROP_FN.complianceHasRole, args: [role, holder] }),
+  complianceHasRoleAll: (s) => airdropQueryKeyPrefix({ ...s, fn: AIRDROP_FN.complianceHasRole }),
+  complianceRoleMembers: (s, role) => airdropQueryKey({ ...s, fn: AIRDROP_FN.complianceRoleMembers, args: [role] }),
+  complianceRoleMembersAll: (s) => airdropQueryKeyPrefix({ ...s, fn: AIRDROP_FN.complianceRoleMembers })
+};
+
+exports.AIRDROP_FN = AIRDROP_FN;
+exports.airdropKeys = airdropKeys;
+exports.airdropQueryKey = airdropQueryKey;
+exports.airdropQueryKeyPrefix = airdropQueryKeyPrefix;
+exports.useMemoAirdropBaseClient = useMemoAirdropBaseClient;
+exports.useMemoAirdropFactoryClient = useMemoAirdropFactoryClient;
+exports.useMemoComplianceManagerClient = useMemoComplianceManagerClient;
+exports.useMemoEcdsaAirdropClient = useMemoEcdsaAirdropClient;
+exports.useMemoMerkleAirdropClient = useMemoMerkleAirdropClient;