@tokenops/sdk 2.0.0-alpha.1 → 2.0.0-alpha.3

package/dist/{chunk-PUX5VXDB.cjs → chunk-4AWQJQXY.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
-var chunkM4IT6DNJ_cjs = require('./chunk-M4IT6DNJ.cjs');
+var chunkYTIYTV4K_cjs = require('./chunk-YTIYTV4K.cjs');
 var chunkFAXIIH5R_cjs = require('./chunk-FAXIIH5R.cjs');
 var chunkUG5RKLU2_cjs = require('./chunk-UG5RKLU2.cjs');
 var chunkMVDQMV25_cjs = require('./chunk-MVDQMV25.cjs');
-var chunk5576FRT3_cjs = require('./chunk-5576FRT3.cjs');
+var chunkPG3WXT3K_cjs = require('./chunk-PG3WXT3K.cjs');
 var chunkJK4XMMKM_cjs = require('./chunk-JK4XMMKM.cjs');
 var chunk66IHPTOK_cjs = require('./chunk-66IHPTOK.cjs');
 var chunk67OV5CX2_cjs = require('./chunk-67OV5CX2.cjs');
@@ -71,6 +71,11 @@ var airdropFactoryAbi = [
         internalType: "uint96",
         name: "defaultGasFee_",
         type: "uint96"
+      },
+      {
+        internalType: "uint96",
+        name: "maxGasFee_",
+        type: "uint96"
       }
     ],
     stateMutability: "nonpayable",
@@ -175,6 +180,38 @@ var airdropFactoryAbi = [
     name: "FailedDeployment",
     type: "error"
   },
+  {
+    inputs: [
+      {
+        internalType: "uint96",
+        name: "gasFee",
+        type: "uint96"
+      },
+      {
+        internalType: "uint96",
+        name: "maxGasFee",
+        type: "uint96"
+      }
+    ],
+    name: "GasFeeExceedsMaximum",
+    type: "error"
+  },
+  {
+    inputs: [
+      {
+        internalType: "uint96",
+        name: "resolvedFee",
+        type: "uint96"
+      },
+      {
+        internalType: "uint96",
+        name: "maxAcceptedGasFee",
+        type: "uint96"
+      }
+    ],
+    name: "GasFeeNotAccepted",
+    type: "error"
+  },
   {
     inputs: [
       {
@@ -393,6 +430,11 @@ var airdropFactoryAbi = [
     name: "ZeroToken",
     type: "error"
   },
+  {
+    inputs: [],
+    name: "ZeroUnwrapRequestId",
+    type: "error"
+  },
   {
     anonymous: false,
     inputs: [
@@ -425,6 +467,12 @@ var airdropFactoryAbi = [
         internalType: "uint256",
         name: "deploymentBlockNumber",
         type: "uint256"
+      },
+      {
+        indexed: false,
+        internalType: "uint256",
+        name: "gasFee",
+        type: "uint256"
       }
     ],
     name: "AirdropInitialized",
@@ -929,6 +977,19 @@ var airdropFactoryAbi = [
     name: "SetDefaultGasFee",
     type: "event"
   },
+  {
+    anonymous: false,
+    inputs: [
+      {
+        indexed: false,
+        internalType: "uint256",
+        name: "maxGasFee",
+        type: "uint256"
+      }
+    ],
+    name: "SetMaxGasFee",
+    type: "event"
+  },
   {
     anonymous: false,
     inputs: [
@@ -1220,6 +1281,11 @@ var airdropFactoryAbi = [
                 internalType: "address",
                 name: "complianceAdmin",
                 type: "address"
+              },
+              {
+                internalType: "uint96",
+                name: "maxAcceptedGasFee",
+                type: "uint96"
               }
             ],
             internalType: "struct IAirdropFactory.CommonAirdropParams",
@@ -1308,6 +1374,11 @@ var airdropFactoryAbi = [
                 internalType: "address",
                 name: "complianceAdmin",
                 type: "address"
+              },
+              {
+                internalType: "uint96",
+                name: "maxAcceptedGasFee",
+                type: "uint96"
               }
             ],
             internalType: "struct IAirdropFactory.CommonAirdropParams",
@@ -1396,6 +1467,11 @@ var airdropFactoryAbi = [
                 internalType: "address",
                 name: "complianceAdmin",
                 type: "address"
+              },
+              {
+                internalType: "uint96",
+                name: "maxAcceptedGasFee",
+                type: "uint96"
               }
             ],
             internalType: "struct IAirdropFactory.CommonAirdropParams",
@@ -1474,6 +1550,11 @@ var airdropFactoryAbi = [
                 internalType: "address",
                 name: "complianceAdmin",
                 type: "address"
+              },
+              {
+                internalType: "uint96",
+                name: "maxAcceptedGasFee",
+                type: "uint96"
               }
             ],
             internalType: "struct IAirdropFactory.CommonAirdropParams",
@@ -1740,6 +1821,11 @@ var airdropFactoryAbi = [
                 internalType: "address",
                 name: "complianceAdmin",
                 type: "address"
+              },
+              {
+                internalType: "uint96",
+                name: "maxAcceptedGasFee",
+                type: "uint96"
               }
             ],
             internalType: "struct IAirdropFactory.CommonAirdropParams",
@@ -1813,6 +1899,11 @@ var airdropFactoryAbi = [
                 internalType: "address",
                 name: "complianceAdmin",
                 type: "address"
+              },
+              {
+                internalType: "uint96",
+                name: "maxAcceptedGasFee",
+                type: "uint96"
               }
             ],
             internalType: "struct IAirdropFactory.CommonAirdropParams",
@@ -2005,6 +2096,38 @@ var airdropFactoryAbi = [
     stateMutability: "view",
     type: "function"
   },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "candidate",
+        type: "address"
+      }
+    ],
+    name: "isAirdrop",
+    outputs: [
+      {
+        internalType: "bool",
+        name: "",
+        type: "bool"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [],
+    name: "maxGasFee",
+    outputs: [
+      {
+        internalType: "uint256",
+        name: "",
+        type: "uint256"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
   {
     inputs: [],
     name: "merkleImplementation",
@@ -2053,6 +2176,11 @@ var airdropFactoryAbi = [
                 internalType: "address",
                 name: "complianceAdmin",
                 type: "address"
+              },
+              {
+                internalType: "uint96",
+                name: "maxAcceptedGasFee",
+                type: "uint96"
               }
             ],
             internalType: "struct IAirdropFactory.CommonAirdropParams",
@@ -2136,6 +2264,11 @@ var airdropFactoryAbi = [
                 internalType: "address",
                 name: "complianceAdmin",
                 type: "address"
+              },
+              {
+                internalType: "uint96",
+                name: "maxAcceptedGasFee",
+                type: "uint96"
               }
             ],
             internalType: "struct IAirdropFactory.CommonAirdropParams",
@@ -2347,6 +2480,19 @@ var airdropFactoryAbi = [
     stateMutability: "nonpayable",
     type: "function"
   },
+  {
+    inputs: [
+      {
+        internalType: "uint96",
+        name: "maxGasFee_",
+        type: "uint96"
+      }
+    ],
+    name: "setMaxGasFee",
+    outputs: [],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
   {
     inputs: [
       {
@@ -2765,6 +2911,11 @@ var ecdsaConfidentialAirdropAbi = [
     name: "ZeroToken",
     type: "error"
   },
+  {
+    inputs: [],
+    name: "ZeroUnwrapRequestId",
+    type: "error"
+  },
   {
     anonymous: false,
     inputs: [
@@ -2797,6 +2948,12 @@ var ecdsaConfidentialAirdropAbi = [
         internalType: "uint256",
         name: "deploymentBlockNumber",
         type: "uint256"
+      },
+      {
+        indexed: false,
+        internalType: "uint256",
+        name: "gasFee",
+        type: "uint256"
       }
     ],
     name: "AirdropInitialized",
@@ -3909,6 +4066,19 @@ var ecdsaConfidentialAirdropAbi = [
     stateMutability: "view",
     type: "function"
   },
+  {
+    inputs: [],
+    name: "refreshComplianceBalance",
+    outputs: [
+      {
+        internalType: "euint64",
+        name: "balance",
+        type: "bytes32"
+      }
+    ],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
   {
     inputs: [
       {
@@ -4296,6 +4466,11 @@ var confidentialAirdropBaseAbi = [
     name: "ZeroToken",
     type: "error"
   },
+  {
+    inputs: [],
+    name: "ZeroUnwrapRequestId",
+    type: "error"
+  },
   {
     anonymous: false,
     inputs: [
@@ -4328,6 +4503,12 @@ var confidentialAirdropBaseAbi = [
         internalType: "uint256",
         name: "deploymentBlockNumber",
         type: "uint256"
+      },
+      {
+        indexed: false,
+        internalType: "uint256",
+        name: "gasFee",
+        type: "uint256"
       }
     ],
     name: "AirdropInitialized",
@@ -4804,6 +4985,19 @@ var confidentialAirdropBaseAbi = [
     stateMutability: "nonpayable",
     type: "function"
   },
+  {
+    inputs: [],
+    name: "refreshComplianceBalance",
+    outputs: [
+      {
+        internalType: "euint64",
+        name: "balance",
+        type: "bytes32"
+      }
+    ],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
   {
     inputs: [
       {
@@ -5101,7 +5295,7 @@ var AirdropBaseClient = class {
         clientLabel: "AirdropBaseClient"
       });
     }
-    chunkM4IT6DNJ_cjs.assertSupportedChain(chainId);
+    chunkYTIYTV4K_cjs.assertSupportedChain(chainId);
     this.chainId = chainId;
     this.address = chunkJK4XMMKM_cjs.normaliseAddress(config.address);
     this.aclAddress = config.aclAddress ? chunkJK4XMMKM_cjs.normaliseAddress(config.aclAddress) : chunkFAXIIH5R_cjs.requireFhevmAclAddress(chainId, "AirdropBaseClient");
@@ -5203,8 +5397,12 @@ var AirdropBaseClient = class {
    * Sweep a plain ERC-20 that was sent to the instance by mistake. Requires
    * `RESCUER_ROLE`.
    *
-   * The campaign's own token is ERC-7984, not ERC-20, so it cannot be reached
-   * through this path — use {@link withdrawConfidential} for the pool.
+   * Passing the campaign's own token reverts `CannotRescueAirdropToken`
+   * (audit-05), matching {@link rescueOtherConfidentialToken}. ERC-7984 and
+   * ERC-20 are not disjoint in practice - a wrapper token answers both
+   * interfaces - so "the pool token is confidential, therefore out of reach
+   * here" was never a guarantee, only an assumption. Use
+   * {@link withdrawConfidential} for the pool.
    *
    * @returns The transaction hash.
    */
@@ -5564,17 +5762,56 @@ var AirdropBaseClient = class {
   //                    DISCLOSURE (ENCRYPTED)
   // ============================================================
   //
-  // The first three read like getters and are `nonpayable` in the ABI: they
+  // The first four read like getters and are `nonpayable` in the ABI: they
   // call `FHE.allow`, which writes ACL state. They therefore submit a
   // transaction and recover their `euint64` result from the receipt — never
   // from a simulation. See `extractGrantedHandle`.
   //
+  // Three of those four grant the CALLER; `refreshComplianceBalance` grants the
+  // compliance clone instead, which is why it resolves the clone address and
+  // passes it as `grantee`.
+  //
   // The last two return nothing on-chain and are ordinary writes: they grant a
   // handle the caller already has, so there is no new handle to recover.
+  /**
+   * Re-grant the compliance-manager clone on the instance's current pool
+   * balance, and return the handle it was granted on.
+   *
+   * **Permissionless, and deliberately so** (audit-04). The token rotates the
+   * instance's balance handle on every incoming transfer, including one no
+   * airdrop code observes - a third party transferring in directly - and
+   * grants the fresh handle to the token and the holder only. Without this the
+   * compliance clone's grant can be stranded on a handle the token has already
+   * replaced, with no admin necessarily around to restore it. There is no
+   * argument to abuse: the only handle read is `address(this)`'s own balance,
+   * and the only grantee is the clone wired at initialization.
+   *
+   * This is therefore the normative way to obtain a readable live-balance
+   * handle - and it is a **snapshot, not a subscription**. Grants are
+   * append-only, so the handle this returns stays readable forever; but the
+   * next incoming transfer rotates the instance to a NEW handle the clone was
+   * never granted on. A compliance reader that refreshes once and stops is
+   * reading a stale balance, not a live one. Call it again after any transfer
+   * in, or before each read.
+   *
+   * @returns `{ handle, hash }` - the handle the compliance clone may now decrypt.
+   * @throws {@link ReceiptEventNotFoundError} when the transaction granted no ACL to the clone.
+   */
+  async refreshComplianceBalance(args = {}) {
+    const grantee = await this.complianceManager();
+    return this.encryptedView({
+      functionName: "refreshComplianceBalance",
+      grantee,
+      account: args.account
+    });
+  }
   /**
    * Read the instance's own remaining pool balance as a handle the **caller**
    * can decrypt. Requires `DISCLOSURE_ADMIN_ROLE`.
    *
+   * Also re-grants the compliance-manager clone on the same handle (audit-04),
+   * so an admin read doubles as a {@link refreshComplianceBalance}.
+   *
    * @returns `{ handle, hash }` — pass `handle` to the Zama relayer's `userDecrypt`.
    * @throws {@link ReceiptEventNotFoundError} when the transaction granted no ACL to the caller.
    */
@@ -5650,11 +5887,18 @@ var AirdropBaseClient = class {
   /**
    * Grant `party` decrypt access to a handle you already hold.
    *
-   * Two gates apply on-chain: the caller must itself be allowed on the handle
-   * (bypassed by `DISCLOSURE_ADMIN_ROLE`), and the *instance* must be allowed
-   * on it — so an arbitrary handle from another contract cannot be laundered
-   * through this campaign. A failure of the first surfaces as
-   * `FheHandleNotAllowedError`.
+   * Two gates apply on-chain. Gate #1: the handle must be **persistently**
+   * user-decryptable in the `(caller, instance)` context - BOTH legs, and a
+   * transient allowance does not satisfy either (audit-06). `DISCLOSURE_ADMIN_ROLE`
+   * bypasses gate #1 only. Gate #2: the instance must be allowed on the handle,
+   * so an arbitrary handle from another contract cannot be laundered through
+   * this campaign.
+   *
+   * **The transient case is the trap.** An `euint64` that just came back from
+   * an FHE op carries a transient allowance, which used to be enough here and
+   * no longer is. Handles worth disclosing come from the encrypted views on
+   * this client, whose grants are persistent. A gate #1 failure surfaces as
+   * `FheHandleNotAllowedError` carrying the offending handle.
    *
    * @param args.handle An existing `euint64` handle — a public pointer, not a value.
    * @returns The transaction hash. No new handle is produced.
@@ -5788,7 +6032,7 @@ var AirdropBaseClient = class {
       method,
       contractAddress: this.address,
       abi: this.abi,
-      productMapper: chunkM4IT6DNJ_cjs.airdropProductMapper,
+      productMapper: chunkYTIYTV4K_cjs.airdropProductMapper,
       account: accountAddress(account),
       productContext: {
         creator: accountAddress(account),
@@ -5809,6 +6053,17 @@ var AirdropBaseClient = class {
     }
     return acct;
   }
+  /**
+   * The address that will actually send the transaction, as a plain `Address`.
+   *
+   * Needed by any method whose arguments must be validated against the sender before
+   * the write — on the Merkle variant the claim identity, the payout destination and
+   * the submitter are three separate addresses with rules between them.
+   */
+  resolveSender(override, method) {
+    const wallet = this.requireWallet(method);
+    return accountAddress(this.resolveAccount(wallet, override, method));
+  }
 };
 function createAirdropBaseClient(config) {
   return new AirdropBaseClient(config);
@@ -5913,11 +6168,24 @@ var EcdsaAirdropClient = class extends AirdropBaseClient {
    * consuming either replay guard — the same input can still be claimed for
    * real afterwards. No fee.
    *
+   * **It is repeatable, not unconditional** (audit-07). While the claim is
+   * still available this may be called any number of times; once it is not,
+   * this reverts with the same error the consuming claim would raise, in the
+   * same order: the mode's dedup slot first (`AddressAlreadyClaimed` /
+   * `DedupIdAlreadyClaimed`), the EIP-712 digest second (`SignatureAlreadyUsed`).
+   * A rejected preview performs no FHE op, grants no ACL and emits nothing.
+   *
+   * So this is not a probe for "has this been claimed" - use
+   * {@link isSignatureValid}, which never reverts and answers the same
+   * question for free. Reach for this when you want the AMOUNT.
+   *
    * An encrypted view: the contract calls `FHE.allow(amount, msg.sender)`, so
    * the result is recovered from the receipt's ACL `Allowed` event, never
    * from a simulation. See {@link AirdropBaseClient}'s class TSDoc.
    *
    * @returns `{ handle, hash }` — pass `handle` to the Zama relayer's `userDecrypt`.
+   * @throws {@link AlreadyClaimedError} when this recipient's dedup slot is consumed.
+   * @throws {@link DedupIdConsumedError} when this `dedupId`'s slot is consumed.
    */
   async getClaimAmount(args) {
     return this.encryptedView({
@@ -6108,7 +6376,7 @@ async function signClaimAuthorization(args) {
   return chunk66IHPTOK_cjs.asSignature(sig);
 }
 function toDeploymentModeOrdinal(mode) {
-  return chunkM4IT6DNJ_cjs.DEPLOYMENT_MODE[mode];
+  return chunkYTIYTV4K_cjs.DEPLOYMENT_MODE[mode];
 }
 function toContractCommonParams(common) {
   return {
@@ -6117,14 +6385,15 @@ function toContractCommonParams(common) {
     endTime: common.endTime,
     canExtendClaimWindow: common.canExtendClaimWindow,
     unwrappable: common.unwrappable,
-    complianceAdmin: common.complianceAdmin
+    complianceAdmin: common.complianceAdmin,
+    maxAcceptedGasFee: common.maxAcceptedGasFee
   };
 }
 function toContractEcdsaParams(params) {
   return {
     common: toContractCommonParams(params.common),
     signer: params.signer,
-    dedupMode: chunkM4IT6DNJ_cjs.DEDUP_MODE[params.dedupMode]
+    dedupMode: chunkYTIYTV4K_cjs.DEDUP_MODE[params.dedupMode]
   };
 }
 function toContractMerkleParams(params) {
@@ -6155,9 +6424,9 @@ var ConfidentialAirdropFactoryClient = class {
         clientLabel: "ConfidentialAirdropFactoryClient"
       });
     }
-    chunkM4IT6DNJ_cjs.assertSupportedChain(chainId);
+    chunkYTIYTV4K_cjs.assertSupportedChain(chainId);
     this.chainId = chainId;
-    this.address = config.address ? chunkJK4XMMKM_cjs.normaliseAddress(config.address) : chunk5576FRT3_cjs.requireFheAirdropFactoryAddress(chainId);
+    this.address = config.address ? chunkJK4XMMKM_cjs.normaliseAddress(config.address) : chunkPG3WXT3K_cjs.requireFheAirdropFactoryAddress(chainId);
     this.#telemetry = config.telemetry;
     this.#telemetry?.event("fhe-airdrop.client.init", {
       surface: "factory",
@@ -6228,7 +6497,7 @@ var ConfidentialAirdropFactoryClient = class {
    * @throws {@link InvalidArgumentError} when the root is zero and `isMerkleRootMutable` is false, or the salt was already used.
    */
   async createMerkleAirdrop(args) {
-    chunkM4IT6DNJ_cjs.assertMerkleModeSupported(args.mode);
+    chunkYTIYTV4K_cjs.assertMerkleModeSupported(args.mode);
     return chunkVJKZWYYJ_cjs.withTelemetry(this.#telemetry, "fhe-airdrop.factory.createMerkleAirdrop", async () => {
       const method = "createMerkleAirdrop";
       const account = this.#senderFor(args.account, method);
@@ -6320,7 +6589,7 @@ var ConfidentialAirdropFactoryClient = class {
    * @throws {@link MissingEncryptorError} when `amount` is given and no encryptor is resolvable.
    */
   async createAndFundMerkleAirdrop(args) {
-    chunkM4IT6DNJ_cjs.assertMerkleModeSupported(args.mode);
+    chunkYTIYTV4K_cjs.assertMerkleModeSupported(args.mode);
     return chunkVJKZWYYJ_cjs.withTelemetry(
       this.#telemetry,
       "fhe-airdrop.factory.createAndFundMerkleAirdrop",
@@ -6474,11 +6743,28 @@ var ConfidentialAirdropFactoryClient = class {
   async airdrops(offset, limit) {
     return this.#read("airdrops", [offset, limit]);
   }
+  /**
+   * Whether THIS factory created `candidate` - the genuineness check (audit-10).
+   *
+   * Nothing observable at an instance proves which factory, if any, deployed
+   * it: an attacker can deploy a contract with the same ABI, the same events
+   * and a pool it controls. The only trustworthy question is whether the
+   * canonical factory's own registry contains the address, which is why this
+   * read has to be addressed to a factory taken from
+   * `src/core/addresses.ts` rather than one the instance names.
+   *
+   * @param candidate The address to check.
+   * @returns True when this factory's registry contains `candidate`.
+   */
+  async isAirdrop(candidate) {
+    return this.#read("isAirdrop", [candidate]);
+  }
   /**
    * The compliance-manager clone bound to an instance.
    *
-   * Doubles as a provenance check: the factory records this mapping only for
-   * instances it deployed, so a zero address means the instance is not ours.
+   * Doubles as a provenance check, though a weaker one than {@link isAirdrop}:
+   * the factory records this mapping only for instances it deployed, so a zero
+   * address means the instance is not ours.
    *
    * @param airdrop Instance address.
    * @returns The clone address, or the zero address when unknown to this factory.
@@ -6532,6 +6818,47 @@ var ConfidentialAirdropFactoryClient = class {
   async defaultGasFee() {
     return this.#read("defaultGasFee");
   }
+  /** The factory's own ceiling on every configurable fee and every create-time resolved fee. */
+  async maxGasFee() {
+    return this.#read("maxGasFee");
+  }
+  /**
+   * Set the factory's ceiling on every fee `setDefaultGasFee`/`setCustomFee`
+   * may configure, and on the fee resolved at create.
+   *
+   * Requires `DEFAULT_ADMIN_ROLE`, deliberately not `FEE_MANAGER_ROLE`: the fee
+   * manager moves fees only within a bound the admin controls. `0n` admits a
+   * zero fee and nothing else.
+   *
+   * Lowering it below an already-configured fee does not rewrite that fee - the
+   * stale value stays in storage and reverts `GasFeeExceedsMaximum` at the next
+   * create until it is lowered too.
+   *
+   * @throws {@link InvalidArgumentError} when `maxGasFee` is below a currently configured fee (`GasFeeExceedsMaximum`).
+   */
+  async setMaxGasFee(maxGasFee, account) {
+    return this.#write("setMaxGasFee", [maxGasFee], account, "setMaxGasFee");
+  }
+  /**
+   * The per-claim fee a `create*` from `creator` would freeze into the new
+   * instance right now: their {@link getCustomFee} override when enabled, else
+   * {@link defaultGasFee}.
+   *
+   * This is the number `CommonAirdropParams.maxAcceptedGasFee` is checked
+   * against, so it is also what to show a creator before they choose a bound.
+   * It is a snapshot, not a quote: `FEE_MANAGER_ROLE` can move it between this
+   * read and the create, which is exactly what the bound exists to catch.
+   *
+   * @param creator The account that will send `create*`.
+   * @returns The resolved fee in wei.
+   */
+  async resolveGasFee(creator) {
+    const [custom, fallback] = await Promise.all([
+      this.getCustomFee(creator),
+      this.defaultGasFee()
+    ]);
+    return custom.enabled ? custom.gasFee : fallback;
+  }
   // ----------------------- implementation admin -----------------------
   /**
    * Point future `createEcdsaAirdrop*` calls at a new ECDSA implementation.
@@ -6796,17 +7123,15 @@ var ConfidentialAirdropFactoryClient = class {
   /**
    * Revoke `role` from `holder`. Requires the role's admin role.
    *
-   * Unlike an airdrop instance, the factory declares no "never empty" floor:
-   * revoking the last `DEFAULT_ADMIN_ROLE` member succeeds, and what it
-   * freezes is **role administration**, permanently. `DEFAULT_ADMIN_ROLE`
-   * administers all four operational roles and itself, so with the set empty
-   * no role can ever be granted or revoked again - including putting an admin
-   * back. The four operational roles keep working for whoever already holds
-   * them: a `FEE_MANAGER_ROLE` holder can still call {@link setDefaultGasFee},
-   * an `IMPL_MANAGER_ROLE` holder can still rotate an implementation. The
-   * factory therefore keeps running with exactly the role holders it had at
-   * that moment, with no way to rotate or remove them. Grant the successor
-   * first.
+   * **The factory floors `DEFAULT_ADMIN_ROLE` at one live member** (audit-14),
+   * matching the instances. Renouncing or revoking the sole holder reverts
+   * `LastAdmin`, and granting the role to the zero address reverts
+   * `ZeroAdminGrant`, so the set can neither be emptied nor satisfied by a
+   * member nobody controls. Before audit-14 this succeeded and froze role
+   * administration permanently; it no longer does.
+   *
+   * A handover is still available and is the supported way out: grant the
+   * successor first, then renounce.
    *
    * @returns The transaction hash.
    */
@@ -6878,11 +7203,15 @@ var ConfidentialAirdropFactoryClient = class {
   /**
    * The create-time guardrails that need a read, run before anything is sent.
    *
-   * Two checks, in the order a failure is cheapest to discover:
+   * Three checks, in the order a failure is cheapest to discover:
    *
-   * 1. **Stock wrapper.** Only when `unwrappable` is requested; one
+   * 1. **Accepted gas fee.** The fee is frozen into the instance at
+   *    initialization and immutable after, so a bound that no longer holds must
+   *    stop the transaction before anything else is spent on it (see
+   *    {@link GasFeeNotAcceptedError}).
+   * 2. **Stock wrapper.** Only when `unwrappable` is requested; one
    *    `underlying()` probe (see {@link NonStockWrapperError}).
-   * 2. **Salt collision.** A predicted address commits to `(implementation,
+   * 3. **Salt collision.** A predicted address commits to `(implementation,
    *    mode, deployer, userSalt)` and ignores the params struct entirely, so
    *    two campaigns differing only in token, window, signer or root still
    *    land on one address. The prediction plus one `eth_getCode` turns that
@@ -6893,7 +7222,13 @@ var ConfidentialAirdropFactoryClient = class {
    */
   async #guardCreate(input) {
     const { variant, args, deployer, method } = input;
-    await chunkM4IT6DNJ_cjs.assertStockWrapper({
+    await chunkYTIYTV4K_cjs.assertGasFeeAccepted({
+      factory: this,
+      creator: deployer,
+      maxAcceptedGasFee: args.params.common.maxAcceptedGasFee,
+      method
+    });
+    await chunkYTIYTV4K_cjs.assertStockWrapper({
       publicClient: this.publicClient,
       token: args.params.common.token,
       unwrappable: args.params.common.unwrappable
@@ -6906,7 +7241,7 @@ var ConfidentialAirdropFactoryClient = class {
       params: args.params,
       ...predictArgs
     });
-    await chunkM4IT6DNJ_cjs.assertSaltAvailable({
+    await chunkYTIYTV4K_cjs.assertSaltAvailable({
       publicClient: this.publicClient,
       predictedAddress,
       variant,
@@ -7009,7 +7344,7 @@ var ConfidentialAirdropFactoryClient = class {
       method,
       contractAddress: this.address,
       abi: airdropFactoryAbi,
-      productMapper: chunkM4IT6DNJ_cjs.airdropProductMapper,
+      productMapper: chunkYTIYTV4K_cjs.airdropProductMapper,
       account: accountAddress2(account),
       // `UpgradeabilityNotAllowed` and `ZamaProtocolUnsupported` carry no args
       // on-chain; the mapper can only name the creator and chain if we forward
@@ -7332,22 +7667,6 @@ var merkleConfidentialAirdropAbi = [
     name: "SafeERC20FailedOperation",
     type: "error"
   },
-  {
-    inputs: [
-      {
-        internalType: "bytes32",
-        name: "handle",
-        type: "bytes32"
-      },
-      {
-        internalType: "address",
-        name: "sender",
-        type: "address"
-      }
-    ],
-    name: "SenderNotAllowedToUseHandle",
-    type: "error"
-  },
   {
     inputs: [],
     name: "TokenNotAWrapper",
@@ -7374,11 +7693,32 @@ var merkleConfidentialAirdropAbi = [
     name: "UUPSUnsupportedProxiableUUID",
     type: "error"
   },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "account",
+        type: "address"
+      },
+      {
+        internalType: "address",
+        name: "to",
+        type: "address"
+      }
+    ],
+    name: "UnauthorizedRedirect",
+    type: "error"
+  },
   {
     inputs: [],
     name: "ZamaProtocolUnsupported",
     type: "error"
   },
+  {
+    inputs: [],
+    name: "ZeroAccount",
+    type: "error"
+  },
   {
     inputs: [],
     name: "ZeroAdminGrant",
@@ -7419,6 +7759,11 @@ var merkleConfidentialAirdropAbi = [
     name: "ZeroToken",
     type: "error"
   },
+  {
+    inputs: [],
+    name: "ZeroUnwrapRequestId",
+    type: "error"
+  },
   {
     anonymous: false,
     inputs: [
@@ -7451,6 +7796,12 @@ var merkleConfidentialAirdropAbi = [
         internalType: "uint256",
         name: "deploymentBlockNumber",
         type: "uint256"
+      },
+      {
+        indexed: false,
+        internalType: "uint256",
+        name: "gasFee",
+        type: "uint256"
       }
     ],
     name: "AirdropInitialized",
@@ -8000,11 +8351,16 @@ var merkleConfidentialAirdropAbi = [
     inputs: [
       {
         internalType: "address",
-        name: "to",
+        name: "account",
         type: "address"
       },
       {
-        internalType: "externalEuint64",
+        internalType: "address",
+        name: "to",
+        type: "address"
+      },
+      {
+        internalType: "externalEuint64",
         name: "inputAmount",
         type: "bytes32"
       },
@@ -8124,6 +8480,11 @@ var merkleConfidentialAirdropAbi = [
   },
   {
     inputs: [
+      {
+        internalType: "address",
+        name: "account",
+        type: "address"
+      },
       {
         internalType: "externalEuint64",
         name: "inputAmount",
@@ -8468,6 +8829,19 @@ var merkleConfidentialAirdropAbi = [
     stateMutability: "view",
     type: "function"
   },
+  {
+    inputs: [],
+    name: "refreshComplianceBalance",
+    outputs: [
+      {
+        internalType: "euint64",
+        name: "balance",
+        type: "bytes32"
+      }
+    ],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
   {
     inputs: [
       {
@@ -8676,8 +9050,8 @@ var MerkleAirdropClient = class extends AirdropBaseClient {
   //                          CLAIM
   // ============================================================
   /**
-   * Claim the outstanding amount for a proof-bearing entry, delivering the
-   * tokens to `to` (defaults to the sending account).
+   * Claim the outstanding amount for a proof-bearing entry, delivering the tokens to
+   * `to` — which defaults to `entry.account`, the CLAIM IDENTITY, not the sender.
    *
    * Requires `msg.value == gasFee()` exactly — handled for you; see the
    * class TSDoc.
@@ -8694,16 +9068,31 @@ var MerkleAirdropClient = class extends AirdropBaseClient {
    *
    * @throws {@link ClaimNotStartedError} before `startTime`.
    * @throws {@link ClaimWindowClosedError} after `endTime`.
-   * @throws {@link InvalidArgumentError} (`argument: "merkleProof"`) when the proof does not verify against
-   *   the current root — including when `entry.recipient` does not match the sending account.
+   * @throws {@link InvalidArgumentError} (`argument: "entry.boundTo"`) when the entry's proof is bound to
+   *   another address, or (`argument: "merkleProof"`) when the proof does not verify against the current root.
+   * @throws {@link UnauthorizedRedirectError} when a third-party submitter passes a `to` other than `entry.account`.
    * @returns The transaction hash.
    */
   async claim(args) {
     return chunkVJKZWYYJ_cjs.withTelemetry(this.telemetry, `${this.spanPrefix}.claim`, async () => {
+      const submitter = this.resolveSender(args.account, "claim");
+      chunkYTIYTV4K_cjs.assertMerkleClaimIdentity({
+        method: "claim",
+        account: args.entry.account,
+        boundTo: args.entry.boundTo,
+        submitter,
+        to: args.to
+      });
       const fee = await this.gasFee();
       return this.write(
         "claim",
-        [args.to ?? viem.zeroAddress, args.entry.handle, args.entry.inputProof, args.entry.merkleProof],
+        [
+          args.entry.account,
+          args.to ?? viem.zeroAddress,
+          args.entry.handle,
+          args.entry.inputProof,
+          args.entry.merkleProof
+        ],
         args.account,
         "claim",
         fee
@@ -8719,12 +9108,29 @@ var MerkleAirdropClient = class extends AirdropBaseClient {
    * Same replay/accounting semantics and `msg.value == gasFee()` requirement
    * as {@link claim} — see its `@remarks`.
    *
+   * @remarks
+   * **Self-only by design.** This entrypoint takes no claim identity: releasing an
+   * allocation as a public ERC-20 transfer publishes the amount irreversibly, which is
+   * the recipient's own choice to make. A relayed unwrap is therefore unrepresentable
+   * rather than merely rejected, and an entry whose `account` is not the sender is
+   * refused before the write. A third party can still submit a confidential
+   * {@link claim}.
+   *
    * @returns The transaction hash. The underlying ERC-20 is released later by
    *   a separate, permissionless `finalizeUnwrap` — this hash is only the
    *   unwrap request.
    */
   async claimAndUnwrap(args) {
     return chunkVJKZWYYJ_cjs.withTelemetry(this.telemetry, `${this.spanPrefix}.claimAndUnwrap`, async () => {
+      const submitter = this.resolveSender(args.account, "claimAndUnwrap");
+      chunkYTIYTV4K_cjs.assertMerkleClaimIdentity({
+        method: "claimAndUnwrap",
+        account: args.entry.account,
+        boundTo: args.entry.boundTo,
+        submitter,
+        to: args.to,
+        entrypoint: "claimAndUnwrap"
+      });
       const fee = await this.gasFee();
       return this.write(
         "claimAndUnwrap",
@@ -8740,16 +9146,32 @@ var MerkleAirdropClient = class extends AirdropBaseClient {
    * caller can decrypt. Consumes no accounting and no per-leaf state — the
    * same entry still pays the same amount after a preview. No fee.
    *
-   * An encrypted view: the contract calls `FHE.allow(outstanding, msg.sender)`,
-   * so the result is recovered from the receipt's ACL `Allowed` event, never
-   * from a simulation. See {@link AirdropBaseClient}'s class TSDoc.
+   * **Submits a transaction.** The contract calls `FHE.allow(outstanding, account)`, so
+   * the result is recovered from the receipt's ACL `Allowed` event, never from a
+   * simulation. See {@link AirdropBaseClient}'s class TSDoc.
    *
-   * @returns `{ handle, hash }` — pass `handle` to the Zama relayer's `userDecrypt`.
+   * **`entry.account` is the decryptable party, not the caller.** A relayer previewing on
+   * someone's behalf gets a valid handle it cannot read — that is the contract's intent,
+   * and it is what makes a blind relayed submission possible.
+   *
+   * @returns `{ handle, hash }` — pass `handle` to the Zama relayer's `userDecrypt`, as `entry.account`.
    */
   async getClaimAmount(args) {
+    const submitter = this.resolveSender(args.account, "getClaimAmount");
+    chunkYTIYTV4K_cjs.assertMerkleClaimIdentity({
+      method: "getClaimAmount",
+      account: args.entry.account,
+      boundTo: args.entry.boundTo,
+      submitter
+    });
     return this.encryptedView({
       functionName: "getClaimAmount",
-      args: [args.entry.handle, args.entry.inputProof, args.entry.merkleProof],
+      args: [args.entry.account, args.entry.handle, args.entry.inputProof, args.entry.merkleProof],
+      // The contract grants the outstanding handle to `account`, never to the caller
+      // (`_outstandingOf(account, account, …)`), so the receipt's ACL `Allowed` event
+      // names the account. Defaulting to the sender would fail extraction on any
+      // relayed preview — after the transaction had already been mined.
+      grantee: args.entry.account,
       account: args.account
     });
   }
@@ -8772,10 +9194,15 @@ var MerkleAirdropClient = class extends AirdropBaseClient {
    *   leaves for the same recipient, claiming both pays the higher of the
    *   two totals net of this running value — `max`, not `sum`.
    *
-   * The zero handle (uninitialized ciphertext) before an account's first
-   * settled claim decrypts as zero.
+   * **An account that has never claimed returns the ZERO handle, which cannot be
+   * decrypted.** It is an uninitialized ciphertext, so nobody holds an ACL on it and
+   * the relayer rejects it with "not authorized to user decrypt handle 0x0…0" rather
+   * than answering zero. Treat `handle === zeroHash` as "nothing delivered yet" and
+   * skip the decrypt; only call `userDecrypt` on a non-zero handle. (A mock FHEVM
+   * instance does answer zero here, so this only bites against a live relayer.)
    *
-   * @returns The account's cumulative delivered total, as an encrypted handle.
+   * @returns The account's cumulative delivered total as an encrypted handle, or the
+   *   zero handle if it has never claimed.
    */
   async getClaimedAmount(account) {
     const handle = await this.read("getClaimedAmount", [account]);
@@ -8822,9 +9249,925 @@ function createMerkleAirdropClient(config) {
   return new MerkleAirdropClient(config);
 }
 
+// src/fhe-airdrop/abis/compliance.ts
+var complianceRoleManagerAbi = [
+  {
+    inputs: [],
+    stateMutability: "nonpayable",
+    type: "constructor"
+  },
+  {
+    inputs: [],
+    name: "AccessControlBadConfirmation",
+    type: "error"
+  },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "account",
+        type: "address"
+      },
+      {
+        internalType: "bytes32",
+        name: "neededRole",
+        type: "bytes32"
+      }
+    ],
+    name: "AccessControlUnauthorizedAccount",
+    type: "error"
+  },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "airdrop",
+        type: "address"
+      }
+    ],
+    name: "AirdropAndManagerAreSameAddress",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "CannotManageComplianceDelegate",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "DelegateAlreadyAdded",
+    type: "error"
+  },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "delegate",
+        type: "address"
+      }
+    ],
+    name: "DelegateAndAirdropAreSameAddress",
+    type: "error"
+  },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "delegate",
+        type: "address"
+      }
+    ],
+    name: "DelegateAndManagerAreSameAddress",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "DelegateNotFound",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "InvalidInitialization",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "NotInitializing",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "ZamaProtocolUnsupported",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "ZeroAirdrop",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "ZeroClientAdmin",
+    type: "error"
+  },
+  {
+    inputs: [],
+    name: "ZeroDelegate",
+    type: "error"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      {
+        indexed: true,
+        internalType: "address",
+        name: "delegate",
+        type: "address"
+      }
+    ],
+    name: "ClientDelegateAdded",
+    type: "event"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      {
+        indexed: true,
+        internalType: "address",
+        name: "delegate",
+        type: "address"
+      }
+    ],
+    name: "ClientDelegateRevoked",
+    type: "event"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      {
+        indexed: true,
+        internalType: "address",
+        name: "delegate",
+        type: "address"
+      }
+    ],
+    name: "ComplianceDelegateSet",
+    type: "event"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      {
+        indexed: false,
+        internalType: "uint64",
+        name: "version",
+        type: "uint64"
+      }
+    ],
+    name: "Initialized",
+    type: "event"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      {
+        indexed: true,
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      },
+      {
+        indexed: true,
+        internalType: "bytes32",
+        name: "previousAdminRole",
+        type: "bytes32"
+      },
+      {
+        indexed: true,
+        internalType: "bytes32",
+        name: "newAdminRole",
+        type: "bytes32"
+      }
+    ],
+    name: "RoleAdminChanged",
+    type: "event"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      {
+        indexed: true,
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      },
+      {
+        indexed: true,
+        internalType: "address",
+        name: "account",
+        type: "address"
+      },
+      {
+        indexed: true,
+        internalType: "address",
+        name: "sender",
+        type: "address"
+      }
+    ],
+    name: "RoleGranted",
+    type: "event"
+  },
+  {
+    anonymous: false,
+    inputs: [
+      {
+        indexed: true,
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      },
+      {
+        indexed: true,
+        internalType: "address",
+        name: "account",
+        type: "address"
+      },
+      {
+        indexed: true,
+        internalType: "address",
+        name: "sender",
+        type: "address"
+      }
+    ],
+    name: "RoleRevoked",
+    type: "event"
+  },
+  {
+    inputs: [],
+    name: "DEFAULT_ADMIN_ROLE",
+    outputs: [
+      {
+        internalType: "bytes32",
+        name: "",
+        type: "bytes32"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [],
+    name: "DELEGATION_ADMIN_ROLE",
+    outputs: [
+      {
+        internalType: "bytes32",
+        name: "",
+        type: "bytes32"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "delegate",
+        type: "address"
+      }
+    ],
+    name: "addDelegate",
+    outputs: [],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
+  {
+    inputs: [],
+    name: "airdrop",
+    outputs: [
+      {
+        internalType: "address",
+        name: "",
+        type: "address"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [],
+    name: "clientDelegates",
+    outputs: [
+      {
+        internalType: "address[]",
+        name: "",
+        type: "address[]"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [],
+    name: "complianceDelegate",
+    outputs: [
+      {
+        internalType: "address",
+        name: "",
+        type: "address"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      }
+    ],
+    name: "getRoleAdmin",
+    outputs: [
+      {
+        internalType: "bytes32",
+        name: "",
+        type: "bytes32"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      },
+      {
+        internalType: "uint256",
+        name: "index",
+        type: "uint256"
+      }
+    ],
+    name: "getRoleMember",
+    outputs: [
+      {
+        internalType: "address",
+        name: "",
+        type: "address"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      }
+    ],
+    name: "getRoleMemberCount",
+    outputs: [
+      {
+        internalType: "uint256",
+        name: "",
+        type: "uint256"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      }
+    ],
+    name: "getRoleMembers",
+    outputs: [
+      {
+        internalType: "address[]",
+        name: "",
+        type: "address[]"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      },
+      {
+        internalType: "address",
+        name: "account",
+        type: "address"
+      }
+    ],
+    name: "grantRole",
+    outputs: [],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      },
+      {
+        internalType: "address",
+        name: "account",
+        type: "address"
+      }
+    ],
+    name: "hasRole",
+    outputs: [
+      {
+        internalType: "bool",
+        name: "",
+        type: "bool"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "airdrop_",
+        type: "address"
+      },
+      {
+        internalType: "address",
+        name: "clientAdmin",
+        type: "address"
+      },
+      {
+        internalType: "address",
+        name: "clientDelegate",
+        type: "address"
+      },
+      {
+        internalType: "address",
+        name: "complianceDelegate_",
+        type: "address"
+      }
+    ],
+    name: "initialize",
+    outputs: [],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "delegate",
+        type: "address"
+      }
+    ],
+    name: "isActiveDelegate",
+    outputs: [
+      {
+        internalType: "bool",
+        name: "",
+        type: "bool"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      },
+      {
+        internalType: "address",
+        name: "callerConfirmation",
+        type: "address"
+      }
+    ],
+    name: "renounceRole",
+    outputs: [],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "address",
+        name: "delegate",
+        type: "address"
+      }
+    ],
+    name: "revokeDelegate",
+    outputs: [],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes32",
+        name: "role",
+        type: "bytes32"
+      },
+      {
+        internalType: "address",
+        name: "account",
+        type: "address"
+      }
+    ],
+    name: "revokeRole",
+    outputs: [],
+    stateMutability: "nonpayable",
+    type: "function"
+  },
+  {
+    inputs: [
+      {
+        internalType: "bytes4",
+        name: "interfaceId",
+        type: "bytes4"
+      }
+    ],
+    name: "supportsInterface",
+    outputs: [
+      {
+        internalType: "bool",
+        name: "",
+        type: "bool"
+      }
+    ],
+    stateMutability: "view",
+    type: "function"
+  }
+];
+
+// src/fhe-airdrop/compliance.ts
+var ACL_PROPAGATION_CODE = "DELEGATION_NOT_PROPAGATED";
+var ACL_PROPAGATION_ERROR_NAME = "DelegationNotPropagatedError";
+var ACL_PROPAGATION_STATUSES = /* @__PURE__ */ new Set([400, 500]);
+function matchesPropagationMessage(message) {
+  const lower = message.toLowerCase();
+  if (lower.includes("acl check not propagated")) return true;
+  return lower.includes("propagat") && lower.includes("gateway");
+}
+function readRecord(value) {
+  return typeof value === "object" && value !== null ? value : void 0;
+}
+function readNumber(obj, key) {
+  const value = obj?.[key];
+  return typeof value === "number" ? value : void 0;
+}
+function readString(obj, key) {
+  const value = obj?.[key];
+  return typeof value === "string" ? value : void 0;
+}
+function isAclPropagationError(error) {
+  const err = readRecord(error);
+  if (!err) return false;
+  const cause = readRecord(err["cause"]);
+  if (err["code"] === ACL_PROPAGATION_CODE || err["name"] === ACL_PROPAGATION_ERROR_NAME || cause?.["code"] === ACL_PROPAGATION_CODE || cause?.["name"] === ACL_PROPAGATION_ERROR_NAME) {
+    return true;
+  }
+  const status = readNumber(err, "status") ?? readNumber(err, "statusCode") ?? readNumber(cause, "status") ?? readNumber(cause, "statusCode");
+  if (status === void 0 || !ACL_PROPAGATION_STATUSES.has(status)) return false;
+  const errMessage = readString(err, "message");
+  const causeMessage = readString(cause, "message");
+  return errMessage !== void 0 && matchesPropagationMessage(errMessage) || causeMessage !== void 0 && matchesPropagationMessage(causeMessage);
+}
+var ComplianceManagerClient = class {
+  publicClient;
+  walletClient;
+  address;
+  chainId;
+  #telemetry;
+  constructor(config) {
+    this.publicClient = config.publicClient;
+    this.walletClient = config.walletClient;
+    const chainId = config.chainId ?? config.publicClient.chain?.id;
+    if (chainId === void 0) {
+      throw new chunk67OV5CX2_cjs.DeploymentAddressUnavailableError({
+        reason: "chain-id-missing",
+        product: "fheAirdrop",
+        contract: "complianceManager",
+        clientLabel: "ComplianceManagerClient"
+      });
+    }
+    chunkYTIYTV4K_cjs.assertSupportedChain(chainId);
+    this.chainId = chainId;
+    this.address = chunkJK4XMMKM_cjs.normaliseAddress(config.address);
+    this.#telemetry = config.telemetry;
+    this.#telemetry?.event("fhe-airdrop.client.init", {
+      surface: "compliance",
+      chainId,
+      hasWallet: !!this.walletClient,
+      sdkVersion: chunkUG5RKLU2_cjs.SDK_VERSION
+    });
+  }
+  // ============================================================
+  //                    CLIENT DELEGATION MGMT
+  // ============================================================
+  /**
+   * Add a client delegate: grants `delegate` permanent (never-expiring)
+   * user-decryption delegation over this clone's airdrop. Requires
+   * {@link DELEGATION_ADMIN_ROLE}.
+   *
+   * Effective on-chain immediately; see the class TSDoc for the gateway
+   * propagation lag before `delegatedUserDecrypt` catches up.
+   *
+   * @throws {@link InvalidArgumentError} (`argument: "delegate"`) when `delegate` is the zero address
+   *   (`ZeroDelegate`), already an active client delegate (`DelegateAlreadyAdded`), or targets the
+   *   irrevocable platform compliance delegate (`CannotManageComplianceDelegate`).
+   * @returns The transaction hash.
+   */
+  async addDelegate(args) {
+    return chunkVJKZWYYJ_cjs.withTelemetry(
+      this.#telemetry,
+      "fhe-airdrop.compliance.addDelegate",
+      () => this.#write("addDelegate", [args.delegate], args.account, "addDelegate")
+    );
+  }
+  /**
+   * Revoke a client delegate. Requires {@link DELEGATION_ADMIN_ROLE}.
+   *
+   * Effective on-chain immediately — but off-chain, gateway-served
+   * `delegatedUserDecrypt` calls stop succeeding only once the gateway
+   * observes the revocation, which is not instantaneous either. Cannot target
+   * the platform compliance delegate, which is irrevocable by construction.
+   *
+   * **Not in the same block as {@link addDelegate} for the same delegate.**
+   * The FHEVM ACL rejects an add and a revoke of one delegate within a single
+   * block (`AlreadyDelegatedOrRevokedInSameBlock`), and because that revert
+   * comes from the ACL rather than from this contract, it surfaces as an
+   * opaque {@link ContractRevertError} with no decodable selector — nothing
+   * names the delegate or the cause. Batching an add and a revoke into one
+   * multicall, or sending both inside one block, is the way to hit it; wait a
+   * block between them. This is the sequencing counterpart to the propagation
+   * gotcha on the class TSDoc: that one is the gateway lagging the chain, this
+   * one is the chain refusing two conflicting writes at the same height.
+   *
+   * @throws {@link InvalidArgumentError} (`argument: "delegate"`) when `delegate` is the zero address
+   *   (`ZeroDelegate`), not currently an active client delegate (`DelegateNotFound`), or targets the
+   *   irrevocable platform compliance delegate (`CannotManageComplianceDelegate`).
+   * @returns The transaction hash.
+   */
+  async revokeDelegate(args) {
+    return chunkVJKZWYYJ_cjs.withTelemetry(
+      this.#telemetry,
+      "fhe-airdrop.compliance.revokeDelegate",
+      () => this.#write("revokeDelegate", [args.delegate], args.account, "revokeDelegate")
+    );
+  }
+  // ============================================================
+  //                            READS
+  // ============================================================
+  /** The one airdrop instance this clone serves — set once, at `initialize`. */
+  async airdrop() {
+    return this.#read("airdrop");
+  }
+  /**
+   * The platform compliance delegate.
+   *
+   * @returns The delegate address, or the zero address when this clone was
+   *   created with the platform compliance policy OFF. Because `initialize`
+   *   always runs atomically before this client can reach the clone (see the
+   *   class TSDoc), a zero return never means "not wired yet" — there is no
+   *   such observable state on this contract. It unambiguously means "no
+   *   platform delegate for this airdrop."
+   */
+  async complianceDelegate() {
+    return this.#read("complianceDelegate");
+  }
+  /** The current set of active client delegates (excludes the platform compliance delegate, if any). */
+  async clientDelegates() {
+    return this.#read("clientDelegates");
+  }
+  /**
+   * Authoritative active-delegate check for `delegate` — reads the ACL
+   * expiration date directly rather than the contract's `EnumerableSet`
+   * mirror, so it reflects the platform compliance delegate too (which never
+   * appears in {@link clientDelegates}).
+   *
+   * On-chain truth only: a `true` result means the delegation is live in the
+   * ACL, not that the gateway has caught up with it yet — see the class
+   * TSDoc's propagation note.
+   */
+  async isActiveDelegate(delegate) {
+    return this.#read("isActiveDelegate", [delegate]);
+  }
+  // Role-constant getters are named for the contract function they read, the
+  // same convention every other client in this module follows: one spelling
+  // per role, whichever client you happen to be holding.
+  /** Gates {@link addDelegate} / {@link revokeDelegate}. */
+  async DELEGATION_ADMIN_ROLE() {
+    return this.#read("DELEGATION_ADMIN_ROLE");
+  }
+  /**
+   * OpenZeppelin's root role (`bytes32(0)`), read from the clone rather than
+   * hard-coded. It administers {@link DELEGATION_ADMIN_ROLE}.
+   */
+  async DEFAULT_ADMIN_ROLE() {
+    return this.#read("DEFAULT_ADMIN_ROLE");
+  }
+  // ============================================================
+  //                     ROLE ADMINISTRATION
+  // ============================================================
+  //
+  // The clone is `AccessControlEnumerableUpgradeable`, so membership is
+  // enumerable as well as checkable. This surface is what makes the delegation
+  // verbs above administrable: without it, whoever the factory named at
+  // `initialize` is the only account that can ever add a delegate, and there
+  // is no way to find out who that is.
+  //
+  // Unlike an airdrop instance, this contract adds no "never empty" floor of
+  // its own - emptying `DEFAULT_ADMIN_ROLE` here permanently freezes the
+  // clone's delegate set at whatever it currently holds.
+  /**
+   * Whether `holder` holds `role`.
+   *
+   * The role subject is called `holder`, not `account`: on the writes below
+   * `account` already means "who sends this transaction", and one key cannot
+   * be both.
+   *
+   * @param args.role A `bytes32` from {@link DELEGATION_ADMIN_ROLE} or {@link DEFAULT_ADMIN_ROLE}.
+   */
+  async hasRole(args) {
+    return this.#read("hasRole", [args.role, args.holder]);
+  }
+  /** The role whose holders may {@link grantRole} and {@link revokeRole} `role`. */
+  async getRoleAdmin(role) {
+    return this.#read("getRoleAdmin", [role]);
+  }
+  /** How many accounts hold `role`. */
+  async getRoleMemberCount(role) {
+    return this.#read("getRoleMemberCount", [role]);
+  }
+  /**
+   * The `index`-th holder of `role`, in `EnumerableSet` order - which is not
+   * stable across grants and revokes. Prefer {@link getRoleMembers}.
+   */
+  async getRoleMember(args) {
+    return this.#read("getRoleMember", [args.role, args.index]);
+  }
+  /**
+   * Every account currently holding `role`.
+   *
+   * With {@link DELEGATION_ADMIN_ROLE} this answers "who may add or revoke a
+   * delegate on this clone?" - the administrative counterpart to
+   * {@link clientDelegates}, which answers "who may currently decrypt?".
+   */
+  async getRoleMembers(role) {
+    return this.#read("getRoleMembers", [role]);
+  }
+  /**
+   * Grant `role` to `holder`. Requires the role's admin role
+   * ({@link getRoleAdmin}).
+   *
+   * This is how a second operator is added to {@link DELEGATION_ADMIN_ROLE} -
+   * the delegation verbs themselves are unaffected, the grant only widens who
+   * may call them.
+   *
+   * @returns The transaction hash.
+   */
+  async grantRole(args) {
+    return chunkVJKZWYYJ_cjs.withTelemetry(
+      this.#telemetry,
+      "fhe-airdrop.compliance.grantRole",
+      () => this.#write("grantRole", [args.role, args.holder], args.account, "grantRole")
+    );
+  }
+  /**
+   * Revoke `role` from `holder`. Requires the role's admin role.
+   *
+   * Revoking a delegation admin does **not** revoke the delegations they
+   * created: an existing delegate keeps decrypting until
+   * {@link revokeDelegate} is called for it explicitly.
+   *
+   * @returns The transaction hash.
+   */
+  async revokeRole(args) {
+    return chunkVJKZWYYJ_cjs.withTelemetry(
+      this.#telemetry,
+      "fhe-airdrop.compliance.revokeRole",
+      () => this.#write("revokeRole", [args.role, args.holder], args.account, "revokeRole")
+    );
+  }
+  /**
+   * Give up `role` yourself.
+   *
+   * The contract's signature is `renounceRole(role, callerConfirmation)` and
+   * it reverts `AccessControlBadConfirmation` unless `callerConfirmation` is
+   * the sender, so this method takes no holder and fills the confirmation from
+   * the resolved sending account. Renouncing for somebody else is not a call
+   * that can succeed; use {@link revokeRole} to remove another account's role.
+   *
+   * @returns The transaction hash.
+   */
+  async renounceRole(args) {
+    const method = "renounceRole";
+    const wallet = this.#requireWallet(method);
+    const account = this.#resolveAccount(wallet, args.account, method);
+    return chunkVJKZWYYJ_cjs.withTelemetry(
+      this.#telemetry,
+      "fhe-airdrop.compliance.renounceRole",
+      () => this.#write(method, [args.role, accountAddress3(account)], account, method)
+    );
+  }
+  // ============================================================
+  //                     INTERNALS (private)
+  // ============================================================
+  async #write(functionName, args, account, method) {
+    const wallet = this.#requireWallet(method);
+    const acct = this.#resolveAccount(wallet, account, method);
+    await this.#preflightWrite(method, functionName, args, acct);
+    try {
+      return await wallet.writeContract({
+        address: this.address,
+        abi: complianceRoleManagerAbi,
+        functionName,
+        args,
+        account: acct,
+        chain: wallet.chain
+      });
+    } catch (err) {
+      throw this.#mapRevert(method, err, acct);
+    }
+  }
+  async #read(functionName, args = []) {
+    const result = await this.publicClient.readContract({
+      address: this.address,
+      abi: complianceRoleManagerAbi,
+      functionName,
+      args
+    });
+    return result;
+  }
+  /**
+   * Simulate a write purely to surface typed reverts.
+   *
+   * The simulate's return value is discarded on principle: this contract
+   * returns nothing from `addDelegate` / `revokeDelegate` anyway, but the
+   * pattern is kept identical to every other airdrop v2 client so a revert is
+   * always decoded before the user pays for it.
+   */
+  async #preflightWrite(method, functionName, args, account) {
+    try {
+      await this.publicClient.simulateContract({
+        address: this.address,
+        abi: complianceRoleManagerAbi,
+        functionName,
+        args,
+        account
+      });
+    } catch (err) {
+      if (chunkMVDQMV25_cjs.isContractRevert(err)) {
+        throw this.#mapRevert(method, err, account);
+      }
+    }
+  }
+  /**
+   * Map a viem error to the SDK's typed palette.
+   *
+   * `productContext` deliberately carries only public identifiers — the
+   * caller, the chain. Never an amount: this contract never handles amounts
+   * at all, but the convention is shared across every airdrop v2 client.
+   */
+  #mapRevert(method, err, account) {
+    return chunkMVDQMV25_cjs.mapContractRevert(err, {
+      method,
+      contractAddress: this.address,
+      abi: complianceRoleManagerAbi,
+      productMapper: chunkYTIYTV4K_cjs.airdropProductMapper,
+      account: accountAddress3(account),
+      productContext: {
+        creator: accountAddress3(account),
+        chainId: this.chainId
+      }
+    });
+  }
+  #requireWallet(method) {
+    if (!this.walletClient) {
+      throw new chunk67OV5CX2_cjs.MissingWalletClientError(method);
+    }
+    return this.walletClient;
+  }
+  #resolveAccount(wallet, override, method) {
+    const acct = override ?? wallet.account;
+    if (!acct) {
+      throw new chunk67OV5CX2_cjs.MissingAccountError(method);
+    }
+    return acct;
+  }
+};
+function createComplianceManagerClient(config) {
+  return new ComplianceManagerClient(config);
+}
+function accountAddress3(account) {
+  return typeof account === "string" ? account : account.address;
+}
+
 exports.AirdropBaseClient = AirdropBaseClient;
 exports.CLAIM_TYPEHASH = CLAIM_TYPEHASH;
 exports.CLAIM_TYPES = CLAIM_TYPES;
+exports.ComplianceManagerClient = ComplianceManagerClient;
 exports.ConfidentialAirdropFactoryClient = ConfidentialAirdropFactoryClient;
 exports.EIP712_DOMAIN_NAME = EIP712_DOMAIN_NAME;
 exports.EIP712_DOMAIN_VERSION = EIP712_DOMAIN_VERSION;
@@ -8832,14 +10175,17 @@ exports.EcdsaAirdropClient = EcdsaAirdropClient;
 exports.FACTORY_ROLE_CONCENTRATION_NOTE = FACTORY_ROLE_CONCENTRATION_NOTE;
 exports.MerkleAirdropClient = MerkleAirdropClient;
 exports.airdropFactoryAbi = airdropFactoryAbi;
+exports.complianceRoleManagerAbi = complianceRoleManagerAbi;
 exports.confidentialAirdropBaseAbi = confidentialAirdropBaseAbi;
 exports.createAirdropBaseClient = createAirdropBaseClient;
+exports.createComplianceManagerClient = createComplianceManagerClient;
 exports.createConfidentialAirdropFactoryClient = createConfidentialAirdropFactoryClient;
 exports.createEcdsaAirdropClient = createEcdsaAirdropClient;
 exports.createMerkleAirdropClient = createMerkleAirdropClient;
 exports.ecdsaConfidentialAirdropAbi = ecdsaConfidentialAirdropAbi;
 exports.encryptUint64 = encryptUint64;
 exports.encryptUint64Batch = encryptUint64Batch;
+exports.isAclPropagationError = isAclPropagationError;
 exports.merkleConfidentialAirdropAbi = merkleConfidentialAirdropAbi;
 exports.resolveEncryptor = resolveEncryptor;
 exports.signClaimAuthorization = signClaimAuthorization;