@tokenops/sdk 2.0.0-alpha.2 → 2.0.0-alpha.4

package/dist/fhe-airdrop/factory.d.ts

@@ -1,44 +1,11 @@
 import type { Account, Address, Hex, PublicClient, WalletClient } from "viem";
 import { type SdkTelemetry } from "../core/telemetry.js";
+import type { ReceiptMode } from "../core/pending.js";
 import type { EncryptedInput } from "../fhe/types.js";
 import type { WriteAccountOverride } from "./airdrop-base.js";
-import { type DeploymentMode } from "./constants.js";
+import type { DeploymentMode } from "./constants.js";
 import { type EncryptorSource } from "./encryption.js";
-import type { CommonAirdropParams, CreateAirdropArgs, CreateAirdropResult, EcdsaAirdropParams, MerkleAirdropParams } from "./types.js";
-/** The on-chain `CommonAirdropParams` struct, field-for-field. */
-interface ContractCommonParams {
-    token: Address;
-    startTime: number;
-    endTime: number;
-    canExtendClaimWindow: boolean;
-    unwrappable: boolean;
-    complianceAdmin: Address;
-}
-/**
- * Convert the SDK's `"clone"` / `"uups"` name to the contract's
- * `DeploymentMode` ordinal.
- *
- * The string union is the SDK's currency everywhere else; the ordinal exists
- * only at the ABI edge. Keeping the conversion in one exported function makes
- * an inverted mapping a one-line test failure rather than a silently
- * upgradeable instance.
- *
- * @param mode Deployment shell to select.
- * @returns The `uint8` the factory expects.
- */
-export declare function toDeploymentModeOrdinal(mode: DeploymentMode): number;
-/**
- * Project {@link CommonAirdropParams} onto the contract's struct.
- *
- * The two shapes are already identical, so this is a re-assembly rather than a
- * translation — and that is the point: it pins the field set and their order to
- * the vendored ABI, so a struct change in a future contract commit surfaces
- * here instead of as a silently mis-encoded tuple.
- *
- * @param common Create-time fields shared by both airdrop variants.
- * @returns The struct in the ABI's declared field order.
- */
-export declare function toContractCommonParams(common: CommonAirdropParams): ContractCommonParams;
+import type { AirdropVariantParams, CreateAirdropArgs, CreateAirdropResult, CreateCommitments, CreateMerkleAirdropArgs, EcdsaAirdropParams, MerkleAirdropParams, PendingCreateAirdropResult } from "./types.js";
 /** @alpha */
 export interface ConfidentialAirdropFactoryClientConfig {
     publicClient: PublicClient;
@@ -188,6 +155,14 @@ export declare const FACTORY_ROLE_CONCENTRATION_NOTE = "The live factory holds a
  * exists; splitting roles is a contracts-repo decision, not something this
  * client can arrange.
  *
+ * **Safe / multisig signers.** The four creates take `waitForReceipt: false`
+ * and return the committed addresses with `pending: true` (see
+ * {@link PendingCreateAirdropResult}). `fundAirdrop` and the admin
+ * writes already return a bare hash; the operator approval they need
+ * (`setOperator`, `@tokenops/sdk/fhe`) takes `waitForReceipt: false` as well. A post-create role split goes through
+ * {@link planInstanceRoleSplit} plus {@link encodeInstanceRoleSplit} as one
+ * MultiSend batch, not `grantInstanceRoles`.
+ *
  * @example
  * const factory = createConfidentialAirdropFactoryClient({ publicClient, walletClient });
  * const { airdrop, complianceManager } = await factory.createMerkleAirdrop({
@@ -216,9 +191,14 @@ export declare class ConfidentialAirdropFactoryClient {
      * read-only form of the same checks.
      *
      * @param args Instance parameters, deployment shell and the caller's salt.
-     * @returns The tx hash, the deployed instance and its compliance-manager clone.
+     * @returns The tx hash, the deployed instance, its compliance-manager clone, the clone's
+     *   implementation and the platform delegate it was wired with. With `waitForReceipt: false`,
+     *   a {@link PendingCreateAirdropResult}.
+     * @throws {@link InvalidArgumentError} on `gasFee` when the resolved fee exceeds the factory's `maxGasFee` ceiling, checked before the creator's bound.
+     * @throws {@link GasFeeNotAcceptedError} when the factory resolves a fee above `common.maxAcceptedGasFee`.
      * @throws {@link NonStockWrapperError} when `unwrappable` is set on a token that is not a stock wrapper.
      * @throws {@link SaltCollisionError} when this `(mode, deployer, userSalt)` tuple already deployed an instance.
+     * @throws {@link CreateCommitmentMismatchError} when a quoted or pinned commitment no longer matches what the factory would deploy.
      * @throws {@link UpgradeabilityNotAllowedError} when `mode: "uups"` is not permitted for the creator.
      * @throws {@link InvalidArgumentError} when `userSalt` was already consumed by this creator and mode.
      *
@@ -229,7 +209,11 @@ export declare class ConfidentialAirdropFactoryClient {
      *   userSalt: keccak256(toBytes("campaign-42")),
      * });
      */
-    createEcdsaAirdrop(args: CreateAirdropArgs<EcdsaAirdropParams> & WriteAccountOverride): Promise<CreateAirdropResult>;
+    createEcdsaAirdrop(args: CreateAirdropArgs<EcdsaAirdropParams> & WriteAccountOverride & ReceiptMode<true>): Promise<CreateAirdropResult>;
+    /** With `waitForReceipt: false`: returns on submission, before the receipt exists. */
+    createEcdsaAirdrop(args: CreateAirdropArgs<EcdsaAirdropParams> & WriteAccountOverride & ReceiptMode<false>): Promise<PendingCreateAirdropResult>;
+    /** With a runtime `boolean`: either result, narrowed by `pending`. */
+    createEcdsaAirdrop(args: CreateAirdropArgs<EcdsaAirdropParams> & WriteAccountOverride & ReceiptMode): Promise<CreateAirdropResult | PendingCreateAirdropResult>;
     /**
      * Deploy a Merkle-proof airdrop instance.
      *
@@ -239,14 +223,43 @@ export declare class ConfidentialAirdropFactoryClient {
      * across that change reinterprets live storage. See
      * {@link MerkleUupsUnsupportedError}.
      *
-     * @param args Instance parameters, deployment shell and the caller's salt.
-     * @returns The tx hash, the deployed instance and its compliance-manager clone.
+     * **Creating from a plan.** Pass the {@link PlannedCampaign} as `plan`, with
+     * `merkleRoot: plan.root`. The plan's leaves are bound to `plan.predictedAddress`, so the
+     * create pins it, refuses a root that differs from `plan.root`, and refuses to send once
+     * the factory's Merkle implementation has moved since the plan was taken
+     * ({@link PredictionDriftError}). A rotation landing after that check is still refused by
+     * the contract ({@link CreateCommitmentMismatchError}). `expected: { airdrop: plan.predictedAddress }`
+     * is the lower-level equivalent of the pin alone.
+     *
+     * @example
+     * const plan = await planMerkleCampaign({
+     *   factory, params, mode, creator, userSalt, recipients, encryptor,
+     * });
+     * await factory.createMerkleAirdrop({
+     *   params: { ...params, merkleRoot: plan.root, isMerkleRootMutable: false },
+     *   mode,
+     *   userSalt,
+     *   plan,
+     * });
+     *
+     * @param args Instance parameters, deployment shell, the caller's salt and, optionally, the plan being realised.
+     * @returns The tx hash, the deployed instance, its compliance-manager clone, the clone's
+     *   implementation and the platform delegate it was wired with. With `waitForReceipt: false`,
+     *   a {@link PendingCreateAirdropResult}.
+     * @throws {@link InvalidArgumentError} on `gasFee` when the resolved fee exceeds the factory's `maxGasFee` ceiling, checked before the creator's bound.
+     * @throws {@link GasFeeNotAcceptedError} when the factory resolves a fee above `common.maxAcceptedGasFee`.
      * @throws {@link MerkleUupsUnsupportedError} when `mode` is `"uups"`.
      * @throws {@link NonStockWrapperError} when `unwrappable` is set on a token that is not a stock wrapper.
      * @throws {@link SaltCollisionError} when this `(mode, deployer, userSalt)` tuple already deployed an instance.
-     * @throws {@link InvalidArgumentError} when the root is zero and `isMerkleRootMutable` is false, or the salt was already used.
+     * @throws {@link CreateCommitmentMismatchError} when a quoted or pinned commitment no longer matches what the factory would deploy.
+     * @throws {@link PredictionDriftError} when `plan` is given and the factory's Merkle implementation moved since it was taken.
+     * @throws {@link InvalidArgumentError} when the root is zero and `isMerkleRootMutable` is false, the salt was already used, or `params.merkleRoot` / `expected.airdrop` disagrees with `plan`.
      */
-    createMerkleAirdrop(args: CreateAirdropArgs<MerkleAirdropParams> & WriteAccountOverride): Promise<CreateAirdropResult>;
+    createMerkleAirdrop(args: CreateMerkleAirdropArgs & WriteAccountOverride & ReceiptMode<true>): Promise<CreateAirdropResult>;
+    /** With `waitForReceipt: false`: returns on submission, before the receipt exists. */
+    createMerkleAirdrop(args: CreateMerkleAirdropArgs & WriteAccountOverride & ReceiptMode<false>): Promise<PendingCreateAirdropResult>;
+    /** With a runtime `boolean`: either result, narrowed by `pending`. */
+    createMerkleAirdrop(args: CreateMerkleAirdropArgs & WriteAccountOverride & ReceiptMode): Promise<CreateAirdropResult | PendingCreateAirdropResult>;
     /**
      * Deploy an ECDSA airdrop and seed its pool in the same transaction.
      *
@@ -260,12 +273,21 @@ export declare class ConfidentialAirdropFactoryClient {
      * does not prove the pool was funded — confirm the funder's balance first.
      *
      * @param args Create arguments plus exactly one of `amount` / `encryptedInput`.
-     * @returns The tx hash, the deployed instance and its compliance-manager clone.
+     * @returns The tx hash, the deployed instance, its compliance-manager clone, the clone's
+     *   implementation and the platform delegate it was wired with. With `waitForReceipt: false`,
+     *   a {@link PendingCreateAirdropResult}.
+     * @throws {@link InvalidArgumentError} on `gasFee` when the resolved fee exceeds the factory's `maxGasFee` ceiling, checked before the creator's bound.
+     * @throws {@link GasFeeNotAcceptedError} when the factory resolves a fee above `common.maxAcceptedGasFee`.
      * @throws {@link NonStockWrapperError} when `unwrappable` is set on a token that is not a stock wrapper.
      * @throws {@link SaltCollisionError} when this `(mode, deployer, userSalt)` tuple already deployed an instance.
+     * @throws {@link CreateCommitmentMismatchError} when a quoted or pinned commitment no longer matches what the factory would deploy.
      * @throws {@link MissingEncryptorError} when `amount` is given and no encryptor is resolvable.
      */
-    createAndFundEcdsaAirdrop(args: CreateAirdropArgs<EcdsaAirdropParams> & FundInput & WriteAccountOverride): Promise<CreateAirdropResult>;
+    createAndFundEcdsaAirdrop(args: CreateAirdropArgs<EcdsaAirdropParams> & FundInput & WriteAccountOverride & ReceiptMode<true>): Promise<CreateAirdropResult>;
+    /** With `waitForReceipt: false`: returns on submission, before the receipt exists. */
+    createAndFundEcdsaAirdrop(args: CreateAirdropArgs<EcdsaAirdropParams> & FundInput & WriteAccountOverride & ReceiptMode<false>): Promise<PendingCreateAirdropResult>;
+    /** With a runtime `boolean`: either result, narrowed by `pending`. */
+    createAndFundEcdsaAirdrop(args: CreateAirdropArgs<EcdsaAirdropParams> & FundInput & WriteAccountOverride & ReceiptMode): Promise<CreateAirdropResult | PendingCreateAirdropResult>;
     /**
      * Deploy a Merkle airdrop and seed its pool in the same transaction.
      *
@@ -277,14 +299,31 @@ export declare class ConfidentialAirdropFactoryClient {
      * because reverting would leak the balance. A successful receipt therefore
      * does not prove the pool was funded.
      *
-     * @param args Create arguments plus exactly one of `amount` / `encryptedInput`.
-     * @returns The tx hash, the deployed instance and its compliance-manager clone.
+     * **Creating from a plan.** Pass the {@link PlannedCampaign} as `plan`, with
+     * `merkleRoot: plan.root`, exactly as for {@link createMerkleAirdrop}: the address is pinned,
+     * the root and the Merkle init-code hash are checked, and both checks run before anything is
+     * encrypted. `expected: { airdrop: plan.predictedAddress }` is the lower-level equivalent of
+     * the pin alone.
+     *
+     * @param args Create arguments plus exactly one of `amount` / `encryptedInput`, and optionally the plan being realised.
+     * @returns The tx hash, the deployed instance, its compliance-manager clone, the clone's
+     *   implementation and the platform delegate it was wired with. With `waitForReceipt: false`,
+     *   a {@link PendingCreateAirdropResult}.
+     * @throws {@link InvalidArgumentError} on `gasFee` when the resolved fee exceeds the factory's `maxGasFee` ceiling, checked before the creator's bound.
+     * @throws {@link GasFeeNotAcceptedError} when the factory resolves a fee above `common.maxAcceptedGasFee`.
      * @throws {@link MerkleUupsUnsupportedError} when `mode` is `"uups"`.
      * @throws {@link NonStockWrapperError} when `unwrappable` is set on a token that is not a stock wrapper.
      * @throws {@link SaltCollisionError} when this `(mode, deployer, userSalt)` tuple already deployed an instance.
+     * @throws {@link CreateCommitmentMismatchError} when a quoted or pinned commitment no longer matches what the factory would deploy.
      * @throws {@link MissingEncryptorError} when `amount` is given and no encryptor is resolvable.
+     * @throws {@link PredictionDriftError} when `plan` is given and the factory's Merkle implementation moved since it was taken.
+     * @throws {@link InvalidArgumentError} when `params.merkleRoot` or `expected.airdrop` disagrees with `plan`.
      */
-    createAndFundMerkleAirdrop(args: CreateAirdropArgs<MerkleAirdropParams> & FundInput & WriteAccountOverride): Promise<CreateAirdropResult>;
+    createAndFundMerkleAirdrop(args: CreateMerkleAirdropArgs & FundInput & WriteAccountOverride & ReceiptMode<true>): Promise<CreateAirdropResult>;
+    /** With `waitForReceipt: false`: returns on submission, before the receipt exists. */
+    createAndFundMerkleAirdrop(args: CreateMerkleAirdropArgs & FundInput & WriteAccountOverride & ReceiptMode<false>): Promise<PendingCreateAirdropResult>;
+    /** With a runtime `boolean`: either result, narrowed by `pending`. */
+    createAndFundMerkleAirdrop(args: CreateMerkleAirdropArgs & FundInput & WriteAccountOverride & ReceiptMode): Promise<CreateAirdropResult | PendingCreateAirdropResult>;
     /**
      * Top up the pool of an instance this factory already deployed.
      *
@@ -293,12 +332,22 @@ export declare class ConfidentialAirdropFactoryClient {
      * grants the compliance-manager clone its ACL on the amount. Sending tokens
      * to the instance directly leaves the pool unusable for compliance reads.
      *
+     * The token pulled is the one the factory recorded at create ({@link tokenOf}), not
+     * whatever the instance reports today.
+     *
+     * Prerequisite: the funder approved the factory as an ERC-7984 operator on that token
+     * (`setOperator` / `ensureOperator` from `@tokenops/sdk/fhe`). Those wait for their receipt
+     * by default, so a Safe passes `waitForReceipt: false` there too and lets the approval
+     * execute before this transaction does.
+     *
      * **Silent-zero transfers.** A short encrypted balance moves an encrypted
      * zero instead of reverting — the receipt cannot tell you value arrived.
      *
      * @param args The instance address plus exactly one of `amount` / `encryptedInput`.
      * @returns The transaction hash.
      * @throws {@link InvalidArgumentError} when `airdrop` was not created by this factory (`UnknownAirdrop`).
+     * @throws {@link InvalidArgumentError} when both or neither of `amount` / `encryptedInput` is supplied.
+     * @throws {@link MissingEncryptorError} when `amount` is given and no encryptor is resolvable.
      */
     fundAirdrop(args: {
         airdrop: Address;
@@ -362,16 +411,39 @@ export declare class ConfidentialAirdropFactoryClient {
      * @returns The page, possibly shorter than `limit`.
      */
     airdrops(offset: bigint, limit: bigint): Promise<readonly Address[]>;
+    /**
+     * Whether THIS factory created `candidate` - the genuineness check.
+     *
+     * Nothing observable at an instance proves which factory, if any, deployed
+     * it: an attacker can deploy a contract with the same ABI, the same events
+     * and a pool it controls. The only trustworthy question is whether the
+     * canonical factory's own registry contains the address, which is why this
+     * read has to be addressed to a factory taken from
+     * `src/core/addresses.ts` rather than one the instance names.
+     *
+     * @param candidate The address to check.
+     * @returns True when this factory's registry contains `candidate`.
+     */
+    isAirdrop(candidate: Address): Promise<boolean>;
     /**
      * The compliance-manager clone bound to an instance.
      *
-     * Doubles as a provenance check: the factory records this mapping only for
-     * instances it deployed, so a zero address means the instance is not ours.
+     * Doubles as a provenance check, though a weaker one than {@link isAirdrop}:
+     * the factory records this mapping only for instances it deployed, so a zero
+     * address means the instance is not ours.
      *
      * @param airdrop Instance address.
      * @returns The clone address, or the zero address when unknown to this factory.
      */
     complianceManagerOf(airdrop: Address): Promise<Address>;
+    /**
+     * The token recorded for `airdrop` at create - what {@link fundAirdrop} pulls, regardless
+     * of what the instance reports today.
+     *
+     * @param airdrop Instance address.
+     * @returns The token address, or the zero address when unknown to this factory.
+     */
+    tokenOf(airdrop: Address): Promise<Address>;
     /**
      * Redirect where accrued claim-fee ETH withdraws to. Requires
      * `FEE_MANAGER_ROLE`.
@@ -403,12 +475,43 @@ export declare class ConfidentialAirdropFactoryClient {
     feeCollector(): Promise<Address>;
     /** Per-claim gas fee new instances default to absent a {@link setCustomFee} override. */
     defaultGasFee(): Promise<bigint>;
+    /** The factory's own ceiling on every configurable fee and every create-time resolved fee. */
+    maxGasFee(): Promise<bigint>;
+    /**
+     * Set the factory's ceiling on every fee `setDefaultGasFee`/`setCustomFee`
+     * may configure, and on the fee resolved at create.
+     *
+     * Requires `DEFAULT_ADMIN_ROLE`, deliberately not `FEE_MANAGER_ROLE`: the fee
+     * manager moves fees only within a bound the admin controls. `0n` admits a
+     * zero fee and nothing else.
+     *
+     * Lowering it below an already-configured fee does not rewrite that fee - the
+     * stale value stays in storage and reverts `GasFeeExceedsMaximum` at the next
+     * create until it is lowered too. The contract sets no lower bound, so this call
+     * itself does not revert on that account.
+     */
+    setMaxGasFee(maxGasFee: bigint, account?: Account | Address): Promise<Hex>;
+    /**
+     * The per-claim fee a `create*` from `creator` would freeze into the new
+     * instance right now: their {@link getCustomFee} override when enabled, else
+     * {@link defaultGasFee}.
+     *
+     * This is the number `CommonAirdropParams.maxAcceptedGasFee` is checked
+     * against, so it is also what to show a creator before they choose a bound.
+     * It is a snapshot, not a quote: `FEE_MANAGER_ROLE` can move it between this
+     * read and the create, which is exactly what the bound exists to catch.
+     *
+     * @param creator The account that will send `create*`.
+     * @returns The resolved fee in wei.
+     */
+    resolveGasFee(creator: Address): Promise<bigint>;
     /**
      * Point future `createEcdsaAirdrop*` calls at a new ECDSA implementation.
      * Requires `IMPL_MANAGER_ROLE`. Does not affect already-deployed instances —
      * clones point at the implementation live when they were created.
      *
      * @throws {@link InvalidArgumentError} when `implementation` is the zero address (`ZeroImplementation`).
+     * @throws {@link InvalidArgumentError} when `implementation` has no code or is an EIP-7702 delegation designator (`InvalidImplementation`).
      */
     setEcdsaImplementation(implementation: Address, account?: Account | Address): Promise<Hex>;
     /**
@@ -416,6 +519,7 @@ export declare class ConfidentialAirdropFactoryClient {
      * Requires `IMPL_MANAGER_ROLE`. Does not affect already-deployed instances.
      *
      * @throws {@link InvalidArgumentError} when `implementation` is the zero address (`ZeroImplementation`).
+     * @throws {@link InvalidArgumentError} when `implementation` has no code or is an EIP-7702 delegation designator (`InvalidImplementation`).
      */
     setMerkleImplementation(implementation: Address, account?: Account | Address): Promise<Hex>;
     /** The implementation address `createEcdsaAirdrop*` currently clones. */
@@ -427,16 +531,17 @@ export declare class ConfidentialAirdropFactoryClient {
      * `COMPLIANCE_WIRING_ROLE`. Does not affect already-deployed clones.
      *
      * @throws {@link InvalidArgumentError} when `implementation` is the zero address (`ZeroComplianceManagerImpl`).
+     * @throws {@link InvalidArgumentError} when `implementation` has no code or is an EIP-7702 delegation designator (`InvalidImplementation`).
      */
     setComplianceManagerImpl(implementation: Address, account?: Account | Address): Promise<Hex>;
     /**
      * Set the platform-designated compliance delegate every compliance-manager
      * clone wires in. Requires `COMPLIANCE_WIRING_ROLE`.
      *
-     * **Ordering:** call this before {@link setDefaultDelegateToCompliance}`(true)`
-     * — the contracts' own deploy script does it in this order, and the reverse
-     * reverts `ZeroComplianceDelegate` (turning delegation on with no delegate
-     * set has nothing to delegate to).
+     * The factory's constructor already seeded a non-zero delegate with delegation ON, so
+     * this only rotates it: it can never be cleared, and the zero address always reverts.
+     * Applies to clones created after it lands; existing clones keep the delegate they were
+     * initialized with.
      *
      * @throws {@link InvalidArgumentError} when `delegate` is the zero address (`ZeroComplianceDelegate`).
      */
@@ -445,10 +550,8 @@ export declare class ConfidentialAirdropFactoryClient {
      * Set whether new instances default to delegating compliance disclosure to
      * {@link complianceDelegate}. Requires `COMPLIANCE_WIRING_ROLE`.
      *
-     * **Ordering:** call {@link setComplianceDelegate} first when turning this
-     * on — passing `true` while no delegate is set reverts `ZeroComplianceDelegate`.
-     *
-     * @throws {@link InvalidArgumentError} when `on` is `true` and no delegate is set yet (`ZeroComplianceDelegate`).
+     * The default starts ON at construction (no post-deploy wiring); passing `false` is the
+     * deliberate opt-out. A per-creator {@link setCompliancePolicy} override still wins.
      */
     setDefaultDelegateToCompliance(on: boolean, account?: Account | Address): Promise<Hex>;
     /**
@@ -465,6 +568,24 @@ export declare class ConfidentialAirdropFactoryClient {
     complianceManagerImpl(): Promise<Address>;
     /** The platform-designated compliance delegate wired into new compliance-manager clones. */
     complianceDelegate(): Promise<Address>;
+    /**
+     * The platform delegate a create from `creator` would wire into its compliance clone:
+     * `complianceDelegate()` while the creator's effective policy is ON, the zero address
+     * while it is OFF. This is the value the factory checks `expectedComplianceDelegate`
+     * against.
+     */
+    resolveComplianceDelegate(creator: Address): Promise<Address>;
+    /**
+     * Quote the {@link CreateCommitments} a create from `deployer` will be checked against,
+     * honouring anything already pinned in `expected`. The predicted address comes from the
+     * variant's prediction oracle, the other two from the factory's live configuration.
+     */
+    quoteCreateCommitments(args: AirdropVariantParams & {
+        mode: DeploymentMode;
+        deployer: Address;
+        userSalt: Hex;
+        expected?: Partial<CreateCommitments> | undefined;
+    }): Promise<CreateCommitments>;
     /** A creator's delegate-to-compliance override, if any — `overridden: false` means the factory default applies instead. */
     getCompliancePolicy(creator: Address): Promise<CompliancePolicy>;
     /**
@@ -571,17 +692,14 @@ export declare class ConfidentialAirdropFactoryClient {
     /**
      * Revoke `role` from `holder`. Requires the role's admin role.
      *
-     * Unlike an airdrop instance, the factory declares no "never empty" floor:
-     * revoking the last `DEFAULT_ADMIN_ROLE` member succeeds, and what it
-     * freezes is **role administration**, permanently. `DEFAULT_ADMIN_ROLE`
-     * administers all four operational roles and itself, so with the set empty
-     * no role can ever be granted or revoked again - including putting an admin
-     * back. The four operational roles keep working for whoever already holds
-     * them: a `FEE_MANAGER_ROLE` holder can still call {@link setDefaultGasFee},
-     * an `IMPL_MANAGER_ROLE` holder can still rotate an implementation. The
-     * factory therefore keeps running with exactly the role holders it had at
-     * that moment, with no way to rotate or remove them. Grant the successor
-     * first.
+     * **The factory floors `DEFAULT_ADMIN_ROLE` at one live member**, matching
+     * the instances. Renouncing or revoking the sole holder reverts `LastAdmin`,
+     * and granting the role to the zero address reverts `ZeroAdminGrant`, so the
+     * set can neither be emptied (which would freeze role administration
+     * permanently) nor satisfied by a member nobody controls.
+     *
+     * A handover is still available and is the supported way out: grant the
+     * successor first, then renounce.
      *
      * @returns The transaction hash.
      */
@@ -598,12 +716,9 @@ export declare class ConfidentialAirdropFactoryClient {
      * the resolved sending account. Renouncing for somebody else is not a call
      * that can succeed; use {@link revokeRole} to remove another account's role.
      *
-     * The same frozen-role-administration warning as {@link revokeRole} applies,
-     * and more sharply - a sole admin renouncing `DEFAULT_ADMIN_ROLE` is not
-     * blocked here the way it is on an instance. Read that warning for what
-     * actually stops working: role grants and revokes, permanently; not the
-     * operational setters, which keep answering to whoever already holds the
-     * role that gates them.
+     * The same `DEFAULT_ADMIN_ROLE` floor as {@link revokeRole} applies: the sole admin
+     * cannot renounce, the call reverts `LastAdmin`. Grant a successor first, then
+     * renounce.
      *
      * @returns The transaction hash.
      */
@@ -620,4 +735,3 @@ export declare class ConfidentialAirdropFactoryClient {
  * @alpha
  */
 export declare function createConfidentialAirdropFactoryClient(config: ConfidentialAirdropFactoryClientConfig): ConfidentialAirdropFactoryClient;
-export {};