@tokenops/sdk 2.0.0-alpha.3 → 2.0.0-alpha.4

package/dist/{chunk-YTIYTV4K.cjs → chunk-VHKMWWBA.cjs}

@@ -5,9 +5,12 @@ var chunk67OV5CX2_cjs = require('./chunk-67OV5CX2.cjs');
 var viem = require('viem');
 
 // src/fhe-airdrop/constants.ts
-var AIRDROP_CONTRACTS_COMMIT = "c5c12c2087f61bcd5bd1daa802563ed3cd68f002";
+var AIRDROP_CONTRACTS_COMMIT = "005980df194e0dc66053bd517e9759bd4d580047";
 var DEPLOYMENT_MODE = { clone: 0, uups: 1 };
 var DEDUP_MODE = { perAddress: 0, perDedupId: 1, both: 2, none: 3 };
+var DEDUP_MODE_BY_ORDINAL = new Map(
+  Object.keys(DEDUP_MODE).map((mode) => [DEDUP_MODE[mode], mode])
+);
 var UINT96_MAX = (1n << 96n) - 1n;
 
 // src/fhe-airdrop/errors.ts
@@ -97,6 +100,43 @@ var PredictionDriftError = class extends chunk67OV5CX2_cjs.TokenOpsSdkError {
     );
   }
 };
+var CreateCommitmentMismatchError = class extends chunk67OV5CX2_cjs.TokenOpsSdkError {
+  name = "CreateCommitmentMismatchError";
+  constructor(args) {
+    const rebuild = args.field === "airdrop" ? " Anything bound to the old prediction (Merkle leaves, vouchers, encrypted inputs) must be rebuilt." : "";
+    const { cause, ...context } = args;
+    super(
+      `${args.method}: the factory would deploy with ${args.field} = ${args.actual ?? "?"}, but the create committed to ${args.expected ?? "?"}. Nothing was deployed and the salt is unused; re-quote and retry.${rebuild}`,
+      { code: "TOKENOPS_CREATE_COMMITMENT_MISMATCH", cause, context }
+    );
+  }
+};
+var ClawbackRequiresPauseError = class extends chunk67OV5CX2_cjs.TokenOpsSdkError {
+  name = "ClawbackRequiresPauseError";
+  constructor(args) {
+    super(
+      `${args.method}: withdrawConfidential is refused while the campaign is unpaused inside its claim window. Pause first (PAUSER_ROLE), or run it outside the window (before startTime or after endTime).`,
+      {
+        code: "TOKENOPS_CLAWBACK_REQUIRES_PAUSE",
+        cause: args.cause,
+        context: { method: args.method, contractAddress: args.contractAddress }
+      }
+    );
+  }
+};
+var NativeRescueRequiresZeroFeeError = class extends chunk67OV5CX2_cjs.TokenOpsSdkError {
+  name = "NativeRescueRequiresZeroFeeError";
+  constructor(args) {
+    super(
+      `${args.method}: rescueNativeToken is only available on a zero-fee campaign; this instance charges a gas fee, so its ETH is fee revenue - use withdrawGasFee.`,
+      {
+        code: "TOKENOPS_NATIVE_RESCUE_REQUIRES_ZERO_FEE",
+        cause: args.cause,
+        context: { method: args.method, contractAddress: args.contractAddress }
+      }
+    );
+  }
+};
 var UpgradeabilityNotAllowedError = class extends chunk67OV5CX2_cjs.TokenOpsSdkError {
   name = "UpgradeabilityNotAllowedError";
   constructor(args) {
@@ -289,12 +329,16 @@ var airdropProductMapper = (name, errArgs, ctx) => {
       return new chunk67OV5CX2_cjs.FheHandleNotAllowedError({ ...ctx, handle });
     }
     // ---- Merkle-specific ----------------------------------------------
-    case "InvalidMerkleProof":
+    case "InvalidMerkleProof": {
+      const leaf = errArgs?.[0];
+      const merkleRoot = errArgs?.[1];
       return new chunk67OV5CX2_cjs.InvalidArgumentError({
         method: ctx.method,
         argument: "merkleProof",
-        reason: "the contract reverted with `InvalidMerkleProof` \u2014 the proof does not verify against the current on-chain root. If the root was recently rotated, rebuild the proof against the new root."
+        reason: "the contract reverted with `InvalidMerkleProof` \u2014 the proof does not verify against the current on-chain root. If the root was recently rotated, rebuild the proof against the new root.",
+        ...leaf !== void 0 || merkleRoot !== void 0 ? { value: { leaf, merkleRoot } } : {}
       });
+    }
     case "RootImmutable":
       return new chunk67OV5CX2_cjs.FeatureDisabledError({ ...ctx, feature: "merkleRootRotation" });
     case "ZeroAccount":
@@ -332,13 +376,10 @@ var airdropProductMapper = (name, errArgs, ctx) => {
       return new GasFeeNotAcceptedError({ ...ctx, resolvedFee, maxAcceptedGasFee });
     }
     case "GasFeeExceedsMaximum": {
-      const gasFee = errArgs?.[0];
-      const maxGasFee = errArgs?.[1];
-      return new chunk67OV5CX2_cjs.InvalidArgumentError({
+      return gasFeeExceedsMaximumError({
         method: ctx.method,
-        argument: "gasFee",
-        reason: `exceeds the factory's own maximum${gasFee !== void 0 && maxGasFee !== void 0 ? ` (${gasFee} wei > ${maxGasFee} wei)` : ""}; \`setMaxGasFee\` is DEFAULT_ADMIN_ROLE-gated and bounds what FEE_MANAGER_ROLE may configure`,
-        value: gasFee
+        gasFee: errArgs?.[0],
+        maxGasFee: errArgs?.[1]
       });
     }
     case "ZeroUnwrapRequestId":
@@ -404,7 +445,7 @@ var airdropProductMapper = (name, errArgs, ctx) => {
         ctx,
         "complianceDelegate",
         name,
-        "required while the default compliance-delegate policy is on"
+        "the factory requires a non-zero delegate (constructor, setter and create)"
       );
     case "IndexOutOfBounds": {
       const index = errArgs?.[0];
@@ -427,6 +468,48 @@ var airdropProductMapper = (name, errArgs, ctx) => {
         value: existingAirdrop
       });
     }
+    case "PredictionMismatch":
+    case "ManagerImplementationMismatch":
+    case "ComplianceDelegateMismatch": {
+      const field = name === "PredictionMismatch" ? "airdrop" : name === "ManagerImplementationMismatch" ? "complianceManagerImpl" : "complianceDelegate";
+      return new CreateCommitmentMismatchError({
+        method: ctx.method,
+        contractAddress: ctx.contractAddress,
+        field,
+        expected: errArgs?.[0],
+        actual: errArgs?.[1]
+      });
+    }
+    case "InvalidImplementation":
+      return invalidArg(ctx, "implementation", name, void 0, errArgs?.[0]);
+    case "EndTimeInPast": {
+      const endTime = numberArg(errArgs?.[0]);
+      const currentTime = numberArg(errArgs?.[1]);
+      return invalidArg(
+        ctx,
+        "endTime",
+        name,
+        endTime !== void 0 && currentTime !== void 0 ? `endTime ${endTime} is not after the chain time ${currentTime}` : void 0,
+        endTime !== void 0 || currentTime !== void 0 ? { endTime, currentTime } : void 0
+      );
+    }
+    case "InvalidDuration": {
+      const fromTime = numberArg(errArgs?.[0]);
+      const toTime = numberArg(errArgs?.[1]);
+      return invalidArg(
+        ctx,
+        "duration",
+        name,
+        fromTime !== void 0 && toTime !== void 0 ? `${toTime} does not come after ${fromTime}` : void 0,
+        fromTime !== void 0 || toTime !== void 0 ? { fromTime, toTime } : void 0
+      );
+    }
+    case "UninitializedHandle":
+      return invalidArg(ctx, "handle", name);
+    case "ClawbackRequiresPause":
+      return new ClawbackRequiresPauseError(ctx);
+    case "NativeRescueRequiresZeroFee":
+      return new NativeRescueRequiresZeroFeeError(ctx);
     case "ZeroSigner":
       return invalidArg(ctx, "signer", name);
     case "ZeroMerkleRoot":
@@ -434,7 +517,7 @@ var airdropProductMapper = (name, errArgs, ctx) => {
         ctx,
         "merkleRoot",
         name,
-        "a zero root is only permitted when `isMerkleRootMutable` is true"
+        "a zero root is permitted only at create on a mutable-root campaign, and never as a rotation target"
       );
     // ---- compliance manager clone (`ComplianceRoleManager`) --------------
     case "ZeroAirdrop":
@@ -474,15 +557,26 @@ var airdropProductMapper = (name, errArgs, ctx) => {
       return void 0;
   }
 };
-function invalidArg(ctx, argument, revertName, detail) {
+function gasFeeExceedsMaximumError(args) {
+  const { gasFee, maxGasFee } = args;
+  return new chunk67OV5CX2_cjs.InvalidArgumentError({
+    method: args.method,
+    argument: "gasFee",
+    reason: `exceeds the factory's own maximum${gasFee !== void 0 && maxGasFee !== void 0 ? ` (${gasFee} wei > ${maxGasFee} wei)` : ""}; \`setMaxGasFee\` is DEFAULT_ADMIN_ROLE-gated and bounds what FEE_MANAGER_ROLE may configure`,
+    value: gasFee
+  });
+}
+function invalidArg(ctx, argument, revertName, detail, value) {
   const suffix = detail ? ` ${detail}.` : "";
   return new chunk67OV5CX2_cjs.InvalidArgumentError({
     method: ctx.method,
     argument,
-    reason: `the contract reverted with \`${revertName}\`.${suffix}`
+    reason: `the contract reverted with \`${revertName}\`.${suffix}`,
+    ...value !== void 0 ? { value } : {}
   });
 }
 function numberArg(value) {
+  if (typeof value === "number") return value;
   return typeof value === "bigint" ? Number(value) : void 0;
 }
 var SUPPORTED_CHAIN_IDS = [1, 11155111, 31337];
@@ -549,9 +643,12 @@ function assertMaxAcceptedGasFeeRange(value, method) {
     });
   }
 }
-async function assertGasFeeAccepted(args) {
-  assertMaxAcceptedGasFeeRange(args.maxAcceptedGasFee, args.method);
-  const resolvedFee = await args.factory.resolveGasFee(args.creator);
+function assertWithinCeiling(method, resolvedFee, maxGasFee) {
+  if (resolvedFee > maxGasFee) {
+    throw gasFeeExceedsMaximumError({ method, gasFee: resolvedFee, maxGasFee });
+  }
+}
+function assertResolvedFeeAccepted(args, resolvedFee) {
   if (resolvedFee <= args.maxAcceptedGasFee) return;
   throw new GasFeeNotAcceptedError({
     method: args.method,
@@ -560,6 +657,15 @@ async function assertGasFeeAccepted(args) {
     maxAcceptedGasFee: args.maxAcceptedGasFee
   });
 }
+async function assertCreateGasFee(args) {
+  assertMaxAcceptedGasFeeRange(args.maxAcceptedGasFee, args.method);
+  const [resolvedFee, maxGasFee] = await Promise.all([
+    args.factory.resolveGasFee(args.creator),
+    args.factory.maxGasFee()
+  ]);
+  assertWithinCeiling(args.method, resolvedFee, maxGasFee);
+  assertResolvedFeeAccepted(args, resolvedFee);
+}
 function assertPredictionFresh(args) {
   if (args.initCodeHashBefore.toLowerCase() === args.initCodeHashAfter.toLowerCase()) return;
   throw new PredictionDriftError({
@@ -570,6 +676,112 @@ function assertPredictionFresh(args) {
     predictedAddress: args.predictedAddress
   });
 }
+var END_TIME_MARGIN_SECONDS = 60;
+function invalidCreateParam(method, argument, revertName, reason, value) {
+  return new chunk67OV5CX2_cjs.InvalidArgumentError({
+    method,
+    argument,
+    reason: `${reason}; the instance initializer reverts \`${revertName}\``,
+    value
+  });
+}
+function assertCreateParamsWellFormed(args, method) {
+  const { common } = args.params;
+  if (viem.isAddressEqual(common.token, viem.zeroAddress)) {
+    throw invalidCreateParam(
+      method,
+      "common.token",
+      "ZeroToken",
+      "is the zero address",
+      common.token
+    );
+  }
+  const now = Math.floor(Date.now() / 1e3);
+  if (common.endTime <= now + END_TIME_MARGIN_SECONDS) {
+    throw invalidCreateParam(
+      method,
+      "common.endTime",
+      "EndTimeInPast",
+      `is not at least ${END_TIME_MARGIN_SECONDS}s in the future`,
+      common.endTime
+    );
+  }
+  if (common.startTime > common.endTime) {
+    throw invalidCreateParam(
+      method,
+      "common.startTime",
+      "InvalidStartTime",
+      "is after `endTime`",
+      common.startTime
+    );
+  }
+  if (common.startTime === common.endTime) {
+    throw invalidCreateParam(
+      method,
+      "common.startTime",
+      "InvalidDuration",
+      "equals `endTime`, leaving a zero-length claim window",
+      common.startTime
+    );
+  }
+  if (args.variant === "merkle") {
+    const { merkleRoot, isMerkleRootMutable } = args.params;
+    if (!isMerkleRootMutable && BigInt(merkleRoot) === 0n) {
+      throw invalidCreateParam(
+        method,
+        "merkleRoot",
+        "ZeroMerkleRoot",
+        "is zero on an immutable-root campaign, so no claim could ever verify",
+        merkleRoot
+      );
+    }
+  } else if (viem.isAddressEqual(args.params.signer, viem.zeroAddress)) {
+    throw invalidCreateParam(
+      method,
+      "signer",
+      "ZeroSigner",
+      "is the zero address",
+      args.params.signer
+    );
+  }
+}
+function resolvePlannedCreate(args) {
+  const { method, params, expected, expectedInitCodeHash, plan } = args;
+  if (!plan) return { expected, expectedInitCodeHash };
+  if (params.merkleRoot.toLowerCase() !== plan.root.toLowerCase()) {
+    throw new chunk67OV5CX2_cjs.InvalidArgumentError({
+      method,
+      argument: "params.merkleRoot",
+      reason: "differs from plan.root; the plan's entries verify only against the root they were built into",
+      value: params.merkleRoot
+    });
+  }
+  if (expected?.airdrop !== void 0 && !viem.isAddressEqual(expected.airdrop, plan.predictedAddress)) {
+    throw new chunk67OV5CX2_cjs.InvalidArgumentError({
+      method,
+      argument: "expected.airdrop",
+      reason: "differs from plan.predictedAddress; a plan's leaves are bound to its predicted address, so the two cannot name different instances",
+      value: expected.airdrop
+    });
+  }
+  if (expectedInitCodeHash !== void 0 && expectedInitCodeHash.toLowerCase() !== plan.initCodeHashAfter.toLowerCase()) {
+    throw new chunk67OV5CX2_cjs.InvalidArgumentError({
+      method,
+      argument: "expectedInitCodeHash",
+      reason: "differs from plan.initCodeHashAfter; pass one or the other",
+      value: expectedInitCodeHash
+    });
+  }
+  return {
+    expected: { ...definedFields(expected), airdrop: plan.predictedAddress },
+    expectedInitCodeHash: plan.initCodeHashAfter
+  };
+}
+var COMMITMENT_FIELDS = ["airdrop", "complianceManagerImpl", "complianceDelegate"];
+function definedFields(pinned) {
+  if (!pinned) return {};
+  return Object.fromEntries(Object.entries(pinned).filter(([, value]) => value !== void 0));
+}
 async function preflightCreate(args) {
   const method = args.variant === "merkle" ? "createMerkleAirdrop" : "createEcdsaAirdrop";
   const blockers = [];
@@ -582,15 +794,34 @@ async function preflightCreate(args) {
     () => assertMaxAcceptedGasFeeRange(args.params.common.maxAcceptedGasFee, method)
   );
   if (!encodable) return { ready: false, blockers };
-  await collectAsync(
-    blockers,
-    () => assertGasFeeAccepted({
-      factory: args.factory,
-      creator: args.creator,
-      maxAcceptedGasFee: args.params.common.maxAcceptedGasFee,
-      method
-    })
-  );
+  collect(blockers, () => assertCreateParamsWellFormed(args, method));
+  let pins = { expected: args.expected, expectedInitCodeHash: args.expectedInitCodeHash };
+  if (args.variant === "merkle") {
+    const { params, plan } = args;
+    collect(blockers, () => {
+      pins = resolvePlannedCreate({ method, params, ...pins, plan });
+    });
+  }
+  const { expected, expectedInitCodeHash } = pins;
+  await collectAsync(blockers, async () => {
+    const [resolvedFee, maxGasFee] = await Promise.all([
+      args.factory.resolveGasFee(args.creator),
+      args.factory.maxGasFee()
+    ]);
+    collect(blockers, () => assertWithinCeiling(method, resolvedFee, maxGasFee));
+    collect(
+      blockers,
+      () => assertResolvedFeeAccepted(
+        {
+          factory: args.factory,
+          creator: args.creator,
+          maxAcceptedGasFee: args.params.common.maxAcceptedGasFee,
+          method
+        },
+        resolvedFee
+      )
+    );
+  });
   const predictArgs = {
     mode: args.mode,
     deployer: args.creator,
@@ -622,7 +853,7 @@ async function preflightCreate(args) {
     blockers,
     () => assertSaltAvailable({
       publicClient: args.factory.publicClient,
-      predictedAddress,
+      predictedAddress: expected?.airdrop ?? predictedAddress,
       variant: args.variant,
       mode: args.mode,
       deployer: args.creator,
@@ -630,19 +861,53 @@ async function preflightCreate(args) {
       method
     })
   );
-  if (args.expectedInitCodeHash !== void 0) {
+  if (expectedInitCodeHash !== void 0) {
+    const initCodeHashBefore = expectedInitCodeHash;
     collect(
       blockers,
       () => assertPredictionFresh({
         variant: args.variant,
-        initCodeHashBefore: args.expectedInitCodeHash,
+        initCodeHashBefore,
         initCodeHashAfter: liveInitCodeHash,
-        predictedAddress,
+        predictedAddress: expected?.airdrop ?? predictedAddress,
         method
       })
     );
   }
-  return { ready: blockers.length === 0, blockers };
+  const pinned = Object.keys(definedFields(expected)).length > 0;
+  let fresh;
+  try {
+    fresh = await args.factory.quoteCreateCommitments({
+      ...args.variant === "merkle" ? { variant: "merkle", params: args.params } : { variant: "ecdsa", params: args.params },
+      mode: args.mode,
+      deployer: args.creator,
+      userSalt: args.userSalt,
+      expected: { airdrop: predictedAddress }
+    });
+  } catch (err) {
+    if (pinned) {
+      if (!chunk67OV5CX2_cjs.isTokenOpsSdkError(err)) throw err;
+      blockers.push(err);
+    }
+  }
+  let commitments;
+  if (fresh) {
+    commitments = { ...fresh, ...definedFields(expected) };
+    for (const field of COMMITMENT_FIELDS) {
+      const pinned2 = expected?.[field];
+      if (pinned2 === void 0 || viem.isAddressEqual(pinned2, fresh[field])) continue;
+      blockers.push(
+        new CreateCommitmentMismatchError({
+          method,
+          contractAddress: args.factory.address,
+          field,
+          expected: pinned2,
+          actual: fresh[field]
+        })
+      );
+    }
+  }
+  return { ready: blockers.length === 0, blockers, ...commitments ? { commitments } : {} };
 }
 async function assertKnownAirdrop(args) {
   if (args.factory.chainId !== args.chainId) {
@@ -661,10 +926,9 @@ async function assertKnownAirdrop(args) {
   });
 }
 function assertMerkleClaimIdentity(args) {
-  const { method, account, submitter, boundTo, to, entrypoint = "claim" } = args;
+  const { method, account, submitter, to, entrypoint = "claim" } = args;
   for (const [argument, value] of [
     ["account", account],
-    ["entry.boundTo", boundTo],
     ["to", to],
     ["submitter", submitter]
   ]) {
@@ -684,13 +948,6 @@ function assertMerkleClaimIdentity(args) {
       reason: "is the zero address; the claim identity is mandatory and is never defaulted from the caller"
     });
   }
-  if (boundTo !== void 0 && !viem.isAddressEqual(boundTo, submitter)) {
-    throw new chunk67OV5CX2_cjs.InvalidArgumentError({
-      method,
-      argument: "entry.boundTo",
-      reason: `is ${boundTo}, but this transaction is sent from ${submitter}; the FHE input proof is bound to the sender, so only ${boundTo} can submit this entry`
-    });
-  }
   if (entrypoint === "claimAndUnwrap") {
     if (!viem.isAddressEqual(account, submitter)) {
       throw new chunk67OV5CX2_cjs.InvalidArgumentError({
@@ -809,17 +1066,37 @@ async function collectAsync(blockers, run) {
     blockers.push(err);
   }
 }
+var CLONE_INIT_CODE_PREFIX = "0x3d602d80600a3d3981f3363d3d373d3d3d363d73";
+var CLONE_INIT_CODE_SUFFIX = "5af43d82803e903d91602b57fd5bf3";
+function predictComplianceManagerClone(args) {
+  const salt = viem.keccak256(
+    viem.encodeAbiParameters(
+      [{ type: "address" }, { type: "string" }],
+      [viem.getAddress(args.airdrop), "compliance"]
+    )
+  );
+  const initCode = `${CLONE_INIT_CODE_PREFIX}${viem.getAddress(args.managerImplementation).slice(2).toLowerCase()}${CLONE_INIT_CODE_SUFFIX}`;
+  return viem.getCreate2Address({
+    from: viem.getAddress(args.factory),
+    salt,
+    bytecodeHash: viem.keccak256(initCode)
+  });
+}
 
 exports.AIRDROP_CONTRACTS_COMMIT = AIRDROP_CONTRACTS_COMMIT;
 exports.AlreadyClaimedError = AlreadyClaimedError;
 exports.ClaimNotStartedError = ClaimNotStartedError;
 exports.ClaimWindowClosedError = ClaimWindowClosedError;
+exports.ClawbackRequiresPauseError = ClawbackRequiresPauseError;
+exports.CreateCommitmentMismatchError = CreateCommitmentMismatchError;
 exports.DEDUP_MODE = DEDUP_MODE;
+exports.DEDUP_MODE_BY_ORDINAL = DEDUP_MODE_BY_ORDINAL;
 exports.DEPLOYMENT_MODE = DEPLOYMENT_MODE;
 exports.DedupIdConsumedError = DedupIdConsumedError;
 exports.FeeCollectorSelfAdministeredError = FeeCollectorSelfAdministeredError;
 exports.GasFeeNotAcceptedError = GasFeeNotAcceptedError;
 exports.MerkleUupsUnsupportedError = MerkleUupsUnsupportedError;
+exports.NativeRescueRequiresZeroFeeError = NativeRescueRequiresZeroFeeError;
 exports.NonStockWrapperError = NonStockWrapperError;
 exports.PredictionDriftError = PredictionDriftError;
 exports.SaltCollisionError = SaltCollisionError;
@@ -829,12 +1106,14 @@ exports.UnauthorizedRedirectError = UnauthorizedRedirectError;
 exports.UnrecognisedAirdropError = UnrecognisedAirdropError;
 exports.UpgradeabilityNotAllowedError = UpgradeabilityNotAllowedError;
 exports.airdropProductMapper = airdropProductMapper;
-exports.assertGasFeeAccepted = assertGasFeeAccepted;
+exports.assertCreateGasFee = assertCreateGasFee;
 exports.assertMerkleClaimIdentity = assertMerkleClaimIdentity;
 exports.assertMerkleModeSupported = assertMerkleModeSupported;
 exports.assertPredictionFresh = assertPredictionFresh;
 exports.assertSaltAvailable = assertSaltAvailable;
 exports.assertStockWrapper = assertStockWrapper;
 exports.assertSupportedChain = assertSupportedChain;
+exports.predictComplianceManagerClone = predictComplianceManagerClone;
 exports.preflightClaim = preflightClaim;
 exports.preflightCreate = preflightCreate;
+exports.resolvePlannedCreate = resolvePlannedCreate;

package/dist/{chunk-PG3WXT3K.cjs → chunk-YAL6JSAZ.cjs}

@@ -10,29 +10,32 @@ var DEPLOYED_ADDRESSES = {
       // mainnet omitted — not deployed.
     }
   },
-  // Airdrop v2 (tokenops-fhe-airdrop-v2 @ c5c12c2). The four contracts deploy
-  // together in one scripted run, so a chain either has all of them or none —
-  // which is what `chainsWithDeployment` assumes.
+  // Airdrop v2 (tokenops-fhe-airdrop-v2 @ AIRDROP_CONTRACTS_COMMIT). The four
+  // contracts deploy together in one scripted run, so a chain either has all of
+  // them or none - which is what `chainsWithDeployment` assumes.
   //
-  // Every address moved again at c5c12c2. The internal-audit round changed the
-  // factory and all three implementations, and CREATE3 returns a consumed salt's
-  // EXISTING address without comparing codehashes - so the run bumps the canonical
-  // salt version (2.0.0 → 2.0.2) rather than redeploying over itself. A campaign
-  // planned against the previous factory therefore predicts an address the new
-  // factory will never produce; `PredictionDriftError` is what catches that.
+  // Deployed with the CREATE3 salt version
+  // "sdk-preview-13cad511", set at deploy time; the contracts branch is unchanged
+  // and still names "2.0.2", which is already consumed on Sepolia, so a redeploy
+  // needs its own fresh salt version. A salt change is needed
+  // at all because CREATE3 returns a consumed salt's EXISTING address without
+  // comparing codehashes, so redeploying changed bytecode under the same salt
+  // would silently resolve to the old contracts. A campaign planned against a
+  // previous factory therefore predicts an address the new factory will never
+  // produce; `PredictionDriftError` is what catches that.
   fheAirdrop: {
     airdropFactory: {
-      [chains.sepolia.id]: "0xA10ff713cfeE5348313Cda0B2CA1b190A1194cab"
+      [chains.sepolia.id]: "0xD5906f366Ff50909F403c8EDfDe680015563046a"
       // mainnet omitted — ZamaConfig-gated, not deployed.
     },
     ecdsaImplementation: {
-      [chains.sepolia.id]: "0x8d4E8F379f73D5488a76B6C3CC8a2fD489936BDe"
+      [chains.sepolia.id]: "0xE27A2aF9dCBda2B06535d5502e6dbB90364b43bA"
     },
     merkleImplementation: {
-      [chains.sepolia.id]: "0x4B4F43Ed9aB3F9D10468b59C03d14f55A9d4E82F"
+      [chains.sepolia.id]: "0xccea0A916dBe5aB939915a402942EE6AFDcD505E"
     },
     complianceManagerImplementation: {
-      [chains.sepolia.id]: "0x14bdE71e6b32b50dF1a5Dca1bccD150a319168e2"
+      [chains.sepolia.id]: "0x076719596c21F0Eb358AC45649C3db387D98FADf"
     }
   },
   fheDisperse: {