@dstoken-solana/rwa-rbac 0.2.1 → 0.4.0

package/dist/index.es.js

@@ -1,7 +1,7 @@
 import { PublicKey, SystemProgram } from '@solana/web3.js';
 import { utils, Program, BN } from '@coral-xyz/anchor';
 import { TOKEN_2022_PROGRAM_ID, getAssociatedTokenAddressSync, ASSOCIATED_TOKEN_PROGRAM_ID } from '@solana/spl-token';
-import { getCreateAssetControllerIx, getAssetControllerPda, assetControllerProgramId, getAssetControllerEventAuthority, getIdentityRegistryPda, getIssueTokensIx, getTrackerAccountPda, getPolicyEnginePda, policyEngineProgramId, getIdentityAccountPda, getWalletIdentityAccountPda, getFreezeTokenIx, getThawTokenIx, getRevokeTokensIx, getCloseMintIx, getUpdateInterestBearingMintRateIx, getSeizeTokensIx, identityRegistryProgramId, getExtraMetasListPda, getPolicyEngineEventAuthority, getIdentityRegistryEventAuthority, getIdentityAccount, getRemoveLevelFromIdentityAccount, getIdentityRegistryProgram, getPolicyEngineProgram, RwaClient } from '@dstoken-solana/rwa-token-sdk';
+import { getCreateAssetControllerIx, getAssetControllerPda, assetControllerProgramId, getAssetControllerEventAuthority, getIdentityRegistryPda, getIssueTokensIx, getTrackerAccountPda, getPolicyEnginePda, policyEngineProgramId, getIdentityAccountPda, getWalletIdentityAccountPda, getFreezeTokenIx, getThawTokenIx, getRevokeTokensIx, getUpdateInterestBearingMintRateIx, getSeizeTokensIx, identityRegistryProgramId, getExtraMetasListPda, getPolicyEngineEventAuthority, getIdentityRegistryEventAuthority, getIdentityAccount, getIdentityRegistryProgram, RwaClient } from '@dstoken-solana/rwa-token-sdk';
 
 const IMR_PROGRAM = new PublicKey("D2V7wTBbNCKgYwirgRUnSmc2QyKnHSVmRotWJ4rz8Jp9");
 const RBAC_PROGRAM = new PublicKey("3g6fUgMsJQhjPUYxNjEU5PyzGf8DerbDx8p5Qh4yMnRR");
@@ -51,98 +51,6 @@ var metadata$1 = {
 	description: "Created with Anchor"
 };
 var instructions$1 = [
-	{
-		name: "add_level_to_identity_account",
-		discriminator: [
-			102,
-			204,
-			64,
-			169,
-			252,
-			177,
-			192,
-			232
-		],
-		accounts: [
-			{
-				name: "payer",
-				writable: true,
-				signer: true
-			},
-			{
-				name: "user",
-				signer: true
-			},
-			{
-				name: "controller_authority",
-				relations: [
-					"asset_access_controller"
-				]
-			},
-			{
-				name: "asset_access_controller",
-				relations: [
-					"authorized_user_role"
-				]
-			},
-			{
-				name: "authorized_user_role",
-				optional: true
-			},
-			{
-				name: "identity_registry_program",
-				address: "GZsnjqT3c5zbHqsctrJ4EG4rbEfo7ZXyyUG7aDJNmxfA"
-			},
-			{
-				name: "identity_registry"
-			},
-			{
-				name: "identity_account",
-				writable: true
-			},
-			{
-				name: "identity_account_owner",
-				docs: [
-					"to ensure that it is not an Investor account. If it is an Investor account,",
-					"CPI to IdentityMetadataRegistry should be called."
-				]
-			},
-			{
-				name: "system_program",
-				address: "11111111111111111111111111111111"
-			},
-			{
-				name: "policy_engine_program"
-			},
-			{
-				name: "policy_engine",
-				writable: true
-			},
-			{
-				name: "tracker_account"
-			},
-			{
-				name: "asset_mint"
-			},
-			{
-				name: "event_authority"
-			}
-		],
-		args: [
-			{
-				name: "level",
-				type: "u8"
-			},
-			{
-				name: "expiry",
-				type: "i64"
-			},
-			{
-				name: "enforce_limits",
-				type: "bool"
-			}
-		]
-	},
 	{
 		name: "add_levels",
 		discriminator: [
@@ -178,8 +86,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -266,8 +173,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -329,6 +235,7 @@ var instructions$1 = [
 			},
 			{
 				name: "asset_access_controller",
+				writable: true,
 				relations: [
 					"user_role",
 					"authorized_user_role"
@@ -423,8 +330,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -484,8 +390,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_registry_program",
@@ -555,8 +460,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -616,8 +520,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -677,8 +580,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -758,8 +660,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -815,8 +716,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -837,63 +737,6 @@ var instructions$1 = [
 			}
 		]
 	},
-	{
-		name: "close_mint_account",
-		discriminator: [
-			14,
-			121,
-			72,
-			246,
-			96,
-			224,
-			42,
-			162
-		],
-		accounts: [
-			{
-				name: "user",
-				signer: true
-			},
-			{
-				name: "controller_authority",
-				writable: true,
-				relations: [
-					"asset_access_controller"
-				]
-			},
-			{
-				name: "asset_access_controller",
-				relations: [
-					"authorized_user_role"
-				]
-			},
-			{
-				name: "authorized_user_role",
-				optional: true
-			},
-			{
-				name: "asset_controller_program",
-				address: "7tXjmbkZVY3Gmg9kDBebcNXT1yC5pyoxxXVLwdbv9tvP"
-			},
-			{
-				name: "asset_mint",
-				writable: true
-			},
-			{
-				name: "asset_controller"
-			},
-			{
-				name: "token_program",
-				address: "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb"
-			}
-		],
-		args: [
-			{
-				name: "cpi_data",
-				type: "bytes"
-			}
-		]
-	},
 	{
 		name: "create_controller",
 		discriminator: [
@@ -922,8 +765,8 @@ var instructions$1 = [
 				pda: {
 					seeds: [
 						{
-							kind: "arg",
-							path: "unique_seed"
+							kind: "account",
+							path: "asset_mint"
 						},
 						{
 							kind: "const",
@@ -954,6 +797,53 @@ var instructions$1 = [
 					]
 				}
 			},
+			{
+				name: "asset_access_controller_authority",
+				pda: {
+					seeds: [
+						{
+							kind: "account",
+							path: "asset_access_controller"
+						}
+					]
+				}
+			},
+			{
+				name: "asset_controller",
+				writable: true
+			},
+			{
+				name: "asset_mint",
+				writable: true,
+				signer: true
+			},
+			{
+				name: "extra_metas_account",
+				writable: true
+			},
+			{
+				name: "policy_engine_account",
+				writable: true
+			},
+			{
+				name: "identity_registry_account",
+				writable: true
+			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "identity_registry_program"
+			},
+			{
+				name: "asset_controller_program"
+			},
+			{
+				name: "asset_controller_event_authority"
+			},
+			{
+				name: "token_program"
+			},
 			{
 				name: "system_program",
 				address: "11111111111111111111111111111111"
@@ -961,8 +851,8 @@ var instructions$1 = [
 		],
 		args: [
 			{
-				name: "unique_seed",
-				type: "pubkey"
+				name: "cpi_data",
+				type: "bytes"
 			}
 		]
 	},
@@ -1001,8 +891,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_registry_program",
@@ -1019,6 +908,16 @@ var instructions$1 = [
 				name: "wallet_identity",
 				writable: true
 			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "tracker_account",
+				writable: true
+			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "system_program",
 				address: "11111111111111111111111111111111"
@@ -1088,6 +987,10 @@ var instructions$1 = [
 			{
 				name: "allowed_medici_ixs",
 				type: "u64"
+			},
+			{
+				name: "is_master_role",
+				type: "bool"
 			}
 		]
 	},
@@ -1166,8 +1069,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -1228,8 +1130,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_registry_program",
@@ -1246,6 +1147,12 @@ var instructions$1 = [
 			{
 				name: "identity_registry"
 			},
+			{
+				name: "token_account"
+			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "event_authority"
 			}
@@ -1287,8 +1194,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -1353,8 +1259,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -1467,63 +1372,6 @@ var instructions$1 = [
 			}
 		]
 	},
-	{
-		name: "refresh_level_to_identity_account",
-		discriminator: [
-			23,
-			68,
-			237,
-			111,
-			144,
-			169,
-			239,
-			91
-		],
-		accounts: [
-			{
-				name: "payer",
-				writable: true,
-				signer: true
-			},
-			{
-				name: "user",
-				signer: true
-			},
-			{
-				name: "controller_authority",
-				relations: [
-					"asset_access_controller"
-				]
-			},
-			{
-				name: "asset_access_controller",
-				relations: [
-					"authorized_user_role"
-				]
-			},
-			{
-				name: "authorized_user_role",
-				optional: true
-			},
-			{
-				name: "identity_registry_program",
-				address: "GZsnjqT3c5zbHqsctrJ4EG4rbEfo7ZXyyUG7aDJNmxfA"
-			},
-			{
-				name: "identity_registry"
-			},
-			{
-				name: "identity_account",
-				writable: true
-			}
-		],
-		args: [
-			{
-				name: "cpi_data",
-				type: "bytes"
-			}
-		]
-	},
 	{
 		name: "register_investor",
 		discriminator: [
@@ -1559,8 +1407,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -1585,6 +1432,16 @@ var instructions$1 = [
 				name: "wallet_identity",
 				writable: true
 			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "tracker_account",
+				writable: true
+			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "event_authority_identity_metadata_registry"
 			},
@@ -1609,78 +1466,11 @@ var instructions$1 = [
 			78,
 			35,
 			174,
-			50,
-			72,
-			181,
-			12,
-			42
-		],
-		accounts: [
-			{
-				name: "payer",
-				writable: true,
-				signer: true
-			},
-			{
-				name: "user",
-				signer: true
-			},
-			{
-				name: "controller_authority",
-				relations: [
-					"asset_access_controller"
-				]
-			},
-			{
-				name: "asset_access_controller",
-				relations: [
-					"authorized_user_role"
-				]
-			},
-			{
-				name: "authorized_user_role",
-				optional: true
-			},
-			{
-				name: "identity_registry_program",
-				address: "GZsnjqT3c5zbHqsctrJ4EG4rbEfo7ZXyyUG7aDJNmxfA"
-			},
-			{
-				name: "identity_registry"
-			},
-			{
-				name: "identity_account",
-				writable: true
-			},
-			{
-				name: "wallet_identity",
-				writable: true
-			},
-			{
-				name: "event_authority"
-			},
-			{
-				name: "identity_owner"
-			}
-		],
-		args: [
-			{
-				name: "cpi_data",
-				type: "bytes"
-			}
-		]
-	},
-	{
-		name: "remove_investor",
-		discriminator: [
-			93,
-			0,
-			162,
-			199,
-			76,
-			5,
-			180,
-			2
+			50,
+			72,
+			181,
+			12,
+			42
 		],
 		accounts: [
 			{
@@ -1705,16 +1495,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
-			},
-			{
-				name: "identity_metadata_registry_program",
-				address: "D2V7wTBbNCKgYwirgRUnSmc2QyKnHSVmRotWJ4rz8Jp9"
-			},
-			{
-				name: "investor",
-				writable: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_registry_program",
@@ -1732,34 +1513,40 @@ var instructions$1 = [
 				writable: true
 			},
 			{
-				name: "policy_engine_program",
-				address: "FsE8mCJyvgMzqJbfHbJQm3iuf3cRZC6n2vZi1Q8rQCy2"
+				name: "event_authority"
 			},
 			{
-				name: "tracker_account",
-				writable: true
+				name: "identity_owner"
 			},
 			{
-				name: "event_authority_identity_metadata_registry"
+				name: "policy_engine_program"
 			},
 			{
-				name: "event_authority_identity_registry"
+				name: "tracker_account",
+				writable: true
+			},
+			{
+				name: "asset_mint"
 			}
 		],
 		args: [
+			{
+				name: "cpi_data",
+				type: "bytes"
+			}
 		]
 	},
 	{
-		name: "remove_level_from_identity_account",
+		name: "remove_investor",
 		discriminator: [
-			194,
-			231,
-			187,
-			54,
-			197,
-			136,
-			170,
-			55
+			93,
+			0,
+			162,
+			199,
+			76,
+			5,
+			180,
+			2
 		],
 		accounts: [
 			{
@@ -1784,8 +1571,15 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
+			},
+			{
+				name: "identity_metadata_registry_program",
+				address: "D2V7wTBbNCKgYwirgRUnSmc2QyKnHSVmRotWJ4rz8Jp9"
+			},
+			{
+				name: "investor",
+				writable: true
 			},
 			{
 				name: "identity_registry_program",
@@ -1799,38 +1593,28 @@ var instructions$1 = [
 				writable: true
 			},
 			{
-				name: "identity_account_owner",
-				docs: [
-					"to ensure that it is not an Investor account. If it is an Investor account,",
-					"CPI to IdentityMetadataRegistry should be called."
-				]
-			},
-			{
-				name: "system_program",
-				address: "11111111111111111111111111111111"
+				name: "wallet_identity",
+				writable: true
 			},
 			{
-				name: "policy_engine_program"
+				name: "policy_engine_program",
+				address: "FsE8mCJyvgMzqJbfHbJQm3iuf3cRZC6n2vZi1Q8rQCy2"
 			},
 			{
-				name: "policy_engine",
+				name: "tracker_account",
 				writable: true
 			},
 			{
-				name: "tracker_account"
+				name: "event_authority_identity_metadata_registry"
 			},
 			{
-				name: "asset_mint"
+				name: "event_authority_identity_registry"
 			},
 			{
-				name: "event_authority"
+				name: "asset_mint"
 			}
 		],
 		args: [
-			{
-				name: "cpi_data",
-				type: "bytes"
-			}
 		]
 	},
 	{
@@ -1868,8 +1652,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -1953,8 +1736,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -2097,8 +1879,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2189,8 +1970,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2260,8 +2040,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -2347,8 +2126,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2417,8 +2195,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2512,8 +2289,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2680,6 +2456,31 @@ var errors$1 = [
 		code: 6007,
 		name: "IllegalOperation",
 		msg: "Illegal operation"
+	},
+	{
+		code: 6008,
+		name: "InvalidFlags",
+		msg: "Invalid flag bits"
+	},
+	{
+		code: 6009,
+		name: "CannotEmptyMasterRole",
+		msg: "Cannot empty master role of users"
+	},
+	{
+		code: 6010,
+		name: "CannotVoidAuthority",
+		msg: "Cannot void authority"
+	},
+	{
+		code: 6011,
+		name: "InvalidMasterRole",
+		msg: "Invalid master role"
+	},
+	{
+		code: 6012,
+		name: "CannotDeleteMasterRole",
+		msg: "Cannot delete master role"
 	}
 ];
 var types$1 = [
@@ -2710,9 +2511,9 @@ var types$1 = [
 					type: "pubkey"
 				},
 				{
-					name: "unique_seed",
+					name: "asset_mint",
 					docs: [
-						"Unique seed used for creating this account."
+						"Asset mint that is going to be managed by this controller."
 					],
 					type: "pubkey"
 				},
@@ -2723,6 +2524,13 @@ var types$1 = [
 					],
 					type: "u64"
 				},
+				{
+					name: "has_master_role",
+					docs: [
+						"Whether a master role exists."
+					],
+					type: "bool"
+				},
 				{
 					name: "lut_address",
 					docs: [
@@ -2757,7 +2565,7 @@ var types$1 = [
 					type: "pubkey"
 				},
 				{
-					name: "seed",
+					name: "asset_mint",
 					type: "pubkey"
 				}
 			]
@@ -2787,7 +2595,7 @@ var types$1 = [
 					type: "pubkey"
 				},
 				{
-					name: "seed",
+					name: "asset_mint",
 					type: "pubkey"
 				}
 			]
@@ -2833,6 +2641,13 @@ var types$1 = [
 					],
 					type: "u64"
 				},
+				{
+					name: "is_master_role",
+					docs: [
+						"If true, this is the master role."
+					],
+					type: "bool"
+				},
 				{
 					name: "users",
 					docs: [
@@ -3196,6 +3011,16 @@ var instructions = [
 				name: "wallet_identity",
 				writable: true
 			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "tracker_account",
+				writable: true
+			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "system_program",
 				address: "11111111111111111111111111111111"
@@ -3318,6 +3143,9 @@ var instructions = [
 			{
 				name: "event_authority_identity_registry"
 			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "event_authority",
 				pda: {
@@ -3772,33 +3600,32 @@ var MediciFlags;
     MediciFlags[MediciFlags["FREEZE_TOKEN_ACCOUNT"] = 4] = "FREEZE_TOKEN_ACCOUNT";
     MediciFlags[MediciFlags["ISSUE_TOKENS"] = 8] = "ISSUE_TOKENS";
     MediciFlags[MediciFlags["REVOKE_TOKENS"] = 16] = "REVOKE_TOKENS";
-    MediciFlags[MediciFlags["CLOSE_MINT_ACCOUNT"] = 32] = "CLOSE_MINT_ACCOUNT";
-    MediciFlags[MediciFlags["UPDATE_INTEREST_BEARING_MINT_RATE"] = 64] = "UPDATE_INTEREST_BEARING_MINT_RATE";
-    MediciFlags[MediciFlags["ATTACH_TO_POLICY_ACCOUNT"] = 128] = "ATTACH_TO_POLICY_ACCOUNT";
-    MediciFlags[MediciFlags["CREATE_POLICY_ACCOUNT"] = 256] = "CREATE_POLICY_ACCOUNT";
-    MediciFlags[MediciFlags["DETACH_FROM_POLICY_ACCOUNT"] = 512] = "DETACH_FROM_POLICY_ACCOUNT";
-    MediciFlags[MediciFlags["ADD_LEVELS"] = 1024] = "ADD_LEVELS";
-    MediciFlags[MediciFlags["ADD_LEVEL_TO_IDENTITY_ACCOUNT"] = 2048] = "ADD_LEVEL_TO_IDENTITY_ACCOUNT";
-    MediciFlags[MediciFlags["REGISTER_INVESTOR"] = 4096] = "REGISTER_INVESTOR";
-    MediciFlags[MediciFlags["REMOVE_LEVELS"] = 8192] = "REMOVE_LEVELS";
-    MediciFlags[MediciFlags["REMOVE_INVESTOR"] = 16384] = "REMOVE_INVESTOR";
-    MediciFlags[MediciFlags["EDIT_IDENTITY_METADATA"] = 32768] = "EDIT_IDENTITY_METADATA";
-    MediciFlags[MediciFlags["REFRESH_LEVEL_TO_IDENTITY_ACCOUNT"] = 65536] = "REFRESH_LEVEL_TO_IDENTITY_ACCOUNT";
-    MediciFlags[MediciFlags["ATTACH_WALLET_TO_IDENTITY"] = 131072] = "ATTACH_WALLET_TO_IDENTITY";
-    MediciFlags[MediciFlags["DETACH_WALLET_FROM_IDENTITY"] = 262144] = "DETACH_WALLET_FROM_IDENTITY";
-    MediciFlags[MediciFlags["SEIZE_TOKENS"] = 524288] = "SEIZE_TOKENS";
-    MediciFlags[MediciFlags["CREATE_IDENTITY_ACCOUNT"] = 1048576] = "CREATE_IDENTITY_ACCOUNT";
-    MediciFlags[MediciFlags["CREATE_INVESTOR_LOCKS"] = 2097152] = "CREATE_INVESTOR_LOCKS";
-    MediciFlags[MediciFlags["CLOSE_INVESTOR_LOCKS"] = 4194304] = "CLOSE_INVESTOR_LOCKS";
-    MediciFlags[MediciFlags["ADD_TOKEN_LOCK"] = 8388608] = "ADD_TOKEN_LOCK";
-    MediciFlags[MediciFlags["REMOVE_TOKEN_LOCK"] = 16777216] = "REMOVE_TOKEN_LOCK";
-    MediciFlags[MediciFlags["CHANGE_COUNTERS"] = 33554432] = "CHANGE_COUNTERS";
-    MediciFlags[MediciFlags["CHANGE_COUNTER_LIMITS"] = 67108864] = "CHANGE_COUNTER_LIMITS";
-    MediciFlags[MediciFlags["CHANGE_COUNTRY"] = 134217728] = "CHANGE_COUNTRY";
-    MediciFlags[MediciFlags["CHANGE_MAPPING"] = 268435456] = "CHANGE_MAPPING";
-    MediciFlags[MediciFlags["CHANGE_ISSUANCE_POLICIES"] = 536870912] = "CHANGE_ISSUANCE_POLICIES";
-    MediciFlags[MediciFlags["REMOVE_IDENTITY_ACCOUNT"] = 1073741824] = "REMOVE_IDENTITY_ACCOUNT";
-    MediciFlags[MediciFlags["ALL"] = 2147483647] = "ALL";
+    MediciFlags[MediciFlags["UPDATE_INTEREST_BEARING_MINT_RATE"] = 32] = "UPDATE_INTEREST_BEARING_MINT_RATE";
+    MediciFlags[MediciFlags["ATTACH_TO_POLICY_ACCOUNT"] = 64] = "ATTACH_TO_POLICY_ACCOUNT";
+    MediciFlags[MediciFlags["CREATE_POLICY_ACCOUNT"] = 128] = "CREATE_POLICY_ACCOUNT";
+    MediciFlags[MediciFlags["DETACH_FROM_POLICY_ACCOUNT"] = 256] = "DETACH_FROM_POLICY_ACCOUNT";
+    MediciFlags[MediciFlags["ADD_LEVELS"] = 512] = "ADD_LEVELS";
+    MediciFlags[MediciFlags["ADD_LEVEL_TO_IDENTITY_ACCOUNT"] = 1024] = "ADD_LEVEL_TO_IDENTITY_ACCOUNT";
+    MediciFlags[MediciFlags["REGISTER_INVESTOR"] = 2048] = "REGISTER_INVESTOR";
+    MediciFlags[MediciFlags["REMOVE_LEVELS"] = 4096] = "REMOVE_LEVELS";
+    MediciFlags[MediciFlags["REMOVE_INVESTOR"] = 8192] = "REMOVE_INVESTOR";
+    MediciFlags[MediciFlags["EDIT_IDENTITY_METADATA"] = 16384] = "EDIT_IDENTITY_METADATA";
+    MediciFlags[MediciFlags["REFRESH_LEVEL_TO_IDENTITY_ACCOUNT"] = 32768] = "REFRESH_LEVEL_TO_IDENTITY_ACCOUNT";
+    MediciFlags[MediciFlags["ATTACH_WALLET_TO_IDENTITY"] = 65536] = "ATTACH_WALLET_TO_IDENTITY";
+    MediciFlags[MediciFlags["DETACH_WALLET_FROM_IDENTITY"] = 131072] = "DETACH_WALLET_FROM_IDENTITY";
+    MediciFlags[MediciFlags["SEIZE_TOKENS"] = 262144] = "SEIZE_TOKENS";
+    MediciFlags[MediciFlags["CREATE_IDENTITY_ACCOUNT"] = 524288] = "CREATE_IDENTITY_ACCOUNT";
+    MediciFlags[MediciFlags["CREATE_INVESTOR_LOCKS"] = 1048576] = "CREATE_INVESTOR_LOCKS";
+    MediciFlags[MediciFlags["CLOSE_INVESTOR_LOCKS"] = 2097152] = "CLOSE_INVESTOR_LOCKS";
+    MediciFlags[MediciFlags["ADD_TOKEN_LOCK"] = 4194304] = "ADD_TOKEN_LOCK";
+    MediciFlags[MediciFlags["REMOVE_TOKEN_LOCK"] = 8388608] = "REMOVE_TOKEN_LOCK";
+    MediciFlags[MediciFlags["CHANGE_COUNTERS"] = 16777216] = "CHANGE_COUNTERS";
+    MediciFlags[MediciFlags["CHANGE_COUNTER_LIMITS"] = 33554432] = "CHANGE_COUNTER_LIMITS";
+    MediciFlags[MediciFlags["CHANGE_COUNTRY"] = 67108864] = "CHANGE_COUNTRY";
+    MediciFlags[MediciFlags["CHANGE_MAPPING"] = 134217728] = "CHANGE_MAPPING";
+    MediciFlags[MediciFlags["CHANGE_ISSUANCE_POLICIES"] = 268435456] = "CHANGE_ISSUANCE_POLICIES";
+    MediciFlags[MediciFlags["REMOVE_IDENTITY_ACCOUNT"] = 536870912] = "REMOVE_IDENTITY_ACCOUNT";
+    MediciFlags[MediciFlags["ALL"] = 1073741823] = "ALL";
 })(MediciFlags || (MediciFlags = {}));
 
 /******************************************************************************
@@ -3853,7 +3680,7 @@ class AssetController {
      * Update the asset controller's metadata.
      * @param args - {@link UpdateAssetMetadataArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to update the asset controller's metadata.
      * */
     updateAssetMetadata(args, assetAccessController, authorizedUserRole) {
@@ -3882,7 +3709,7 @@ class AssetController {
      * Asynchronously generates instructions to issue tokens and lock tokens according to issuance policy.
      * @param args - {@link IssueTokensWithLockArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      */
     issueTokenIxns(args, assetAccessController, authorizedUserRole) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -3929,16 +3756,6 @@ class AssetController {
                 .instruction();
         });
     }
-    /**
-     * Asynchronously generates instructions to revoke assets.
-     * @param args - {@link VoidTokensArgs}
-     * @returns A Promise that resolves to the instructions to revoke assets.
-     */
-    voidTokenIxns(args) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.rwaClient.assetController.voidTokenIxns(args);
-        });
-    }
     /**
      * Executes a token transfer.
      * @param args - {@link TransferTokensArgs}
@@ -3953,7 +3770,7 @@ class AssetController {
      * Asynchronously generates instruction to freeze a token account.
      * @param args - {@link FreezeTokenArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instruction to freeze.
      */
     freezeTokenIxn(args, assetAccessController, authorizedUserRole) {
@@ -3981,7 +3798,7 @@ class AssetController {
      * Asynchronously generates instruction to thaw a token account.
      * @param args - {@link FreezeTokenArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instruction to thaw.
      */
     thawTokenIxn(args, assetAccessController, authorizedUserRole) {
@@ -4009,13 +3826,13 @@ class AssetController {
     /**
      * Asynchronously generates instructions to revoke tokens from a user.
      * @param args - {@link RevokeTokensArgs}
-     * @param payer - Payer public key.
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
+     * @param investorId - Optional investorId. Required if user is not an investor.
      * @returns A Promise that resolves to the instructions to revoke.
      */
-    revokeTokenIxn(args, investorId, signer, assetAccessController, authorizedUserRole) {
+    revokeTokenIxn(args, signer, assetAccessController, authorizedUserRole, investorId) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args.wallet) {
                 throw new Error("Use wallet arg for wallet to revoke tokens from.");
@@ -4024,7 +3841,9 @@ class AssetController {
             args.owner = args.wallet;
             const revokeIx = yield getRevokeTokensIx(args, this.rwaClient.provider);
             const identityRegistry = getIdentityRegistryPda(args.assetMint);
-            const investorPda = deriveInvestorPda(investorId, identityRegistry);
+            const investorPda = investorId
+                ? deriveInvestorPda(investorId, identityRegistry)
+                : null;
             const ixData = revokeIx.data;
             const assetController = getAssetControllerPda(args.assetMint);
             const revokeTokenAccount = getAssociatedTokenAddressSync(new PublicKey(args.assetMint), new PublicKey(args.wallet), false, TOKEN_2022_PROGRAM_ID);
@@ -4040,8 +3859,8 @@ class AssetController {
                 assetController,
                 revokeTokenAccount,
                 identityRegistry,
-                identityAccount: getIdentityAccountPda(args.assetMint, investorPda.toString()),
-                trackerAccount: getTrackerAccountPda(args.assetMint, investorPda.toString()),
+                identityAccount: getIdentityAccountPda(args.assetMint, investorId ? investorPda.toString() : args.owner),
+                trackerAccount: getTrackerAccountPda(args.assetMint, investorId ? investorPda.toString() : args.owner),
                 policyEngineProgram: policyEngineProgramId,
                 policyEngine: getPolicyEnginePda(args.assetMint),
                 walletIdentityAccount: getWalletIdentityAccountPda(args.assetMint, args.wallet),
@@ -4053,37 +3872,11 @@ class AssetController {
                 .instruction();
         });
     }
-    /**
-     * Asynchronously generates instruction to close mint.
-     * @param args - {@link CloseMintArgs}
-     * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
-     * @returns A Promise that resolves to the instruction to close mint.
-     */
-    closeMintIxn(args, assetAccessController, authorizedUserRole) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const closeIx = yield getCloseMintIx(args, this.rwaClient.provider);
-            const ixData = closeIx.data;
-            return this.rbacProgram.methods
-                .closeMintAccount(ixData)
-                .accountsStrict({
-                user: args.signer,
-                controllerAuthority: args.authority,
-                assetAccessController,
-                authorizedUserRole: authorizedUserRole || null,
-                assetControllerProgram: assetControllerProgramId,
-                assetMint: args.assetMint,
-                assetController: getAssetControllerPda(args.assetMint),
-                tokenProgram: TOKEN_2022_PROGRAM_ID,
-            })
-                .instruction();
-        });
-    }
     /**
      * Asynchronously generates instruction to update mint interest rate.
      * @param args - {@link UpdateInterestBearingMintRateArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instruction to update mint interest rate.
      */
     updateInterestBearingMintRateIxn(args, assetAccessController, authorizedUserRole) {
@@ -4111,7 +3904,7 @@ class AssetController {
      * @param args - {@link SeizeTokensArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instruction to seize.
      */
     seizeTokensIxn(args, investorId, signer, assetAccessController, authorizedUserRole) {
@@ -4209,7 +4002,7 @@ class PolicyEngine {
      * @param args - {@link AttachPolicyArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to attach a policy.
      * */
     attachPolicy(args, signer, assetAccessController, authorizedUserRole) {
@@ -4237,7 +4030,7 @@ class PolicyEngine {
      * @param args - {@link DetachPolicyArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to detach a policy.
      * */
     detachPolicy(args, signer, assetAccessController, authorizedUserRole) {
@@ -4265,7 +4058,7 @@ class PolicyEngine {
      * @param args - {@link ChangeCountersArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to change the counters.
      * */
     changeCounters(args, signer, assetAccessController, authorizedUserRole) {
@@ -4293,7 +4086,7 @@ class PolicyEngine {
      * @param args - {@link SetCountersArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to set the counter values.
      * */
     setCounters(args, signer, assetAccessController, authorizedUserRole) {
@@ -4320,7 +4113,7 @@ class PolicyEngine {
      * @param args - {@link ChangeCounterLimitsArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to change the counters limits.
      * */
     changeCounterLimits(args, signer, assetAccessController, authorizedUserRole) {
@@ -4348,7 +4141,7 @@ class PolicyEngine {
      * @param args - {@link ChangeMappingArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * */
     changeMapping(args, signer, assetAccessController, authorizedUserRole) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -4374,7 +4167,7 @@ class PolicyEngine {
      * @param args - {@link ChangeIssuancePoliciesArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * */
     changeIssuancePolicies(args, signer, assetAccessController, authorizedUserRole) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -4458,7 +4251,7 @@ class IdentityRegistry {
      * @param args - {@link SetupUserArgs}
      * @param authority - RBAC AssetAccessController ControllerAuthority.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to setup a user.
      *
      * It is required for at least a single user to be setup before issuing tokens.
@@ -4468,7 +4261,6 @@ class IdentityRegistry {
             const { ixs } = yield this.rwaClient.identityRegistry.setupUserIxns(args);
             const returnIxs = [];
             const identityAccountIx = ixs[0];
-            const trackerAccountIx = ixs[1];
             const controllerAuthority = deriveControllerAuthorityPda(assetAccessController);
             const identityAccount = getIdentityAccountPda(args.assetMint, args.owner);
             returnIxs.push(yield this.rbacProgram.methods
@@ -4485,9 +4277,11 @@ class IdentityRegistry {
                 walletIdentity: getWalletIdentityAccountPda(args.assetMint, args.owner),
                 systemProgram: SystemProgram.programId,
                 eventAuthority: getIdentityRegistryEventAuthority(),
+                policyEngineProgram: policyEngineProgramId,
+                trackerAccount: getTrackerAccountPda(args.assetMint, args.owner),
+                assetMint: args.assetMint,
             })
                 .instruction());
-            returnIxs.push(trackerAccountIx);
             return {
                 ixs: returnIxs,
                 signers: [],
@@ -4499,7 +4293,7 @@ class IdentityRegistry {
      * @param args - {@link SetupUserArgs}
      * @param authority - RBAC AssetAccessController ControllerAuthority.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to setup a user.
      *
      * It is required for at least a single user to be setup before issuing tokens.
@@ -4524,122 +4318,19 @@ class IdentityRegistry {
                 walletIdentity: getWalletIdentityAccountPda(args.assetMint, args.owner),
                 eventAuthority: getIdentityRegistryEventAuthority(),
                 identityOwner: identityAccount.owner,
-            })
-                .instruction();
-            return returnIx;
-        });
-    }
-    /**
-     * Asynchronously update a non-investor user identity account level.
-     * @param args - {@link AddLevelToIdentityAccountArgs}
-     * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
-     * @returns A Promise that resolves to the instructions to update user account identity.
-     * */
-    addIdentityLevelToUserAccount(args, assetAccessController, authorizedUserRole) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            const identityAccount = getIdentityAccountPda(args.assetMint, args.owner);
-            const controllerAuthority = deriveControllerAuthorityPda(assetAccessController);
-            return this.rbacProgram.methods
-                .addLevelToIdentityAccount(args.levels[0], args.expiries[0], (_a = args.ignorePolicy) !== null && _a !== void 0 ? _a : false)
-                .accountsStrict({
-                payer: args.payer,
-                user: args.signer,
-                controllerAuthority,
-                assetAccessController,
-                authorizedUserRole: authorizedUserRole || null,
-                identityRegistryProgram: identityRegistryProgramId,
-                identityRegistry: getIdentityRegistryPda(args.assetMint),
-                identityAccount,
-                identityAccountOwner: args.owner,
-                systemProgram: SystemProgram.programId,
-                policyEngineProgram: policyEngineProgramId,
-                policyEngine: getPolicyEnginePda(args.assetMint),
-                trackerAccount: getTrackerAccountPda(args.assetMint, args.owner),
-                assetMint: args.assetMint,
-                eventAuthority: getIdentityRegistryEventAuthority(),
-            })
-                .instruction();
-        });
-    }
-    /**
-     * Asynchronously reduces a non-Investor user identity account level.
-     * @param args - {@link RemoveLevelFromIdentityAccount}
-     * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
-     * @returns A Promise that resolves to the instructions to reduce the level of a user identity account.
-     */
-    removeIdentityLevelFromUserAccount(args, assetAccessController, authorizedUserRole) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const removeLevelIx = yield getRemoveLevelFromIdentityAccount(args, this.rwaClient.provider);
-            const ixData = removeLevelIx.data;
-            const controllerAuthority = deriveControllerAuthorityPda(assetAccessController);
-            const identityAccount = getIdentityAccountPda(args.assetMint, args.owner);
-            return this.rbacProgram.methods
-                .removeLevelFromIdentityAccount(ixData)
-                .accountsStrict({
-                payer: args.payer,
-                user: args.signer,
-                controllerAuthority,
-                assetAccessController,
-                authorizedUserRole: authorizedUserRole || null,
-                identityRegistryProgram: identityRegistryProgramId,
-                identityRegistry: getIdentityRegistryPda(args.assetMint),
-                identityAccount,
-                identityAccountOwner: args.owner,
-                systemProgram: SystemProgram.programId,
                 policyEngineProgram: policyEngineProgramId,
-                policyEngine: getPolicyEnginePda(args.assetMint),
                 trackerAccount: getTrackerAccountPda(args.assetMint, args.owner),
                 assetMint: args.assetMint,
-                eventAuthority: getIdentityRegistryEventAuthority(),
-            })
-                .instruction();
-        });
-    }
-    /**
-     * Asynchronously generates instruction to refresh expiry on an Identity Account level.
-     * @param args - {@link RefreshLevelArgs}
-     * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
-     * @returns A Promise that resolves to refresh expiry on an Identity Account level.
-     * */
-    refreshLevelToIdentityAccountIxn(args, assetAccessController, authorizedUserRole) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const identityProgram = getIdentityRegistryProgram(this.rwaClient.provider);
-            const identityRegistry = getIdentityRegistryPda(args.assetMint);
-            const identityAccount = getIdentityAccountPda(args.assetMint, args.owner);
-            const controllerAuthority = deriveControllerAuthorityPda(assetAccessController);
-            const refreshIx = yield identityProgram.methods
-                .refreshLevelToIdentityAccount(args.level, args.expiry)
-                .accountsStrict({
-                payer: args.payer,
-                signer: controllerAuthority,
-                identityRegistry,
-                identityAccount,
-            })
-                .instruction();
-            return this.rbacProgram.methods
-                .refreshLevelToIdentityAccount(refreshIx.data)
-                .accountsStrict({
-                payer: args.payer,
-                user: args.signer,
-                controllerAuthority,
-                assetAccessController,
-                authorizedUserRole: authorizedUserRole || null,
-                identityRegistryProgram: identityRegistryProgramId,
-                identityRegistry,
-                identityAccount,
             })
                 .instruction();
+            return returnIx;
         });
     }
     /**
      * Asynchronously generates instruction to attach wallet to identity.
      * @param args - {@link AttachDetachWalletArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to attach wallet.
      * */
     attachWalletToIdentityIxn(args, assetAccessController, authorizedUserRole) {
@@ -4687,7 +4378,7 @@ class IdentityRegistry {
      * Asynchronously generates instruction to detach wallet from identity.
      * @param args - {@link AttachDetachWalletArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to detach wallet.
      * */
     detachWalletFromIdentityIxn(args, assetAccessController, authorizedUserRole) {
@@ -4697,6 +4388,7 @@ class IdentityRegistry {
             const identityRegistry = getIdentityRegistryPda(args.assetMint);
             const identityAccount = getIdentityAccountPda(args.assetMint, args.owner);
             const walletIdentity = getWalletIdentityAccountPda(args.assetMint, args.wallet.toString());
+            const tokenAccount = getAssociatedTokenAddressSync(new PublicKey(args.assetMint), new PublicKey(args.wallet), false, TOKEN_2022_PROGRAM_ID);
             const ix = yield identityProgram.methods
                 .detachWalletFromIdentity()
                 .accountsStrict({
@@ -4707,6 +4399,8 @@ class IdentityRegistry {
                 identityRegistry,
                 eventAuthority: getIdentityRegistryEventAuthority(),
                 program: identityRegistryProgramId,
+                tokenAccount: tokenAccount,
+                assetMint: args.assetMint,
             })
                 .instruction();
             return this.rbacProgram.methods
@@ -4722,6 +4416,8 @@ class IdentityRegistry {
                 identityAccount,
                 identityRegistry,
                 eventAuthority: getIdentityRegistryEventAuthority(),
+                tokenAccount: tokenAccount,
+                assetMint: args.assetMint,
             })
                 .instruction();
         });
@@ -4763,7 +4459,7 @@ class IdentityMetadataRegistry {
      * @param args - {@link SetupInvestorArgs}
      * @param authority - RBAC AssetAccessController ControllerAuthority.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to setup an investor.
      *
      * It is required for at least a single user to be setup before issuing tokens.
@@ -4792,6 +4488,9 @@ class IdentityMetadataRegistry {
                 eventAuthority: getEventAuthority(IMR_PROGRAM),
                 eventAuthorityIdentityRegistry: getIdentityRegistryEventAuthority(),
                 program: identityRegistryProgramId,
+                policyEngineProgram: policyEngineProgramId,
+                trackerAccount: getTrackerAccountPda(args.assetMint, investor.toString()),
+                assetMint: assetMintKey,
             })
                 .instruction();
             returnIxs.push(yield this.rbacProgram.methods
@@ -4811,21 +4510,9 @@ class IdentityMetadataRegistry {
                 systemProgram: SystemProgram.programId,
                 eventAuthorityIdentityMetadataRegistry: getEventAuthority(IMR_PROGRAM),
                 eventAuthorityIdentityRegistry: getIdentityRegistryEventAuthority(),
-            })
-                .instruction());
-            const policyProgram = getPolicyEngineProgram(this.imrProgram.provider);
-            const trackerAccount = PublicKey.findProgramAddressSync([assetMintKey.toBuffer(), identityAccount.toBuffer()], policyProgram.programId)[0];
-            returnIxs.push(yield policyProgram.methods
-                .createTrackerAccount()
-                .accountsStrict({
-                payer: args.payer,
-                trackerAccount,
-                systemProgram: SystemProgram.programId,
-                program: policyProgram.programId,
+                policyEngineProgram: policyEngineProgramId,
+                trackerAccount: getTrackerAccountPda(args.assetMint, investor.toString()),
                 assetMint: assetMintKey,
-                eventAuthority: getPolicyEngineEventAuthority(),
-                identityRegistry,
-                identityAccount,
             })
                 .instruction());
             if (args.levels.length > 1) {
@@ -4850,7 +4537,7 @@ class IdentityMetadataRegistry {
      * Asynchronously add levels to investor.
      * @param args - {@link AddLevelsArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to add levels.
      * */
     addLevels(args, assetAccessController, authorizedUserRole) {
@@ -4908,7 +4595,7 @@ class IdentityMetadataRegistry {
      * Asynchronously change country for the Investor.
      * @param args - {@link ChangeCountryArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to change the country.
      * */
     changeCountry(args, assetAccessController, authorizedUserRole) {
@@ -4961,7 +4648,7 @@ class IdentityMetadataRegistry {
      * Asynchronously remove levels from an investor.
      * @param args - {@link RemoveLevelsArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to remove levels.
      * */
     removeLevels(args, assetAccessController, authorizedUserRole) {
@@ -5016,7 +4703,7 @@ class IdentityMetadataRegistry {
      * Asynchronously remove an investor.
      * @param args - {@link RemoveLevelsArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to remove an investor.
      * */
     removeInvestor(args, assetAccessController, authorizedUserRole) {
@@ -5043,6 +4730,7 @@ class IdentityMetadataRegistry {
                 trackerAccount: getTrackerAccountPda(args.assetMint, investor.toString()),
                 eventAuthorityIdentityMetadataRegistry: getEventAuthority(IMR_PROGRAM),
                 eventAuthorityIdentityRegistry: getIdentityRegistryEventAuthority(),
+                assetMint: args.assetMint,
             })
                 .instruction();
         });
@@ -5114,13 +4802,36 @@ class RwaRbacClient {
      */
     createAssetAccessControllerIxn(args) {
         return __awaiter(this, void 0, void 0, function* () {
+            const assetAccessController = deriveAssetAccessControllerPda(args.assetMint);
+            const assetAccessControllerAuthority = deriveControllerAuthorityPda(assetAccessController);
+            const cpiInstruction = yield this.assetController.setupNewRegistry({
+                decimals: args.decimals,
+                authority: assetAccessControllerAuthority.toString(),
+                name: args.name,
+                uri: args.uri,
+                symbol: args.symbol,
+                interestRate: args.interestRate,
+                assetMint: args.assetMint.toString(),
+                payer: args.payer.toString(),
+            });
             return this.rbacProgram.methods
-                .createController(args.uniqueSeed)
+                .createController(cpiInstruction.data)
                 .accountsStrict({
                 payer: args.payer,
                 admin: args.admin,
-                assetAccessController: deriveAssetAccessControllerPda(args.uniqueSeed),
+                assetAccessController,
+                assetAccessControllerAuthority,
+                assetMint: args.assetMint,
+                assetController: cpiInstruction.keys[2].pubkey,
+                extraMetasAccount: cpiInstruction.keys[4].pubkey,
+                policyEngineAccount: cpiInstruction.keys[5].pubkey,
+                identityRegistryAccount: cpiInstruction.keys[6].pubkey,
+                policyEngineProgram: cpiInstruction.keys[7].pubkey,
+                identityRegistryProgram: cpiInstruction.keys[8].pubkey,
+                assetControllerProgram: cpiInstruction.programId,
+                tokenProgram: TOKEN_2022_PROGRAM_ID,
                 systemProgram: SystemProgram.programId,
+                assetControllerEventAuthority: getAssetControllerEventAuthority(),
             })
                 .instruction();
         });
@@ -5151,7 +4862,7 @@ class RwaRbacClient {
             // Fetch controller to get next UserRole id.
             const controller = yield this.rbacProgram.account.assetAccessController.fetch(args.assetAccessController);
             return this.rbacProgram.methods
-                .createUserRole(args.name, new BN(args.allowedAdminIxs), new BN(args.allowedMediciIxs))
+                .createUserRole(args.name, new BN(args.allowedAdminIxs), new BN(args.allowedMediciIxs), args.isMasterRole || false)
                 .accountsStrict({
                 payer: args.payer,
                 user: args.user,