@dstoken-solana/rwa-rbac 0.2.1 → 0.4.0

package/dist/index.js

@@ -55,98 +55,6 @@ var metadata$1 = {
 	description: "Created with Anchor"
 };
 var instructions$1 = [
-	{
-		name: "add_level_to_identity_account",
-		discriminator: [
-			102,
-			204,
-			64,
-			169,
-			252,
-			177,
-			192,
-			232
-		],
-		accounts: [
-			{
-				name: "payer",
-				writable: true,
-				signer: true
-			},
-			{
-				name: "user",
-				signer: true
-			},
-			{
-				name: "controller_authority",
-				relations: [
-					"asset_access_controller"
-				]
-			},
-			{
-				name: "asset_access_controller",
-				relations: [
-					"authorized_user_role"
-				]
-			},
-			{
-				name: "authorized_user_role",
-				optional: true
-			},
-			{
-				name: "identity_registry_program",
-				address: "GZsnjqT3c5zbHqsctrJ4EG4rbEfo7ZXyyUG7aDJNmxfA"
-			},
-			{
-				name: "identity_registry"
-			},
-			{
-				name: "identity_account",
-				writable: true
-			},
-			{
-				name: "identity_account_owner",
-				docs: [
-					"to ensure that it is not an Investor account. If it is an Investor account,",
-					"CPI to IdentityMetadataRegistry should be called."
-				]
-			},
-			{
-				name: "system_program",
-				address: "11111111111111111111111111111111"
-			},
-			{
-				name: "policy_engine_program"
-			},
-			{
-				name: "policy_engine",
-				writable: true
-			},
-			{
-				name: "tracker_account"
-			},
-			{
-				name: "asset_mint"
-			},
-			{
-				name: "event_authority"
-			}
-		],
-		args: [
-			{
-				name: "level",
-				type: "u8"
-			},
-			{
-				name: "expiry",
-				type: "i64"
-			},
-			{
-				name: "enforce_limits",
-				type: "bool"
-			}
-		]
-	},
 	{
 		name: "add_levels",
 		discriminator: [
@@ -182,8 +90,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -270,8 +177,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -333,6 +239,7 @@ var instructions$1 = [
 			},
 			{
 				name: "asset_access_controller",
+				writable: true,
 				relations: [
 					"user_role",
 					"authorized_user_role"
@@ -427,8 +334,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -488,8 +394,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_registry_program",
@@ -559,8 +464,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -620,8 +524,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -681,8 +584,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -762,8 +664,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -819,8 +720,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -841,63 +741,6 @@ var instructions$1 = [
 			}
 		]
 	},
-	{
-		name: "close_mint_account",
-		discriminator: [
-			14,
-			121,
-			72,
-			246,
-			96,
-			224,
-			42,
-			162
-		],
-		accounts: [
-			{
-				name: "user",
-				signer: true
-			},
-			{
-				name: "controller_authority",
-				writable: true,
-				relations: [
-					"asset_access_controller"
-				]
-			},
-			{
-				name: "asset_access_controller",
-				relations: [
-					"authorized_user_role"
-				]
-			},
-			{
-				name: "authorized_user_role",
-				optional: true
-			},
-			{
-				name: "asset_controller_program",
-				address: "7tXjmbkZVY3Gmg9kDBebcNXT1yC5pyoxxXVLwdbv9tvP"
-			},
-			{
-				name: "asset_mint",
-				writable: true
-			},
-			{
-				name: "asset_controller"
-			},
-			{
-				name: "token_program",
-				address: "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb"
-			}
-		],
-		args: [
-			{
-				name: "cpi_data",
-				type: "bytes"
-			}
-		]
-	},
 	{
 		name: "create_controller",
 		discriminator: [
@@ -926,8 +769,8 @@ var instructions$1 = [
 				pda: {
 					seeds: [
 						{
-							kind: "arg",
-							path: "unique_seed"
+							kind: "account",
+							path: "asset_mint"
 						},
 						{
 							kind: "const",
@@ -958,6 +801,53 @@ var instructions$1 = [
 					]
 				}
 			},
+			{
+				name: "asset_access_controller_authority",
+				pda: {
+					seeds: [
+						{
+							kind: "account",
+							path: "asset_access_controller"
+						}
+					]
+				}
+			},
+			{
+				name: "asset_controller",
+				writable: true
+			},
+			{
+				name: "asset_mint",
+				writable: true,
+				signer: true
+			},
+			{
+				name: "extra_metas_account",
+				writable: true
+			},
+			{
+				name: "policy_engine_account",
+				writable: true
+			},
+			{
+				name: "identity_registry_account",
+				writable: true
+			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "identity_registry_program"
+			},
+			{
+				name: "asset_controller_program"
+			},
+			{
+				name: "asset_controller_event_authority"
+			},
+			{
+				name: "token_program"
+			},
 			{
 				name: "system_program",
 				address: "11111111111111111111111111111111"
@@ -965,8 +855,8 @@ var instructions$1 = [
 		],
 		args: [
 			{
-				name: "unique_seed",
-				type: "pubkey"
+				name: "cpi_data",
+				type: "bytes"
 			}
 		]
 	},
@@ -1005,8 +895,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_registry_program",
@@ -1023,6 +912,16 @@ var instructions$1 = [
 				name: "wallet_identity",
 				writable: true
 			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "tracker_account",
+				writable: true
+			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "system_program",
 				address: "11111111111111111111111111111111"
@@ -1092,6 +991,10 @@ var instructions$1 = [
 			{
 				name: "allowed_medici_ixs",
 				type: "u64"
+			},
+			{
+				name: "is_master_role",
+				type: "bool"
 			}
 		]
 	},
@@ -1170,8 +1073,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -1232,8 +1134,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_registry_program",
@@ -1250,6 +1151,12 @@ var instructions$1 = [
 			{
 				name: "identity_registry"
 			},
+			{
+				name: "token_account"
+			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "event_authority"
 			}
@@ -1291,8 +1198,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -1357,8 +1263,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -1471,63 +1376,6 @@ var instructions$1 = [
 			}
 		]
 	},
-	{
-		name: "refresh_level_to_identity_account",
-		discriminator: [
-			23,
-			68,
-			237,
-			111,
-			144,
-			169,
-			239,
-			91
-		],
-		accounts: [
-			{
-				name: "payer",
-				writable: true,
-				signer: true
-			},
-			{
-				name: "user",
-				signer: true
-			},
-			{
-				name: "controller_authority",
-				relations: [
-					"asset_access_controller"
-				]
-			},
-			{
-				name: "asset_access_controller",
-				relations: [
-					"authorized_user_role"
-				]
-			},
-			{
-				name: "authorized_user_role",
-				optional: true
-			},
-			{
-				name: "identity_registry_program",
-				address: "GZsnjqT3c5zbHqsctrJ4EG4rbEfo7ZXyyUG7aDJNmxfA"
-			},
-			{
-				name: "identity_registry"
-			},
-			{
-				name: "identity_account",
-				writable: true
-			}
-		],
-		args: [
-			{
-				name: "cpi_data",
-				type: "bytes"
-			}
-		]
-	},
 	{
 		name: "register_investor",
 		discriminator: [
@@ -1563,8 +1411,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -1589,6 +1436,16 @@ var instructions$1 = [
 				name: "wallet_identity",
 				writable: true
 			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "tracker_account",
+				writable: true
+			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "event_authority_identity_metadata_registry"
 			},
@@ -1613,78 +1470,11 @@ var instructions$1 = [
 			78,
 			35,
 			174,
-			50,
-			72,
-			181,
-			12,
-			42
-		],
-		accounts: [
-			{
-				name: "payer",
-				writable: true,
-				signer: true
-			},
-			{
-				name: "user",
-				signer: true
-			},
-			{
-				name: "controller_authority",
-				relations: [
-					"asset_access_controller"
-				]
-			},
-			{
-				name: "asset_access_controller",
-				relations: [
-					"authorized_user_role"
-				]
-			},
-			{
-				name: "authorized_user_role",
-				optional: true
-			},
-			{
-				name: "identity_registry_program",
-				address: "GZsnjqT3c5zbHqsctrJ4EG4rbEfo7ZXyyUG7aDJNmxfA"
-			},
-			{
-				name: "identity_registry"
-			},
-			{
-				name: "identity_account",
-				writable: true
-			},
-			{
-				name: "wallet_identity",
-				writable: true
-			},
-			{
-				name: "event_authority"
-			},
-			{
-				name: "identity_owner"
-			}
-		],
-		args: [
-			{
-				name: "cpi_data",
-				type: "bytes"
-			}
-		]
-	},
-	{
-		name: "remove_investor",
-		discriminator: [
-			93,
-			0,
-			162,
-			199,
-			76,
-			5,
-			180,
-			2
+			50,
+			72,
+			181,
+			12,
+			42
 		],
 		accounts: [
 			{
@@ -1709,16 +1499,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
-			},
-			{
-				name: "identity_metadata_registry_program",
-				address: "D2V7wTBbNCKgYwirgRUnSmc2QyKnHSVmRotWJ4rz8Jp9"
-			},
-			{
-				name: "investor",
-				writable: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_registry_program",
@@ -1736,34 +1517,40 @@ var instructions$1 = [
 				writable: true
 			},
 			{
-				name: "policy_engine_program",
-				address: "FsE8mCJyvgMzqJbfHbJQm3iuf3cRZC6n2vZi1Q8rQCy2"
+				name: "event_authority"
 			},
 			{
-				name: "tracker_account",
-				writable: true
+				name: "identity_owner"
 			},
 			{
-				name: "event_authority_identity_metadata_registry"
+				name: "policy_engine_program"
 			},
 			{
-				name: "event_authority_identity_registry"
+				name: "tracker_account",
+				writable: true
+			},
+			{
+				name: "asset_mint"
 			}
 		],
 		args: [
+			{
+				name: "cpi_data",
+				type: "bytes"
+			}
 		]
 	},
 	{
-		name: "remove_level_from_identity_account",
+		name: "remove_investor",
 		discriminator: [
-			194,
-			231,
-			187,
-			54,
-			197,
-			136,
-			170,
-			55
+			93,
+			0,
+			162,
+			199,
+			76,
+			5,
+			180,
+			2
 		],
 		accounts: [
 			{
@@ -1788,8 +1575,15 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
+			},
+			{
+				name: "identity_metadata_registry_program",
+				address: "D2V7wTBbNCKgYwirgRUnSmc2QyKnHSVmRotWJ4rz8Jp9"
+			},
+			{
+				name: "investor",
+				writable: true
 			},
 			{
 				name: "identity_registry_program",
@@ -1803,38 +1597,28 @@ var instructions$1 = [
 				writable: true
 			},
 			{
-				name: "identity_account_owner",
-				docs: [
-					"to ensure that it is not an Investor account. If it is an Investor account,",
-					"CPI to IdentityMetadataRegistry should be called."
-				]
-			},
-			{
-				name: "system_program",
-				address: "11111111111111111111111111111111"
+				name: "wallet_identity",
+				writable: true
 			},
 			{
-				name: "policy_engine_program"
+				name: "policy_engine_program",
+				address: "FsE8mCJyvgMzqJbfHbJQm3iuf3cRZC6n2vZi1Q8rQCy2"
 			},
 			{
-				name: "policy_engine",
+				name: "tracker_account",
 				writable: true
 			},
 			{
-				name: "tracker_account"
+				name: "event_authority_identity_metadata_registry"
 			},
 			{
-				name: "asset_mint"
+				name: "event_authority_identity_registry"
 			},
 			{
-				name: "event_authority"
+				name: "asset_mint"
 			}
 		],
 		args: [
-			{
-				name: "cpi_data",
-				type: "bytes"
-			}
 		]
 	},
 	{
@@ -1872,8 +1656,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -1957,8 +1740,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -2101,8 +1883,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2193,8 +1974,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2264,8 +2044,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -2351,8 +2130,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2421,8 +2199,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2516,8 +2293,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2684,6 +2460,31 @@ var errors$1 = [
 		code: 6007,
 		name: "IllegalOperation",
 		msg: "Illegal operation"
+	},
+	{
+		code: 6008,
+		name: "InvalidFlags",
+		msg: "Invalid flag bits"
+	},
+	{
+		code: 6009,
+		name: "CannotEmptyMasterRole",
+		msg: "Cannot empty master role of users"
+	},
+	{
+		code: 6010,
+		name: "CannotVoidAuthority",
+		msg: "Cannot void authority"
+	},
+	{
+		code: 6011,
+		name: "InvalidMasterRole",
+		msg: "Invalid master role"
+	},
+	{
+		code: 6012,
+		name: "CannotDeleteMasterRole",
+		msg: "Cannot delete master role"
 	}
 ];
 var types$1 = [
@@ -2714,9 +2515,9 @@ var types$1 = [
 					type: "pubkey"
 				},
 				{
-					name: "unique_seed",
+					name: "asset_mint",
 					docs: [
-						"Unique seed used for creating this account."
+						"Asset mint that is going to be managed by this controller."
 					],
 					type: "pubkey"
 				},
@@ -2727,6 +2528,13 @@ var types$1 = [
 					],
 					type: "u64"
 				},
+				{
+					name: "has_master_role",
+					docs: [
+						"Whether a master role exists."
+					],
+					type: "bool"
+				},
 				{
 					name: "lut_address",
 					docs: [
@@ -2761,7 +2569,7 @@ var types$1 = [
 					type: "pubkey"
 				},
 				{
-					name: "seed",
+					name: "asset_mint",
 					type: "pubkey"
 				}
 			]
@@ -2791,7 +2599,7 @@ var types$1 = [
 					type: "pubkey"
 				},
 				{
-					name: "seed",
+					name: "asset_mint",
 					type: "pubkey"
 				}
 			]
@@ -2837,6 +2645,13 @@ var types$1 = [
 					],
 					type: "u64"
 				},
+				{
+					name: "is_master_role",
+					docs: [
+						"If true, this is the master role."
+					],
+					type: "bool"
+				},
 				{
 					name: "users",
 					docs: [
@@ -3200,6 +3015,16 @@ var instructions = [
 				name: "wallet_identity",
 				writable: true
 			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "tracker_account",
+				writable: true
+			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "system_program",
 				address: "11111111111111111111111111111111"
@@ -3322,6 +3147,9 @@ var instructions = [
 			{
 				name: "event_authority_identity_registry"
 			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "event_authority",
 				pda: {
@@ -3776,33 +3604,32 @@ exports.MediciFlags = void 0;
     MediciFlags[MediciFlags["FREEZE_TOKEN_ACCOUNT"] = 4] = "FREEZE_TOKEN_ACCOUNT";
     MediciFlags[MediciFlags["ISSUE_TOKENS"] = 8] = "ISSUE_TOKENS";
     MediciFlags[MediciFlags["REVOKE_TOKENS"] = 16] = "REVOKE_TOKENS";
-    MediciFlags[MediciFlags["CLOSE_MINT_ACCOUNT"] = 32] = "CLOSE_MINT_ACCOUNT";
-    MediciFlags[MediciFlags["UPDATE_INTEREST_BEARING_MINT_RATE"] = 64] = "UPDATE_INTEREST_BEARING_MINT_RATE";
-    MediciFlags[MediciFlags["ATTACH_TO_POLICY_ACCOUNT"] = 128] = "ATTACH_TO_POLICY_ACCOUNT";
-    MediciFlags[MediciFlags["CREATE_POLICY_ACCOUNT"] = 256] = "CREATE_POLICY_ACCOUNT";
-    MediciFlags[MediciFlags["DETACH_FROM_POLICY_ACCOUNT"] = 512] = "DETACH_FROM_POLICY_ACCOUNT";
-    MediciFlags[MediciFlags["ADD_LEVELS"] = 1024] = "ADD_LEVELS";
-    MediciFlags[MediciFlags["ADD_LEVEL_TO_IDENTITY_ACCOUNT"] = 2048] = "ADD_LEVEL_TO_IDENTITY_ACCOUNT";
-    MediciFlags[MediciFlags["REGISTER_INVESTOR"] = 4096] = "REGISTER_INVESTOR";
-    MediciFlags[MediciFlags["REMOVE_LEVELS"] = 8192] = "REMOVE_LEVELS";
-    MediciFlags[MediciFlags["REMOVE_INVESTOR"] = 16384] = "REMOVE_INVESTOR";
-    MediciFlags[MediciFlags["EDIT_IDENTITY_METADATA"] = 32768] = "EDIT_IDENTITY_METADATA";
-    MediciFlags[MediciFlags["REFRESH_LEVEL_TO_IDENTITY_ACCOUNT"] = 65536] = "REFRESH_LEVEL_TO_IDENTITY_ACCOUNT";
-    MediciFlags[MediciFlags["ATTACH_WALLET_TO_IDENTITY"] = 131072] = "ATTACH_WALLET_TO_IDENTITY";
-    MediciFlags[MediciFlags["DETACH_WALLET_FROM_IDENTITY"] = 262144] = "DETACH_WALLET_FROM_IDENTITY";
-    MediciFlags[MediciFlags["SEIZE_TOKENS"] = 524288] = "SEIZE_TOKENS";
-    MediciFlags[MediciFlags["CREATE_IDENTITY_ACCOUNT"] = 1048576] = "CREATE_IDENTITY_ACCOUNT";
-    MediciFlags[MediciFlags["CREATE_INVESTOR_LOCKS"] = 2097152] = "CREATE_INVESTOR_LOCKS";
-    MediciFlags[MediciFlags["CLOSE_INVESTOR_LOCKS"] = 4194304] = "CLOSE_INVESTOR_LOCKS";
-    MediciFlags[MediciFlags["ADD_TOKEN_LOCK"] = 8388608] = "ADD_TOKEN_LOCK";
-    MediciFlags[MediciFlags["REMOVE_TOKEN_LOCK"] = 16777216] = "REMOVE_TOKEN_LOCK";
-    MediciFlags[MediciFlags["CHANGE_COUNTERS"] = 33554432] = "CHANGE_COUNTERS";
-    MediciFlags[MediciFlags["CHANGE_COUNTER_LIMITS"] = 67108864] = "CHANGE_COUNTER_LIMITS";
-    MediciFlags[MediciFlags["CHANGE_COUNTRY"] = 134217728] = "CHANGE_COUNTRY";
-    MediciFlags[MediciFlags["CHANGE_MAPPING"] = 268435456] = "CHANGE_MAPPING";
-    MediciFlags[MediciFlags["CHANGE_ISSUANCE_POLICIES"] = 536870912] = "CHANGE_ISSUANCE_POLICIES";
-    MediciFlags[MediciFlags["REMOVE_IDENTITY_ACCOUNT"] = 1073741824] = "REMOVE_IDENTITY_ACCOUNT";
-    MediciFlags[MediciFlags["ALL"] = 2147483647] = "ALL";
+    MediciFlags[MediciFlags["UPDATE_INTEREST_BEARING_MINT_RATE"] = 32] = "UPDATE_INTEREST_BEARING_MINT_RATE";
+    MediciFlags[MediciFlags["ATTACH_TO_POLICY_ACCOUNT"] = 64] = "ATTACH_TO_POLICY_ACCOUNT";
+    MediciFlags[MediciFlags["CREATE_POLICY_ACCOUNT"] = 128] = "CREATE_POLICY_ACCOUNT";
+    MediciFlags[MediciFlags["DETACH_FROM_POLICY_ACCOUNT"] = 256] = "DETACH_FROM_POLICY_ACCOUNT";
+    MediciFlags[MediciFlags["ADD_LEVELS"] = 512] = "ADD_LEVELS";
+    MediciFlags[MediciFlags["ADD_LEVEL_TO_IDENTITY_ACCOUNT"] = 1024] = "ADD_LEVEL_TO_IDENTITY_ACCOUNT";
+    MediciFlags[MediciFlags["REGISTER_INVESTOR"] = 2048] = "REGISTER_INVESTOR";
+    MediciFlags[MediciFlags["REMOVE_LEVELS"] = 4096] = "REMOVE_LEVELS";
+    MediciFlags[MediciFlags["REMOVE_INVESTOR"] = 8192] = "REMOVE_INVESTOR";
+    MediciFlags[MediciFlags["EDIT_IDENTITY_METADATA"] = 16384] = "EDIT_IDENTITY_METADATA";
+    MediciFlags[MediciFlags["REFRESH_LEVEL_TO_IDENTITY_ACCOUNT"] = 32768] = "REFRESH_LEVEL_TO_IDENTITY_ACCOUNT";
+    MediciFlags[MediciFlags["ATTACH_WALLET_TO_IDENTITY"] = 65536] = "ATTACH_WALLET_TO_IDENTITY";
+    MediciFlags[MediciFlags["DETACH_WALLET_FROM_IDENTITY"] = 131072] = "DETACH_WALLET_FROM_IDENTITY";
+    MediciFlags[MediciFlags["SEIZE_TOKENS"] = 262144] = "SEIZE_TOKENS";
+    MediciFlags[MediciFlags["CREATE_IDENTITY_ACCOUNT"] = 524288] = "CREATE_IDENTITY_ACCOUNT";
+    MediciFlags[MediciFlags["CREATE_INVESTOR_LOCKS"] = 1048576] = "CREATE_INVESTOR_LOCKS";
+    MediciFlags[MediciFlags["CLOSE_INVESTOR_LOCKS"] = 2097152] = "CLOSE_INVESTOR_LOCKS";
+    MediciFlags[MediciFlags["ADD_TOKEN_LOCK"] = 4194304] = "ADD_TOKEN_LOCK";
+    MediciFlags[MediciFlags["REMOVE_TOKEN_LOCK"] = 8388608] = "REMOVE_TOKEN_LOCK";
+    MediciFlags[MediciFlags["CHANGE_COUNTERS"] = 16777216] = "CHANGE_COUNTERS";
+    MediciFlags[MediciFlags["CHANGE_COUNTER_LIMITS"] = 33554432] = "CHANGE_COUNTER_LIMITS";
+    MediciFlags[MediciFlags["CHANGE_COUNTRY"] = 67108864] = "CHANGE_COUNTRY";
+    MediciFlags[MediciFlags["CHANGE_MAPPING"] = 134217728] = "CHANGE_MAPPING";
+    MediciFlags[MediciFlags["CHANGE_ISSUANCE_POLICIES"] = 268435456] = "CHANGE_ISSUANCE_POLICIES";
+    MediciFlags[MediciFlags["REMOVE_IDENTITY_ACCOUNT"] = 536870912] = "REMOVE_IDENTITY_ACCOUNT";
+    MediciFlags[MediciFlags["ALL"] = 1073741823] = "ALL";
 })(exports.MediciFlags || (exports.MediciFlags = {}));
 
 /******************************************************************************
@@ -3857,7 +3684,7 @@ class AssetController {
      * Update the asset controller's metadata.
      * @param args - {@link UpdateAssetMetadataArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to update the asset controller's metadata.
      * */
     updateAssetMetadata(args, assetAccessController, authorizedUserRole) {
@@ -3886,7 +3713,7 @@ class AssetController {
      * Asynchronously generates instructions to issue tokens and lock tokens according to issuance policy.
      * @param args - {@link IssueTokensWithLockArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      */
     issueTokenIxns(args, assetAccessController, authorizedUserRole) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -3933,16 +3760,6 @@ class AssetController {
                 .instruction();
         });
     }
-    /**
-     * Asynchronously generates instructions to revoke assets.
-     * @param args - {@link VoidTokensArgs}
-     * @returns A Promise that resolves to the instructions to revoke assets.
-     */
-    voidTokenIxns(args) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.rwaClient.assetController.voidTokenIxns(args);
-        });
-    }
     /**
      * Executes a token transfer.
      * @param args - {@link TransferTokensArgs}
@@ -3957,7 +3774,7 @@ class AssetController {
      * Asynchronously generates instruction to freeze a token account.
      * @param args - {@link FreezeTokenArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instruction to freeze.
      */
     freezeTokenIxn(args, assetAccessController, authorizedUserRole) {
@@ -3985,7 +3802,7 @@ class AssetController {
      * Asynchronously generates instruction to thaw a token account.
      * @param args - {@link FreezeTokenArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instruction to thaw.
      */
     thawTokenIxn(args, assetAccessController, authorizedUserRole) {
@@ -4013,13 +3830,13 @@ class AssetController {
     /**
      * Asynchronously generates instructions to revoke tokens from a user.
      * @param args - {@link RevokeTokensArgs}
-     * @param payer - Payer public key.
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
+     * @param investorId - Optional investorId. Required if user is not an investor.
      * @returns A Promise that resolves to the instructions to revoke.
      */
-    revokeTokenIxn(args, investorId, signer, assetAccessController, authorizedUserRole) {
+    revokeTokenIxn(args, signer, assetAccessController, authorizedUserRole, investorId) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args.wallet) {
                 throw new Error("Use wallet arg for wallet to revoke tokens from.");
@@ -4028,7 +3845,9 @@ class AssetController {
             args.owner = args.wallet;
             const revokeIx = yield rwaTokenSdk.getRevokeTokensIx(args, this.rwaClient.provider);
             const identityRegistry = rwaTokenSdk.getIdentityRegistryPda(args.assetMint);
-            const investorPda = deriveInvestorPda(investorId, identityRegistry);
+            const investorPda = investorId
+                ? deriveInvestorPda(investorId, identityRegistry)
+                : null;
             const ixData = revokeIx.data;
             const assetController = rwaTokenSdk.getAssetControllerPda(args.assetMint);
             const revokeTokenAccount = splToken.getAssociatedTokenAddressSync(new web3_js.PublicKey(args.assetMint), new web3_js.PublicKey(args.wallet), false, splToken.TOKEN_2022_PROGRAM_ID);
@@ -4044,8 +3863,8 @@ class AssetController {
                 assetController,
                 revokeTokenAccount,
                 identityRegistry,
-                identityAccount: rwaTokenSdk.getIdentityAccountPda(args.assetMint, investorPda.toString()),
-                trackerAccount: rwaTokenSdk.getTrackerAccountPda(args.assetMint, investorPda.toString()),
+                identityAccount: rwaTokenSdk.getIdentityAccountPda(args.assetMint, investorId ? investorPda.toString() : args.owner),
+                trackerAccount: rwaTokenSdk.getTrackerAccountPda(args.assetMint, investorId ? investorPda.toString() : args.owner),
                 policyEngineProgram: rwaTokenSdk.policyEngineProgramId,
                 policyEngine: rwaTokenSdk.getPolicyEnginePda(args.assetMint),
                 walletIdentityAccount: rwaTokenSdk.getWalletIdentityAccountPda(args.assetMint, args.wallet),
@@ -4057,37 +3876,11 @@ class AssetController {
                 .instruction();
         });
     }
-    /**
-     * Asynchronously generates instruction to close mint.
-     * @param args - {@link CloseMintArgs}
-     * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
-     * @returns A Promise that resolves to the instruction to close mint.
-     */
-    closeMintIxn(args, assetAccessController, authorizedUserRole) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const closeIx = yield rwaTokenSdk.getCloseMintIx(args, this.rwaClient.provider);
-            const ixData = closeIx.data;
-            return this.rbacProgram.methods
-                .closeMintAccount(ixData)
-                .accountsStrict({
-                user: args.signer,
-                controllerAuthority: args.authority,
-                assetAccessController,
-                authorizedUserRole: authorizedUserRole || null,
-                assetControllerProgram: rwaTokenSdk.assetControllerProgramId,
-                assetMint: args.assetMint,
-                assetController: rwaTokenSdk.getAssetControllerPda(args.assetMint),
-                tokenProgram: splToken.TOKEN_2022_PROGRAM_ID,
-            })
-                .instruction();
-        });
-    }
     /**
      * Asynchronously generates instruction to update mint interest rate.
      * @param args - {@link UpdateInterestBearingMintRateArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instruction to update mint interest rate.
      */
     updateInterestBearingMintRateIxn(args, assetAccessController, authorizedUserRole) {
@@ -4115,7 +3908,7 @@ class AssetController {
      * @param args - {@link SeizeTokensArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instruction to seize.
      */
     seizeTokensIxn(args, investorId, signer, assetAccessController, authorizedUserRole) {
@@ -4213,7 +4006,7 @@ class PolicyEngine {
      * @param args - {@link AttachPolicyArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to attach a policy.
      * */
     attachPolicy(args, signer, assetAccessController, authorizedUserRole) {
@@ -4241,7 +4034,7 @@ class PolicyEngine {
      * @param args - {@link DetachPolicyArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to detach a policy.
      * */
     detachPolicy(args, signer, assetAccessController, authorizedUserRole) {
@@ -4269,7 +4062,7 @@ class PolicyEngine {
      * @param args - {@link ChangeCountersArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to change the counters.
      * */
     changeCounters(args, signer, assetAccessController, authorizedUserRole) {
@@ -4297,7 +4090,7 @@ class PolicyEngine {
      * @param args - {@link SetCountersArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to set the counter values.
      * */
     setCounters(args, signer, assetAccessController, authorizedUserRole) {
@@ -4324,7 +4117,7 @@ class PolicyEngine {
      * @param args - {@link ChangeCounterLimitsArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to change the counters limits.
      * */
     changeCounterLimits(args, signer, assetAccessController, authorizedUserRole) {
@@ -4352,7 +4145,7 @@ class PolicyEngine {
      * @param args - {@link ChangeMappingArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * */
     changeMapping(args, signer, assetAccessController, authorizedUserRole) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -4378,7 +4171,7 @@ class PolicyEngine {
      * @param args - {@link ChangeIssuancePoliciesArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * */
     changeIssuancePolicies(args, signer, assetAccessController, authorizedUserRole) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -4462,7 +4255,7 @@ class IdentityRegistry {
      * @param args - {@link SetupUserArgs}
      * @param authority - RBAC AssetAccessController ControllerAuthority.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to setup a user.
      *
      * It is required for at least a single user to be setup before issuing tokens.
@@ -4472,7 +4265,6 @@ class IdentityRegistry {
             const { ixs } = yield this.rwaClient.identityRegistry.setupUserIxns(args);
             const returnIxs = [];
             const identityAccountIx = ixs[0];
-            const trackerAccountIx = ixs[1];
             const controllerAuthority = deriveControllerAuthorityPda(assetAccessController);
             const identityAccount = rwaTokenSdk.getIdentityAccountPda(args.assetMint, args.owner);
             returnIxs.push(yield this.rbacProgram.methods
@@ -4489,9 +4281,11 @@ class IdentityRegistry {
                 walletIdentity: rwaTokenSdk.getWalletIdentityAccountPda(args.assetMint, args.owner),
                 systemProgram: web3_js.SystemProgram.programId,
                 eventAuthority: rwaTokenSdk.getIdentityRegistryEventAuthority(),
+                policyEngineProgram: rwaTokenSdk.policyEngineProgramId,
+                trackerAccount: rwaTokenSdk.getTrackerAccountPda(args.assetMint, args.owner),
+                assetMint: args.assetMint,
             })
                 .instruction());
-            returnIxs.push(trackerAccountIx);
             return {
                 ixs: returnIxs,
                 signers: [],
@@ -4503,7 +4297,7 @@ class IdentityRegistry {
      * @param args - {@link SetupUserArgs}
      * @param authority - RBAC AssetAccessController ControllerAuthority.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to setup a user.
      *
      * It is required for at least a single user to be setup before issuing tokens.
@@ -4528,122 +4322,19 @@ class IdentityRegistry {
                 walletIdentity: rwaTokenSdk.getWalletIdentityAccountPda(args.assetMint, args.owner),
                 eventAuthority: rwaTokenSdk.getIdentityRegistryEventAuthority(),
                 identityOwner: identityAccount.owner,
-            })
-                .instruction();
-            return returnIx;
-        });
-    }
-    /**
-     * Asynchronously update a non-investor user identity account level.
-     * @param args - {@link AddLevelToIdentityAccountArgs}
-     * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
-     * @returns A Promise that resolves to the instructions to update user account identity.
-     * */
-    addIdentityLevelToUserAccount(args, assetAccessController, authorizedUserRole) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            const identityAccount = rwaTokenSdk.getIdentityAccountPda(args.assetMint, args.owner);
-            const controllerAuthority = deriveControllerAuthorityPda(assetAccessController);
-            return this.rbacProgram.methods
-                .addLevelToIdentityAccount(args.levels[0], args.expiries[0], (_a = args.ignorePolicy) !== null && _a !== void 0 ? _a : false)
-                .accountsStrict({
-                payer: args.payer,
-                user: args.signer,
-                controllerAuthority,
-                assetAccessController,
-                authorizedUserRole: authorizedUserRole || null,
-                identityRegistryProgram: rwaTokenSdk.identityRegistryProgramId,
-                identityRegistry: rwaTokenSdk.getIdentityRegistryPda(args.assetMint),
-                identityAccount,
-                identityAccountOwner: args.owner,
-                systemProgram: web3_js.SystemProgram.programId,
-                policyEngineProgram: rwaTokenSdk.policyEngineProgramId,
-                policyEngine: rwaTokenSdk.getPolicyEnginePda(args.assetMint),
-                trackerAccount: rwaTokenSdk.getTrackerAccountPda(args.assetMint, args.owner),
-                assetMint: args.assetMint,
-                eventAuthority: rwaTokenSdk.getIdentityRegistryEventAuthority(),
-            })
-                .instruction();
-        });
-    }
-    /**
-     * Asynchronously reduces a non-Investor user identity account level.
-     * @param args - {@link RemoveLevelFromIdentityAccount}
-     * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
-     * @returns A Promise that resolves to the instructions to reduce the level of a user identity account.
-     */
-    removeIdentityLevelFromUserAccount(args, assetAccessController, authorizedUserRole) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const removeLevelIx = yield rwaTokenSdk.getRemoveLevelFromIdentityAccount(args, this.rwaClient.provider);
-            const ixData = removeLevelIx.data;
-            const controllerAuthority = deriveControllerAuthorityPda(assetAccessController);
-            const identityAccount = rwaTokenSdk.getIdentityAccountPda(args.assetMint, args.owner);
-            return this.rbacProgram.methods
-                .removeLevelFromIdentityAccount(ixData)
-                .accountsStrict({
-                payer: args.payer,
-                user: args.signer,
-                controllerAuthority,
-                assetAccessController,
-                authorizedUserRole: authorizedUserRole || null,
-                identityRegistryProgram: rwaTokenSdk.identityRegistryProgramId,
-                identityRegistry: rwaTokenSdk.getIdentityRegistryPda(args.assetMint),
-                identityAccount,
-                identityAccountOwner: args.owner,
-                systemProgram: web3_js.SystemProgram.programId,
                 policyEngineProgram: rwaTokenSdk.policyEngineProgramId,
-                policyEngine: rwaTokenSdk.getPolicyEnginePda(args.assetMint),
                 trackerAccount: rwaTokenSdk.getTrackerAccountPda(args.assetMint, args.owner),
                 assetMint: args.assetMint,
-                eventAuthority: rwaTokenSdk.getIdentityRegistryEventAuthority(),
-            })
-                .instruction();
-        });
-    }
-    /**
-     * Asynchronously generates instruction to refresh expiry on an Identity Account level.
-     * @param args - {@link RefreshLevelArgs}
-     * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
-     * @returns A Promise that resolves to refresh expiry on an Identity Account level.
-     * */
-    refreshLevelToIdentityAccountIxn(args, assetAccessController, authorizedUserRole) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const identityProgram = rwaTokenSdk.getIdentityRegistryProgram(this.rwaClient.provider);
-            const identityRegistry = rwaTokenSdk.getIdentityRegistryPda(args.assetMint);
-            const identityAccount = rwaTokenSdk.getIdentityAccountPda(args.assetMint, args.owner);
-            const controllerAuthority = deriveControllerAuthorityPda(assetAccessController);
-            const refreshIx = yield identityProgram.methods
-                .refreshLevelToIdentityAccount(args.level, args.expiry)
-                .accountsStrict({
-                payer: args.payer,
-                signer: controllerAuthority,
-                identityRegistry,
-                identityAccount,
-            })
-                .instruction();
-            return this.rbacProgram.methods
-                .refreshLevelToIdentityAccount(refreshIx.data)
-                .accountsStrict({
-                payer: args.payer,
-                user: args.signer,
-                controllerAuthority,
-                assetAccessController,
-                authorizedUserRole: authorizedUserRole || null,
-                identityRegistryProgram: rwaTokenSdk.identityRegistryProgramId,
-                identityRegistry,
-                identityAccount,
             })
                 .instruction();
+            return returnIx;
         });
     }
     /**
      * Asynchronously generates instruction to attach wallet to identity.
      * @param args - {@link AttachDetachWalletArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to attach wallet.
      * */
     attachWalletToIdentityIxn(args, assetAccessController, authorizedUserRole) {
@@ -4691,7 +4382,7 @@ class IdentityRegistry {
      * Asynchronously generates instruction to detach wallet from identity.
      * @param args - {@link AttachDetachWalletArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to detach wallet.
      * */
     detachWalletFromIdentityIxn(args, assetAccessController, authorizedUserRole) {
@@ -4701,6 +4392,7 @@ class IdentityRegistry {
             const identityRegistry = rwaTokenSdk.getIdentityRegistryPda(args.assetMint);
             const identityAccount = rwaTokenSdk.getIdentityAccountPda(args.assetMint, args.owner);
             const walletIdentity = rwaTokenSdk.getWalletIdentityAccountPda(args.assetMint, args.wallet.toString());
+            const tokenAccount = splToken.getAssociatedTokenAddressSync(new web3_js.PublicKey(args.assetMint), new web3_js.PublicKey(args.wallet), false, splToken.TOKEN_2022_PROGRAM_ID);
             const ix = yield identityProgram.methods
                 .detachWalletFromIdentity()
                 .accountsStrict({
@@ -4711,6 +4403,8 @@ class IdentityRegistry {
                 identityRegistry,
                 eventAuthority: rwaTokenSdk.getIdentityRegistryEventAuthority(),
                 program: rwaTokenSdk.identityRegistryProgramId,
+                tokenAccount: tokenAccount,
+                assetMint: args.assetMint,
             })
                 .instruction();
             return this.rbacProgram.methods
@@ -4726,6 +4420,8 @@ class IdentityRegistry {
                 identityAccount,
                 identityRegistry,
                 eventAuthority: rwaTokenSdk.getIdentityRegistryEventAuthority(),
+                tokenAccount: tokenAccount,
+                assetMint: args.assetMint,
             })
                 .instruction();
         });
@@ -4767,7 +4463,7 @@ class IdentityMetadataRegistry {
      * @param args - {@link SetupInvestorArgs}
      * @param authority - RBAC AssetAccessController ControllerAuthority.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to setup an investor.
      *
      * It is required for at least a single user to be setup before issuing tokens.
@@ -4796,6 +4492,9 @@ class IdentityMetadataRegistry {
                 eventAuthority: getEventAuthority(IMR_PROGRAM),
                 eventAuthorityIdentityRegistry: rwaTokenSdk.getIdentityRegistryEventAuthority(),
                 program: rwaTokenSdk.identityRegistryProgramId,
+                policyEngineProgram: rwaTokenSdk.policyEngineProgramId,
+                trackerAccount: rwaTokenSdk.getTrackerAccountPda(args.assetMint, investor.toString()),
+                assetMint: assetMintKey,
             })
                 .instruction();
             returnIxs.push(yield this.rbacProgram.methods
@@ -4815,21 +4514,9 @@ class IdentityMetadataRegistry {
                 systemProgram: web3_js.SystemProgram.programId,
                 eventAuthorityIdentityMetadataRegistry: getEventAuthority(IMR_PROGRAM),
                 eventAuthorityIdentityRegistry: rwaTokenSdk.getIdentityRegistryEventAuthority(),
-            })
-                .instruction());
-            const policyProgram = rwaTokenSdk.getPolicyEngineProgram(this.imrProgram.provider);
-            const trackerAccount = web3_js.PublicKey.findProgramAddressSync([assetMintKey.toBuffer(), identityAccount.toBuffer()], policyProgram.programId)[0];
-            returnIxs.push(yield policyProgram.methods
-                .createTrackerAccount()
-                .accountsStrict({
-                payer: args.payer,
-                trackerAccount,
-                systemProgram: web3_js.SystemProgram.programId,
-                program: policyProgram.programId,
+                policyEngineProgram: rwaTokenSdk.policyEngineProgramId,
+                trackerAccount: rwaTokenSdk.getTrackerAccountPda(args.assetMint, investor.toString()),
                 assetMint: assetMintKey,
-                eventAuthority: rwaTokenSdk.getPolicyEngineEventAuthority(),
-                identityRegistry,
-                identityAccount,
             })
                 .instruction());
             if (args.levels.length > 1) {
@@ -4854,7 +4541,7 @@ class IdentityMetadataRegistry {
      * Asynchronously add levels to investor.
      * @param args - {@link AddLevelsArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to add levels.
      * */
     addLevels(args, assetAccessController, authorizedUserRole) {
@@ -4912,7 +4599,7 @@ class IdentityMetadataRegistry {
      * Asynchronously change country for the Investor.
      * @param args - {@link ChangeCountryArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to change the country.
      * */
     changeCountry(args, assetAccessController, authorizedUserRole) {
@@ -4965,7 +4652,7 @@ class IdentityMetadataRegistry {
      * Asynchronously remove levels from an investor.
      * @param args - {@link RemoveLevelsArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to remove levels.
      * */
     removeLevels(args, assetAccessController, authorizedUserRole) {
@@ -5020,7 +4707,7 @@ class IdentityMetadataRegistry {
      * Asynchronously remove an investor.
      * @param args - {@link RemoveLevelsArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to remove an investor.
      * */
     removeInvestor(args, assetAccessController, authorizedUserRole) {
@@ -5047,6 +4734,7 @@ class IdentityMetadataRegistry {
                 trackerAccount: rwaTokenSdk.getTrackerAccountPda(args.assetMint, investor.toString()),
                 eventAuthorityIdentityMetadataRegistry: getEventAuthority(IMR_PROGRAM),
                 eventAuthorityIdentityRegistry: rwaTokenSdk.getIdentityRegistryEventAuthority(),
+                assetMint: args.assetMint,
             })
                 .instruction();
         });
@@ -5118,13 +4806,36 @@ class RwaRbacClient {
      */
     createAssetAccessControllerIxn(args) {
         return __awaiter(this, void 0, void 0, function* () {
+            const assetAccessController = deriveAssetAccessControllerPda(args.assetMint);
+            const assetAccessControllerAuthority = deriveControllerAuthorityPda(assetAccessController);
+            const cpiInstruction = yield this.assetController.setupNewRegistry({
+                decimals: args.decimals,
+                authority: assetAccessControllerAuthority.toString(),
+                name: args.name,
+                uri: args.uri,
+                symbol: args.symbol,
+                interestRate: args.interestRate,
+                assetMint: args.assetMint.toString(),
+                payer: args.payer.toString(),
+            });
             return this.rbacProgram.methods
-                .createController(args.uniqueSeed)
+                .createController(cpiInstruction.data)
                 .accountsStrict({
                 payer: args.payer,
                 admin: args.admin,
-                assetAccessController: deriveAssetAccessControllerPda(args.uniqueSeed),
+                assetAccessController,
+                assetAccessControllerAuthority,
+                assetMint: args.assetMint,
+                assetController: cpiInstruction.keys[2].pubkey,
+                extraMetasAccount: cpiInstruction.keys[4].pubkey,
+                policyEngineAccount: cpiInstruction.keys[5].pubkey,
+                identityRegistryAccount: cpiInstruction.keys[6].pubkey,
+                policyEngineProgram: cpiInstruction.keys[7].pubkey,
+                identityRegistryProgram: cpiInstruction.keys[8].pubkey,
+                assetControllerProgram: cpiInstruction.programId,
+                tokenProgram: splToken.TOKEN_2022_PROGRAM_ID,
                 systemProgram: web3_js.SystemProgram.programId,
+                assetControllerEventAuthority: rwaTokenSdk.getAssetControllerEventAuthority(),
             })
                 .instruction();
         });
@@ -5155,7 +4866,7 @@ class RwaRbacClient {
             // Fetch controller to get next UserRole id.
             const controller = yield this.rbacProgram.account.assetAccessController.fetch(args.assetAccessController);
             return this.rbacProgram.methods
-                .createUserRole(args.name, new anchor.BN(args.allowedAdminIxs), new anchor.BN(args.allowedMediciIxs))
+                .createUserRole(args.name, new anchor.BN(args.allowedAdminIxs), new anchor.BN(args.allowedMediciIxs), args.isMasterRole || false)
                 .accountsStrict({
                 payer: args.payer,
                 user: args.user,