@dynamic-labs-sdk/client 1.28.0 → 1.30.0

package/dist/waas.esm.js

@@ -1,9 +1,9 @@
-import { Ct as version, D as NoWalletProviderFoundError, G as createApiClient, M as formatWalletProviderKey, P as getChainFromVerifiedCredentialChain, St as name, _t as getDefaultClient, c as isWaasWalletProvider, d as DYNAMIC_WAAS_METADATA, dt as assertDefined, g as __logoutWithReason_wrapped, i as InvalidParamError, o as isWaasWalletAccount, s as findWaasWalletProviderByChain, xt as getCore } from "./updateAuthFromVerifyResponse-DcwFCD-Y.esm.js";
-import { i as __refreshAuth_wrapped, n as TransactionBroadcastError, t as isDynamicWaasEnabled } from "./isDynamicWaasEnabled-D3-nDwVw.esm.js";
-import { n as getVerifiedCredentialForWalletAccount, t as getWalletProviderByKey } from "./getWalletProviderByKey-C9TWlmDD.esm.js";
-import { n as getWaasWalletProviderFromWalletAccount, r as NotWaasWalletProviderError, t as migrateFromFireblocks } from "./migrateFromFireblocks-BM6Iaii-.esm.js";
+import { Ct as name, F as getChainFromVerifiedCredentialChain, K as createApiClient, M as getWalletAccounts, N as formatWalletProviderKey, O as NoWalletProviderFoundError, St as getCore, a as InvalidParamError, c as findWaasWalletProviderByChain, f as DYNAMIC_WAAS_METADATA, ft as assertDefined, h as __logoutWithReason_wrapped, l as isWaasWalletProvider, s as isWaasWalletAccount, vt as getDefaultClient, wt as version } from "./updateAuthFromVerifyResponse-CFIyg2PR.esm.js";
+import { i as __refreshAuth_wrapped, n as TransactionBroadcastError, t as isDynamicWaasEnabled } from "./isDynamicWaasEnabled-CIJILHSm.esm.js";
+import { n as getVerifiedCredentialForWalletAccount, t as getWalletProviderByKey } from "./getWalletProviderByKey-D678OktF.esm.js";
+import { n as getWaasWalletProviderFromWalletAccount, r as NotWaasWalletProviderError, t as migrateFromFireblocks } from "./migrateFromFireblocks-R-aPmpUZ.esm.js";
 import { assertPackageVersion } from "@dynamic-labs-sdk/assert-package-version";
-import { AssignableBusinessAccountMemberRole, JwtVerifiedCredentialFormatEnum, TokenScope, UserIdentifierTypeEnum, WaasWalletShareSetType, WalletProviderEnum } from "@dynamic-labs/sdk-api-core";
+import { AssignableBusinessAccountMemberRole, JwtVerifiedCredentialFormatEnum, TokenScope, UserIdentifierTypeEnum, WaasPolicyLayerRuleOperationOpEnum, WaasPolicyLayerUpdateRequestOpEnum, WaasPolicyRuleType, WaasSignerPolicyLayerUpdateRequestOpEnum, WaasWalletShareSetType, WaasWalletShareSetType as WaasWalletShareSetType$1, WalletProviderEnum } from "@dynamic-labs/sdk-api-core";
 
 //#region src/modules/waas/businessAccounts/assertTargetIdentity.ts
 /**
@@ -185,6 +185,34 @@ const backupWaasKeySharesToGoogleDrive = async ({ googleDriveAccessToken, passwo
 	});
 };
 
+//#endregion
+//#region src/modules/waas/policies/buildAllowPolicyRule/buildAllowPolicyRule.ts
+/**
+* Builds a policy rule that permits the described action.
+*
+* @param rule - The rule fields (name, chain, and any targeting/limit fields).
+* @returns A `WaasPolicyRule` with `ruleType` set to `allow`.
+* @notInstrumented
+*/
+const buildAllowPolicyRule = (rule) => ({
+	...rule,
+	ruleType: WaasPolicyRuleType.Allow
+});
+
+//#endregion
+//#region src/modules/waas/policies/buildDenyPolicyRule/buildDenyPolicyRule.ts
+/**
+* Builds a policy rule that blocks the described action.
+*
+* @param rule - The rule fields (name, chain, and any targeting/limit fields).
+* @returns A `WaasPolicyRule` with `ruleType` set to `deny`.
+* @notInstrumented
+*/
+const buildDenyPolicyRule = (rule) => ({
+	...rule,
+	ruleType: WaasPolicyRuleType.Deny
+});
+
 //#endregion
 //#region src/modules/waas/businessAccounts/createBusinessAccount/createBusinessAccount.ts
 /**
@@ -212,6 +240,649 @@ const createBusinessAccount = async (params, client = getDefaultClient()) => {
 	return result;
 };
 
+//#endregion
+//#region src/modules/waas/policies/applyPolicyLayerBatch/applyPolicyLayerBatch.ts
+/**
+* Applies a batch of rule operations to the policy layer a
+* {@link ResolvedPolicyScope} points at, atomically in one enclave cycle.
+* Shared by {@link createPolicy} and {@link removePolicyRules} so the
+* account-vs-wallet-vs-signer branch is written once.
+*
+* @notInstrumented
+*/
+const applyPolicyLayerBatch = ({ operations, resolvedScope }, client) => {
+	const { environmentId } = getCore(client);
+	const apiClient = createApiClient({}, client);
+	switch (resolvedScope.target) {
+		case "account": return apiClient.updateBusinessAccountPolicyLayer({
+			businessAccountId: resolvedScope.businessAccountId,
+			environmentId,
+			waasPolicyLayerUpdateRequest: {
+				op: WaasPolicyLayerUpdateRequestOpEnum.Batch,
+				operations
+			}
+		});
+		case "wallet": return apiClient.updateWaasWalletSelfPolicyLayer({
+			environmentId,
+			waasPolicyLayerUpdateRequest: {
+				op: WaasPolicyLayerUpdateRequestOpEnum.Batch,
+				operations
+			},
+			walletId: resolvedScope.walletId
+		});
+		case "signer": return apiClient.updateWaasSignerSelfPolicyLayer({
+			environmentId,
+			waasSignerPolicyLayerUpdateRequest: {
+				op: WaasSignerPolicyLayerUpdateRequestOpEnum.Batch,
+				operations,
+				shareSetId: resolvedScope.shareSetId
+			},
+			walletId: resolvedScope.walletId
+		});
+		default: {
+			const unhandledScope = resolvedScope;
+			throw new InvalidParamError(`applyPolicyLayerBatch: unhandled target "${JSON.stringify(unhandledScope)}"`);
+		}
+	}
+};
+
+//#endregion
+//#region src/utils/objectKeys/objectKeys.ts
+/**
+* Typed `Object.keys` — returns `(keyof T)[]` instead of `string[]`, for
+* objects whose key set is fully known at the type level.
+*
+* @notInstrumented
+*/
+const objectKeys = (value) => Object.keys(value);
+
+//#endregion
+//#region src/modules/waas/policies/buildValueLimit/buildValueLimit.ts
+/**
+* Turns a {@link PolicyRuleMaxAmountPerTransaction} into the `valueLimit` shape a rule stores it as.
+* @notInstrumented
+*/
+const buildValueLimit = ({ amount, asset }) => ({
+	asset,
+	maxPerCall: amount
+});
+
+//#endregion
+//#region src/modules/waas/policies/policyRuleDefaultNames.ts
+/**
+* Each rule kind's name when the caller doesn't override it via
+* `PolicyRules['names']`. Shared between the `build*Rule` functions and
+* `desugarPolicyRules` so a rename can't drift the two out of sync — the
+* same reason `RULE_KINDS` in `policyRuleKinds.ts` is a single table
+* instead of parallel switches.
+*/
+const DEFAULT_POLICY_RULE_NAMES = {
+	allowAddresses: "Allowed addresses",
+	blockExport: "Block key export",
+	denyAddresses: "Denied addresses",
+	maxAmountPerTransaction: "Per-transaction cap"
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildAllowAddressesRule/buildAllowAddressesRule.ts
+/**
+* Builds the `allowAddresses` rule, absorbing a sibling
+* `maxAmountPerTransaction` onto the same rule instead of letting it emit
+* its own — see `buildMaxAmountPerTransactionRule`.
+* @notInstrumented
+*/
+const buildAllowAddressesRule = ({ context: { chain, chainIds }, rules }) => {
+	if (!rules.allowAddresses || rules.allowAddresses.length === 0) return void 0;
+	return {
+		addresses: rules.allowAddresses,
+		chain,
+		chainIds,
+		name: rules.names?.allowAddresses ?? DEFAULT_POLICY_RULE_NAMES.allowAddresses,
+		ruleType: WaasPolicyRuleType.Allow,
+		...rules.maxAmountPerTransaction ? { valueLimit: buildValueLimit(rules.maxAmountPerTransaction) } : {}
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildBlockExportRule/buildBlockExportRule.ts
+/**
+* Builds the `blockExport` rule. `deny`, not `allow`: an addressless
+* allow-rule normalizes to an empty allowed-set, denying every transaction.
+* `chain`/`chainIds` are stamped for consistency but the enforcement of a
+* `blockExport` `operationRestrictions` rule is wallet-wide, ignoring them.
+* @notInstrumented
+*/
+const buildBlockExportRule = ({ context: { chain, chainIds }, rules }) => {
+	if (rules.blockExport !== true) return void 0;
+	return {
+		chain,
+		chainIds,
+		name: rules.names?.blockExport ?? DEFAULT_POLICY_RULE_NAMES.blockExport,
+		operationRestrictions: { blockExport: true },
+		ruleType: WaasPolicyRuleType.Deny
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildDenyAddressesRule/buildDenyAddressesRule.ts
+/**
+* Builds the `denyAddresses` rule. Independent of `allowAddresses`.
+* @notInstrumented
+*/
+const buildDenyAddressesRule = ({ context: { chain, chainIds }, rules }) => {
+	if (!rules.denyAddresses || rules.denyAddresses.length === 0) return void 0;
+	return {
+		addresses: rules.denyAddresses,
+		chain,
+		chainIds,
+		name: rules.names?.denyAddresses ?? DEFAULT_POLICY_RULE_NAMES.denyAddresses,
+		ruleType: WaasPolicyRuleType.Deny
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildMaxAmountPerTransactionRule/buildMaxAmountPerTransactionRule.ts
+/**
+* Builds the standalone `maxAmountPerTransaction` rule. Only fires when
+* `allowAddresses` didn't already absorb this cap onto its own rule. `deny`
+* for the same reason as `blockExport`'s builder.
+* @notInstrumented
+*/
+const buildMaxAmountPerTransactionRule = ({ context: { chain, chainIds }, rules }) => {
+	const isAbsorbedByAllowAddresses = Boolean(rules.allowAddresses?.length);
+	if (!rules.maxAmountPerTransaction || isAbsorbedByAllowAddresses) return void 0;
+	return {
+		chain,
+		chainIds,
+		name: rules.names?.maxAmountPerTransaction ?? DEFAULT_POLICY_RULE_NAMES.maxAmountPerTransaction,
+		ruleType: WaasPolicyRuleType.Deny,
+		valueLimit: buildValueLimit(rules.maxAmountPerTransaction)
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/hasAddresses/hasAddresses.ts
+/**
+* Checks both the current `addresses` array and the legacy singular `address` field.
+* @notInstrumented
+*/
+const hasAddresses = (rule) => rule.addresses !== void 0 && rule.addresses.length > 0 || rule.address != null;
+
+//#endregion
+//#region src/modules/waas/policies/hasUnrecognizedFields/hasUnrecognizedFields.ts
+const RECOGNIZED_TOP_LEVEL_KEY_SET = new Set([
+	"ruleId",
+	"name",
+	"ruleType",
+	"addresses",
+	"chain",
+	"chainIds",
+	"valueLimit",
+	"operationRestrictions"
+]);
+/**
+* @notInstrumented
+*/
+const hasUnrecognizedFields = (rule) => Object.keys(rule).some((key) => !RECOGNIZED_TOP_LEVEL_KEY_SET.has(key) && rule[key] != null) || rule.valueLimit?.totalLimit != null || rule.operationRestrictions?.blockRevocation != null || rule.operationRestrictions?.blockClientSigning != null;
+
+//#endregion
+//#region src/modules/waas/policies/readValueLimit/readValueLimit.ts
+/**
+* Reads a stored `valueLimit` back into a {@link PolicyRuleMaxAmountPerTransaction}.
+* @notInstrumented
+*/
+const readValueLimit = ({ asset, maxPerCall }) => ({
+	amount: maxPerCall,
+	...asset ? { asset } : {}
+});
+
+//#endregion
+//#region src/modules/waas/policies/readAllowAddressesRule/readAllowAddressesRule.ts
+/**
+* Recognizes an existing rule as `allowAddresses`, reading back a merged
+* `maxAmountPerTransaction` cap too when the rule carries one.
+* @notInstrumented
+*/
+const readAllowAddressesRule = (rule) => {
+	if (!(rule.ruleType === WaasPolicyRuleType.Allow && rule.operationRestrictions === void 0 && (rule.valueLimit === void 0 || rule.valueLimit.maxPerCall !== void 0) && hasAddresses(rule) && !hasUnrecognizedFields(rule))) return void 0;
+	return {
+		allowAddresses: rule.addresses,
+		...rule.valueLimit?.maxPerCall !== void 0 ? { maxAmountPerTransaction: readValueLimit({
+			asset: rule.valueLimit.asset,
+			maxPerCall: rule.valueLimit.maxPerCall
+		}) } : {}
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/readBlockExportRule/readBlockExportRule.ts
+/**
+* Recognizes an existing rule as `blockExport`.
+* @notInstrumented
+*/
+const readBlockExportRule = (rule) => {
+	if (!(rule.ruleType === WaasPolicyRuleType.Deny && rule.operationRestrictions?.blockExport === true && rule.valueLimit === void 0 && !hasAddresses(rule) && !hasUnrecognizedFields(rule))) return void 0;
+	return { blockExport: true };
+};
+
+//#endregion
+//#region src/modules/waas/policies/readDenyAddressesRule/readDenyAddressesRule.ts
+/**
+* Recognizes an existing rule as `denyAddresses`.
+* @notInstrumented
+*/
+const readDenyAddressesRule = (rule) => {
+	if (!(rule.ruleType === WaasPolicyRuleType.Deny && rule.operationRestrictions === void 0 && rule.valueLimit === void 0 && hasAddresses(rule) && !hasUnrecognizedFields(rule))) return void 0;
+	return { denyAddresses: rule.addresses };
+};
+
+//#endregion
+//#region src/modules/waas/policies/readMaxAmountPerTransactionRule/readMaxAmountPerTransactionRule.ts
+/**
+* Recognizes an existing rule as a standalone `maxAmountPerTransaction` cap.
+* @notInstrumented
+*/
+const readMaxAmountPerTransactionRule = (rule) => {
+	if (!(rule.ruleType === WaasPolicyRuleType.Deny && rule.operationRestrictions === void 0 && rule.valueLimit?.maxPerCall !== void 0 && !hasAddresses(rule) && !hasUnrecognizedFields(rule))) return void 0;
+	return { maxAmountPerTransaction: readValueLimit({
+		asset: rule.valueLimit.asset,
+		maxPerCall: rule.valueLimit.maxPerCall
+	}) };
+};
+
+//#endregion
+//#region src/modules/waas/policies/policyRuleKinds.ts
+/** The four keys of {@link PolicyRules}, each of which produces its own rule. */
+const RULE_KIND_KEYS = [
+	"blockExport",
+	"allowAddresses",
+	"denyAddresses",
+	"maxAmountPerTransaction"
+];
+/**
+* The single source of truth {@link expandPolicyRules} and
+* {@link desugarPolicyRules} both build on. Entries are alphabetized
+* (enforced by lint), not grouped by relationship — `allowAddresses` and
+* `maxAmountPerTransaction` cooperate (see their builders' comments) despite
+* sitting apart here.
+*/
+const RULE_KINDS = {
+	allowAddresses: {
+		buildRule: buildAllowAddressesRule,
+		readRule: readAllowAddressesRule
+	},
+	blockExport: {
+		buildRule: buildBlockExportRule,
+		readRule: readBlockExportRule
+	},
+	denyAddresses: {
+		buildRule: buildDenyAddressesRule,
+		readRule: readDenyAddressesRule
+	},
+	maxAmountPerTransaction: {
+		buildRule: buildMaxAmountPerTransactionRule,
+		readRule: readMaxAmountPerTransactionRule
+	}
+};
+
+//#endregion
+//#region src/modules/waas/policies/readCoveredRule/readCoveredRule.ts
+/**
+* The sugar keys and values an existing rule structurally represents — a
+* single rule can cover more than one key (see `allowAddresses` absorbing
+* `maxAmountPerTransaction` in `policyRuleKinds.ts`). A rule carrying a
+* per-rule `modifiableBySigner` grant is never matched here — treating it
+* as covering keys would let a caller's batch reuse/replace/remove it and
+* silently revoke that signer's edit permission (mirrors `desugarPolicyRules`).
+*
+* @param rule - The existing policy-layer rule to read.
+* @returns The sugar keys and values the rule covers, or undefined when it matches no kind or carries a signer grant.
+* @notInstrumented
+*/
+const readCoveredRule = (rule) => {
+	if (rule.modifiableBySigner === true) return;
+	for (const kind of RULE_KIND_KEYS) {
+		const values = RULE_KINDS[kind].readRule(rule);
+		if (values === void 0) continue;
+		return {
+			keys: objectKeys(values),
+			kind,
+			values
+		};
+	}
+};
+
+//#endregion
+//#region src/modules/waas/policies/sortRulesByRuleId/sortRulesByRuleId.ts
+/**
+* Sorts rules by `ruleId` ascending (a rule missing one sorts first, as `''`)
+* — the deterministic order {@link matchExistingRules} picks its reuse
+* target from, so every caller agrees on which duplicate rule wins.
+*
+* @param rules - The rules to sort.
+* @returns A new array, sorted by `ruleId` ascending.
+* @notInstrumented
+*/
+const sortRulesByRuleId = (rules) => [...rules].sort((a, b) => {
+	const idA = a.ruleId ?? "";
+	const idB = b.ruleId ?? "";
+	if (idA < idB) return -1;
+	if (idA > idB) return 1;
+	return 0;
+});
+
+//#endregion
+//#region src/modules/waas/policies/matchExistingRules/matchExistingRules.ts
+const coveredRuleKeys = (rule) => readCoveredRule(rule)?.keys ?? [];
+/**
+* Matches existing rules covering any of `builtRule`'s keys. Only rules
+* being *absorbed* into it — i.e. no other match claims the same key — are
+* superseded (safe to remove). Two matches claiming the SAME key (e.g. two
+* hand-authored `denyAddresses` rules for this chain scope) are a
+* legitimate duplicate, not one superseding the other, so are left alone
+* rather than removed.
+*
+* @param params.builtRule - The newly built rule to match existing rules against.
+* @param params.consumedRuleIds - `ruleId`s already reused or removed for a prior built rule this call, so none is touched twice.
+* @param params.existingRulesInScope - The layer's rules already narrowed to the target chain scope.
+* @returns The rule to reuse `builtRule`'s upsert onto (if any), and every rule it supersedes.
+* @notInstrumented
+*/
+const matchExistingRules = ({ builtRule, consumedRuleIds, existingRulesInScope }) => {
+	const builtKeys = new Set(coveredRuleKeys(builtRule));
+	const matches = sortRulesByRuleId(existingRulesInScope).filter((existingRule) => existingRule.ruleId !== void 0 && !consumedRuleIds.has(existingRule.ruleId)).map((rule) => ({
+		keys: coveredRuleKeys(rule),
+		rule
+	})).filter(({ keys }) => keys.some((key) => builtKeys.has(key)));
+	const [reused, ...rest] = matches;
+	const superseded = rest.filter(({ keys, rule }) => {
+		const ruleKeys = new Set(keys);
+		return !matches.some((other) => other.rule.ruleId !== rule.ruleId && other.keys.some((key) => ruleKeys.has(key)));
+	}).map(({ rule }) => rule);
+	return {
+		reused: reused?.rule,
+		superseded
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/resolveRuleName/resolveRuleName.ts
+/**
+* Keeps the reused rule's label unless the caller overrides it or its
+* name-owning kind changed.
+*
+* @param params.builtRule - The newly built rule about to be upserted.
+* @param params.reused - The existing rule `builtRule` is upserted onto, if any.
+* @param params.rules - The caller's requested {@link PolicyRules} sugar map.
+* @returns The name to use for the upserted rule.
+* @notInstrumented
+*/
+const resolveRuleName = ({ builtRule, reused, rules }) => {
+	if (reused === void 0) return builtRule.name;
+	const builtKind = readCoveredRule(builtRule)?.kind;
+	const reusedKind = readCoveredRule(reused)?.kind;
+	const sameOwningKind = builtKind !== void 0 && builtKind === reusedKind;
+	const nameOverridden = builtKind !== void 0 && rules.names?.[builtKind] !== void 0;
+	return sameOwningKind && !nameOverridden ? reused.name : builtRule.name;
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildOperationsForRule/buildOperationsForRule.ts
+/**
+* Upserts `builtRule` onto the existing rule it reuses (if any), and
+* removes every rule that rule superseded. Mutates `consumedRuleIds` so a
+* later call for a different built rule never reuses or removes the same
+* existing rule twice.
+*
+* @param params.builtRule - The newly built rule to turn into batch operations.
+* @param params.consumedRuleIds - `ruleId`s already reused or removed for a prior built rule this call.
+* @param params.existingRulesInScope - The layer's rules already narrowed to the target chain scope.
+* @param params.rules - The caller's requested {@link PolicyRules} sugar map.
+* @returns The batch operations for this built rule — one upsert, plus a remove per superseded rule.
+* @notInstrumented
+*/
+const buildOperationsForRule = ({ builtRule, consumedRuleIds, existingRulesInScope, rules }) => {
+	const { reused, superseded } = matchExistingRules({
+		builtRule,
+		consumedRuleIds,
+		existingRulesInScope
+	});
+	const reusedRuleId = reused?.ruleId;
+	const operations = [{
+		op: WaasPolicyLayerRuleOperationOpEnum.Upsert,
+		rule: reusedRuleId ? {
+			...builtRule,
+			name: resolveRuleName({
+				builtRule,
+				reused,
+				rules
+			}),
+			ruleId: reusedRuleId
+		} : builtRule
+	}];
+	if (reusedRuleId) consumedRuleIds.add(reusedRuleId);
+	for (const { ruleId } of superseded) {
+		consumedRuleIds.add(ruleId);
+		operations.push({
+			op: WaasPolicyLayerRuleOperationOpEnum.Remove,
+			ruleId
+		});
+	}
+	return operations;
+};
+
+//#endregion
+//#region src/modules/waas/policies/expandPolicyRules/expandPolicyRules.ts
+/**
+* Expands the {@link PolicyRules} sugar map into `WaasPolicyRule[]` for one
+* chain scope. Omitting `chainIds` (or passing an empty array) builds a
+* wildcard rule matching every chain id of `chain`.
+*
+* @param params.rules - The sugar map describing the desired rules.
+* @param params.chain - The chain these rules apply to.
+* @param params.chainIds - The chain ids these rules apply to; omit for a wildcard rule that matches every chain id of `chain`.
+* @returns The expanded `WaasPolicyRule[]`, without `ruleId`.
+* @throws When expansion would produce an `allow` rule with a value limit and no addresses — that empties the allowed set and denies every transaction on the chain.
+* @notInstrumented
+*/
+const expandPolicyRules = ({ chain, chainIds, rules }) => {
+	const context = {
+		chain,
+		chainIds: chainIds ?? []
+	};
+	const expanded = RULE_KIND_KEYS.flatMap((key) => {
+		const rule = RULE_KINDS[key].buildRule({
+			context,
+			rules
+		});
+		return rule ? [rule] : [];
+	});
+	if (expanded.some((rule) => rule.ruleType === WaasPolicyRuleType.Allow && rule.valueLimit !== void 0 && (rule.addresses === void 0 || rule.addresses.length === 0))) throw new InvalidParamError("expandPolicyRules: refusing to emit an allow rule with a value limit and no addresses — it would empty the allowed-address set and deny every transaction on this chain");
+	return expanded;
+};
+
+//#endregion
+//#region src/modules/waas/policies/fillOmittedRuleValues/fillOmittedRuleValues.ts
+/**
+* Whether the caller's value for a sugar key would actually produce a rule —
+* an empty `allowAddresses`/`denyAddresses` array builds no rule (see
+* `buildAllowAddressesRule`/`buildDenyAddressesRule`), so it must count the
+* same as omitted here. Otherwise a real value is present.
+*/
+const isRuleKeyRequested = (value) => Array.isArray(value) ? value.length > 0 : value !== void 0;
+/**
+* A key the caller omitted can be silently dropped if it's merged into the
+* same rule as a key they DID supply (e.g. re-saving only `allowAddresses`
+* when the existing rule also carries `maxAmountPerTransaction`) — carries
+* it forward so a partial re-save never erases a restriction the caller
+* didn't ask to remove.
+*
+* Rules are visited in the same lexicographically-smallest-`ruleId` order
+* `matchExistingRules` reuses, and only the first rule to cover a given key
+* fills it — so when duplicate rules cover the same omitted key, the value
+* always comes from the rule that will actually be upserted.
+*
+* @param params.existingRulesInScope - The layer's rules already narrowed to the target chain scope.
+* @param params.rules - The caller's requested {@link PolicyRules} sugar map.
+* @returns `rules`, with any key a partially-requested existing rule also covers filled in from that rule's current value.
+* @notInstrumented
+*/
+const fillOmittedRuleValues = ({ existingRulesInScope, rules }) => {
+	const mergedRules = { ...rules };
+	for (const existingRule of sortRulesByRuleId(existingRulesInScope)) {
+		const covered = readCoveredRule(existingRule);
+		const isPartiallyRequested = covered !== void 0 && covered.keys.some((key) => isRuleKeyRequested(rules[key])) && covered.keys.some((key) => !isRuleKeyRequested(rules[key]));
+		if (covered === void 0 || !isPartiallyRequested) continue;
+		for (const key of covered.keys) if (!isRuleKeyRequested(rules[key]) && mergedRules[key] === void 0) Object.assign(mergedRules, { [key]: covered.values[key] });
+	}
+	return mergedRules;
+};
+
+//#endregion
+//#region src/modules/waas/policies/getResolvedPolicyLayer/getResolvedPolicyLayer.ts
+/**
+* Fetches the policy layer a {@link ResolvedPolicyScope} points at. Shared
+* by {@link createPolicy}, {@link getPolicy}, and {@link removePolicyRules}
+* so the account/wallet/signer branch is written once.
+*
+* @notInstrumented
+*/
+const getResolvedPolicyLayer = ({ resolvedScope }, client) => {
+	const { environmentId } = getCore(client);
+	const apiClient = createApiClient({}, client);
+	switch (resolvedScope.target) {
+		case "account": return apiClient.getBusinessAccountPolicyLayer({
+			businessAccountId: resolvedScope.businessAccountId,
+			environmentId
+		});
+		case "wallet": return apiClient.getWaasWalletSelfPolicyLayer({
+			environmentId,
+			walletId: resolvedScope.walletId
+		});
+		case "signer": return apiClient.getWaasSignerSelfPolicyLayer({
+			environmentId,
+			shareSetId: resolvedScope.shareSetId,
+			walletId: resolvedScope.walletId
+		});
+		default: {
+			const unhandledScope = resolvedScope;
+			throw new InvalidParamError(`getResolvedPolicyLayer: unhandled target "${JSON.stringify(unhandledScope)}"`);
+		}
+	}
+};
+
+//#endregion
+//#region src/modules/waas/policies/resolvePolicyScope/resolvePolicyScope.ts
+/** Narrows a {@link WalletAccount} to {@link WaasWalletAccount} so WaaS-only fields (e.g. `shareSetId`) are accessible. */
+const isWaasWallet = (walletAccount) => isWaasWalletAccount({ walletAccount });
+/**
+* Resolves a {@link PolicyScope} to its concrete policy layer. When only a
+* `shareSetId` is given, the owning wallet is found locally by scanning the
+* client's own wallet accounts — no network request.
+*
+* @param params.scope - The scope to resolve.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The concrete target (`account`, `wallet`, or `signer`) plus the ids needed to call the SDK API.
+* @throws When a `shareSetId`-only scope doesn't match any of the client's wallet accounts.
+* @notInstrumented
+*/
+const resolvePolicyScope = ({ scope }, client = getDefaultClient()) => {
+	if ("businessAccountId" in scope) return {
+		businessAccountId: scope.businessAccountId,
+		target: "account"
+	};
+	if ("walletId" in scope) return scope.shareSetId === void 0 ? {
+		target: "wallet",
+		walletId: scope.walletId
+	} : {
+		shareSetId: scope.shareSetId,
+		target: "signer",
+		walletId: scope.walletId
+	};
+	const owningWalletAccount = getWalletAccounts(client).filter(isWaasWallet).find((walletAccount) => walletAccount.shareSetId === scope.shareSetId || walletAccount.otherShareSets?.some((shareSet) => shareSet.shareSetId === scope.shareSetId));
+	assertDefined(owningWalletAccount?.verifiedCredentialId, `resolvePolicyScope: could not resolve a wallet for shareSetId "${scope.shareSetId}" — no verified wallet account exposes this share set`);
+	return {
+		shareSetId: scope.shareSetId,
+		target: "signer",
+		walletId: owningWalletAccount.verifiedCredentialId
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/sameChainIds/sameChainIds.ts
+/**
+* Whether two chainIds arrays describe the same set, regardless of order.
+* Shared by {@link createPolicy} and {@link removePolicyRules} to keep their
+* existing-rule lookups consistent.
+*
+* @notInstrumented
+*/
+const sameChainIds = ({ existing = [], requested }) => {
+	if (existing.length !== requested.length) return false;
+	const sortedExisting = [...existing].sort((x, y) => x - y);
+	const sortedRequested = [...requested].sort((x, y) => x - y);
+	return sortedExisting.every((id, index) => id === sortedRequested[index]);
+};
+
+//#endregion
+//#region src/modules/waas/policies/createPolicy/createPolicy.ts
+/**
+* Creates or updates a wallet's, signer's, or business account's policy rules from the
+* {@link PolicyRules} sugar map, in one atomic `batch` PATCH. Each key in
+* `rules` maps to at most one underlying rule, so calling this twice with
+* the same map updates that rule in place instead of duplicating it.
+*
+* Known race: no ETag / optimistic-concurrency check — concurrent calls for
+* the same scope can both read-then-write and duplicate a rule.
+*
+* When more than one existing rule matches the same sugar key(s), only
+* rules being absorbed into the newly built rule (i.e. no other match
+* claims the same key) are removed. Two rules that duplicate the same key
+* (e.g. two hand-authored `denyAddresses` rules for this chain scope) are
+* left as-is rather than one being silently deleted — this call updates the
+* lexicographically-smallest-`ruleId` match in place and leaves the rest
+* untouched. A caller repeating this call will not converge on a single
+* rule; the duplicate has to be removed by hand.
+*
+* @param params.scope - Which policy layer to update — see {@link resolvePolicyScope}.
+* @param params.chain - The chain the rules apply to.
+* @param params.chainIds - The chain ids the rules apply to; omit for a wildcard rule that matches every chain id of `chain`.
+* @param params.rules - The desired rules, as a {@link PolicyRules} sugar map.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The policy layer as it stands after the batch is applied.
+* @throws When `rules` produces no recognized keys, or via {@link resolvePolicyScope}'s scope-resolution errors.
+* @notInstrumented
+*/
+const createPolicy = async ({ chain, chainIds, rules, scope }, client = getDefaultClient()) => {
+	const normalizedChainIds = chainIds ?? [];
+	const resolvedScope = resolvePolicyScope({ scope }, client);
+	const existingRulesInScope = ((await getResolvedPolicyLayer({ resolvedScope }, client)).layerContent.rules ?? []).filter((existingRule) => existingRule.chain === chain && sameChainIds({
+		existing: existingRule.chainIds,
+		requested: normalizedChainIds
+	}));
+	const expandedRules = expandPolicyRules({
+		chain,
+		chainIds: normalizedChainIds,
+		rules: fillOmittedRuleValues({
+			existingRulesInScope,
+			rules
+		})
+	});
+	if (expandedRules.length === 0) throw new InvalidParamError("createPolicy: rules must include at least one recognized policy key");
+	const consumedRuleIds = /* @__PURE__ */ new Set();
+	const operations = [];
+	for (const builtRule of expandedRules) operations.push(...buildOperationsForRule({
+		builtRule,
+		consumedRuleIds,
+		existingRulesInScope,
+		rules
+	}));
+	return applyPolicyLayerBatch({
+		operations,
+		resolvedScope
+	}, client);
+};
+
 //#endregion
 //#region src/modules/waas/createWaasOfflineRecoveryShares/createWaasOfflineRecoveryShares.ts
 /**
@@ -323,6 +994,7 @@ const normalizeWalletRequirements = ({ defaultBitcoinConfig, input }) => {
 const createWaasWalletAccounts = async ({ chains, password, thresholdSignatureScheme }, client = getDefaultClient()) => {
 	const normalizedRequirements = normalizeWalletRequirements({ input: chains });
 	const supportedChains = [
+		"ALEO",
 		"BTC",
 		"EVM",
 		"SOL",
@@ -420,6 +1092,101 @@ const delegateWaasKeyShares = async ({ initialSignerRules, password, walletAccou
 	await __refreshAuth_wrapped(client);
 };
 
+//#endregion
+//#region src/modules/waas/policies/findMatchedRuleKind/findMatchedRuleKind.ts
+const COUPLED_RULE_KINDS = new Set(["allowAddresses", "maxAmountPerTransaction"]);
+const isBlocked = ({ claimedKinds, populatedKeys }) => populatedKeys.some((key) => claimedKinds.has(key) || COUPLED_RULE_KINDS.has(key) && [...COUPLED_RULE_KINDS].some((coupledKey) => claimedKinds.has(coupledKey)));
+/**
+* Finds the first {@link RULE_KINDS} entry that recognizes `entry` as its
+* kind without colliding with an already-claimed key. Must check every key
+* `readRule` would populate, not just this kind's own key — allowAddresses'
+* `readRule` also populates `maxAmountPerTransaction` when the rule carries
+* a merged cap, so accepting it while that key is already claimed would
+* overwrite an earlier standalone cap.
+* @notInstrumented
+*/
+const findMatchedRuleKind = ({ claimedKinds, entry }) => {
+	for (const key of RULE_KIND_KEYS) {
+		const readResult = RULE_KINDS[key].readRule(entry);
+		if (readResult === void 0) continue;
+		if (!isBlocked({
+			claimedKinds,
+			populatedKeys: Object.keys(readResult)
+		})) return {
+			kind: key,
+			readResult
+		};
+	}
+};
+
+//#endregion
+//#region src/modules/waas/policies/isPolicyRuleDeletionMarker/isPolicyRuleDeletionMarker.ts
+/** The exact key set of a deletion marker — checked as a closed shape, not by presence alone. */
+const DELETION_MARKER_KEYS = new Set([
+	"ruleId",
+	"deletedByType",
+	"deletedById"
+]);
+/**
+* Recognizes a policy-Layer deletion marker — the enclave's stand-in for a
+* rule it couldn't drop outright, kept so the removal stays attributable.
+* Matches on the entry's exact key set, not field presence, since the read
+* response types every entry as a live rule.
+*
+* @param entry - The raw policy-Layer rule entry to check.
+* @returns Whether `entry` is a deletion marker rather than a live rule.
+* @notInstrumented
+*/
+const isPolicyRuleDeletionMarker = (entry) => {
+	const candidate = entry;
+	return typeof candidate.ruleId === "string" && typeof candidate.deletedByType === "string" && typeof candidate.deletedById === "string" && Object.keys(entry).every((key) => DELETION_MARKER_KEYS.has(key));
+};
+
+//#endregion
+//#region src/modules/waas/policies/desugarPolicyRules/desugarPolicyRules.ts
+/**
+* Reverses {@link expandPolicyRules} using {@link findMatchedRuleKind}'s
+* same rule-kind table, skipping deletion markers. A kind claims at most
+* one rule; extra matches, out-of-vocabulary fields, and per-rule
+* `modifiableBySigner` grants (no sugar representation) all go to
+* `unmapped` instead of being dropped.
+*
+* @param params.entries - The policy-Layer's rule entries, as returned in `layerContent.rules`.
+* @returns The recognized rules as a {@link PolicyRules} map, plus whatever wasn't recognized.
+* @notInstrumented
+*/
+const desugarPolicyRules = ({ entries }) => {
+	const rules = {};
+	const unmapped = [];
+	const claimedKinds = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		if (isPolicyRuleDeletionMarker(entry)) continue;
+		if (entry.modifiableBySigner === true) {
+			unmapped.push(entry);
+			continue;
+		}
+		const matched = findMatchedRuleKind({
+			claimedKinds,
+			entry
+		});
+		if (matched === void 0) {
+			unmapped.push(entry);
+			continue;
+		}
+		const { kind, readResult } = matched;
+		Object.assign(rules, readResult);
+		for (const key of Object.keys(readResult)) claimedKinds.add(key);
+		if (entry.name !== DEFAULT_POLICY_RULE_NAMES[kind]) rules.names = {
+			...rules.names,
+			[kind]: entry.name
+		};
+	}
+	return {
+		rules,
+		unmapped
+	};
+};
+
 //#endregion
 //#region src/modules/waas/exportWaasClientKeyshares/exportWaasClientKeyshares.ts
 /**
@@ -464,6 +1231,26 @@ const exportWaasPrivateKey = async ({ displayContainer, password, walletAccount
 	});
 };
 
+//#endregion
+//#region src/modules/waas/policies/getAccountPolicyLayer/getAccountPolicyLayer.ts
+/**
+* Fetches a business account's active policy rules (the account-Layer).
+* BA owner/admin only. Calls the SDK API directly (no MPC step), so a
+* rejection surfaces as a thrown error.
+*
+* @param params.businessAccountId - The business account to read policy rules for.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The account-Layer, including its current rules.
+* @notInstrumented
+*/
+const getAccountPolicyLayer = async ({ businessAccountId }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	return createApiClient({}, client).getBusinessAccountPolicyLayer({
+		businessAccountId,
+		environmentId: core.environmentId
+	});
+};
+
 //#endregion
 //#region src/modules/waas/businessAccounts/getBusinessAccount/getBusinessAccount.ts
 /**
@@ -512,6 +1299,110 @@ const getChainsMissingWaasWalletAccounts = (client = getDefaultClient()) => {
 	}));
 };
 
+//#endregion
+//#region src/modules/waas/policies/getPolicy/getPolicy.ts
+/**
+* Fetches a policy layer and reads its `chain`/`chainIds` scope back into
+* the {@link PolicyRules} sugar map (see {@link desugarPolicyRules}). A
+* layer can hold rules for more than one chain, so entries are narrowed to
+* `chain`/`chainIds` first — the same scoping {@link createPolicy} uses —
+* to keep the `getPolicy` → edit → `createPolicy` round-trip safe for
+* multi-chain wallets. Calls the SDK API directly (no MPC step), so a
+* rejection surfaces as a thrown error.
+*
+* @param params.scope - Which policy layer to read — see {@link resolvePolicyScope}.
+* @param params.chain - The chain to read rules for.
+* @param params.chainIds - The chain ids to read rules for; omit to read the wildcard rule matching every chain id of `chain`.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The recognized rules as a {@link PolicyRules} map, whatever wasn't recognized within `chain`/`chainIds`, and the layer's id and last-updated timestamp.
+* @throws Via {@link resolvePolicyScope}'s scope-resolution errors.
+* @notInstrumented
+*/
+const getPolicy = async ({ chain, chainIds, scope }, client = getDefaultClient()) => {
+	const normalizedChainIds = chainIds ?? [];
+	const layer = await getResolvedPolicyLayer({ resolvedScope: resolvePolicyScope({ scope }, client) }, client);
+	const { rules, unmapped } = desugarPolicyRules({ entries: (layer.layerContent.rules ?? []).filter((entry) => entry.chain === chain && sameChainIds({
+		existing: entry.chainIds,
+		requested: normalizedChainIds
+	})) });
+	return {
+		layerId: layer.layerId,
+		rules,
+		unmapped,
+		updatedAt: layer.updatedAt
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/getSignerPolicyLayer/getSignerPolicyLayer.ts
+/**
+* Fetches a signer's active policy rules (the signer-Layer) — the caller's
+* own active share set by default, or another share set on the same wallet
+* (e.g. a delegated share set) when `shareSetId` is given. Calls the SDK API
+* directly (no MPC step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account whose signer-Layer to read.
+* @param [params.shareSetId] - The share set to target; defaults to the caller's own.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The signer-Layer, including its current rules.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const getSignerPolicyLayer = async ({ shareSetId, walletAccount }, client = getDefaultClient()) => {
+	assertDefined(walletAccount.verifiedCredentialId, "getSignerPolicyLayer: cannot resolve a wallet id — use a verified wallet account");
+	const core = getCore(client);
+	return createApiClient({}, client).getWaasSignerSelfPolicyLayer({
+		environmentId: core.environmentId,
+		shareSetId,
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/getWalletAccountShareSets/getWalletAccountShareSets.ts
+/**
+* No network request. Share set ids rotate on refresh/reshare (stale ids are
+* rejected server-side), so re-read rather than cache; non-WaaS accounts
+* return `{ own: undefined, others: [] }` instead of throwing.
+*
+* @param params.walletAccount - The WaaS wallet account whose share sets to read.
+* @returns The account's own share set (if any) and the wallet's other active share sets.
+* @notInstrumented
+*/
+const getWalletAccountShareSets = ({ walletAccount }) => {
+	const own = walletAccount.shareSetId ? {
+		shareSetId: walletAccount.shareSetId,
+		shareSetType: walletAccount.shareSetType
+	} : void 0;
+	return {
+		others: walletAccount.otherShareSets ?? [],
+		own
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/getWalletPolicyLayer/getWalletPolicyLayer.ts
+/**
+* Fetches a wallet's active policy rules (the wallet-Layer). Calls the SDK
+* API directly (no MPC step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account to read policy rules for.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The wallet-Layer, including its current rules.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const getWalletPolicyLayer = async ({ walletAccount }, client = getDefaultClient()) => {
+	assertDefined(walletAccount.verifiedCredentialId, "getWalletPolicyLayer: cannot resolve a wallet id — use a verified wallet account");
+	const core = getCore(client);
+	return createApiClient({}, client).getWaasWalletSelfPolicyLayer({
+		environmentId: core.environmentId,
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
 //#endregion
 //#region src/modules/waas/getWalletRecoveryState/getWalletRecoveryState.ts
 /**
@@ -540,7 +1431,7 @@ const hasDelegatedAccess = ({ walletAccount }, client = getDefaultClient()) => {
 	const verifiedCredential = getVerifiedCredentialForWalletAccount({ walletAccount }, client);
 	assertDefined(verifiedCredential, "Verified credential not found for Waas wallet account");
 	const hasDelegatedKeyShare = verifiedCredential.walletProperties?.keyShares?.some((keyShare) => keyShare.backupLocation === "delegated");
-	const hasDelegatedShareSet = verifiedCredential.walletProperties?.otherShareSets?.some((shareSet) => shareSet.shareSetType === WaasWalletShareSetType.Delegated);
+	const hasDelegatedShareSet = verifiedCredential.walletProperties?.otherShareSets?.some((shareSet) => shareSet.shareSetType === WaasWalletShareSetType$1.Delegated);
 	return Boolean(hasDelegatedKeyShare || hasDelegatedShareSet);
 };
 
@@ -626,6 +1517,31 @@ const refreshWaasWalletAccountShares = async ({ walletAccount, password }, clien
 	});
 };
 
+//#endregion
+//#region src/modules/waas/policies/removeAccountPolicyRule/removeAccountPolicyRule.ts
+/**
+* Removes a single rule from a business account's account-Layer. BA
+* owner/admin only. Calls the SDK API directly (no MPC step), so a
+* rejection surfaces as a thrown error.
+*
+* @param params.businessAccountId - The business account to remove the rule from.
+* @param params.ruleId - The id of the rule to remove.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The account-Layer as it stands after the rule is removed.
+* @notInstrumented
+*/
+const removeAccountPolicyRule = async ({ businessAccountId, ruleId }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	return createApiClient({}, client).updateBusinessAccountPolicyLayer({
+		businessAccountId,
+		environmentId: core.environmentId,
+		waasPolicyLayerUpdateRequest: {
+			op: WaasPolicyLayerUpdateRequestOpEnum.Remove,
+			ruleId
+		}
+	});
+};
+
 //#endregion
 //#region src/modules/waas/businessAccounts/removeBusinessAccountMember/removeBusinessAccountMember.ts
 /**
@@ -738,6 +1654,147 @@ const removeBusinessAccountWallet = async ({ businessAccountId, walletId }, clie
 	return detail;
 };
 
+//#endregion
+//#region src/modules/waas/policies/buildOperationForExistingRule/buildOperationForExistingRule.ts
+/**
+* Builds the operation to remove or rebuild `existingRule` when the
+* caller's requested keys touch it — outright removal when every key it
+* covers is being removed, or an upsert of the rule rebuilt from its
+* remaining keys when only some are. Returns undefined when none of the
+* requested keys touch this rule, when it's outside the sugar vocabulary,
+* or when it can't be identified without a `ruleId`.
+*
+* @param params.chain - The chain the rule to remove/rebuild applies to.
+* @param params.chainIds - The chain ids the rule to remove/rebuild applies to.
+* @param params.existingRule - The existing layer rule to check.
+* @param params.rules - The sugar keys to remove.
+* @returns The operation for this rule, or undefined when it isn't touched.
+* @notInstrumented
+*/
+const buildOperationForExistingRule = ({ chain, chainIds, existingRule, rules }) => {
+	if (existingRule.ruleId === void 0) return;
+	const covered = readCoveredRule(existingRule);
+	if (covered === void 0) return;
+	const remainingKeys = covered.keys.filter((key) => !rules.includes(key));
+	if (remainingKeys.length === covered.keys.length) return;
+	if (remainingKeys.length === 0) return {
+		op: WaasPolicyLayerRuleOperationOpEnum.Remove,
+		ruleId: existingRule.ruleId
+	};
+	const remainingRules = {};
+	for (const key of remainingKeys) Object.assign(remainingRules, { [key]: covered.values[key] });
+	const [rebuiltRule] = expandPolicyRules({
+		chain,
+		chainIds,
+		rules: remainingRules
+	});
+	if (rebuiltRule === void 0) return;
+	const keepsName = readCoveredRule(rebuiltRule)?.kind === covered.kind;
+	return {
+		op: WaasPolicyLayerRuleOperationOpEnum.Upsert,
+		rule: {
+			...rebuiltRule,
+			name: keepsName ? existingRule.name ?? rebuiltRule.name : rebuiltRule.name,
+			ruleId: existingRule.ruleId
+		}
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/removePolicyRules/removePolicyRules.ts
+/**
+* Removes the rules behind one or more {@link PolicyRules} keys from a
+* policy layer, in one atomic `batch` PATCH. For every existing rule the
+* given keys touch, either removes it outright or — when it also covers a
+* key the caller didn't ask to remove (e.g. an
+* `allowAddresses`+`maxAmountPerTransaction` rule with only the cap
+* removed) — rebuilds it from the remaining keys so that restriction
+* survives.
+*
+* @param params.scope - Which policy layer to update — see {@link resolvePolicyScope}.
+* @param params.chain - The chain the rules to remove apply to.
+* @param params.chainIds - The chain ids the rules to remove apply to; omit to target the wildcard rule that matches every chain id of `chain`.
+* @param params.rules - The sugar keys to remove.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The policy layer as it stands after the batch is applied.
+* @throws When none of the given keys match an existing rule for this chain scope, or via {@link resolvePolicyScope}'s scope-resolution errors.
+* @notInstrumented
+*/
+const removePolicyRules = async ({ chain, chainIds, rules, scope }, client = getDefaultClient()) => {
+	const normalizedChainIds = chainIds ?? [];
+	const resolvedScope = resolvePolicyScope({ scope }, client);
+	const operations = ((await getResolvedPolicyLayer({ resolvedScope }, client)).layerContent.rules ?? []).filter((existingRule) => existingRule.chain === chain && sameChainIds({
+		existing: existingRule.chainIds,
+		requested: normalizedChainIds
+	})).map((existingRule) => buildOperationForExistingRule({
+		chain,
+		chainIds: normalizedChainIds,
+		existingRule,
+		rules
+	})).filter((operation) => operation !== void 0);
+	if (operations.length === 0) throw new InvalidParamError("removePolicyRules: none of the given rule keys matched an existing rule for this scope");
+	return applyPolicyLayerBatch({
+		operations,
+		resolvedScope
+	}, client);
+};
+
+//#endregion
+//#region src/modules/waas/policies/removeSignerPolicyRule/removeSignerPolicyRule.ts
+/**
+* Removes a single rule from a signer's policy layer. Calls the SDK API
+* directly (no MPC step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account whose signer-Layer to update.
+* @param params.ruleId - The id of the rule to remove.
+* @param [params.shareSetId] - The share set to target; defaults to the caller's own. Only the wallet's own owner may target another share set.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The signer-Layer as it stands after the rule is removed.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const removeSignerPolicyRule = async ({ ruleId, shareSetId, walletAccount }, client = getDefaultClient()) => {
+	assertDefined(walletAccount.verifiedCredentialId, "removeSignerPolicyRule: cannot resolve a wallet id — use a verified wallet account");
+	const core = getCore(client);
+	return createApiClient({}, client).updateWaasSignerSelfPolicyLayer({
+		environmentId: core.environmentId,
+		waasSignerPolicyLayerUpdateRequest: {
+			op: WaasSignerPolicyLayerUpdateRequestOpEnum.Remove,
+			ruleId,
+			shareSetId
+		},
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/policies/removeWalletPolicyRule/removeWalletPolicyRule.ts
+/**
+* Removes a single rule from a wallet's policy layer. Calls the SDK API
+* directly (no MPC step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account to remove the rule from.
+* @param params.ruleId - The id of the rule to remove.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The wallet-Layer as it stands after the rule is removed.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const removeWalletPolicyRule = async ({ ruleId, walletAccount }, client = getDefaultClient()) => {
+	assertDefined(walletAccount.verifiedCredentialId, "removeWalletPolicyRule: cannot resolve a wallet id — use a verified wallet account");
+	const core = getCore(client);
+	return createApiClient({}, client).updateWaasWalletSelfPolicyLayer({
+		environmentId: core.environmentId,
+		waasPolicyLayerUpdateRequest: {
+			op: WaasPolicyLayerUpdateRequestOpEnum.Remove,
+			ruleId
+		},
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
 //#endregion
 //#region src/modules/waas/revokeWaasDelegation/revokeWaasDelegation.ts
 /**
@@ -805,6 +1862,27 @@ const shouldAutoCreateWalletForChain = ({ chain }, client = getDefaultClient())
 	return getChainsMissingWaasWalletAccounts(client).includes(chain);
 };
 
+//#endregion
+//#region src/modules/waas/signSerializedTransaction/signSerializedTransaction.ts
+/**
+* No gas estimation, balance check, or broadcast — unlike `transferAmount`.
+* Useful for exercising WaaS policy enforcement in isolation.
+*
+* @param params.walletAccount - The wallet account to sign with.
+* @param params.serializedTransaction - The raw serialized transaction (e.g. viem's `serializeTransaction`).
+* @param [params.chainId] - The chain id, if required by the target chain's signer.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The raw signature.
+* @notInstrumented
+*/
+const signSerializedTransaction = async ({ chainId, serializedTransaction, walletAccount }, client = getDefaultClient()) => {
+	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).signSerializedTransaction({
+		chainId,
+		serializedTransaction,
+		walletAccount
+	});
+};
+
 //#endregion
 //#region src/modules/waas/businessAccounts/transferBusinessAccountOwnership/transferBusinessAccountOwnership.ts
 /**
@@ -949,10 +2027,101 @@ const updateWaasPassword = async ({ currentPassword, newPassword, walletAccount
 	});
 };
 
+//#endregion
+//#region src/modules/waas/policies/upsertAccountPolicyRule/upsertAccountPolicyRule.ts
+/**
+* Creates or updates a single rule on a business account's account-Layer
+* (rules applied to every wallet in the account). Build `rule` with
+* {@link buildAllowPolicyRule} / {@link buildDenyPolicyRule}. Omit
+* `rule.ruleId` to create a new rule (the enclave mints one for you); pass
+* an existing `ruleId` to update it in place. BA owner/admin only. Calls
+* the SDK API directly (no MPC step), so a rejection surfaces as a thrown
+* error.
+*
+* @param params.businessAccountId - The business account to apply the rule to.
+* @param params.rule - The rule to create or update.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The account-Layer as it stands after the rule is applied.
+* @notInstrumented
+*/
+const upsertAccountPolicyRule = async ({ businessAccountId, rule }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	return createApiClient({}, client).updateBusinessAccountPolicyLayer({
+		businessAccountId,
+		environmentId: core.environmentId,
+		waasPolicyLayerUpdateRequest: {
+			op: WaasPolicyLayerUpdateRequestOpEnum.Upsert,
+			rule
+		}
+	});
+};
+
+//#endregion
+//#region src/modules/waas/policies/upsertSignerPolicyRule/upsertSignerPolicyRule.ts
+/**
+* Creates or updates a single rule on a signer's policy layer. Build `rule`
+* with {@link buildAllowPolicyRule} / {@link buildDenyPolicyRule}. Omit
+* `rule.ruleId` to create a new rule (the enclave mints one for you); pass an
+* existing `ruleId` to update it in place. Calls the SDK API directly (no MPC
+* step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account whose signer-Layer to update.
+* @param params.rule - The rule to create or update.
+* @param [params.shareSetId] - The share set to target; defaults to the caller's own. Only the wallet's own owner may target another share set.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The signer-Layer as it stands after the rule is applied.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const upsertSignerPolicyRule = async ({ rule, shareSetId, walletAccount }, client = getDefaultClient()) => {
+	assertDefined(walletAccount.verifiedCredentialId, "upsertSignerPolicyRule: cannot resolve a wallet id — use a verified wallet account");
+	const core = getCore(client);
+	return createApiClient({}, client).updateWaasSignerSelfPolicyLayer({
+		environmentId: core.environmentId,
+		waasSignerPolicyLayerUpdateRequest: {
+			op: WaasSignerPolicyLayerUpdateRequestOpEnum.Upsert,
+			rule,
+			shareSetId
+		},
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/policies/upsertWalletPolicyRule/upsertWalletPolicyRule.ts
+/**
+* Creates or updates a single rule on a wallet's policy layer. Build `rule`
+* with {@link buildAllowPolicyRule} / {@link buildDenyPolicyRule}. Omit
+* `rule.ruleId` to create a new rule (the enclave mints one for you); pass an
+* existing `ruleId` to update it in place. Calls the SDK API directly (no MPC
+* step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account to apply the rule to.
+* @param params.rule - The rule to create or update.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The wallet-Layer as it stands after the rule is applied.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const upsertWalletPolicyRule = async ({ rule, walletAccount }, client = getDefaultClient()) => {
+	assertDefined(walletAccount.verifiedCredentialId, "upsertWalletPolicyRule: cannot resolve a wallet id — use a verified wallet account");
+	const core = getCore(client);
+	return createApiClient({}, client).updateWaasWalletSelfPolicyLayer({
+		environmentId: core.environmentId,
+		waasPolicyLayerUpdateRequest: {
+			op: WaasPolicyLayerUpdateRequestOpEnum.Upsert,
+			rule
+		},
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
 //#endregion
 //#region src/exports/waas.ts
 assertPackageVersion(name, version);
 
 //#endregion
-export { NotWaasWalletProviderError, TransactionBroadcastError, addBusinessAccountMember, addBusinessAccountSigner, addWalletToBusinessAccount, backupWaasKeySharesToGoogleDrive, createBusinessAccount, createWaasOfflineRecoveryShares, createWaasWalletAccounts, createWalletForBusinessAccount, delegateWaasKeyShares, exportWaasClientKeyshares, exportWaasPrivateKey, getBusinessAccount, getChainsMissingWaasWalletAccounts, getWalletRecoveryState, hasDelegatedAccess, importWaasPrivateKey, isDynamicWaasEnabled, isPasswordRequiredForWaasWallets, isWaasWalletAccount, isWalletCreationRequirement, listBusinessAccounts, migrateFromFireblocks, normalizeWalletRequirements, refreshWaasWalletAccountShares, removeBusinessAccountMember, removeBusinessAccountSigner, removeBusinessAccountWallet, revokeWaasDelegation, setWaasWalletAccountPassword, shouldAutoCreateWalletForChain, transferBusinessAccountOwnership, unlockWallet, updateBusinessAccount, updateBusinessAccountMemberRole, updateWaasPassword };
+export { NotWaasWalletProviderError, TransactionBroadcastError, WaasWalletShareSetType, addBusinessAccountMember, addBusinessAccountSigner, addWalletToBusinessAccount, backupWaasKeySharesToGoogleDrive, buildAllowPolicyRule, buildDenyPolicyRule, createBusinessAccount, createPolicy, createWaasOfflineRecoveryShares, createWaasWalletAccounts, createWalletForBusinessAccount, delegateWaasKeyShares, desugarPolicyRules, expandPolicyRules, exportWaasClientKeyshares, exportWaasPrivateKey, getAccountPolicyLayer, getBusinessAccount, getChainsMissingWaasWalletAccounts, getPolicy, getSignerPolicyLayer, getWalletAccountShareSets, getWalletPolicyLayer, getWalletRecoveryState, hasDelegatedAccess, importWaasPrivateKey, isDynamicWaasEnabled, isPasswordRequiredForWaasWallets, isWaasWalletAccount, isWalletCreationRequirement, listBusinessAccounts, migrateFromFireblocks, normalizeWalletRequirements, refreshWaasWalletAccountShares, removeAccountPolicyRule, removeBusinessAccountMember, removeBusinessAccountSigner, removeBusinessAccountWallet, removePolicyRules, removeSignerPolicyRule, removeWalletPolicyRule, resolvePolicyScope, revokeWaasDelegation, setWaasWalletAccountPassword, shouldAutoCreateWalletForChain, signSerializedTransaction, transferBusinessAccountOwnership, unlockWallet, updateBusinessAccount, updateBusinessAccountMemberRole, updateWaasPassword, upsertAccountPolicyRule, upsertSignerPolicyRule, upsertWalletPolicyRule };
 //# sourceMappingURL=waas.esm.js.map