@dynamic-labs-sdk/client 1.30.2 → 1.31.0

package/dist/waas-BOKafCeH.cjs

@@ -0,0 +1,2467 @@
+const require_logoutWithReason = require('./logoutWithReason-DlA15deT.cjs');
+const require_migrateFromFireblocks = require('./migrateFromFireblocks-CqIpxGRS.cjs');
+const require_getVerifiedCredentialForWalletAccount = require('./getVerifiedCredentialForWalletAccount-C2o5idph.cjs');
+let _dynamic_labs_sdk_assert_package_version = require("@dynamic-labs-sdk/assert-package-version");
+let _dynamic_labs_sdk_api_core = require("@dynamic-labs/sdk-api-core");
+
+//#region src/modules/waas/waas.consts.ts
+/**
+* Identifies the chain family targeted by WaaS policy operations.
+*
+* @example
+* ```ts
+* const chain: WaasChainEnum = WaasChainEnum.Evm;
+* ```
+*
+* @see createPolicy
+* @see getPolicy
+*/
+const WaasChainEnum = _dynamic_labs_sdk_api_core.WaasChainEnum;
+/**
+* Identifies the role of a share set exposed through a WaaS wallet account.
+*
+* @see getWalletAccountShareSets
+* @see WaasWalletAccount
+*/
+const WaasWalletShareSetType$1 = _dynamic_labs_sdk_api_core.WaasWalletShareSetType;
+
+//#endregion
+//#region src/modules/waas/businessAccounts/assertTargetIdentity.ts
+/**
+* Asserts a {@link TargetIdentity} resolves to a user: a `userId`, or an
+* `identifier` with its `identifierType`. Throws otherwise.
+*
+* @notInstrumented
+*/
+const assertTargetIdentity = ({ fnName, targetIdentity }) => {
+	const hasUserId = Boolean(targetIdentity.userId);
+	const hasIdentifier = Boolean(targetIdentity.identifier && targetIdentity.identifierType);
+	if (!hasUserId && !hasIdentifier) throw new require_logoutWithReason.InvalidParamError(`${fnName}: targetIdentity must provide a userId, or an identifier with its identifierType`);
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/businessAccounts.constants.ts
+/** Maps the SDK's identifier-type union to the generated API enum. */
+const IDENTIFIER_TYPE_TO_API = {
+	email: _dynamic_labs_sdk_api_core.UserIdentifierTypeEnum.Email,
+	externalUserId: _dynamic_labs_sdk_api_core.UserIdentifierTypeEnum.ExternalUserId,
+	id: _dynamic_labs_sdk_api_core.UserIdentifierTypeEnum.Id,
+	phoneNumber: _dynamic_labs_sdk_api_core.UserIdentifierTypeEnum.PhoneNumber,
+	socialAccountId: _dynamic_labs_sdk_api_core.UserIdentifierTypeEnum.SocialAccountId,
+	socialUsername: _dynamic_labs_sdk_api_core.UserIdentifierTypeEnum.SocialUsername
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/addBusinessAccountMember/addBusinessAccountMember.ts
+/**
+* Adds a member to an existing business account. Identify the target with a
+* `targetIdentity`: a known `userId`, or an `identifier` + `identifierType`
+* (e.g. an email — the user is created if absent).
+*
+* Calls the SDK API directly (not the WaaS iframe): this is a server-state
+* mutation with no MPC step, so a rejection (e.g. a 422 resource-limit) surfaces
+* as a thrown error rather than stalling in the iframe bridge.
+*
+* @param params.businessAccountId - The ID of the business account.
+* @param params.targetIdentity - The member to add (userId, or identifier + identifierType).
+* @param [params.role] - The member role (`admin` or `viewer`). Defaults to `viewer`.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The created business account member.
+* @notInstrumented
+*/
+const addBusinessAccountMember = async ({ businessAccountId, targetIdentity, role }, client = require_logoutWithReason.getDefaultClient()) => {
+	assertTargetIdentity({
+		fnName: "addBusinessAccountMember",
+		targetIdentity
+	});
+	const core = require_logoutWithReason.getCore(client);
+	const apiClient = require_logoutWithReason.createApiClient({ elevatedAccessTokenScope: _dynamic_labs_sdk_api_core.TokenScope.BusinessAccountmemberadd }, client);
+	const { userId, identifier, identifierType, socialProvider, smsCountryCode } = targetIdentity;
+	return await apiClient.sdkAddBusinessAccountMember({
+		addBusinessAccountMemberSdkRequest: {
+			identifier,
+			role: role === "admin" ? _dynamic_labs_sdk_api_core.AssignableBusinessAccountMemberRole.Admin : _dynamic_labs_sdk_api_core.AssignableBusinessAccountMemberRole.Viewer,
+			smsCountryCode,
+			socialProvider,
+			type: identifierType ? IDENTIFIER_TYPE_TO_API[identifierType] : void 0,
+			userId
+		},
+		businessAccountId,
+		environmentId: core.environmentId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/getWaasWalletProviderByChain/getWaasWalletProviderByChain.ts
+/** @notInstrumented */
+const getWaasWalletProviderByChain = ({ chain }, client) => {
+	const waasProvider = require_logoutWithReason.findWaasWalletProviderByChain({ chain }, client);
+	if (!waasProvider) throw new require_logoutWithReason.NoWalletProviderFoundError({ walletProviderKey: require_logoutWithReason.formatWalletProviderKey({
+		chain,
+		displayName: require_logoutWithReason.DYNAMIC_WAAS_METADATA.displayName,
+		walletProviderType: _dynamic_labs_sdk_api_core.WalletProviderEnum.EmbeddedWallet
+	}) });
+	return waasProvider;
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/addBusinessAccountSigner/addBusinessAccountSigner.ts
+/**
+* Adds a signer to a business-account wallet via the reshare ceremony, minting
+* the new signer's share set. Identify the target by `userId`, or `identifier`
+* + `identifierType` (the user is created if absent).
+*
+* Omit `businessAccountId` to add a signer to a wallet that isn't in a business
+* account yet: the wallet's per-account is found-or-created first (idempotent —
+* converts the personal wallet, seating its owner as the first signer), then
+* the new signer is reshared in.
+*
+* @param params.walletAccount - The wallet account to add the signer to.
+* @param [params.businessAccountId] - The business account; found-or-created when omitted.
+* @param [params.walletId] - The wallet UUID to link when finding-or-creating; defaults to `walletAccount.verifiedCredentialId`.
+* @param params.targetIdentity - The signer to add (userId, or identifier + identifierType).
+* @param [params.signerType] - `endUser` (default) or `server`.
+* @param [params.password] - Password for the current signer's share, if it is password-encrypted.
+* @param [params.targetSignerPassword] - Password used to encrypt the new signer's share. Required when wallet passwords are required by the environment.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The new signer's share set id.
+* @notInstrumented
+*/
+const addBusinessAccountSigner = async ({ walletAccount, businessAccountId, walletId, targetIdentity, signerType, password, targetSignerPassword }, client = require_logoutWithReason.getDefaultClient()) => {
+	assertTargetIdentity({
+		fnName: "addBusinessAccountSigner",
+		targetIdentity
+	});
+	if (walletAccount.businessAccountId) require_logoutWithReason.assertDefined(businessAccountId, "addBusinessAccountSigner: this wallet is already part of a business account");
+	let resolvedBusinessAccountId = businessAccountId;
+	if (!resolvedBusinessAccountId) {
+		const linkWalletId = walletId ?? walletAccount.verifiedCredentialId;
+		require_logoutWithReason.assertDefined(linkWalletId, "addBusinessAccountSigner: cannot resolve a wallet id to link — pass walletId, or use a verified wallet account");
+		const core = require_logoutWithReason.getCore(client);
+		resolvedBusinessAccountId = (await require_logoutWithReason.createApiClient({ elevatedAccessTokenScope: _dynamic_labs_sdk_api_core.TokenScope.BusinessAccountsigneradd }, client).sdkLinkBusinessAccountWallet({
+			environmentId: core.environmentId,
+			linkBusinessAccountWalletSdkRequest: { walletId: linkWalletId }
+		})).id;
+	}
+	const result = await getWaasWalletProviderByChain({ chain: walletAccount.chain }, client).reshareToNewSignerShareSet({
+		businessAccountId: resolvedBusinessAccountId,
+		password,
+		signerType,
+		targetSignerIdentity: targetIdentity,
+		targetSignerPassword,
+		walletAccount
+	});
+	await require_logoutWithReason.__refreshAuth_wrapped(client);
+	return result;
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/addWalletToBusinessAccount/addWalletToBusinessAccount.ts
+/**
+* Links a wallet to a business account, or omit `businessAccountId` to
+* find-or-create the per-wallet business account (the server seats the wallet's
+* owner as the first member/signer).
+*
+* Calls the SDK API directly (not the WaaS iframe): this is a server-state
+* mutation with no MPC step, so a rejection (e.g. a 422 resource-limit) surfaces
+* as a thrown error rather than stalling in the iframe bridge.
+*
+* @param [params.businessAccountId] - The business account to link to; found-or-created when omitted.
+* @param params.walletId - The ID of the wallet to link.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The updated business account detail.
+* @notInstrumented
+*/
+const addWalletToBusinessAccount = async ({ businessAccountId, walletId }, client = require_logoutWithReason.getDefaultClient()) => {
+	const core = require_logoutWithReason.getCore(client);
+	const detail = await require_logoutWithReason.createApiClient({ elevatedAccessTokenScope: _dynamic_labs_sdk_api_core.TokenScope.BusinessAccountlinkWallet }, client).sdkLinkBusinessAccountWallet({
+		environmentId: core.environmentId,
+		linkBusinessAccountWalletSdkRequest: {
+			businessAccountId,
+			walletId
+		}
+	});
+	await require_logoutWithReason.__refreshAuth_wrapped(client);
+	return detail;
+};
+
+//#endregion
+//#region src/modules/waas/backupWaasKeySharesToGoogleDrive/backupWaasKeySharesToGoogleDrive.ts
+/**
+* Backs up WaaS wallet key shares to Google Drive for secure recovery.
+*
+* This function creates a backup of the wallet's cryptographic key shares
+* to Google Drive, allowing users to recover their wallet later.
+*
+* @param params.walletAccount - The WaaS wallet account to backup.
+* @param [params.password] - Optional password to encrypt the backup.
+* @param [params.googleDriveAccessToken] - Optional consumer-supplied Drive-scoped access token; used directly instead of the stored OAuth token (avoids a second Google consent). Useful for external-auth setups.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the backup process is complete.
+* @notInstrumented
+*/
+const backupWaasKeySharesToGoogleDrive = async ({ googleDriveAccessToken, password, walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	return require_migrateFromFireblocks.getWaasWalletProviderFromWalletAccount({ walletAccount }, client).backupKeySharesToGoogleDrive({
+		googleDriveAccessToken,
+		password,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildAllowPolicyRule/buildAllowPolicyRule.ts
+/**
+* Builds a policy rule that permits the described action.
+*
+* @param rule - The rule fields (name, chain, and any targeting/limit fields).
+* @returns A `WaasPolicyRule` with `ruleType` set to `allow`.
+* @notInstrumented
+*/
+const buildAllowPolicyRule = (rule) => ({
+	...rule,
+	ruleType: _dynamic_labs_sdk_api_core.WaasPolicyRuleType.Allow
+});
+
+//#endregion
+//#region src/modules/waas/policies/buildDenyPolicyRule/buildDenyPolicyRule.ts
+/**
+* Builds a policy rule that blocks the described action.
+*
+* @param rule - The rule fields (name, chain, and any targeting/limit fields).
+* @returns A `WaasPolicyRule` with `ruleType` set to `deny`.
+* @notInstrumented
+*/
+const buildDenyPolicyRule = (rule) => ({
+	...rule,
+	ruleType: _dynamic_labs_sdk_api_core.WaasPolicyRuleType.Deny
+});
+
+//#endregion
+//#region src/modules/waas/businessAccounts/createBusinessAccount/createBusinessAccount.ts
+/**
+* Creates a new business account.
+*
+* @param [params] - Optional parameters for the business account.
+* @param [params.name] - Optional name for the business account.
+* @param [params.externalRef] - Optional developer-supplied label (not unique; accounts may share one).
+* @param [params.metadata] - Optional arbitrary key-value metadata.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The created business account.
+* @notInstrumented
+*/
+const createBusinessAccount = async (params, client = require_logoutWithReason.getDefaultClient()) => {
+	const core = require_logoutWithReason.getCore(client);
+	const result = await require_logoutWithReason.createApiClient({}, client).sdkCreateBusinessAccount({
+		createBusinessAccountSdkRequest: {
+			externalRef: params?.externalRef,
+			metadata: params?.metadata,
+			name: params?.name
+		},
+		environmentId: core.environmentId
+	});
+	await require_logoutWithReason.__refreshAuth_wrapped(client);
+	return result;
+};
+
+//#endregion
+//#region src/modules/waas/policies/applyPolicyLayerBatch/applyPolicyLayerBatch.ts
+/**
+* Applies a batch of rule operations to the policy layer a
+* {@link ResolvedPolicyScope} points at, atomically in one enclave cycle.
+* Shared by {@link createPolicy} and {@link removePolicyRules} so the
+* account-vs-wallet-vs-signer branch is written once.
+*
+* @notInstrumented
+*/
+const applyPolicyLayerBatch = ({ operations, resolvedScope }, client) => {
+	const { environmentId } = require_logoutWithReason.getCore(client);
+	const apiClient = require_logoutWithReason.createApiClient({}, client);
+	switch (resolvedScope.target) {
+		case "account": return apiClient.updateBusinessAccountPolicyLayer({
+			businessAccountId: resolvedScope.businessAccountId,
+			environmentId,
+			waasPolicyLayerUpdateRequest: {
+				op: _dynamic_labs_sdk_api_core.WaasPolicyLayerUpdateRequestOpEnum.Batch,
+				operations
+			}
+		});
+		case "wallet": return apiClient.updateWaasWalletSelfPolicyLayer({
+			environmentId,
+			waasPolicyLayerUpdateRequest: {
+				op: _dynamic_labs_sdk_api_core.WaasPolicyLayerUpdateRequestOpEnum.Batch,
+				operations
+			},
+			walletId: resolvedScope.walletId
+		});
+		case "signer": return apiClient.updateWaasSignerSelfPolicyLayer({
+			environmentId,
+			waasSignerPolicyLayerUpdateRequest: {
+				op: _dynamic_labs_sdk_api_core.WaasSignerPolicyLayerUpdateRequestOpEnum.Batch,
+				operations,
+				shareSetId: resolvedScope.shareSetId
+			},
+			walletId: resolvedScope.walletId
+		});
+		default: {
+			const unhandledScope = resolvedScope;
+			throw new require_logoutWithReason.InvalidParamError(`applyPolicyLayerBatch: unhandled target "${JSON.stringify(unhandledScope)}"`);
+		}
+	}
+};
+
+//#endregion
+//#region src/utils/objectKeys/objectKeys.ts
+/**
+* Typed `Object.keys` — returns `(keyof T)[]` instead of `string[]`, for
+* objects whose key set is fully known at the type level.
+*
+* @notInstrumented
+*/
+const objectKeys = (value) => Object.keys(value);
+
+//#endregion
+//#region src/modules/waas/policies/buildValueLimit/buildValueLimit.ts
+/**
+* Turns a {@link PolicyRuleMaxAmountPerTransaction} into the `valueLimit` shape a rule stores it as.
+* @notInstrumented
+*/
+const buildValueLimit = ({ amount, asset }) => ({
+	asset,
+	maxPerCall: amount
+});
+
+//#endregion
+//#region src/modules/waas/policies/policyRuleDefaultNames.ts
+/**
+* Each rule kind's name when the caller doesn't override it via
+* `PolicyRules['names']`. Shared between the `build*Rule` functions and
+* `desugarPolicyRules` so a rename can't drift the two out of sync — the
+* same reason `RULE_KINDS` in `policyRuleKinds.ts` is a single table
+* instead of parallel switches.
+*/
+const DEFAULT_POLICY_RULE_NAMES = {
+	allowAddresses: "Allowed addresses",
+	blockExport: "Block key export",
+	denyAddresses: "Denied addresses",
+	maxAmountPerTransaction: "Per-transaction cap"
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildAllowAddressesRule/buildAllowAddressesRule.ts
+/**
+* Builds the `allowAddresses` rule, absorbing a sibling
+* `maxAmountPerTransaction` onto the same rule instead of letting it emit
+* its own — see `buildMaxAmountPerTransactionRule`.
+* @notInstrumented
+*/
+const buildAllowAddressesRule = ({ context: { chain, chainIds }, rules }) => {
+	if (!rules.allowAddresses || rules.allowAddresses.length === 0) return void 0;
+	return {
+		addresses: rules.allowAddresses,
+		chain,
+		chainIds,
+		name: rules.names?.allowAddresses ?? DEFAULT_POLICY_RULE_NAMES.allowAddresses,
+		ruleType: _dynamic_labs_sdk_api_core.WaasPolicyRuleType.Allow,
+		...rules.maxAmountPerTransaction ? { valueLimit: buildValueLimit(rules.maxAmountPerTransaction) } : {}
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildBlockExportRule/buildBlockExportRule.ts
+/**
+* Builds the `blockExport` rule. `deny`, not `allow`: an addressless
+* allow-rule normalizes to an empty allowed-set, denying every transaction.
+* `chain`/`chainIds` are stamped for consistency but the enforcement of a
+* `blockExport` `operationRestrictions` rule is wallet-wide, ignoring them.
+* @notInstrumented
+*/
+const buildBlockExportRule = ({ context: { chain, chainIds }, rules }) => {
+	if (rules.blockExport !== true) return void 0;
+	return {
+		chain,
+		chainIds,
+		name: rules.names?.blockExport ?? DEFAULT_POLICY_RULE_NAMES.blockExport,
+		operationRestrictions: { blockExport: true },
+		ruleType: _dynamic_labs_sdk_api_core.WaasPolicyRuleType.Deny
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildDenyAddressesRule/buildDenyAddressesRule.ts
+/**
+* Builds the `denyAddresses` rule. Independent of `allowAddresses`.
+* @notInstrumented
+*/
+const buildDenyAddressesRule = ({ context: { chain, chainIds }, rules }) => {
+	if (!rules.denyAddresses || rules.denyAddresses.length === 0) return void 0;
+	return {
+		addresses: rules.denyAddresses,
+		chain,
+		chainIds,
+		name: rules.names?.denyAddresses ?? DEFAULT_POLICY_RULE_NAMES.denyAddresses,
+		ruleType: _dynamic_labs_sdk_api_core.WaasPolicyRuleType.Deny
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildMaxAmountPerTransactionRule/buildMaxAmountPerTransactionRule.ts
+/**
+* Builds the standalone `maxAmountPerTransaction` rule. Only fires when
+* `allowAddresses` didn't already absorb this cap onto its own rule. `deny`
+* for the same reason as `blockExport`'s builder.
+* @notInstrumented
+*/
+const buildMaxAmountPerTransactionRule = ({ context: { chain, chainIds }, rules }) => {
+	const isAbsorbedByAllowAddresses = Boolean(rules.allowAddresses?.length);
+	if (!rules.maxAmountPerTransaction || isAbsorbedByAllowAddresses) return void 0;
+	return {
+		chain,
+		chainIds,
+		name: rules.names?.maxAmountPerTransaction ?? DEFAULT_POLICY_RULE_NAMES.maxAmountPerTransaction,
+		ruleType: _dynamic_labs_sdk_api_core.WaasPolicyRuleType.Deny,
+		valueLimit: buildValueLimit(rules.maxAmountPerTransaction)
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/hasAddresses/hasAddresses.ts
+/**
+* Checks both the current `addresses` array and the legacy singular `address` field.
+* @notInstrumented
+*/
+const hasAddresses = (rule) => rule.addresses !== void 0 && rule.addresses.length > 0 || rule.address != null;
+
+//#endregion
+//#region src/modules/waas/policies/hasUnrecognizedFields/hasUnrecognizedFields.ts
+const RECOGNIZED_TOP_LEVEL_KEY_SET = new Set([
+	"ruleId",
+	"name",
+	"ruleType",
+	"addresses",
+	"chain",
+	"chainIds",
+	"valueLimit",
+	"operationRestrictions"
+]);
+/**
+* @notInstrumented
+*/
+const hasUnrecognizedFields = (rule) => Object.keys(rule).some((key) => !RECOGNIZED_TOP_LEVEL_KEY_SET.has(key) && rule[key] != null) || rule.valueLimit?.totalLimit != null || rule.operationRestrictions?.blockRevocation != null || rule.operationRestrictions?.blockClientSigning != null;
+
+//#endregion
+//#region src/modules/waas/policies/readValueLimit/readValueLimit.ts
+/**
+* Reads a stored `valueLimit` back into a {@link PolicyRuleMaxAmountPerTransaction}.
+* @notInstrumented
+*/
+const readValueLimit = ({ asset, maxPerCall }) => ({
+	amount: maxPerCall,
+	...asset ? { asset } : {}
+});
+
+//#endregion
+//#region src/modules/waas/policies/readAllowAddressesRule/readAllowAddressesRule.ts
+/**
+* Recognizes an existing rule as `allowAddresses`, reading back a merged
+* `maxAmountPerTransaction` cap too when the rule carries one.
+* @notInstrumented
+*/
+const readAllowAddressesRule = (rule) => {
+	if (!(rule.ruleType === _dynamic_labs_sdk_api_core.WaasPolicyRuleType.Allow && rule.operationRestrictions === void 0 && (rule.valueLimit === void 0 || rule.valueLimit.maxPerCall !== void 0) && hasAddresses(rule) && !hasUnrecognizedFields(rule))) return void 0;
+	return {
+		allowAddresses: rule.addresses,
+		...rule.valueLimit?.maxPerCall !== void 0 ? { maxAmountPerTransaction: readValueLimit({
+			asset: rule.valueLimit.asset,
+			maxPerCall: rule.valueLimit.maxPerCall
+		}) } : {}
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/readBlockExportRule/readBlockExportRule.ts
+/**
+* Recognizes an existing rule as `blockExport`.
+* @notInstrumented
+*/
+const readBlockExportRule = (rule) => {
+	if (!(rule.ruleType === _dynamic_labs_sdk_api_core.WaasPolicyRuleType.Deny && rule.operationRestrictions?.blockExport === true && rule.valueLimit === void 0 && !hasAddresses(rule) && !hasUnrecognizedFields(rule))) return void 0;
+	return { blockExport: true };
+};
+
+//#endregion
+//#region src/modules/waas/policies/readDenyAddressesRule/readDenyAddressesRule.ts
+/**
+* Recognizes an existing rule as `denyAddresses`.
+* @notInstrumented
+*/
+const readDenyAddressesRule = (rule) => {
+	if (!(rule.ruleType === _dynamic_labs_sdk_api_core.WaasPolicyRuleType.Deny && rule.operationRestrictions === void 0 && rule.valueLimit === void 0 && hasAddresses(rule) && !hasUnrecognizedFields(rule))) return void 0;
+	return { denyAddresses: rule.addresses };
+};
+
+//#endregion
+//#region src/modules/waas/policies/readMaxAmountPerTransactionRule/readMaxAmountPerTransactionRule.ts
+/**
+* Recognizes an existing rule as a standalone `maxAmountPerTransaction` cap.
+* @notInstrumented
+*/
+const readMaxAmountPerTransactionRule = (rule) => {
+	if (!(rule.ruleType === _dynamic_labs_sdk_api_core.WaasPolicyRuleType.Deny && rule.operationRestrictions === void 0 && rule.valueLimit?.maxPerCall !== void 0 && !hasAddresses(rule) && !hasUnrecognizedFields(rule))) return void 0;
+	return { maxAmountPerTransaction: readValueLimit({
+		asset: rule.valueLimit.asset,
+		maxPerCall: rule.valueLimit.maxPerCall
+	}) };
+};
+
+//#endregion
+//#region src/modules/waas/policies/policyRuleKinds.ts
+/** The four keys of {@link PolicyRules}, each of which produces its own rule. */
+const RULE_KIND_KEYS = [
+	"blockExport",
+	"allowAddresses",
+	"denyAddresses",
+	"maxAmountPerTransaction"
+];
+/**
+* The single source of truth {@link expandPolicyRules} and
+* {@link desugarPolicyRules} both build on. Entries are alphabetized
+* (enforced by lint), not grouped by relationship — `allowAddresses` and
+* `maxAmountPerTransaction` cooperate (see their builders' comments) despite
+* sitting apart here.
+*/
+const RULE_KINDS = {
+	allowAddresses: {
+		buildRule: buildAllowAddressesRule,
+		readRule: readAllowAddressesRule
+	},
+	blockExport: {
+		buildRule: buildBlockExportRule,
+		readRule: readBlockExportRule
+	},
+	denyAddresses: {
+		buildRule: buildDenyAddressesRule,
+		readRule: readDenyAddressesRule
+	},
+	maxAmountPerTransaction: {
+		buildRule: buildMaxAmountPerTransactionRule,
+		readRule: readMaxAmountPerTransactionRule
+	}
+};
+
+//#endregion
+//#region src/modules/waas/policies/readCoveredRule/readCoveredRule.ts
+/**
+* The sugar keys and values an existing rule structurally represents — a
+* single rule can cover more than one key (see `allowAddresses` absorbing
+* `maxAmountPerTransaction` in `policyRuleKinds.ts`). A rule carrying a
+* per-rule `modifiableBySigner` grant is never matched here — treating it
+* as covering keys would let a caller's batch reuse/replace/remove it and
+* silently revoke that signer's edit permission (mirrors `desugarPolicyRules`).
+*
+* @param rule - The existing policy-layer rule to read.
+* @returns The sugar keys and values the rule covers, or undefined when it matches no kind or carries a signer grant.
+* @notInstrumented
+*/
+const readCoveredRule = (rule) => {
+	if (rule.modifiableBySigner === true) return;
+	for (const kind of RULE_KIND_KEYS) {
+		const values = RULE_KINDS[kind].readRule(rule);
+		if (values === void 0) continue;
+		return {
+			keys: objectKeys(values),
+			kind,
+			values
+		};
+	}
+};
+
+//#endregion
+//#region src/modules/waas/policies/sortRulesByRuleId/sortRulesByRuleId.ts
+/**
+* Sorts rules by `ruleId` ascending (a rule missing one sorts first, as `''`)
+* — the deterministic order {@link matchExistingRules} picks its reuse
+* target from, so every caller agrees on which duplicate rule wins.
+*
+* @param rules - The rules to sort.
+* @returns A new array, sorted by `ruleId` ascending.
+* @notInstrumented
+*/
+const sortRulesByRuleId = (rules) => [...rules].sort((a, b) => {
+	const idA = a.ruleId ?? "";
+	const idB = b.ruleId ?? "";
+	if (idA < idB) return -1;
+	if (idA > idB) return 1;
+	return 0;
+});
+
+//#endregion
+//#region src/modules/waas/policies/matchExistingRules/matchExistingRules.ts
+const coveredRuleKeys = (rule) => readCoveredRule(rule)?.keys ?? [];
+/**
+* Matches existing rules covering any of `builtRule`'s keys. Only rules
+* being *absorbed* into it — i.e. no other match claims the same key — are
+* superseded (safe to remove). Two matches claiming the SAME key (e.g. two
+* hand-authored `denyAddresses` rules for this chain scope) are a
+* legitimate duplicate, not one superseding the other, so are left alone
+* rather than removed.
+*
+* @param params.builtRule - The newly built rule to match existing rules against.
+* @param params.consumedRuleIds - `ruleId`s already reused or removed for a prior built rule this call, so none is touched twice.
+* @param params.existingRulesInScope - The layer's rules already narrowed to the target chain scope.
+* @returns The rule to reuse `builtRule`'s upsert onto (if any), and every rule it supersedes.
+* @notInstrumented
+*/
+const matchExistingRules = ({ builtRule, consumedRuleIds, existingRulesInScope }) => {
+	const builtKeys = new Set(coveredRuleKeys(builtRule));
+	const matches = sortRulesByRuleId(existingRulesInScope).filter((existingRule) => existingRule.ruleId !== void 0 && !consumedRuleIds.has(existingRule.ruleId)).map((rule) => ({
+		keys: coveredRuleKeys(rule),
+		rule
+	})).filter(({ keys }) => keys.some((key) => builtKeys.has(key)));
+	const [reused, ...rest] = matches;
+	const superseded = rest.filter(({ keys, rule }) => {
+		const ruleKeys = new Set(keys);
+		return !matches.some((other) => other.rule.ruleId !== rule.ruleId && other.keys.some((key) => ruleKeys.has(key)));
+	}).map(({ rule }) => rule);
+	return {
+		reused: reused?.rule,
+		superseded
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/resolveRuleName/resolveRuleName.ts
+/**
+* Keeps the reused rule's label unless the caller overrides it or its
+* name-owning kind changed.
+*
+* @param params.builtRule - The newly built rule about to be upserted.
+* @param params.reused - The existing rule `builtRule` is upserted onto, if any.
+* @param params.rules - The caller's requested {@link PolicyRules} sugar map.
+* @returns The name to use for the upserted rule.
+* @notInstrumented
+*/
+const resolveRuleName = ({ builtRule, reused, rules }) => {
+	if (reused === void 0) return builtRule.name;
+	const builtKind = readCoveredRule(builtRule)?.kind;
+	const reusedKind = readCoveredRule(reused)?.kind;
+	const sameOwningKind = builtKind !== void 0 && builtKind === reusedKind;
+	const nameOverridden = builtKind !== void 0 && rules.names?.[builtKind] !== void 0;
+	return sameOwningKind && !nameOverridden ? reused.name : builtRule.name;
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildOperationsForRule/buildOperationsForRule.ts
+/**
+* Upserts `builtRule` onto the existing rule it reuses (if any), and
+* removes every rule that rule superseded. Mutates `consumedRuleIds` so a
+* later call for a different built rule never reuses or removes the same
+* existing rule twice.
+*
+* @param params.builtRule - The newly built rule to turn into batch operations.
+* @param params.consumedRuleIds - `ruleId`s already reused or removed for a prior built rule this call.
+* @param params.existingRulesInScope - The layer's rules already narrowed to the target chain scope.
+* @param params.rules - The caller's requested {@link PolicyRules} sugar map.
+* @returns The batch operations for this built rule — one upsert, plus a remove per superseded rule.
+* @notInstrumented
+*/
+const buildOperationsForRule = ({ builtRule, consumedRuleIds, existingRulesInScope, rules }) => {
+	const { reused, superseded } = matchExistingRules({
+		builtRule,
+		consumedRuleIds,
+		existingRulesInScope
+	});
+	const reusedRuleId = reused?.ruleId;
+	const operations = [{
+		op: _dynamic_labs_sdk_api_core.WaasPolicyLayerRuleOperationOpEnum.Upsert,
+		rule: reusedRuleId ? {
+			...builtRule,
+			name: resolveRuleName({
+				builtRule,
+				reused,
+				rules
+			}),
+			ruleId: reusedRuleId
+		} : builtRule
+	}];
+	if (reusedRuleId) consumedRuleIds.add(reusedRuleId);
+	for (const { ruleId } of superseded) {
+		consumedRuleIds.add(ruleId);
+		operations.push({
+			op: _dynamic_labs_sdk_api_core.WaasPolicyLayerRuleOperationOpEnum.Remove,
+			ruleId
+		});
+	}
+	return operations;
+};
+
+//#endregion
+//#region src/modules/waas/policies/expandPolicyRules/expandPolicyRules.ts
+/**
+* Expands the {@link PolicyRules} sugar map into `WaasPolicyRule[]` for one
+* chain scope. Omitting `chainIds` (or passing an empty array) builds a
+* wildcard rule matching every chain id of `chain`.
+*
+* @param params.rules - The sugar map describing the desired rules.
+* @param params.chain - The chain these rules apply to.
+* @param params.chainIds - The chain ids these rules apply to; omit for a wildcard rule that matches every chain id of `chain`.
+* @returns The expanded `WaasPolicyRule[]`, without `ruleId`.
+* @throws When expansion would produce an `allow` rule with a value limit and no addresses — that empties the allowed set and denies every transaction on the chain.
+* @notInstrumented
+*/
+const expandPolicyRules = ({ chain, chainIds, rules }) => {
+	const context = {
+		chain,
+		chainIds: chainIds ?? []
+	};
+	const expanded = RULE_KIND_KEYS.flatMap((key) => {
+		const rule = RULE_KINDS[key].buildRule({
+			context,
+			rules
+		});
+		return rule ? [rule] : [];
+	});
+	if (expanded.some((rule) => rule.ruleType === _dynamic_labs_sdk_api_core.WaasPolicyRuleType.Allow && rule.valueLimit !== void 0 && (rule.addresses === void 0 || rule.addresses.length === 0))) throw new require_logoutWithReason.InvalidParamError("expandPolicyRules: refusing to emit an allow rule with a value limit and no addresses — it would empty the allowed-address set and deny every transaction on this chain");
+	return expanded;
+};
+
+//#endregion
+//#region src/modules/waas/policies/fillOmittedRuleValues/fillOmittedRuleValues.ts
+/**
+* Whether the caller's value for a sugar key would actually produce a rule —
+* an empty `allowAddresses`/`denyAddresses` array builds no rule (see
+* `buildAllowAddressesRule`/`buildDenyAddressesRule`), so it must count the
+* same as omitted here. Otherwise a real value is present.
+*/
+const isRuleKeyRequested = (value) => Array.isArray(value) ? value.length > 0 : value !== void 0;
+/**
+* A key the caller omitted can be silently dropped if it's merged into the
+* same rule as a key they DID supply (e.g. re-saving only `allowAddresses`
+* when the existing rule also carries `maxAmountPerTransaction`) — carries
+* it forward so a partial re-save never erases a restriction the caller
+* didn't ask to remove.
+*
+* Rules are visited in the same lexicographically-smallest-`ruleId` order
+* `matchExistingRules` reuses, and only the first rule to cover a given key
+* fills it — so when duplicate rules cover the same omitted key, the value
+* always comes from the rule that will actually be upserted.
+*
+* @param params.existingRulesInScope - The layer's rules already narrowed to the target chain scope.
+* @param params.rules - The caller's requested {@link PolicyRules} sugar map.
+* @returns `rules`, with any key a partially-requested existing rule also covers filled in from that rule's current value.
+* @notInstrumented
+*/
+const fillOmittedRuleValues = ({ existingRulesInScope, rules }) => {
+	const mergedRules = { ...rules };
+	for (const existingRule of sortRulesByRuleId(existingRulesInScope)) {
+		const covered = readCoveredRule(existingRule);
+		const isPartiallyRequested = covered !== void 0 && covered.keys.some((key) => isRuleKeyRequested(rules[key])) && covered.keys.some((key) => !isRuleKeyRequested(rules[key]));
+		if (covered === void 0 || !isPartiallyRequested) continue;
+		for (const key of covered.keys) if (!isRuleKeyRequested(rules[key]) && mergedRules[key] === void 0) Object.assign(mergedRules, { [key]: covered.values[key] });
+	}
+	return mergedRules;
+};
+
+//#endregion
+//#region src/modules/waas/policies/getResolvedPolicyLayer/getResolvedPolicyLayer.ts
+/**
+* Fetches the policy layer a {@link ResolvedPolicyScope} points at. Shared
+* by {@link createPolicy}, {@link getPolicy}, and {@link removePolicyRules}
+* so the account/wallet/signer branch is written once.
+*
+* @notInstrumented
+*/
+const getResolvedPolicyLayer = ({ resolvedScope }, client) => {
+	const { environmentId } = require_logoutWithReason.getCore(client);
+	const apiClient = require_logoutWithReason.createApiClient({}, client);
+	switch (resolvedScope.target) {
+		case "account": return apiClient.getBusinessAccountPolicyLayer({
+			businessAccountId: resolvedScope.businessAccountId,
+			environmentId
+		});
+		case "wallet": return apiClient.getWaasWalletSelfPolicyLayer({
+			environmentId,
+			walletId: resolvedScope.walletId
+		});
+		case "signer": return apiClient.getWaasSignerSelfPolicyLayer({
+			environmentId,
+			shareSetId: resolvedScope.shareSetId,
+			walletId: resolvedScope.walletId
+		});
+		default: {
+			const unhandledScope = resolvedScope;
+			throw new require_logoutWithReason.InvalidParamError(`getResolvedPolicyLayer: unhandled target "${JSON.stringify(unhandledScope)}"`);
+		}
+	}
+};
+
+//#endregion
+//#region src/modules/waas/policies/resolvePolicyScope/resolvePolicyScope.ts
+/** Narrows a {@link WalletAccount} to {@link WaasWalletAccount} so WaaS-only fields (e.g. `shareSetId`) are accessible. */
+const isWaasWallet = (walletAccount) => require_logoutWithReason.isWaasWalletAccount({ walletAccount });
+/**
+* Resolves a {@link PolicyScope} to its concrete policy layer. When only a
+* `shareSetId` is given, the owning wallet is found locally by scanning the
+* client's own wallet accounts — no network request.
+*
+* @param params.scope - The scope to resolve.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The concrete target (`account`, `wallet`, or `signer`) plus the ids needed to call the SDK API.
+* @throws When a `shareSetId`-only scope doesn't match any of the client's wallet accounts.
+* @notInstrumented
+*/
+const resolvePolicyScope = ({ scope }, client = require_logoutWithReason.getDefaultClient()) => {
+	if ("businessAccountId" in scope) return {
+		businessAccountId: scope.businessAccountId,
+		target: "account"
+	};
+	if ("walletId" in scope) return scope.shareSetId === void 0 ? {
+		target: "wallet",
+		walletId: scope.walletId
+	} : {
+		shareSetId: scope.shareSetId,
+		target: "signer",
+		walletId: scope.walletId
+	};
+	const owningWalletAccount = require_logoutWithReason.getWalletAccounts(client).filter(isWaasWallet).find((walletAccount) => walletAccount.shareSetId === scope.shareSetId || walletAccount.otherShareSets?.some((shareSet) => shareSet.shareSetId === scope.shareSetId));
+	require_logoutWithReason.assertDefined(owningWalletAccount?.verifiedCredentialId, `resolvePolicyScope: could not resolve a wallet for shareSetId "${scope.shareSetId}" — no verified wallet account exposes this share set`);
+	return {
+		shareSetId: scope.shareSetId,
+		target: "signer",
+		walletId: owningWalletAccount.verifiedCredentialId
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/sameChainIds/sameChainIds.ts
+/**
+* Whether two chainIds arrays describe the same set, regardless of order.
+* Shared by {@link createPolicy} and {@link removePolicyRules} to keep their
+* existing-rule lookups consistent.
+*
+* @notInstrumented
+*/
+const sameChainIds = ({ existing = [], requested }) => {
+	if (existing.length !== requested.length) return false;
+	const sortedExisting = [...existing].sort((x, y) => x - y);
+	const sortedRequested = [...requested].sort((x, y) => x - y);
+	return sortedExisting.every((id, index) => id === sortedRequested[index]);
+};
+
+//#endregion
+//#region src/modules/waas/policies/createPolicy/createPolicy.ts
+/**
+* Creates or updates a wallet's, signer's, or business account's policy rules from the
+* {@link PolicyRules} sugar map, in one atomic `batch` PATCH. Each key in
+* `rules` maps to at most one underlying rule, so calling this twice with
+* the same map updates that rule in place instead of duplicating it.
+*
+* Known race: no ETag / optimistic-concurrency check — concurrent calls for
+* the same scope can both read-then-write and duplicate a rule.
+*
+* When more than one existing rule matches the same sugar key(s), only
+* rules being absorbed into the newly built rule (i.e. no other match
+* claims the same key) are removed. Two rules that duplicate the same key
+* (e.g. two hand-authored `denyAddresses` rules for this chain scope) are
+* left as-is rather than one being silently deleted — this call updates the
+* lexicographically-smallest-`ruleId` match in place and leaves the rest
+* untouched. A caller repeating this call will not converge on a single
+* rule; the duplicate has to be removed by hand.
+*
+* @param params.scope - Which policy layer to update — see {@link resolvePolicyScope}.
+* @param params.chain - The chain the rules apply to.
+* @param params.chainIds - The chain ids the rules apply to; omit for a wildcard rule that matches every chain id of `chain`.
+* @param params.rules - The desired rules, as a {@link PolicyRules} sugar map.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The policy layer as it stands after the batch is applied.
+* @throws When `rules` produces no recognized keys, or via {@link resolvePolicyScope}'s scope-resolution errors.
+* @notInstrumented
+*/
+const createPolicy = async ({ chain, chainIds, rules, scope }, client = require_logoutWithReason.getDefaultClient()) => {
+	const normalizedChainIds = chainIds ?? [];
+	const resolvedScope = resolvePolicyScope({ scope }, client);
+	const existingRulesInScope = ((await getResolvedPolicyLayer({ resolvedScope }, client)).layerContent.rules ?? []).filter((existingRule) => existingRule.chain === chain && sameChainIds({
+		existing: existingRule.chainIds,
+		requested: normalizedChainIds
+	}));
+	const expandedRules = expandPolicyRules({
+		chain,
+		chainIds: normalizedChainIds,
+		rules: fillOmittedRuleValues({
+			existingRulesInScope,
+			rules
+		})
+	});
+	if (expandedRules.length === 0) throw new require_logoutWithReason.InvalidParamError("createPolicy: rules must include at least one recognized policy key");
+	const consumedRuleIds = /* @__PURE__ */ new Set();
+	const operations = [];
+	for (const builtRule of expandedRules) operations.push(...buildOperationsForRule({
+		builtRule,
+		consumedRuleIds,
+		existingRulesInScope,
+		rules
+	}));
+	return applyPolicyLayerBatch({
+		operations,
+		resolvedScope
+	}, client);
+};
+
+//#endregion
+//#region src/modules/waas/createWaasOfflineRecoveryShares/createWaasOfflineRecoveryShares.ts
+/**
+* Mints an offline-recovery share set for a WaaS wallet account.
+*
+* This mints a second, independent 2-of-2 share set: the client's share is
+* uploaded to Google Drive, and the server's share is delivered to the
+* developer's webhook. Dynamic never retains its half, so recovery works even
+* if Dynamic is fully offline.
+*
+* @param params.walletAccount - The WaaS wallet account to create offline-recovery shares for.
+* @param [params.password] - Optional password to encrypt the client share.
+* @param [params.cloudProviderAccessToken] - Optional consumer-supplied Drive-scoped access token; used directly instead of the stored OAuth token (avoids a second Google consent). Useful for external-auth setups.
+* @param [params.mfaToken] - Optional MFA token proving step-up verification, when required for this action.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the offline-recovery share set has been minted.
+* @notInstrumented
+*/
+const createWaasOfflineRecoveryShares = async ({ cloudProviderAccessToken, mfaToken, password, walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	return require_migrateFromFireblocks.getWaasWalletProviderFromWalletAccount({ walletAccount }, client).createOfflineRecoveryShares({
+		cloudProviderAccessToken,
+		mfaToken,
+		password,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/waas/isWalletCreationRequirement/isWalletCreationRequirement.ts
+/**
+* Type guard to check if an item is a WalletCreationRequirement object.
+* Chain values are strings, so we can distinguish by checking if it's an object with a 'chain' property.
+*
+* @param item - The item to check, either a WalletCreationRequirement or Chain string
+* @returns True if the item is a WalletCreationRequirement object
+* @notInstrumented
+*/
+const isWalletCreationRequirement = (item) => typeof item === "object" && item !== null && "chain" in item;
+
+//#endregion
+//#region src/modules/waas/normalizeWalletRequirements/normalizeWalletRequirements.ts
+const DEFAULT_BITCOIN_ADDRESS_TYPE = "native_segwit";
+/**
+* Normalizes wallet creation input from either legacy Chain[] format
+* or new WalletCreationRequirement[] format to WalletCreationRequirement[].
+*
+* For BTC chains without explicit bitcoinConfig, defaults to native_segwit.
+*
+* @param params.input - Either an array of Chain strings or WalletCreationRequirement objects
+* @param params.defaultBitcoinConfig - Optional default bitcoin config to use for BTC chains when converting from legacy format
+* @returns Array of WalletCreationRequirement objects
+* @notInstrumented
+*/
+const normalizeWalletRequirements = ({ defaultBitcoinConfig, input }) => {
+	if (input.length === 0) return [];
+	const [firstItem] = input;
+	if (isWalletCreationRequirement(firstItem)) return input.map((requirement) => {
+		if (requirement.chain === "BTC" && !requirement.bitcoinConfig) return {
+			...requirement,
+			bitcoinConfig: { addressType: DEFAULT_BITCOIN_ADDRESS_TYPE }
+		};
+		return requirement;
+	});
+	return input.map((chain) => {
+		const requirement = { chain };
+		if (chain === "BTC") requirement.bitcoinConfig = defaultBitcoinConfig ?? { addressType: DEFAULT_BITCOIN_ADDRESS_TYPE };
+		return requirement;
+	});
+};
+
+//#endregion
+//#region src/modules/waas/createWaasWalletAccounts/createWaasWalletAccounts.ts
+/**
+* Creates wallet accounts for the specified chains.
+*
+* This function creates wallet accounts for the specified chains.
+* If the same chain is passed multiple times, just as many wallet accounts will be created
+* for that chain.
+*
+* @example
+* ```ts
+* // Legacy format - will create wallet accounts for EVM and SOL, BTC defaults to native_segwit
+* await createWaasWalletAccounts({ chains: ['EVM', 'SOL', 'BTC'] });
+*
+* // New format with chain-specific config
+* await createWaasWalletAccounts({
+*   chains: [
+*     { chain: 'BTC', bitcoinConfig: { addressType: 'taproot' } },
+*     { chain: 'EVM' },
+*   ]
+* });
+*
+* // Create both BTC address types
+* await createWaasWalletAccounts({
+*   chains: [
+*     { chain: 'BTC', bitcoinConfig: { addressType: 'native_segwit' } },
+*     { chain: 'BTC', bitcoinConfig: { addressType: 'taproot' } },
+*   ]
+* });
+* ```
+*
+* @param params.chains - The chains to create wallet accounts for.
+* @param params.password - The optional password to use for the wallet accounts.
+* @param params.thresholdSignatureScheme - The threshold signature scheme to use for the wallet accounts. (Default: TWO_OF_TWO)
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when all wallet accounts are created.
+* @notInstrumented
+*/
+const createWaasWalletAccounts = async ({ chains, password, thresholdSignatureScheme }, client = require_logoutWithReason.getDefaultClient()) => {
+	const normalizedRequirements = normalizeWalletRequirements({ input: chains });
+	const supportedChains = [
+		"ALEO",
+		"BTC",
+		"EVM",
+		"SOL",
+		"SUI",
+		"TON",
+		"TRON"
+	];
+	const filteredRequirements = normalizedRequirements.filter((requirement) => supportedChains.includes(requirement.chain));
+	if (filteredRequirements.length === 0) return;
+	const walletProviderMap = /* @__PURE__ */ new Map();
+	for (const requirement of filteredRequirements) {
+		const walletProviderKey = require_logoutWithReason.formatWalletProviderKey({
+			chain: requirement.chain,
+			displayName: require_logoutWithReason.DYNAMIC_WAAS_METADATA.displayName,
+			walletProviderType: _dynamic_labs_sdk_api_core.WalletProviderEnum.EmbeddedWallet
+		});
+		if (!walletProviderMap.has(walletProviderKey)) {
+			const walletProvider = require_getVerifiedCredentialForWalletAccount.getWalletProviderByKey({ walletProviderKey }, client);
+			if (!walletProvider) throw new require_logoutWithReason.NoWalletProviderFoundError({ walletProviderKey });
+			if (!require_logoutWithReason.isWaasWalletProvider(walletProvider)) throw new require_migrateFromFireblocks.NotWaasWalletProviderError({ walletProviderKey });
+			walletProviderMap.set(walletProviderKey, walletProvider);
+		}
+	}
+	await Promise.all(filteredRequirements.map((requirement) => {
+		const walletProviderKey = require_logoutWithReason.formatWalletProviderKey({
+			chain: requirement.chain,
+			displayName: require_logoutWithReason.DYNAMIC_WAAS_METADATA.displayName,
+			walletProviderType: _dynamic_labs_sdk_api_core.WalletProviderEnum.EmbeddedWallet
+		});
+		const walletProvider = walletProviderMap.get(walletProviderKey);
+		if (!walletProvider || !require_logoutWithReason.isWaasWalletProvider(walletProvider)) return Promise.resolve();
+		return walletProvider.createWalletAccount({
+			bitcoinConfig: requirement.bitcoinConfig,
+			password,
+			thresholdSignatureScheme
+		});
+	}));
+	await require_logoutWithReason.__refreshAuth_wrapped(client);
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/createWalletForBusinessAccount/createWalletForBusinessAccount.ts
+/**
+* Creates a WaaS wallet account owned directly by a business account, in one
+* step — the server seats the wallet's signer row against the business account
+* as it is minted, so no separate link call is needed.
+*
+* @example
+* ```ts
+* const wallet = await createWalletForBusinessAccount({
+*   businessAccountId: 'ba-1',
+*   chain: 'EVM',
+* });
+* ```
+*
+* @param params.businessAccountId - The business account that will own the wallet.
+* @param params.chain - The chain to create the wallet account for.
+* @param [params.password] - Optional password used to encrypt the user share.
+* @param [params.thresholdSignatureScheme] - The threshold signature scheme to use. (Default: TWO_OF_TWO)
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The created wallet account.
+* @notInstrumented
+*/
+const createWalletForBusinessAccount = async ({ businessAccountId, chain, password, thresholdSignatureScheme }, client = require_logoutWithReason.getDefaultClient()) => {
+	const wallet = await getWaasWalletProviderByChain({ chain }, client).createWalletAccount({
+		businessAccountId,
+		password,
+		thresholdSignatureScheme
+	});
+	await require_logoutWithReason.__refreshAuth_wrapped(client);
+	return wallet;
+};
+
+//#endregion
+//#region src/modules/waas/delegateWaasKeyShares/delegateWaasKeyShares.ts
+/**
+* Delegates cryptographic key shares for a WaaS wallet account.
+*
+* This function allows the delegation of key management responsibilities,
+* enabling distributed key management for enhanced security.
+*
+* @param params.walletAccount - The WaaS wallet account to delegate shares for.
+* @param [params.password] - Optional password for key share operations.
+* @param [params.initialSignerRules] - Optional policy rules used to seed the delegated signer's policy layer at delegation time.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the key delegation is complete.
+* @notInstrumented
+*/
+const delegateWaasKeyShares = async ({ initialSignerRules, password, walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	await require_migrateFromFireblocks.getWaasWalletProviderFromWalletAccount({ walletAccount }, client).delegateKeyShares({
+		initialSignerRules,
+		password,
+		walletAccount
+	});
+	await require_logoutWithReason.__refreshAuth_wrapped(client);
+};
+
+//#endregion
+//#region src/modules/waas/policies/findMatchedRuleKind/findMatchedRuleKind.ts
+const COUPLED_RULE_KINDS = new Set(["allowAddresses", "maxAmountPerTransaction"]);
+const isBlocked = ({ claimedKinds, populatedKeys }) => populatedKeys.some((key) => claimedKinds.has(key) || COUPLED_RULE_KINDS.has(key) && [...COUPLED_RULE_KINDS].some((coupledKey) => claimedKinds.has(coupledKey)));
+/**
+* Finds the first {@link RULE_KINDS} entry that recognizes `entry` as its
+* kind without colliding with an already-claimed key. Must check every key
+* `readRule` would populate, not just this kind's own key — allowAddresses'
+* `readRule` also populates `maxAmountPerTransaction` when the rule carries
+* a merged cap, so accepting it while that key is already claimed would
+* overwrite an earlier standalone cap.
+* @notInstrumented
+*/
+const findMatchedRuleKind = ({ claimedKinds, entry }) => {
+	for (const key of RULE_KIND_KEYS) {
+		const readResult = RULE_KINDS[key].readRule(entry);
+		if (readResult === void 0) continue;
+		if (!isBlocked({
+			claimedKinds,
+			populatedKeys: Object.keys(readResult)
+		})) return {
+			kind: key,
+			readResult
+		};
+	}
+};
+
+//#endregion
+//#region src/modules/waas/policies/isPolicyRuleDeletionMarker/isPolicyRuleDeletionMarker.ts
+/** The exact key set of a deletion marker — checked as a closed shape, not by presence alone. */
+const DELETION_MARKER_KEYS = new Set([
+	"ruleId",
+	"deletedByType",
+	"deletedById"
+]);
+/**
+* Recognizes a policy-Layer deletion marker — the enclave's stand-in for a
+* rule it couldn't drop outright, kept so the removal stays attributable.
+* Matches on the entry's exact key set, not field presence, since the read
+* response types every entry as a live rule.
+*
+* @param entry - The raw policy-Layer rule entry to check.
+* @returns Whether `entry` is a deletion marker rather than a live rule.
+* @notInstrumented
+*/
+const isPolicyRuleDeletionMarker = (entry) => {
+	const candidate = entry;
+	return typeof candidate.ruleId === "string" && typeof candidate.deletedByType === "string" && typeof candidate.deletedById === "string" && Object.keys(entry).every((key) => DELETION_MARKER_KEYS.has(key));
+};
+
+//#endregion
+//#region src/modules/waas/policies/desugarPolicyRules/desugarPolicyRules.ts
+/**
+* Reverses {@link expandPolicyRules} using {@link findMatchedRuleKind}'s
+* same rule-kind table, skipping deletion markers. A kind claims at most
+* one rule; extra matches, out-of-vocabulary fields, and per-rule
+* `modifiableBySigner` grants (no sugar representation) all go to
+* `unmapped` instead of being dropped.
+*
+* @param params.entries - The policy-Layer's rule entries, as returned in `layerContent.rules`.
+* @returns The recognized rules as a {@link PolicyRules} map, plus whatever wasn't recognized.
+* @notInstrumented
+*/
+const desugarPolicyRules = ({ entries }) => {
+	const rules = {};
+	const unmapped = [];
+	const claimedKinds = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		if (isPolicyRuleDeletionMarker(entry)) continue;
+		if (entry.modifiableBySigner === true) {
+			unmapped.push(entry);
+			continue;
+		}
+		const matched = findMatchedRuleKind({
+			claimedKinds,
+			entry
+		});
+		if (matched === void 0) {
+			unmapped.push(entry);
+			continue;
+		}
+		const { kind, readResult } = matched;
+		Object.assign(rules, readResult);
+		for (const key of Object.keys(readResult)) claimedKinds.add(key);
+		if (entry.name !== DEFAULT_POLICY_RULE_NAMES[kind]) rules.names = {
+			...rules.names,
+			[kind]: entry.name
+		};
+	}
+	return {
+		rules,
+		unmapped
+	};
+};
+
+//#endregion
+//#region src/modules/waas/exportWaasClientKeyshares/exportWaasClientKeyshares.ts
+/**
+* Exports the client-side key shares for a WaaS wallet account.
+*
+* This function retrieves the cryptographic key shares that are stored
+* on the client side for backup or migration purposes.
+*
+* @param params.walletAccount - The WaaS wallet account to export shares from.
+* @param [params.password] - Optional password to encrypt the exported shares.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves to the exported key shares.
+* @notInstrumented
+*/
+const exportWaasClientKeyshares = async ({ password, walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	return require_migrateFromFireblocks.getWaasWalletProviderFromWalletAccount({ walletAccount }, client).exportClientKeyshares({
+		password,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/waas/exportWaasPrivateKey/exportWaasPrivateKey.ts
+/**
+* Exports the private key for a WaaS wallet account with secure display.
+*
+* This function reveals the private key for a WaaS wallet and displays it
+* securely within an iframe dynamically inserted into the specified HTML container element.
+*
+* @param params.walletAccount - The WaaS wallet account to export the private key from.
+* @param params.displayContainer - The HTML element where the iframe will be injected.
+* @param [params.password] - Optional password to decrypt the private key.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the private key export is complete.
+* @notInstrumented
+*/
+const exportWaasPrivateKey = async ({ displayContainer, password, walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	return require_migrateFromFireblocks.getWaasWalletProviderFromWalletAccount({ walletAccount }, client).exportPrivateKey({
+		displayContainer,
+		password,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/waas/policies/getAccountPolicyLayer/getAccountPolicyLayer.ts
+/**
+* Fetches a business account's active policy rules (the account-Layer).
+* BA owner/admin only. Calls the SDK API directly (no MPC step), so a
+* rejection surfaces as a thrown error.
+*
+* @param params.businessAccountId - The business account to read policy rules for.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The account-Layer, including its current rules.
+* @notInstrumented
+*/
+const getAccountPolicyLayer = async ({ businessAccountId }, client = require_logoutWithReason.getDefaultClient()) => {
+	const core = require_logoutWithReason.getCore(client);
+	return require_logoutWithReason.createApiClient({}, client).getBusinessAccountPolicyLayer({
+		businessAccountId,
+		environmentId: core.environmentId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/getBusinessAccount/getBusinessAccount.ts
+/**
+* Retrieves a business account by ID, including its members, signers, and wallets.
+*
+* @param params.businessAccountId - The ID of the business account to retrieve.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The business account with its members, signers, and wallets.
+* @notInstrumented
+*/
+const getBusinessAccount = async ({ businessAccountId }, client = require_logoutWithReason.getDefaultClient()) => {
+	const core = require_logoutWithReason.getCore(client);
+	return await require_logoutWithReason.createApiClient({}, client).sdkGetBusinessAccountById({
+		businessAccountId,
+		environmentId: core.environmentId
+	});
+};
+
+//#endregion
+//#region src/modules/wallets/userHasEmbeddedWalletForChain/userHasEmbeddedWalletForChain.ts
+/** @notInstrumented */
+const userHasEmbeddedWalletForChain = ({ user, chain }) => {
+	return user.verifiedCredentials.some((vc) => vc.walletProvider === _dynamic_labs_sdk_api_core.WalletProviderEnum.EmbeddedWallet && vc.chain && require_logoutWithReason.getChainFromVerifiedCredentialChain(vc.chain) === chain);
+};
+
+//#endregion
+//#region src/modules/waas/getChainsMissingWaasWalletAccounts/getChainsMissingWaasWalletAccounts.ts
+/**
+* Gets all chains missing a waas wallet account for the current user.
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns An array of all chains that have waas wallet accounts enabled
+* but for which the current user does not yet have an embedded wallet account.
+* @notInstrumented
+*/
+const getChainsMissingWaasWalletAccounts = (client = require_logoutWithReason.getDefaultClient()) => {
+	const projectSettings = client.projectSettings;
+	require_logoutWithReason.assertDefined(projectSettings, "Project settings are not available");
+	const embeddedWalletSettings = projectSettings.sdk.embeddedWallets;
+	const isWaasEnabled = require_migrateFromFireblocks.isDynamicWaasEnabled(client);
+	const user = client.user;
+	if (!user || !isWaasEnabled) return [];
+	return (embeddedWalletSettings?.chainConfigurations?.filter((chain) => chain.enabled) ?? []).map((chain) => chain.name).filter((chain) => !userHasEmbeddedWalletForChain({
+		chain,
+		user
+	}));
+};
+
+//#endregion
+//#region src/modules/waas/policies/getPolicy/getPolicy.ts
+/**
+* Fetches a policy layer and reads its `chain`/`chainIds` scope back into
+* the {@link PolicyRules} sugar map (see {@link desugarPolicyRules}). A
+* layer can hold rules for more than one chain, so entries are narrowed to
+* `chain`/`chainIds` first — the same scoping {@link createPolicy} uses —
+* to keep the `getPolicy` → edit → `createPolicy` round-trip safe for
+* multi-chain wallets. Calls the SDK API directly (no MPC step), so a
+* rejection surfaces as a thrown error.
+*
+* @param params.scope - Which policy layer to read — see {@link resolvePolicyScope}.
+* @param params.chain - The chain to read rules for.
+* @param params.chainIds - The chain ids to read rules for; omit to read the wildcard rule matching every chain id of `chain`.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The recognized rules as a {@link PolicyRules} map, whatever wasn't recognized within `chain`/`chainIds`, and the layer's id and last-updated timestamp.
+* @throws Via {@link resolvePolicyScope}'s scope-resolution errors.
+* @notInstrumented
+*/
+const getPolicy = async ({ chain, chainIds, scope }, client = require_logoutWithReason.getDefaultClient()) => {
+	const normalizedChainIds = chainIds ?? [];
+	const layer = await getResolvedPolicyLayer({ resolvedScope: resolvePolicyScope({ scope }, client) }, client);
+	const { rules, unmapped } = desugarPolicyRules({ entries: (layer.layerContent.rules ?? []).filter((entry) => entry.chain === chain && sameChainIds({
+		existing: entry.chainIds,
+		requested: normalizedChainIds
+	})) });
+	return {
+		layerId: layer.layerId,
+		rules,
+		unmapped,
+		updatedAt: layer.updatedAt
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/getSignerPolicyLayer/getSignerPolicyLayer.ts
+/**
+* Fetches a signer's active policy rules (the signer-Layer) — the caller's
+* own active share set by default, or another share set on the same wallet
+* (e.g. a delegated share set) when `shareSetId` is given. Calls the SDK API
+* directly (no MPC step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account whose signer-Layer to read.
+* @param [params.shareSetId] - The share set to target; defaults to the caller's own.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The signer-Layer, including its current rules.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const getSignerPolicyLayer = async ({ shareSetId, walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	require_logoutWithReason.assertDefined(walletAccount.verifiedCredentialId, "getSignerPolicyLayer: cannot resolve a wallet id — use a verified wallet account");
+	const core = require_logoutWithReason.getCore(client);
+	return require_logoutWithReason.createApiClient({}, client).getWaasSignerSelfPolicyLayer({
+		environmentId: core.environmentId,
+		shareSetId,
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/getWalletAccountShareSets/getWalletAccountShareSets.ts
+/**
+* No network request. Share set ids rotate on refresh/reshare (stale ids are
+* rejected server-side), so re-read rather than cache; non-WaaS accounts
+* return `{ own: undefined, others: [] }` instead of throwing.
+*
+* @param params.walletAccount - The WaaS wallet account whose share sets to read.
+* @returns The account's own share set (if any) and the wallet's other active share sets.
+* @notInstrumented
+*/
+const getWalletAccountShareSets = ({ walletAccount }) => {
+	const own = walletAccount.shareSetId ? {
+		shareSetId: walletAccount.shareSetId,
+		shareSetType: walletAccount.shareSetType
+	} : void 0;
+	return {
+		others: walletAccount.otherShareSets ?? [],
+		own
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/getWalletPolicyLayer/getWalletPolicyLayer.ts
+/**
+* Fetches a wallet's active policy rules (the wallet-Layer). Calls the SDK
+* API directly (no MPC step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account to read policy rules for.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The wallet-Layer, including its current rules.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const getWalletPolicyLayer = async ({ walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	require_logoutWithReason.assertDefined(walletAccount.verifiedCredentialId, "getWalletPolicyLayer: cannot resolve a wallet id — use a verified wallet account");
+	const core = require_logoutWithReason.getCore(client);
+	return require_logoutWithReason.createApiClient({}, client).getWaasWalletSelfPolicyLayer({
+		environmentId: core.environmentId,
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/getWalletRecoveryState/getWalletRecoveryState.ts
+/**
+* Retrieves the recovery state of a WaaS wallet account.
+*
+* @param params.walletAccount - The WaaS wallet account to get the recovery state for.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves with the wallet recovery state.
+* @notInstrumented
+*/
+const getWalletRecoveryState = async ({ walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	return require_migrateFromFireblocks.getWaasWalletProviderFromWalletAccount({ walletAccount }, client).getWalletRecoveryState({ walletAccount });
+};
+
+//#endregion
+//#region src/modules/waas/hasDelegatedAccess/hasDelegatedAccess.ts
+/**
+* Checks if a WaaS wallet account has delegated access.
+*
+* @param params.walletAccount - The WaaS wallet account to check for delegated access.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns True if the wallet account has delegated access, false otherwise.
+* @notInstrumented
+*/
+const hasDelegatedAccess = ({ walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	const verifiedCredential = require_getVerifiedCredentialForWalletAccount.getVerifiedCredentialForWalletAccount({ walletAccount }, client);
+	require_logoutWithReason.assertDefined(verifiedCredential, "Verified credential not found for Waas wallet account");
+	const hasDelegatedKeyShare = verifiedCredential.walletProperties?.keyShares?.some((keyShare) => keyShare.backupLocation === "delegated");
+	const hasDelegatedShareSet = verifiedCredential.walletProperties?.otherShareSets?.some((shareSet) => shareSet.shareSetType === _dynamic_labs_sdk_api_core.WaasWalletShareSetType.Delegated);
+	return Boolean(hasDelegatedKeyShare || hasDelegatedShareSet);
+};
+
+//#endregion
+//#region src/modules/waas/importWaasPrivateKey/importWaasPrivateKey.ts
+/**
+* Imports an existing private key to create a new WaaS wallet account.
+*
+* This function allows users to import their existing private key into
+* Dynamic's WaaS infrastructure for secure management.
+*
+* @param params.chain - The chain for the imported wallet.
+* @param params.privateKey - The private key to import.
+* @param [params.thresholdSignatureScheme] - Optional threshold signature scheme configuration. Default is TWO_OF_TWO.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the private key is successfully imported.
+* @notInstrumented
+*/
+const importWaasPrivateKey = async ({ chain, privateKey, thresholdSignatureScheme }, client = require_logoutWithReason.getDefaultClient()) => {
+	return getWaasWalletProviderByChain({ chain }, client).importPrivateKey({
+		privateKey,
+		thresholdSignatureScheme
+	});
+};
+
+//#endregion
+//#region src/modules/waas/isPasswordRequiredForWaasWallets/isPasswordRequiredForWaasWallets.ts
+/**
+* Checks if the user Waas wallets are password protected.
+*
+* If the user's Waas wallets are password protected, it means that user's will have to be prompted for a
+* password for the first wallet action that happens on each session.
+* The password is also required for creating any new Waas wallets.
+*
+* @param client - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns True if the user has any password protected Waas wallets, false otherwise
+* @notInstrumented
+*/
+const isPasswordRequiredForWaasWallets = (client = require_logoutWithReason.getDefaultClient()) => {
+	const { user } = client;
+	require_logoutWithReason.assertDefined(user, "User is not authenticated");
+	return user.verifiedCredentials.some((credential) => credential.walletProperties?.keyShares?.some((keyShare) => keyShare.passwordEncrypted));
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/listBusinessAccounts/listBusinessAccounts.ts
+/**
+* Lists the business accounts the current user is a member of, scoped to the
+* active project environment. Optionally filter by `externalRefs`.
+*
+* @param [params] - Optional filters.
+* @param [params.externalRefs] - Return only accounts whose externalRef is in this list.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A paginated list of business accounts.
+* @notInstrumented
+*/
+const listBusinessAccounts = async (params, client = require_logoutWithReason.getDefaultClient()) => {
+	const core = require_logoutWithReason.getCore(client);
+	return await require_logoutWithReason.createApiClient({}, client).sdkListBusinessAccounts({
+		environmentId: core.environmentId,
+		externalRef: params?.externalRefs
+	});
+};
+
+//#endregion
+//#region src/modules/waas/refreshWaasWalletAccountShares/refreshWaasWalletAccountShares.ts
+/**
+* Refreshes the cryptographic key shares for a WaaS wallet account.
+*
+* This function generates new key shares for the wallet while maintaining
+* the same threshold signature scheme.
+*
+* @param params.walletAccount - The WaaS wallet account to refresh shares for.
+* @param [params.password] - Optional password for key share operations.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the key shares are refreshed.
+* @notInstrumented
+*/
+const refreshWaasWalletAccountShares = async ({ walletAccount, password }, client = require_logoutWithReason.getDefaultClient()) => {
+	return require_migrateFromFireblocks.getWaasWalletProviderFromWalletAccount({ walletAccount }, client).refreshWalletAccountShares({
+		password,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/waas/policies/removeAccountPolicyRule/removeAccountPolicyRule.ts
+/**
+* Removes a single rule from a business account's account-Layer. BA
+* owner/admin only. Calls the SDK API directly (no MPC step), so a
+* rejection surfaces as a thrown error.
+*
+* @param params.businessAccountId - The business account to remove the rule from.
+* @param params.ruleId - The id of the rule to remove.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The account-Layer as it stands after the rule is removed.
+* @notInstrumented
+*/
+const removeAccountPolicyRule = async ({ businessAccountId, ruleId }, client = require_logoutWithReason.getDefaultClient()) => {
+	const core = require_logoutWithReason.getCore(client);
+	return require_logoutWithReason.createApiClient({}, client).updateBusinessAccountPolicyLayer({
+		businessAccountId,
+		environmentId: core.environmentId,
+		waasPolicyLayerUpdateRequest: {
+			op: _dynamic_labs_sdk_api_core.WaasPolicyLayerUpdateRequestOpEnum.Remove,
+			ruleId
+		}
+	});
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/removeBusinessAccountMember/removeBusinessAccountMember.ts
+/**
+* Removes a member from a business account. Any signer rows the member held on
+* the account's wallets are torn down as part of the removal. The backend
+* refuses to remove the account's last owner.
+*
+* @param params.businessAccountId - The business account to remove the member from.
+* @param params.userId - The id of the user to remove.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The removed member.
+*
+* @example
+* ```ts
+* const detail = await getBusinessAccount({ businessAccountId });
+* const member = detail.members[0];
+* await removeBusinessAccountMember({
+*   businessAccountId,
+*   userId: member.userId,
+* });
+* ```
+*
+* @see addBusinessAccountMember
+* @see getBusinessAccount
+* @notInstrumented
+*/
+const removeBusinessAccountMember = async ({ businessAccountId, userId }, client = require_logoutWithReason.getDefaultClient()) => {
+	const core = require_logoutWithReason.getCore(client);
+	const { member } = await require_logoutWithReason.createApiClient({ elevatedAccessTokenScope: _dynamic_labs_sdk_api_core.TokenScope.BusinessAccountmemberremove }, client).sdkRemoveBusinessAccountMember({
+		businessAccountId,
+		environmentId: core.environmentId,
+		userId
+	});
+	return member;
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/removeBusinessAccountSigner/removeBusinessAccountSigner.ts
+/**
+* Removes a signer from a business-account wallet. This detaches the signer's
+* share set from the wallet — it does not run an MPC ceremony — so the removed
+* identity can no longer sign for that wallet. The backend refuses to remove
+* the last remaining signer on a wallet.
+*
+* @param params.businessAccountId - The business account the wallet belongs to.
+* @param params.walletId - The wallet the signer is attached to.
+* @param params.signerId - The id of the signer to remove (`BusinessAccountSigner.id`).
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The removed signer.
+*
+* @example
+* ```ts
+* const detail = await getBusinessAccount({ businessAccountId });
+* const signer = detail.signers[0];
+* await removeBusinessAccountSigner({
+*   businessAccountId,
+*   walletId: signer.walletId,
+*   signerId: signer.id,
+* });
+* ```
+*
+* @see addBusinessAccountSigner
+* @see getBusinessAccount
+* @notInstrumented
+*/
+const removeBusinessAccountSigner = async ({ businessAccountId, walletId, signerId }, client = require_logoutWithReason.getDefaultClient()) => {
+	const core = require_logoutWithReason.getCore(client);
+	const { signer } = await require_logoutWithReason.createApiClient({ elevatedAccessTokenScope: _dynamic_labs_sdk_api_core.TokenScope.BusinessAccountsignerremove }, client).sdkRemoveBusinessAccountSigner({
+		businessAccountId,
+		environmentId: core.environmentId,
+		signerId,
+		walletId
+	});
+	return signer;
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/removeBusinessAccountWallet/removeBusinessAccountWallet.ts
+/**
+* Removes a wallet from a business account (owner-/admin-only). The wallet and
+* all its associated signer rows are detached from the account. The backend
+* refuses to remove the last wallet on a business account.
+*
+* @param params.businessAccountId - The business account the wallet belongs to.
+* @param params.walletId - The wallet to remove (`BusinessAccountWallet.id`).
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The updated business account detail.
+*
+* @example
+* ```ts
+* const detail = await getBusinessAccount({ businessAccountId });
+* await removeBusinessAccountWallet({
+*   businessAccountId,
+*   walletId: detail.wallets[0].id,
+* });
+* ```
+*
+* @see addWalletToBusinessAccount
+* @see getBusinessAccount
+* @notInstrumented
+*/
+const removeBusinessAccountWallet = async ({ businessAccountId, walletId }, client = require_logoutWithReason.getDefaultClient()) => {
+	const core = require_logoutWithReason.getCore(client);
+	const detail = await require_logoutWithReason.createApiClient({ elevatedAccessTokenScope: _dynamic_labs_sdk_api_core.TokenScope.BusinessAccountwalletremove }, client).sdkRemoveBusinessAccountWallet({
+		businessAccountId,
+		environmentId: core.environmentId,
+		walletId
+	});
+	await require_logoutWithReason.__refreshAuth_wrapped(client);
+	return detail;
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildOperationForExistingRule/buildOperationForExistingRule.ts
+/**
+* Builds the operation to remove or rebuild `existingRule` when the
+* caller's requested keys touch it — outright removal when every key it
+* covers is being removed, or an upsert of the rule rebuilt from its
+* remaining keys when only some are. Returns undefined when none of the
+* requested keys touch this rule, when it's outside the sugar vocabulary,
+* or when it can't be identified without a `ruleId`.
+*
+* @param params.chain - The chain the rule to remove/rebuild applies to.
+* @param params.chainIds - The chain ids the rule to remove/rebuild applies to.
+* @param params.existingRule - The existing layer rule to check.
+* @param params.rules - The sugar keys to remove.
+* @returns The operation for this rule, or undefined when it isn't touched.
+* @notInstrumented
+*/
+const buildOperationForExistingRule = ({ chain, chainIds, existingRule, rules }) => {
+	if (existingRule.ruleId === void 0) return;
+	const covered = readCoveredRule(existingRule);
+	if (covered === void 0) return;
+	const remainingKeys = covered.keys.filter((key) => !rules.includes(key));
+	if (remainingKeys.length === covered.keys.length) return;
+	if (remainingKeys.length === 0) return {
+		op: _dynamic_labs_sdk_api_core.WaasPolicyLayerRuleOperationOpEnum.Remove,
+		ruleId: existingRule.ruleId
+	};
+	const remainingRules = {};
+	for (const key of remainingKeys) Object.assign(remainingRules, { [key]: covered.values[key] });
+	const [rebuiltRule] = expandPolicyRules({
+		chain,
+		chainIds,
+		rules: remainingRules
+	});
+	if (rebuiltRule === void 0) return;
+	const keepsName = readCoveredRule(rebuiltRule)?.kind === covered.kind;
+	return {
+		op: _dynamic_labs_sdk_api_core.WaasPolicyLayerRuleOperationOpEnum.Upsert,
+		rule: {
+			...rebuiltRule,
+			name: keepsName ? existingRule.name ?? rebuiltRule.name : rebuiltRule.name,
+			ruleId: existingRule.ruleId
+		}
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/removePolicyRules/removePolicyRules.ts
+/**
+* Removes the rules behind one or more {@link PolicyRules} keys from a
+* policy layer, in one atomic `batch` PATCH. For every existing rule the
+* given keys touch, either removes it outright or — when it also covers a
+* key the caller didn't ask to remove (e.g. an
+* `allowAddresses`+`maxAmountPerTransaction` rule with only the cap
+* removed) — rebuilds it from the remaining keys so that restriction
+* survives.
+*
+* @param params.scope - Which policy layer to update — see {@link resolvePolicyScope}.
+* @param params.chain - The chain the rules to remove apply to.
+* @param params.chainIds - The chain ids the rules to remove apply to; omit to target the wildcard rule that matches every chain id of `chain`.
+* @param params.rules - The sugar keys to remove.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The policy layer as it stands after the batch is applied.
+* @throws When none of the given keys match an existing rule for this chain scope, or via {@link resolvePolicyScope}'s scope-resolution errors.
+* @notInstrumented
+*/
+const removePolicyRules = async ({ chain, chainIds, rules, scope }, client = require_logoutWithReason.getDefaultClient()) => {
+	const normalizedChainIds = chainIds ?? [];
+	const resolvedScope = resolvePolicyScope({ scope }, client);
+	const operations = ((await getResolvedPolicyLayer({ resolvedScope }, client)).layerContent.rules ?? []).filter((existingRule) => existingRule.chain === chain && sameChainIds({
+		existing: existingRule.chainIds,
+		requested: normalizedChainIds
+	})).map((existingRule) => buildOperationForExistingRule({
+		chain,
+		chainIds: normalizedChainIds,
+		existingRule,
+		rules
+	})).filter((operation) => operation !== void 0);
+	if (operations.length === 0) throw new require_logoutWithReason.InvalidParamError("removePolicyRules: none of the given rule keys matched an existing rule for this scope");
+	return applyPolicyLayerBatch({
+		operations,
+		resolvedScope
+	}, client);
+};
+
+//#endregion
+//#region src/modules/waas/policies/removeSignerPolicyRule/removeSignerPolicyRule.ts
+/**
+* Removes a single rule from a signer's policy layer. Calls the SDK API
+* directly (no MPC step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account whose signer-Layer to update.
+* @param params.ruleId - The id of the rule to remove.
+* @param [params.shareSetId] - The share set to target; defaults to the caller's own. Only the wallet's own owner may target another share set.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The signer-Layer as it stands after the rule is removed.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const removeSignerPolicyRule = async ({ ruleId, shareSetId, walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	require_logoutWithReason.assertDefined(walletAccount.verifiedCredentialId, "removeSignerPolicyRule: cannot resolve a wallet id — use a verified wallet account");
+	const core = require_logoutWithReason.getCore(client);
+	return require_logoutWithReason.createApiClient({}, client).updateWaasSignerSelfPolicyLayer({
+		environmentId: core.environmentId,
+		waasSignerPolicyLayerUpdateRequest: {
+			op: _dynamic_labs_sdk_api_core.WaasSignerPolicyLayerUpdateRequestOpEnum.Remove,
+			ruleId,
+			shareSetId
+		},
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/policies/removeWalletPolicyRule/removeWalletPolicyRule.ts
+/**
+* Removes a single rule from a wallet's policy layer. Calls the SDK API
+* directly (no MPC step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account to remove the rule from.
+* @param params.ruleId - The id of the rule to remove.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The wallet-Layer as it stands after the rule is removed.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const removeWalletPolicyRule = async ({ ruleId, walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	require_logoutWithReason.assertDefined(walletAccount.verifiedCredentialId, "removeWalletPolicyRule: cannot resolve a wallet id — use a verified wallet account");
+	const core = require_logoutWithReason.getCore(client);
+	return require_logoutWithReason.createApiClient({}, client).updateWaasWalletSelfPolicyLayer({
+		environmentId: core.environmentId,
+		waasPolicyLayerUpdateRequest: {
+			op: _dynamic_labs_sdk_api_core.WaasPolicyLayerUpdateRequestOpEnum.Remove,
+			ruleId
+		},
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/revokeWaasDelegation/revokeWaasDelegation.ts
+/**
+* Revokes the delegation of a WaaS wallet account.
+*
+* @param params.walletAccount - The WaaS wallet account to revoke delegation for.
+* @param [params.password] - Optional password for delegation operations.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the delegation is revoked.
+* @notInstrumented
+*/
+const revokeWaasDelegation = async ({ password, walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	await require_migrateFromFireblocks.getWaasWalletProviderFromWalletAccount({ walletAccount }, client).revokeDelegation({
+		password,
+		walletAccount
+	});
+	await require_logoutWithReason.__refreshAuth_wrapped(client);
+};
+
+//#endregion
+//#region src/modules/waas/setWaasWalletAccountPassword/setWaasWalletAccountPassword.ts
+/**
+* Sets a password for a WaaS wallet account.
+*
+* @param params.walletAccount - The WaaS wallet account to set the password for.
+* @param params.password - The password to set for the wallet.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the password is successfully set.
+* @notInstrumented
+*/
+const setWaasWalletAccountPassword = async ({ password, walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	return require_migrateFromFireblocks.getWaasWalletProviderFromWalletAccount({ walletAccount }, client).setWaasWalletAccountPassword({
+		password,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/wallets/userHasExternalWallet/userHasExternalWallet.ts
+/** @notInstrumented */
+const userHasExternalWallet = (user) => {
+	return user?.verifiedCredentials.some((vc) => vc.format === _dynamic_labs_sdk_api_core.JwtVerifiedCredentialFormatEnum.Blockchain && vc.walletProvider !== _dynamic_labs_sdk_api_core.WalletProviderEnum.EmbeddedWallet);
+};
+
+//#endregion
+//#region src/modules/waas/shouldAutoCreateWalletForChain/shouldAutoCreateWalletForChain.ts
+/**
+* Checks if a WaaS wallet should be automatically created for the specified blockchain.
+*
+* This function determines whether the current user configuration and project
+* settings require automatic wallet creation for the given chain, considering
+* whether the user already has an embedded wallet for the enabled chains or an external wallet.
+*
+* @param params.chain - The blockchain network to check.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns True if a wallet should be auto-created for the chain, false otherwise.
+* @notInstrumented
+*/
+const shouldAutoCreateWalletForChain = ({ chain }, client = require_logoutWithReason.getDefaultClient()) => {
+	require_logoutWithReason.assertDefined(client.projectSettings, "Project settings are not available");
+	const embeddedWalletSettings = client.projectSettings.sdk.embeddedWallets;
+	if (!embeddedWalletSettings?.automaticEmbeddedWalletCreation || !client.user) return false;
+	const automaticEmbeddedWalletCreationForExternalEnabled = embeddedWalletSettings?.automaticEmbeddedWalletCreationForExternal;
+	if (!(!userHasExternalWallet(client.user) || automaticEmbeddedWalletCreationForExternalEnabled)) return false;
+	return getChainsMissingWaasWalletAccounts(client).includes(chain);
+};
+
+//#endregion
+//#region src/modules/waas/signSerializedTransaction/signSerializedTransaction.ts
+/**
+* No gas estimation, balance check, or broadcast — unlike `transferAmount`.
+* Useful for exercising WaaS policy enforcement in isolation.
+*
+* @param params.walletAccount - The wallet account to sign with.
+* @param params.serializedTransaction - The raw serialized transaction (e.g. viem's `serializeTransaction`).
+* @param [params.chainId] - The chain id, if required by the target chain's signer.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The raw signature.
+* @notInstrumented
+*/
+const signSerializedTransaction = async ({ chainId, serializedTransaction, walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	return require_migrateFromFireblocks.getWaasWalletProviderFromWalletAccount({ walletAccount }, client).signSerializedTransaction({
+		chainId,
+		serializedTransaction,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/transferBusinessAccountOwnership/transferBusinessAccountOwnership.ts
+/**
+* Transfers ownership of a business account to another member. Owner-only: the
+* `newOwnerUserId` must already be a member, is promoted to owner, and the
+* current owner is atomically demoted to admin.
+*
+* @param params.businessAccountId - The business account whose ownership moves.
+* @param params.newOwnerUserId - The member to promote to owner.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The updated business account detail.
+*
+* @example
+* ```ts
+* const detail = await getBusinessAccount({ businessAccountId });
+* const target = detail.members.find((m) => m.role === 'admin');
+* await transferBusinessAccountOwnership({
+*   businessAccountId,
+*   newOwnerUserId: target.userId,
+* });
+* ```
+*
+* @see getBusinessAccount
+* @notInstrumented
+*/
+const transferBusinessAccountOwnership = async ({ businessAccountId, newOwnerUserId }, client = require_logoutWithReason.getDefaultClient()) => {
+	const core = require_logoutWithReason.getCore(client);
+	const detail = await require_logoutWithReason.createApiClient({ elevatedAccessTokenScope: _dynamic_labs_sdk_api_core.TokenScope.BusinessAccounttransferOwnership }, client).sdkTransferBusinessAccountOwnership({
+		businessAccountId,
+		environmentId: core.environmentId,
+		transferBusinessAccountOwnershipSdkRequest: { newOwnerUserId }
+	});
+	await require_logoutWithReason.__logoutWithReason_wrapped({ reason: "business-account-ownership-transferred" }, client);
+	return detail;
+};
+
+//#endregion
+//#region src/modules/waas/unlockWallet/unlockWallet.ts
+/**
+* Unlocks a WaaS wallet account.
+*
+* @param params.walletAccount - The WaaS wallet account to unlock.
+* @param params.password - The password to unlock the wallet.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves with the wallet information.
+* @notInstrumented
+*/
+const unlockWallet = async ({ password, walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	return require_migrateFromFireblocks.getWaasWalletProviderFromWalletAccount({ walletAccount }, client).unlockWallet({
+		password,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/updateBusinessAccount/updateBusinessAccount.ts
+/**
+* Renames a business account (owner-/admin-only). Calls the SDK API directly
+* (no MPC step), so a rejection surfaces as a thrown error.
+*
+* @param params.businessAccountId - The business account to rename.
+* @param params.name - The new name.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The updated business account.
+*
+* @example
+* ```ts
+* await updateBusinessAccount({ businessAccountId, name: 'Acme Inc' });
+* ```
+*
+* @see getBusinessAccount
+* @notInstrumented
+*/
+const updateBusinessAccount = async ({ businessAccountId, name: name$1 }, client = require_logoutWithReason.getDefaultClient()) => {
+	const core = require_logoutWithReason.getCore(client);
+	return await require_logoutWithReason.createApiClient({}, client).sdkUpdateBusinessAccount({
+		businessAccountId,
+		environmentId: core.environmentId,
+		updateBusinessAccountSdkRequest: { name: name$1 }
+	});
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/updateBusinessAccountMemberRole/updateBusinessAccountMemberRole.ts
+const ROLE_TO_API = {
+	admin: _dynamic_labs_sdk_api_core.AssignableBusinessAccountMemberRole.Admin,
+	viewer: _dynamic_labs_sdk_api_core.AssignableBusinessAccountMemberRole.Viewer
+};
+/**
+* Changes an existing member's role between `admin` and `viewer` (owner-/admin-only).
+* Owner is not assignable here — use `transferBusinessAccountOwnership` for that.
+*
+* @param params.businessAccountId - The business account the member belongs to.
+* @param params.userId - The member whose role changes.
+* @param params.role - The new role (`admin` or `viewer`).
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The updated business account member.
+*
+* @example
+* ```ts
+* await updateBusinessAccountMemberRole({
+*   businessAccountId,
+*   userId: member.userId,
+*   role: 'admin',
+* });
+* ```
+*
+* @see transferBusinessAccountOwnership
+* @see addBusinessAccountMember
+* @notInstrumented
+*/
+const updateBusinessAccountMemberRole = async ({ businessAccountId, userId, role }, client = require_logoutWithReason.getDefaultClient()) => {
+	const core = require_logoutWithReason.getCore(client);
+	return await require_logoutWithReason.createApiClient({ elevatedAccessTokenScope: _dynamic_labs_sdk_api_core.TokenScope.BusinessAccountmemberroleupdate }, client).sdkUpdateBusinessAccountMemberRole({
+		businessAccountId,
+		environmentId: core.environmentId,
+		updateBusinessAccountMemberRoleSdkRequest: { role: ROLE_TO_API[role] },
+		userId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/updateWaasPassword/updateWaasPassword.ts
+/**
+* Updates the password for a WaaS wallet account.
+*
+* This function changes the password used to encrypt and protect the
+* cryptographic key shares for the specified wallet account.
+*
+* @param params.walletAccount - The WaaS wallet account to update the password for.
+* @param params.currentPassword - The current password for the wallet.
+* @param params.newPassword - The new password to set for the wallet.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the password is successfully updated.
+* @notInstrumented
+*/
+const updateWaasPassword = async ({ currentPassword, newPassword, walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	return require_migrateFromFireblocks.getWaasWalletProviderFromWalletAccount({ walletAccount }, client).updatePassword({
+		currentPassword,
+		newPassword,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/waas/policies/upsertAccountPolicyRule/upsertAccountPolicyRule.ts
+/**
+* Creates or updates a single rule on a business account's account-Layer
+* (rules applied to every wallet in the account). Build `rule` with
+* {@link buildAllowPolicyRule} / {@link buildDenyPolicyRule}. Omit
+* `rule.ruleId` to create a new rule (the enclave mints one for you); pass
+* an existing `ruleId` to update it in place. BA owner/admin only. Calls
+* the SDK API directly (no MPC step), so a rejection surfaces as a thrown
+* error.
+*
+* @param params.businessAccountId - The business account to apply the rule to.
+* @param params.rule - The rule to create or update.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The account-Layer as it stands after the rule is applied.
+* @notInstrumented
+*/
+const upsertAccountPolicyRule = async ({ businessAccountId, rule }, client = require_logoutWithReason.getDefaultClient()) => {
+	const core = require_logoutWithReason.getCore(client);
+	return require_logoutWithReason.createApiClient({}, client).updateBusinessAccountPolicyLayer({
+		businessAccountId,
+		environmentId: core.environmentId,
+		waasPolicyLayerUpdateRequest: {
+			op: _dynamic_labs_sdk_api_core.WaasPolicyLayerUpdateRequestOpEnum.Upsert,
+			rule
+		}
+	});
+};
+
+//#endregion
+//#region src/modules/waas/policies/upsertSignerPolicyRule/upsertSignerPolicyRule.ts
+/**
+* Creates or updates a single rule on a signer's policy layer. Build `rule`
+* with {@link buildAllowPolicyRule} / {@link buildDenyPolicyRule}. Omit
+* `rule.ruleId` to create a new rule (the enclave mints one for you); pass an
+* existing `ruleId` to update it in place. Calls the SDK API directly (no MPC
+* step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account whose signer-Layer to update.
+* @param params.rule - The rule to create or update.
+* @param [params.shareSetId] - The share set to target; defaults to the caller's own. Only the wallet's own owner may target another share set.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The signer-Layer as it stands after the rule is applied.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const upsertSignerPolicyRule = async ({ rule, shareSetId, walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	require_logoutWithReason.assertDefined(walletAccount.verifiedCredentialId, "upsertSignerPolicyRule: cannot resolve a wallet id — use a verified wallet account");
+	const core = require_logoutWithReason.getCore(client);
+	return require_logoutWithReason.createApiClient({}, client).updateWaasSignerSelfPolicyLayer({
+		environmentId: core.environmentId,
+		waasSignerPolicyLayerUpdateRequest: {
+			op: _dynamic_labs_sdk_api_core.WaasSignerPolicyLayerUpdateRequestOpEnum.Upsert,
+			rule,
+			shareSetId
+		},
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/policies/upsertWalletPolicyRule/upsertWalletPolicyRule.ts
+/**
+* Creates or updates a single rule on a wallet's policy layer. Build `rule`
+* with {@link buildAllowPolicyRule} / {@link buildDenyPolicyRule}. Omit
+* `rule.ruleId` to create a new rule (the enclave mints one for you); pass an
+* existing `ruleId` to update it in place. Calls the SDK API directly (no MPC
+* step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account to apply the rule to.
+* @param params.rule - The rule to create or update.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The wallet-Layer as it stands after the rule is applied.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const upsertWalletPolicyRule = async ({ rule, walletAccount }, client = require_logoutWithReason.getDefaultClient()) => {
+	require_logoutWithReason.assertDefined(walletAccount.verifiedCredentialId, "upsertWalletPolicyRule: cannot resolve a wallet id — use a verified wallet account");
+	const core = require_logoutWithReason.getCore(client);
+	return require_logoutWithReason.createApiClient({}, client).updateWaasWalletSelfPolicyLayer({
+		environmentId: core.environmentId,
+		waasPolicyLayerUpdateRequest: {
+			op: _dynamic_labs_sdk_api_core.WaasPolicyLayerUpdateRequestOpEnum.Upsert,
+			rule
+		},
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
+//#endregion
+//#region src/exports/waas.ts
+(0, _dynamic_labs_sdk_assert_package_version.assertPackageVersion)(require_logoutWithReason.name, require_logoutWithReason.version);
+
+//#endregion
+Object.defineProperty(exports, 'WaasChainEnum', {
+  enumerable: true,
+  get: function () {
+    return WaasChainEnum;
+  }
+});
+Object.defineProperty(exports, 'WaasWalletShareSetType', {
+  enumerable: true,
+  get: function () {
+    return WaasWalletShareSetType$1;
+  }
+});
+Object.defineProperty(exports, 'addBusinessAccountMember', {
+  enumerable: true,
+  get: function () {
+    return addBusinessAccountMember;
+  }
+});
+Object.defineProperty(exports, 'addBusinessAccountSigner', {
+  enumerable: true,
+  get: function () {
+    return addBusinessAccountSigner;
+  }
+});
+Object.defineProperty(exports, 'addWalletToBusinessAccount', {
+  enumerable: true,
+  get: function () {
+    return addWalletToBusinessAccount;
+  }
+});
+Object.defineProperty(exports, 'backupWaasKeySharesToGoogleDrive', {
+  enumerable: true,
+  get: function () {
+    return backupWaasKeySharesToGoogleDrive;
+  }
+});
+Object.defineProperty(exports, 'buildAllowPolicyRule', {
+  enumerable: true,
+  get: function () {
+    return buildAllowPolicyRule;
+  }
+});
+Object.defineProperty(exports, 'buildDenyPolicyRule', {
+  enumerable: true,
+  get: function () {
+    return buildDenyPolicyRule;
+  }
+});
+Object.defineProperty(exports, 'createBusinessAccount', {
+  enumerable: true,
+  get: function () {
+    return createBusinessAccount;
+  }
+});
+Object.defineProperty(exports, 'createPolicy', {
+  enumerable: true,
+  get: function () {
+    return createPolicy;
+  }
+});
+Object.defineProperty(exports, 'createWaasOfflineRecoveryShares', {
+  enumerable: true,
+  get: function () {
+    return createWaasOfflineRecoveryShares;
+  }
+});
+Object.defineProperty(exports, 'createWaasWalletAccounts', {
+  enumerable: true,
+  get: function () {
+    return createWaasWalletAccounts;
+  }
+});
+Object.defineProperty(exports, 'createWalletForBusinessAccount', {
+  enumerable: true,
+  get: function () {
+    return createWalletForBusinessAccount;
+  }
+});
+Object.defineProperty(exports, 'delegateWaasKeyShares', {
+  enumerable: true,
+  get: function () {
+    return delegateWaasKeyShares;
+  }
+});
+Object.defineProperty(exports, 'desugarPolicyRules', {
+  enumerable: true,
+  get: function () {
+    return desugarPolicyRules;
+  }
+});
+Object.defineProperty(exports, 'expandPolicyRules', {
+  enumerable: true,
+  get: function () {
+    return expandPolicyRules;
+  }
+});
+Object.defineProperty(exports, 'exportWaasClientKeyshares', {
+  enumerable: true,
+  get: function () {
+    return exportWaasClientKeyshares;
+  }
+});
+Object.defineProperty(exports, 'exportWaasPrivateKey', {
+  enumerable: true,
+  get: function () {
+    return exportWaasPrivateKey;
+  }
+});
+Object.defineProperty(exports, 'getAccountPolicyLayer', {
+  enumerable: true,
+  get: function () {
+    return getAccountPolicyLayer;
+  }
+});
+Object.defineProperty(exports, 'getBusinessAccount', {
+  enumerable: true,
+  get: function () {
+    return getBusinessAccount;
+  }
+});
+Object.defineProperty(exports, 'getChainsMissingWaasWalletAccounts', {
+  enumerable: true,
+  get: function () {
+    return getChainsMissingWaasWalletAccounts;
+  }
+});
+Object.defineProperty(exports, 'getPolicy', {
+  enumerable: true,
+  get: function () {
+    return getPolicy;
+  }
+});
+Object.defineProperty(exports, 'getSignerPolicyLayer', {
+  enumerable: true,
+  get: function () {
+    return getSignerPolicyLayer;
+  }
+});
+Object.defineProperty(exports, 'getWalletAccountShareSets', {
+  enumerable: true,
+  get: function () {
+    return getWalletAccountShareSets;
+  }
+});
+Object.defineProperty(exports, 'getWalletPolicyLayer', {
+  enumerable: true,
+  get: function () {
+    return getWalletPolicyLayer;
+  }
+});
+Object.defineProperty(exports, 'getWalletRecoveryState', {
+  enumerable: true,
+  get: function () {
+    return getWalletRecoveryState;
+  }
+});
+Object.defineProperty(exports, 'hasDelegatedAccess', {
+  enumerable: true,
+  get: function () {
+    return hasDelegatedAccess;
+  }
+});
+Object.defineProperty(exports, 'importWaasPrivateKey', {
+  enumerable: true,
+  get: function () {
+    return importWaasPrivateKey;
+  }
+});
+Object.defineProperty(exports, 'isPasswordRequiredForWaasWallets', {
+  enumerable: true,
+  get: function () {
+    return isPasswordRequiredForWaasWallets;
+  }
+});
+Object.defineProperty(exports, 'isWalletCreationRequirement', {
+  enumerable: true,
+  get: function () {
+    return isWalletCreationRequirement;
+  }
+});
+Object.defineProperty(exports, 'listBusinessAccounts', {
+  enumerable: true,
+  get: function () {
+    return listBusinessAccounts;
+  }
+});
+Object.defineProperty(exports, 'normalizeWalletRequirements', {
+  enumerable: true,
+  get: function () {
+    return normalizeWalletRequirements;
+  }
+});
+Object.defineProperty(exports, 'refreshWaasWalletAccountShares', {
+  enumerable: true,
+  get: function () {
+    return refreshWaasWalletAccountShares;
+  }
+});
+Object.defineProperty(exports, 'removeAccountPolicyRule', {
+  enumerable: true,
+  get: function () {
+    return removeAccountPolicyRule;
+  }
+});
+Object.defineProperty(exports, 'removeBusinessAccountMember', {
+  enumerable: true,
+  get: function () {
+    return removeBusinessAccountMember;
+  }
+});
+Object.defineProperty(exports, 'removeBusinessAccountSigner', {
+  enumerable: true,
+  get: function () {
+    return removeBusinessAccountSigner;
+  }
+});
+Object.defineProperty(exports, 'removeBusinessAccountWallet', {
+  enumerable: true,
+  get: function () {
+    return removeBusinessAccountWallet;
+  }
+});
+Object.defineProperty(exports, 'removePolicyRules', {
+  enumerable: true,
+  get: function () {
+    return removePolicyRules;
+  }
+});
+Object.defineProperty(exports, 'removeSignerPolicyRule', {
+  enumerable: true,
+  get: function () {
+    return removeSignerPolicyRule;
+  }
+});
+Object.defineProperty(exports, 'removeWalletPolicyRule', {
+  enumerable: true,
+  get: function () {
+    return removeWalletPolicyRule;
+  }
+});
+Object.defineProperty(exports, 'resolvePolicyScope', {
+  enumerable: true,
+  get: function () {
+    return resolvePolicyScope;
+  }
+});
+Object.defineProperty(exports, 'revokeWaasDelegation', {
+  enumerable: true,
+  get: function () {
+    return revokeWaasDelegation;
+  }
+});
+Object.defineProperty(exports, 'setWaasWalletAccountPassword', {
+  enumerable: true,
+  get: function () {
+    return setWaasWalletAccountPassword;
+  }
+});
+Object.defineProperty(exports, 'shouldAutoCreateWalletForChain', {
+  enumerable: true,
+  get: function () {
+    return shouldAutoCreateWalletForChain;
+  }
+});
+Object.defineProperty(exports, 'signSerializedTransaction', {
+  enumerable: true,
+  get: function () {
+    return signSerializedTransaction;
+  }
+});
+Object.defineProperty(exports, 'transferBusinessAccountOwnership', {
+  enumerable: true,
+  get: function () {
+    return transferBusinessAccountOwnership;
+  }
+});
+Object.defineProperty(exports, 'unlockWallet', {
+  enumerable: true,
+  get: function () {
+    return unlockWallet;
+  }
+});
+Object.defineProperty(exports, 'updateBusinessAccount', {
+  enumerable: true,
+  get: function () {
+    return updateBusinessAccount;
+  }
+});
+Object.defineProperty(exports, 'updateBusinessAccountMemberRole', {
+  enumerable: true,
+  get: function () {
+    return updateBusinessAccountMemberRole;
+  }
+});
+Object.defineProperty(exports, 'updateWaasPassword', {
+  enumerable: true,
+  get: function () {
+    return updateWaasPassword;
+  }
+});
+Object.defineProperty(exports, 'upsertAccountPolicyRule', {
+  enumerable: true,
+  get: function () {
+    return upsertAccountPolicyRule;
+  }
+});
+Object.defineProperty(exports, 'upsertSignerPolicyRule', {
+  enumerable: true,
+  get: function () {
+    return upsertSignerPolicyRule;
+  }
+});
+Object.defineProperty(exports, 'upsertWalletPolicyRule', {
+  enumerable: true,
+  get: function () {
+    return upsertWalletPolicyRule;
+  }
+});
+//# sourceMappingURL=waas-BOKafCeH.cjs.map