@dynamic-labs-sdk/client 1.30.2 → 1.31.0

package/dist/waas-CUDgU2pl.esm.js

@@ -0,0 +1,2150 @@
+import { E as isWaasWalletProvider, Et as version, R as getWalletAccounts, St as getCore, T as findWaasWalletProviderByChain, Tt as name, V as getChainFromVerifiedCredentialChain, b as InvalidParamError, c as createApiClient, k as DYNAMIC_WAAS_METADATA, l as __refreshAuth_wrapped, mt as assertDefined, s as NoWalletProviderFoundError, t as __logoutWithReason_wrapped, w as isWaasWalletAccount, yt as getDefaultClient, z as formatWalletProviderKey } from "./logoutWithReason-DV89zJmJ.esm.js";
+import { n as isDynamicWaasEnabled, o as NotWaasWalletProviderError, r as getWaasWalletProviderFromWalletAccount } from "./migrateFromFireblocks-CiOS4_Nq.esm.js";
+import { n as getWalletProviderByKey, t as getVerifiedCredentialForWalletAccount } from "./getVerifiedCredentialForWalletAccount-Cjwoeej7.esm.js";
+import { assertPackageVersion } from "@dynamic-labs-sdk/assert-package-version";
+import { AssignableBusinessAccountMemberRole, JwtVerifiedCredentialFormatEnum, TokenScope, UserIdentifierTypeEnum, WaasChainEnum, WaasPolicyLayerRuleOperationOpEnum, WaasPolicyLayerUpdateRequestOpEnum, WaasPolicyRuleType, WaasSignerPolicyLayerUpdateRequestOpEnum, WaasWalletShareSetType, WalletProviderEnum } from "@dynamic-labs/sdk-api-core";
+
+//#region src/modules/waas/waas.consts.ts
+/**
+* Identifies the chain family targeted by WaaS policy operations.
+*
+* @example
+* ```ts
+* const chain: WaasChainEnum = WaasChainEnum.Evm;
+* ```
+*
+* @see createPolicy
+* @see getPolicy
+*/
+const WaasChainEnum$1 = WaasChainEnum;
+/**
+* Identifies the role of a share set exposed through a WaaS wallet account.
+*
+* @see getWalletAccountShareSets
+* @see WaasWalletAccount
+*/
+const WaasWalletShareSetType$1 = WaasWalletShareSetType;
+
+//#endregion
+//#region src/modules/waas/businessAccounts/assertTargetIdentity.ts
+/**
+* Asserts a {@link TargetIdentity} resolves to a user: a `userId`, or an
+* `identifier` with its `identifierType`. Throws otherwise.
+*
+* @notInstrumented
+*/
+const assertTargetIdentity = ({ fnName, targetIdentity }) => {
+	const hasUserId = Boolean(targetIdentity.userId);
+	const hasIdentifier = Boolean(targetIdentity.identifier && targetIdentity.identifierType);
+	if (!hasUserId && !hasIdentifier) throw new InvalidParamError(`${fnName}: targetIdentity must provide a userId, or an identifier with its identifierType`);
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/businessAccounts.constants.ts
+/** Maps the SDK's identifier-type union to the generated API enum. */
+const IDENTIFIER_TYPE_TO_API = {
+	email: UserIdentifierTypeEnum.Email,
+	externalUserId: UserIdentifierTypeEnum.ExternalUserId,
+	id: UserIdentifierTypeEnum.Id,
+	phoneNumber: UserIdentifierTypeEnum.PhoneNumber,
+	socialAccountId: UserIdentifierTypeEnum.SocialAccountId,
+	socialUsername: UserIdentifierTypeEnum.SocialUsername
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/addBusinessAccountMember/addBusinessAccountMember.ts
+/**
+* Adds a member to an existing business account. Identify the target with a
+* `targetIdentity`: a known `userId`, or an `identifier` + `identifierType`
+* (e.g. an email — the user is created if absent).
+*
+* Calls the SDK API directly (not the WaaS iframe): this is a server-state
+* mutation with no MPC step, so a rejection (e.g. a 422 resource-limit) surfaces
+* as a thrown error rather than stalling in the iframe bridge.
+*
+* @param params.businessAccountId - The ID of the business account.
+* @param params.targetIdentity - The member to add (userId, or identifier + identifierType).
+* @param [params.role] - The member role (`admin` or `viewer`). Defaults to `viewer`.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The created business account member.
+* @notInstrumented
+*/
+const addBusinessAccountMember = async ({ businessAccountId, targetIdentity, role }, client = getDefaultClient()) => {
+	assertTargetIdentity({
+		fnName: "addBusinessAccountMember",
+		targetIdentity
+	});
+	const core = getCore(client);
+	const apiClient = createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountmemberadd }, client);
+	const { userId, identifier, identifierType, socialProvider, smsCountryCode } = targetIdentity;
+	return await apiClient.sdkAddBusinessAccountMember({
+		addBusinessAccountMemberSdkRequest: {
+			identifier,
+			role: role === "admin" ? AssignableBusinessAccountMemberRole.Admin : AssignableBusinessAccountMemberRole.Viewer,
+			smsCountryCode,
+			socialProvider,
+			type: identifierType ? IDENTIFIER_TYPE_TO_API[identifierType] : void 0,
+			userId
+		},
+		businessAccountId,
+		environmentId: core.environmentId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/getWaasWalletProviderByChain/getWaasWalletProviderByChain.ts
+/** @notInstrumented */
+const getWaasWalletProviderByChain = ({ chain }, client) => {
+	const waasProvider = findWaasWalletProviderByChain({ chain }, client);
+	if (!waasProvider) throw new NoWalletProviderFoundError({ walletProviderKey: formatWalletProviderKey({
+		chain,
+		displayName: DYNAMIC_WAAS_METADATA.displayName,
+		walletProviderType: WalletProviderEnum.EmbeddedWallet
+	}) });
+	return waasProvider;
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/addBusinessAccountSigner/addBusinessAccountSigner.ts
+/**
+* Adds a signer to a business-account wallet via the reshare ceremony, minting
+* the new signer's share set. Identify the target by `userId`, or `identifier`
+* + `identifierType` (the user is created if absent).
+*
+* Omit `businessAccountId` to add a signer to a wallet that isn't in a business
+* account yet: the wallet's per-account is found-or-created first (idempotent —
+* converts the personal wallet, seating its owner as the first signer), then
+* the new signer is reshared in.
+*
+* @param params.walletAccount - The wallet account to add the signer to.
+* @param [params.businessAccountId] - The business account; found-or-created when omitted.
+* @param [params.walletId] - The wallet UUID to link when finding-or-creating; defaults to `walletAccount.verifiedCredentialId`.
+* @param params.targetIdentity - The signer to add (userId, or identifier + identifierType).
+* @param [params.signerType] - `endUser` (default) or `server`.
+* @param [params.password] - Password for the current signer's share, if it is password-encrypted.
+* @param [params.targetSignerPassword] - Password used to encrypt the new signer's share. Required when wallet passwords are required by the environment.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The new signer's share set id.
+* @notInstrumented
+*/
+const addBusinessAccountSigner = async ({ walletAccount, businessAccountId, walletId, targetIdentity, signerType, password, targetSignerPassword }, client = getDefaultClient()) => {
+	assertTargetIdentity({
+		fnName: "addBusinessAccountSigner",
+		targetIdentity
+	});
+	if (walletAccount.businessAccountId) assertDefined(businessAccountId, "addBusinessAccountSigner: this wallet is already part of a business account");
+	let resolvedBusinessAccountId = businessAccountId;
+	if (!resolvedBusinessAccountId) {
+		const linkWalletId = walletId ?? walletAccount.verifiedCredentialId;
+		assertDefined(linkWalletId, "addBusinessAccountSigner: cannot resolve a wallet id to link — pass walletId, or use a verified wallet account");
+		const core = getCore(client);
+		resolvedBusinessAccountId = (await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountsigneradd }, client).sdkLinkBusinessAccountWallet({
+			environmentId: core.environmentId,
+			linkBusinessAccountWalletSdkRequest: { walletId: linkWalletId }
+		})).id;
+	}
+	const result = await getWaasWalletProviderByChain({ chain: walletAccount.chain }, client).reshareToNewSignerShareSet({
+		businessAccountId: resolvedBusinessAccountId,
+		password,
+		signerType,
+		targetSignerIdentity: targetIdentity,
+		targetSignerPassword,
+		walletAccount
+	});
+	await __refreshAuth_wrapped(client);
+	return result;
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/addWalletToBusinessAccount/addWalletToBusinessAccount.ts
+/**
+* Links a wallet to a business account, or omit `businessAccountId` to
+* find-or-create the per-wallet business account (the server seats the wallet's
+* owner as the first member/signer).
+*
+* Calls the SDK API directly (not the WaaS iframe): this is a server-state
+* mutation with no MPC step, so a rejection (e.g. a 422 resource-limit) surfaces
+* as a thrown error rather than stalling in the iframe bridge.
+*
+* @param [params.businessAccountId] - The business account to link to; found-or-created when omitted.
+* @param params.walletId - The ID of the wallet to link.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The updated business account detail.
+* @notInstrumented
+*/
+const addWalletToBusinessAccount = async ({ businessAccountId, walletId }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	const detail = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountlinkWallet }, client).sdkLinkBusinessAccountWallet({
+		environmentId: core.environmentId,
+		linkBusinessAccountWalletSdkRequest: {
+			businessAccountId,
+			walletId
+		}
+	});
+	await __refreshAuth_wrapped(client);
+	return detail;
+};
+
+//#endregion
+//#region src/modules/waas/backupWaasKeySharesToGoogleDrive/backupWaasKeySharesToGoogleDrive.ts
+/**
+* Backs up WaaS wallet key shares to Google Drive for secure recovery.
+*
+* This function creates a backup of the wallet's cryptographic key shares
+* to Google Drive, allowing users to recover their wallet later.
+*
+* @param params.walletAccount - The WaaS wallet account to backup.
+* @param [params.password] - Optional password to encrypt the backup.
+* @param [params.googleDriveAccessToken] - Optional consumer-supplied Drive-scoped access token; used directly instead of the stored OAuth token (avoids a second Google consent). Useful for external-auth setups.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the backup process is complete.
+* @notInstrumented
+*/
+const backupWaasKeySharesToGoogleDrive = async ({ googleDriveAccessToken, password, walletAccount }, client = getDefaultClient()) => {
+	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).backupKeySharesToGoogleDrive({
+		googleDriveAccessToken,
+		password,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildAllowPolicyRule/buildAllowPolicyRule.ts
+/**
+* Builds a policy rule that permits the described action.
+*
+* @param rule - The rule fields (name, chain, and any targeting/limit fields).
+* @returns A `WaasPolicyRule` with `ruleType` set to `allow`.
+* @notInstrumented
+*/
+const buildAllowPolicyRule = (rule) => ({
+	...rule,
+	ruleType: WaasPolicyRuleType.Allow
+});
+
+//#endregion
+//#region src/modules/waas/policies/buildDenyPolicyRule/buildDenyPolicyRule.ts
+/**
+* Builds a policy rule that blocks the described action.
+*
+* @param rule - The rule fields (name, chain, and any targeting/limit fields).
+* @returns A `WaasPolicyRule` with `ruleType` set to `deny`.
+* @notInstrumented
+*/
+const buildDenyPolicyRule = (rule) => ({
+	...rule,
+	ruleType: WaasPolicyRuleType.Deny
+});
+
+//#endregion
+//#region src/modules/waas/businessAccounts/createBusinessAccount/createBusinessAccount.ts
+/**
+* Creates a new business account.
+*
+* @param [params] - Optional parameters for the business account.
+* @param [params.name] - Optional name for the business account.
+* @param [params.externalRef] - Optional developer-supplied label (not unique; accounts may share one).
+* @param [params.metadata] - Optional arbitrary key-value metadata.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The created business account.
+* @notInstrumented
+*/
+const createBusinessAccount = async (params, client = getDefaultClient()) => {
+	const core = getCore(client);
+	const result = await createApiClient({}, client).sdkCreateBusinessAccount({
+		createBusinessAccountSdkRequest: {
+			externalRef: params?.externalRef,
+			metadata: params?.metadata,
+			name: params?.name
+		},
+		environmentId: core.environmentId
+	});
+	await __refreshAuth_wrapped(client);
+	return result;
+};
+
+//#endregion
+//#region src/modules/waas/policies/applyPolicyLayerBatch/applyPolicyLayerBatch.ts
+/**
+* Applies a batch of rule operations to the policy layer a
+* {@link ResolvedPolicyScope} points at, atomically in one enclave cycle.
+* Shared by {@link createPolicy} and {@link removePolicyRules} so the
+* account-vs-wallet-vs-signer branch is written once.
+*
+* @notInstrumented
+*/
+const applyPolicyLayerBatch = ({ operations, resolvedScope }, client) => {
+	const { environmentId } = getCore(client);
+	const apiClient = createApiClient({}, client);
+	switch (resolvedScope.target) {
+		case "account": return apiClient.updateBusinessAccountPolicyLayer({
+			businessAccountId: resolvedScope.businessAccountId,
+			environmentId,
+			waasPolicyLayerUpdateRequest: {
+				op: WaasPolicyLayerUpdateRequestOpEnum.Batch,
+				operations
+			}
+		});
+		case "wallet": return apiClient.updateWaasWalletSelfPolicyLayer({
+			environmentId,
+			waasPolicyLayerUpdateRequest: {
+				op: WaasPolicyLayerUpdateRequestOpEnum.Batch,
+				operations
+			},
+			walletId: resolvedScope.walletId
+		});
+		case "signer": return apiClient.updateWaasSignerSelfPolicyLayer({
+			environmentId,
+			waasSignerPolicyLayerUpdateRequest: {
+				op: WaasSignerPolicyLayerUpdateRequestOpEnum.Batch,
+				operations,
+				shareSetId: resolvedScope.shareSetId
+			},
+			walletId: resolvedScope.walletId
+		});
+		default: {
+			const unhandledScope = resolvedScope;
+			throw new InvalidParamError(`applyPolicyLayerBatch: unhandled target "${JSON.stringify(unhandledScope)}"`);
+		}
+	}
+};
+
+//#endregion
+//#region src/utils/objectKeys/objectKeys.ts
+/**
+* Typed `Object.keys` — returns `(keyof T)[]` instead of `string[]`, for
+* objects whose key set is fully known at the type level.
+*
+* @notInstrumented
+*/
+const objectKeys = (value) => Object.keys(value);
+
+//#endregion
+//#region src/modules/waas/policies/buildValueLimit/buildValueLimit.ts
+/**
+* Turns a {@link PolicyRuleMaxAmountPerTransaction} into the `valueLimit` shape a rule stores it as.
+* @notInstrumented
+*/
+const buildValueLimit = ({ amount, asset }) => ({
+	asset,
+	maxPerCall: amount
+});
+
+//#endregion
+//#region src/modules/waas/policies/policyRuleDefaultNames.ts
+/**
+* Each rule kind's name when the caller doesn't override it via
+* `PolicyRules['names']`. Shared between the `build*Rule` functions and
+* `desugarPolicyRules` so a rename can't drift the two out of sync — the
+* same reason `RULE_KINDS` in `policyRuleKinds.ts` is a single table
+* instead of parallel switches.
+*/
+const DEFAULT_POLICY_RULE_NAMES = {
+	allowAddresses: "Allowed addresses",
+	blockExport: "Block key export",
+	denyAddresses: "Denied addresses",
+	maxAmountPerTransaction: "Per-transaction cap"
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildAllowAddressesRule/buildAllowAddressesRule.ts
+/**
+* Builds the `allowAddresses` rule, absorbing a sibling
+* `maxAmountPerTransaction` onto the same rule instead of letting it emit
+* its own — see `buildMaxAmountPerTransactionRule`.
+* @notInstrumented
+*/
+const buildAllowAddressesRule = ({ context: { chain, chainIds }, rules }) => {
+	if (!rules.allowAddresses || rules.allowAddresses.length === 0) return void 0;
+	return {
+		addresses: rules.allowAddresses,
+		chain,
+		chainIds,
+		name: rules.names?.allowAddresses ?? DEFAULT_POLICY_RULE_NAMES.allowAddresses,
+		ruleType: WaasPolicyRuleType.Allow,
+		...rules.maxAmountPerTransaction ? { valueLimit: buildValueLimit(rules.maxAmountPerTransaction) } : {}
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildBlockExportRule/buildBlockExportRule.ts
+/**
+* Builds the `blockExport` rule. `deny`, not `allow`: an addressless
+* allow-rule normalizes to an empty allowed-set, denying every transaction.
+* `chain`/`chainIds` are stamped for consistency but the enforcement of a
+* `blockExport` `operationRestrictions` rule is wallet-wide, ignoring them.
+* @notInstrumented
+*/
+const buildBlockExportRule = ({ context: { chain, chainIds }, rules }) => {
+	if (rules.blockExport !== true) return void 0;
+	return {
+		chain,
+		chainIds,
+		name: rules.names?.blockExport ?? DEFAULT_POLICY_RULE_NAMES.blockExport,
+		operationRestrictions: { blockExport: true },
+		ruleType: WaasPolicyRuleType.Deny
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildDenyAddressesRule/buildDenyAddressesRule.ts
+/**
+* Builds the `denyAddresses` rule. Independent of `allowAddresses`.
+* @notInstrumented
+*/
+const buildDenyAddressesRule = ({ context: { chain, chainIds }, rules }) => {
+	if (!rules.denyAddresses || rules.denyAddresses.length === 0) return void 0;
+	return {
+		addresses: rules.denyAddresses,
+		chain,
+		chainIds,
+		name: rules.names?.denyAddresses ?? DEFAULT_POLICY_RULE_NAMES.denyAddresses,
+		ruleType: WaasPolicyRuleType.Deny
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildMaxAmountPerTransactionRule/buildMaxAmountPerTransactionRule.ts
+/**
+* Builds the standalone `maxAmountPerTransaction` rule. Only fires when
+* `allowAddresses` didn't already absorb this cap onto its own rule. `deny`
+* for the same reason as `blockExport`'s builder.
+* @notInstrumented
+*/
+const buildMaxAmountPerTransactionRule = ({ context: { chain, chainIds }, rules }) => {
+	const isAbsorbedByAllowAddresses = Boolean(rules.allowAddresses?.length);
+	if (!rules.maxAmountPerTransaction || isAbsorbedByAllowAddresses) return void 0;
+	return {
+		chain,
+		chainIds,
+		name: rules.names?.maxAmountPerTransaction ?? DEFAULT_POLICY_RULE_NAMES.maxAmountPerTransaction,
+		ruleType: WaasPolicyRuleType.Deny,
+		valueLimit: buildValueLimit(rules.maxAmountPerTransaction)
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/hasAddresses/hasAddresses.ts
+/**
+* Checks both the current `addresses` array and the legacy singular `address` field.
+* @notInstrumented
+*/
+const hasAddresses = (rule) => rule.addresses !== void 0 && rule.addresses.length > 0 || rule.address != null;
+
+//#endregion
+//#region src/modules/waas/policies/hasUnrecognizedFields/hasUnrecognizedFields.ts
+const RECOGNIZED_TOP_LEVEL_KEY_SET = new Set([
+	"ruleId",
+	"name",
+	"ruleType",
+	"addresses",
+	"chain",
+	"chainIds",
+	"valueLimit",
+	"operationRestrictions"
+]);
+/**
+* @notInstrumented
+*/
+const hasUnrecognizedFields = (rule) => Object.keys(rule).some((key) => !RECOGNIZED_TOP_LEVEL_KEY_SET.has(key) && rule[key] != null) || rule.valueLimit?.totalLimit != null || rule.operationRestrictions?.blockRevocation != null || rule.operationRestrictions?.blockClientSigning != null;
+
+//#endregion
+//#region src/modules/waas/policies/readValueLimit/readValueLimit.ts
+/**
+* Reads a stored `valueLimit` back into a {@link PolicyRuleMaxAmountPerTransaction}.
+* @notInstrumented
+*/
+const readValueLimit = ({ asset, maxPerCall }) => ({
+	amount: maxPerCall,
+	...asset ? { asset } : {}
+});
+
+//#endregion
+//#region src/modules/waas/policies/readAllowAddressesRule/readAllowAddressesRule.ts
+/**
+* Recognizes an existing rule as `allowAddresses`, reading back a merged
+* `maxAmountPerTransaction` cap too when the rule carries one.
+* @notInstrumented
+*/
+const readAllowAddressesRule = (rule) => {
+	if (!(rule.ruleType === WaasPolicyRuleType.Allow && rule.operationRestrictions === void 0 && (rule.valueLimit === void 0 || rule.valueLimit.maxPerCall !== void 0) && hasAddresses(rule) && !hasUnrecognizedFields(rule))) return void 0;
+	return {
+		allowAddresses: rule.addresses,
+		...rule.valueLimit?.maxPerCall !== void 0 ? { maxAmountPerTransaction: readValueLimit({
+			asset: rule.valueLimit.asset,
+			maxPerCall: rule.valueLimit.maxPerCall
+		}) } : {}
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/readBlockExportRule/readBlockExportRule.ts
+/**
+* Recognizes an existing rule as `blockExport`.
+* @notInstrumented
+*/
+const readBlockExportRule = (rule) => {
+	if (!(rule.ruleType === WaasPolicyRuleType.Deny && rule.operationRestrictions?.blockExport === true && rule.valueLimit === void 0 && !hasAddresses(rule) && !hasUnrecognizedFields(rule))) return void 0;
+	return { blockExport: true };
+};
+
+//#endregion
+//#region src/modules/waas/policies/readDenyAddressesRule/readDenyAddressesRule.ts
+/**
+* Recognizes an existing rule as `denyAddresses`.
+* @notInstrumented
+*/
+const readDenyAddressesRule = (rule) => {
+	if (!(rule.ruleType === WaasPolicyRuleType.Deny && rule.operationRestrictions === void 0 && rule.valueLimit === void 0 && hasAddresses(rule) && !hasUnrecognizedFields(rule))) return void 0;
+	return { denyAddresses: rule.addresses };
+};
+
+//#endregion
+//#region src/modules/waas/policies/readMaxAmountPerTransactionRule/readMaxAmountPerTransactionRule.ts
+/**
+* Recognizes an existing rule as a standalone `maxAmountPerTransaction` cap.
+* @notInstrumented
+*/
+const readMaxAmountPerTransactionRule = (rule) => {
+	if (!(rule.ruleType === WaasPolicyRuleType.Deny && rule.operationRestrictions === void 0 && rule.valueLimit?.maxPerCall !== void 0 && !hasAddresses(rule) && !hasUnrecognizedFields(rule))) return void 0;
+	return { maxAmountPerTransaction: readValueLimit({
+		asset: rule.valueLimit.asset,
+		maxPerCall: rule.valueLimit.maxPerCall
+	}) };
+};
+
+//#endregion
+//#region src/modules/waas/policies/policyRuleKinds.ts
+/** The four keys of {@link PolicyRules}, each of which produces its own rule. */
+const RULE_KIND_KEYS = [
+	"blockExport",
+	"allowAddresses",
+	"denyAddresses",
+	"maxAmountPerTransaction"
+];
+/**
+* The single source of truth {@link expandPolicyRules} and
+* {@link desugarPolicyRules} both build on. Entries are alphabetized
+* (enforced by lint), not grouped by relationship — `allowAddresses` and
+* `maxAmountPerTransaction` cooperate (see their builders' comments) despite
+* sitting apart here.
+*/
+const RULE_KINDS = {
+	allowAddresses: {
+		buildRule: buildAllowAddressesRule,
+		readRule: readAllowAddressesRule
+	},
+	blockExport: {
+		buildRule: buildBlockExportRule,
+		readRule: readBlockExportRule
+	},
+	denyAddresses: {
+		buildRule: buildDenyAddressesRule,
+		readRule: readDenyAddressesRule
+	},
+	maxAmountPerTransaction: {
+		buildRule: buildMaxAmountPerTransactionRule,
+		readRule: readMaxAmountPerTransactionRule
+	}
+};
+
+//#endregion
+//#region src/modules/waas/policies/readCoveredRule/readCoveredRule.ts
+/**
+* The sugar keys and values an existing rule structurally represents — a
+* single rule can cover more than one key (see `allowAddresses` absorbing
+* `maxAmountPerTransaction` in `policyRuleKinds.ts`). A rule carrying a
+* per-rule `modifiableBySigner` grant is never matched here — treating it
+* as covering keys would let a caller's batch reuse/replace/remove it and
+* silently revoke that signer's edit permission (mirrors `desugarPolicyRules`).
+*
+* @param rule - The existing policy-layer rule to read.
+* @returns The sugar keys and values the rule covers, or undefined when it matches no kind or carries a signer grant.
+* @notInstrumented
+*/
+const readCoveredRule = (rule) => {
+	if (rule.modifiableBySigner === true) return;
+	for (const kind of RULE_KIND_KEYS) {
+		const values = RULE_KINDS[kind].readRule(rule);
+		if (values === void 0) continue;
+		return {
+			keys: objectKeys(values),
+			kind,
+			values
+		};
+	}
+};
+
+//#endregion
+//#region src/modules/waas/policies/sortRulesByRuleId/sortRulesByRuleId.ts
+/**
+* Sorts rules by `ruleId` ascending (a rule missing one sorts first, as `''`)
+* — the deterministic order {@link matchExistingRules} picks its reuse
+* target from, so every caller agrees on which duplicate rule wins.
+*
+* @param rules - The rules to sort.
+* @returns A new array, sorted by `ruleId` ascending.
+* @notInstrumented
+*/
+const sortRulesByRuleId = (rules) => [...rules].sort((a, b) => {
+	const idA = a.ruleId ?? "";
+	const idB = b.ruleId ?? "";
+	if (idA < idB) return -1;
+	if (idA > idB) return 1;
+	return 0;
+});
+
+//#endregion
+//#region src/modules/waas/policies/matchExistingRules/matchExistingRules.ts
+const coveredRuleKeys = (rule) => readCoveredRule(rule)?.keys ?? [];
+/**
+* Matches existing rules covering any of `builtRule`'s keys. Only rules
+* being *absorbed* into it — i.e. no other match claims the same key — are
+* superseded (safe to remove). Two matches claiming the SAME key (e.g. two
+* hand-authored `denyAddresses` rules for this chain scope) are a
+* legitimate duplicate, not one superseding the other, so are left alone
+* rather than removed.
+*
+* @param params.builtRule - The newly built rule to match existing rules against.
+* @param params.consumedRuleIds - `ruleId`s already reused or removed for a prior built rule this call, so none is touched twice.
+* @param params.existingRulesInScope - The layer's rules already narrowed to the target chain scope.
+* @returns The rule to reuse `builtRule`'s upsert onto (if any), and every rule it supersedes.
+* @notInstrumented
+*/
+const matchExistingRules = ({ builtRule, consumedRuleIds, existingRulesInScope }) => {
+	const builtKeys = new Set(coveredRuleKeys(builtRule));
+	const matches = sortRulesByRuleId(existingRulesInScope).filter((existingRule) => existingRule.ruleId !== void 0 && !consumedRuleIds.has(existingRule.ruleId)).map((rule) => ({
+		keys: coveredRuleKeys(rule),
+		rule
+	})).filter(({ keys }) => keys.some((key) => builtKeys.has(key)));
+	const [reused, ...rest] = matches;
+	const superseded = rest.filter(({ keys, rule }) => {
+		const ruleKeys = new Set(keys);
+		return !matches.some((other) => other.rule.ruleId !== rule.ruleId && other.keys.some((key) => ruleKeys.has(key)));
+	}).map(({ rule }) => rule);
+	return {
+		reused: reused?.rule,
+		superseded
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/resolveRuleName/resolveRuleName.ts
+/**
+* Keeps the reused rule's label unless the caller overrides it or its
+* name-owning kind changed.
+*
+* @param params.builtRule - The newly built rule about to be upserted.
+* @param params.reused - The existing rule `builtRule` is upserted onto, if any.
+* @param params.rules - The caller's requested {@link PolicyRules} sugar map.
+* @returns The name to use for the upserted rule.
+* @notInstrumented
+*/
+const resolveRuleName = ({ builtRule, reused, rules }) => {
+	if (reused === void 0) return builtRule.name;
+	const builtKind = readCoveredRule(builtRule)?.kind;
+	const reusedKind = readCoveredRule(reused)?.kind;
+	const sameOwningKind = builtKind !== void 0 && builtKind === reusedKind;
+	const nameOverridden = builtKind !== void 0 && rules.names?.[builtKind] !== void 0;
+	return sameOwningKind && !nameOverridden ? reused.name : builtRule.name;
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildOperationsForRule/buildOperationsForRule.ts
+/**
+* Upserts `builtRule` onto the existing rule it reuses (if any), and
+* removes every rule that rule superseded. Mutates `consumedRuleIds` so a
+* later call for a different built rule never reuses or removes the same
+* existing rule twice.
+*
+* @param params.builtRule - The newly built rule to turn into batch operations.
+* @param params.consumedRuleIds - `ruleId`s already reused or removed for a prior built rule this call.
+* @param params.existingRulesInScope - The layer's rules already narrowed to the target chain scope.
+* @param params.rules - The caller's requested {@link PolicyRules} sugar map.
+* @returns The batch operations for this built rule — one upsert, plus a remove per superseded rule.
+* @notInstrumented
+*/
+const buildOperationsForRule = ({ builtRule, consumedRuleIds, existingRulesInScope, rules }) => {
+	const { reused, superseded } = matchExistingRules({
+		builtRule,
+		consumedRuleIds,
+		existingRulesInScope
+	});
+	const reusedRuleId = reused?.ruleId;
+	const operations = [{
+		op: WaasPolicyLayerRuleOperationOpEnum.Upsert,
+		rule: reusedRuleId ? {
+			...builtRule,
+			name: resolveRuleName({
+				builtRule,
+				reused,
+				rules
+			}),
+			ruleId: reusedRuleId
+		} : builtRule
+	}];
+	if (reusedRuleId) consumedRuleIds.add(reusedRuleId);
+	for (const { ruleId } of superseded) {
+		consumedRuleIds.add(ruleId);
+		operations.push({
+			op: WaasPolicyLayerRuleOperationOpEnum.Remove,
+			ruleId
+		});
+	}
+	return operations;
+};
+
+//#endregion
+//#region src/modules/waas/policies/expandPolicyRules/expandPolicyRules.ts
+/**
+* Expands the {@link PolicyRules} sugar map into `WaasPolicyRule[]` for one
+* chain scope. Omitting `chainIds` (or passing an empty array) builds a
+* wildcard rule matching every chain id of `chain`.
+*
+* @param params.rules - The sugar map describing the desired rules.
+* @param params.chain - The chain these rules apply to.
+* @param params.chainIds - The chain ids these rules apply to; omit for a wildcard rule that matches every chain id of `chain`.
+* @returns The expanded `WaasPolicyRule[]`, without `ruleId`.
+* @throws When expansion would produce an `allow` rule with a value limit and no addresses — that empties the allowed set and denies every transaction on the chain.
+* @notInstrumented
+*/
+const expandPolicyRules = ({ chain, chainIds, rules }) => {
+	const context = {
+		chain,
+		chainIds: chainIds ?? []
+	};
+	const expanded = RULE_KIND_KEYS.flatMap((key) => {
+		const rule = RULE_KINDS[key].buildRule({
+			context,
+			rules
+		});
+		return rule ? [rule] : [];
+	});
+	if (expanded.some((rule) => rule.ruleType === WaasPolicyRuleType.Allow && rule.valueLimit !== void 0 && (rule.addresses === void 0 || rule.addresses.length === 0))) throw new InvalidParamError("expandPolicyRules: refusing to emit an allow rule with a value limit and no addresses — it would empty the allowed-address set and deny every transaction on this chain");
+	return expanded;
+};
+
+//#endregion
+//#region src/modules/waas/policies/fillOmittedRuleValues/fillOmittedRuleValues.ts
+/**
+* Whether the caller's value for a sugar key would actually produce a rule —
+* an empty `allowAddresses`/`denyAddresses` array builds no rule (see
+* `buildAllowAddressesRule`/`buildDenyAddressesRule`), so it must count the
+* same as omitted here. Otherwise a real value is present.
+*/
+const isRuleKeyRequested = (value) => Array.isArray(value) ? value.length > 0 : value !== void 0;
+/**
+* A key the caller omitted can be silently dropped if it's merged into the
+* same rule as a key they DID supply (e.g. re-saving only `allowAddresses`
+* when the existing rule also carries `maxAmountPerTransaction`) — carries
+* it forward so a partial re-save never erases a restriction the caller
+* didn't ask to remove.
+*
+* Rules are visited in the same lexicographically-smallest-`ruleId` order
+* `matchExistingRules` reuses, and only the first rule to cover a given key
+* fills it — so when duplicate rules cover the same omitted key, the value
+* always comes from the rule that will actually be upserted.
+*
+* @param params.existingRulesInScope - The layer's rules already narrowed to the target chain scope.
+* @param params.rules - The caller's requested {@link PolicyRules} sugar map.
+* @returns `rules`, with any key a partially-requested existing rule also covers filled in from that rule's current value.
+* @notInstrumented
+*/
+const fillOmittedRuleValues = ({ existingRulesInScope, rules }) => {
+	const mergedRules = { ...rules };
+	for (const existingRule of sortRulesByRuleId(existingRulesInScope)) {
+		const covered = readCoveredRule(existingRule);
+		const isPartiallyRequested = covered !== void 0 && covered.keys.some((key) => isRuleKeyRequested(rules[key])) && covered.keys.some((key) => !isRuleKeyRequested(rules[key]));
+		if (covered === void 0 || !isPartiallyRequested) continue;
+		for (const key of covered.keys) if (!isRuleKeyRequested(rules[key]) && mergedRules[key] === void 0) Object.assign(mergedRules, { [key]: covered.values[key] });
+	}
+	return mergedRules;
+};
+
+//#endregion
+//#region src/modules/waas/policies/getResolvedPolicyLayer/getResolvedPolicyLayer.ts
+/**
+* Fetches the policy layer a {@link ResolvedPolicyScope} points at. Shared
+* by {@link createPolicy}, {@link getPolicy}, and {@link removePolicyRules}
+* so the account/wallet/signer branch is written once.
+*
+* @notInstrumented
+*/
+const getResolvedPolicyLayer = ({ resolvedScope }, client) => {
+	const { environmentId } = getCore(client);
+	const apiClient = createApiClient({}, client);
+	switch (resolvedScope.target) {
+		case "account": return apiClient.getBusinessAccountPolicyLayer({
+			businessAccountId: resolvedScope.businessAccountId,
+			environmentId
+		});
+		case "wallet": return apiClient.getWaasWalletSelfPolicyLayer({
+			environmentId,
+			walletId: resolvedScope.walletId
+		});
+		case "signer": return apiClient.getWaasSignerSelfPolicyLayer({
+			environmentId,
+			shareSetId: resolvedScope.shareSetId,
+			walletId: resolvedScope.walletId
+		});
+		default: {
+			const unhandledScope = resolvedScope;
+			throw new InvalidParamError(`getResolvedPolicyLayer: unhandled target "${JSON.stringify(unhandledScope)}"`);
+		}
+	}
+};
+
+//#endregion
+//#region src/modules/waas/policies/resolvePolicyScope/resolvePolicyScope.ts
+/** Narrows a {@link WalletAccount} to {@link WaasWalletAccount} so WaaS-only fields (e.g. `shareSetId`) are accessible. */
+const isWaasWallet = (walletAccount) => isWaasWalletAccount({ walletAccount });
+/**
+* Resolves a {@link PolicyScope} to its concrete policy layer. When only a
+* `shareSetId` is given, the owning wallet is found locally by scanning the
+* client's own wallet accounts — no network request.
+*
+* @param params.scope - The scope to resolve.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The concrete target (`account`, `wallet`, or `signer`) plus the ids needed to call the SDK API.
+* @throws When a `shareSetId`-only scope doesn't match any of the client's wallet accounts.
+* @notInstrumented
+*/
+const resolvePolicyScope = ({ scope }, client = getDefaultClient()) => {
+	if ("businessAccountId" in scope) return {
+		businessAccountId: scope.businessAccountId,
+		target: "account"
+	};
+	if ("walletId" in scope) return scope.shareSetId === void 0 ? {
+		target: "wallet",
+		walletId: scope.walletId
+	} : {
+		shareSetId: scope.shareSetId,
+		target: "signer",
+		walletId: scope.walletId
+	};
+	const owningWalletAccount = getWalletAccounts(client).filter(isWaasWallet).find((walletAccount) => walletAccount.shareSetId === scope.shareSetId || walletAccount.otherShareSets?.some((shareSet) => shareSet.shareSetId === scope.shareSetId));
+	assertDefined(owningWalletAccount?.verifiedCredentialId, `resolvePolicyScope: could not resolve a wallet for shareSetId "${scope.shareSetId}" — no verified wallet account exposes this share set`);
+	return {
+		shareSetId: scope.shareSetId,
+		target: "signer",
+		walletId: owningWalletAccount.verifiedCredentialId
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/sameChainIds/sameChainIds.ts
+/**
+* Whether two chainIds arrays describe the same set, regardless of order.
+* Shared by {@link createPolicy} and {@link removePolicyRules} to keep their
+* existing-rule lookups consistent.
+*
+* @notInstrumented
+*/
+const sameChainIds = ({ existing = [], requested }) => {
+	if (existing.length !== requested.length) return false;
+	const sortedExisting = [...existing].sort((x, y) => x - y);
+	const sortedRequested = [...requested].sort((x, y) => x - y);
+	return sortedExisting.every((id, index) => id === sortedRequested[index]);
+};
+
+//#endregion
+//#region src/modules/waas/policies/createPolicy/createPolicy.ts
+/**
+* Creates or updates a wallet's, signer's, or business account's policy rules from the
+* {@link PolicyRules} sugar map, in one atomic `batch` PATCH. Each key in
+* `rules` maps to at most one underlying rule, so calling this twice with
+* the same map updates that rule in place instead of duplicating it.
+*
+* Known race: no ETag / optimistic-concurrency check — concurrent calls for
+* the same scope can both read-then-write and duplicate a rule.
+*
+* When more than one existing rule matches the same sugar key(s), only
+* rules being absorbed into the newly built rule (i.e. no other match
+* claims the same key) are removed. Two rules that duplicate the same key
+* (e.g. two hand-authored `denyAddresses` rules for this chain scope) are
+* left as-is rather than one being silently deleted — this call updates the
+* lexicographically-smallest-`ruleId` match in place and leaves the rest
+* untouched. A caller repeating this call will not converge on a single
+* rule; the duplicate has to be removed by hand.
+*
+* @param params.scope - Which policy layer to update — see {@link resolvePolicyScope}.
+* @param params.chain - The chain the rules apply to.
+* @param params.chainIds - The chain ids the rules apply to; omit for a wildcard rule that matches every chain id of `chain`.
+* @param params.rules - The desired rules, as a {@link PolicyRules} sugar map.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The policy layer as it stands after the batch is applied.
+* @throws When `rules` produces no recognized keys, or via {@link resolvePolicyScope}'s scope-resolution errors.
+* @notInstrumented
+*/
+const createPolicy = async ({ chain, chainIds, rules, scope }, client = getDefaultClient()) => {
+	const normalizedChainIds = chainIds ?? [];
+	const resolvedScope = resolvePolicyScope({ scope }, client);
+	const existingRulesInScope = ((await getResolvedPolicyLayer({ resolvedScope }, client)).layerContent.rules ?? []).filter((existingRule) => existingRule.chain === chain && sameChainIds({
+		existing: existingRule.chainIds,
+		requested: normalizedChainIds
+	}));
+	const expandedRules = expandPolicyRules({
+		chain,
+		chainIds: normalizedChainIds,
+		rules: fillOmittedRuleValues({
+			existingRulesInScope,
+			rules
+		})
+	});
+	if (expandedRules.length === 0) throw new InvalidParamError("createPolicy: rules must include at least one recognized policy key");
+	const consumedRuleIds = /* @__PURE__ */ new Set();
+	const operations = [];
+	for (const builtRule of expandedRules) operations.push(...buildOperationsForRule({
+		builtRule,
+		consumedRuleIds,
+		existingRulesInScope,
+		rules
+	}));
+	return applyPolicyLayerBatch({
+		operations,
+		resolvedScope
+	}, client);
+};
+
+//#endregion
+//#region src/modules/waas/createWaasOfflineRecoveryShares/createWaasOfflineRecoveryShares.ts
+/**
+* Mints an offline-recovery share set for a WaaS wallet account.
+*
+* This mints a second, independent 2-of-2 share set: the client's share is
+* uploaded to Google Drive, and the server's share is delivered to the
+* developer's webhook. Dynamic never retains its half, so recovery works even
+* if Dynamic is fully offline.
+*
+* @param params.walletAccount - The WaaS wallet account to create offline-recovery shares for.
+* @param [params.password] - Optional password to encrypt the client share.
+* @param [params.cloudProviderAccessToken] - Optional consumer-supplied Drive-scoped access token; used directly instead of the stored OAuth token (avoids a second Google consent). Useful for external-auth setups.
+* @param [params.mfaToken] - Optional MFA token proving step-up verification, when required for this action.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the offline-recovery share set has been minted.
+* @notInstrumented
+*/
+const createWaasOfflineRecoveryShares = async ({ cloudProviderAccessToken, mfaToken, password, walletAccount }, client = getDefaultClient()) => {
+	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).createOfflineRecoveryShares({
+		cloudProviderAccessToken,
+		mfaToken,
+		password,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/waas/isWalletCreationRequirement/isWalletCreationRequirement.ts
+/**
+* Type guard to check if an item is a WalletCreationRequirement object.
+* Chain values are strings, so we can distinguish by checking if it's an object with a 'chain' property.
+*
+* @param item - The item to check, either a WalletCreationRequirement or Chain string
+* @returns True if the item is a WalletCreationRequirement object
+* @notInstrumented
+*/
+const isWalletCreationRequirement = (item) => typeof item === "object" && item !== null && "chain" in item;
+
+//#endregion
+//#region src/modules/waas/normalizeWalletRequirements/normalizeWalletRequirements.ts
+const DEFAULT_BITCOIN_ADDRESS_TYPE = "native_segwit";
+/**
+* Normalizes wallet creation input from either legacy Chain[] format
+* or new WalletCreationRequirement[] format to WalletCreationRequirement[].
+*
+* For BTC chains without explicit bitcoinConfig, defaults to native_segwit.
+*
+* @param params.input - Either an array of Chain strings or WalletCreationRequirement objects
+* @param params.defaultBitcoinConfig - Optional default bitcoin config to use for BTC chains when converting from legacy format
+* @returns Array of WalletCreationRequirement objects
+* @notInstrumented
+*/
+const normalizeWalletRequirements = ({ defaultBitcoinConfig, input }) => {
+	if (input.length === 0) return [];
+	const [firstItem] = input;
+	if (isWalletCreationRequirement(firstItem)) return input.map((requirement) => {
+		if (requirement.chain === "BTC" && !requirement.bitcoinConfig) return {
+			...requirement,
+			bitcoinConfig: { addressType: DEFAULT_BITCOIN_ADDRESS_TYPE }
+		};
+		return requirement;
+	});
+	return input.map((chain) => {
+		const requirement = { chain };
+		if (chain === "BTC") requirement.bitcoinConfig = defaultBitcoinConfig ?? { addressType: DEFAULT_BITCOIN_ADDRESS_TYPE };
+		return requirement;
+	});
+};
+
+//#endregion
+//#region src/modules/waas/createWaasWalletAccounts/createWaasWalletAccounts.ts
+/**
+* Creates wallet accounts for the specified chains.
+*
+* This function creates wallet accounts for the specified chains.
+* If the same chain is passed multiple times, just as many wallet accounts will be created
+* for that chain.
+*
+* @example
+* ```ts
+* // Legacy format - will create wallet accounts for EVM and SOL, BTC defaults to native_segwit
+* await createWaasWalletAccounts({ chains: ['EVM', 'SOL', 'BTC'] });
+*
+* // New format with chain-specific config
+* await createWaasWalletAccounts({
+*   chains: [
+*     { chain: 'BTC', bitcoinConfig: { addressType: 'taproot' } },
+*     { chain: 'EVM' },
+*   ]
+* });
+*
+* // Create both BTC address types
+* await createWaasWalletAccounts({
+*   chains: [
+*     { chain: 'BTC', bitcoinConfig: { addressType: 'native_segwit' } },
+*     { chain: 'BTC', bitcoinConfig: { addressType: 'taproot' } },
+*   ]
+* });
+* ```
+*
+* @param params.chains - The chains to create wallet accounts for.
+* @param params.password - The optional password to use for the wallet accounts.
+* @param params.thresholdSignatureScheme - The threshold signature scheme to use for the wallet accounts. (Default: TWO_OF_TWO)
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when all wallet accounts are created.
+* @notInstrumented
+*/
+const createWaasWalletAccounts = async ({ chains, password, thresholdSignatureScheme }, client = getDefaultClient()) => {
+	const normalizedRequirements = normalizeWalletRequirements({ input: chains });
+	const supportedChains = [
+		"ALEO",
+		"BTC",
+		"EVM",
+		"SOL",
+		"SUI",
+		"TON",
+		"TRON"
+	];
+	const filteredRequirements = normalizedRequirements.filter((requirement) => supportedChains.includes(requirement.chain));
+	if (filteredRequirements.length === 0) return;
+	const walletProviderMap = /* @__PURE__ */ new Map();
+	for (const requirement of filteredRequirements) {
+		const walletProviderKey = formatWalletProviderKey({
+			chain: requirement.chain,
+			displayName: DYNAMIC_WAAS_METADATA.displayName,
+			walletProviderType: WalletProviderEnum.EmbeddedWallet
+		});
+		if (!walletProviderMap.has(walletProviderKey)) {
+			const walletProvider = getWalletProviderByKey({ walletProviderKey }, client);
+			if (!walletProvider) throw new NoWalletProviderFoundError({ walletProviderKey });
+			if (!isWaasWalletProvider(walletProvider)) throw new NotWaasWalletProviderError({ walletProviderKey });
+			walletProviderMap.set(walletProviderKey, walletProvider);
+		}
+	}
+	await Promise.all(filteredRequirements.map((requirement) => {
+		const walletProviderKey = formatWalletProviderKey({
+			chain: requirement.chain,
+			displayName: DYNAMIC_WAAS_METADATA.displayName,
+			walletProviderType: WalletProviderEnum.EmbeddedWallet
+		});
+		const walletProvider = walletProviderMap.get(walletProviderKey);
+		if (!walletProvider || !isWaasWalletProvider(walletProvider)) return Promise.resolve();
+		return walletProvider.createWalletAccount({
+			bitcoinConfig: requirement.bitcoinConfig,
+			password,
+			thresholdSignatureScheme
+		});
+	}));
+	await __refreshAuth_wrapped(client);
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/createWalletForBusinessAccount/createWalletForBusinessAccount.ts
+/**
+* Creates a WaaS wallet account owned directly by a business account, in one
+* step — the server seats the wallet's signer row against the business account
+* as it is minted, so no separate link call is needed.
+*
+* @example
+* ```ts
+* const wallet = await createWalletForBusinessAccount({
+*   businessAccountId: 'ba-1',
+*   chain: 'EVM',
+* });
+* ```
+*
+* @param params.businessAccountId - The business account that will own the wallet.
+* @param params.chain - The chain to create the wallet account for.
+* @param [params.password] - Optional password used to encrypt the user share.
+* @param [params.thresholdSignatureScheme] - The threshold signature scheme to use. (Default: TWO_OF_TWO)
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The created wallet account.
+* @notInstrumented
+*/
+const createWalletForBusinessAccount = async ({ businessAccountId, chain, password, thresholdSignatureScheme }, client = getDefaultClient()) => {
+	const wallet = await getWaasWalletProviderByChain({ chain }, client).createWalletAccount({
+		businessAccountId,
+		password,
+		thresholdSignatureScheme
+	});
+	await __refreshAuth_wrapped(client);
+	return wallet;
+};
+
+//#endregion
+//#region src/modules/waas/delegateWaasKeyShares/delegateWaasKeyShares.ts
+/**
+* Delegates cryptographic key shares for a WaaS wallet account.
+*
+* This function allows the delegation of key management responsibilities,
+* enabling distributed key management for enhanced security.
+*
+* @param params.walletAccount - The WaaS wallet account to delegate shares for.
+* @param [params.password] - Optional password for key share operations.
+* @param [params.initialSignerRules] - Optional policy rules used to seed the delegated signer's policy layer at delegation time.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the key delegation is complete.
+* @notInstrumented
+*/
+const delegateWaasKeyShares = async ({ initialSignerRules, password, walletAccount }, client = getDefaultClient()) => {
+	await getWaasWalletProviderFromWalletAccount({ walletAccount }, client).delegateKeyShares({
+		initialSignerRules,
+		password,
+		walletAccount
+	});
+	await __refreshAuth_wrapped(client);
+};
+
+//#endregion
+//#region src/modules/waas/policies/findMatchedRuleKind/findMatchedRuleKind.ts
+const COUPLED_RULE_KINDS = new Set(["allowAddresses", "maxAmountPerTransaction"]);
+const isBlocked = ({ claimedKinds, populatedKeys }) => populatedKeys.some((key) => claimedKinds.has(key) || COUPLED_RULE_KINDS.has(key) && [...COUPLED_RULE_KINDS].some((coupledKey) => claimedKinds.has(coupledKey)));
+/**
+* Finds the first {@link RULE_KINDS} entry that recognizes `entry` as its
+* kind without colliding with an already-claimed key. Must check every key
+* `readRule` would populate, not just this kind's own key — allowAddresses'
+* `readRule` also populates `maxAmountPerTransaction` when the rule carries
+* a merged cap, so accepting it while that key is already claimed would
+* overwrite an earlier standalone cap.
+* @notInstrumented
+*/
+const findMatchedRuleKind = ({ claimedKinds, entry }) => {
+	for (const key of RULE_KIND_KEYS) {
+		const readResult = RULE_KINDS[key].readRule(entry);
+		if (readResult === void 0) continue;
+		if (!isBlocked({
+			claimedKinds,
+			populatedKeys: Object.keys(readResult)
+		})) return {
+			kind: key,
+			readResult
+		};
+	}
+};
+
+//#endregion
+//#region src/modules/waas/policies/isPolicyRuleDeletionMarker/isPolicyRuleDeletionMarker.ts
+/** The exact key set of a deletion marker — checked as a closed shape, not by presence alone. */
+const DELETION_MARKER_KEYS = new Set([
+	"ruleId",
+	"deletedByType",
+	"deletedById"
+]);
+/**
+* Recognizes a policy-Layer deletion marker — the enclave's stand-in for a
+* rule it couldn't drop outright, kept so the removal stays attributable.
+* Matches on the entry's exact key set, not field presence, since the read
+* response types every entry as a live rule.
+*
+* @param entry - The raw policy-Layer rule entry to check.
+* @returns Whether `entry` is a deletion marker rather than a live rule.
+* @notInstrumented
+*/
+const isPolicyRuleDeletionMarker = (entry) => {
+	const candidate = entry;
+	return typeof candidate.ruleId === "string" && typeof candidate.deletedByType === "string" && typeof candidate.deletedById === "string" && Object.keys(entry).every((key) => DELETION_MARKER_KEYS.has(key));
+};
+
+//#endregion
+//#region src/modules/waas/policies/desugarPolicyRules/desugarPolicyRules.ts
+/**
+* Reverses {@link expandPolicyRules} using {@link findMatchedRuleKind}'s
+* same rule-kind table, skipping deletion markers. A kind claims at most
+* one rule; extra matches, out-of-vocabulary fields, and per-rule
+* `modifiableBySigner` grants (no sugar representation) all go to
+* `unmapped` instead of being dropped.
+*
+* @param params.entries - The policy-Layer's rule entries, as returned in `layerContent.rules`.
+* @returns The recognized rules as a {@link PolicyRules} map, plus whatever wasn't recognized.
+* @notInstrumented
+*/
+const desugarPolicyRules = ({ entries }) => {
+	const rules = {};
+	const unmapped = [];
+	const claimedKinds = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		if (isPolicyRuleDeletionMarker(entry)) continue;
+		if (entry.modifiableBySigner === true) {
+			unmapped.push(entry);
+			continue;
+		}
+		const matched = findMatchedRuleKind({
+			claimedKinds,
+			entry
+		});
+		if (matched === void 0) {
+			unmapped.push(entry);
+			continue;
+		}
+		const { kind, readResult } = matched;
+		Object.assign(rules, readResult);
+		for (const key of Object.keys(readResult)) claimedKinds.add(key);
+		if (entry.name !== DEFAULT_POLICY_RULE_NAMES[kind]) rules.names = {
+			...rules.names,
+			[kind]: entry.name
+		};
+	}
+	return {
+		rules,
+		unmapped
+	};
+};
+
+//#endregion
+//#region src/modules/waas/exportWaasClientKeyshares/exportWaasClientKeyshares.ts
+/**
+* Exports the client-side key shares for a WaaS wallet account.
+*
+* This function retrieves the cryptographic key shares that are stored
+* on the client side for backup or migration purposes.
+*
+* @param params.walletAccount - The WaaS wallet account to export shares from.
+* @param [params.password] - Optional password to encrypt the exported shares.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves to the exported key shares.
+* @notInstrumented
+*/
+const exportWaasClientKeyshares = async ({ password, walletAccount }, client = getDefaultClient()) => {
+	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).exportClientKeyshares({
+		password,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/waas/exportWaasPrivateKey/exportWaasPrivateKey.ts
+/**
+* Exports the private key for a WaaS wallet account with secure display.
+*
+* This function reveals the private key for a WaaS wallet and displays it
+* securely within an iframe dynamically inserted into the specified HTML container element.
+*
+* @param params.walletAccount - The WaaS wallet account to export the private key from.
+* @param params.displayContainer - The HTML element where the iframe will be injected.
+* @param [params.password] - Optional password to decrypt the private key.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the private key export is complete.
+* @notInstrumented
+*/
+const exportWaasPrivateKey = async ({ displayContainer, password, walletAccount }, client = getDefaultClient()) => {
+	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).exportPrivateKey({
+		displayContainer,
+		password,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/waas/policies/getAccountPolicyLayer/getAccountPolicyLayer.ts
+/**
+* Fetches a business account's active policy rules (the account-Layer).
+* BA owner/admin only. Calls the SDK API directly (no MPC step), so a
+* rejection surfaces as a thrown error.
+*
+* @param params.businessAccountId - The business account to read policy rules for.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The account-Layer, including its current rules.
+* @notInstrumented
+*/
+const getAccountPolicyLayer = async ({ businessAccountId }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	return createApiClient({}, client).getBusinessAccountPolicyLayer({
+		businessAccountId,
+		environmentId: core.environmentId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/getBusinessAccount/getBusinessAccount.ts
+/**
+* Retrieves a business account by ID, including its members, signers, and wallets.
+*
+* @param params.businessAccountId - The ID of the business account to retrieve.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The business account with its members, signers, and wallets.
+* @notInstrumented
+*/
+const getBusinessAccount = async ({ businessAccountId }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	return await createApiClient({}, client).sdkGetBusinessAccountById({
+		businessAccountId,
+		environmentId: core.environmentId
+	});
+};
+
+//#endregion
+//#region src/modules/wallets/userHasEmbeddedWalletForChain/userHasEmbeddedWalletForChain.ts
+/** @notInstrumented */
+const userHasEmbeddedWalletForChain = ({ user, chain }) => {
+	return user.verifiedCredentials.some((vc) => vc.walletProvider === WalletProviderEnum.EmbeddedWallet && vc.chain && getChainFromVerifiedCredentialChain(vc.chain) === chain);
+};
+
+//#endregion
+//#region src/modules/waas/getChainsMissingWaasWalletAccounts/getChainsMissingWaasWalletAccounts.ts
+/**
+* Gets all chains missing a waas wallet account for the current user.
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns An array of all chains that have waas wallet accounts enabled
+* but for which the current user does not yet have an embedded wallet account.
+* @notInstrumented
+*/
+const getChainsMissingWaasWalletAccounts = (client = getDefaultClient()) => {
+	const projectSettings = client.projectSettings;
+	assertDefined(projectSettings, "Project settings are not available");
+	const embeddedWalletSettings = projectSettings.sdk.embeddedWallets;
+	const isWaasEnabled = isDynamicWaasEnabled(client);
+	const user = client.user;
+	if (!user || !isWaasEnabled) return [];
+	return (embeddedWalletSettings?.chainConfigurations?.filter((chain) => chain.enabled) ?? []).map((chain) => chain.name).filter((chain) => !userHasEmbeddedWalletForChain({
+		chain,
+		user
+	}));
+};
+
+//#endregion
+//#region src/modules/waas/policies/getPolicy/getPolicy.ts
+/**
+* Fetches a policy layer and reads its `chain`/`chainIds` scope back into
+* the {@link PolicyRules} sugar map (see {@link desugarPolicyRules}). A
+* layer can hold rules for more than one chain, so entries are narrowed to
+* `chain`/`chainIds` first — the same scoping {@link createPolicy} uses —
+* to keep the `getPolicy` → edit → `createPolicy` round-trip safe for
+* multi-chain wallets. Calls the SDK API directly (no MPC step), so a
+* rejection surfaces as a thrown error.
+*
+* @param params.scope - Which policy layer to read — see {@link resolvePolicyScope}.
+* @param params.chain - The chain to read rules for.
+* @param params.chainIds - The chain ids to read rules for; omit to read the wildcard rule matching every chain id of `chain`.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The recognized rules as a {@link PolicyRules} map, whatever wasn't recognized within `chain`/`chainIds`, and the layer's id and last-updated timestamp.
+* @throws Via {@link resolvePolicyScope}'s scope-resolution errors.
+* @notInstrumented
+*/
+const getPolicy = async ({ chain, chainIds, scope }, client = getDefaultClient()) => {
+	const normalizedChainIds = chainIds ?? [];
+	const layer = await getResolvedPolicyLayer({ resolvedScope: resolvePolicyScope({ scope }, client) }, client);
+	const { rules, unmapped } = desugarPolicyRules({ entries: (layer.layerContent.rules ?? []).filter((entry) => entry.chain === chain && sameChainIds({
+		existing: entry.chainIds,
+		requested: normalizedChainIds
+	})) });
+	return {
+		layerId: layer.layerId,
+		rules,
+		unmapped,
+		updatedAt: layer.updatedAt
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/getSignerPolicyLayer/getSignerPolicyLayer.ts
+/**
+* Fetches a signer's active policy rules (the signer-Layer) — the caller's
+* own active share set by default, or another share set on the same wallet
+* (e.g. a delegated share set) when `shareSetId` is given. Calls the SDK API
+* directly (no MPC step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account whose signer-Layer to read.
+* @param [params.shareSetId] - The share set to target; defaults to the caller's own.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The signer-Layer, including its current rules.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const getSignerPolicyLayer = async ({ shareSetId, walletAccount }, client = getDefaultClient()) => {
+	assertDefined(walletAccount.verifiedCredentialId, "getSignerPolicyLayer: cannot resolve a wallet id — use a verified wallet account");
+	const core = getCore(client);
+	return createApiClient({}, client).getWaasSignerSelfPolicyLayer({
+		environmentId: core.environmentId,
+		shareSetId,
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/getWalletAccountShareSets/getWalletAccountShareSets.ts
+/**
+* No network request. Share set ids rotate on refresh/reshare (stale ids are
+* rejected server-side), so re-read rather than cache; non-WaaS accounts
+* return `{ own: undefined, others: [] }` instead of throwing.
+*
+* @param params.walletAccount - The WaaS wallet account whose share sets to read.
+* @returns The account's own share set (if any) and the wallet's other active share sets.
+* @notInstrumented
+*/
+const getWalletAccountShareSets = ({ walletAccount }) => {
+	const own = walletAccount.shareSetId ? {
+		shareSetId: walletAccount.shareSetId,
+		shareSetType: walletAccount.shareSetType
+	} : void 0;
+	return {
+		others: walletAccount.otherShareSets ?? [],
+		own
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/getWalletPolicyLayer/getWalletPolicyLayer.ts
+/**
+* Fetches a wallet's active policy rules (the wallet-Layer). Calls the SDK
+* API directly (no MPC step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account to read policy rules for.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The wallet-Layer, including its current rules.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const getWalletPolicyLayer = async ({ walletAccount }, client = getDefaultClient()) => {
+	assertDefined(walletAccount.verifiedCredentialId, "getWalletPolicyLayer: cannot resolve a wallet id — use a verified wallet account");
+	const core = getCore(client);
+	return createApiClient({}, client).getWaasWalletSelfPolicyLayer({
+		environmentId: core.environmentId,
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/getWalletRecoveryState/getWalletRecoveryState.ts
+/**
+* Retrieves the recovery state of a WaaS wallet account.
+*
+* @param params.walletAccount - The WaaS wallet account to get the recovery state for.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves with the wallet recovery state.
+* @notInstrumented
+*/
+const getWalletRecoveryState = async ({ walletAccount }, client = getDefaultClient()) => {
+	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).getWalletRecoveryState({ walletAccount });
+};
+
+//#endregion
+//#region src/modules/waas/hasDelegatedAccess/hasDelegatedAccess.ts
+/**
+* Checks if a WaaS wallet account has delegated access.
+*
+* @param params.walletAccount - The WaaS wallet account to check for delegated access.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns True if the wallet account has delegated access, false otherwise.
+* @notInstrumented
+*/
+const hasDelegatedAccess = ({ walletAccount }, client = getDefaultClient()) => {
+	const verifiedCredential = getVerifiedCredentialForWalletAccount({ walletAccount }, client);
+	assertDefined(verifiedCredential, "Verified credential not found for Waas wallet account");
+	const hasDelegatedKeyShare = verifiedCredential.walletProperties?.keyShares?.some((keyShare) => keyShare.backupLocation === "delegated");
+	const hasDelegatedShareSet = verifiedCredential.walletProperties?.otherShareSets?.some((shareSet) => shareSet.shareSetType === WaasWalletShareSetType.Delegated);
+	return Boolean(hasDelegatedKeyShare || hasDelegatedShareSet);
+};
+
+//#endregion
+//#region src/modules/waas/importWaasPrivateKey/importWaasPrivateKey.ts
+/**
+* Imports an existing private key to create a new WaaS wallet account.
+*
+* This function allows users to import their existing private key into
+* Dynamic's WaaS infrastructure for secure management.
+*
+* @param params.chain - The chain for the imported wallet.
+* @param params.privateKey - The private key to import.
+* @param [params.thresholdSignatureScheme] - Optional threshold signature scheme configuration. Default is TWO_OF_TWO.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the private key is successfully imported.
+* @notInstrumented
+*/
+const importWaasPrivateKey = async ({ chain, privateKey, thresholdSignatureScheme }, client = getDefaultClient()) => {
+	return getWaasWalletProviderByChain({ chain }, client).importPrivateKey({
+		privateKey,
+		thresholdSignatureScheme
+	});
+};
+
+//#endregion
+//#region src/modules/waas/isPasswordRequiredForWaasWallets/isPasswordRequiredForWaasWallets.ts
+/**
+* Checks if the user Waas wallets are password protected.
+*
+* If the user's Waas wallets are password protected, it means that user's will have to be prompted for a
+* password for the first wallet action that happens on each session.
+* The password is also required for creating any new Waas wallets.
+*
+* @param client - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns True if the user has any password protected Waas wallets, false otherwise
+* @notInstrumented
+*/
+const isPasswordRequiredForWaasWallets = (client = getDefaultClient()) => {
+	const { user } = client;
+	assertDefined(user, "User is not authenticated");
+	return user.verifiedCredentials.some((credential) => credential.walletProperties?.keyShares?.some((keyShare) => keyShare.passwordEncrypted));
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/listBusinessAccounts/listBusinessAccounts.ts
+/**
+* Lists the business accounts the current user is a member of, scoped to the
+* active project environment. Optionally filter by `externalRefs`.
+*
+* @param [params] - Optional filters.
+* @param [params.externalRefs] - Return only accounts whose externalRef is in this list.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A paginated list of business accounts.
+* @notInstrumented
+*/
+const listBusinessAccounts = async (params, client = getDefaultClient()) => {
+	const core = getCore(client);
+	return await createApiClient({}, client).sdkListBusinessAccounts({
+		environmentId: core.environmentId,
+		externalRef: params?.externalRefs
+	});
+};
+
+//#endregion
+//#region src/modules/waas/refreshWaasWalletAccountShares/refreshWaasWalletAccountShares.ts
+/**
+* Refreshes the cryptographic key shares for a WaaS wallet account.
+*
+* This function generates new key shares for the wallet while maintaining
+* the same threshold signature scheme.
+*
+* @param params.walletAccount - The WaaS wallet account to refresh shares for.
+* @param [params.password] - Optional password for key share operations.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the key shares are refreshed.
+* @notInstrumented
+*/
+const refreshWaasWalletAccountShares = async ({ walletAccount, password }, client = getDefaultClient()) => {
+	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).refreshWalletAccountShares({
+		password,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/waas/policies/removeAccountPolicyRule/removeAccountPolicyRule.ts
+/**
+* Removes a single rule from a business account's account-Layer. BA
+* owner/admin only. Calls the SDK API directly (no MPC step), so a
+* rejection surfaces as a thrown error.
+*
+* @param params.businessAccountId - The business account to remove the rule from.
+* @param params.ruleId - The id of the rule to remove.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The account-Layer as it stands after the rule is removed.
+* @notInstrumented
+*/
+const removeAccountPolicyRule = async ({ businessAccountId, ruleId }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	return createApiClient({}, client).updateBusinessAccountPolicyLayer({
+		businessAccountId,
+		environmentId: core.environmentId,
+		waasPolicyLayerUpdateRequest: {
+			op: WaasPolicyLayerUpdateRequestOpEnum.Remove,
+			ruleId
+		}
+	});
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/removeBusinessAccountMember/removeBusinessAccountMember.ts
+/**
+* Removes a member from a business account. Any signer rows the member held on
+* the account's wallets are torn down as part of the removal. The backend
+* refuses to remove the account's last owner.
+*
+* @param params.businessAccountId - The business account to remove the member from.
+* @param params.userId - The id of the user to remove.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The removed member.
+*
+* @example
+* ```ts
+* const detail = await getBusinessAccount({ businessAccountId });
+* const member = detail.members[0];
+* await removeBusinessAccountMember({
+*   businessAccountId,
+*   userId: member.userId,
+* });
+* ```
+*
+* @see addBusinessAccountMember
+* @see getBusinessAccount
+* @notInstrumented
+*/
+const removeBusinessAccountMember = async ({ businessAccountId, userId }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	const { member } = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountmemberremove }, client).sdkRemoveBusinessAccountMember({
+		businessAccountId,
+		environmentId: core.environmentId,
+		userId
+	});
+	return member;
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/removeBusinessAccountSigner/removeBusinessAccountSigner.ts
+/**
+* Removes a signer from a business-account wallet. This detaches the signer's
+* share set from the wallet — it does not run an MPC ceremony — so the removed
+* identity can no longer sign for that wallet. The backend refuses to remove
+* the last remaining signer on a wallet.
+*
+* @param params.businessAccountId - The business account the wallet belongs to.
+* @param params.walletId - The wallet the signer is attached to.
+* @param params.signerId - The id of the signer to remove (`BusinessAccountSigner.id`).
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The removed signer.
+*
+* @example
+* ```ts
+* const detail = await getBusinessAccount({ businessAccountId });
+* const signer = detail.signers[0];
+* await removeBusinessAccountSigner({
+*   businessAccountId,
+*   walletId: signer.walletId,
+*   signerId: signer.id,
+* });
+* ```
+*
+* @see addBusinessAccountSigner
+* @see getBusinessAccount
+* @notInstrumented
+*/
+const removeBusinessAccountSigner = async ({ businessAccountId, walletId, signerId }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	const { signer } = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountsignerremove }, client).sdkRemoveBusinessAccountSigner({
+		businessAccountId,
+		environmentId: core.environmentId,
+		signerId,
+		walletId
+	});
+	return signer;
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/removeBusinessAccountWallet/removeBusinessAccountWallet.ts
+/**
+* Removes a wallet from a business account (owner-/admin-only). The wallet and
+* all its associated signer rows are detached from the account. The backend
+* refuses to remove the last wallet on a business account.
+*
+* @param params.businessAccountId - The business account the wallet belongs to.
+* @param params.walletId - The wallet to remove (`BusinessAccountWallet.id`).
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The updated business account detail.
+*
+* @example
+* ```ts
+* const detail = await getBusinessAccount({ businessAccountId });
+* await removeBusinessAccountWallet({
+*   businessAccountId,
+*   walletId: detail.wallets[0].id,
+* });
+* ```
+*
+* @see addWalletToBusinessAccount
+* @see getBusinessAccount
+* @notInstrumented
+*/
+const removeBusinessAccountWallet = async ({ businessAccountId, walletId }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	const detail = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountwalletremove }, client).sdkRemoveBusinessAccountWallet({
+		businessAccountId,
+		environmentId: core.environmentId,
+		walletId
+	});
+	await __refreshAuth_wrapped(client);
+	return detail;
+};
+
+//#endregion
+//#region src/modules/waas/policies/buildOperationForExistingRule/buildOperationForExistingRule.ts
+/**
+* Builds the operation to remove or rebuild `existingRule` when the
+* caller's requested keys touch it — outright removal when every key it
+* covers is being removed, or an upsert of the rule rebuilt from its
+* remaining keys when only some are. Returns undefined when none of the
+* requested keys touch this rule, when it's outside the sugar vocabulary,
+* or when it can't be identified without a `ruleId`.
+*
+* @param params.chain - The chain the rule to remove/rebuild applies to.
+* @param params.chainIds - The chain ids the rule to remove/rebuild applies to.
+* @param params.existingRule - The existing layer rule to check.
+* @param params.rules - The sugar keys to remove.
+* @returns The operation for this rule, or undefined when it isn't touched.
+* @notInstrumented
+*/
+const buildOperationForExistingRule = ({ chain, chainIds, existingRule, rules }) => {
+	if (existingRule.ruleId === void 0) return;
+	const covered = readCoveredRule(existingRule);
+	if (covered === void 0) return;
+	const remainingKeys = covered.keys.filter((key) => !rules.includes(key));
+	if (remainingKeys.length === covered.keys.length) return;
+	if (remainingKeys.length === 0) return {
+		op: WaasPolicyLayerRuleOperationOpEnum.Remove,
+		ruleId: existingRule.ruleId
+	};
+	const remainingRules = {};
+	for (const key of remainingKeys) Object.assign(remainingRules, { [key]: covered.values[key] });
+	const [rebuiltRule] = expandPolicyRules({
+		chain,
+		chainIds,
+		rules: remainingRules
+	});
+	if (rebuiltRule === void 0) return;
+	const keepsName = readCoveredRule(rebuiltRule)?.kind === covered.kind;
+	return {
+		op: WaasPolicyLayerRuleOperationOpEnum.Upsert,
+		rule: {
+			...rebuiltRule,
+			name: keepsName ? existingRule.name ?? rebuiltRule.name : rebuiltRule.name,
+			ruleId: existingRule.ruleId
+		}
+	};
+};
+
+//#endregion
+//#region src/modules/waas/policies/removePolicyRules/removePolicyRules.ts
+/**
+* Removes the rules behind one or more {@link PolicyRules} keys from a
+* policy layer, in one atomic `batch` PATCH. For every existing rule the
+* given keys touch, either removes it outright or — when it also covers a
+* key the caller didn't ask to remove (e.g. an
+* `allowAddresses`+`maxAmountPerTransaction` rule with only the cap
+* removed) — rebuilds it from the remaining keys so that restriction
+* survives.
+*
+* @param params.scope - Which policy layer to update — see {@link resolvePolicyScope}.
+* @param params.chain - The chain the rules to remove apply to.
+* @param params.chainIds - The chain ids the rules to remove apply to; omit to target the wildcard rule that matches every chain id of `chain`.
+* @param params.rules - The sugar keys to remove.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The policy layer as it stands after the batch is applied.
+* @throws When none of the given keys match an existing rule for this chain scope, or via {@link resolvePolicyScope}'s scope-resolution errors.
+* @notInstrumented
+*/
+const removePolicyRules = async ({ chain, chainIds, rules, scope }, client = getDefaultClient()) => {
+	const normalizedChainIds = chainIds ?? [];
+	const resolvedScope = resolvePolicyScope({ scope }, client);
+	const operations = ((await getResolvedPolicyLayer({ resolvedScope }, client)).layerContent.rules ?? []).filter((existingRule) => existingRule.chain === chain && sameChainIds({
+		existing: existingRule.chainIds,
+		requested: normalizedChainIds
+	})).map((existingRule) => buildOperationForExistingRule({
+		chain,
+		chainIds: normalizedChainIds,
+		existingRule,
+		rules
+	})).filter((operation) => operation !== void 0);
+	if (operations.length === 0) throw new InvalidParamError("removePolicyRules: none of the given rule keys matched an existing rule for this scope");
+	return applyPolicyLayerBatch({
+		operations,
+		resolvedScope
+	}, client);
+};
+
+//#endregion
+//#region src/modules/waas/policies/removeSignerPolicyRule/removeSignerPolicyRule.ts
+/**
+* Removes a single rule from a signer's policy layer. Calls the SDK API
+* directly (no MPC step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account whose signer-Layer to update.
+* @param params.ruleId - The id of the rule to remove.
+* @param [params.shareSetId] - The share set to target; defaults to the caller's own. Only the wallet's own owner may target another share set.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The signer-Layer as it stands after the rule is removed.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const removeSignerPolicyRule = async ({ ruleId, shareSetId, walletAccount }, client = getDefaultClient()) => {
+	assertDefined(walletAccount.verifiedCredentialId, "removeSignerPolicyRule: cannot resolve a wallet id — use a verified wallet account");
+	const core = getCore(client);
+	return createApiClient({}, client).updateWaasSignerSelfPolicyLayer({
+		environmentId: core.environmentId,
+		waasSignerPolicyLayerUpdateRequest: {
+			op: WaasSignerPolicyLayerUpdateRequestOpEnum.Remove,
+			ruleId,
+			shareSetId
+		},
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/policies/removeWalletPolicyRule/removeWalletPolicyRule.ts
+/**
+* Removes a single rule from a wallet's policy layer. Calls the SDK API
+* directly (no MPC step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account to remove the rule from.
+* @param params.ruleId - The id of the rule to remove.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The wallet-Layer as it stands after the rule is removed.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const removeWalletPolicyRule = async ({ ruleId, walletAccount }, client = getDefaultClient()) => {
+	assertDefined(walletAccount.verifiedCredentialId, "removeWalletPolicyRule: cannot resolve a wallet id — use a verified wallet account");
+	const core = getCore(client);
+	return createApiClient({}, client).updateWaasWalletSelfPolicyLayer({
+		environmentId: core.environmentId,
+		waasPolicyLayerUpdateRequest: {
+			op: WaasPolicyLayerUpdateRequestOpEnum.Remove,
+			ruleId
+		},
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/revokeWaasDelegation/revokeWaasDelegation.ts
+/**
+* Revokes the delegation of a WaaS wallet account.
+*
+* @param params.walletAccount - The WaaS wallet account to revoke delegation for.
+* @param [params.password] - Optional password for delegation operations.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the delegation is revoked.
+* @notInstrumented
+*/
+const revokeWaasDelegation = async ({ password, walletAccount }, client = getDefaultClient()) => {
+	await getWaasWalletProviderFromWalletAccount({ walletAccount }, client).revokeDelegation({
+		password,
+		walletAccount
+	});
+	await __refreshAuth_wrapped(client);
+};
+
+//#endregion
+//#region src/modules/waas/setWaasWalletAccountPassword/setWaasWalletAccountPassword.ts
+/**
+* Sets a password for a WaaS wallet account.
+*
+* @param params.walletAccount - The WaaS wallet account to set the password for.
+* @param params.password - The password to set for the wallet.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the password is successfully set.
+* @notInstrumented
+*/
+const setWaasWalletAccountPassword = async ({ password, walletAccount }, client = getDefaultClient()) => {
+	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).setWaasWalletAccountPassword({
+		password,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/wallets/userHasExternalWallet/userHasExternalWallet.ts
+/** @notInstrumented */
+const userHasExternalWallet = (user) => {
+	return user?.verifiedCredentials.some((vc) => vc.format === JwtVerifiedCredentialFormatEnum.Blockchain && vc.walletProvider !== WalletProviderEnum.EmbeddedWallet);
+};
+
+//#endregion
+//#region src/modules/waas/shouldAutoCreateWalletForChain/shouldAutoCreateWalletForChain.ts
+/**
+* Checks if a WaaS wallet should be automatically created for the specified blockchain.
+*
+* This function determines whether the current user configuration and project
+* settings require automatic wallet creation for the given chain, considering
+* whether the user already has an embedded wallet for the enabled chains or an external wallet.
+*
+* @param params.chain - The blockchain network to check.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns True if a wallet should be auto-created for the chain, false otherwise.
+* @notInstrumented
+*/
+const shouldAutoCreateWalletForChain = ({ chain }, client = getDefaultClient()) => {
+	assertDefined(client.projectSettings, "Project settings are not available");
+	const embeddedWalletSettings = client.projectSettings.sdk.embeddedWallets;
+	if (!embeddedWalletSettings?.automaticEmbeddedWalletCreation || !client.user) return false;
+	const automaticEmbeddedWalletCreationForExternalEnabled = embeddedWalletSettings?.automaticEmbeddedWalletCreationForExternal;
+	if (!(!userHasExternalWallet(client.user) || automaticEmbeddedWalletCreationForExternalEnabled)) return false;
+	return getChainsMissingWaasWalletAccounts(client).includes(chain);
+};
+
+//#endregion
+//#region src/modules/waas/signSerializedTransaction/signSerializedTransaction.ts
+/**
+* No gas estimation, balance check, or broadcast — unlike `transferAmount`.
+* Useful for exercising WaaS policy enforcement in isolation.
+*
+* @param params.walletAccount - The wallet account to sign with.
+* @param params.serializedTransaction - The raw serialized transaction (e.g. viem's `serializeTransaction`).
+* @param [params.chainId] - The chain id, if required by the target chain's signer.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The raw signature.
+* @notInstrumented
+*/
+const signSerializedTransaction = async ({ chainId, serializedTransaction, walletAccount }, client = getDefaultClient()) => {
+	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).signSerializedTransaction({
+		chainId,
+		serializedTransaction,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/transferBusinessAccountOwnership/transferBusinessAccountOwnership.ts
+/**
+* Transfers ownership of a business account to another member. Owner-only: the
+* `newOwnerUserId` must already be a member, is promoted to owner, and the
+* current owner is atomically demoted to admin.
+*
+* @param params.businessAccountId - The business account whose ownership moves.
+* @param params.newOwnerUserId - The member to promote to owner.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The updated business account detail.
+*
+* @example
+* ```ts
+* const detail = await getBusinessAccount({ businessAccountId });
+* const target = detail.members.find((m) => m.role === 'admin');
+* await transferBusinessAccountOwnership({
+*   businessAccountId,
+*   newOwnerUserId: target.userId,
+* });
+* ```
+*
+* @see getBusinessAccount
+* @notInstrumented
+*/
+const transferBusinessAccountOwnership = async ({ businessAccountId, newOwnerUserId }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	const detail = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccounttransferOwnership }, client).sdkTransferBusinessAccountOwnership({
+		businessAccountId,
+		environmentId: core.environmentId,
+		transferBusinessAccountOwnershipSdkRequest: { newOwnerUserId }
+	});
+	await __logoutWithReason_wrapped({ reason: "business-account-ownership-transferred" }, client);
+	return detail;
+};
+
+//#endregion
+//#region src/modules/waas/unlockWallet/unlockWallet.ts
+/**
+* Unlocks a WaaS wallet account.
+*
+* @param params.walletAccount - The WaaS wallet account to unlock.
+* @param params.password - The password to unlock the wallet.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves with the wallet information.
+* @notInstrumented
+*/
+const unlockWallet = async ({ password, walletAccount }, client = getDefaultClient()) => {
+	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).unlockWallet({
+		password,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/updateBusinessAccount/updateBusinessAccount.ts
+/**
+* Renames a business account (owner-/admin-only). Calls the SDK API directly
+* (no MPC step), so a rejection surfaces as a thrown error.
+*
+* @param params.businessAccountId - The business account to rename.
+* @param params.name - The new name.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The updated business account.
+*
+* @example
+* ```ts
+* await updateBusinessAccount({ businessAccountId, name: 'Acme Inc' });
+* ```
+*
+* @see getBusinessAccount
+* @notInstrumented
+*/
+const updateBusinessAccount = async ({ businessAccountId, name: name$1 }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	return await createApiClient({}, client).sdkUpdateBusinessAccount({
+		businessAccountId,
+		environmentId: core.environmentId,
+		updateBusinessAccountSdkRequest: { name: name$1 }
+	});
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/updateBusinessAccountMemberRole/updateBusinessAccountMemberRole.ts
+const ROLE_TO_API = {
+	admin: AssignableBusinessAccountMemberRole.Admin,
+	viewer: AssignableBusinessAccountMemberRole.Viewer
+};
+/**
+* Changes an existing member's role between `admin` and `viewer` (owner-/admin-only).
+* Owner is not assignable here — use `transferBusinessAccountOwnership` for that.
+*
+* @param params.businessAccountId - The business account the member belongs to.
+* @param params.userId - The member whose role changes.
+* @param params.role - The new role (`admin` or `viewer`).
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The updated business account member.
+*
+* @example
+* ```ts
+* await updateBusinessAccountMemberRole({
+*   businessAccountId,
+*   userId: member.userId,
+*   role: 'admin',
+* });
+* ```
+*
+* @see transferBusinessAccountOwnership
+* @see addBusinessAccountMember
+* @notInstrumented
+*/
+const updateBusinessAccountMemberRole = async ({ businessAccountId, userId, role }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	return await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountmemberroleupdate }, client).sdkUpdateBusinessAccountMemberRole({
+		businessAccountId,
+		environmentId: core.environmentId,
+		updateBusinessAccountMemberRoleSdkRequest: { role: ROLE_TO_API[role] },
+		userId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/updateWaasPassword/updateWaasPassword.ts
+/**
+* Updates the password for a WaaS wallet account.
+*
+* This function changes the password used to encrypt and protect the
+* cryptographic key shares for the specified wallet account.
+*
+* @param params.walletAccount - The WaaS wallet account to update the password for.
+* @param params.currentPassword - The current password for the wallet.
+* @param params.newPassword - The new password to set for the wallet.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns A promise that resolves when the password is successfully updated.
+* @notInstrumented
+*/
+const updateWaasPassword = async ({ currentPassword, newPassword, walletAccount }, client = getDefaultClient()) => {
+	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).updatePassword({
+		currentPassword,
+		newPassword,
+		walletAccount
+	});
+};
+
+//#endregion
+//#region src/modules/waas/policies/upsertAccountPolicyRule/upsertAccountPolicyRule.ts
+/**
+* Creates or updates a single rule on a business account's account-Layer
+* (rules applied to every wallet in the account). Build `rule` with
+* {@link buildAllowPolicyRule} / {@link buildDenyPolicyRule}. Omit
+* `rule.ruleId` to create a new rule (the enclave mints one for you); pass
+* an existing `ruleId` to update it in place. BA owner/admin only. Calls
+* the SDK API directly (no MPC step), so a rejection surfaces as a thrown
+* error.
+*
+* @param params.businessAccountId - The business account to apply the rule to.
+* @param params.rule - The rule to create or update.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The account-Layer as it stands after the rule is applied.
+* @notInstrumented
+*/
+const upsertAccountPolicyRule = async ({ businessAccountId, rule }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	return createApiClient({}, client).updateBusinessAccountPolicyLayer({
+		businessAccountId,
+		environmentId: core.environmentId,
+		waasPolicyLayerUpdateRequest: {
+			op: WaasPolicyLayerUpdateRequestOpEnum.Upsert,
+			rule
+		}
+	});
+};
+
+//#endregion
+//#region src/modules/waas/policies/upsertSignerPolicyRule/upsertSignerPolicyRule.ts
+/**
+* Creates or updates a single rule on a signer's policy layer. Build `rule`
+* with {@link buildAllowPolicyRule} / {@link buildDenyPolicyRule}. Omit
+* `rule.ruleId` to create a new rule (the enclave mints one for you); pass an
+* existing `ruleId` to update it in place. Calls the SDK API directly (no MPC
+* step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account whose signer-Layer to update.
+* @param params.rule - The rule to create or update.
+* @param [params.shareSetId] - The share set to target; defaults to the caller's own. Only the wallet's own owner may target another share set.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The signer-Layer as it stands after the rule is applied.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const upsertSignerPolicyRule = async ({ rule, shareSetId, walletAccount }, client = getDefaultClient()) => {
+	assertDefined(walletAccount.verifiedCredentialId, "upsertSignerPolicyRule: cannot resolve a wallet id — use a verified wallet account");
+	const core = getCore(client);
+	return createApiClient({}, client).updateWaasSignerSelfPolicyLayer({
+		environmentId: core.environmentId,
+		waasSignerPolicyLayerUpdateRequest: {
+			op: WaasSignerPolicyLayerUpdateRequestOpEnum.Upsert,
+			rule,
+			shareSetId
+		},
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/policies/upsertWalletPolicyRule/upsertWalletPolicyRule.ts
+/**
+* Creates or updates a single rule on a wallet's policy layer. Build `rule`
+* with {@link buildAllowPolicyRule} / {@link buildDenyPolicyRule}. Omit
+* `rule.ruleId` to create a new rule (the enclave mints one for you); pass an
+* existing `ruleId` to update it in place. Calls the SDK API directly (no MPC
+* step), so a rejection surfaces as a thrown error.
+*
+* @param params.walletAccount - The wallet account to apply the rule to.
+* @param params.rule - The rule to create or update.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The wallet-Layer as it stands after the rule is applied.
+* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
+* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
+* @notInstrumented
+*/
+const upsertWalletPolicyRule = async ({ rule, walletAccount }, client = getDefaultClient()) => {
+	assertDefined(walletAccount.verifiedCredentialId, "upsertWalletPolicyRule: cannot resolve a wallet id — use a verified wallet account");
+	const core = getCore(client);
+	return createApiClient({}, client).updateWaasWalletSelfPolicyLayer({
+		environmentId: core.environmentId,
+		waasPolicyLayerUpdateRequest: {
+			op: WaasPolicyLayerUpdateRequestOpEnum.Upsert,
+			rule
+		},
+		walletId: walletAccount.verifiedCredentialId
+	});
+};
+
+//#endregion
+//#region src/exports/waas.ts
+assertPackageVersion(name, version);
+
+//#endregion
+export { WaasWalletShareSetType$1 as $, getChainsMissingWaasWalletAccounts as A, isWalletCreationRequirement as B, importWaasPrivateKey as C, getWalletAccountShareSets as D, getWalletPolicyLayer as E, desugarPolicyRules as F, createBusinessAccount as G, createPolicy as H, delegateWaasKeyShares as I, backupWaasKeySharesToGoogleDrive as J, buildDenyPolicyRule as K, createWalletForBusinessAccount as L, getAccountPolicyLayer as M, exportWaasPrivateKey as N, getSignerPolicyLayer as O, exportWaasClientKeyshares as P, WaasChainEnum$1 as Q, createWaasWalletAccounts as R, isPasswordRequiredForWaasWallets as S, getWalletRecoveryState as T, resolvePolicyScope as U, createWaasOfflineRecoveryShares as V, expandPolicyRules as W, addBusinessAccountSigner as X, addWalletToBusinessAccount as Y, addBusinessAccountMember as Z, removeBusinessAccountSigner as _, updateBusinessAccountMemberRole as a, refreshWaasWalletAccountShares as b, transferBusinessAccountOwnership as c, setWaasWalletAccountPassword as d, revokeWaasDelegation as f, removeBusinessAccountWallet as g, removePolicyRules as h, updateWaasPassword as i, getBusinessAccount as j, getPolicy as k, signSerializedTransaction as l, removeSignerPolicyRule as m, upsertSignerPolicyRule as n, updateBusinessAccount as o, removeWalletPolicyRule as p, buildAllowPolicyRule as q, upsertAccountPolicyRule as r, unlockWallet as s, upsertWalletPolicyRule as t, shouldAutoCreateWalletForChain as u, removeBusinessAccountMember as v, hasDelegatedAccess as w, listBusinessAccounts as x, removeAccountPolicyRule as y, normalizeWalletRequirements as z };
+//# sourceMappingURL=waas-CUDgU2pl.esm.js.map