@dynamic-labs-sdk/client 1.30.2 → 1.31.0

package/dist/waas.esm.js

@@ -1,2127 +1,6 @@
-import { Ct as name, F as getChainFromVerifiedCredentialChain, K as createApiClient, M as getWalletAccounts, N as formatWalletProviderKey, O as NoWalletProviderFoundError, St as getCore, a as InvalidParamError, c as findWaasWalletProviderByChain, f as DYNAMIC_WAAS_METADATA, ft as assertDefined, h as __logoutWithReason_wrapped, l as isWaasWalletProvider, s as isWaasWalletAccount, vt as getDefaultClient, wt as version } from "./updateAuthFromVerifyResponse-BLgNMqwN.esm.js";
-import { i as __refreshAuth_wrapped, n as TransactionBroadcastError, t as isDynamicWaasEnabled } from "./isDynamicWaasEnabled-DYORq7Jc.esm.js";
-import { n as getVerifiedCredentialForWalletAccount, t as getWalletProviderByKey } from "./getWalletProviderByKey-xqyD3ybv.esm.js";
-import { n as getWaasWalletProviderFromWalletAccount, r as NotWaasWalletProviderError, t as migrateFromFireblocks } from "./migrateFromFireblocks-D4E9bT2H.esm.js";
-import { assertPackageVersion } from "@dynamic-labs-sdk/assert-package-version";
-import { AssignableBusinessAccountMemberRole, JwtVerifiedCredentialFormatEnum, TokenScope, UserIdentifierTypeEnum, WaasPolicyLayerRuleOperationOpEnum, WaasPolicyLayerUpdateRequestOpEnum, WaasPolicyRuleType, WaasSignerPolicyLayerUpdateRequestOpEnum, WaasWalletShareSetType, WaasWalletShareSetType as WaasWalletShareSetType$1, WalletProviderEnum } from "@dynamic-labs/sdk-api-core";
+import { w as isWaasWalletAccount } from "./logoutWithReason-DV89zJmJ.esm.js";
+import { a as TransactionBroadcastError, n as isDynamicWaasEnabled, o as NotWaasWalletProviderError, t as migrateFromFireblocks } from "./migrateFromFireblocks-CiOS4_Nq.esm.js";
+import { $ as WaasWalletShareSetType, A as getChainsMissingWaasWalletAccounts, B as isWalletCreationRequirement, C as importWaasPrivateKey, D as getWalletAccountShareSets, E as getWalletPolicyLayer, F as desugarPolicyRules, G as createBusinessAccount, H as createPolicy, I as delegateWaasKeyShares, J as backupWaasKeySharesToGoogleDrive, K as buildDenyPolicyRule, L as createWalletForBusinessAccount, M as getAccountPolicyLayer, N as exportWaasPrivateKey, O as getSignerPolicyLayer, P as exportWaasClientKeyshares, Q as WaasChainEnum, R as createWaasWalletAccounts, S as isPasswordRequiredForWaasWallets, T as getWalletRecoveryState, U as resolvePolicyScope, V as createWaasOfflineRecoveryShares, W as expandPolicyRules, X as addBusinessAccountSigner, Y as addWalletToBusinessAccount, Z as addBusinessAccountMember, _ as removeBusinessAccountSigner, a as updateBusinessAccountMemberRole, b as refreshWaasWalletAccountShares, c as transferBusinessAccountOwnership, d as setWaasWalletAccountPassword, f as revokeWaasDelegation, g as removeBusinessAccountWallet, h as removePolicyRules, i as updateWaasPassword, j as getBusinessAccount, k as getPolicy, l as signSerializedTransaction, m as removeSignerPolicyRule, n as upsertSignerPolicyRule, o as updateBusinessAccount, p as removeWalletPolicyRule, q as buildAllowPolicyRule, r as upsertAccountPolicyRule, s as unlockWallet, t as upsertWalletPolicyRule, u as shouldAutoCreateWalletForChain, v as removeBusinessAccountMember, w as hasDelegatedAccess, x as listBusinessAccounts, y as removeAccountPolicyRule, z as normalizeWalletRequirements } from "./waas-CUDgU2pl.esm.js";
+import "./getVerifiedCredentialForWalletAccount-Cjwoeej7.esm.js";
 
-//#region src/modules/waas/businessAccounts/assertTargetIdentity.ts
-/**
-* Asserts a {@link TargetIdentity} resolves to a user: a `userId`, or an
-* `identifier` with its `identifierType`. Throws otherwise.
-*
-* @notInstrumented
-*/
-const assertTargetIdentity = ({ fnName, targetIdentity }) => {
-	const hasUserId = Boolean(targetIdentity.userId);
-	const hasIdentifier = Boolean(targetIdentity.identifier && targetIdentity.identifierType);
-	if (!hasUserId && !hasIdentifier) throw new InvalidParamError(`${fnName}: targetIdentity must provide a userId, or an identifier with its identifierType`);
-};
-
-//#endregion
-//#region src/modules/waas/businessAccounts/businessAccounts.constants.ts
-/** Maps the SDK's identifier-type union to the generated API enum. */
-const IDENTIFIER_TYPE_TO_API = {
-	email: UserIdentifierTypeEnum.Email,
-	externalUserId: UserIdentifierTypeEnum.ExternalUserId,
-	id: UserIdentifierTypeEnum.Id,
-	phoneNumber: UserIdentifierTypeEnum.PhoneNumber,
-	socialAccountId: UserIdentifierTypeEnum.SocialAccountId,
-	socialUsername: UserIdentifierTypeEnum.SocialUsername
-};
-
-//#endregion
-//#region src/modules/waas/businessAccounts/addBusinessAccountMember/addBusinessAccountMember.ts
-/**
-* Adds a member to an existing business account. Identify the target with a
-* `targetIdentity`: a known `userId`, or an `identifier` + `identifierType`
-* (e.g. an email — the user is created if absent).
-*
-* Calls the SDK API directly (not the WaaS iframe): this is a server-state
-* mutation with no MPC step, so a rejection (e.g. a 422 resource-limit) surfaces
-* as a thrown error rather than stalling in the iframe bridge.
-*
-* @param params.businessAccountId - The ID of the business account.
-* @param params.targetIdentity - The member to add (userId, or identifier + identifierType).
-* @param [params.role] - The member role (`admin` or `viewer`). Defaults to `viewer`.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The created business account member.
-* @notInstrumented
-*/
-const addBusinessAccountMember = async ({ businessAccountId, targetIdentity, role }, client = getDefaultClient()) => {
-	assertTargetIdentity({
-		fnName: "addBusinessAccountMember",
-		targetIdentity
-	});
-	const core = getCore(client);
-	const apiClient = createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountmemberadd }, client);
-	const { userId, identifier, identifierType, socialProvider, smsCountryCode } = targetIdentity;
-	return await apiClient.sdkAddBusinessAccountMember({
-		addBusinessAccountMemberSdkRequest: {
-			identifier,
-			role: role === "admin" ? AssignableBusinessAccountMemberRole.Admin : AssignableBusinessAccountMemberRole.Viewer,
-			smsCountryCode,
-			socialProvider,
-			type: identifierType ? IDENTIFIER_TYPE_TO_API[identifierType] : void 0,
-			userId
-		},
-		businessAccountId,
-		environmentId: core.environmentId
-	});
-};
-
-//#endregion
-//#region src/modules/waas/getWaasWalletProviderByChain/getWaasWalletProviderByChain.ts
-/** @notInstrumented */
-const getWaasWalletProviderByChain = ({ chain }, client) => {
-	const waasProvider = findWaasWalletProviderByChain({ chain }, client);
-	if (!waasProvider) throw new NoWalletProviderFoundError({ walletProviderKey: formatWalletProviderKey({
-		chain,
-		displayName: DYNAMIC_WAAS_METADATA.displayName,
-		walletProviderType: WalletProviderEnum.EmbeddedWallet
-	}) });
-	return waasProvider;
-};
-
-//#endregion
-//#region src/modules/waas/businessAccounts/addBusinessAccountSigner/addBusinessAccountSigner.ts
-/**
-* Adds a signer to a business-account wallet via the reshare ceremony, minting
-* the new signer's share set. Identify the target by `userId`, or `identifier`
-* + `identifierType` (the user is created if absent).
-*
-* Omit `businessAccountId` to add a signer to a wallet that isn't in a business
-* account yet: the wallet's per-account is found-or-created first (idempotent —
-* converts the personal wallet, seating its owner as the first signer), then
-* the new signer is reshared in.
-*
-* @param params.walletAccount - The wallet account to add the signer to.
-* @param [params.businessAccountId] - The business account; found-or-created when omitted.
-* @param [params.walletId] - The wallet UUID to link when finding-or-creating; defaults to `walletAccount.verifiedCredentialId`.
-* @param params.targetIdentity - The signer to add (userId, or identifier + identifierType).
-* @param [params.signerType] - `endUser` (default) or `server`.
-* @param [params.password] - Password for the reshare, if the wallet is password-encrypted.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The new signer's share set id.
-* @notInstrumented
-*/
-const addBusinessAccountSigner = async ({ walletAccount, businessAccountId, walletId, targetIdentity, signerType, password }, client = getDefaultClient()) => {
-	assertTargetIdentity({
-		fnName: "addBusinessAccountSigner",
-		targetIdentity
-	});
-	if (walletAccount.businessAccountId) assertDefined(businessAccountId, "addBusinessAccountSigner: this wallet is already part of a business account");
-	let resolvedBusinessAccountId = businessAccountId;
-	if (!resolvedBusinessAccountId) {
-		const linkWalletId = walletId ?? walletAccount.verifiedCredentialId;
-		assertDefined(linkWalletId, "addBusinessAccountSigner: cannot resolve a wallet id to link — pass walletId, or use a verified wallet account");
-		const core = getCore(client);
-		resolvedBusinessAccountId = (await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountsigneradd }, client).sdkLinkBusinessAccountWallet({
-			environmentId: core.environmentId,
-			linkBusinessAccountWalletSdkRequest: { walletId: linkWalletId }
-		})).id;
-	}
-	const result = await getWaasWalletProviderByChain({ chain: walletAccount.chain }, client).reshareToNewSignerShareSet({
-		businessAccountId: resolvedBusinessAccountId,
-		password,
-		signerType,
-		targetSignerIdentity: targetIdentity,
-		walletAccount
-	});
-	await __refreshAuth_wrapped(client);
-	return result;
-};
-
-//#endregion
-//#region src/modules/waas/businessAccounts/addWalletToBusinessAccount/addWalletToBusinessAccount.ts
-/**
-* Links a wallet to a business account, or omit `businessAccountId` to
-* find-or-create the per-wallet business account (the server seats the wallet's
-* owner as the first member/signer).
-*
-* Calls the SDK API directly (not the WaaS iframe): this is a server-state
-* mutation with no MPC step, so a rejection (e.g. a 422 resource-limit) surfaces
-* as a thrown error rather than stalling in the iframe bridge.
-*
-* @param [params.businessAccountId] - The business account to link to; found-or-created when omitted.
-* @param params.walletId - The ID of the wallet to link.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The updated business account detail.
-* @notInstrumented
-*/
-const addWalletToBusinessAccount = async ({ businessAccountId, walletId }, client = getDefaultClient()) => {
-	const core = getCore(client);
-	const detail = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountlinkWallet }, client).sdkLinkBusinessAccountWallet({
-		environmentId: core.environmentId,
-		linkBusinessAccountWalletSdkRequest: {
-			businessAccountId,
-			walletId
-		}
-	});
-	await __refreshAuth_wrapped(client);
-	return detail;
-};
-
-//#endregion
-//#region src/modules/waas/backupWaasKeySharesToGoogleDrive/backupWaasKeySharesToGoogleDrive.ts
-/**
-* Backs up WaaS wallet key shares to Google Drive for secure recovery.
-*
-* This function creates a backup of the wallet's cryptographic key shares
-* to Google Drive, allowing users to recover their wallet later.
-*
-* @param params.walletAccount - The WaaS wallet account to backup.
-* @param [params.password] - Optional password to encrypt the backup.
-* @param [params.googleDriveAccessToken] - Optional consumer-supplied Drive-scoped access token; used directly instead of the stored OAuth token (avoids a second Google consent). Useful for external-auth setups.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A promise that resolves when the backup process is complete.
-* @notInstrumented
-*/
-const backupWaasKeySharesToGoogleDrive = async ({ googleDriveAccessToken, password, walletAccount }, client = getDefaultClient()) => {
-	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).backupKeySharesToGoogleDrive({
-		googleDriveAccessToken,
-		password,
-		walletAccount
-	});
-};
-
-//#endregion
-//#region src/modules/waas/policies/buildAllowPolicyRule/buildAllowPolicyRule.ts
-/**
-* Builds a policy rule that permits the described action.
-*
-* @param rule - The rule fields (name, chain, and any targeting/limit fields).
-* @returns A `WaasPolicyRule` with `ruleType` set to `allow`.
-* @notInstrumented
-*/
-const buildAllowPolicyRule = (rule) => ({
-	...rule,
-	ruleType: WaasPolicyRuleType.Allow
-});
-
-//#endregion
-//#region src/modules/waas/policies/buildDenyPolicyRule/buildDenyPolicyRule.ts
-/**
-* Builds a policy rule that blocks the described action.
-*
-* @param rule - The rule fields (name, chain, and any targeting/limit fields).
-* @returns A `WaasPolicyRule` with `ruleType` set to `deny`.
-* @notInstrumented
-*/
-const buildDenyPolicyRule = (rule) => ({
-	...rule,
-	ruleType: WaasPolicyRuleType.Deny
-});
-
-//#endregion
-//#region src/modules/waas/businessAccounts/createBusinessAccount/createBusinessAccount.ts
-/**
-* Creates a new business account.
-*
-* @param [params] - Optional parameters for the business account.
-* @param [params.name] - Optional name for the business account.
-* @param [params.externalRef] - Optional developer-supplied label (not unique; accounts may share one).
-* @param [params.metadata] - Optional arbitrary key-value metadata.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The created business account.
-* @notInstrumented
-*/
-const createBusinessAccount = async (params, client = getDefaultClient()) => {
-	const core = getCore(client);
-	const result = await createApiClient({}, client).sdkCreateBusinessAccount({
-		createBusinessAccountSdkRequest: {
-			externalRef: params?.externalRef,
-			metadata: params?.metadata,
-			name: params?.name
-		},
-		environmentId: core.environmentId
-	});
-	await __refreshAuth_wrapped(client);
-	return result;
-};
-
-//#endregion
-//#region src/modules/waas/policies/applyPolicyLayerBatch/applyPolicyLayerBatch.ts
-/**
-* Applies a batch of rule operations to the policy layer a
-* {@link ResolvedPolicyScope} points at, atomically in one enclave cycle.
-* Shared by {@link createPolicy} and {@link removePolicyRules} so the
-* account-vs-wallet-vs-signer branch is written once.
-*
-* @notInstrumented
-*/
-const applyPolicyLayerBatch = ({ operations, resolvedScope }, client) => {
-	const { environmentId } = getCore(client);
-	const apiClient = createApiClient({}, client);
-	switch (resolvedScope.target) {
-		case "account": return apiClient.updateBusinessAccountPolicyLayer({
-			businessAccountId: resolvedScope.businessAccountId,
-			environmentId,
-			waasPolicyLayerUpdateRequest: {
-				op: WaasPolicyLayerUpdateRequestOpEnum.Batch,
-				operations
-			}
-		});
-		case "wallet": return apiClient.updateWaasWalletSelfPolicyLayer({
-			environmentId,
-			waasPolicyLayerUpdateRequest: {
-				op: WaasPolicyLayerUpdateRequestOpEnum.Batch,
-				operations
-			},
-			walletId: resolvedScope.walletId
-		});
-		case "signer": return apiClient.updateWaasSignerSelfPolicyLayer({
-			environmentId,
-			waasSignerPolicyLayerUpdateRequest: {
-				op: WaasSignerPolicyLayerUpdateRequestOpEnum.Batch,
-				operations,
-				shareSetId: resolvedScope.shareSetId
-			},
-			walletId: resolvedScope.walletId
-		});
-		default: {
-			const unhandledScope = resolvedScope;
-			throw new InvalidParamError(`applyPolicyLayerBatch: unhandled target "${JSON.stringify(unhandledScope)}"`);
-		}
-	}
-};
-
-//#endregion
-//#region src/utils/objectKeys/objectKeys.ts
-/**
-* Typed `Object.keys` — returns `(keyof T)[]` instead of `string[]`, for
-* objects whose key set is fully known at the type level.
-*
-* @notInstrumented
-*/
-const objectKeys = (value) => Object.keys(value);
-
-//#endregion
-//#region src/modules/waas/policies/buildValueLimit/buildValueLimit.ts
-/**
-* Turns a {@link PolicyRuleMaxAmountPerTransaction} into the `valueLimit` shape a rule stores it as.
-* @notInstrumented
-*/
-const buildValueLimit = ({ amount, asset }) => ({
-	asset,
-	maxPerCall: amount
-});
-
-//#endregion
-//#region src/modules/waas/policies/policyRuleDefaultNames.ts
-/**
-* Each rule kind's name when the caller doesn't override it via
-* `PolicyRules['names']`. Shared between the `build*Rule` functions and
-* `desugarPolicyRules` so a rename can't drift the two out of sync — the
-* same reason `RULE_KINDS` in `policyRuleKinds.ts` is a single table
-* instead of parallel switches.
-*/
-const DEFAULT_POLICY_RULE_NAMES = {
-	allowAddresses: "Allowed addresses",
-	blockExport: "Block key export",
-	denyAddresses: "Denied addresses",
-	maxAmountPerTransaction: "Per-transaction cap"
-};
-
-//#endregion
-//#region src/modules/waas/policies/buildAllowAddressesRule/buildAllowAddressesRule.ts
-/**
-* Builds the `allowAddresses` rule, absorbing a sibling
-* `maxAmountPerTransaction` onto the same rule instead of letting it emit
-* its own — see `buildMaxAmountPerTransactionRule`.
-* @notInstrumented
-*/
-const buildAllowAddressesRule = ({ context: { chain, chainIds }, rules }) => {
-	if (!rules.allowAddresses || rules.allowAddresses.length === 0) return void 0;
-	return {
-		addresses: rules.allowAddresses,
-		chain,
-		chainIds,
-		name: rules.names?.allowAddresses ?? DEFAULT_POLICY_RULE_NAMES.allowAddresses,
-		ruleType: WaasPolicyRuleType.Allow,
-		...rules.maxAmountPerTransaction ? { valueLimit: buildValueLimit(rules.maxAmountPerTransaction) } : {}
-	};
-};
-
-//#endregion
-//#region src/modules/waas/policies/buildBlockExportRule/buildBlockExportRule.ts
-/**
-* Builds the `blockExport` rule. `deny`, not `allow`: an addressless
-* allow-rule normalizes to an empty allowed-set, denying every transaction.
-* `chain`/`chainIds` are stamped for consistency but the enforcement of a
-* `blockExport` `operationRestrictions` rule is wallet-wide, ignoring them.
-* @notInstrumented
-*/
-const buildBlockExportRule = ({ context: { chain, chainIds }, rules }) => {
-	if (rules.blockExport !== true) return void 0;
-	return {
-		chain,
-		chainIds,
-		name: rules.names?.blockExport ?? DEFAULT_POLICY_RULE_NAMES.blockExport,
-		operationRestrictions: { blockExport: true },
-		ruleType: WaasPolicyRuleType.Deny
-	};
-};
-
-//#endregion
-//#region src/modules/waas/policies/buildDenyAddressesRule/buildDenyAddressesRule.ts
-/**
-* Builds the `denyAddresses` rule. Independent of `allowAddresses`.
-* @notInstrumented
-*/
-const buildDenyAddressesRule = ({ context: { chain, chainIds }, rules }) => {
-	if (!rules.denyAddresses || rules.denyAddresses.length === 0) return void 0;
-	return {
-		addresses: rules.denyAddresses,
-		chain,
-		chainIds,
-		name: rules.names?.denyAddresses ?? DEFAULT_POLICY_RULE_NAMES.denyAddresses,
-		ruleType: WaasPolicyRuleType.Deny
-	};
-};
-
-//#endregion
-//#region src/modules/waas/policies/buildMaxAmountPerTransactionRule/buildMaxAmountPerTransactionRule.ts
-/**
-* Builds the standalone `maxAmountPerTransaction` rule. Only fires when
-* `allowAddresses` didn't already absorb this cap onto its own rule. `deny`
-* for the same reason as `blockExport`'s builder.
-* @notInstrumented
-*/
-const buildMaxAmountPerTransactionRule = ({ context: { chain, chainIds }, rules }) => {
-	const isAbsorbedByAllowAddresses = Boolean(rules.allowAddresses?.length);
-	if (!rules.maxAmountPerTransaction || isAbsorbedByAllowAddresses) return void 0;
-	return {
-		chain,
-		chainIds,
-		name: rules.names?.maxAmountPerTransaction ?? DEFAULT_POLICY_RULE_NAMES.maxAmountPerTransaction,
-		ruleType: WaasPolicyRuleType.Deny,
-		valueLimit: buildValueLimit(rules.maxAmountPerTransaction)
-	};
-};
-
-//#endregion
-//#region src/modules/waas/policies/hasAddresses/hasAddresses.ts
-/**
-* Checks both the current `addresses` array and the legacy singular `address` field.
-* @notInstrumented
-*/
-const hasAddresses = (rule) => rule.addresses !== void 0 && rule.addresses.length > 0 || rule.address != null;
-
-//#endregion
-//#region src/modules/waas/policies/hasUnrecognizedFields/hasUnrecognizedFields.ts
-const RECOGNIZED_TOP_LEVEL_KEY_SET = new Set([
-	"ruleId",
-	"name",
-	"ruleType",
-	"addresses",
-	"chain",
-	"chainIds",
-	"valueLimit",
-	"operationRestrictions"
-]);
-/**
-* @notInstrumented
-*/
-const hasUnrecognizedFields = (rule) => Object.keys(rule).some((key) => !RECOGNIZED_TOP_LEVEL_KEY_SET.has(key) && rule[key] != null) || rule.valueLimit?.totalLimit != null || rule.operationRestrictions?.blockRevocation != null || rule.operationRestrictions?.blockClientSigning != null;
-
-//#endregion
-//#region src/modules/waas/policies/readValueLimit/readValueLimit.ts
-/**
-* Reads a stored `valueLimit` back into a {@link PolicyRuleMaxAmountPerTransaction}.
-* @notInstrumented
-*/
-const readValueLimit = ({ asset, maxPerCall }) => ({
-	amount: maxPerCall,
-	...asset ? { asset } : {}
-});
-
-//#endregion
-//#region src/modules/waas/policies/readAllowAddressesRule/readAllowAddressesRule.ts
-/**
-* Recognizes an existing rule as `allowAddresses`, reading back a merged
-* `maxAmountPerTransaction` cap too when the rule carries one.
-* @notInstrumented
-*/
-const readAllowAddressesRule = (rule) => {
-	if (!(rule.ruleType === WaasPolicyRuleType.Allow && rule.operationRestrictions === void 0 && (rule.valueLimit === void 0 || rule.valueLimit.maxPerCall !== void 0) && hasAddresses(rule) && !hasUnrecognizedFields(rule))) return void 0;
-	return {
-		allowAddresses: rule.addresses,
-		...rule.valueLimit?.maxPerCall !== void 0 ? { maxAmountPerTransaction: readValueLimit({
-			asset: rule.valueLimit.asset,
-			maxPerCall: rule.valueLimit.maxPerCall
-		}) } : {}
-	};
-};
-
-//#endregion
-//#region src/modules/waas/policies/readBlockExportRule/readBlockExportRule.ts
-/**
-* Recognizes an existing rule as `blockExport`.
-* @notInstrumented
-*/
-const readBlockExportRule = (rule) => {
-	if (!(rule.ruleType === WaasPolicyRuleType.Deny && rule.operationRestrictions?.blockExport === true && rule.valueLimit === void 0 && !hasAddresses(rule) && !hasUnrecognizedFields(rule))) return void 0;
-	return { blockExport: true };
-};
-
-//#endregion
-//#region src/modules/waas/policies/readDenyAddressesRule/readDenyAddressesRule.ts
-/**
-* Recognizes an existing rule as `denyAddresses`.
-* @notInstrumented
-*/
-const readDenyAddressesRule = (rule) => {
-	if (!(rule.ruleType === WaasPolicyRuleType.Deny && rule.operationRestrictions === void 0 && rule.valueLimit === void 0 && hasAddresses(rule) && !hasUnrecognizedFields(rule))) return void 0;
-	return { denyAddresses: rule.addresses };
-};
-
-//#endregion
-//#region src/modules/waas/policies/readMaxAmountPerTransactionRule/readMaxAmountPerTransactionRule.ts
-/**
-* Recognizes an existing rule as a standalone `maxAmountPerTransaction` cap.
-* @notInstrumented
-*/
-const readMaxAmountPerTransactionRule = (rule) => {
-	if (!(rule.ruleType === WaasPolicyRuleType.Deny && rule.operationRestrictions === void 0 && rule.valueLimit?.maxPerCall !== void 0 && !hasAddresses(rule) && !hasUnrecognizedFields(rule))) return void 0;
-	return { maxAmountPerTransaction: readValueLimit({
-		asset: rule.valueLimit.asset,
-		maxPerCall: rule.valueLimit.maxPerCall
-	}) };
-};
-
-//#endregion
-//#region src/modules/waas/policies/policyRuleKinds.ts
-/** The four keys of {@link PolicyRules}, each of which produces its own rule. */
-const RULE_KIND_KEYS = [
-	"blockExport",
-	"allowAddresses",
-	"denyAddresses",
-	"maxAmountPerTransaction"
-];
-/**
-* The single source of truth {@link expandPolicyRules} and
-* {@link desugarPolicyRules} both build on. Entries are alphabetized
-* (enforced by lint), not grouped by relationship — `allowAddresses` and
-* `maxAmountPerTransaction` cooperate (see their builders' comments) despite
-* sitting apart here.
-*/
-const RULE_KINDS = {
-	allowAddresses: {
-		buildRule: buildAllowAddressesRule,
-		readRule: readAllowAddressesRule
-	},
-	blockExport: {
-		buildRule: buildBlockExportRule,
-		readRule: readBlockExportRule
-	},
-	denyAddresses: {
-		buildRule: buildDenyAddressesRule,
-		readRule: readDenyAddressesRule
-	},
-	maxAmountPerTransaction: {
-		buildRule: buildMaxAmountPerTransactionRule,
-		readRule: readMaxAmountPerTransactionRule
-	}
-};
-
-//#endregion
-//#region src/modules/waas/policies/readCoveredRule/readCoveredRule.ts
-/**
-* The sugar keys and values an existing rule structurally represents — a
-* single rule can cover more than one key (see `allowAddresses` absorbing
-* `maxAmountPerTransaction` in `policyRuleKinds.ts`). A rule carrying a
-* per-rule `modifiableBySigner` grant is never matched here — treating it
-* as covering keys would let a caller's batch reuse/replace/remove it and
-* silently revoke that signer's edit permission (mirrors `desugarPolicyRules`).
-*
-* @param rule - The existing policy-layer rule to read.
-* @returns The sugar keys and values the rule covers, or undefined when it matches no kind or carries a signer grant.
-* @notInstrumented
-*/
-const readCoveredRule = (rule) => {
-	if (rule.modifiableBySigner === true) return;
-	for (const kind of RULE_KIND_KEYS) {
-		const values = RULE_KINDS[kind].readRule(rule);
-		if (values === void 0) continue;
-		return {
-			keys: objectKeys(values),
-			kind,
-			values
-		};
-	}
-};
-
-//#endregion
-//#region src/modules/waas/policies/sortRulesByRuleId/sortRulesByRuleId.ts
-/**
-* Sorts rules by `ruleId` ascending (a rule missing one sorts first, as `''`)
-* — the deterministic order {@link matchExistingRules} picks its reuse
-* target from, so every caller agrees on which duplicate rule wins.
-*
-* @param rules - The rules to sort.
-* @returns A new array, sorted by `ruleId` ascending.
-* @notInstrumented
-*/
-const sortRulesByRuleId = (rules) => [...rules].sort((a, b) => {
-	const idA = a.ruleId ?? "";
-	const idB = b.ruleId ?? "";
-	if (idA < idB) return -1;
-	if (idA > idB) return 1;
-	return 0;
-});
-
-//#endregion
-//#region src/modules/waas/policies/matchExistingRules/matchExistingRules.ts
-const coveredRuleKeys = (rule) => readCoveredRule(rule)?.keys ?? [];
-/**
-* Matches existing rules covering any of `builtRule`'s keys. Only rules
-* being *absorbed* into it — i.e. no other match claims the same key — are
-* superseded (safe to remove). Two matches claiming the SAME key (e.g. two
-* hand-authored `denyAddresses` rules for this chain scope) are a
-* legitimate duplicate, not one superseding the other, so are left alone
-* rather than removed.
-*
-* @param params.builtRule - The newly built rule to match existing rules against.
-* @param params.consumedRuleIds - `ruleId`s already reused or removed for a prior built rule this call, so none is touched twice.
-* @param params.existingRulesInScope - The layer's rules already narrowed to the target chain scope.
-* @returns The rule to reuse `builtRule`'s upsert onto (if any), and every rule it supersedes.
-* @notInstrumented
-*/
-const matchExistingRules = ({ builtRule, consumedRuleIds, existingRulesInScope }) => {
-	const builtKeys = new Set(coveredRuleKeys(builtRule));
-	const matches = sortRulesByRuleId(existingRulesInScope).filter((existingRule) => existingRule.ruleId !== void 0 && !consumedRuleIds.has(existingRule.ruleId)).map((rule) => ({
-		keys: coveredRuleKeys(rule),
-		rule
-	})).filter(({ keys }) => keys.some((key) => builtKeys.has(key)));
-	const [reused, ...rest] = matches;
-	const superseded = rest.filter(({ keys, rule }) => {
-		const ruleKeys = new Set(keys);
-		return !matches.some((other) => other.rule.ruleId !== rule.ruleId && other.keys.some((key) => ruleKeys.has(key)));
-	}).map(({ rule }) => rule);
-	return {
-		reused: reused?.rule,
-		superseded
-	};
-};
-
-//#endregion
-//#region src/modules/waas/policies/resolveRuleName/resolveRuleName.ts
-/**
-* Keeps the reused rule's label unless the caller overrides it or its
-* name-owning kind changed.
-*
-* @param params.builtRule - The newly built rule about to be upserted.
-* @param params.reused - The existing rule `builtRule` is upserted onto, if any.
-* @param params.rules - The caller's requested {@link PolicyRules} sugar map.
-* @returns The name to use for the upserted rule.
-* @notInstrumented
-*/
-const resolveRuleName = ({ builtRule, reused, rules }) => {
-	if (reused === void 0) return builtRule.name;
-	const builtKind = readCoveredRule(builtRule)?.kind;
-	const reusedKind = readCoveredRule(reused)?.kind;
-	const sameOwningKind = builtKind !== void 0 && builtKind === reusedKind;
-	const nameOverridden = builtKind !== void 0 && rules.names?.[builtKind] !== void 0;
-	return sameOwningKind && !nameOverridden ? reused.name : builtRule.name;
-};
-
-//#endregion
-//#region src/modules/waas/policies/buildOperationsForRule/buildOperationsForRule.ts
-/**
-* Upserts `builtRule` onto the existing rule it reuses (if any), and
-* removes every rule that rule superseded. Mutates `consumedRuleIds` so a
-* later call for a different built rule never reuses or removes the same
-* existing rule twice.
-*
-* @param params.builtRule - The newly built rule to turn into batch operations.
-* @param params.consumedRuleIds - `ruleId`s already reused or removed for a prior built rule this call.
-* @param params.existingRulesInScope - The layer's rules already narrowed to the target chain scope.
-* @param params.rules - The caller's requested {@link PolicyRules} sugar map.
-* @returns The batch operations for this built rule — one upsert, plus a remove per superseded rule.
-* @notInstrumented
-*/
-const buildOperationsForRule = ({ builtRule, consumedRuleIds, existingRulesInScope, rules }) => {
-	const { reused, superseded } = matchExistingRules({
-		builtRule,
-		consumedRuleIds,
-		existingRulesInScope
-	});
-	const reusedRuleId = reused?.ruleId;
-	const operations = [{
-		op: WaasPolicyLayerRuleOperationOpEnum.Upsert,
-		rule: reusedRuleId ? {
-			...builtRule,
-			name: resolveRuleName({
-				builtRule,
-				reused,
-				rules
-			}),
-			ruleId: reusedRuleId
-		} : builtRule
-	}];
-	if (reusedRuleId) consumedRuleIds.add(reusedRuleId);
-	for (const { ruleId } of superseded) {
-		consumedRuleIds.add(ruleId);
-		operations.push({
-			op: WaasPolicyLayerRuleOperationOpEnum.Remove,
-			ruleId
-		});
-	}
-	return operations;
-};
-
-//#endregion
-//#region src/modules/waas/policies/expandPolicyRules/expandPolicyRules.ts
-/**
-* Expands the {@link PolicyRules} sugar map into `WaasPolicyRule[]` for one
-* chain scope. Omitting `chainIds` (or passing an empty array) builds a
-* wildcard rule matching every chain id of `chain`.
-*
-* @param params.rules - The sugar map describing the desired rules.
-* @param params.chain - The chain these rules apply to.
-* @param params.chainIds - The chain ids these rules apply to; omit for a wildcard rule that matches every chain id of `chain`.
-* @returns The expanded `WaasPolicyRule[]`, without `ruleId`.
-* @throws When expansion would produce an `allow` rule with a value limit and no addresses — that empties the allowed set and denies every transaction on the chain.
-* @notInstrumented
-*/
-const expandPolicyRules = ({ chain, chainIds, rules }) => {
-	const context = {
-		chain,
-		chainIds: chainIds ?? []
-	};
-	const expanded = RULE_KIND_KEYS.flatMap((key) => {
-		const rule = RULE_KINDS[key].buildRule({
-			context,
-			rules
-		});
-		return rule ? [rule] : [];
-	});
-	if (expanded.some((rule) => rule.ruleType === WaasPolicyRuleType.Allow && rule.valueLimit !== void 0 && (rule.addresses === void 0 || rule.addresses.length === 0))) throw new InvalidParamError("expandPolicyRules: refusing to emit an allow rule with a value limit and no addresses — it would empty the allowed-address set and deny every transaction on this chain");
-	return expanded;
-};
-
-//#endregion
-//#region src/modules/waas/policies/fillOmittedRuleValues/fillOmittedRuleValues.ts
-/**
-* Whether the caller's value for a sugar key would actually produce a rule —
-* an empty `allowAddresses`/`denyAddresses` array builds no rule (see
-* `buildAllowAddressesRule`/`buildDenyAddressesRule`), so it must count the
-* same as omitted here. Otherwise a real value is present.
-*/
-const isRuleKeyRequested = (value) => Array.isArray(value) ? value.length > 0 : value !== void 0;
-/**
-* A key the caller omitted can be silently dropped if it's merged into the
-* same rule as a key they DID supply (e.g. re-saving only `allowAddresses`
-* when the existing rule also carries `maxAmountPerTransaction`) — carries
-* it forward so a partial re-save never erases a restriction the caller
-* didn't ask to remove.
-*
-* Rules are visited in the same lexicographically-smallest-`ruleId` order
-* `matchExistingRules` reuses, and only the first rule to cover a given key
-* fills it — so when duplicate rules cover the same omitted key, the value
-* always comes from the rule that will actually be upserted.
-*
-* @param params.existingRulesInScope - The layer's rules already narrowed to the target chain scope.
-* @param params.rules - The caller's requested {@link PolicyRules} sugar map.
-* @returns `rules`, with any key a partially-requested existing rule also covers filled in from that rule's current value.
-* @notInstrumented
-*/
-const fillOmittedRuleValues = ({ existingRulesInScope, rules }) => {
-	const mergedRules = { ...rules };
-	for (const existingRule of sortRulesByRuleId(existingRulesInScope)) {
-		const covered = readCoveredRule(existingRule);
-		const isPartiallyRequested = covered !== void 0 && covered.keys.some((key) => isRuleKeyRequested(rules[key])) && covered.keys.some((key) => !isRuleKeyRequested(rules[key]));
-		if (covered === void 0 || !isPartiallyRequested) continue;
-		for (const key of covered.keys) if (!isRuleKeyRequested(rules[key]) && mergedRules[key] === void 0) Object.assign(mergedRules, { [key]: covered.values[key] });
-	}
-	return mergedRules;
-};
-
-//#endregion
-//#region src/modules/waas/policies/getResolvedPolicyLayer/getResolvedPolicyLayer.ts
-/**
-* Fetches the policy layer a {@link ResolvedPolicyScope} points at. Shared
-* by {@link createPolicy}, {@link getPolicy}, and {@link removePolicyRules}
-* so the account/wallet/signer branch is written once.
-*
-* @notInstrumented
-*/
-const getResolvedPolicyLayer = ({ resolvedScope }, client) => {
-	const { environmentId } = getCore(client);
-	const apiClient = createApiClient({}, client);
-	switch (resolvedScope.target) {
-		case "account": return apiClient.getBusinessAccountPolicyLayer({
-			businessAccountId: resolvedScope.businessAccountId,
-			environmentId
-		});
-		case "wallet": return apiClient.getWaasWalletSelfPolicyLayer({
-			environmentId,
-			walletId: resolvedScope.walletId
-		});
-		case "signer": return apiClient.getWaasSignerSelfPolicyLayer({
-			environmentId,
-			shareSetId: resolvedScope.shareSetId,
-			walletId: resolvedScope.walletId
-		});
-		default: {
-			const unhandledScope = resolvedScope;
-			throw new InvalidParamError(`getResolvedPolicyLayer: unhandled target "${JSON.stringify(unhandledScope)}"`);
-		}
-	}
-};
-
-//#endregion
-//#region src/modules/waas/policies/resolvePolicyScope/resolvePolicyScope.ts
-/** Narrows a {@link WalletAccount} to {@link WaasWalletAccount} so WaaS-only fields (e.g. `shareSetId`) are accessible. */
-const isWaasWallet = (walletAccount) => isWaasWalletAccount({ walletAccount });
-/**
-* Resolves a {@link PolicyScope} to its concrete policy layer. When only a
-* `shareSetId` is given, the owning wallet is found locally by scanning the
-* client's own wallet accounts — no network request.
-*
-* @param params.scope - The scope to resolve.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The concrete target (`account`, `wallet`, or `signer`) plus the ids needed to call the SDK API.
-* @throws When a `shareSetId`-only scope doesn't match any of the client's wallet accounts.
-* @notInstrumented
-*/
-const resolvePolicyScope = ({ scope }, client = getDefaultClient()) => {
-	if ("businessAccountId" in scope) return {
-		businessAccountId: scope.businessAccountId,
-		target: "account"
-	};
-	if ("walletId" in scope) return scope.shareSetId === void 0 ? {
-		target: "wallet",
-		walletId: scope.walletId
-	} : {
-		shareSetId: scope.shareSetId,
-		target: "signer",
-		walletId: scope.walletId
-	};
-	const owningWalletAccount = getWalletAccounts(client).filter(isWaasWallet).find((walletAccount) => walletAccount.shareSetId === scope.shareSetId || walletAccount.otherShareSets?.some((shareSet) => shareSet.shareSetId === scope.shareSetId));
-	assertDefined(owningWalletAccount?.verifiedCredentialId, `resolvePolicyScope: could not resolve a wallet for shareSetId "${scope.shareSetId}" — no verified wallet account exposes this share set`);
-	return {
-		shareSetId: scope.shareSetId,
-		target: "signer",
-		walletId: owningWalletAccount.verifiedCredentialId
-	};
-};
-
-//#endregion
-//#region src/modules/waas/policies/sameChainIds/sameChainIds.ts
-/**
-* Whether two chainIds arrays describe the same set, regardless of order.
-* Shared by {@link createPolicy} and {@link removePolicyRules} to keep their
-* existing-rule lookups consistent.
-*
-* @notInstrumented
-*/
-const sameChainIds = ({ existing = [], requested }) => {
-	if (existing.length !== requested.length) return false;
-	const sortedExisting = [...existing].sort((x, y) => x - y);
-	const sortedRequested = [...requested].sort((x, y) => x - y);
-	return sortedExisting.every((id, index) => id === sortedRequested[index]);
-};
-
-//#endregion
-//#region src/modules/waas/policies/createPolicy/createPolicy.ts
-/**
-* Creates or updates a wallet's, signer's, or business account's policy rules from the
-* {@link PolicyRules} sugar map, in one atomic `batch` PATCH. Each key in
-* `rules` maps to at most one underlying rule, so calling this twice with
-* the same map updates that rule in place instead of duplicating it.
-*
-* Known race: no ETag / optimistic-concurrency check — concurrent calls for
-* the same scope can both read-then-write and duplicate a rule.
-*
-* When more than one existing rule matches the same sugar key(s), only
-* rules being absorbed into the newly built rule (i.e. no other match
-* claims the same key) are removed. Two rules that duplicate the same key
-* (e.g. two hand-authored `denyAddresses` rules for this chain scope) are
-* left as-is rather than one being silently deleted — this call updates the
-* lexicographically-smallest-`ruleId` match in place and leaves the rest
-* untouched. A caller repeating this call will not converge on a single
-* rule; the duplicate has to be removed by hand.
-*
-* @param params.scope - Which policy layer to update — see {@link resolvePolicyScope}.
-* @param params.chain - The chain the rules apply to.
-* @param params.chainIds - The chain ids the rules apply to; omit for a wildcard rule that matches every chain id of `chain`.
-* @param params.rules - The desired rules, as a {@link PolicyRules} sugar map.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The policy layer as it stands after the batch is applied.
-* @throws When `rules` produces no recognized keys, or via {@link resolvePolicyScope}'s scope-resolution errors.
-* @notInstrumented
-*/
-const createPolicy = async ({ chain, chainIds, rules, scope }, client = getDefaultClient()) => {
-	const normalizedChainIds = chainIds ?? [];
-	const resolvedScope = resolvePolicyScope({ scope }, client);
-	const existingRulesInScope = ((await getResolvedPolicyLayer({ resolvedScope }, client)).layerContent.rules ?? []).filter((existingRule) => existingRule.chain === chain && sameChainIds({
-		existing: existingRule.chainIds,
-		requested: normalizedChainIds
-	}));
-	const expandedRules = expandPolicyRules({
-		chain,
-		chainIds: normalizedChainIds,
-		rules: fillOmittedRuleValues({
-			existingRulesInScope,
-			rules
-		})
-	});
-	if (expandedRules.length === 0) throw new InvalidParamError("createPolicy: rules must include at least one recognized policy key");
-	const consumedRuleIds = /* @__PURE__ */ new Set();
-	const operations = [];
-	for (const builtRule of expandedRules) operations.push(...buildOperationsForRule({
-		builtRule,
-		consumedRuleIds,
-		existingRulesInScope,
-		rules
-	}));
-	return applyPolicyLayerBatch({
-		operations,
-		resolvedScope
-	}, client);
-};
-
-//#endregion
-//#region src/modules/waas/createWaasOfflineRecoveryShares/createWaasOfflineRecoveryShares.ts
-/**
-* Mints an offline-recovery share set for a WaaS wallet account.
-*
-* This mints a second, independent 2-of-2 share set: the client's share is
-* uploaded to Google Drive, and the server's share is delivered to the
-* developer's webhook. Dynamic never retains its half, so recovery works even
-* if Dynamic is fully offline.
-*
-* @param params.walletAccount - The WaaS wallet account to create offline-recovery shares for.
-* @param [params.password] - Optional password to encrypt the client share.
-* @param [params.cloudProviderAccessToken] - Optional consumer-supplied Drive-scoped access token; used directly instead of the stored OAuth token (avoids a second Google consent). Useful for external-auth setups.
-* @param [params.mfaToken] - Optional MFA token proving step-up verification, when required for this action.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A promise that resolves when the offline-recovery share set has been minted.
-* @notInstrumented
-*/
-const createWaasOfflineRecoveryShares = async ({ cloudProviderAccessToken, mfaToken, password, walletAccount }, client = getDefaultClient()) => {
-	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).createOfflineRecoveryShares({
-		cloudProviderAccessToken,
-		mfaToken,
-		password,
-		walletAccount
-	});
-};
-
-//#endregion
-//#region src/modules/waas/isWalletCreationRequirement/isWalletCreationRequirement.ts
-/**
-* Type guard to check if an item is a WalletCreationRequirement object.
-* Chain values are strings, so we can distinguish by checking if it's an object with a 'chain' property.
-*
-* @param item - The item to check, either a WalletCreationRequirement or Chain string
-* @returns True if the item is a WalletCreationRequirement object
-* @notInstrumented
-*/
-const isWalletCreationRequirement = (item) => typeof item === "object" && item !== null && "chain" in item;
-
-//#endregion
-//#region src/modules/waas/normalizeWalletRequirements/normalizeWalletRequirements.ts
-const DEFAULT_BITCOIN_ADDRESS_TYPE = "native_segwit";
-/**
-* Normalizes wallet creation input from either legacy Chain[] format
-* or new WalletCreationRequirement[] format to WalletCreationRequirement[].
-*
-* For BTC chains without explicit bitcoinConfig, defaults to native_segwit.
-*
-* @param params.input - Either an array of Chain strings or WalletCreationRequirement objects
-* @param params.defaultBitcoinConfig - Optional default bitcoin config to use for BTC chains when converting from legacy format
-* @returns Array of WalletCreationRequirement objects
-* @notInstrumented
-*/
-const normalizeWalletRequirements = ({ defaultBitcoinConfig, input }) => {
-	if (input.length === 0) return [];
-	const [firstItem] = input;
-	if (isWalletCreationRequirement(firstItem)) return input.map((requirement) => {
-		if (requirement.chain === "BTC" && !requirement.bitcoinConfig) return {
-			...requirement,
-			bitcoinConfig: { addressType: DEFAULT_BITCOIN_ADDRESS_TYPE }
-		};
-		return requirement;
-	});
-	return input.map((chain) => {
-		const requirement = { chain };
-		if (chain === "BTC") requirement.bitcoinConfig = defaultBitcoinConfig ?? { addressType: DEFAULT_BITCOIN_ADDRESS_TYPE };
-		return requirement;
-	});
-};
-
-//#endregion
-//#region src/modules/waas/createWaasWalletAccounts/createWaasWalletAccounts.ts
-/**
-* Creates wallet accounts for the specified chains.
-*
-* This function creates wallet accounts for the specified chains.
-* If the same chain is passed multiple times, just as many wallet accounts will be created
-* for that chain.
-*
-* @example
-* ```ts
-* // Legacy format - will create wallet accounts for EVM and SOL, BTC defaults to native_segwit
-* await createWaasWalletAccounts({ chains: ['EVM', 'SOL', 'BTC'] });
-*
-* // New format with chain-specific config
-* await createWaasWalletAccounts({
-*   chains: [
-*     { chain: 'BTC', bitcoinConfig: { addressType: 'taproot' } },
-*     { chain: 'EVM' },
-*   ]
-* });
-*
-* // Create both BTC address types
-* await createWaasWalletAccounts({
-*   chains: [
-*     { chain: 'BTC', bitcoinConfig: { addressType: 'native_segwit' } },
-*     { chain: 'BTC', bitcoinConfig: { addressType: 'taproot' } },
-*   ]
-* });
-* ```
-*
-* @param params.chains - The chains to create wallet accounts for.
-* @param params.password - The optional password to use for the wallet accounts.
-* @param params.thresholdSignatureScheme - The threshold signature scheme to use for the wallet accounts. (Default: TWO_OF_TWO)
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A promise that resolves when all wallet accounts are created.
-* @notInstrumented
-*/
-const createWaasWalletAccounts = async ({ chains, password, thresholdSignatureScheme }, client = getDefaultClient()) => {
-	const normalizedRequirements = normalizeWalletRequirements({ input: chains });
-	const supportedChains = [
-		"ALEO",
-		"BTC",
-		"EVM",
-		"SOL",
-		"SUI",
-		"TON",
-		"TRON"
-	];
-	const filteredRequirements = normalizedRequirements.filter((requirement) => supportedChains.includes(requirement.chain));
-	if (filteredRequirements.length === 0) return;
-	const walletProviderMap = /* @__PURE__ */ new Map();
-	for (const requirement of filteredRequirements) {
-		const walletProviderKey = formatWalletProviderKey({
-			chain: requirement.chain,
-			displayName: DYNAMIC_WAAS_METADATA.displayName,
-			walletProviderType: WalletProviderEnum.EmbeddedWallet
-		});
-		if (!walletProviderMap.has(walletProviderKey)) {
-			const walletProvider = getWalletProviderByKey({ walletProviderKey }, client);
-			if (!walletProvider) throw new NoWalletProviderFoundError({ walletProviderKey });
-			if (!isWaasWalletProvider(walletProvider)) throw new NotWaasWalletProviderError({ walletProviderKey });
-			walletProviderMap.set(walletProviderKey, walletProvider);
-		}
-	}
-	await Promise.all(filteredRequirements.map((requirement) => {
-		const walletProviderKey = formatWalletProviderKey({
-			chain: requirement.chain,
-			displayName: DYNAMIC_WAAS_METADATA.displayName,
-			walletProviderType: WalletProviderEnum.EmbeddedWallet
-		});
-		const walletProvider = walletProviderMap.get(walletProviderKey);
-		if (!walletProvider || !isWaasWalletProvider(walletProvider)) return Promise.resolve();
-		return walletProvider.createWalletAccount({
-			bitcoinConfig: requirement.bitcoinConfig,
-			password,
-			thresholdSignatureScheme
-		});
-	}));
-	await __refreshAuth_wrapped(client);
-};
-
-//#endregion
-//#region src/modules/waas/businessAccounts/createWalletForBusinessAccount/createWalletForBusinessAccount.ts
-/**
-* Creates a WaaS wallet account owned directly by a business account, in one
-* step — the server seats the wallet's signer row against the business account
-* as it is minted, so no separate link call is needed.
-*
-* @example
-* ```ts
-* const wallet = await createWalletForBusinessAccount({
-*   businessAccountId: 'ba-1',
-*   chain: 'EVM',
-* });
-* ```
-*
-* @param params.businessAccountId - The business account that will own the wallet.
-* @param params.chain - The chain to create the wallet account for.
-* @param [params.password] - Optional password used to encrypt the user share.
-* @param [params.thresholdSignatureScheme] - The threshold signature scheme to use. (Default: TWO_OF_TWO)
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The created wallet account.
-* @notInstrumented
-*/
-const createWalletForBusinessAccount = async ({ businessAccountId, chain, password, thresholdSignatureScheme }, client = getDefaultClient()) => {
-	const wallet = await getWaasWalletProviderByChain({ chain }, client).createWalletAccount({
-		businessAccountId,
-		password,
-		thresholdSignatureScheme
-	});
-	await __refreshAuth_wrapped(client);
-	return wallet;
-};
-
-//#endregion
-//#region src/modules/waas/delegateWaasKeyShares/delegateWaasKeyShares.ts
-/**
-* Delegates cryptographic key shares for a WaaS wallet account.
-*
-* This function allows the delegation of key management responsibilities,
-* enabling distributed key management for enhanced security.
-*
-* @param params.walletAccount - The WaaS wallet account to delegate shares for.
-* @param [params.password] - Optional password for key share operations.
-* @param [params.initialSignerRules] - Optional policy rules used to seed the delegated signer's policy layer at delegation time.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A promise that resolves when the key delegation is complete.
-* @notInstrumented
-*/
-const delegateWaasKeyShares = async ({ initialSignerRules, password, walletAccount }, client = getDefaultClient()) => {
-	await getWaasWalletProviderFromWalletAccount({ walletAccount }, client).delegateKeyShares({
-		initialSignerRules,
-		password,
-		walletAccount
-	});
-	await __refreshAuth_wrapped(client);
-};
-
-//#endregion
-//#region src/modules/waas/policies/findMatchedRuleKind/findMatchedRuleKind.ts
-const COUPLED_RULE_KINDS = new Set(["allowAddresses", "maxAmountPerTransaction"]);
-const isBlocked = ({ claimedKinds, populatedKeys }) => populatedKeys.some((key) => claimedKinds.has(key) || COUPLED_RULE_KINDS.has(key) && [...COUPLED_RULE_KINDS].some((coupledKey) => claimedKinds.has(coupledKey)));
-/**
-* Finds the first {@link RULE_KINDS} entry that recognizes `entry` as its
-* kind without colliding with an already-claimed key. Must check every key
-* `readRule` would populate, not just this kind's own key — allowAddresses'
-* `readRule` also populates `maxAmountPerTransaction` when the rule carries
-* a merged cap, so accepting it while that key is already claimed would
-* overwrite an earlier standalone cap.
-* @notInstrumented
-*/
-const findMatchedRuleKind = ({ claimedKinds, entry }) => {
-	for (const key of RULE_KIND_KEYS) {
-		const readResult = RULE_KINDS[key].readRule(entry);
-		if (readResult === void 0) continue;
-		if (!isBlocked({
-			claimedKinds,
-			populatedKeys: Object.keys(readResult)
-		})) return {
-			kind: key,
-			readResult
-		};
-	}
-};
-
-//#endregion
-//#region src/modules/waas/policies/isPolicyRuleDeletionMarker/isPolicyRuleDeletionMarker.ts
-/** The exact key set of a deletion marker — checked as a closed shape, not by presence alone. */
-const DELETION_MARKER_KEYS = new Set([
-	"ruleId",
-	"deletedByType",
-	"deletedById"
-]);
-/**
-* Recognizes a policy-Layer deletion marker — the enclave's stand-in for a
-* rule it couldn't drop outright, kept so the removal stays attributable.
-* Matches on the entry's exact key set, not field presence, since the read
-* response types every entry as a live rule.
-*
-* @param entry - The raw policy-Layer rule entry to check.
-* @returns Whether `entry` is a deletion marker rather than a live rule.
-* @notInstrumented
-*/
-const isPolicyRuleDeletionMarker = (entry) => {
-	const candidate = entry;
-	return typeof candidate.ruleId === "string" && typeof candidate.deletedByType === "string" && typeof candidate.deletedById === "string" && Object.keys(entry).every((key) => DELETION_MARKER_KEYS.has(key));
-};
-
-//#endregion
-//#region src/modules/waas/policies/desugarPolicyRules/desugarPolicyRules.ts
-/**
-* Reverses {@link expandPolicyRules} using {@link findMatchedRuleKind}'s
-* same rule-kind table, skipping deletion markers. A kind claims at most
-* one rule; extra matches, out-of-vocabulary fields, and per-rule
-* `modifiableBySigner` grants (no sugar representation) all go to
-* `unmapped` instead of being dropped.
-*
-* @param params.entries - The policy-Layer's rule entries, as returned in `layerContent.rules`.
-* @returns The recognized rules as a {@link PolicyRules} map, plus whatever wasn't recognized.
-* @notInstrumented
-*/
-const desugarPolicyRules = ({ entries }) => {
-	const rules = {};
-	const unmapped = [];
-	const claimedKinds = /* @__PURE__ */ new Set();
-	for (const entry of entries) {
-		if (isPolicyRuleDeletionMarker(entry)) continue;
-		if (entry.modifiableBySigner === true) {
-			unmapped.push(entry);
-			continue;
-		}
-		const matched = findMatchedRuleKind({
-			claimedKinds,
-			entry
-		});
-		if (matched === void 0) {
-			unmapped.push(entry);
-			continue;
-		}
-		const { kind, readResult } = matched;
-		Object.assign(rules, readResult);
-		for (const key of Object.keys(readResult)) claimedKinds.add(key);
-		if (entry.name !== DEFAULT_POLICY_RULE_NAMES[kind]) rules.names = {
-			...rules.names,
-			[kind]: entry.name
-		};
-	}
-	return {
-		rules,
-		unmapped
-	};
-};
-
-//#endregion
-//#region src/modules/waas/exportWaasClientKeyshares/exportWaasClientKeyshares.ts
-/**
-* Exports the client-side key shares for a WaaS wallet account.
-*
-* This function retrieves the cryptographic key shares that are stored
-* on the client side for backup or migration purposes.
-*
-* @param params.walletAccount - The WaaS wallet account to export shares from.
-* @param [params.password] - Optional password to encrypt the exported shares.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A promise that resolves to the exported key shares.
-* @notInstrumented
-*/
-const exportWaasClientKeyshares = async ({ password, walletAccount }, client = getDefaultClient()) => {
-	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).exportClientKeyshares({
-		password,
-		walletAccount
-	});
-};
-
-//#endregion
-//#region src/modules/waas/exportWaasPrivateKey/exportWaasPrivateKey.ts
-/**
-* Exports the private key for a WaaS wallet account with secure display.
-*
-* This function reveals the private key for a WaaS wallet and displays it
-* securely within an iframe dynamically inserted into the specified HTML container element.
-*
-* @param params.walletAccount - The WaaS wallet account to export the private key from.
-* @param params.displayContainer - The HTML element where the iframe will be injected.
-* @param [params.password] - Optional password to decrypt the private key.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A promise that resolves when the private key export is complete.
-* @notInstrumented
-*/
-const exportWaasPrivateKey = async ({ displayContainer, password, walletAccount }, client = getDefaultClient()) => {
-	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).exportPrivateKey({
-		displayContainer,
-		password,
-		walletAccount
-	});
-};
-
-//#endregion
-//#region src/modules/waas/policies/getAccountPolicyLayer/getAccountPolicyLayer.ts
-/**
-* Fetches a business account's active policy rules (the account-Layer).
-* BA owner/admin only. Calls the SDK API directly (no MPC step), so a
-* rejection surfaces as a thrown error.
-*
-* @param params.businessAccountId - The business account to read policy rules for.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The account-Layer, including its current rules.
-* @notInstrumented
-*/
-const getAccountPolicyLayer = async ({ businessAccountId }, client = getDefaultClient()) => {
-	const core = getCore(client);
-	return createApiClient({}, client).getBusinessAccountPolicyLayer({
-		businessAccountId,
-		environmentId: core.environmentId
-	});
-};
-
-//#endregion
-//#region src/modules/waas/businessAccounts/getBusinessAccount/getBusinessAccount.ts
-/**
-* Retrieves a business account by ID, including its members, signers, and wallets.
-*
-* @param params.businessAccountId - The ID of the business account to retrieve.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The business account with its members, signers, and wallets.
-* @notInstrumented
-*/
-const getBusinessAccount = async ({ businessAccountId }, client = getDefaultClient()) => {
-	const core = getCore(client);
-	return await createApiClient({}, client).sdkGetBusinessAccountById({
-		businessAccountId,
-		environmentId: core.environmentId
-	});
-};
-
-//#endregion
-//#region src/modules/wallets/userHasEmbeddedWalletForChain/userHasEmbeddedWalletForChain.ts
-/** @notInstrumented */
-const userHasEmbeddedWalletForChain = ({ user, chain }) => {
-	return user.verifiedCredentials.some((vc) => vc.walletProvider === WalletProviderEnum.EmbeddedWallet && vc.chain && getChainFromVerifiedCredentialChain(vc.chain) === chain);
-};
-
-//#endregion
-//#region src/modules/waas/getChainsMissingWaasWalletAccounts/getChainsMissingWaasWalletAccounts.ts
-/**
-* Gets all chains missing a waas wallet account for the current user.
-*
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns An array of all chains that have waas wallet accounts enabled
-* but for which the current user does not yet have an embedded wallet account.
-* @notInstrumented
-*/
-const getChainsMissingWaasWalletAccounts = (client = getDefaultClient()) => {
-	const projectSettings = client.projectSettings;
-	assertDefined(projectSettings, "Project settings are not available");
-	const embeddedWalletSettings = projectSettings.sdk.embeddedWallets;
-	const isWaasEnabled = isDynamicWaasEnabled(client);
-	const user = client.user;
-	if (!user || !isWaasEnabled) return [];
-	return (embeddedWalletSettings?.chainConfigurations?.filter((chain) => chain.enabled) ?? []).map((chain) => chain.name).filter((chain) => !userHasEmbeddedWalletForChain({
-		chain,
-		user
-	}));
-};
-
-//#endregion
-//#region src/modules/waas/policies/getPolicy/getPolicy.ts
-/**
-* Fetches a policy layer and reads its `chain`/`chainIds` scope back into
-* the {@link PolicyRules} sugar map (see {@link desugarPolicyRules}). A
-* layer can hold rules for more than one chain, so entries are narrowed to
-* `chain`/`chainIds` first — the same scoping {@link createPolicy} uses —
-* to keep the `getPolicy` → edit → `createPolicy` round-trip safe for
-* multi-chain wallets. Calls the SDK API directly (no MPC step), so a
-* rejection surfaces as a thrown error.
-*
-* @param params.scope - Which policy layer to read — see {@link resolvePolicyScope}.
-* @param params.chain - The chain to read rules for.
-* @param params.chainIds - The chain ids to read rules for; omit to read the wildcard rule matching every chain id of `chain`.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The recognized rules as a {@link PolicyRules} map, whatever wasn't recognized within `chain`/`chainIds`, and the layer's id and last-updated timestamp.
-* @throws Via {@link resolvePolicyScope}'s scope-resolution errors.
-* @notInstrumented
-*/
-const getPolicy = async ({ chain, chainIds, scope }, client = getDefaultClient()) => {
-	const normalizedChainIds = chainIds ?? [];
-	const layer = await getResolvedPolicyLayer({ resolvedScope: resolvePolicyScope({ scope }, client) }, client);
-	const { rules, unmapped } = desugarPolicyRules({ entries: (layer.layerContent.rules ?? []).filter((entry) => entry.chain === chain && sameChainIds({
-		existing: entry.chainIds,
-		requested: normalizedChainIds
-	})) });
-	return {
-		layerId: layer.layerId,
-		rules,
-		unmapped,
-		updatedAt: layer.updatedAt
-	};
-};
-
-//#endregion
-//#region src/modules/waas/policies/getSignerPolicyLayer/getSignerPolicyLayer.ts
-/**
-* Fetches a signer's active policy rules (the signer-Layer) — the caller's
-* own active share set by default, or another share set on the same wallet
-* (e.g. a delegated share set) when `shareSetId` is given. Calls the SDK API
-* directly (no MPC step), so a rejection surfaces as a thrown error.
-*
-* @param params.walletAccount - The wallet account whose signer-Layer to read.
-* @param [params.shareSetId] - The share set to target; defaults to the caller's own.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The signer-Layer, including its current rules.
-* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
-* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
-* @notInstrumented
-*/
-const getSignerPolicyLayer = async ({ shareSetId, walletAccount }, client = getDefaultClient()) => {
-	assertDefined(walletAccount.verifiedCredentialId, "getSignerPolicyLayer: cannot resolve a wallet id — use a verified wallet account");
-	const core = getCore(client);
-	return createApiClient({}, client).getWaasSignerSelfPolicyLayer({
-		environmentId: core.environmentId,
-		shareSetId,
-		walletId: walletAccount.verifiedCredentialId
-	});
-};
-
-//#endregion
-//#region src/modules/waas/getWalletAccountShareSets/getWalletAccountShareSets.ts
-/**
-* No network request. Share set ids rotate on refresh/reshare (stale ids are
-* rejected server-side), so re-read rather than cache; non-WaaS accounts
-* return `{ own: undefined, others: [] }` instead of throwing.
-*
-* @param params.walletAccount - The WaaS wallet account whose share sets to read.
-* @returns The account's own share set (if any) and the wallet's other active share sets.
-* @notInstrumented
-*/
-const getWalletAccountShareSets = ({ walletAccount }) => {
-	const own = walletAccount.shareSetId ? {
-		shareSetId: walletAccount.shareSetId,
-		shareSetType: walletAccount.shareSetType
-	} : void 0;
-	return {
-		others: walletAccount.otherShareSets ?? [],
-		own
-	};
-};
-
-//#endregion
-//#region src/modules/waas/policies/getWalletPolicyLayer/getWalletPolicyLayer.ts
-/**
-* Fetches a wallet's active policy rules (the wallet-Layer). Calls the SDK
-* API directly (no MPC step), so a rejection surfaces as a thrown error.
-*
-* @param params.walletAccount - The wallet account to read policy rules for.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The wallet-Layer, including its current rules.
-* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
-* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
-* @notInstrumented
-*/
-const getWalletPolicyLayer = async ({ walletAccount }, client = getDefaultClient()) => {
-	assertDefined(walletAccount.verifiedCredentialId, "getWalletPolicyLayer: cannot resolve a wallet id — use a verified wallet account");
-	const core = getCore(client);
-	return createApiClient({}, client).getWaasWalletSelfPolicyLayer({
-		environmentId: core.environmentId,
-		walletId: walletAccount.verifiedCredentialId
-	});
-};
-
-//#endregion
-//#region src/modules/waas/getWalletRecoveryState/getWalletRecoveryState.ts
-/**
-* Retrieves the recovery state of a WaaS wallet account.
-*
-* @param params.walletAccount - The WaaS wallet account to get the recovery state for.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A promise that resolves with the wallet recovery state.
-* @notInstrumented
-*/
-const getWalletRecoveryState = async ({ walletAccount }, client = getDefaultClient()) => {
-	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).getWalletRecoveryState({ walletAccount });
-};
-
-//#endregion
-//#region src/modules/waas/hasDelegatedAccess/hasDelegatedAccess.ts
-/**
-* Checks if a WaaS wallet account has delegated access.
-*
-* @param params.walletAccount - The WaaS wallet account to check for delegated access.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns True if the wallet account has delegated access, false otherwise.
-* @notInstrumented
-*/
-const hasDelegatedAccess = ({ walletAccount }, client = getDefaultClient()) => {
-	const verifiedCredential = getVerifiedCredentialForWalletAccount({ walletAccount }, client);
-	assertDefined(verifiedCredential, "Verified credential not found for Waas wallet account");
-	const hasDelegatedKeyShare = verifiedCredential.walletProperties?.keyShares?.some((keyShare) => keyShare.backupLocation === "delegated");
-	const hasDelegatedShareSet = verifiedCredential.walletProperties?.otherShareSets?.some((shareSet) => shareSet.shareSetType === WaasWalletShareSetType$1.Delegated);
-	return Boolean(hasDelegatedKeyShare || hasDelegatedShareSet);
-};
-
-//#endregion
-//#region src/modules/waas/importWaasPrivateKey/importWaasPrivateKey.ts
-/**
-* Imports an existing private key to create a new WaaS wallet account.
-*
-* This function allows users to import their existing private key into
-* Dynamic's WaaS infrastructure for secure management.
-*
-* @param params.chain - The chain for the imported wallet.
-* @param params.privateKey - The private key to import.
-* @param [params.thresholdSignatureScheme] - Optional threshold signature scheme configuration. Default is TWO_OF_TWO.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A promise that resolves when the private key is successfully imported.
-* @notInstrumented
-*/
-const importWaasPrivateKey = async ({ chain, privateKey, thresholdSignatureScheme }, client = getDefaultClient()) => {
-	return getWaasWalletProviderByChain({ chain }, client).importPrivateKey({
-		privateKey,
-		thresholdSignatureScheme
-	});
-};
-
-//#endregion
-//#region src/modules/waas/isPasswordRequiredForWaasWallets/isPasswordRequiredForWaasWallets.ts
-/**
-* Checks if the user Waas wallets are password protected.
-*
-* If the user's Waas wallets are password protected, it means that user's will have to be prompted for a
-* password for the first wallet action that happens on each session.
-* The password is also required for creating any new Waas wallets.
-*
-* @param client - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns True if the user has any password protected Waas wallets, false otherwise
-* @notInstrumented
-*/
-const isPasswordRequiredForWaasWallets = (client = getDefaultClient()) => {
-	const { user } = client;
-	assertDefined(user, "User is not authenticated");
-	return user.verifiedCredentials.some((credential) => credential.walletProperties?.keyShares?.some((keyShare) => keyShare.passwordEncrypted));
-};
-
-//#endregion
-//#region src/modules/waas/businessAccounts/listBusinessAccounts/listBusinessAccounts.ts
-/**
-* Lists the business accounts the current user is a member of, scoped to the
-* active project environment. Optionally filter by `externalRefs`.
-*
-* @param [params] - Optional filters.
-* @param [params.externalRefs] - Return only accounts whose externalRef is in this list.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A paginated list of business accounts.
-* @notInstrumented
-*/
-const listBusinessAccounts = async (params, client = getDefaultClient()) => {
-	const core = getCore(client);
-	return await createApiClient({}, client).sdkListBusinessAccounts({
-		environmentId: core.environmentId,
-		externalRef: params?.externalRefs
-	});
-};
-
-//#endregion
-//#region src/modules/waas/refreshWaasWalletAccountShares/refreshWaasWalletAccountShares.ts
-/**
-* Refreshes the cryptographic key shares for a WaaS wallet account.
-*
-* This function generates new key shares for the wallet while maintaining
-* the same threshold signature scheme.
-*
-* @param params.walletAccount - The WaaS wallet account to refresh shares for.
-* @param [params.password] - Optional password for key share operations.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A promise that resolves when the key shares are refreshed.
-* @notInstrumented
-*/
-const refreshWaasWalletAccountShares = async ({ walletAccount, password }, client = getDefaultClient()) => {
-	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).refreshWalletAccountShares({
-		password,
-		walletAccount
-	});
-};
-
-//#endregion
-//#region src/modules/waas/policies/removeAccountPolicyRule/removeAccountPolicyRule.ts
-/**
-* Removes a single rule from a business account's account-Layer. BA
-* owner/admin only. Calls the SDK API directly (no MPC step), so a
-* rejection surfaces as a thrown error.
-*
-* @param params.businessAccountId - The business account to remove the rule from.
-* @param params.ruleId - The id of the rule to remove.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The account-Layer as it stands after the rule is removed.
-* @notInstrumented
-*/
-const removeAccountPolicyRule = async ({ businessAccountId, ruleId }, client = getDefaultClient()) => {
-	const core = getCore(client);
-	return createApiClient({}, client).updateBusinessAccountPolicyLayer({
-		businessAccountId,
-		environmentId: core.environmentId,
-		waasPolicyLayerUpdateRequest: {
-			op: WaasPolicyLayerUpdateRequestOpEnum.Remove,
-			ruleId
-		}
-	});
-};
-
-//#endregion
-//#region src/modules/waas/businessAccounts/removeBusinessAccountMember/removeBusinessAccountMember.ts
-/**
-* Removes a member from a business account. Any signer rows the member held on
-* the account's wallets are torn down as part of the removal. The backend
-* refuses to remove the account's last owner.
-*
-* @param params.businessAccountId - The business account to remove the member from.
-* @param params.userId - The id of the user to remove.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The removed member.
-*
-* @example
-* ```ts
-* const detail = await getBusinessAccount({ businessAccountId });
-* const member = detail.members[0];
-* await removeBusinessAccountMember({
-*   businessAccountId,
-*   userId: member.userId,
-* });
-* ```
-*
-* @see addBusinessAccountMember
-* @see getBusinessAccount
-* @notInstrumented
-*/
-const removeBusinessAccountMember = async ({ businessAccountId, userId }, client = getDefaultClient()) => {
-	const core = getCore(client);
-	const { member } = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountmemberremove }, client).sdkRemoveBusinessAccountMember({
-		businessAccountId,
-		environmentId: core.environmentId,
-		userId
-	});
-	return member;
-};
-
-//#endregion
-//#region src/modules/waas/businessAccounts/removeBusinessAccountSigner/removeBusinessAccountSigner.ts
-/**
-* Removes a signer from a business-account wallet. This detaches the signer's
-* share set from the wallet — it does not run an MPC ceremony — so the removed
-* identity can no longer sign for that wallet. The backend refuses to remove
-* the last remaining signer on a wallet.
-*
-* @param params.businessAccountId - The business account the wallet belongs to.
-* @param params.walletId - The wallet the signer is attached to.
-* @param params.signerId - The id of the signer to remove (`BusinessAccountSigner.id`).
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The removed signer.
-*
-* @example
-* ```ts
-* const detail = await getBusinessAccount({ businessAccountId });
-* const signer = detail.signers[0];
-* await removeBusinessAccountSigner({
-*   businessAccountId,
-*   walletId: signer.walletId,
-*   signerId: signer.id,
-* });
-* ```
-*
-* @see addBusinessAccountSigner
-* @see getBusinessAccount
-* @notInstrumented
-*/
-const removeBusinessAccountSigner = async ({ businessAccountId, walletId, signerId }, client = getDefaultClient()) => {
-	const core = getCore(client);
-	const { signer } = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountsignerremove }, client).sdkRemoveBusinessAccountSigner({
-		businessAccountId,
-		environmentId: core.environmentId,
-		signerId,
-		walletId
-	});
-	return signer;
-};
-
-//#endregion
-//#region src/modules/waas/businessAccounts/removeBusinessAccountWallet/removeBusinessAccountWallet.ts
-/**
-* Removes a wallet from a business account (owner-/admin-only). The wallet and
-* all its associated signer rows are detached from the account. The backend
-* refuses to remove the last wallet on a business account.
-*
-* @param params.businessAccountId - The business account the wallet belongs to.
-* @param params.walletId - The wallet to remove (`BusinessAccountWallet.id`).
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The updated business account detail.
-*
-* @example
-* ```ts
-* const detail = await getBusinessAccount({ businessAccountId });
-* await removeBusinessAccountWallet({
-*   businessAccountId,
-*   walletId: detail.wallets[0].id,
-* });
-* ```
-*
-* @see addWalletToBusinessAccount
-* @see getBusinessAccount
-* @notInstrumented
-*/
-const removeBusinessAccountWallet = async ({ businessAccountId, walletId }, client = getDefaultClient()) => {
-	const core = getCore(client);
-	const detail = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountwalletremove }, client).sdkRemoveBusinessAccountWallet({
-		businessAccountId,
-		environmentId: core.environmentId,
-		walletId
-	});
-	await __refreshAuth_wrapped(client);
-	return detail;
-};
-
-//#endregion
-//#region src/modules/waas/policies/buildOperationForExistingRule/buildOperationForExistingRule.ts
-/**
-* Builds the operation to remove or rebuild `existingRule` when the
-* caller's requested keys touch it — outright removal when every key it
-* covers is being removed, or an upsert of the rule rebuilt from its
-* remaining keys when only some are. Returns undefined when none of the
-* requested keys touch this rule, when it's outside the sugar vocabulary,
-* or when it can't be identified without a `ruleId`.
-*
-* @param params.chain - The chain the rule to remove/rebuild applies to.
-* @param params.chainIds - The chain ids the rule to remove/rebuild applies to.
-* @param params.existingRule - The existing layer rule to check.
-* @param params.rules - The sugar keys to remove.
-* @returns The operation for this rule, or undefined when it isn't touched.
-* @notInstrumented
-*/
-const buildOperationForExistingRule = ({ chain, chainIds, existingRule, rules }) => {
-	if (existingRule.ruleId === void 0) return;
-	const covered = readCoveredRule(existingRule);
-	if (covered === void 0) return;
-	const remainingKeys = covered.keys.filter((key) => !rules.includes(key));
-	if (remainingKeys.length === covered.keys.length) return;
-	if (remainingKeys.length === 0) return {
-		op: WaasPolicyLayerRuleOperationOpEnum.Remove,
-		ruleId: existingRule.ruleId
-	};
-	const remainingRules = {};
-	for (const key of remainingKeys) Object.assign(remainingRules, { [key]: covered.values[key] });
-	const [rebuiltRule] = expandPolicyRules({
-		chain,
-		chainIds,
-		rules: remainingRules
-	});
-	if (rebuiltRule === void 0) return;
-	const keepsName = readCoveredRule(rebuiltRule)?.kind === covered.kind;
-	return {
-		op: WaasPolicyLayerRuleOperationOpEnum.Upsert,
-		rule: {
-			...rebuiltRule,
-			name: keepsName ? existingRule.name ?? rebuiltRule.name : rebuiltRule.name,
-			ruleId: existingRule.ruleId
-		}
-	};
-};
-
-//#endregion
-//#region src/modules/waas/policies/removePolicyRules/removePolicyRules.ts
-/**
-* Removes the rules behind one or more {@link PolicyRules} keys from a
-* policy layer, in one atomic `batch` PATCH. For every existing rule the
-* given keys touch, either removes it outright or — when it also covers a
-* key the caller didn't ask to remove (e.g. an
-* `allowAddresses`+`maxAmountPerTransaction` rule with only the cap
-* removed) — rebuilds it from the remaining keys so that restriction
-* survives.
-*
-* @param params.scope - Which policy layer to update — see {@link resolvePolicyScope}.
-* @param params.chain - The chain the rules to remove apply to.
-* @param params.chainIds - The chain ids the rules to remove apply to; omit to target the wildcard rule that matches every chain id of `chain`.
-* @param params.rules - The sugar keys to remove.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The policy layer as it stands after the batch is applied.
-* @throws When none of the given keys match an existing rule for this chain scope, or via {@link resolvePolicyScope}'s scope-resolution errors.
-* @notInstrumented
-*/
-const removePolicyRules = async ({ chain, chainIds, rules, scope }, client = getDefaultClient()) => {
-	const normalizedChainIds = chainIds ?? [];
-	const resolvedScope = resolvePolicyScope({ scope }, client);
-	const operations = ((await getResolvedPolicyLayer({ resolvedScope }, client)).layerContent.rules ?? []).filter((existingRule) => existingRule.chain === chain && sameChainIds({
-		existing: existingRule.chainIds,
-		requested: normalizedChainIds
-	})).map((existingRule) => buildOperationForExistingRule({
-		chain,
-		chainIds: normalizedChainIds,
-		existingRule,
-		rules
-	})).filter((operation) => operation !== void 0);
-	if (operations.length === 0) throw new InvalidParamError("removePolicyRules: none of the given rule keys matched an existing rule for this scope");
-	return applyPolicyLayerBatch({
-		operations,
-		resolvedScope
-	}, client);
-};
-
-//#endregion
-//#region src/modules/waas/policies/removeSignerPolicyRule/removeSignerPolicyRule.ts
-/**
-* Removes a single rule from a signer's policy layer. Calls the SDK API
-* directly (no MPC step), so a rejection surfaces as a thrown error.
-*
-* @param params.walletAccount - The wallet account whose signer-Layer to update.
-* @param params.ruleId - The id of the rule to remove.
-* @param [params.shareSetId] - The share set to target; defaults to the caller's own. Only the wallet's own owner may target another share set.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The signer-Layer as it stands after the rule is removed.
-* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
-* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
-* @notInstrumented
-*/
-const removeSignerPolicyRule = async ({ ruleId, shareSetId, walletAccount }, client = getDefaultClient()) => {
-	assertDefined(walletAccount.verifiedCredentialId, "removeSignerPolicyRule: cannot resolve a wallet id — use a verified wallet account");
-	const core = getCore(client);
-	return createApiClient({}, client).updateWaasSignerSelfPolicyLayer({
-		environmentId: core.environmentId,
-		waasSignerPolicyLayerUpdateRequest: {
-			op: WaasSignerPolicyLayerUpdateRequestOpEnum.Remove,
-			ruleId,
-			shareSetId
-		},
-		walletId: walletAccount.verifiedCredentialId
-	});
-};
-
-//#endregion
-//#region src/modules/waas/policies/removeWalletPolicyRule/removeWalletPolicyRule.ts
-/**
-* Removes a single rule from a wallet's policy layer. Calls the SDK API
-* directly (no MPC step), so a rejection surfaces as a thrown error.
-*
-* @param params.walletAccount - The wallet account to remove the rule from.
-* @param params.ruleId - The id of the rule to remove.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The wallet-Layer as it stands after the rule is removed.
-* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
-* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
-* @notInstrumented
-*/
-const removeWalletPolicyRule = async ({ ruleId, walletAccount }, client = getDefaultClient()) => {
-	assertDefined(walletAccount.verifiedCredentialId, "removeWalletPolicyRule: cannot resolve a wallet id — use a verified wallet account");
-	const core = getCore(client);
-	return createApiClient({}, client).updateWaasWalletSelfPolicyLayer({
-		environmentId: core.environmentId,
-		waasPolicyLayerUpdateRequest: {
-			op: WaasPolicyLayerUpdateRequestOpEnum.Remove,
-			ruleId
-		},
-		walletId: walletAccount.verifiedCredentialId
-	});
-};
-
-//#endregion
-//#region src/modules/waas/revokeWaasDelegation/revokeWaasDelegation.ts
-/**
-* Revokes the delegation of a WaaS wallet account.
-*
-* @param params.walletAccount - The WaaS wallet account to revoke delegation for.
-* @param [params.password] - Optional password for delegation operations.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A promise that resolves when the delegation is revoked.
-* @notInstrumented
-*/
-const revokeWaasDelegation = async ({ password, walletAccount }, client = getDefaultClient()) => {
-	await getWaasWalletProviderFromWalletAccount({ walletAccount }, client).revokeDelegation({
-		password,
-		walletAccount
-	});
-	await __refreshAuth_wrapped(client);
-};
-
-//#endregion
-//#region src/modules/waas/setWaasWalletAccountPassword/setWaasWalletAccountPassword.ts
-/**
-* Sets a password for a WaaS wallet account.
-*
-* @param params.walletAccount - The WaaS wallet account to set the password for.
-* @param params.password - The password to set for the wallet.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A promise that resolves when the password is successfully set.
-* @notInstrumented
-*/
-const setWaasWalletAccountPassword = async ({ password, walletAccount }, client = getDefaultClient()) => {
-	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).setWaasWalletAccountPassword({
-		password,
-		walletAccount
-	});
-};
-
-//#endregion
-//#region src/modules/wallets/userHasExternalWallet/userHasExternalWallet.ts
-/** @notInstrumented */
-const userHasExternalWallet = (user) => {
-	return user?.verifiedCredentials.some((vc) => vc.format === JwtVerifiedCredentialFormatEnum.Blockchain && vc.walletProvider !== WalletProviderEnum.EmbeddedWallet);
-};
-
-//#endregion
-//#region src/modules/waas/shouldAutoCreateWalletForChain/shouldAutoCreateWalletForChain.ts
-/**
-* Checks if a WaaS wallet should be automatically created for the specified blockchain.
-*
-* This function determines whether the current user configuration and project
-* settings require automatic wallet creation for the given chain, considering
-* whether the user already has an embedded wallet for the enabled chains or an external wallet.
-*
-* @param params.chain - The blockchain network to check.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns True if a wallet should be auto-created for the chain, false otherwise.
-* @notInstrumented
-*/
-const shouldAutoCreateWalletForChain = ({ chain }, client = getDefaultClient()) => {
-	assertDefined(client.projectSettings, "Project settings are not available");
-	const embeddedWalletSettings = client.projectSettings.sdk.embeddedWallets;
-	if (!embeddedWalletSettings?.automaticEmbeddedWalletCreation || !client.user) return false;
-	const automaticEmbeddedWalletCreationForExternalEnabled = embeddedWalletSettings?.automaticEmbeddedWalletCreationForExternal;
-	if (!(!userHasExternalWallet(client.user) || automaticEmbeddedWalletCreationForExternalEnabled)) return false;
-	return getChainsMissingWaasWalletAccounts(client).includes(chain);
-};
-
-//#endregion
-//#region src/modules/waas/signSerializedTransaction/signSerializedTransaction.ts
-/**
-* No gas estimation, balance check, or broadcast — unlike `transferAmount`.
-* Useful for exercising WaaS policy enforcement in isolation.
-*
-* @param params.walletAccount - The wallet account to sign with.
-* @param params.serializedTransaction - The raw serialized transaction (e.g. viem's `serializeTransaction`).
-* @param [params.chainId] - The chain id, if required by the target chain's signer.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The raw signature.
-* @notInstrumented
-*/
-const signSerializedTransaction = async ({ chainId, serializedTransaction, walletAccount }, client = getDefaultClient()) => {
-	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).signSerializedTransaction({
-		chainId,
-		serializedTransaction,
-		walletAccount
-	});
-};
-
-//#endregion
-//#region src/modules/waas/businessAccounts/transferBusinessAccountOwnership/transferBusinessAccountOwnership.ts
-/**
-* Transfers ownership of a business account to another member. Owner-only: the
-* `newOwnerUserId` must already be a member, is promoted to owner, and the
-* current owner is atomically demoted to admin.
-*
-* @param params.businessAccountId - The business account whose ownership moves.
-* @param params.newOwnerUserId - The member to promote to owner.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The updated business account detail.
-*
-* @example
-* ```ts
-* const detail = await getBusinessAccount({ businessAccountId });
-* const target = detail.members.find((m) => m.role === 'admin');
-* await transferBusinessAccountOwnership({
-*   businessAccountId,
-*   newOwnerUserId: target.userId,
-* });
-* ```
-*
-* @see getBusinessAccount
-* @notInstrumented
-*/
-const transferBusinessAccountOwnership = async ({ businessAccountId, newOwnerUserId }, client = getDefaultClient()) => {
-	const core = getCore(client);
-	const detail = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccounttransferOwnership }, client).sdkTransferBusinessAccountOwnership({
-		businessAccountId,
-		environmentId: core.environmentId,
-		transferBusinessAccountOwnershipSdkRequest: { newOwnerUserId }
-	});
-	await __logoutWithReason_wrapped({ reason: "business-account-ownership-transferred" }, client);
-	return detail;
-};
-
-//#endregion
-//#region src/modules/waas/unlockWallet/unlockWallet.ts
-/**
-* Unlocks a WaaS wallet account.
-*
-* @param params.walletAccount - The WaaS wallet account to unlock.
-* @param params.password - The password to unlock the wallet.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A promise that resolves with the wallet information.
-* @notInstrumented
-*/
-const unlockWallet = async ({ password, walletAccount }, client = getDefaultClient()) => {
-	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).unlockWallet({
-		password,
-		walletAccount
-	});
-};
-
-//#endregion
-//#region src/modules/waas/businessAccounts/updateBusinessAccount/updateBusinessAccount.ts
-/**
-* Renames a business account (owner-/admin-only). Calls the SDK API directly
-* (no MPC step), so a rejection surfaces as a thrown error.
-*
-* @param params.businessAccountId - The business account to rename.
-* @param params.name - The new name.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The updated business account.
-*
-* @example
-* ```ts
-* await updateBusinessAccount({ businessAccountId, name: 'Acme Inc' });
-* ```
-*
-* @see getBusinessAccount
-* @notInstrumented
-*/
-const updateBusinessAccount = async ({ businessAccountId, name: name$1 }, client = getDefaultClient()) => {
-	const core = getCore(client);
-	return await createApiClient({}, client).sdkUpdateBusinessAccount({
-		businessAccountId,
-		environmentId: core.environmentId,
-		updateBusinessAccountSdkRequest: { name: name$1 }
-	});
-};
-
-//#endregion
-//#region src/modules/waas/businessAccounts/updateBusinessAccountMemberRole/updateBusinessAccountMemberRole.ts
-const ROLE_TO_API = {
-	admin: AssignableBusinessAccountMemberRole.Admin,
-	viewer: AssignableBusinessAccountMemberRole.Viewer
-};
-/**
-* Changes an existing member's role between `admin` and `viewer` (owner-/admin-only).
-* Owner is not assignable here — use `transferBusinessAccountOwnership` for that.
-*
-* @param params.businessAccountId - The business account the member belongs to.
-* @param params.userId - The member whose role changes.
-* @param params.role - The new role (`admin` or `viewer`).
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The updated business account member.
-*
-* @example
-* ```ts
-* await updateBusinessAccountMemberRole({
-*   businessAccountId,
-*   userId: member.userId,
-*   role: 'admin',
-* });
-* ```
-*
-* @see transferBusinessAccountOwnership
-* @see addBusinessAccountMember
-* @notInstrumented
-*/
-const updateBusinessAccountMemberRole = async ({ businessAccountId, userId, role }, client = getDefaultClient()) => {
-	const core = getCore(client);
-	return await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountmemberroleupdate }, client).sdkUpdateBusinessAccountMemberRole({
-		businessAccountId,
-		environmentId: core.environmentId,
-		updateBusinessAccountMemberRoleSdkRequest: { role: ROLE_TO_API[role] },
-		userId
-	});
-};
-
-//#endregion
-//#region src/modules/waas/updateWaasPassword/updateWaasPassword.ts
-/**
-* Updates the password for a WaaS wallet account.
-*
-* This function changes the password used to encrypt and protect the
-* cryptographic key shares for the specified wallet account.
-*
-* @param params.walletAccount - The WaaS wallet account to update the password for.
-* @param params.currentPassword - The current password for the wallet.
-* @param params.newPassword - The new password to set for the wallet.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns A promise that resolves when the password is successfully updated.
-* @notInstrumented
-*/
-const updateWaasPassword = async ({ currentPassword, newPassword, walletAccount }, client = getDefaultClient()) => {
-	return getWaasWalletProviderFromWalletAccount({ walletAccount }, client).updatePassword({
-		currentPassword,
-		newPassword,
-		walletAccount
-	});
-};
-
-//#endregion
-//#region src/modules/waas/policies/upsertAccountPolicyRule/upsertAccountPolicyRule.ts
-/**
-* Creates or updates a single rule on a business account's account-Layer
-* (rules applied to every wallet in the account). Build `rule` with
-* {@link buildAllowPolicyRule} / {@link buildDenyPolicyRule}. Omit
-* `rule.ruleId` to create a new rule (the enclave mints one for you); pass
-* an existing `ruleId` to update it in place. BA owner/admin only. Calls
-* the SDK API directly (no MPC step), so a rejection surfaces as a thrown
-* error.
-*
-* @param params.businessAccountId - The business account to apply the rule to.
-* @param params.rule - The rule to create or update.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The account-Layer as it stands after the rule is applied.
-* @notInstrumented
-*/
-const upsertAccountPolicyRule = async ({ businessAccountId, rule }, client = getDefaultClient()) => {
-	const core = getCore(client);
-	return createApiClient({}, client).updateBusinessAccountPolicyLayer({
-		businessAccountId,
-		environmentId: core.environmentId,
-		waasPolicyLayerUpdateRequest: {
-			op: WaasPolicyLayerUpdateRequestOpEnum.Upsert,
-			rule
-		}
-	});
-};
-
-//#endregion
-//#region src/modules/waas/policies/upsertSignerPolicyRule/upsertSignerPolicyRule.ts
-/**
-* Creates or updates a single rule on a signer's policy layer. Build `rule`
-* with {@link buildAllowPolicyRule} / {@link buildDenyPolicyRule}. Omit
-* `rule.ruleId` to create a new rule (the enclave mints one for you); pass an
-* existing `ruleId` to update it in place. Calls the SDK API directly (no MPC
-* step), so a rejection surfaces as a thrown error.
-*
-* @param params.walletAccount - The wallet account whose signer-Layer to update.
-* @param params.rule - The rule to create or update.
-* @param [params.shareSetId] - The share set to target; defaults to the caller's own. Only the wallet's own owner may target another share set.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The signer-Layer as it stands after the rule is applied.
-* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
-* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
-* @notInstrumented
-*/
-const upsertSignerPolicyRule = async ({ rule, shareSetId, walletAccount }, client = getDefaultClient()) => {
-	assertDefined(walletAccount.verifiedCredentialId, "upsertSignerPolicyRule: cannot resolve a wallet id — use a verified wallet account");
-	const core = getCore(client);
-	return createApiClient({}, client).updateWaasSignerSelfPolicyLayer({
-		environmentId: core.environmentId,
-		waasSignerPolicyLayerUpdateRequest: {
-			op: WaasSignerPolicyLayerUpdateRequestOpEnum.Upsert,
-			rule,
-			shareSetId
-		},
-		walletId: walletAccount.verifiedCredentialId
-	});
-};
-
-//#endregion
-//#region src/modules/waas/policies/upsertWalletPolicyRule/upsertWalletPolicyRule.ts
-/**
-* Creates or updates a single rule on a wallet's policy layer. Build `rule`
-* with {@link buildAllowPolicyRule} / {@link buildDenyPolicyRule}. Omit
-* `rule.ruleId` to create a new rule (the enclave mints one for you); pass an
-* existing `ruleId` to update it in place. Calls the SDK API directly (no MPC
-* step), so a rejection surfaces as a thrown error.
-*
-* @param params.walletAccount - The wallet account to apply the rule to.
-* @param params.rule - The rule to create or update.
-* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
-* @returns The wallet-Layer as it stands after the rule is applied.
-* @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).
-* @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.
-* @notInstrumented
-*/
-const upsertWalletPolicyRule = async ({ rule, walletAccount }, client = getDefaultClient()) => {
-	assertDefined(walletAccount.verifiedCredentialId, "upsertWalletPolicyRule: cannot resolve a wallet id — use a verified wallet account");
-	const core = getCore(client);
-	return createApiClient({}, client).updateWaasWalletSelfPolicyLayer({
-		environmentId: core.environmentId,
-		waasPolicyLayerUpdateRequest: {
-			op: WaasPolicyLayerUpdateRequestOpEnum.Upsert,
-			rule
-		},
-		walletId: walletAccount.verifiedCredentialId
-	});
-};
-
-//#endregion
-//#region src/exports/waas.ts
-assertPackageVersion(name, version);
-
-//#endregion
-export { NotWaasWalletProviderError, TransactionBroadcastError, WaasWalletShareSetType, addBusinessAccountMember, addBusinessAccountSigner, addWalletToBusinessAccount, backupWaasKeySharesToGoogleDrive, buildAllowPolicyRule, buildDenyPolicyRule, createBusinessAccount, createPolicy, createWaasOfflineRecoveryShares, createWaasWalletAccounts, createWalletForBusinessAccount, delegateWaasKeyShares, desugarPolicyRules, expandPolicyRules, exportWaasClientKeyshares, exportWaasPrivateKey, getAccountPolicyLayer, getBusinessAccount, getChainsMissingWaasWalletAccounts, getPolicy, getSignerPolicyLayer, getWalletAccountShareSets, getWalletPolicyLayer, getWalletRecoveryState, hasDelegatedAccess, importWaasPrivateKey, isDynamicWaasEnabled, isPasswordRequiredForWaasWallets, isWaasWalletAccount, isWalletCreationRequirement, listBusinessAccounts, migrateFromFireblocks, normalizeWalletRequirements, refreshWaasWalletAccountShares, removeAccountPolicyRule, removeBusinessAccountMember, removeBusinessAccountSigner, removeBusinessAccountWallet, removePolicyRules, removeSignerPolicyRule, removeWalletPolicyRule, resolvePolicyScope, revokeWaasDelegation, setWaasWalletAccountPassword, shouldAutoCreateWalletForChain, signSerializedTransaction, transferBusinessAccountOwnership, unlockWallet, updateBusinessAccount, updateBusinessAccountMemberRole, updateWaasPassword, upsertAccountPolicyRule, upsertSignerPolicyRule, upsertWalletPolicyRule };
-//# sourceMappingURL=waas.esm.js.map
+export { NotWaasWalletProviderError, TransactionBroadcastError, WaasChainEnum, WaasWalletShareSetType, addBusinessAccountMember, addBusinessAccountSigner, addWalletToBusinessAccount, backupWaasKeySharesToGoogleDrive, buildAllowPolicyRule, buildDenyPolicyRule, createBusinessAccount, createPolicy, createWaasOfflineRecoveryShares, createWaasWalletAccounts, createWalletForBusinessAccount, delegateWaasKeyShares, desugarPolicyRules, expandPolicyRules, exportWaasClientKeyshares, exportWaasPrivateKey, getAccountPolicyLayer, getBusinessAccount, getChainsMissingWaasWalletAccounts, getPolicy, getSignerPolicyLayer, getWalletAccountShareSets, getWalletPolicyLayer, getWalletRecoveryState, hasDelegatedAccess, importWaasPrivateKey, isDynamicWaasEnabled, isPasswordRequiredForWaasWallets, isWaasWalletAccount, isWalletCreationRequirement, listBusinessAccounts, migrateFromFireblocks, normalizeWalletRequirements, refreshWaasWalletAccountShares, removeAccountPolicyRule, removeBusinessAccountMember, removeBusinessAccountSigner, removeBusinessAccountWallet, removePolicyRules, removeSignerPolicyRule, removeWalletPolicyRule, resolvePolicyScope, revokeWaasDelegation, setWaasWalletAccountPassword, shouldAutoCreateWalletForChain, signSerializedTransaction, transferBusinessAccountOwnership, unlockWallet, updateBusinessAccount, updateBusinessAccountMemberRole, updateWaasPassword, upsertAccountPolicyRule, upsertSignerPolicyRule, upsertWalletPolicyRule };