@dynamic-labs-sdk/client 1.33.2 → 1.33.4

package/dist/{waas-H5xyBfTI.esm.js → waas-BAcC_ZEU.esm.js}

@@ -1,8 +1,8 @@
-import { B as getWalletAccounts, D as findWaasWalletProviderByChain, E as isWaasWalletAccount, Et as BaseError, O as isWaasWalletProvider, Ot as name, S as InvalidParamError, St as getDefaultClient, Tt as getCore, U as getChainFromVerifiedCredentialChain, V as formatWalletProviderKey, _t as assertDefined, c as NoWalletProviderFoundError, j as DYNAMIC_WAAS_METADATA, kt as version, l as createApiClient, t as __logoutWithReason_wrapped, u as __refreshAuth_wrapped } from "./logoutWithReason-B-cf-dUs.esm.js";
-import { n as isDynamicWaasEnabled, o as NotWaasWalletProviderError, r as getWaasWalletProviderFromWalletAccount } from "./migrateFromFireblocks-B76sFd7a.esm.js";
-import { n as getWalletProviderByKey, t as getVerifiedCredentialForWalletAccount } from "./getVerifiedCredentialForWalletAccount-DzZ-0SaQ.esm.js";
+import { At as version, C as InvalidParamError, Ct as getDefaultClient, D as isWaasWalletAccount, Dt as BaseError, Et as getCore, H as formatWalletProviderKey, M as DYNAMIC_WAAS_METADATA, O as findWaasWalletProviderByChain, V as getWalletAccounts, W as getChainFromVerifiedCredentialChain, d as __refreshAuth_wrapped, k as isWaasWalletProvider, kt as name, l as NoWalletProviderFoundError, t as __logoutWithReason_wrapped, u as createApiClient, vt as assertDefined } from "./logoutWithReason-Demgc354.esm.js";
+import { n as isDynamicWaasEnabled, o as NotWaasWalletProviderError, r as getWaasWalletProviderFromWalletAccount } from "./migrateFromFireblocks-DSgWzuHJ.esm.js";
+import { n as getWalletProviderByKey, t as getVerifiedCredentialForWalletAccount } from "./getVerifiedCredentialForWalletAccount-BWtWpYjd.esm.js";
 import { assertPackageVersion } from "@dynamic-labs-sdk/assert-package-version";
-import { JwtVerifiedCredentialFormatEnum, TokenScope, UserIdentifierTypeEnum, WaasChainEnum, WaasPolicyLayerRuleOperationOpEnum, WaasPolicyLayerUpdateRequestOpEnum, WaasPolicyRuleType, WaasSignerPolicyLayerUpdateRequestOpEnum, WaasWalletShareSetType, WalletProviderEnum } from "@dynamic-labs/sdk-api-core";
+import { BusinessAccountProposalStatus, JwtVerifiedCredentialFormatEnum, TokenScope, UserIdentifierTypeEnum, WaasChainEnum, WaasPolicyLayerRuleOperationOpEnum, WaasPolicyLayerUpdateRequestOpEnum, WaasPolicyRuleType, WaasSignerPolicyLayerUpdateRequestOpEnum, WaasWalletShareSetType, WalletProviderEnum } from "@dynamic-labs/sdk-api-core";
 
 //#region src/modules/waas/waas.consts.ts
 /**
@@ -99,6 +99,39 @@ const parseGovernedResponse = async ({ fnName, response }) => {
 	return payload;
 };
 
+//#endregion
+//#region src/modules/waas/businessAccounts/resendFields.ts
+/**
+* The `autoExecute`/`intent`/`intentSignature` fields shared by every governed
+* mutation's request body.
+*
+* `autoExecute` is read only on the first call — once an intent is signed, it
+* carries its own copy and the server ignores whatever this call sends, so an
+* approver's consent can't be overridden after the fact.
+*
+* @param [params.autoExecute] - Whether to apply immediately on the completing
+*   approval. Only meaningful on the first (unsigned) call.
+* @param [params.signed] - A previously-signed intent, to resend past
+*   `INTENT_REQUIRED`.
+* @returns The fields to spread into a governed mutation's SDK request body.
+*
+* @example
+* ```ts
+* const body = { businessAccountId, ...resendFields({ signed }) };
+* ```
+*
+* @see {@link SignedBusinessAccountIntent} for what `signed` carries.
+* @see {@link parseGovernedResponse} for reading the `intent` back off a 202.
+* @notInstrumented
+*/
+const resendFields = ({ autoExecute, signed }) => ({
+	...autoExecute === void 0 ? {} : { autoExecute },
+	...signed ? {
+		intent: signed.intent,
+		intentSignature: signed.intentSignature
+	} : {}
+});
+
 //#endregion
 //#region src/modules/waas/businessAccounts/addBusinessAccountMember/addBusinessAccountMember.ts
 /**
@@ -112,19 +145,23 @@ const parseGovernedResponse = async ({ fnName, response }) => {
 *
 * When the account governs `addMember`, nothing is written and the 202 body is
 * returned instead — first the intent to sign, then the proposal collecting
-* approvals. Narrow it with `isBusinessAccountActionRequired`.
+* approvals. Narrow it with `isBusinessAccountActionRequired`. Resend with
+* `signed` (from `signBusinessAccountIntent`) to move past `INTENT_REQUIRED`.
 *
 * @param params.businessAccountId - The ID of the business account.
 * @param params.targetIdentity - The member to add (userId, or identifier + identifierType).
 * @param [params.role] - The member role: a built-in (`admin`, `viewer`) or a
 *   role this account defined. Defaults to `viewer`. `owner` is rejected — use
 *   `transferBusinessAccountOwnership`.
+* @param [params.autoExecute] - Whether to apply on the completing approval.
+*   Only meaningful on the first call.
+* @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns The created business account member, or the outstanding action required.
 * @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.
 * @notInstrumented
 */
-const addBusinessAccountMember = async ({ businessAccountId, targetIdentity, role }, client = getDefaultClient()) => {
+const addBusinessAccountMember = async ({ businessAccountId, targetIdentity, role, autoExecute, signed }, client = getDefaultClient()) => {
 	assertTargetIdentity({
 		fnName: "addBusinessAccountMember",
 		targetIdentity
@@ -139,7 +176,11 @@ const addBusinessAccountMember = async ({ businessAccountId, targetIdentity, rol
 			smsCountryCode,
 			socialProvider,
 			type: identifierType ? IDENTIFIER_TYPE_TO_API[identifierType] : void 0,
-			userId
+			userId,
+			...resendFields({
+				autoExecute,
+				signed
+			})
 		},
 		businessAccountId,
 		environmentId: core.environmentId
@@ -232,33 +273,209 @@ const addBusinessAccountSigner = async ({ walletAccount, businessAccountId, wall
 *
 * When the account governs `linkWallet`, nothing is written and the 202 body is
 * returned instead — first the intent to sign, then the proposal collecting
-* approvals. Narrow it with `isBusinessAccountActionRequired`.
+* approvals. Narrow it with `isBusinessAccountActionRequired`. Resend with
+* `signed` (from `signBusinessAccountIntent`) to move past `INTENT_REQUIRED`.
 *
 * @param [params.businessAccountId] - The business account to link to; found-or-created when omitted.
 * @param params.walletId - The ID of the wallet to link.
+* @param [params.autoExecute] - Whether to apply on the completing approval.
+*   Only meaningful on the first call.
+* @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns The updated business account detail, or the outstanding action required.
+* @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.
 * @notInstrumented
 */
-const addWalletToBusinessAccount = async ({ businessAccountId, walletId }, client = getDefaultClient()) => {
+const addWalletToBusinessAccount = async ({ businessAccountId, walletId, autoExecute, signed }, client = getDefaultClient()) => {
 	const core = getCore(client);
 	const response = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountlinkWallet }, client).sdkLinkBusinessAccountWalletRaw({
 		environmentId: core.environmentId,
 		linkBusinessAccountWalletSdkRequest: {
 			businessAccountId,
-			walletId
+			walletId,
+			...resendFields({
+				autoExecute,
+				signed
+			})
 		}
 	});
-	if (response.raw.status === 202) {
-		const payload = await response.raw.json();
-		if (payload.reason !== "INTENT_REQUIRED" && payload.reason !== "APPROVALS_REQUIRED" || !payload.intent) throw new UnexpectedConsentResponseError({ message: `addWalletToBusinessAccount: unexpected 202 body: ${JSON.stringify(payload)}` });
-		return payload;
-	}
+	if (response.raw.status === 202) return parseGovernedResponse({
+		fnName: "addWalletToBusinessAccount",
+		response: response.raw
+	});
 	const detail = await response.value();
 	await __refreshAuth_wrapped(client);
 	return detail;
 };
 
+//#endregion
+//#region src/modules/sessionKeys/canonicalizeJson/canonicalizeJson.ts
+const codepointCompare = (a, b) => {
+	if (a < b) return -1;
+	if (a > b) return 1;
+	return 0;
+};
+const MAX_CANONICALIZE_DEPTH = 64;
+var CanonicalizeDepthError = class extends Error {
+	constructor() {
+		super(`canonicalization exceeded max nesting depth (${MAX_CANONICALIZE_DEPTH})`);
+		this.name = "CanonicalizeDepthError";
+	}
+};
+const sortDeep = (value, depth) => {
+	if (depth > MAX_CANONICALIZE_DEPTH) throw new CanonicalizeDepthError();
+	if (Array.isArray(value)) return value.map((item) => sortDeep(item, depth + 1));
+	if (value !== null && typeof value === "object") {
+		const sorted = Object.create(null);
+		for (const key of Object.keys(value).sort(codepointCompare)) {
+			const field = value[key];
+			if (field === void 0) continue;
+			sorted[key] = sortDeep(field, depth + 1);
+		}
+		return sorted;
+	}
+	return value;
+};
+/**
+* Deterministic canonical JSON: codepoint-sorted keys at every depth, arrays
+* in order, `undefined` fields removed, no whitespace. Byte-identical to
+* auth-service's `enclave/canonical-json`, which the enclave re-canonicalizes
+* against when verifying signatures.
+*
+* @param obj - The document to canonicalize.
+* @returns The canonical JSON string.
+*
+* @example
+* ```typescript
+* canonicalizeJson({ b: 1, a: 2 }); // '{"a":2,"b":1}'
+* ```
+*
+* @see {@link signBusinessAccountIntent} for the signature flow that depends on this byte sequence.
+* @see {@link signBusinessAccountApproval} for the co-signer flow using the same canonical form.
+* @notInstrumented
+*/
+const canonicalizeJson = (obj) => JSON.stringify(sortDeep(obj, 0));
+
+//#endregion
+//#region src/modules/sessionKeys/signBusinessAccountIntent/signBusinessAccountIntent.ts
+/**
+* Sign an intent with the session key.
+*
+* The signature is over the CANONICAL form, not over `JSON.stringify(intent)` —
+* the enclave re-canonicalizes before verifying, so a signature over any other
+* byte sequence will not verify. Nothing here chooses that byte sequence
+* freely: it is fixed by `canonicalizeJson`.
+*
+* The private half never enters JS. `keychain.sign` holds a non-extractable
+* key and returns a P1363 hex signature, which is the form the enclave's
+* WebCrypto verify expects.
+*
+* @param params.intent - The intent to sign.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The intent alongside the P1363 hex signature over its canonical form.
+*
+* @example
+* ```typescript
+* const { intent, intentSignature } = await signBusinessAccountIntent({ intent: draftIntent });
+* ```
+*
+* @see {@link signBusinessAccountApproval} for a co-signer approving this intent.
+* @see {@link BusinessAccountIntent} for the shape being signed.
+* @noHook A local crypto step inside a larger flow, not a standalone server mutation a component would drive loading/error state around.
+* @notInstrumented
+*/
+const signBusinessAccountIntent = async ({ intent }, client = getDefaultClient()) => {
+	return {
+		intent,
+		intentSignature: await getCore(client).keychain.sign("session", canonicalizeJson(intent))
+	};
+};
+/**
+* Sign an approval of someone else's intent.
+*
+* The payload is `{ approvedAt, intent }` rather than the intent alone, so each
+* approver attests WHEN they consented as well as what to. The enclave measures
+* the execution window from the latest of those timestamps, which it could not
+* do from an unsigned value — a caller could simply claim a fresher one.
+*
+* Sent whether or not the account configures an execution window: a signed
+* shape that varied with configuration would mean reading governance before
+* knowing what to sign.
+*
+* @param params.intent - The intent being approved.
+* @param params.approvedAt - When the approver consented. Defaults to now.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The timestamp signed over, alongside the P1363 hex signature.
+*
+* @example
+* ```typescript
+* const { approvedAt, signature } = await signBusinessAccountApproval({ intent });
+* ```
+*
+* @see {@link signBusinessAccountIntent} for the initiator's own signature over the intent.
+* @see {@link BusinessAccountIntent} for the shape being approved.
+* @noHook A local crypto step inside a larger flow — {@link approveBusinessAccountProposal} already wraps it for the normal approve-a-proposal case.
+* @notInstrumented
+*/
+const signBusinessAccountApproval = async ({ intent, approvedAt = (/* @__PURE__ */ new Date()).toISOString() }, client = getDefaultClient()) => {
+	return {
+		approvedAt,
+		signature: await getCore(client).keychain.sign("session", canonicalizeJson({
+			approvedAt,
+			intent
+		}))
+	};
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/approveBusinessAccountProposal/approveBusinessAccountProposal.ts
+/**
+* Signs and records this session's approval of a pending proposal.
+*
+* The signature is over the intent AS STORED on `proposal`, which is why it's
+* read off the proposal rather than rebuilt — a re-derived intent would carry
+* a different `intentId` and fail verification. Run this signed in as the
+* approver: the session key that signs is theirs, and the enclave reads who
+* they are from the bearer token, not from any field here. An initiator can
+* never approve their own proposal.
+*
+* With `autoExecute` on, the approval that completes the quorum also applies
+* the change and the returned proposal reads `status: 'executed'` — the
+* caller's cue to refresh the account rather than inferring readiness from
+* the tally.
+*
+* @param params.businessAccountId - The business account the proposal belongs to.
+* @param params.proposal - The proposal to approve, as returned by
+*   `listBusinessAccountProposals` or `getBusinessAccount`.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The proposal after recording this approval.
+*
+* @example
+* ```ts
+* const pending = await listBusinessAccountProposals({ businessAccountId, status: 'pending' });
+* const updated = await approveBusinessAccountProposal({ businessAccountId, proposal: pending[0] });
+* if (updated.status === 'executed') {
+*   // refresh the account — the change is live
+* }
+* ```
+*
+* @see {@link vetoBusinessAccountProposal} for refusing a proposal instead.
+* @see {@link executeBusinessAccountProposal} for applying a satisfied one with `autoExecute` off.
+* @notInstrumented
+*/
+const approveBusinessAccountProposal = async ({ businessAccountId, proposal }, client = getDefaultClient()) => {
+	const { approvedAt, signature } = await signBusinessAccountApproval({ intent: proposal.intent }, client);
+	return await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountproposalapprove }, client).sdkApproveBusinessAccountProposal({
+		approveBusinessAccountProposalSdkRequest: {
+			approvedAt: new Date(approvedAt),
+			signature
+		},
+		businessAccountId,
+		environmentId: getCore(client).environmentId,
+		proposalId: proposal.id
+	});
+};
+
 //#endregion
 //#region src/modules/waas/backupWaasKeySharesToGoogleDrive/backupWaasKeySharesToGoogleDrive.ts
 /**
@@ -1165,6 +1382,62 @@ const createWalletForBusinessAccount = async ({ businessAccountId, chain, passwo
 	return wallet;
 };
 
+//#endregion
+//#region src/modules/waas/businessAccounts/defineBusinessAccountRole/defineBusinessAccountRole.ts
+/**
+* Defines a custom role that inherits the authority of a built-in one.
+* Inheriting is real: a holder passes every check gated on the base role,
+* under the custom name rather than the base name itself. A role cannot
+* inherit `owner` — use `transferBusinessAccountOwnership` to grant ownership.
+*
+* When the account governs `defineRole`, nothing is written and the 202 body
+* is returned instead. Resend with `signed` (from `signBusinessAccountIntent`)
+* to move past `INTENT_REQUIRED`.
+*
+* @param params.businessAccountId - The business account defining the role.
+* @param params.role - The new role's name.
+* @param params.inherits - The built-in role (`admin` or `viewer`) this role inherits.
+* @param [params.autoExecute] - Whether to apply on the completing approval.
+*   Only meaningful on the first call.
+* @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The new document version, or the outstanding action required.
+*
+* @example
+* ```ts
+* await defineBusinessAccountRole({
+*   businessAccountId,
+*   role: 'cfo',
+*   inherits: 'admin',
+* });
+* ```
+*
+* @see {@link deleteBusinessAccountRole}
+* @see {@link listBusinessAccountRoles}
+* @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.
+* @notInstrumented
+*/
+const defineBusinessAccountRole = async ({ businessAccountId, role, inherits, autoExecute, signed }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	const response = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountroledefine }, client).sdkDefineBusinessAccountRoleRaw({
+		businessAccountId,
+		defineBusinessAccountRoleSdkRequest: {
+			inherits,
+			role,
+			...resendFields({
+				autoExecute,
+				signed
+			})
+		},
+		environmentId: core.environmentId
+	});
+	if (response.raw.status === 202) return parseGovernedResponse({
+		fnName: "defineBusinessAccountRole",
+		response: response.raw
+	});
+	return await response.value();
+};
+
 //#endregion
 //#region src/modules/waas/delegateWaasKeyShares/delegateWaasKeyShares.ts
 /**
@@ -1189,6 +1462,56 @@ const delegateWaasKeyShares = async ({ initialSignerRules, password, walletAccou
 	await __refreshAuth_wrapped(client);
 };
 
+//#endregion
+//#region src/modules/waas/businessAccounts/deleteBusinessAccountRole/deleteBusinessAccountRole.ts
+/**
+* Deletes a custom role definition. Holders are not removed and keep every
+* capability they had — they're demoted to the role's inherited base (e.g. a
+* deleted `cfo` role that inherited `admin` leaves its holders reading
+* `admin`), since only the name goes away, not the authority. Refused with
+* `ROLE_REFERENCED_BY_GOVERNANCE` while a governance requirement still names
+* the role — remove it from governance first.
+*
+* When the account governs `deleteRole`, nothing is written and the 202 body
+* is returned instead. Resend with `signed` (from `signBusinessAccountIntent`)
+* to move past `INTENT_REQUIRED`.
+*
+* @param params.businessAccountId - The business account the role belongs to.
+* @param params.role - The role's name.
+* @param [params.autoExecute] - Whether to apply on the completing approval.
+*   Only meaningful on the first call.
+* @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The new document version, or the outstanding action required.
+*
+* @example
+* ```ts
+* await deleteBusinessAccountRole({ businessAccountId, role: 'cfo' });
+* ```
+*
+* @see {@link defineBusinessAccountRole}
+* @see {@link listBusinessAccountRoles}
+* @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.
+* @notInstrumented
+*/
+const deleteBusinessAccountRole = async ({ businessAccountId, role, autoExecute, signed }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	const response = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountroledelete }, client).sdkDeleteBusinessAccountRoleRaw({
+		businessAccountId,
+		deleteBusinessAccountRoleSdkRequest: resendFields({
+			autoExecute,
+			signed
+		}),
+		environmentId: core.environmentId,
+		role
+	});
+	if (response.raw.status === 202) return parseGovernedResponse({
+		fnName: "deleteBusinessAccountRole",
+		response: response.raw
+	});
+	return await response.value();
+};
+
 //#endregion
 //#region src/modules/waas/policies/findMatchedRuleKind/findMatchedRuleKind.ts
 const COUPLED_RULE_KINDS = new Set(["allowAddresses", "maxAmountPerTransaction"]);
@@ -1284,6 +1607,57 @@ const desugarPolicyRules = ({ entries }) => {
 	};
 };
 
+//#endregion
+//#region src/modules/waas/businessAccounts/executeBusinessAccountProposal/executeBusinessAccountProposal.ts
+/**
+* Applies a proposal whose quorum is already met — the counterpart to
+* `autoExecute: false`, where the completing approval records consent but
+* does not itself apply the change. Also the only way to run a ceremony
+* action's change (e.g. `addSignerToWallet`): its reshare needs a live signer
+* to come back and run it, so the server forces `autoExecute` false in the
+* signed bytes regardless of what was requested, and this is what someone
+* holding a share calls afterward.
+*
+* A 202 here is not a failure — it means the collected approvals still don't
+* satisfy the requirement, and the proposal stays `pending`.
+*
+* @param params.businessAccountId - The business account the proposal belongs to.
+* @param params.proposalId - The proposal to execute.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The new document version, or the tally if approvals still fall short.
+*
+* @example
+* ```ts
+* const result = await executeBusinessAccountProposal({ businessAccountId, proposalId });
+* if ('reason' in result) {
+*   console.log(result.approvalRequirements);
+* }
+* ```
+*
+* @see {@link approveBusinessAccountProposal} for the completing approval that usually does this instead.
+* @see {@link BusinessAccountProposalStillPending} for the tally shape when it's still short.
+* @throws {UnexpectedConsentResponseError} When a 202 answers with an unrecognized body.
+* @notInstrumented
+*/
+const executeBusinessAccountProposal = async ({ businessAccountId, proposalId }, client = getDefaultClient()) => {
+	const response = await createApiClient({}, client).sdkExecuteBusinessAccountProposalRaw({
+		businessAccountId,
+		environmentId: getCore(client).environmentId,
+		proposalId
+	});
+	if (response.raw.status === 202) {
+		const payload = await response.raw.json();
+		if (payload.reason !== "APPROVALS_REQUIRED" || !payload.intent) throw new UnexpectedConsentResponseError({ message: "executeBusinessAccountProposal: unexpected 202 body" });
+		return {
+			approvalRequirements: payload.approvalRequirements ?? [],
+			intent: payload.intent,
+			proposalId,
+			reason: "APPROVALS_REQUIRED"
+		};
+	}
+	return await response.value();
+};
+
 //#endregion
 //#region src/modules/waas/exportWaasClientKeyshares/exportWaasClientKeyshares.ts
 /**
@@ -1366,6 +1740,38 @@ const getBusinessAccount = async ({ businessAccountId }, client = getDefaultClie
 	});
 };
 
+//#endregion
+//#region src/modules/waas/businessAccounts/getBusinessAccountGovernance/getBusinessAccountGovernance.ts
+/**
+* Reads the approval requirements currently in force for a business account,
+* keyed by governed action. Empty when the account governs nothing — that's
+* an answer, not a missing resource.
+*
+* There's no other way to tell a governed account from an ungoverned one
+* ahead of time: a mutation only reveals it by answering 202.
+*
+* @param params.businessAccountId - The business account whose governance to read.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The governance section, keyed by governed action.
+*
+* @example
+* ```ts
+* const governance = await getBusinessAccountGovernance({ businessAccountId });
+* const addMemberRules = governance.addMember ?? [];
+* ```
+*
+* @see {@link setBusinessAccountGovernance} for writing it back.
+* @see {@link BusinessAccountGovernance} for the returned shape.
+* @notInstrumented
+*/
+const getBusinessAccountGovernance = async ({ businessAccountId }, client = getDefaultClient()) => {
+	const { governance } = await createApiClient({}, client).sdkGetBusinessAccountGovernance({
+		businessAccountId,
+		environmentId: getCore(client).environmentId
+	});
+	return governance;
+};
+
 //#endregion
 //#region src/modules/wallets/userHasEmbeddedWalletForChain/userHasEmbeddedWalletForChain.ts
 /** @notInstrumented */
@@ -1601,6 +2007,84 @@ const isPasswordRequiredForWaasWallets = (client = getDefaultClient()) => {
 	return user.verifiedCredentials.some((credential) => credential.walletProperties?.keyShares?.some((keyShare) => keyShare.passwordEncrypted));
 };
 
+//#endregion
+//#region src/modules/waas/businessAccounts/listBusinessAccountProposals/listBusinessAccountProposals.ts
+/**
+* Lists a business account's governed-mutation proposals.
+*
+* @param params.businessAccountId - The business account whose proposals to list.
+* @param [params.status] - Filter to `pending` only; omit for every status.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The matching proposals.
+*
+* @example
+* ```ts
+* const pending = await listBusinessAccountProposals({ businessAccountId, status: 'pending' });
+* ```
+*
+* @see {@link approveBusinessAccountProposal}
+* @see {@link listBusinessAccountProposalsAwaitingMyApproval} for proposals across every account this caller belongs to.
+* @notInstrumented
+*/
+const listBusinessAccountProposals = async ({ businessAccountId, status }, client = getDefaultClient()) => {
+	return await createApiClient({}, client).sdkListBusinessAccountProposals({
+		businessAccountId,
+		environmentId: getCore(client).environmentId,
+		status: status ? BusinessAccountProposalStatus.Pending : void 0
+	});
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/listBusinessAccountProposalsAwaitingMyApproval/listBusinessAccountProposalsAwaitingMyApproval.ts
+/**
+* Every pending proposal awaiting this caller's approval, across every
+* business account they belong to. Not scoped to one account — the server
+* derives the scope from the caller's own memberships.
+*
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The proposals awaiting this caller's approval.
+*
+* @example
+* ```ts
+* const awaitingMe = await listBusinessAccountProposalsAwaitingMyApproval();
+* ```
+*
+* @see {@link approveBusinessAccountProposal}
+* @see {@link listBusinessAccountProposals} for one account's proposals instead.
+* @notInstrumented
+*/
+const listBusinessAccountProposalsAwaitingMyApproval = async (client = getDefaultClient()) => {
+	return await createApiClient({}, client).sdkListBusinessAccountProposalsAwaitingApproval({ environmentId: getCore(client).environmentId });
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/listBusinessAccountRoles/listBusinessAccountRoles.ts
+/**
+* Lists the custom roles a business account has defined. Empty when none
+* are — that's an answer, not a missing resource.
+*
+* @param params.businessAccountId - The business account whose roles to list.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The account's custom roles, keyed by role name.
+*
+* @example
+* ```ts
+* const roles = await listBusinessAccountRoles({ businessAccountId });
+* console.log(roles.cfo?.inherits); // 'admin'
+* ```
+*
+* @see {@link defineBusinessAccountRole}
+* @see {@link deleteBusinessAccountRole}
+* @notInstrumented
+*/
+const listBusinessAccountRoles = async ({ businessAccountId }, client = getDefaultClient()) => {
+	const { roles } = await createApiClient({}, client).sdkListBusinessAccountRoles({
+		businessAccountId,
+		environmentId: getCore(client).environmentId
+	});
+	return roles;
+};
+
 //#endregion
 //#region src/modules/waas/businessAccounts/listBusinessAccounts/listBusinessAccounts.ts
 /**
@@ -1674,8 +2158,15 @@ const removeAccountPolicyRule = async ({ businessAccountId, ruleId }, client = g
 * the account's wallets are torn down as part of the removal. The backend
 * refuses to remove the account's last owner.
 *
+* When the account governs `removeMember`, nothing is written and the 202
+* body is returned instead. Resend with `signed` (from
+* `signBusinessAccountIntent`) to move past `INTENT_REQUIRED`.
+*
 * @param params.businessAccountId - The business account to remove the member from.
 * @param params.userId - The id of the user to remove.
+* @param [params.autoExecute] - Whether to apply on the completing approval.
+*   Only meaningful on the first call.
+* @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns The removed member, or the outstanding action required.
 *
@@ -1694,11 +2185,15 @@ const removeAccountPolicyRule = async ({ businessAccountId, ruleId }, client = g
 * @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.
 * @notInstrumented
 */
-const removeBusinessAccountMember = async ({ businessAccountId, userId }, client = getDefaultClient()) => {
+const removeBusinessAccountMember = async ({ businessAccountId, userId, autoExecute, signed }, client = getDefaultClient()) => {
 	const core = getCore(client);
 	const response = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountmemberremove }, client).sdkRemoveBusinessAccountMemberRaw({
 		businessAccountId,
 		environmentId: core.environmentId,
+		removeBusinessAccountMemberSdkRequest: resendFields({
+			autoExecute,
+			signed
+		}),
 		userId
 	});
 	if (response.raw.status === 202) return parseGovernedResponse({
@@ -1717,9 +2212,16 @@ const removeBusinessAccountMember = async ({ businessAccountId, userId }, client
 * identity can no longer sign for that wallet. The backend refuses to remove
 * the last remaining signer on a wallet.
 *
+* When the account governs `removeSignerFromWallet`, nothing is written and
+* the 202 body is returned instead. Resend with `signed` (from
+* `signBusinessAccountIntent`) to move past `INTENT_REQUIRED`.
+*
 * @param params.businessAccountId - The business account the wallet belongs to.
 * @param params.walletId - The wallet the signer is attached to.
 * @param params.signerId - The id of the signer to remove (`BusinessAccountSigner.id`).
+* @param [params.autoExecute] - Whether to apply on the completing approval.
+*   Only meaningful on the first call.
+* @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns The removed signer, or the outstanding action required.
 *
@@ -1739,11 +2241,15 @@ const removeBusinessAccountMember = async ({ businessAccountId, userId }, client
 * @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.
 * @notInstrumented
 */
-const removeBusinessAccountSigner = async ({ businessAccountId, walletId, signerId }, client = getDefaultClient()) => {
+const removeBusinessAccountSigner = async ({ businessAccountId, walletId, signerId, autoExecute, signed }, client = getDefaultClient()) => {
 	const core = getCore(client);
 	const response = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountsignerremove }, client).sdkRemoveBusinessAccountSignerRaw({
 		businessAccountId,
 		environmentId: core.environmentId,
+		removeBusinessAccountSignerSdkRequest: resendFields({
+			autoExecute,
+			signed
+		}),
 		signerId,
 		walletId
 	});
@@ -1759,11 +2265,17 @@ const removeBusinessAccountSigner = async ({ businessAccountId, walletId, signer
 //#region src/modules/waas/businessAccounts/removeBusinessAccountWallet/removeBusinessAccountWallet.ts
 /**
 * Removes a wallet from a business account (owner-/admin-only). The wallet and
-* all its associated signer rows are detached from the account. The backend
-* refuses to remove the last wallet on a business account.
+* all its associated signer rows are detached from the account.
+*
+* When the account governs `removeWallet`, nothing is written and the 202
+* body is returned instead. Resend with `signed` (from
+* `signBusinessAccountIntent`) to move past `INTENT_REQUIRED`.
 *
 * @param params.businessAccountId - The business account the wallet belongs to.
 * @param params.walletId - The wallet to remove (`BusinessAccountWallet.id`).
+* @param [params.autoExecute] - Whether to apply on the completing approval.
+*   Only meaningful on the first call.
+* @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns The updated business account detail, or the outstanding action required.
 *
@@ -1781,11 +2293,15 @@ const removeBusinessAccountSigner = async ({ businessAccountId, walletId, signer
 * @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.
 * @notInstrumented
 */
-const removeBusinessAccountWallet = async ({ businessAccountId, walletId }, client = getDefaultClient()) => {
+const removeBusinessAccountWallet = async ({ businessAccountId, walletId, autoExecute, signed }, client = getDefaultClient()) => {
 	const core = getCore(client);
 	const response = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountwalletremove }, client).sdkRemoveBusinessAccountWalletRaw({
 		businessAccountId,
 		environmentId: core.environmentId,
+		removeBusinessAccountWalletSdkRequest: resendFields({
+			autoExecute,
+			signed
+		}),
 		walletId
 	});
 	if (response.raw.status === 202) return parseGovernedResponse({
@@ -1957,6 +2473,66 @@ const revokeWaasDelegation = async ({ password, walletAccount }, client = getDef
 	await __refreshAuth_wrapped(client);
 };
 
+//#endregion
+//#region src/modules/waas/businessAccounts/setBusinessAccountGovernance/setBusinessAccountGovernance.ts
+/**
+* Replaces the account's entire governance section. Wholesale, not a merge —
+* an action left out of `governance` is refused rather than read as "delete
+* its requirements"; send it back with its existing requirements (or an
+* empty array) to keep or clear it.
+*
+* `setGovernance` is itself always governed at the capability-table floor
+* (owner-only today), so the 202 path applies here too: nothing is written
+* and the 202 body is returned instead. Resend with `signed` (from
+* `signBusinessAccountIntent`) to move past `INTENT_REQUIRED`.
+*
+* @param params.businessAccountId - The business account whose governance changes.
+* @param params.governance - The full governance section to write, keyed by
+*   governed action. Read the current value with `getBusinessAccountGovernance`
+*   first if you're changing only one action.
+* @param [params.autoExecute] - Whether to apply on the completing approval.
+*   Only meaningful on the first call.
+* @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The new document version, or the outstanding action required.
+*
+* @example
+* ```ts
+* const current = await getBusinessAccountGovernance({ businessAccountId });
+* await setBusinessAccountGovernance({
+*   businessAccountId,
+*   governance: {
+*     ...current,
+*     addMember: [{ id: 'one-admin', schemaVersion: 1, requiredApprovals: 1, eligibleApproverRoles: ['admin'] }],
+*   },
+* });
+* ```
+*
+* @see {@link getBusinessAccountGovernance} for reading the current section first.
+* @see {@link defineBusinessAccountRole} for defining a role governance can name.
+* @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.
+* @notInstrumented
+*/
+const setBusinessAccountGovernance = async ({ businessAccountId, governance, autoExecute, signed }, client = getDefaultClient()) => {
+	const core = getCore(client);
+	const response = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountgovernanceupdate }, client).sdkSetBusinessAccountGovernanceRaw({
+		businessAccountId,
+		environmentId: core.environmentId,
+		setBusinessAccountGovernanceSdkRequest: {
+			governance,
+			...resendFields({
+				autoExecute,
+				signed
+			})
+		}
+	});
+	if (response.raw.status === 202) return parseGovernedResponse({
+		fnName: "setBusinessAccountGovernance",
+		response: response.raw
+	});
+	return await response.value();
+};
+
 //#endregion
 //#region src/modules/waas/setWaasWalletAccountPassword/setWaasWalletAccountPassword.ts
 /**
@@ -2033,8 +2609,15 @@ const signSerializedTransaction = async ({ chainId, serializedTransaction, walle
 * `newOwnerUserId` must already be a member, is promoted to owner, and the
 * current owner is atomically demoted to admin.
 *
+* When the account governs `transferOwnership`, nothing is written and the
+* 202 body is returned instead. Resend with `signed` (from
+* `signBusinessAccountIntent`) to move past `INTENT_REQUIRED`.
+*
 * @param params.businessAccountId - The business account whose ownership moves.
 * @param params.newOwnerUserId - The member to promote to owner.
+* @param [params.autoExecute] - Whether to apply on the completing approval.
+*   Only meaningful on the first call.
+* @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns The updated business account detail, or the outstanding action required.
 *
@@ -2052,12 +2635,18 @@ const signSerializedTransaction = async ({ chainId, serializedTransaction, walle
 * @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.
 * @notInstrumented
 */
-const transferBusinessAccountOwnership = async ({ businessAccountId, newOwnerUserId }, client = getDefaultClient()) => {
+const transferBusinessAccountOwnership = async ({ businessAccountId, newOwnerUserId, autoExecute, signed }, client = getDefaultClient()) => {
 	const core = getCore(client);
 	const response = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccounttransferOwnership }, client).sdkTransferBusinessAccountOwnershipRaw({
 		businessAccountId,
 		environmentId: core.environmentId,
-		transferBusinessAccountOwnershipSdkRequest: { newOwnerUserId }
+		transferBusinessAccountOwnershipSdkRequest: {
+			newOwnerUserId,
+			...resendFields({
+				autoExecute,
+				signed
+			})
+		}
 	});
 	if (response.raw.status === 202) return parseGovernedResponse({
 		fnName: "transferBusinessAccountOwnership",
@@ -2122,10 +2711,17 @@ const updateBusinessAccount = async ({ businessAccountId, name: name$1 }, client
 * another. Owner is not assignable here — use
 * `transferBusinessAccountOwnership` for that.
 *
+* When the account governs `updateMemberRole`, nothing is written and the
+* 202 body is returned instead. Resend with `signed` (from
+* `signBusinessAccountIntent`) to move past `INTENT_REQUIRED`.
+*
 * @param params.businessAccountId - The business account the member belongs to.
 * @param params.userId - The member whose role changes.
 * @param params.role - The new role: a built-in (`admin`, `viewer`) or a role
 *   this account defined.
+* @param [params.autoExecute] - Whether to apply on the completing approval.
+*   Only meaningful on the first call.
+* @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.
 * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
 * @returns The updated business account member, or the outstanding action required.
 *
@@ -2143,12 +2739,18 @@ const updateBusinessAccount = async ({ businessAccountId, name: name$1 }, client
 * @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.
 * @notInstrumented
 */
-const updateBusinessAccountMemberRole = async ({ businessAccountId, userId, role }, client = getDefaultClient()) => {
+const updateBusinessAccountMemberRole = async ({ businessAccountId, userId, role, autoExecute, signed }, client = getDefaultClient()) => {
 	const core = getCore(client);
 	const response = await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountmemberroleupdate }, client).sdkUpdateBusinessAccountMemberRoleRaw({
 		businessAccountId,
 		environmentId: core.environmentId,
-		updateBusinessAccountMemberRoleSdkRequest: { role },
+		updateBusinessAccountMemberRoleSdkRequest: {
+			role,
+			...resendFields({
+				autoExecute,
+				signed
+			})
+		},
 		userId
 	});
 	if (response.raw.status === 202) return parseGovernedResponse({
@@ -2272,10 +2874,70 @@ const upsertWalletPolicyRule = async ({ rule, walletAccount }, client = getDefau
 	});
 };
 
+//#endregion
+//#region src/modules/waas/businessAccounts/vetoBusinessAccountProposal/vetoBusinessAccountProposal.ts
+/**
+* Vetoes a pending proposal — terminal: a vetoed proposal can never be
+* approved or executed afterward. Gated on its own scope
+* (`business_account:proposal:veto`), distinct from approving one, so a
+* caller with only approve-scoped access cannot veto instead.
+*
+* @param params.businessAccountId - The business account the proposal belongs to.
+* @param params.proposalId - The proposal to veto.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The proposal, now `status: 'vetoed'`.
+*
+* @example
+* ```ts
+* await vetoBusinessAccountProposal({ businessAccountId, proposalId });
+* ```
+*
+* @see {@link approveBusinessAccountProposal} for consenting to a proposal instead.
+* @see {@link BusinessAccountProposal} for the returned shape.
+* @notInstrumented
+*/
+const vetoBusinessAccountProposal = async ({ businessAccountId, proposalId }, client = getDefaultClient()) => {
+	return await createApiClient({ elevatedAccessTokenScope: TokenScope.BusinessAccountproposalveto }, client).sdkVetoBusinessAccountProposal({
+		businessAccountId,
+		environmentId: getCore(client).environmentId,
+		proposalId
+	});
+};
+
+//#endregion
+//#region src/modules/waas/businessAccounts/withdrawBusinessAccountProposalApproval/withdrawBusinessAccountProposalApproval.ts
+/**
+* Withdraws this session's own approval from a proposal still collecting
+* them. The approval row is kept with `revokedAt` set rather than deleted —
+* consent is recorded as given and taken back, not erased — so approving
+* again afterward reuses the same row.
+*
+* @param params.businessAccountId - The business account the proposal belongs to.
+* @param params.proposalId - The proposal to withdraw this session's approval from.
+* @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.
+* @returns The proposal, with this approval's count no longer contributing.
+*
+* @example
+* ```ts
+* await withdrawBusinessAccountProposalApproval({ businessAccountId, proposalId });
+* ```
+*
+* @see {@link approveBusinessAccountProposal} for approving (or re-approving) instead.
+* @see {@link BusinessAccountProposalApprovalRecord} for what `revokedAt` looks like once set.
+* @notInstrumented
+*/
+const withdrawBusinessAccountProposalApproval = async ({ businessAccountId, proposalId }, client = getDefaultClient()) => {
+	return await createApiClient({}, client).sdkWithdrawBusinessAccountProposalApproval({
+		businessAccountId,
+		environmentId: getCore(client).environmentId,
+		proposalId
+	});
+};
+
 //#endregion
 //#region src/exports/waas.ts
 assertPackageVersion(name, version);
 
 //#endregion
-export { WaasChainEnum$1 as $, getPolicy as A, normalizeWalletRequirements as B, isBusinessAccountActionRequired as C, getWalletPolicyLayer as D, getWalletRecoveryState as E, exportWaasClientKeyshares as F, expandPolicyRules as G, createWaasOfflineRecoveryShares as H, desugarPolicyRules as I, buildAllowPolicyRule as J, createBusinessAccount as K, delegateWaasKeyShares as L, getBusinessAccount as M, getAccountPolicyLayer as N, getWalletAccountShareSets as O, exportWaasPrivateKey as P, addBusinessAccountMember as Q, createWalletForBusinessAccount as R, isPasswordRequiredForWaasWallets as S, hasDelegatedAccess as T, createPolicy as U, isWalletCreationRequirement as V, resolvePolicyScope as W, addWalletToBusinessAccount as X, backupWaasKeySharesToGoogleDrive as Y, addBusinessAccountSigner as Z, removeBusinessAccountSigner as _, updateBusinessAccountMemberRole as a, refreshWaasWalletAccountShares as b, transferBusinessAccountOwnership as c, setWaasWalletAccountPassword as d, WaasWalletShareSetType$1 as et, revokeWaasDelegation as f, removeBusinessAccountWallet as g, removePolicyRules as h, updateWaasPassword as i, getChainsMissingWaasWalletAccounts as j, getSignerPolicyLayer as k, signSerializedTransaction as l, removeSignerPolicyRule as m, upsertSignerPolicyRule as n, updateBusinessAccount as o, removeWalletPolicyRule as p, buildDenyPolicyRule as q, upsertAccountPolicyRule as r, unlockWallet as s, upsertWalletPolicyRule as t, shouldAutoCreateWalletForChain as u, removeBusinessAccountMember as v, importWaasPrivateKey as w, listBusinessAccounts as x, removeAccountPolicyRule as y, createWaasWalletAccounts as z };
-//# sourceMappingURL=waas-H5xyBfTI.esm.js.map
+export { createPolicy as $, importWaasPrivateKey as A, getAccountPolicyLayer as B, refreshWaasWalletAccountShares as C, listBusinessAccountProposals as D, listBusinessAccountProposalsAwaitingMyApproval as E, getSignerPolicyLayer as F, deleteBusinessAccountRole as G, exportWaasClientKeyshares as H, getPolicy as I, createWalletForBusinessAccount as J, delegateWaasKeyShares as K, getChainsMissingWaasWalletAccounts as L, getWalletRecoveryState as M, getWalletPolicyLayer as N, isPasswordRequiredForWaasWallets as O, getWalletAccountShareSets as P, createWaasOfflineRecoveryShares as Q, getBusinessAccountGovernance as R, removeAccountPolicyRule as S, listBusinessAccountRoles as T, executeBusinessAccountProposal as U, exportWaasPrivateKey as V, desugarPolicyRules as W, normalizeWalletRequirements as X, createWaasWalletAccounts as Y, isWalletCreationRequirement as Z, removeSignerPolicyRule as _, upsertAccountPolicyRule as a, backupWaasKeySharesToGoogleDrive as at, removeBusinessAccountSigner as b, updateBusinessAccount as c, signBusinessAccountIntent as ct, signSerializedTransaction as d, addBusinessAccountMember as dt, resolvePolicyScope as et, shouldAutoCreateWalletForChain as f, WaasChainEnum$1 as ft, removeWalletPolicyRule as g, revokeWaasDelegation as h, upsertSignerPolicyRule as i, buildAllowPolicyRule as it, hasDelegatedAccess as j, isBusinessAccountActionRequired as k, unlockWallet as l, addWalletToBusinessAccount as lt, setBusinessAccountGovernance as m, vetoBusinessAccountProposal as n, createBusinessAccount as nt, updateWaasPassword as o, approveBusinessAccountProposal as ot, setWaasWalletAccountPassword as p, WaasWalletShareSetType$1 as pt, defineBusinessAccountRole as q, upsertWalletPolicyRule as r, buildDenyPolicyRule as rt, updateBusinessAccountMemberRole as s, signBusinessAccountApproval as st, withdrawBusinessAccountProposalApproval as t, expandPolicyRules as tt, transferBusinessAccountOwnership as u, addBusinessAccountSigner as ut, removePolicyRules as v, listBusinessAccounts as w, removeBusinessAccountMember as x, removeBusinessAccountWallet as y, getBusinessAccount as z };
+//# sourceMappingURL=waas-BAcC_ZEU.esm.js.map