@dynamic-labs-sdk/client 1.33.2 → 1.33.4

package/dist/waas-BAcC_ZEU.esm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"waas-BAcC_ZEU.esm.js","names":["WaasChainEnum","SdkApiWaasChainEnum","WaasWalletShareSetType","SdkApiWaasWalletShareSetType","IDENTIFIER_TYPE_TO_API: Record<\n  BusinessAccountSignerIdentifierType,\n  UserIdentifierTypeEnum\n>","refreshAuth","refreshAuth","sorted: Record<string, unknown>","refreshAuth","unhandledScope: never","DEFAULT_POLICY_RULE_NAMES: Record<PolicyRuleKind, string>","RULE_KINDS: Record<PolicyRuleKind, RuleKindDefinition>","operations: WaasPolicyLayerRuleOperation[]","mergedRules: PolicyRules","unhandledScope: never","operations: WaasPolicyLayerRuleOperation[]","requirement: WalletCreationRequirement","refreshAuth","refreshAuth","refreshAuth","COUPLED_RULE_KINDS: ReadonlySet<PolicyRuleKind>","DELETION_MARKER_KEYS: ReadonlySet<string>","rules: PolicyRules","unmapped: WaasPolicyRule[]","own: WalletAccountOwnShareSet | undefined","refreshAuth","remainingRules: PolicyRules","refreshAuth","logoutWithReason","packageName","packageVersion"],"sources":["../src/modules/waas/waas.consts.ts","../src/modules/waas/businessAccounts/assertTargetIdentity.ts","../src/modules/waas/businessAccounts/businessAccounts.constants.ts","../src/errors/UnexpectedConsentResponseError.ts","../src/modules/waas/businessAccounts/parseGovernedResponse.ts","../src/modules/waas/businessAccounts/resendFields.ts","../src/modules/waas/businessAccounts/addBusinessAccountMember/addBusinessAccountMember.ts","../src/modules/waas/getWaasWalletProviderByChain/getWaasWalletProviderByChain.ts","../src/modules/waas/businessAccounts/addBusinessAccountSigner/addBusinessAccountSigner.ts","../src/modules/waas/businessAccounts/addWalletToBusinessAccount/addWalletToBusinessAccount.ts","../src/modules/sessionKeys/canonicalizeJson/canonicalizeJson.ts","../src/modules/sessionKeys/signBusinessAccountIntent/signBusinessAccountIntent.ts","../src/modules/waas/businessAccounts/approveBusinessAccountProposal/approveBusinessAccountProposal.ts","../src/modules/waas/backupWaasKeySharesToGoogleDrive/backupWaasKeySharesToGoogleDrive.ts","../src/modules/waas/policies/buildAllowPolicyRule/buildAllowPolicyRule.ts","../src/modules/waas/policies/buildDenyPolicyRule/buildDenyPolicyRule.ts","../src/modules/waas/businessAccounts/createBusinessAccount/createBusinessAccount.ts","../src/modules/waas/policies/applyPolicyLayerBatch/applyPolicyLayerBatch.ts","../src/utils/objectKeys/objectKeys.ts","../src/modules/waas/policies/buildValueLimit/buildValueLimit.ts","../src/modules/waas/policies/policyRuleDefaultNames.ts","../src/modules/waas/policies/buildAllowAddressesRule/buildAllowAddressesRule.ts","../src/modules/waas/policies/buildBlockExportRule/buildBlockExportRule.ts","../src/modules/waas/policies/buildDenyAddressesRule/buildDenyAddressesRule.ts","../src/modules/waas/policies/buildMaxAmountPerTransactionRule/buildMaxAmountPerTransactionRule.ts","../src/modules/waas/policies/hasAddresses/hasAddresses.ts","../src/modules/waas/policies/hasUnrecognizedFields/hasUnrecognizedFields.ts","../src/modules/waas/policies/readValueLimit/readValueLimit.ts","../src/modules/waas/policies/readAllowAddressesRule/readAllowAddressesRule.ts","../src/modules/waas/policies/readBlockExportRule/readBlockExportRule.ts","../src/modules/waas/policies/readDenyAddressesRule/readDenyAddressesRule.ts","../src/modules/waas/policies/readMaxAmountPerTransactionRule/readMaxAmountPerTransactionRule.ts","../src/modules/waas/policies/policyRuleKinds.ts","../src/modules/waas/policies/readCoveredRule/readCoveredRule.ts","../src/modules/waas/policies/sortRulesByRuleId/sortRulesByRuleId.ts","../src/modules/waas/policies/matchExistingRules/matchExistingRules.ts","../src/modules/waas/policies/resolveRuleName/resolveRuleName.ts","../src/modules/waas/policies/buildOperationsForRule/buildOperationsForRule.ts","../src/modules/waas/policies/expandPolicyRules/expandPolicyRules.ts","../src/modules/waas/policies/fillOmittedRuleValues/fillOmittedRuleValues.ts","../src/modules/waas/policies/getResolvedPolicyLayer/getResolvedPolicyLayer.ts","../src/modules/waas/policies/resolvePolicyScope/resolvePolicyScope.ts","../src/modules/waas/policies/sameChainIds/sameChainIds.ts","../src/modules/waas/policies/createPolicy/createPolicy.ts","../src/modules/waas/createWaasOfflineRecoveryShares/createWaasOfflineRecoveryShares.ts","../src/modules/waas/isWalletCreationRequirement/isWalletCreationRequirement.ts","../src/modules/waas/normalizeWalletRequirements/normalizeWalletRequirements.ts","../src/modules/waas/createWaasWalletAccounts/createWaasWalletAccounts.ts","../src/modules/waas/businessAccounts/createWalletForBusinessAccount/createWalletForBusinessAccount.ts","../src/modules/waas/businessAccounts/defineBusinessAccountRole/defineBusinessAccountRole.ts","../src/modules/waas/delegateWaasKeyShares/delegateWaasKeyShares.ts","../src/modules/waas/businessAccounts/deleteBusinessAccountRole/deleteBusinessAccountRole.ts","../src/modules/waas/policies/findMatchedRuleKind/findMatchedRuleKind.ts","../src/modules/waas/policies/isPolicyRuleDeletionMarker/isPolicyRuleDeletionMarker.ts","../src/modules/waas/policies/desugarPolicyRules/desugarPolicyRules.ts","../src/modules/waas/businessAccounts/executeBusinessAccountProposal/executeBusinessAccountProposal.ts","../src/modules/waas/exportWaasClientKeyshares/exportWaasClientKeyshares.ts","../src/modules/waas/exportWaasPrivateKey/exportWaasPrivateKey.ts","../src/modules/waas/policies/getAccountPolicyLayer/getAccountPolicyLayer.ts","../src/modules/waas/businessAccounts/getBusinessAccount/getBusinessAccount.ts","../src/modules/waas/businessAccounts/getBusinessAccountGovernance/getBusinessAccountGovernance.ts","../src/modules/wallets/userHasEmbeddedWalletForChain/userHasEmbeddedWalletForChain.ts","../src/modules/waas/getChainsMissingWaasWalletAccounts/getChainsMissingWaasWalletAccounts.ts","../src/modules/waas/policies/getPolicy/getPolicy.ts","../src/modules/waas/policies/getSignerPolicyLayer/getSignerPolicyLayer.ts","../src/modules/waas/getWalletAccountShareSets/getWalletAccountShareSets.ts","../src/modules/waas/policies/getWalletPolicyLayer/getWalletPolicyLayer.ts","../src/modules/waas/getWalletRecoveryState/getWalletRecoveryState.ts","../src/modules/waas/hasDelegatedAccess/hasDelegatedAccess.ts","../src/modules/waas/importWaasPrivateKey/importWaasPrivateKey.ts","../src/modules/waas/businessAccounts/isBusinessAccountActionRequired/isBusinessAccountActionRequired.ts","../src/modules/waas/isPasswordRequiredForWaasWallets/isPasswordRequiredForWaasWallets.ts","../src/modules/waas/businessAccounts/listBusinessAccountProposals/listBusinessAccountProposals.ts","../src/modules/waas/businessAccounts/listBusinessAccountProposalsAwaitingMyApproval/listBusinessAccountProposalsAwaitingMyApproval.ts","../src/modules/waas/businessAccounts/listBusinessAccountRoles/listBusinessAccountRoles.ts","../src/modules/waas/businessAccounts/listBusinessAccounts/listBusinessAccounts.ts","../src/modules/waas/refreshWaasWalletAccountShares/refreshWaasWalletAccountShares.ts","../src/modules/waas/policies/removeAccountPolicyRule/removeAccountPolicyRule.ts","../src/modules/waas/businessAccounts/removeBusinessAccountMember/removeBusinessAccountMember.ts","../src/modules/waas/businessAccounts/removeBusinessAccountSigner/removeBusinessAccountSigner.ts","../src/modules/waas/businessAccounts/removeBusinessAccountWallet/removeBusinessAccountWallet.ts","../src/modules/waas/policies/buildOperationForExistingRule/buildOperationForExistingRule.ts","../src/modules/waas/policies/removePolicyRules/removePolicyRules.ts","../src/modules/waas/policies/removeSignerPolicyRule/removeSignerPolicyRule.ts","../src/modules/waas/policies/removeWalletPolicyRule/removeWalletPolicyRule.ts","../src/modules/waas/revokeWaasDelegation/revokeWaasDelegation.ts","../src/modules/waas/businessAccounts/setBusinessAccountGovernance/setBusinessAccountGovernance.ts","../src/modules/waas/setWaasWalletAccountPassword/setWaasWalletAccountPassword.ts","../src/modules/wallets/userHasExternalWallet/userHasExternalWallet.ts","../src/modules/waas/shouldAutoCreateWalletForChain/shouldAutoCreateWalletForChain.ts","../src/modules/waas/signSerializedTransaction/signSerializedTransaction.ts","../src/modules/waas/businessAccounts/transferBusinessAccountOwnership/transferBusinessAccountOwnership.ts","../src/modules/waas/unlockWallet/unlockWallet.ts","../src/modules/waas/businessAccounts/updateBusinessAccount/updateBusinessAccount.ts","../src/modules/waas/businessAccounts/updateBusinessAccountMemberRole/updateBusinessAccountMemberRole.ts","../src/modules/waas/updateWaasPassword/updateWaasPassword.ts","../src/modules/waas/policies/upsertAccountPolicyRule/upsertAccountPolicyRule.ts","../src/modules/waas/policies/upsertSignerPolicyRule/upsertSignerPolicyRule.ts","../src/modules/waas/policies/upsertWalletPolicyRule/upsertWalletPolicyRule.ts","../src/modules/waas/businessAccounts/vetoBusinessAccountProposal/vetoBusinessAccountProposal.ts","../src/modules/waas/businessAccounts/withdrawBusinessAccountProposalApproval/withdrawBusinessAccountProposalApproval.ts","../src/exports/waas.ts"],"sourcesContent":["import {\n  WaasChainEnum as SdkApiWaasChainEnum,\n  WaasWalletShareSetType as SdkApiWaasWalletShareSetType,\n} from '@dynamic-labs/sdk-api-core';\n\n/**\n * Identifies the chain family targeted by WaaS policy operations.\n *\n * @example\n * ```ts\n * const chain: WaasChainEnum = WaasChainEnum.Evm;\n * ```\n *\n * @see createPolicy\n * @see getPolicy\n */\nexport const WaasChainEnum = SdkApiWaasChainEnum;\nexport type WaasChainEnum = SdkApiWaasChainEnum;\n\n/**\n * Identifies the role of a share set exposed through a WaaS wallet account.\n *\n * @see getWalletAccountShareSets\n * @see WaasWalletAccount\n */\nexport const WaasWalletShareSetType = SdkApiWaasWalletShareSetType;\nexport type WaasWalletShareSetType = SdkApiWaasWalletShareSetType;\n","import { InvalidParamError } from '../../../errors/InvalidParamError';\nimport type { TargetIdentity } from './businessAccounts.types';\n\ntype AssertTargetIdentityParams = {\n  fnName: string;\n  targetIdentity: TargetIdentity;\n};\n\n/**\n * Asserts a {@link TargetIdentity} resolves to a user: a `userId`, or an\n * `identifier` with its `identifierType`. Throws otherwise.\n *\n * @notInstrumented\n */\nexport const assertTargetIdentity = ({\n  fnName,\n  targetIdentity,\n}: AssertTargetIdentityParams): void => {\n  const hasUserId = Boolean(targetIdentity.userId);\n  const hasIdentifier = Boolean(\n    targetIdentity.identifier && targetIdentity.identifierType\n  );\n  if (!hasUserId && !hasIdentifier) {\n    throw new InvalidParamError(\n      `${fnName}: targetIdentity must provide a userId, or an identifier with its identifierType`\n    );\n  }\n};\n","import { UserIdentifierTypeEnum } from '@dynamic-labs/sdk-api-core';\n\nimport type { BusinessAccountSignerIdentifierType } from './businessAccounts.types';\n\n/** Maps the SDK's identifier-type union to the generated API enum. */\nexport const IDENTIFIER_TYPE_TO_API: Record<\n  BusinessAccountSignerIdentifierType,\n  UserIdentifierTypeEnum\n> = {\n  email: UserIdentifierTypeEnum.Email,\n  externalUserId: UserIdentifierTypeEnum.ExternalUserId,\n  id: UserIdentifierTypeEnum.Id,\n  phoneNumber: UserIdentifierTypeEnum.PhoneNumber,\n  socialAccountId: UserIdentifierTypeEnum.SocialAccountId,\n  socialUsername: UserIdentifierTypeEnum.SocialUsername,\n};\n\n","import { BaseError } from './base';\n\nexport class UnexpectedConsentResponseError extends BaseError {\n  constructor({ message }: { message: string }) {\n    super({\n      cause: null,\n      code: 'unexpected_consent_response_error',\n      docsUrl: null,\n      name: 'UnexpectedConsentResponse',\n      shortMessage: message,\n    });\n  }\n}\n","import { UnexpectedConsentResponseError } from '../../../errors/UnexpectedConsentResponseError';\nimport type { BusinessAccountActionRequired } from './businessAccounts.types';\n\ntype ParseGovernedResponseParams = {\n  fnName: string;\n  response: Response;\n};\n\n/**\n * Reads a governed mutation's 202 body off the raw response, narrowed on\n * `reason` + `intent` rather than cast outright: a malformed or unrecognized\n * body would otherwise pass through as action-required, and the caller would\n * sign or wait on data that does not exist.\n *\n * Shared by every governed business-account mutation, since the generated\n * 200 mapper cannot run over this body — it assumes the ungoverned success\n * shape and throws or returns garbage instead.\n *\n * @param params.fnName - The calling function's name, named in the thrown error.\n * @param params.response - The raw fetch `Response` carrying the 202 body.\n * @returns The governed-pending result: the intent to sign, or the proposal collecting approvals.\n *\n * @example\n * ```ts\n * if (response.raw.status === 202) {\n *   return parseGovernedResponse({ fnName: 'addBusinessAccountMember', response: response.raw });\n * }\n * ```\n *\n * @see addBusinessAccountMember\n * @see removeBusinessAccountWallet\n * @throws {UnexpectedConsentResponseError} When the 202 body has no recognized reason or no intent.\n * @notInstrumented\n */\nexport const parseGovernedResponse = async ({\n  fnName,\n  response,\n}: ParseGovernedResponseParams): Promise<BusinessAccountActionRequired> => {\n  const payload = (await response.json()) as Partial<BusinessAccountActionRequired>;\n  if (\n    (payload.reason !== 'INTENT_REQUIRED' &&\n      payload.reason !== 'APPROVALS_REQUIRED') ||\n    !payload.intent\n  ) {\n    throw new UnexpectedConsentResponseError({\n      message: `${fnName}: unexpected 202 body`,\n    });\n  }\n  return payload as BusinessAccountActionRequired;\n};\n","import type { SignedBusinessAccountIntent } from './businessAccounts.types';\n\ntype ResendFieldsParams = {\n  autoExecute?: boolean;\n  signed?: SignedBusinessAccountIntent;\n};\n\n/** The fields `resendFields` produces, shaped to match every generated\n *  governed-mutation request body's `autoExecute`/`intent`/`intentSignature`\n *  fields. */\ntype ResendFieldsResult = {\n  autoExecute?: boolean;\n  intent?: Record<string, object>;\n  intentSignature?: string;\n};\n\n/**\n * The `autoExecute`/`intent`/`intentSignature` fields shared by every governed\n * mutation's request body.\n *\n * `autoExecute` is read only on the first call — once an intent is signed, it\n * carries its own copy and the server ignores whatever this call sends, so an\n * approver's consent can't be overridden after the fact.\n *\n * @param [params.autoExecute] - Whether to apply immediately on the completing\n *   approval. Only meaningful on the first (unsigned) call.\n * @param [params.signed] - A previously-signed intent, to resend past\n *   `INTENT_REQUIRED`.\n * @returns The fields to spread into a governed mutation's SDK request body.\n *\n * @example\n * ```ts\n * const body = { businessAccountId, ...resendFields({ signed }) };\n * ```\n *\n * @see {@link SignedBusinessAccountIntent} for what `signed` carries.\n * @see {@link parseGovernedResponse} for reading the `intent` back off a 202.\n * @notInstrumented\n */\nexport const resendFields = ({\n  autoExecute,\n  signed,\n}: ResendFieldsParams): ResendFieldsResult => ({\n  ...(autoExecute === undefined ? {} : { autoExecute }),\n  ...(signed\n    ? {\n        // The generated request types index `intent` as `{ [key: string]:\n        // object }` rather than naming its fields, so a concrete\n        // BusinessAccountMutationIntent needs this cast to satisfy them.\n        intent: signed.intent as unknown as Record<string, object>,\n        intentSignature: signed.intentSignature,\n      }\n    : {}),\n});\n","import {\n  type AddBusinessAccountMemberSdkRequest,\n  type ProviderEnum,\n  TokenScope,\n} from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport { assertTargetIdentity } from '../assertTargetIdentity';\nimport { IDENTIFIER_TYPE_TO_API } from '../businessAccounts.constants';\nimport type {\n  BusinessAccountActionRequired,\n  BusinessAccountMember,\n  BusinessAccountMemberRole,\n  SignedBusinessAccountIntent,\n  TargetIdentity,\n} from '../businessAccounts.types';\nimport { parseGovernedResponse } from '../parseGovernedResponse';\nimport { resendFields } from '../resendFields';\n\ntype AddMemberParams = {\n  autoExecute?: boolean;\n  businessAccountId: string;\n  role?: BusinessAccountMemberRole;\n  signed?: SignedBusinessAccountIntent;\n  targetIdentity: TargetIdentity;\n};\n\n/**\n * Adds a member to an existing business account. Identify the target with a\n * `targetIdentity`: a known `userId`, or an `identifier` + `identifierType`\n * (e.g. an email — the user is created if absent).\n *\n * Calls the SDK API directly (not the WaaS iframe): this is a server-state\n * mutation with no MPC step, so a rejection (e.g. a 422 resource-limit) surfaces\n * as a thrown error rather than stalling in the iframe bridge.\n *\n * When the account governs `addMember`, nothing is written and the 202 body is\n * returned instead — first the intent to sign, then the proposal collecting\n * approvals. Narrow it with `isBusinessAccountActionRequired`. Resend with\n * `signed` (from `signBusinessAccountIntent`) to move past `INTENT_REQUIRED`.\n *\n * @param params.businessAccountId - The ID of the business account.\n * @param params.targetIdentity - The member to add (userId, or identifier + identifierType).\n * @param [params.role] - The member role: a built-in (`admin`, `viewer`) or a\n *   role this account defined. Defaults to `viewer`. `owner` is rejected — use\n *   `transferBusinessAccountOwnership`.\n * @param [params.autoExecute] - Whether to apply on the completing approval.\n *   Only meaningful on the first call.\n * @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The created business account member, or the outstanding action required.\n * @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.\n * @notInstrumented\n */\nexport const addBusinessAccountMember = async (\n  { businessAccountId, targetIdentity, role, autoExecute, signed }: AddMemberParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountActionRequired | BusinessAccountMember> => {\n  assertTargetIdentity({ fnName: 'addBusinessAccountMember', targetIdentity });\n\n  const core = getCore(client);\n  const apiClient = createApiClient(\n    { elevatedAccessTokenScope: TokenScope.BusinessAccountmemberadd },\n    client\n  );\n  const { userId, identifier, identifierType, socialProvider, smsCountryCode } =\n    targetIdentity;\n\n  // `Raw` returns the response before the generated 200 mapper runs, which\n  // assumes a member exists and throws on a governed 202's different shape.\n  // Reading the status first is how we tell the two apart.\n  const response = await apiClient.sdkAddBusinessAccountMemberRaw({\n    addBusinessAccountMemberSdkRequest: {\n      identifier,\n      // The generated field only accepts admin/viewer, but an account can\n      // define custom role names too — cast rather than narrow the param type.\n      role: (role ?? 'viewer') as AddBusinessAccountMemberSdkRequest['role'],\n      smsCountryCode,\n      socialProvider: socialProvider as ProviderEnum | undefined,\n      type: identifierType ? IDENTIFIER_TYPE_TO_API[identifierType] : undefined,\n      userId,\n      ...resendFields({ autoExecute, signed }),\n    },\n    businessAccountId,\n    environmentId: core.environmentId,\n  });\n\n  if (response.raw.status === 202) {\n    return parseGovernedResponse({\n      fnName: 'addBusinessAccountMember',\n      response: response.raw,\n    });\n  }\n\n  return (await response.value()) as BusinessAccountMember;\n};\n","import { WalletProviderEnum } from '@dynamic-labs/sdk-api-core';\n\nimport type { DynamicClient } from '../../../client/types/DynamicClient';\nimport { NoWalletProviderFoundError } from '../../../errors/NoWalletProviderFoundError';\nimport type { Chain } from '../../chain';\nimport { formatWalletProviderKey } from '../../wallets/utils/formatWalletProviderKey';\nimport { DYNAMIC_WAAS_METADATA } from '../constants';\nimport type { WaasWalletProvider } from '../waas.types';\nimport { findWaasWalletProviderByChain } from '../findWaasWalletProviderByChain/findWaasWalletProviderByChain';\n\ntype GetWaasWalletProviderByChainParams = {\n  chain: Chain;\n};\n\n/** @notInstrumented */\nexport const getWaasWalletProviderByChain = (\n  { chain }: GetWaasWalletProviderByChainParams,\n  client: DynamicClient\n): WaasWalletProvider => {\n  const waasProvider = findWaasWalletProviderByChain({ chain }, client);\n\n  if (!waasProvider) {\n    const waasProviderKey = formatWalletProviderKey({\n      chain,\n      displayName: DYNAMIC_WAAS_METADATA.displayName,\n      walletProviderType: WalletProviderEnum.EmbeddedWallet,\n    });\n\n    throw new NoWalletProviderFoundError({\n      walletProviderKey: waasProviderKey,\n    });\n  }\n\n  return waasProvider;\n};\n","import { TokenScope } from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport { assertDefined } from '../../../../utils/assertDefined';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport { refreshAuth } from '../../../user/refreshAuth';\nimport { getWaasWalletProviderByChain } from '../../getWaasWalletProviderByChain';\nimport type { WaasWalletAccount } from '../../waas.types';\nimport { assertTargetIdentity } from '../assertTargetIdentity';\nimport type {\n  BusinessAccountActionRequired,\n  BusinessAccountDetail,\n  BusinessAccountMutationIntent,\n  BusinessAccountSignerType,\n  TargetIdentity,\n} from '../businessAccounts.types';\n\ntype AddBusinessAccountSignerResult =\n  | { shareSetId: string }\n  | BusinessAccountActionRequired;\n\ntype AddSignerParams = {\n  businessAccountId?: string;\n  /**\n   * The initiator's signed proposal, when the account governs addSigner. The\n   * first call answers consent-pending with the bytes to sign; passing them\n   * back is what opens the proposal. Omit on the first call.\n   */\n  intent?: BusinessAccountMutationIntent;\n  intentSignature?: string;\n  password?: string;\n  signerType?: BusinessAccountSignerType;\n  targetIdentity: TargetIdentity;\n  targetSignerPassword?: string;\n  walletAccount: WaasWalletAccount;\n  walletId?: string;\n};\n\n/**\n * Adds a signer to a business-account wallet via the reshare ceremony, minting\n * the new signer's share set. Identify the target by `userId`, or `identifier`\n * + `identifierType` (the user is created if absent).\n *\n * Omit `businessAccountId` to add a signer to a wallet that isn't in a business\n * account yet: the wallet's per-account is found-or-created first (idempotent —\n * converts the personal wallet, seating its owner as the first signer), then\n * the new signer is reshared in.\n *\n * @param params.walletAccount - The wallet account to add the signer to.\n * @param [params.businessAccountId] - The business account; found-or-created when omitted.\n * @param [params.walletId] - The wallet UUID to link when finding-or-creating; defaults to `walletAccount.verifiedCredentialId`.\n * @param params.targetIdentity - The signer to add (userId, or identifier + identifierType).\n * @param [params.signerType] - `endUser` (default) or `server`.\n * @param [params.password] - Password for the current signer's share, if it is password-encrypted.\n * @param [params.targetSignerPassword] - Password used to encrypt the new signer's share. Required when wallet passwords are required by the environment.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The new signer's share set id, or a consent-pending answer when the\n * account governs `addSignerToWallet` — the reshare has NOT run in that case.\n * Narrow it with `isBusinessAccountActionRequired`.\n * @notInstrumented\n */\nexport const addBusinessAccountSigner = async (\n  {\n    walletAccount,\n    businessAccountId,\n    walletId,\n    targetIdentity,\n    signerType,\n    password,\n    targetSignerPassword,\n    intent,\n    intentSignature,\n  }: AddSignerParams,\n  client = getDefaultClient()\n): Promise<AddBusinessAccountSignerResult> => {\n  assertTargetIdentity({ fnName: 'addBusinessAccountSigner', targetIdentity });\n\n  // A wallet already owned by a business account can't be found-or-created into\n  // one — require the caller to name that account explicitly.\n  if (walletAccount.businessAccountId) {\n    assertDefined(\n      businessAccountId,\n      'addBusinessAccountSigner: this wallet is already part of a business account'\n    );\n  }\n\n  // No account yet: find-or-create the per-wallet business account first\n  // (idempotent), then reshare the signer into it.\n  let resolvedBusinessAccountId = businessAccountId;\n  if (!resolvedBusinessAccountId) {\n    // The link endpoint wants the wallet's UUID. WalletAccount.id is a\n    // composite (`walletProviderKey:address`), so use verifiedCredentialId —\n    // the VC id, which is the walletId redcoast keys wallets by.\n    const linkWalletId = walletId ?? walletAccount.verifiedCredentialId;\n    assertDefined(\n      linkWalletId,\n      'addBusinessAccountSigner: cannot resolve a wallet id to link — pass walletId, or use a verified wallet account'\n    );\n    const core = getCore(client);\n    const apiClient = createApiClient(\n      { elevatedAccessTokenScope: TokenScope.BusinessAccountsigneradd },\n      client\n    );\n    const account = await apiClient.sdkLinkBusinessAccountWallet({\n      environmentId: core.environmentId,\n      linkBusinessAccountWalletSdkRequest: { walletId: linkWalletId },\n    });\n    resolvedBusinessAccountId = (account as BusinessAccountDetail).id;\n  }\n\n  // Resolve the provider by chain (not by the wallet's provider key) so the\n  // reshare works for any business-account wallet the caller can sign — it need\n  // not be one of the session's own `getWalletAccounts()`.\n  const provider = getWaasWalletProviderByChain(\n    { chain: walletAccount.chain },\n    client\n  );\n\n  const result = await provider.reshareToNewSignerShareSet({\n    businessAccountId: resolvedBusinessAccountId,\n    intent,\n    intentSignature,\n    password,\n    signerType,\n    targetSignerIdentity: targetIdentity,\n    targetSignerPassword,\n    walletAccount,\n  });\n\n  // The find-or-create link above can bind the caller's wallet to the business\n  // account (changing its verifiedCredential); refresh local auth so the\n  // caller's wallet state doesn't go stale. Runs even when consent is pending —\n  // the link may still have happened.\n  await refreshAuth(client);\n\n  // Governed: the quorum is not met, so no reshare ran and there is no share set\n  // to report. Hand the caller the proposal instead.\n  return result;\n};\n","import { TokenScope } from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport { refreshAuth } from '../../../user/refreshAuth';\nimport type {\n  BusinessAccountActionRequired,\n  BusinessAccountDetail,\n  SignedBusinessAccountIntent,\n} from '../businessAccounts.types';\nimport { parseGovernedResponse } from '../parseGovernedResponse';\nimport { resendFields } from '../resendFields';\n\ntype AddWalletParams = {\n  autoExecute?: boolean;\n  businessAccountId?: string;\n  signed?: SignedBusinessAccountIntent;\n  walletId: string;\n};\n\n/**\n * Links a wallet to a business account, or omit `businessAccountId` to\n * find-or-create the per-wallet business account (the server seats the wallet's\n * owner as the first member/signer).\n *\n * Calls the SDK API directly (not the WaaS iframe): this is a server-state\n * mutation with no MPC step, so a rejection (e.g. a 422 resource-limit) surfaces\n * as a thrown error rather than stalling in the iframe bridge.\n *\n * When the account governs `linkWallet`, nothing is written and the 202 body is\n * returned instead — first the intent to sign, then the proposal collecting\n * approvals. Narrow it with `isBusinessAccountActionRequired`. Resend with\n * `signed` (from `signBusinessAccountIntent`) to move past `INTENT_REQUIRED`.\n *\n * @param [params.businessAccountId] - The business account to link to; found-or-created when omitted.\n * @param params.walletId - The ID of the wallet to link.\n * @param [params.autoExecute] - Whether to apply on the completing approval.\n *   Only meaningful on the first call.\n * @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The updated business account detail, or the outstanding action required.\n * @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.\n * @notInstrumented\n */\nexport const addWalletToBusinessAccount = async (\n  { businessAccountId, walletId, autoExecute, signed }: AddWalletParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountActionRequired | BusinessAccountDetail> => {\n  const core = getCore(client);\n  const apiClient = createApiClient(\n    { elevatedAccessTokenScope: TokenScope.BusinessAccountlinkWallet },\n    client\n  );\n\n  // `Raw` returns the response before the generated 200 mapper runs, which\n  // assumes `members` exists and throws on a governed 202's different shape.\n  // Reading the status first is how we tell the two apart.\n  const response = await apiClient.sdkLinkBusinessAccountWalletRaw({\n    environmentId: core.environmentId,\n    linkBusinessAccountWalletSdkRequest: {\n      businessAccountId,\n      walletId,\n      ...resendFields({ autoExecute, signed }),\n    },\n  });\n\n  if (response.raw.status === 202) {\n    // Nothing was written, so there is no local auth state to refresh.\n    return parseGovernedResponse({\n      fnName: 'addWalletToBusinessAccount',\n      response: response.raw,\n    });\n  }\n\n  const detail = await response.value();\n\n  // Linking mutates the wallet's businessAccount binding on its\n  // verifiedCredential; refresh local auth so the change is reflected.\n  await refreshAuth(client);\n\n  return detail as BusinessAccountDetail;\n};\n","/* eslint-disable custom-rules/one-function-per-file -- canonicalizeJson's recursion needs a scoped helper; splitting it out only widens the surface */\n\n// Codepoint-order comparator — reproduces JS's default string sort (UTF-16\n// code-unit order) and RFC 8785 canonical-JSON ordering. Explicit so it can\n// never be swapped for a locale-aware compare.\n// eslint-disable-next-line custom-rules/require-single-object-param -- Array.prototype.sort fixes the (a, b) comparator signature\nconst codepointCompare = (a: string, b: string): number => {\n  if (a < b) return -1;\n  if (a > b) return 1;\n  return 0;\n};\n\n// Nesting bound matching auth-service's `enclave/canonical-json` exactly; a\n// document that can't be canonicalized is unverifiable.\nconst MAX_CANONICALIZE_DEPTH = 64;\n\nclass CanonicalizeDepthError extends Error {\n  constructor() {\n    super(\n      `canonicalization exceeded max nesting depth (${MAX_CANONICALIZE_DEPTH})`\n    );\n    this.name = 'CanonicalizeDepthError';\n  }\n}\n\n// eslint-disable-next-line custom-rules/require-single-object-param -- the recursion threads a depth counter through each level\nconst sortDeep = (value: unknown, depth: number): unknown => {\n  if (depth > MAX_CANONICALIZE_DEPTH) throw new CanonicalizeDepthError();\n  if (Array.isArray(value))\n    return value.map((item) => sortDeep(item, depth + 1));\n  if (value !== null && typeof value === 'object') {\n    const sorted: Record<string, unknown> = Object.create(null);\n    for (const key of Object.keys(value).sort(codepointCompare)) {\n      const field = (value as Record<string, unknown>)[key];\n      if (field === undefined) continue;\n      sorted[key] = sortDeep(field, depth + 1);\n    }\n    return sorted;\n  }\n  return value;\n};\n\n/**\n * Deterministic canonical JSON: codepoint-sorted keys at every depth, arrays\n * in order, `undefined` fields removed, no whitespace. Byte-identical to\n * auth-service's `enclave/canonical-json`, which the enclave re-canonicalizes\n * against when verifying signatures.\n *\n * @param obj - The document to canonicalize.\n * @returns The canonical JSON string.\n *\n * @example\n * ```typescript\n * canonicalizeJson({ b: 1, a: 2 }); // '{\"a\":2,\"b\":1}'\n * ```\n *\n * @see {@link signBusinessAccountIntent} for the signature flow that depends on this byte sequence.\n * @see {@link signBusinessAccountApproval} for the co-signer flow using the same canonical form.\n * @notInstrumented\n */\nexport const canonicalizeJson = (obj: Record<string, unknown>): string =>\n  JSON.stringify(sortDeep(obj, 0));\n","import { getCore } from '../../../client/core/getCore';\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport type { DynamicClient } from '../../../client/types';\nimport { canonicalizeJson } from '../canonicalizeJson';\n\n/**\n * A business-account intent: a signed statement of what the initiator is asking\n * for. The enclave binds it to the change set actually submitted and verifies\n * the signature against the `sessionPublicKey` claim in the caller's JWT, so a\n * verified intent cannot be paired with a different mutation.\n *\n * There is deliberately no `expiresAt`. How long an intent stays redeemable is\n * the account's governance to decide, measured from `createdAt` — an\n * initiator-chosen expiry would be an initiator-chosen authorization lifetime.\n *\n * @example\n * ```ts\n * const result = await addBusinessAccountMember({ businessAccountId, targetIdentity, role: 'admin' });\n * if (isBusinessAccountActionRequired(result)) {\n *   const intent: BusinessAccountIntent = result.intent;\n * }\n * ```\n *\n * @see {@link signBusinessAccountIntent} for signing one of these.\n * @see {@link BusinessAccountActionRequired} for where an unsigned intent is returned.\n */\nexport type BusinessAccountIntent = {\n  actionType: string;\n  businessAccountId: string;\n  createdAt: string;\n  initiatorUserId: string;\n  intentId: string;\n  payload: { changeSet: Record<string, unknown>[] };\n};\n\ntype SignBusinessAccountIntentParams = {\n  intent: BusinessAccountIntent;\n};\n\n/**\n * The signed intent and the signature over its canonical form.\n *\n * @example\n * ```ts\n * const signed: SignBusinessAccountIntentResult = await signBusinessAccountIntent({ intent });\n * ```\n *\n * @see {@link signBusinessAccountIntent} for producing this shape.\n * @see {@link SignedBusinessAccountIntent} for resending it to a governed mutation.\n */\nexport type SignBusinessAccountIntentResult = {\n  intent: BusinessAccountIntent;\n  intentSignature: string;\n};\n\n/**\n * Sign an intent with the session key.\n *\n * The signature is over the CANONICAL form, not over `JSON.stringify(intent)` —\n * the enclave re-canonicalizes before verifying, so a signature over any other\n * byte sequence will not verify. Nothing here chooses that byte sequence\n * freely: it is fixed by `canonicalizeJson`.\n *\n * The private half never enters JS. `keychain.sign` holds a non-extractable\n * key and returns a P1363 hex signature, which is the form the enclave's\n * WebCrypto verify expects.\n *\n * @param params.intent - The intent to sign.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The intent alongside the P1363 hex signature over its canonical form.\n *\n * @example\n * ```typescript\n * const { intent, intentSignature } = await signBusinessAccountIntent({ intent: draftIntent });\n * ```\n *\n * @see {@link signBusinessAccountApproval} for a co-signer approving this intent.\n * @see {@link BusinessAccountIntent} for the shape being signed.\n * @noHook A local crypto step inside a larger flow, not a standalone server mutation a component would drive loading/error state around.\n * @notInstrumented\n */\nexport const signBusinessAccountIntent = async (\n  { intent }: SignBusinessAccountIntentParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<SignBusinessAccountIntentResult> => {\n  const core = getCore(client);\n\n  const intentSignature = await core.keychain.sign(\n    'session',\n    canonicalizeJson(intent as unknown as Record<string, unknown>)\n  );\n\n  return { intent, intentSignature };\n};\n\ntype SignBusinessAccountApprovalParams = {\n  /** Defaults to now. Accepted for tests and for a caller that has already\n   *  recorded when the human consented. */\n  approvedAt?: string;\n  intent: BusinessAccountIntent;\n};\n\n/**\n * An approval's signature and the timestamp it was signed over.\n *\n * @example\n * ```ts\n * const { approvedAt, signature }: SignBusinessAccountApprovalResult = await signBusinessAccountApproval({ intent });\n * ```\n *\n * @see {@link signBusinessAccountApproval} for producing this shape.\n * @see {@link approveBusinessAccountProposal} for the usual way to approve a proposal instead.\n */\nexport type SignBusinessAccountApprovalResult = {\n  approvedAt: string;\n  signature: string;\n};\n\n/**\n * Sign an approval of someone else's intent.\n *\n * The payload is `{ approvedAt, intent }` rather than the intent alone, so each\n * approver attests WHEN they consented as well as what to. The enclave measures\n * the execution window from the latest of those timestamps, which it could not\n * do from an unsigned value — a caller could simply claim a fresher one.\n *\n * Sent whether or not the account configures an execution window: a signed\n * shape that varied with configuration would mean reading governance before\n * knowing what to sign.\n *\n * @param params.intent - The intent being approved.\n * @param params.approvedAt - When the approver consented. Defaults to now.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The timestamp signed over, alongside the P1363 hex signature.\n *\n * @example\n * ```typescript\n * const { approvedAt, signature } = await signBusinessAccountApproval({ intent });\n * ```\n *\n * @see {@link signBusinessAccountIntent} for the initiator's own signature over the intent.\n * @see {@link BusinessAccountIntent} for the shape being approved.\n * @noHook A local crypto step inside a larger flow — {@link approveBusinessAccountProposal} already wraps it for the normal approve-a-proposal case.\n * @notInstrumented\n */\n// eslint-disable-next-line custom-rules/one-function-per-file -- signing an intent and signing an approval OF that intent share the canonical-form contract; separating them invites one changing without the other\nexport const signBusinessAccountApproval = async (\n  {\n    intent,\n    approvedAt = new Date().toISOString(),\n  }: SignBusinessAccountApprovalParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<SignBusinessAccountApprovalResult> => {\n  const core = getCore(client);\n\n  const signature = await core.keychain.sign(\n    'session',\n    canonicalizeJson({\n      approvedAt,\n      intent: intent as unknown as Record<string, unknown>,\n    })\n  );\n\n  return { approvedAt, signature };\n};\n","import { TokenScope } from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { signBusinessAccountApproval } from '../../../sessionKeys/signBusinessAccountIntent/signBusinessAccountIntent';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { BusinessAccountProposal } from '../businessAccounts.types';\n\ntype ApproveProposalParams = {\n  businessAccountId: string;\n  proposal: BusinessAccountProposal;\n};\n\n/**\n * Signs and records this session's approval of a pending proposal.\n *\n * The signature is over the intent AS STORED on `proposal`, which is why it's\n * read off the proposal rather than rebuilt — a re-derived intent would carry\n * a different `intentId` and fail verification. Run this signed in as the\n * approver: the session key that signs is theirs, and the enclave reads who\n * they are from the bearer token, not from any field here. An initiator can\n * never approve their own proposal.\n *\n * With `autoExecute` on, the approval that completes the quorum also applies\n * the change and the returned proposal reads `status: 'executed'` — the\n * caller's cue to refresh the account rather than inferring readiness from\n * the tally.\n *\n * @param params.businessAccountId - The business account the proposal belongs to.\n * @param params.proposal - The proposal to approve, as returned by\n *   `listBusinessAccountProposals` or `getBusinessAccount`.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The proposal after recording this approval.\n *\n * @example\n * ```ts\n * const pending = await listBusinessAccountProposals({ businessAccountId, status: 'pending' });\n * const updated = await approveBusinessAccountProposal({ businessAccountId, proposal: pending[0] });\n * if (updated.status === 'executed') {\n *   // refresh the account — the change is live\n * }\n * ```\n *\n * @see {@link vetoBusinessAccountProposal} for refusing a proposal instead.\n * @see {@link executeBusinessAccountProposal} for applying a satisfied one with `autoExecute` off.\n * @notInstrumented\n */\nexport const approveBusinessAccountProposal = async (\n  { businessAccountId, proposal }: ApproveProposalParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountProposal> => {\n  const { approvedAt, signature } = await signBusinessAccountApproval(\n    { intent: proposal.intent },\n    client\n  );\n\n  const apiClient = createApiClient(\n    { elevatedAccessTokenScope: TokenScope.BusinessAccountproposalapprove },\n    client\n  );\n\n  const result = await apiClient.sdkApproveBusinessAccountProposal({\n    approveBusinessAccountProposalSdkRequest: {\n      approvedAt: new Date(approvedAt),\n      signature,\n    },\n    businessAccountId,\n    environmentId: getCore(client).environmentId,\n    proposalId: proposal.id,\n  });\n\n  // The generated model dates every timestamp field as `Date`; this SDK's\n  // public type keeps them as the raw ISO strings the wire actually carries.\n  return result as unknown as BusinessAccountProposal;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { getWaasWalletProviderFromWalletAccount } from '../getWaasWalletProviderFromWalletAccount';\n\ntype BackupWaasKeySharesToGoogleDriveParams = {\n  /**\n   * Optional consumer-supplied Google Drive access token. When provided (and\n   * already granted Drive scopes), the SDK uses it directly instead of falling\n   * back to the stored OAuth token — avoiding a second Google consent prompt.\n   *\n   * Especially useful for consumers using external auth: the user's Google\n   * account isn't linked in Dynamic, so there's no stored OAuth token to fall\n   * back on — they obtain a Drive-scoped token themselves and pass it here.\n   */\n  googleDriveAccessToken?: string;\n  password?: string;\n  walletAccount: WalletAccount;\n};\n\n/**\n * Backs up WaaS wallet key shares to Google Drive for secure recovery.\n *\n * This function creates a backup of the wallet's cryptographic key shares\n * to Google Drive, allowing users to recover their wallet later.\n *\n * @param params.walletAccount - The WaaS wallet account to backup.\n * @param [params.password] - Optional password to encrypt the backup.\n * @param [params.googleDriveAccessToken] - Optional consumer-supplied Drive-scoped access token; used directly instead of the stored OAuth token (avoids a second Google consent). Useful for external-auth setups.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves when the backup process is complete.\n * @notInstrumented\n */\nexport const backupWaasKeySharesToGoogleDrive = async (\n  {\n    googleDriveAccessToken,\n    password,\n    walletAccount,\n  }: BackupWaasKeySharesToGoogleDriveParams,\n  client = getDefaultClient()\n): Promise<void> => {\n  const provider = getWaasWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  return provider.backupKeySharesToGoogleDrive({\n    googleDriveAccessToken,\n    password,\n    walletAccount,\n  });\n};\n","import { WaasPolicyRuleType } from '@dynamic-labs/sdk-api-core';\n\nimport type { PolicyRuleInput, WaasPolicyRule } from '../policies.types';\n\n/**\n * Builds a policy rule that permits the described action.\n *\n * @param rule - The rule fields (name, chain, and any targeting/limit fields).\n * @returns A `WaasPolicyRule` with `ruleType` set to `allow`.\n * @notInstrumented\n */\nexport const buildAllowPolicyRule = (\n  rule: PolicyRuleInput\n): WaasPolicyRule => ({\n  ...rule,\n  ruleType: WaasPolicyRuleType.Allow,\n});\n","import { WaasPolicyRuleType } from '@dynamic-labs/sdk-api-core';\n\nimport type { PolicyRuleInput, WaasPolicyRule } from '../policies.types';\n\n/**\n * Builds a policy rule that blocks the described action.\n *\n * @param rule - The rule fields (name, chain, and any targeting/limit fields).\n * @returns A `WaasPolicyRule` with `ruleType` set to `deny`.\n * @notInstrumented\n */\nexport const buildDenyPolicyRule = (rule: PolicyRuleInput): WaasPolicyRule => ({\n  ...rule,\n  ruleType: WaasPolicyRuleType.Deny,\n});\n","import { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport { refreshAuth } from '../../../user/refreshAuth';\nimport type { BusinessAccount } from '../businessAccounts.types';\n\ntype CreateBusinessAccountParams = {\n  /**\n   * Optional developer-supplied label for the account. Not unique — multiple\n   * accounts may share the same value — so use it to group accounts or map\n   * them to an ID in your own system (a common B2B2B2C pattern). It's metadata,\n   * never an internal key.\n   */\n  externalRef?: string;\n  /** Arbitrary key-value metadata to store alongside the account. */\n  metadata?: Record<string, unknown>;\n  name?: string;\n};\n\n/**\n * Creates a new business account.\n *\n * @param [params] - Optional parameters for the business account.\n * @param [params.name] - Optional name for the business account.\n * @param [params.externalRef] - Optional developer-supplied label (not unique; accounts may share one).\n * @param [params.metadata] - Optional arbitrary key-value metadata.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The created business account.\n * @notInstrumented\n */\nexport const createBusinessAccount = async (\n  params?: CreateBusinessAccountParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccount> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  const result = await apiClient.sdkCreateBusinessAccount({\n    createBusinessAccountSdkRequest: {\n      externalRef: params?.externalRef,\n      metadata: params?.metadata,\n      name: params?.name,\n    },\n    environmentId: core.environmentId,\n  });\n\n  // Role claims are minted at token issuance, not at account creation — without\n  // rotating here, the next call (e.g. linking a wallet) is refused for lacking\n  // the owner claim. Mirrors createWalletForBusinessAccount's refresh.\n  await refreshAuth(client);\n\n  return result as unknown as BusinessAccount;\n};\n","import {\n  type WaasPolicyLayerRuleOperation,\n  WaasPolicyLayerUpdateRequestOpEnum,\n  WaasSignerPolicyLayerUpdateRequestOpEnum,\n} from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../../client/core/getCore';\nimport type { DynamicClient } from '../../../../client/types';\nimport { InvalidParamError } from '../../../../errors/InvalidParamError';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { ResolvedPolicyScope } from '../resolvePolicyScope';\nimport type { WaasPolicyLayerResponse } from '../../waas.types';\n\ntype ApplyPolicyLayerBatchParams = {\n  operations: WaasPolicyLayerRuleOperation[];\n  resolvedScope: ResolvedPolicyScope;\n};\n\n/**\n * Applies a batch of rule operations to the policy layer a\n * {@link ResolvedPolicyScope} points at, atomically in one enclave cycle.\n * Shared by {@link createPolicy} and {@link removePolicyRules} so the\n * account-vs-wallet-vs-signer branch is written once.\n *\n * @notInstrumented\n */\nexport const applyPolicyLayerBatch = (\n  { operations, resolvedScope }: ApplyPolicyLayerBatchParams,\n  client: DynamicClient\n): Promise<WaasPolicyLayerResponse> => {\n  const { environmentId } = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  // Switch, not a ternary. A ternary's else branch silently absorbs every\n  // target it wasn't written for, and we're adding layers.\n  switch (resolvedScope.target) {\n    case 'account':\n      return apiClient.updateBusinessAccountPolicyLayer({\n        businessAccountId: resolvedScope.businessAccountId,\n        environmentId,\n        waasPolicyLayerUpdateRequest: {\n          op: WaasPolicyLayerUpdateRequestOpEnum.Batch,\n          operations,\n        },\n      });\n    case 'wallet':\n      return apiClient.updateWaasWalletSelfPolicyLayer({\n        environmentId,\n        waasPolicyLayerUpdateRequest: {\n          op: WaasPolicyLayerUpdateRequestOpEnum.Batch,\n          operations,\n        },\n        walletId: resolvedScope.walletId,\n      });\n    case 'signer':\n      return apiClient.updateWaasSignerSelfPolicyLayer({\n        environmentId,\n        waasSignerPolicyLayerUpdateRequest: {\n          op: WaasSignerPolicyLayerUpdateRequestOpEnum.Batch,\n          operations,\n          shareSetId: resolvedScope.shareSetId,\n        },\n        walletId: resolvedScope.walletId,\n      });\n    default: {\n      // Adding a new target without handling it here is a type error, not a\n      // runtime surprise.\n      const unhandledScope: never = resolvedScope;\n      throw new InvalidParamError(\n        `applyPolicyLayerBatch: unhandled target \"${JSON.stringify(unhandledScope)}\"`\n      );\n    }\n  }\n};\n","/**\n * Typed `Object.keys` — returns `(keyof T)[]` instead of `string[]`, for\n * objects whose key set is fully known at the type level.\n *\n * @notInstrumented\n */\nexport const objectKeys = <T extends object>(value: T): (keyof T)[] =>\n  Object.keys(value) as (keyof T)[];\n","import type { PolicyRuleMaxAmountPerTransaction } from '../policies.types';\n\ntype BuildValueLimitResult = {\n  asset: string | undefined;\n  maxPerCall: string;\n};\n\n/**\n * Turns a {@link PolicyRuleMaxAmountPerTransaction} into the `valueLimit` shape a rule stores it as.\n * @notInstrumented\n */\nexport const buildValueLimit = ({\n  amount,\n  asset,\n}: PolicyRuleMaxAmountPerTransaction): BuildValueLimitResult => ({\n  asset,\n  maxPerCall: amount,\n});\n","import type { PolicyRuleKind } from './policyRuleKinds';\n\n/**\n * Each rule kind's name when the caller doesn't override it via\n * `PolicyRules['names']`. Shared between the `build*Rule` functions and\n * `desugarPolicyRules` so a rename can't drift the two out of sync — the\n * same reason `RULE_KINDS` in `policyRuleKinds.ts` is a single table\n * instead of parallel switches.\n */\nexport const DEFAULT_POLICY_RULE_NAMES: Record<PolicyRuleKind, string> = {\n  allowAddresses: 'Allowed addresses',\n  blockExport: 'Block key export',\n  denyAddresses: 'Denied addresses',\n  maxAmountPerTransaction: 'Per-transaction cap',\n};\n","import {\n  WaasPolicyRuleType,\n} from '@dynamic-labs/sdk-api-core';\n\nimport { buildValueLimit } from '../buildValueLimit';\nimport type { BuildRuleParams, WaasPolicyRule } from '../policies.types';\nimport { DEFAULT_POLICY_RULE_NAMES } from '../policyRuleDefaultNames';\n\n/**\n * Builds the `allowAddresses` rule, absorbing a sibling\n * `maxAmountPerTransaction` onto the same rule instead of letting it emit\n * its own — see `buildMaxAmountPerTransactionRule`.\n * @notInstrumented\n */\nexport const buildAllowAddressesRule = ({\n  context: { chain, chainIds },\n  rules,\n}: BuildRuleParams): WaasPolicyRule | undefined => {\n  if (!rules.allowAddresses || rules.allowAddresses.length === 0)\n    return undefined;\n\n  return {\n    addresses: rules.allowAddresses,\n    chain,\n    chainIds,\n    name: rules.names?.allowAddresses ?? DEFAULT_POLICY_RULE_NAMES.allowAddresses,\n    ruleType: WaasPolicyRuleType.Allow,\n    ...(rules.maxAmountPerTransaction\n      ? { valueLimit: buildValueLimit(rules.maxAmountPerTransaction) }\n      : {}),\n  };\n};\n","import {\n  WaasPolicyRuleType,\n} from '@dynamic-labs/sdk-api-core';\n\nimport type { BuildRuleParams, WaasPolicyRule } from '../policies.types';\nimport { DEFAULT_POLICY_RULE_NAMES } from '../policyRuleDefaultNames';\n\n/**\n * Builds the `blockExport` rule. `deny`, not `allow`: an addressless\n * allow-rule normalizes to an empty allowed-set, denying every transaction.\n * `chain`/`chainIds` are stamped for consistency but the enforcement of a\n * `blockExport` `operationRestrictions` rule is wallet-wide, ignoring them.\n * @notInstrumented\n */\nexport const buildBlockExportRule = ({\n  context: { chain, chainIds },\n  rules,\n}: BuildRuleParams): WaasPolicyRule | undefined => {\n  if (rules.blockExport !== true) return undefined;\n\n  return {\n    chain,\n    chainIds,\n    name: rules.names?.blockExport ?? DEFAULT_POLICY_RULE_NAMES.blockExport,\n    operationRestrictions: { blockExport: true },\n    ruleType: WaasPolicyRuleType.Deny,\n  };\n};\n","import {\n  WaasPolicyRuleType,\n} from '@dynamic-labs/sdk-api-core';\n\nimport type { BuildRuleParams, WaasPolicyRule } from '../policies.types';\nimport { DEFAULT_POLICY_RULE_NAMES } from '../policyRuleDefaultNames';\n\n/**\n * Builds the `denyAddresses` rule. Independent of `allowAddresses`.\n * @notInstrumented\n */\nexport const buildDenyAddressesRule = ({\n  context: { chain, chainIds },\n  rules,\n}: BuildRuleParams): WaasPolicyRule | undefined => {\n  if (!rules.denyAddresses || rules.denyAddresses.length === 0)\n    return undefined;\n\n  return {\n    addresses: rules.denyAddresses,\n    chain,\n    chainIds,\n    name: rules.names?.denyAddresses ?? DEFAULT_POLICY_RULE_NAMES.denyAddresses,\n    ruleType: WaasPolicyRuleType.Deny,\n  };\n};\n","import {\n  WaasPolicyRuleType,\n} from '@dynamic-labs/sdk-api-core';\n\nimport { buildValueLimit } from '../buildValueLimit';\nimport type { BuildRuleParams, WaasPolicyRule } from '../policies.types';\nimport { DEFAULT_POLICY_RULE_NAMES } from '../policyRuleDefaultNames';\n\n/**\n * Builds the standalone `maxAmountPerTransaction` rule. Only fires when\n * `allowAddresses` didn't already absorb this cap onto its own rule. `deny`\n * for the same reason as `blockExport`'s builder.\n * @notInstrumented\n */\nexport const buildMaxAmountPerTransactionRule = ({\n  context: { chain, chainIds },\n  rules,\n}: BuildRuleParams): WaasPolicyRule | undefined => {\n  const isAbsorbedByAllowAddresses = Boolean(rules.allowAddresses?.length);\n  if (!rules.maxAmountPerTransaction || isAbsorbedByAllowAddresses)\n    return undefined;\n\n  return {\n    chain,\n    chainIds,\n    name: rules.names?.maxAmountPerTransaction ?? DEFAULT_POLICY_RULE_NAMES.maxAmountPerTransaction,\n    ruleType: WaasPolicyRuleType.Deny,\n    valueLimit: buildValueLimit(rules.maxAmountPerTransaction),\n  };\n};\n","import type { WaasPolicyRule } from '../policies.types';\n\n/**\n * Checks both the current `addresses` array and the legacy singular `address` field.\n * @notInstrumented\n */\nexport const hasAddresses = (rule: WaasPolicyRule): boolean =>\n  (rule.addresses !== undefined && rule.addresses.length > 0) ||\n  rule.address != null;\n","import type { WaasPolicyRule } from '../policies.types';\n\n/**\n * Top-level {@link WaasPolicyRule} fields some rule kind's `readRule`\n * understands. Anything else present on a rule is unrecognized by\n * default — no list of unrecognized fields to keep in sync as the SDK\n * type grows.\n */\nconst RECOGNIZED_TOP_LEVEL_KEYS = [\n  'ruleId',\n  'name',\n  'ruleType',\n  'addresses',\n  'chain',\n  'chainIds',\n  'valueLimit',\n  'operationRestrictions',\n] as const satisfies readonly (keyof WaasPolicyRule)[];\n\nconst RECOGNIZED_TOP_LEVEL_KEY_SET = new Set<keyof WaasPolicyRule>(\n  RECOGNIZED_TOP_LEVEL_KEYS\n);\n\n/**\n * @notInstrumented\n */\nexport const hasUnrecognizedFields = (rule: WaasPolicyRule): boolean =>\n  (Object.keys(rule) as (keyof WaasPolicyRule)[]).some(\n    (key) => !RECOGNIZED_TOP_LEVEL_KEY_SET.has(key) && rule[key] != null\n  ) ||\n  rule.valueLimit?.totalLimit != null ||\n  rule.operationRestrictions?.blockRevocation != null ||\n  rule.operationRestrictions?.blockClientSigning != null;\n","import type { PolicyRuleMaxAmountPerTransaction } from '../policies.types';\n\n/**\n * Reads a stored `valueLimit` back into a {@link PolicyRuleMaxAmountPerTransaction}.\n * @notInstrumented\n */\nexport const readValueLimit = ({\n  asset,\n  maxPerCall,\n}: {\n  asset: string | null | undefined;\n  maxPerCall: string;\n}): PolicyRuleMaxAmountPerTransaction => ({\n  amount: maxPerCall,\n  ...(asset ? { asset } : {}),\n});\n","import {\n  WaasPolicyRuleType,\n} from '@dynamic-labs/sdk-api-core';\n\nimport { hasAddresses } from '../hasAddresses';\nimport { hasUnrecognizedFields } from '../hasUnrecognizedFields';\nimport type { PolicyRules, WaasPolicyRule } from '../policies.types';\nimport { readValueLimit } from '../readValueLimit';\n\n/**\n * Recognizes an existing rule as `allowAddresses`, reading back a merged\n * `maxAmountPerTransaction` cap too when the rule carries one.\n * @notInstrumented\n */\nexport const readAllowAddressesRule = (\n  rule: WaasPolicyRule\n): Partial<PolicyRules> | undefined => {\n  const isMatch =\n    rule.ruleType === WaasPolicyRuleType.Allow &&\n    rule.operationRestrictions === undefined &&\n    (rule.valueLimit === undefined || rule.valueLimit.maxPerCall !== undefined) &&\n    hasAddresses(rule) &&\n    !hasUnrecognizedFields(rule);\n  if (!isMatch) return undefined;\n\n  return {\n    allowAddresses: rule.addresses,\n    ...(rule.valueLimit?.maxPerCall !== undefined\n      ? {\n          maxAmountPerTransaction: readValueLimit({\n            asset: rule.valueLimit.asset,\n            maxPerCall: rule.valueLimit.maxPerCall,\n          }),\n        }\n      : {}),\n  };\n};\n","import {\n  WaasPolicyRuleType,\n} from '@dynamic-labs/sdk-api-core';\n\nimport { hasAddresses } from '../hasAddresses';\nimport { hasUnrecognizedFields } from '../hasUnrecognizedFields';\nimport type { PolicyRules, WaasPolicyRule } from '../policies.types';\n\n/**\n * Recognizes an existing rule as `blockExport`.\n * @notInstrumented\n */\nexport const readBlockExportRule = (\n  rule: WaasPolicyRule\n): Partial<PolicyRules> | undefined => {\n  const isMatch =\n    rule.ruleType === WaasPolicyRuleType.Deny &&\n    rule.operationRestrictions?.blockExport === true &&\n    rule.valueLimit === undefined &&\n    !hasAddresses(rule) &&\n    !hasUnrecognizedFields(rule);\n  if (!isMatch) return undefined;\n\n  return { blockExport: true };\n};\n","import {\n  WaasPolicyRuleType,\n} from '@dynamic-labs/sdk-api-core';\n\nimport { hasAddresses } from '../hasAddresses';\nimport { hasUnrecognizedFields } from '../hasUnrecognizedFields';\nimport type { PolicyRules, WaasPolicyRule } from '../policies.types';\n\n/**\n * Recognizes an existing rule as `denyAddresses`.\n * @notInstrumented\n */\nexport const readDenyAddressesRule = (\n  rule: WaasPolicyRule\n): Partial<PolicyRules> | undefined => {\n  const isMatch =\n    rule.ruleType === WaasPolicyRuleType.Deny &&\n    rule.operationRestrictions === undefined &&\n    rule.valueLimit === undefined &&\n    hasAddresses(rule) &&\n    !hasUnrecognizedFields(rule);\n  if (!isMatch) return undefined;\n\n  return { denyAddresses: rule.addresses };\n};\n","import {\n  WaasPolicyRuleType,\n} from '@dynamic-labs/sdk-api-core';\n\nimport { hasAddresses } from '../hasAddresses';\nimport { hasUnrecognizedFields } from '../hasUnrecognizedFields';\nimport type { PolicyRules, WaasPolicyRule } from '../policies.types';\nimport { readValueLimit } from '../readValueLimit';\n\n/**\n * Recognizes an existing rule as a standalone `maxAmountPerTransaction` cap.\n * @notInstrumented\n */\nexport const readMaxAmountPerTransactionRule = (\n  rule: WaasPolicyRule\n): Partial<PolicyRules> | undefined => {\n  const isMatch =\n    rule.ruleType === WaasPolicyRuleType.Deny &&\n    rule.operationRestrictions === undefined &&\n    rule.valueLimit?.maxPerCall !== undefined &&\n    !hasAddresses(rule) &&\n    !hasUnrecognizedFields(rule);\n  if (!isMatch) return undefined;\n\n  return {\n    maxAmountPerTransaction: readValueLimit({\n      asset: rule.valueLimit!.asset,\n      maxPerCall: rule.valueLimit!.maxPerCall!,\n    }),\n  };\n};\n","import { buildAllowAddressesRule } from './buildAllowAddressesRule';\nimport { buildBlockExportRule } from './buildBlockExportRule';\nimport { buildDenyAddressesRule } from './buildDenyAddressesRule';\nimport { buildMaxAmountPerTransactionRule } from './buildMaxAmountPerTransactionRule';\nimport type {\n  BuildRuleParams,\n  PolicyRules,\n  WaasPolicyRule,\n} from './policies.types';\nimport { readAllowAddressesRule } from './readAllowAddressesRule';\nimport { readBlockExportRule } from './readBlockExportRule';\nimport { readDenyAddressesRule } from './readDenyAddressesRule';\nimport { readMaxAmountPerTransactionRule } from './readMaxAmountPerTransactionRule';\n\nexport type { RuleKindContext } from './policies.types';\n\n/**\n * Kept as a data table, not parallel switches in\n * `expandPolicyRules`/`desugarPolicyRules`, so the two can't drift out of sync.\n */\ntype RuleKindDefinition = {\n  /**\n   * Builds this kind's rule from the full sugar map, not just this key's\n   * own value, so a key can be absorbed into another kind's rule instead of\n   * emitting its own (see `allowAddresses` / `maxAmountPerTransaction`).\n   */\n  buildRule: (params: BuildRuleParams) => WaasPolicyRule | undefined;\n  /**\n   * Recognizes an existing rule as this kind and reads its sugar value\n   * back. Undefined when it doesn't match, including when it carries a\n   * field outside the sugar vocabulary, so that data is never silently\n   * dropped.\n   */\n  readRule: (rule: WaasPolicyRule) => Partial<PolicyRules> | undefined;\n};\n\n/** The four keys of {@link PolicyRules}, each of which produces its own rule. */\nexport const RULE_KIND_KEYS = [\n  'blockExport',\n  'allowAddresses',\n  'denyAddresses',\n  'maxAmountPerTransaction',\n] as const;\n\nexport type PolicyRuleKind = (typeof RULE_KIND_KEYS)[number];\n\n/**\n * The single source of truth {@link expandPolicyRules} and\n * {@link desugarPolicyRules} both build on. Entries are alphabetized\n * (enforced by lint), not grouped by relationship — `allowAddresses` and\n * `maxAmountPerTransaction` cooperate (see their builders' comments) despite\n * sitting apart here.\n */\nexport const RULE_KINDS: Record<PolicyRuleKind, RuleKindDefinition> = {\n  allowAddresses: {\n    buildRule: buildAllowAddressesRule,\n    readRule: readAllowAddressesRule,\n  },\n  blockExport: {\n    buildRule: buildBlockExportRule,\n    readRule: readBlockExportRule,\n  },\n  denyAddresses: {\n    buildRule: buildDenyAddressesRule,\n    readRule: readDenyAddressesRule,\n  },\n  maxAmountPerTransaction: {\n    buildRule: buildMaxAmountPerTransactionRule,\n    readRule: readMaxAmountPerTransactionRule,\n  },\n};\n","import { objectKeys } from '../../../../utils/objectKeys';\nimport type { PolicyRules, WaasPolicyRule } from '../policies.types';\nimport {\n  type PolicyRuleKind,\n  RULE_KINDS,\n  RULE_KIND_KEYS,\n} from '../policyRuleKinds';\n\nexport type CoveredRule = {\n  keys: PolicyRuleKind[];\n  /** The rule kind whose builder owns this rule's `name` when kinds are merged (e.g. `allowAddresses` over `maxAmountPerTransaction`). */\n  kind: PolicyRuleKind;\n  values: Partial<PolicyRules>;\n};\n\n/**\n * Statically asserts every {@link PolicyRuleKind} is a {@link PolicyRules}\n * key, so `objectKeys(values)` below is safe to widen to `PolicyRuleKind[]`\n * without a runtime cast — fails to compile if a kind and its sugar key\n * ever drift apart. Exported (unused otherwise) purely so `noUnusedLocals`\n * leaves it alone; not part of this module's public surface.\n */\nexport type KindsCoverPolicyRules = PolicyRuleKind extends keyof PolicyRules\n  ? true\n  : never;\n\n/**\n * The sugar keys and values an existing rule structurally represents — a\n * single rule can cover more than one key (see `allowAddresses` absorbing\n * `maxAmountPerTransaction` in `policyRuleKinds.ts`). A rule carrying a\n * per-rule `modifiableBySigner` grant is never matched here — treating it\n * as covering keys would let a caller's batch reuse/replace/remove it and\n * silently revoke that signer's edit permission (mirrors `desugarPolicyRules`).\n *\n * @param rule - The existing policy-layer rule to read.\n * @returns The sugar keys and values the rule covers, or undefined when it matches no kind or carries a signer grant.\n * @notInstrumented\n */\nexport const readCoveredRule = (\n  rule: WaasPolicyRule\n): CoveredRule | undefined => {\n  if (rule.modifiableBySigner === true) {\n    return undefined;\n  }\n\n  for (const kind of RULE_KIND_KEYS) {\n    const values = RULE_KINDS[kind].readRule(rule);\n    if (values === undefined) continue;\n\n    return { keys: objectKeys(values) as PolicyRuleKind[], kind, values };\n  }\n\n  // Existing layer rules may be legacy/hand-authored and match no kind —\n  // those cover no keys, so are never matched or removed.\n  return undefined;\n};\n","import type { WaasPolicyRule } from '../policies.types';\n\n/**\n * Sorts rules by `ruleId` ascending (a rule missing one sorts first, as `''`)\n * — the deterministic order {@link matchExistingRules} picks its reuse\n * target from, so every caller agrees on which duplicate rule wins.\n *\n * @param rules - The rules to sort.\n * @returns A new array, sorted by `ruleId` ascending.\n * @notInstrumented\n */\nexport const sortRulesByRuleId = (rules: WaasPolicyRule[]): WaasPolicyRule[] =>\n  [...rules].sort((a, b) => {\n    const idA = a.ruleId ?? '';\n    const idB = b.ruleId ?? '';\n\n    if (idA < idB) return -1;\n    if (idA > idB) return 1;\n    return 0;\n  });\n","import type { WaasPolicyRule } from '../policies.types';\nimport type { PolicyRuleKind } from '../policyRuleKinds';\nimport { readCoveredRule } from '../readCoveredRule';\nimport { sortRulesByRuleId } from '../sortRulesByRuleId';\n\ntype MatchExistingRulesParams = {\n  builtRule: WaasPolicyRule;\n  consumedRuleIds: Set<string>;\n  existingRulesInScope: WaasPolicyRule[];\n};\n\n/** A rule that can be reused or superseded always has a `ruleId` — see the `matches` filter below. */\ntype MatchedRule = WaasPolicyRule & { ruleId: string };\n\nexport type RuleMatch = {\n  /** The rule to upsert `builtRule` onto, if any existing rule covers one of its keys. */\n  reused: MatchedRule | undefined;\n  /** Rules fully absorbed into `builtRule` — safe to remove. */\n  superseded: MatchedRule[];\n};\n\nconst coveredRuleKeys = (rule: WaasPolicyRule): PolicyRuleKind[] =>\n  readCoveredRule(rule)?.keys ?? [];\n\n/**\n * Matches existing rules covering any of `builtRule`'s keys. Only rules\n * being *absorbed* into it — i.e. no other match claims the same key — are\n * superseded (safe to remove). Two matches claiming the SAME key (e.g. two\n * hand-authored `denyAddresses` rules for this chain scope) are a\n * legitimate duplicate, not one superseding the other, so are left alone\n * rather than removed.\n *\n * @param params.builtRule - The newly built rule to match existing rules against.\n * @param params.consumedRuleIds - `ruleId`s already reused or removed for a prior built rule this call, so none is touched twice.\n * @param params.existingRulesInScope - The layer's rules already narrowed to the target chain scope.\n * @returns The rule to reuse `builtRule`'s upsert onto (if any), and every rule it supersedes.\n * @notInstrumented\n */\nexport const matchExistingRules = ({\n  builtRule,\n  consumedRuleIds,\n  existingRulesInScope,\n}: MatchExistingRulesParams): RuleMatch => {\n  const builtKeys = new Set(coveredRuleKeys(builtRule));\n\n  // Keys resolved once per rule up front, so the O(n²) overlap check below\n  // reuses them instead of recomputing `coveredRuleKeys` for every pair.\n  const matches = sortRulesByRuleId(existingRulesInScope)\n    .filter(\n      (existingRule): existingRule is MatchedRule =>\n        existingRule.ruleId !== undefined &&\n        !consumedRuleIds.has(existingRule.ruleId)\n    )\n    .map((rule) => ({ keys: coveredRuleKeys(rule), rule }))\n    .filter(({ keys }) => keys.some((key) => builtKeys.has(key)));\n\n  const [reused, ...rest] = matches;\n  const superseded = rest\n    .filter(({ keys, rule }) => {\n      const ruleKeys = new Set(keys);\n      return !matches.some(\n        (other) =>\n          other.rule.ruleId !== rule.ruleId &&\n          other.keys.some((key) => ruleKeys.has(key))\n      );\n    })\n    .map(({ rule }) => rule);\n\n  return { reused: reused?.rule, superseded };\n};\n","import type { PolicyRules, WaasPolicyRule } from '../policies.types';\nimport { readCoveredRule } from '../readCoveredRule';\n\ntype ResolveRuleNameParams = {\n  builtRule: WaasPolicyRule;\n  reused: WaasPolicyRule | undefined;\n  rules: PolicyRules;\n};\n\n/**\n * Keeps the reused rule's label unless the caller overrides it or its\n * name-owning kind changed.\n *\n * @param params.builtRule - The newly built rule about to be upserted.\n * @param params.reused - The existing rule `builtRule` is upserted onto, if any.\n * @param params.rules - The caller's requested {@link PolicyRules} sugar map.\n * @returns The name to use for the upserted rule.\n * @notInstrumented\n */\nexport const resolveRuleName = ({\n  builtRule,\n  reused,\n  rules,\n}: ResolveRuleNameParams): string => {\n  if (reused === undefined) return builtRule.name;\n\n  const builtKind = readCoveredRule(builtRule)?.kind;\n  const reusedKind = readCoveredRule(reused)?.kind;\n\n  // Both undefined means neither classified, not that they agree.\n  const sameOwningKind = builtKind !== undefined && builtKind === reusedKind;\n  const nameOverridden =\n    builtKind !== undefined && rules.names?.[builtKind] !== undefined;\n\n  return sameOwningKind && !nameOverridden ? reused.name : builtRule.name;\n};\n","import {\n  type WaasPolicyLayerRuleOperation,\n  WaasPolicyLayerRuleOperationOpEnum,\n} from '@dynamic-labs/sdk-api-core';\n\nimport { matchExistingRules } from '../matchExistingRules';\nimport type { PolicyRules, WaasPolicyRule } from '../policies.types';\nimport { resolveRuleName } from '../resolveRuleName';\n\ntype BuildOperationsForRuleParams = {\n  builtRule: WaasPolicyRule;\n  consumedRuleIds: Set<string>;\n  existingRulesInScope: WaasPolicyRule[];\n  rules: PolicyRules;\n};\n\n/**\n * Upserts `builtRule` onto the existing rule it reuses (if any), and\n * removes every rule that rule superseded. Mutates `consumedRuleIds` so a\n * later call for a different built rule never reuses or removes the same\n * existing rule twice.\n *\n * @param params.builtRule - The newly built rule to turn into batch operations.\n * @param params.consumedRuleIds - `ruleId`s already reused or removed for a prior built rule this call.\n * @param params.existingRulesInScope - The layer's rules already narrowed to the target chain scope.\n * @param params.rules - The caller's requested {@link PolicyRules} sugar map.\n * @returns The batch operations for this built rule — one upsert, plus a remove per superseded rule.\n * @notInstrumented\n */\nexport const buildOperationsForRule = ({\n  builtRule,\n  consumedRuleIds,\n  existingRulesInScope,\n  rules,\n}: BuildOperationsForRuleParams): WaasPolicyLayerRuleOperation[] => {\n  const { reused, superseded } = matchExistingRules({\n    builtRule,\n    consumedRuleIds,\n    existingRulesInScope,\n  });\n\n  const reusedRuleId = reused?.ruleId;\n\n  const operations: WaasPolicyLayerRuleOperation[] = [\n    {\n      op: WaasPolicyLayerRuleOperationOpEnum.Upsert,\n      rule: reusedRuleId\n        ? {\n            ...builtRule,\n            name: resolveRuleName({ builtRule, reused, rules }),\n            ruleId: reusedRuleId,\n          }\n        : builtRule,\n    },\n  ];\n\n  if (reusedRuleId) {\n    consumedRuleIds.add(reusedRuleId);\n  }\n\n  for (const { ruleId } of superseded) {\n    consumedRuleIds.add(ruleId);\n    operations.push({ op: WaasPolicyLayerRuleOperationOpEnum.Remove, ruleId });\n  }\n\n  return operations;\n};\n","import { WaasPolicyRuleType } from '@dynamic-labs/sdk-api-core';\n\nimport { InvalidParamError } from '../../../../errors/InvalidParamError';\nimport type { PolicyRules, WaasPolicyRule } from '../policies.types';\nimport type { WaasChainEnum } from '../../waas.consts';\nimport { RULE_KINDS, RULE_KIND_KEYS } from '../policyRuleKinds';\n\ntype ExpandPolicyRulesParams = {\n  chain: WaasChainEnum;\n  chainIds?: number[];\n  rules: PolicyRules;\n};\n\n/**\n * Expands the {@link PolicyRules} sugar map into `WaasPolicyRule[]` for one\n * chain scope. Omitting `chainIds` (or passing an empty array) builds a\n * wildcard rule matching every chain id of `chain`.\n *\n * @param params.rules - The sugar map describing the desired rules.\n * @param params.chain - The chain these rules apply to.\n * @param params.chainIds - The chain ids these rules apply to; omit for a wildcard rule that matches every chain id of `chain`.\n * @returns The expanded `WaasPolicyRule[]`, without `ruleId`.\n * @throws When expansion would produce an `allow` rule with a value limit and no addresses — that empties the allowed set and denies every transaction on the chain.\n * @notInstrumented\n */\nexport const expandPolicyRules = ({\n  chain,\n  chainIds,\n  rules,\n}: ExpandPolicyRulesParams): WaasPolicyRule[] => {\n  const context = { chain, chainIds: chainIds ?? [] };\n\n  const expanded = RULE_KIND_KEYS.flatMap((key) => {\n    const rule = RULE_KINDS[key].buildRule({ context, rules });\n    return rule ? [rule] : [];\n  });\n\n  const unsafeAllowRule = expanded.some(\n    (rule) =>\n      rule.ruleType === WaasPolicyRuleType.Allow &&\n      rule.valueLimit !== undefined &&\n      (rule.addresses === undefined || rule.addresses.length === 0)\n  );\n  if (unsafeAllowRule) {\n    throw new InvalidParamError(\n      'expandPolicyRules: refusing to emit an allow rule with a value limit and no addresses — it would empty the allowed-address set and deny every transaction on this chain'\n    );\n  }\n\n  return expanded;\n};\n","import type { PolicyRules, WaasPolicyRule } from '../policies.types';\nimport type { PolicyRuleKind } from '../policyRuleKinds';\nimport { readCoveredRule } from '../readCoveredRule';\nimport { sortRulesByRuleId } from '../sortRulesByRuleId';\n\ntype FillOmittedRuleValuesParams = {\n  existingRulesInScope: WaasPolicyRule[];\n  rules: PolicyRules;\n};\n\n/**\n * Whether the caller's value for a sugar key would actually produce a rule —\n * an empty `allowAddresses`/`denyAddresses` array builds no rule (see\n * `buildAllowAddressesRule`/`buildDenyAddressesRule`), so it must count the\n * same as omitted here. Otherwise a real value is present.\n */\nconst isRuleKeyRequested = (value: PolicyRules[PolicyRuleKind]): boolean =>\n  Array.isArray(value) ? value.length > 0 : value !== undefined;\n\n/**\n * A key the caller omitted can be silently dropped if it's merged into the\n * same rule as a key they DID supply (e.g. re-saving only `allowAddresses`\n * when the existing rule also carries `maxAmountPerTransaction`) — carries\n * it forward so a partial re-save never erases a restriction the caller\n * didn't ask to remove.\n *\n * Rules are visited in the same lexicographically-smallest-`ruleId` order\n * `matchExistingRules` reuses, and only the first rule to cover a given key\n * fills it — so when duplicate rules cover the same omitted key, the value\n * always comes from the rule that will actually be upserted.\n *\n * @param params.existingRulesInScope - The layer's rules already narrowed to the target chain scope.\n * @param params.rules - The caller's requested {@link PolicyRules} sugar map.\n * @returns `rules`, with any key a partially-requested existing rule also covers filled in from that rule's current value.\n * @notInstrumented\n */\nexport const fillOmittedRuleValues = ({\n  existingRulesInScope,\n  rules,\n}: FillOmittedRuleValuesParams): PolicyRules => {\n  const mergedRules: PolicyRules = { ...rules };\n\n  for (const existingRule of sortRulesByRuleId(existingRulesInScope)) {\n    const covered = readCoveredRule(existingRule);\n    const isPartiallyRequested =\n      covered !== undefined &&\n      covered.keys.some((key) => isRuleKeyRequested(rules[key])) &&\n      covered.keys.some((key) => !isRuleKeyRequested(rules[key]));\n    if (covered === undefined || !isPartiallyRequested) {\n      continue;\n    }\n\n    for (const key of covered.keys) {\n      if (!isRuleKeyRequested(rules[key]) && mergedRules[key] === undefined) {\n        Object.assign(mergedRules, { [key]: covered.values[key] });\n      }\n    }\n  }\n\n  return mergedRules;\n};\n","import type { WaasPolicyLayerResponse } from '../../waas.types';\nimport { getCore } from '../../../../client/core/getCore';\nimport type { DynamicClient } from '../../../../client/types';\nimport { InvalidParamError } from '../../../../errors/InvalidParamError';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { ResolvedPolicyScope } from '../resolvePolicyScope';\n\ntype GetResolvedPolicyLayerParams = {\n  resolvedScope: ResolvedPolicyScope;\n};\n\n/**\n * Fetches the policy layer a {@link ResolvedPolicyScope} points at. Shared\n * by {@link createPolicy}, {@link getPolicy}, and {@link removePolicyRules}\n * so the account/wallet/signer branch is written once.\n *\n * @notInstrumented\n */\nexport const getResolvedPolicyLayer = (\n  { resolvedScope }: GetResolvedPolicyLayerParams,\n  client: DynamicClient\n): Promise<WaasPolicyLayerResponse> => {\n  const { environmentId } = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  // Switch, not a ternary. A ternary's else branch silently absorbs every\n  // target it wasn't written for, and we're adding layers.\n  switch (resolvedScope.target) {\n    case 'account':\n      return apiClient.getBusinessAccountPolicyLayer({\n        businessAccountId: resolvedScope.businessAccountId,\n        environmentId,\n      });\n    case 'wallet':\n      return apiClient.getWaasWalletSelfPolicyLayer({\n        environmentId,\n        walletId: resolvedScope.walletId,\n      });\n    case 'signer':\n      return apiClient.getWaasSignerSelfPolicyLayer({\n        environmentId,\n        shareSetId: resolvedScope.shareSetId,\n        walletId: resolvedScope.walletId,\n      });\n    default: {\n      // Adding a new target without handling it here is a type error, not a\n      // runtime surprise.\n      const unhandledScope: never = resolvedScope;\n      throw new InvalidParamError(\n        `getResolvedPolicyLayer: unhandled target \"${JSON.stringify(unhandledScope)}\"`\n      );\n    }\n  }\n};\n","import { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { assertDefined } from '../../../../utils/assertDefined';\nimport { getWalletAccounts } from '../../../wallets/getWalletAccounts';\nimport type { WalletAccount } from '../../../wallets/walletAccount';\nimport { isWaasWalletAccount } from '../../isWaasWalletAccount';\nimport type { WaasWalletAccount } from '../../waas.types';\nimport type { PolicyScope } from '../policies.types';\n\n/** Narrows a {@link WalletAccount} to {@link WaasWalletAccount} so WaaS-only fields (e.g. `shareSetId`) are accessible. */\nconst isWaasWallet = (\n  walletAccount: WalletAccount\n): walletAccount is WaasWalletAccount => isWaasWalletAccount({ walletAccount });\n\ntype ResolvePolicyScopeParams = {\n  scope: PolicyScope;\n};\n\n/** The concrete policy-Layer a {@link PolicyScope} resolves to, and the ids needed to call the SDK API for it. */\nexport type ResolvedPolicyScope =\n  | { businessAccountId: string; target: 'account' }\n  | { target: 'wallet'; walletId: string }\n  | { shareSetId?: string; target: 'signer'; walletId: string };\n\n/**\n * Resolves a {@link PolicyScope} to its concrete policy layer. When only a\n * `shareSetId` is given, the owning wallet is found locally by scanning the\n * client's own wallet accounts — no network request.\n *\n * @param params.scope - The scope to resolve.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The concrete target (`account`, `wallet`, or `signer`) plus the ids needed to call the SDK API.\n * @throws When a `shareSetId`-only scope doesn't match any of the client's wallet accounts.\n * @notInstrumented\n */\nexport const resolvePolicyScope = (\n  { scope }: ResolvePolicyScopeParams,\n  client: DynamicClient = getDefaultClient()\n): ResolvedPolicyScope => {\n  if ('businessAccountId' in scope) {\n    return { businessAccountId: scope.businessAccountId, target: 'account' };\n  }\n\n  if ('walletId' in scope) {\n    return scope.shareSetId === undefined\n      ? { target: 'wallet', walletId: scope.walletId }\n      : {\n          shareSetId: scope.shareSetId,\n          target: 'signer',\n          walletId: scope.walletId,\n        };\n  }\n\n  const owningWalletAccount = getWalletAccounts(client)\n    .filter(isWaasWallet)\n    .find(\n      (walletAccount) =>\n        walletAccount.shareSetId === scope.shareSetId ||\n        walletAccount.otherShareSets?.some(\n          (shareSet) => shareSet.shareSetId === scope.shareSetId\n        )\n    );\n\n  assertDefined(\n    owningWalletAccount?.verifiedCredentialId,\n    `resolvePolicyScope: could not resolve a wallet for shareSetId \"${scope.shareSetId}\" — no verified wallet account exposes this share set`\n  );\n\n  return {\n    shareSetId: scope.shareSetId,\n    target: 'signer',\n    walletId: owningWalletAccount.verifiedCredentialId,\n  };\n};\n","type SameChainIdsParams = {\n  existing: number[] | undefined;\n  requested: number[];\n};\n\n/**\n * Whether two chainIds arrays describe the same set, regardless of order.\n * Shared by {@link createPolicy} and {@link removePolicyRules} to keep their\n * existing-rule lookups consistent.\n *\n * @notInstrumented\n */\nexport const sameChainIds = ({\n  existing = [],\n  requested,\n}: SameChainIdsParams): boolean => {\n  if (existing.length !== requested.length) return false;\n\n  const sortedExisting = [...existing].sort((x, y) => x - y);\n  const sortedRequested = [...requested].sort((x, y) => x - y);\n\n  return sortedExisting.every((id, index) => id === sortedRequested[index]);\n};\n","import {\n  type WaasPolicyLayerRuleOperation,\n} from '@dynamic-labs/sdk-api-core';\n\nimport type { WaasPolicyLayerResponse } from '../../waas.types';\nimport type { WaasChainEnum } from '../../waas.consts';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { InvalidParamError } from '../../../../errors/InvalidParamError';\nimport { applyPolicyLayerBatch } from '../applyPolicyLayerBatch';\nimport { buildOperationsForRule } from '../buildOperationsForRule';\nimport { expandPolicyRules } from '../expandPolicyRules';\nimport { fillOmittedRuleValues } from '../fillOmittedRuleValues';\nimport { getResolvedPolicyLayer } from '../getResolvedPolicyLayer';\nimport type { PolicyRules, PolicyScope } from '../policies.types';\nimport { resolvePolicyScope } from '../resolvePolicyScope';\nimport { sameChainIds } from '../sameChainIds';\n\ntype CreatePolicyParams = {\n  chain: WaasChainEnum;\n  chainIds?: number[];\n  rules: PolicyRules;\n  scope: PolicyScope;\n};\n\n/**\n * Creates or updates a wallet's, signer's, or business account's policy rules from the\n * {@link PolicyRules} sugar map, in one atomic `batch` PATCH. Each key in\n * `rules` maps to at most one underlying rule, so calling this twice with\n * the same map updates that rule in place instead of duplicating it.\n *\n * Known race: no ETag / optimistic-concurrency check — concurrent calls for\n * the same scope can both read-then-write and duplicate a rule.\n *\n * When more than one existing rule matches the same sugar key(s), only\n * rules being absorbed into the newly built rule (i.e. no other match\n * claims the same key) are removed. Two rules that duplicate the same key\n * (e.g. two hand-authored `denyAddresses` rules for this chain scope) are\n * left as-is rather than one being silently deleted — this call updates the\n * lexicographically-smallest-`ruleId` match in place and leaves the rest\n * untouched. A caller repeating this call will not converge on a single\n * rule; the duplicate has to be removed by hand.\n *\n * @param params.scope - Which policy layer to update — see {@link resolvePolicyScope}.\n * @param params.chain - The chain the rules apply to.\n * @param params.chainIds - The chain ids the rules apply to; omit for a wildcard rule that matches every chain id of `chain`.\n * @param params.rules - The desired rules, as a {@link PolicyRules} sugar map.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The policy layer as it stands after the batch is applied.\n * @throws When `rules` produces no recognized keys, or via {@link resolvePolicyScope}'s scope-resolution errors.\n * @notInstrumented\n */\nexport const createPolicy = async (\n  { chain, chainIds, rules, scope }: CreatePolicyParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<WaasPolicyLayerResponse> => {\n  // Omitted means wildcard. [] is the stored representation, so an existing\n  // wildcard rule and a wildcard request compare equal below.\n  const normalizedChainIds = chainIds ?? [];\n\n  const resolvedScope = resolvePolicyScope({ scope }, client);\n  const layer = await getResolvedPolicyLayer({ resolvedScope }, client);\n\n  const existingRulesInScope = (layer.layerContent.rules ?? []).filter(\n    (existingRule) =>\n      existingRule.chain === chain &&\n      sameChainIds({\n        existing: existingRule.chainIds,\n        requested: normalizedChainIds,\n      })\n  );\n\n  const mergedRules = fillOmittedRuleValues({ existingRulesInScope, rules });\n  const expandedRules = expandPolicyRules({\n    chain,\n    chainIds: normalizedChainIds,\n    rules: mergedRules,\n  });\n  if (expandedRules.length === 0) {\n    throw new InvalidParamError(\n      'createPolicy: rules must include at least one recognized policy key'\n    );\n  }\n\n  // Sequential, not parallel. Each call mutates consumedRuleIds so a later\n  // built rule never reuses or removes an existing rule an earlier one took.\n  const consumedRuleIds = new Set<string>();\n  const operations: WaasPolicyLayerRuleOperation[] = [];\n\n  for (const builtRule of expandedRules) {\n    operations.push(\n      ...buildOperationsForRule({\n        builtRule,\n        consumedRuleIds,\n        existingRulesInScope,\n        rules,\n      })\n    );\n  }\n\n  return applyPolicyLayerBatch({ operations, resolvedScope }, client);\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { getWaasWalletProviderFromWalletAccount } from '../getWaasWalletProviderFromWalletAccount';\n\ntype CreateWaasOfflineRecoverySharesParams = {\n  /**\n   * Optional consumer-supplied Drive access token. When provided (and already\n   * granted Drive scopes), the SDK uses it directly instead of falling back\n   * to the stored OAuth token — avoiding a second Google consent prompt.\n   */\n  cloudProviderAccessToken?: string;\n  mfaToken?: string;\n  password?: string;\n  walletAccount: WalletAccount;\n};\n\n/**\n * Mints an offline-recovery share set for a WaaS wallet account.\n *\n * This mints a second, independent 2-of-2 share set: the client's share is\n * uploaded to Google Drive, and the server's share is delivered to the\n * developer's webhook. Dynamic never retains its half, so recovery works even\n * if Dynamic is fully offline.\n *\n * @param params.walletAccount - The WaaS wallet account to create offline-recovery shares for.\n * @param [params.password] - Optional password to encrypt the client share.\n * @param [params.cloudProviderAccessToken] - Optional consumer-supplied Drive-scoped access token; used directly instead of the stored OAuth token (avoids a second Google consent). Useful for external-auth setups.\n * @param [params.mfaToken] - Optional MFA token proving step-up verification, when required for this action.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves when the offline-recovery share set has been minted.\n * @notInstrumented\n */\nexport const createWaasOfflineRecoveryShares = async (\n  {\n    cloudProviderAccessToken,\n    mfaToken,\n    password,\n    walletAccount,\n  }: CreateWaasOfflineRecoverySharesParams,\n  client = getDefaultClient()\n): Promise<void> => {\n  const provider = getWaasWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  return provider.createOfflineRecoveryShares({\n    cloudProviderAccessToken,\n    mfaToken,\n    password,\n    walletAccount,\n  });\n};\n","import type { Chain } from '../../chain';\nimport type { WalletCreationRequirement } from '../waas.types';\n\n/**\n * Type guard to check if an item is a WalletCreationRequirement object.\n * Chain values are strings, so we can distinguish by checking if it's an object with a 'chain' property.\n *\n * @param item - The item to check, either a WalletCreationRequirement or Chain string\n * @returns True if the item is a WalletCreationRequirement object\n  * @notInstrumented\n */\nexport const isWalletCreationRequirement = (\n  item: WalletCreationRequirement | Chain\n): item is WalletCreationRequirement =>\n  typeof item === 'object' && item !== null && 'chain' in item;\n","import type { Chain } from '../../chain';\nimport { isWalletCreationRequirement } from '../isWalletCreationRequirement/isWalletCreationRequirement';\nimport type {\n  WalletCreationBitcoinConfig,\n  WalletCreationRequirement,\n} from '../waas.types';\n\nconst DEFAULT_BITCOIN_ADDRESS_TYPE = 'native_segwit' as const;\n\ntype NormalizeWalletRequirementsParams = {\n  defaultBitcoinConfig?: WalletCreationBitcoinConfig;\n  input: WalletCreationRequirement[] | Chain[];\n};\n\n/**\n * Normalizes wallet creation input from either legacy Chain[] format\n * or new WalletCreationRequirement[] format to WalletCreationRequirement[].\n *\n * For BTC chains without explicit bitcoinConfig, defaults to native_segwit.\n *\n * @param params.input - Either an array of Chain strings or WalletCreationRequirement objects\n * @param params.defaultBitcoinConfig - Optional default bitcoin config to use for BTC chains when converting from legacy format\n * @returns Array of WalletCreationRequirement objects\n  * @notInstrumented\n */\nexport const normalizeWalletRequirements = ({\n  defaultBitcoinConfig,\n  input,\n}: NormalizeWalletRequirementsParams): WalletCreationRequirement[] => {\n  if (input.length === 0) {\n    return [];\n  }\n\n  const [firstItem] = input;\n\n  if (isWalletCreationRequirement(firstItem)) {\n    return (input as WalletCreationRequirement[]).map((requirement) => {\n      if (requirement.chain === 'BTC' && !requirement.bitcoinConfig) {\n        return {\n          ...requirement,\n          bitcoinConfig: { addressType: DEFAULT_BITCOIN_ADDRESS_TYPE },\n        };\n      }\n\n      return requirement;\n    });\n  }\n\n  return (input as Chain[]).map((chain) => {\n    const requirement: WalletCreationRequirement = { chain };\n\n    if (chain === 'BTC') {\n      requirement.bitcoinConfig = defaultBitcoinConfig ?? {\n        addressType: DEFAULT_BITCOIN_ADDRESS_TYPE,\n      };\n    }\n\n    return requirement;\n  });\n};\n","import type { ThresholdSignatureScheme } from '@dynamic-labs-wallet/browser-wallet-client';\nimport { WalletProviderEnum } from '@dynamic-labs/sdk-api-core';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { NotWaasWalletProviderError } from '../../../errors/NotWaasWalletProviderError';\nimport { NoWalletProviderFoundError } from '../../../errors/NoWalletProviderFoundError';\nimport type { Chain } from '../../chain';\nimport { refreshAuth } from '../../user/refreshAuth';\nimport { getWalletProviderByKey } from '../../wallets/getWalletProviderByKey';\nimport { formatWalletProviderKey } from '../../wallets/utils/formatWalletProviderKey';\nimport { DYNAMIC_WAAS_METADATA } from '../constants';\nimport { isWaasWalletProvider } from '../isWaasWalletProvider';\nimport { normalizeWalletRequirements } from '../normalizeWalletRequirements/normalizeWalletRequirements';\nimport type { WalletCreationRequirement } from '../waas.types';\n\ntype CreateWaasWalletAccountsParams = {\n  /**\n   * For which chains to create wallet accounts.\n   * Accepts either an array of chain strings (legacy format) or an array of\n   * WalletCreationRequirement objects for chain-specific configuration.\n   *\n   * For Bitcoin, you can specify the address type ('native_segwit' or 'taproot').\n   * If not specified, defaults to 'native_segwit'.\n   *\n   * If a chain is passed multiple times, just as many wallet accounts will be created\n   * for that chain.\n    * @notInstrumented\n */\n  chains: Chain[] | WalletCreationRequirement[];\n  /**\n   * The optional password to use for the wallet accounts.\n   * It's used to encrypt the user shares.\n   * The same password must be used for all waas wallet accounts created for the same user.\n   */\n  password?: string;\n  /**\n   * The threshold signature scheme to use for the wallet accounts.\n   * If not provided, TWO_OF_TWO will be used.\n   */\n  thresholdSignatureScheme?: ThresholdSignatureScheme;\n};\n\n/**\n * Creates wallet accounts for the specified chains.\n *\n * This function creates wallet accounts for the specified chains.\n * If the same chain is passed multiple times, just as many wallet accounts will be created\n * for that chain.\n *\n * @example\n * ```ts\n * // Legacy format - will create wallet accounts for EVM and SOL, BTC defaults to native_segwit\n * await createWaasWalletAccounts({ chains: ['EVM', 'SOL', 'BTC'] });\n *\n * // New format with chain-specific config\n * await createWaasWalletAccounts({\n *   chains: [\n *     { chain: 'BTC', bitcoinConfig: { addressType: 'taproot' } },\n *     { chain: 'EVM' },\n *   ]\n * });\n *\n * // Create both BTC address types\n * await createWaasWalletAccounts({\n *   chains: [\n *     { chain: 'BTC', bitcoinConfig: { addressType: 'native_segwit' } },\n *     { chain: 'BTC', bitcoinConfig: { addressType: 'taproot' } },\n *   ]\n * });\n * ```\n *\n * @param params.chains - The chains to create wallet accounts for.\n * @param params.password - The optional password to use for the wallet accounts.\n * @param params.thresholdSignatureScheme - The threshold signature scheme to use for the wallet accounts. (Default: TWO_OF_TWO)\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves when all wallet accounts are created.\n  * @notInstrumented\n */\nexport const createWaasWalletAccounts = async (\n  {\n    chains,\n    password,\n    thresholdSignatureScheme,\n  }: CreateWaasWalletAccountsParams,\n  client = getDefaultClient()\n): Promise<void> => {\n  const normalizedRequirements = normalizeWalletRequirements({ input: chains });\n\n  // we need this right now so we don't try to create wallet accounts for chains\n  // that we don't support Dynamic Waas yet in the JS SDK\n  const supportedChains = ['ALEO', 'BTC', 'EVM', 'SOL', 'SUI', 'TON', 'TRON'];\n\n  const filteredRequirements = normalizedRequirements.filter((requirement) =>\n    supportedChains.includes(requirement.chain)\n  );\n\n  if (filteredRequirements.length === 0) {\n    return;\n  }\n\n  const walletProviderMap = new Map<\n    string,\n    ReturnType<typeof getWalletProviderByKey>\n  >();\n\n  for (const requirement of filteredRequirements) {\n    const walletProviderKey = formatWalletProviderKey({\n      chain: requirement.chain,\n      displayName: DYNAMIC_WAAS_METADATA.displayName,\n      walletProviderType: WalletProviderEnum.EmbeddedWallet,\n    });\n\n    if (!walletProviderMap.has(walletProviderKey)) {\n      const walletProvider = getWalletProviderByKey(\n        { walletProviderKey },\n        client\n      );\n\n      if (!walletProvider) {\n        throw new NoWalletProviderFoundError({\n          walletProviderKey,\n        });\n      }\n\n      if (!isWaasWalletProvider(walletProvider)) {\n        throw new NotWaasWalletProviderError({\n          walletProviderKey,\n        });\n      }\n\n      walletProviderMap.set(walletProviderKey, walletProvider);\n    }\n  }\n\n  await Promise.all(\n    filteredRequirements.map((requirement) => {\n      const walletProviderKey = formatWalletProviderKey({\n        chain: requirement.chain,\n        displayName: DYNAMIC_WAAS_METADATA.displayName,\n        walletProviderType: WalletProviderEnum.EmbeddedWallet,\n      });\n\n      const walletProvider = walletProviderMap.get(walletProviderKey);\n\n      if (!walletProvider || !isWaasWalletProvider(walletProvider)) {\n        return Promise.resolve();\n      }\n\n      return walletProvider.createWalletAccount({\n        bitcoinConfig: requirement.bitcoinConfig,\n        password,\n        thresholdSignatureScheme,\n      });\n    })\n  );\n\n  await refreshAuth(client);\n};\n","import { getDefaultClient } from '../../../../client/defaultClient';\nimport type { Chain } from '../../../chain';\nimport { refreshAuth } from '../../../user/refreshAuth';\nimport { getWaasWalletProviderByChain } from '../../getWaasWalletProviderByChain';\nimport type { ThresholdSignatureScheme } from '../../waas.types';\n\ntype CreateWalletForBusinessAccountParams = {\n  businessAccountId: string;\n  chain: Chain;\n  password?: string;\n  thresholdSignatureScheme?: ThresholdSignatureScheme;\n};\n\ntype CreateWalletForBusinessAccountResult = {\n  accountAddress: string;\n  publicKeyHex: string;\n  rawPublicKey: string | Uint8Array | undefined;\n};\n\n/**\n * Creates a WaaS wallet account owned directly by a business account, in one\n * step — the server seats the wallet's signer row against the business account\n * as it is minted, so no separate link call is needed.\n *\n * @example\n * ```ts\n * const wallet = await createWalletForBusinessAccount({\n *   businessAccountId: 'ba-1',\n *   chain: 'EVM',\n * });\n * ```\n *\n * @param params.businessAccountId - The business account that will own the wallet.\n * @param params.chain - The chain to create the wallet account for.\n * @param [params.password] - Optional password used to encrypt the user share.\n * @param [params.thresholdSignatureScheme] - The threshold signature scheme to use. (Default: TWO_OF_TWO)\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The created wallet account.\n * @notInstrumented\n */\nexport const createWalletForBusinessAccount = async (\n  {\n    businessAccountId,\n    chain,\n    password,\n    thresholdSignatureScheme,\n  }: CreateWalletForBusinessAccountParams,\n  client = getDefaultClient()\n): Promise<CreateWalletForBusinessAccountResult> => {\n  const provider = getWaasWalletProviderByChain({ chain }, client);\n\n  const wallet = await provider.createWalletAccount({\n    businessAccountId,\n    password,\n    thresholdSignatureScheme,\n  });\n\n  // Re-hydrate local auth so the new wallet's verifiedCredential is present —\n  // mirrors createWaasWalletAccounts. Without it the wallet list goes stale\n  // (wallets vanish until the next refresh).\n  await refreshAuth(client);\n\n  return wallet;\n};\n","import {\n  type DefineBusinessAccountRoleSdkRequest,\n  TokenScope,\n} from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type {\n  BuiltInBusinessAccountMemberRole,\n  BusinessAccountActionRequired,\n  BusinessAccountMutationVersion,\n  SignedBusinessAccountIntent,\n} from '../businessAccounts.types';\nimport { parseGovernedResponse } from '../parseGovernedResponse';\nimport { resendFields } from '../resendFields';\n\ntype DefineRoleParams = {\n  autoExecute?: boolean;\n  businessAccountId: string;\n  inherits: Exclude<BuiltInBusinessAccountMemberRole, 'owner'>;\n  role: string;\n  signed?: SignedBusinessAccountIntent;\n};\n\n/**\n * Defines a custom role that inherits the authority of a built-in one.\n * Inheriting is real: a holder passes every check gated on the base role,\n * under the custom name rather than the base name itself. A role cannot\n * inherit `owner` — use `transferBusinessAccountOwnership` to grant ownership.\n *\n * When the account governs `defineRole`, nothing is written and the 202 body\n * is returned instead. Resend with `signed` (from `signBusinessAccountIntent`)\n * to move past `INTENT_REQUIRED`.\n *\n * @param params.businessAccountId - The business account defining the role.\n * @param params.role - The new role's name.\n * @param params.inherits - The built-in role (`admin` or `viewer`) this role inherits.\n * @param [params.autoExecute] - Whether to apply on the completing approval.\n *   Only meaningful on the first call.\n * @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The new document version, or the outstanding action required.\n *\n * @example\n * ```ts\n * await defineBusinessAccountRole({\n *   businessAccountId,\n *   role: 'cfo',\n *   inherits: 'admin',\n * });\n * ```\n *\n * @see {@link deleteBusinessAccountRole}\n * @see {@link listBusinessAccountRoles}\n * @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.\n * @notInstrumented\n */\nexport const defineBusinessAccountRole = async (\n  { businessAccountId, role, inherits, autoExecute, signed }: DefineRoleParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountActionRequired | BusinessAccountMutationVersion> => {\n  const core = getCore(client);\n  const apiClient = createApiClient(\n    { elevatedAccessTokenScope: TokenScope.BusinessAccountroledefine },\n    client\n  );\n\n  // `Raw` returns the response before the generated 200 mapper runs, which\n  // assumes the version-bump shape and throws on a governed 202's different\n  // shape. Reading the status first is how we tell the two apart.\n  const response = await apiClient.sdkDefineBusinessAccountRoleRaw({\n    businessAccountId,\n    defineBusinessAccountRoleSdkRequest: {\n      inherits: inherits as DefineBusinessAccountRoleSdkRequest['inherits'],\n      role,\n      ...resendFields({ autoExecute, signed }),\n    },\n    environmentId: core.environmentId,\n  });\n\n  if (response.raw.status === 202) {\n    return parseGovernedResponse({\n      fnName: 'defineBusinessAccountRole',\n      response: response.raw,\n    });\n  }\n\n  return (await response.value()) as BusinessAccountMutationVersion;\n};\n","import type { WaasPolicyRule } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { refreshAuth } from '../../user/refreshAuth';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { getWaasWalletProviderFromWalletAccount } from '../getWaasWalletProviderFromWalletAccount';\n\ntype DelegateWaasKeySharesParams = {\n  initialSignerRules?: WaasPolicyRule[];\n  password?: string;\n  walletAccount: WalletAccount;\n};\n\n/**\n * Delegates cryptographic key shares for a WaaS wallet account.\n *\n * This function allows the delegation of key management responsibilities,\n * enabling distributed key management for enhanced security.\n *\n * @param params.walletAccount - The WaaS wallet account to delegate shares for.\n * @param [params.password] - Optional password for key share operations.\n * @param [params.initialSignerRules] - Optional policy rules used to seed the delegated signer's policy layer at delegation time.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves when the key delegation is complete.\n  * @notInstrumented\n */\nexport const delegateWaasKeyShares = async (\n  { initialSignerRules, password, walletAccount }: DelegateWaasKeySharesParams,\n  client = getDefaultClient()\n): Promise<void> => {\n  const provider = getWaasWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  await provider.delegateKeyShares({\n    initialSignerRules,\n    password,\n    walletAccount,\n  });\n\n  await refreshAuth(client);\n};\n","import { TokenScope } from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type {\n  BusinessAccountActionRequired,\n  BusinessAccountMutationVersion,\n  SignedBusinessAccountIntent,\n} from '../businessAccounts.types';\nimport { parseGovernedResponse } from '../parseGovernedResponse';\nimport { resendFields } from '../resendFields';\n\ntype DeleteRoleParams = {\n  autoExecute?: boolean;\n  businessAccountId: string;\n  role: string;\n  signed?: SignedBusinessAccountIntent;\n};\n\n/**\n * Deletes a custom role definition. Holders are not removed and keep every\n * capability they had — they're demoted to the role's inherited base (e.g. a\n * deleted `cfo` role that inherited `admin` leaves its holders reading\n * `admin`), since only the name goes away, not the authority. Refused with\n * `ROLE_REFERENCED_BY_GOVERNANCE` while a governance requirement still names\n * the role — remove it from governance first.\n *\n * When the account governs `deleteRole`, nothing is written and the 202 body\n * is returned instead. Resend with `signed` (from `signBusinessAccountIntent`)\n * to move past `INTENT_REQUIRED`.\n *\n * @param params.businessAccountId - The business account the role belongs to.\n * @param params.role - The role's name.\n * @param [params.autoExecute] - Whether to apply on the completing approval.\n *   Only meaningful on the first call.\n * @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The new document version, or the outstanding action required.\n *\n * @example\n * ```ts\n * await deleteBusinessAccountRole({ businessAccountId, role: 'cfo' });\n * ```\n *\n * @see {@link defineBusinessAccountRole}\n * @see {@link listBusinessAccountRoles}\n * @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.\n * @notInstrumented\n */\nexport const deleteBusinessAccountRole = async (\n  { businessAccountId, role, autoExecute, signed }: DeleteRoleParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountActionRequired | BusinessAccountMutationVersion> => {\n  const core = getCore(client);\n  const apiClient = createApiClient(\n    { elevatedAccessTokenScope: TokenScope.BusinessAccountroledelete },\n    client\n  );\n\n  // `Raw` returns the response before the generated 200 mapper runs, which\n  // assumes the version-bump shape and throws on a governed 202's different\n  // shape. Reading the status first is how we tell the two apart.\n  const response = await apiClient.sdkDeleteBusinessAccountRoleRaw({\n    businessAccountId,\n    deleteBusinessAccountRoleSdkRequest: resendFields({\n      autoExecute,\n      signed,\n    }),\n    environmentId: core.environmentId,\n    role,\n  });\n\n  if (response.raw.status === 202) {\n    return parseGovernedResponse({\n      fnName: 'deleteBusinessAccountRole',\n      response: response.raw,\n    });\n  }\n\n  return (await response.value()) as BusinessAccountMutationVersion;\n};\n","import type { PolicyRules, WaasPolicyRule } from '../policies.types';\nimport {\n  type PolicyRuleKind,\n  RULE_KINDS,\n  RULE_KIND_KEYS,\n} from '../policyRuleKinds';\n\n// buildAllowAddressesRule merges these onto one rule whenever both are set,\n// so expandPolicyRules can never reproduce them as two separate entries —\n// claiming either from a different entry than the other's would silently\n// merge or narrow a rule on the next round trip.\nconst COUPLED_RULE_KINDS: ReadonlySet<PolicyRuleKind> = new Set([\n  'allowAddresses',\n  'maxAmountPerTransaction',\n]);\n\ntype IsBlockedParams = {\n  claimedKinds: ReadonlySet<PolicyRuleKind>;\n  populatedKeys: PolicyRuleKind[];\n};\n\nconst isBlocked = ({ claimedKinds, populatedKeys }: IsBlockedParams): boolean =>\n  populatedKeys.some(\n    (key) =>\n      claimedKinds.has(key) ||\n      (COUPLED_RULE_KINDS.has(key) &&\n        [...COUPLED_RULE_KINDS].some((coupledKey) => claimedKinds.has(coupledKey)))\n  );\n\nexport type FindMatchedRuleKindParams = {\n  claimedKinds: ReadonlySet<PolicyRuleKind>;\n  entry: WaasPolicyRule;\n};\n\nexport type MatchedRuleKind = {\n  kind: PolicyRuleKind;\n  readResult: Partial<PolicyRules>;\n};\n\n/**\n * Finds the first {@link RULE_KINDS} entry that recognizes `entry` as its\n * kind without colliding with an already-claimed key. Must check every key\n * `readRule` would populate, not just this kind's own key — allowAddresses'\n * `readRule` also populates `maxAmountPerTransaction` when the rule carries\n * a merged cap, so accepting it while that key is already claimed would\n * overwrite an earlier standalone cap.\n * @notInstrumented\n */\nexport const findMatchedRuleKind = ({\n  claimedKinds,\n  entry,\n}: FindMatchedRuleKindParams): MatchedRuleKind | undefined => {\n  for (const key of RULE_KIND_KEYS) {\n    const readResult = RULE_KINDS[key].readRule(entry);\n    if (readResult === undefined) continue;\n\n    const populatedKeys = Object.keys(readResult) as PolicyRuleKind[];\n    if (!isBlocked({ claimedKinds, populatedKeys })) {\n      return { kind: key, readResult };\n    }\n  }\n\n  return undefined;\n};\n","import type {\n  PolicyRuleDeletionMarker,\n  WaasPolicyRule,\n} from '../policies.types';\n\n/** The exact key set of a deletion marker — checked as a closed shape, not by presence alone. */\nconst DELETION_MARKER_KEYS: ReadonlySet<string> = new Set([\n  'ruleId',\n  'deletedByType',\n  'deletedById',\n]);\n\n/**\n * Recognizes a policy-Layer deletion marker — the enclave's stand-in for a\n * rule it couldn't drop outright, kept so the removal stays attributable.\n * Matches on the entry's exact key set, not field presence, since the read\n * response types every entry as a live rule.\n *\n * @param entry - The raw policy-Layer rule entry to check.\n * @returns Whether `entry` is a deletion marker rather than a live rule.\n * @notInstrumented\n */\n// eslint-disable-next-line custom-rules/require-single-object-param -- type guard: the predicate narrows this exact parameter, so wrapping it in an object would break call-site narrowing\nexport const isPolicyRuleDeletionMarker = (\n  entry: PolicyRuleDeletionMarker | WaasPolicyRule\n): entry is PolicyRuleDeletionMarker => {\n  const candidate = entry as Partial<PolicyRuleDeletionMarker>;\n\n  return (\n    typeof candidate.ruleId === 'string' &&\n    typeof candidate.deletedByType === 'string' &&\n    typeof candidate.deletedById === 'string' &&\n    Object.keys(entry).every((key) => DELETION_MARKER_KEYS.has(key))\n  );\n};\n","import { findMatchedRuleKind } from '../findMatchedRuleKind';\nimport { isPolicyRuleDeletionMarker } from '../isPolicyRuleDeletionMarker';\nimport type {\n  PolicyRuleDeletionMarker,\n  PolicyRules,\n  WaasPolicyRule,\n} from '../policies.types';\nimport { DEFAULT_POLICY_RULE_NAMES } from '../policyRuleDefaultNames';\nimport type { PolicyRuleKind } from '../policyRuleKinds';\n\ntype DesugarPolicyRulesParams = {\n  entries: (PolicyRuleDeletionMarker | WaasPolicyRule)[];\n};\n\ntype DesugarPolicyRulesResult = {\n  rules: PolicyRules;\n  unmapped: WaasPolicyRule[];\n};\n\n/**\n * Reverses {@link expandPolicyRules} using {@link findMatchedRuleKind}'s\n * same rule-kind table, skipping deletion markers. A kind claims at most\n * one rule; extra matches, out-of-vocabulary fields, and per-rule\n * `modifiableBySigner` grants (no sugar representation) all go to\n * `unmapped` instead of being dropped.\n *\n * @param params.entries - The policy-Layer's rule entries, as returned in `layerContent.rules`.\n * @returns The recognized rules as a {@link PolicyRules} map, plus whatever wasn't recognized.\n * @notInstrumented\n */\nexport const desugarPolicyRules = ({\n  entries,\n}: DesugarPolicyRulesParams): DesugarPolicyRulesResult => {\n  const rules: PolicyRules = {};\n  const unmapped: WaasPolicyRule[] = [];\n  const claimedKinds = new Set<PolicyRuleKind>();\n\n  for (const entry of entries) {\n    if (isPolicyRuleDeletionMarker(entry)) {\n      continue;\n    }\n\n    // No sugar form for a per-rule grant — route to unmapped rather than\n    // silently drop it on a later createPolicy round-trip.\n    if (entry.modifiableBySigner === true) {\n      unmapped.push(entry);\n      continue;\n    }\n\n    const matched = findMatchedRuleKind({ claimedKinds, entry });\n\n    if (matched === undefined) {\n      unmapped.push(entry);\n      continue;\n    }\n\n    const { kind, readResult } = matched;\n\n    Object.assign(rules, readResult);\n\n    for (const key of Object.keys(readResult)) {\n      claimedKinds.add(key as PolicyRuleKind);\n    }\n\n    // readRule ignores `name`, so a custom one must be restored here or\n    // re-expanding renames the rule to the kind's default.\n    if (entry.name !== DEFAULT_POLICY_RULE_NAMES[kind]) {\n      rules.names = { ...rules.names, [kind]: entry.name };\n    }\n  }\n\n  return { rules, unmapped };\n};\n","import { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { UnexpectedConsentResponseError } from '../../../../errors/UnexpectedConsentResponseError';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type {\n  BusinessAccountMutationVersion,\n  BusinessAccountProposalStillPending,\n} from '../businessAccounts.types';\n\ntype ExecuteProposalParams = {\n  businessAccountId: string;\n  proposalId: string;\n};\n\n/**\n * Applies a proposal whose quorum is already met — the counterpart to\n * `autoExecute: false`, where the completing approval records consent but\n * does not itself apply the change. Also the only way to run a ceremony\n * action's change (e.g. `addSignerToWallet`): its reshare needs a live signer\n * to come back and run it, so the server forces `autoExecute` false in the\n * signed bytes regardless of what was requested, and this is what someone\n * holding a share calls afterward.\n *\n * A 202 here is not a failure — it means the collected approvals still don't\n * satisfy the requirement, and the proposal stays `pending`.\n *\n * @param params.businessAccountId - The business account the proposal belongs to.\n * @param params.proposalId - The proposal to execute.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The new document version, or the tally if approvals still fall short.\n *\n * @example\n * ```ts\n * const result = await executeBusinessAccountProposal({ businessAccountId, proposalId });\n * if ('reason' in result) {\n *   console.log(result.approvalRequirements);\n * }\n * ```\n *\n * @see {@link approveBusinessAccountProposal} for the completing approval that usually does this instead.\n * @see {@link BusinessAccountProposalStillPending} for the tally shape when it's still short.\n * @throws {UnexpectedConsentResponseError} When a 202 answers with an unrecognized body.\n * @notInstrumented\n */\nexport const executeBusinessAccountProposal = async (\n  { businessAccountId, proposalId }: ExecuteProposalParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountMutationVersion | BusinessAccountProposalStillPending> => {\n  const apiClient = createApiClient({}, client);\n\n  // `Raw` returns the response before the generated 200 mapper runs, which\n  // assumes the version-bump shape and throws on a 202's different shape.\n  // Reading the status first is how we tell the two apart.\n  const response = await apiClient.sdkExecuteBusinessAccountProposalRaw({\n    businessAccountId,\n    environmentId: getCore(client).environmentId,\n    proposalId,\n  });\n\n  if (response.raw.status === 202) {\n    const payload = (await response.raw.json()) as Partial<BusinessAccountProposalStillPending>;\n    if (payload.reason !== 'APPROVALS_REQUIRED' || !payload.intent) {\n      throw new UnexpectedConsentResponseError({\n        message: 'executeBusinessAccountProposal: unexpected 202 body',\n      });\n    }\n    return {\n      approvalRequirements: payload.approvalRequirements ?? [],\n      intent: payload.intent,\n      proposalId,\n      reason: 'APPROVALS_REQUIRED',\n    };\n  }\n\n  return (await response.value()) as BusinessAccountMutationVersion;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { getWaasWalletProviderFromWalletAccount } from '../getWaasWalletProviderFromWalletAccount';\n\ntype ExportWaasClientKeysharesParams = {\n  password?: string;\n  walletAccount: WalletAccount;\n};\n\n/**\n * Exports the client-side key shares for a WaaS wallet account.\n *\n * This function retrieves the cryptographic key shares that are stored\n * on the client side for backup or migration purposes.\n *\n * @param params.walletAccount - The WaaS wallet account to export shares from.\n * @param [params.password] - Optional password to encrypt the exported shares.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves to the exported key shares.\n * @notInstrumented\n */\nexport const exportWaasClientKeyshares = async (\n  { password, walletAccount }: ExportWaasClientKeysharesParams,\n  client = getDefaultClient()\n): Promise<void> => {\n  const provider = getWaasWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  return provider.exportClientKeyshares({\n    password,\n    walletAccount,\n  });\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { getWaasWalletProviderFromWalletAccount } from '../getWaasWalletProviderFromWalletAccount';\n\ntype ExportWaasPrivateKeyParams = {\n  displayContainer: HTMLElement;\n  password?: string;\n  walletAccount: WalletAccount;\n};\n\n/**\n * Exports the private key for a WaaS wallet account with secure display.\n *\n * This function reveals the private key for a WaaS wallet and displays it\n * securely within an iframe dynamically inserted into the specified HTML container element.\n *\n * @param params.walletAccount - The WaaS wallet account to export the private key from.\n * @param params.displayContainer - The HTML element where the iframe will be injected.\n * @param [params.password] - Optional password to decrypt the private key.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves when the private key export is complete.\n * @notInstrumented\n */\nexport const exportWaasPrivateKey = async (\n  { displayContainer, password, walletAccount }: ExportWaasPrivateKeyParams,\n  client = getDefaultClient()\n): Promise<void> => {\n  const provider = getWaasWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  return provider.exportPrivateKey({\n    displayContainer,\n    password,\n    walletAccount,\n  });\n};\n","import type { WaasPolicyLayerResponse } from '../../waas.types';\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\n\ntype GetAccountPolicyLayerParams = {\n  businessAccountId: string;\n};\n\n/**\n * Fetches a business account's active policy rules (the account-Layer).\n * BA owner/admin only. Calls the SDK API directly (no MPC step), so a\n * rejection surfaces as a thrown error.\n *\n * @param params.businessAccountId - The business account to read policy rules for.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The account-Layer, including its current rules.\n * @notInstrumented\n */\nexport const getAccountPolicyLayer = async (\n  { businessAccountId }: GetAccountPolicyLayerParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<WaasPolicyLayerResponse> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  return apiClient.getBusinessAccountPolicyLayer({\n    businessAccountId,\n    environmentId: core.environmentId,\n  });\n};\n","import { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { BusinessAccountDetail } from '../businessAccounts.types';\n\ntype GetBusinessAccountParams = {\n  businessAccountId: string;\n};\n\n/**\n * Retrieves a business account by ID, including its members, signers, and wallets.\n *\n * @param params.businessAccountId - The ID of the business account to retrieve.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The business account with its members, signers, and wallets.\n * @notInstrumented\n */\nexport const getBusinessAccount = async (\n  { businessAccountId }: GetBusinessAccountParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountDetail> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  const result = await apiClient.sdkGetBusinessAccountById({\n    businessAccountId,\n    environmentId: core.environmentId,\n  });\n\n  return result as unknown as BusinessAccountDetail;\n};\n","import { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { BusinessAccountGovernance } from '../businessAccounts.types';\n\ntype GetGovernanceParams = {\n  businessAccountId: string;\n};\n\n/**\n * Reads the approval requirements currently in force for a business account,\n * keyed by governed action. Empty when the account governs nothing — that's\n * an answer, not a missing resource.\n *\n * There's no other way to tell a governed account from an ungoverned one\n * ahead of time: a mutation only reveals it by answering 202.\n *\n * @param params.businessAccountId - The business account whose governance to read.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The governance section, keyed by governed action.\n *\n * @example\n * ```ts\n * const governance = await getBusinessAccountGovernance({ businessAccountId });\n * const addMemberRules = governance.addMember ?? [];\n * ```\n *\n * @see {@link setBusinessAccountGovernance} for writing it back.\n * @see {@link BusinessAccountGovernance} for the returned shape.\n * @notInstrumented\n */\nexport const getBusinessAccountGovernance = async (\n  { businessAccountId }: GetGovernanceParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountGovernance> => {\n  const apiClient = createApiClient({}, client);\n\n  const { governance } = await apiClient.sdkGetBusinessAccountGovernance({\n    businessAccountId,\n    environmentId: getCore(client).environmentId,\n  });\n\n  return governance;\n};\n","import { WalletProviderEnum } from '@dynamic-labs/sdk-api-core';\n\nimport { getChainFromVerifiedCredentialChain } from '../../../utils/getChainFromVerifiedCredentialChain';\nimport type { Chain } from '../../chain/chain.types';\nimport type { User } from '../../user/user.types';\n\ntype UserHasEmbeddedWalletForChainProps = {\n  chain: Chain;\n  user: User;\n};\n\n/** @notInstrumented */\nexport const userHasEmbeddedWalletForChain = ({\n  user,\n  chain,\n}: UserHasEmbeddedWalletForChainProps): boolean => {\n  const hasEmbeddedWalletForChain = user.verifiedCredentials.some(\n    (vc) =>\n      vc.walletProvider === WalletProviderEnum.EmbeddedWallet &&\n      vc.chain &&\n      getChainFromVerifiedCredentialChain(vc.chain) === chain\n  );\n\n  return hasEmbeddedWalletForChain;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport type { Chain } from '../../chain/chain.types';\nimport { userHasEmbeddedWalletForChain } from '../../wallets/userHasEmbeddedWalletForChain';\nimport { isDynamicWaasEnabled } from '../isDynamicWaasEnabled';\n\n/**\n * Gets all chains missing a waas wallet account for the current user.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns An array of all chains that have waas wallet accounts enabled\n * but for which the current user does not yet have an embedded wallet account.\n  * @notInstrumented\n */\nexport const getChainsMissingWaasWalletAccounts = (\n  client = getDefaultClient()\n): Chain[] => {\n  const projectSettings = client.projectSettings;\n\n  assertDefined(projectSettings, 'Project settings are not available');\n\n  const embeddedWalletSettings = projectSettings.sdk.embeddedWallets;\n\n  const isWaasEnabled = isDynamicWaasEnabled(client);\n\n  const user = client.user;\n\n  if (!user || !isWaasEnabled) {\n    return [];\n  }\n\n  const enabledChainForWaas: Chain[] = (\n    embeddedWalletSettings?.chainConfigurations?.filter(\n      (chain) => chain.enabled\n    ) ?? []\n  ).map((chain) => chain.name as Chain);\n\n  // For each enabled chain, if user does NOT have an embedded wallet, add to missing\n  return enabledChainForWaas.filter(\n    (chain) => !userHasEmbeddedWalletForChain({ chain, user })\n  );\n};\n","import { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { desugarPolicyRules } from '../desugarPolicyRules';\nimport { getResolvedPolicyLayer } from '../getResolvedPolicyLayer';\nimport type { PolicyRules, PolicyScope, WaasPolicyRule } from '../policies.types';\nimport type { WaasChainEnum } from '../../waas.consts';\nimport { resolvePolicyScope } from '../resolvePolicyScope';\nimport { sameChainIds } from '../sameChainIds';\n\ntype GetPolicyParams = {\n  chain: WaasChainEnum;\n  chainIds?: number[];\n  scope: PolicyScope;\n};\n\ntype GetPolicyResult = {\n  layerId: string;\n  rules: PolicyRules;\n  unmapped: WaasPolicyRule[];\n  updatedAt: Date;\n};\n\n/**\n * Fetches a policy layer and reads its `chain`/`chainIds` scope back into\n * the {@link PolicyRules} sugar map (see {@link desugarPolicyRules}). A\n * layer can hold rules for more than one chain, so entries are narrowed to\n * `chain`/`chainIds` first — the same scoping {@link createPolicy} uses —\n * to keep the `getPolicy` → edit → `createPolicy` round-trip safe for\n * multi-chain wallets. Calls the SDK API directly (no MPC step), so a\n * rejection surfaces as a thrown error.\n *\n * @param params.scope - Which policy layer to read — see {@link resolvePolicyScope}.\n * @param params.chain - The chain to read rules for.\n * @param params.chainIds - The chain ids to read rules for; omit to read the wildcard rule matching every chain id of `chain`.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The recognized rules as a {@link PolicyRules} map, whatever wasn't recognized within `chain`/`chainIds`, and the layer's id and last-updated timestamp.\n * @throws Via {@link resolvePolicyScope}'s scope-resolution errors.\n * @notInstrumented\n */\nexport const getPolicy = async (\n  { chain, chainIds, scope }: GetPolicyParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<GetPolicyResult> => {\n  const normalizedChainIds = chainIds ?? [];\n  const resolvedScope = resolvePolicyScope({ scope }, client);\n  const layer = await getResolvedPolicyLayer({ resolvedScope }, client);\n\n  const entriesInScope = (layer.layerContent.rules ?? []).filter(\n    (entry) =>\n      entry.chain === chain &&\n      sameChainIds({ existing: entry.chainIds, requested: normalizedChainIds })\n  );\n\n  const { rules, unmapped } = desugarPolicyRules({ entries: entriesInScope });\n\n  return {\n    layerId: layer.layerId,\n    rules,\n    unmapped,\n    updatedAt: layer.updatedAt,\n  };\n};\n","import type { WaasPolicyLayerResponse } from '../../waas.types';\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { assertDefined } from '../../../../utils/assertDefined';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { WalletAccount } from '../../../wallets/walletAccount';\n\ntype GetSignerPolicyLayerParams = {\n  /** Targets a share set other than the caller's own. Omit to read the caller's own active share set. */\n  shareSetId?: string;\n  walletAccount: WalletAccount;\n};\n\n/**\n * Fetches a signer's active policy rules (the signer-Layer) — the caller's\n * own active share set by default, or another share set on the same wallet\n * (e.g. a delegated share set) when `shareSetId` is given. Calls the SDK API\n * directly (no MPC step), so a rejection surfaces as a thrown error.\n *\n * @param params.walletAccount - The wallet account whose signer-Layer to read.\n * @param [params.shareSetId] - The share set to target; defaults to the caller's own.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The signer-Layer, including its current rules.\n * @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).\n * @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.\n * @notInstrumented\n */\nexport const getSignerPolicyLayer = async (\n  { shareSetId, walletAccount }: GetSignerPolicyLayerParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<WaasPolicyLayerResponse> => {\n  assertDefined(\n    walletAccount.verifiedCredentialId,\n    'getSignerPolicyLayer: cannot resolve a wallet id — use a verified wallet account'\n  );\n\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  return apiClient.getWaasSignerSelfPolicyLayer({\n    environmentId: core.environmentId,\n    shareSetId,\n    walletId: walletAccount.verifiedCredentialId,\n  });\n};\n","import type { WaasWalletShareSetType } from '../waas.consts';\nimport type { WaasShareSet, WaasWalletAccount } from '../waas.types';\n\ntype GetWalletAccountShareSetsParams = {\n  walletAccount: WaasWalletAccount;\n};\n\nexport type WalletAccountOwnShareSet = {\n  shareSetId: string;\n  shareSetType?: WaasWalletShareSetType;\n};\n\nexport type WalletAccountShareSets = {\n  /** Other active share sets on the same wallet (e.g. a delegated share set); empty when there are none. */\n  others: WaasShareSet[];\n  /** This wallet account's own share set — the one this auth principal signs with. Undefined when the account carries no share set data. */\n  own?: WalletAccountOwnShareSet;\n};\n\n/**\n * No network request. Share set ids rotate on refresh/reshare (stale ids are\n * rejected server-side), so re-read rather than cache; non-WaaS accounts\n * return `{ own: undefined, others: [] }` instead of throwing.\n *\n * @param params.walletAccount - The WaaS wallet account whose share sets to read.\n * @returns The account's own share set (if any) and the wallet's other active share sets.\n * @notInstrumented\n */\nexport const getWalletAccountShareSets = ({\n  walletAccount,\n}: GetWalletAccountShareSetsParams): WalletAccountShareSets => {\n  const own: WalletAccountOwnShareSet | undefined = walletAccount.shareSetId\n    ? {\n        shareSetId: walletAccount.shareSetId,\n        shareSetType: walletAccount.shareSetType,\n      }\n    : undefined;\n\n  return {\n    others: walletAccount.otherShareSets ?? [],\n    own,\n  };\n};\n","import type { WaasPolicyLayerResponse } from '../../waas.types';\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { assertDefined } from '../../../../utils/assertDefined';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { WalletAccount } from '../../../wallets/walletAccount';\n\ntype GetWalletPolicyLayerParams = {\n  walletAccount: WalletAccount;\n};\n\n/**\n * Fetches a wallet's active policy rules (the wallet-Layer). Calls the SDK\n * API directly (no MPC step), so a rejection surfaces as a thrown error.\n *\n * @param params.walletAccount - The wallet account to read policy rules for.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The wallet-Layer, including its current rules.\n * @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).\n * @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.\n * @notInstrumented\n */\nexport const getWalletPolicyLayer = async (\n  { walletAccount }: GetWalletPolicyLayerParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<WaasPolicyLayerResponse> => {\n  assertDefined(\n    walletAccount.verifiedCredentialId,\n    'getWalletPolicyLayer: cannot resolve a wallet id — use a verified wallet account'\n  );\n\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  return apiClient.getWaasWalletSelfPolicyLayer({\n    environmentId: core.environmentId,\n    walletId: walletAccount.verifiedCredentialId,\n  });\n};\n","import type { WalletRecoveryState } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport type { DynamicClient } from '../../../client/types/DynamicClient';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { getWaasWalletProviderFromWalletAccount } from '../getWaasWalletProviderFromWalletAccount';\n\ntype GetWalletRecoveryStateParams = {\n  walletAccount: WalletAccount;\n};\n\n/**\n * Retrieves the recovery state of a WaaS wallet account.\n *\n * @param params.walletAccount - The WaaS wallet account to get the recovery state for.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves with the wallet recovery state.\n  * @notInstrumented\n */\nexport const getWalletRecoveryState = async (\n  { walletAccount }: GetWalletRecoveryStateParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<WalletRecoveryState> => {\n  const provider = getWaasWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  return provider.getWalletRecoveryState({\n    walletAccount,\n  });\n};\n","import { WaasWalletShareSetType } from '@dynamic-labs/sdk-api-core';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport { getVerifiedCredentialForWalletAccount } from '../../wallets/utils/getVerifiedCredentialForWalletAccount';\nimport type { WalletAccount } from '../../wallets/walletAccount';\n\ntype HasDelegatedAccessParams = {\n  walletAccount: WalletAccount;\n};\n\n/**\n * Checks if a WaaS wallet account has delegated access.\n *\n * @param params.walletAccount - The WaaS wallet account to check for delegated access.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if the wallet account has delegated access, false otherwise.\n  * @notInstrumented\n */\nexport const hasDelegatedAccess = (\n  { walletAccount }: HasDelegatedAccessParams,\n  client = getDefaultClient()\n): boolean => {\n  const verifiedCredential = getVerifiedCredentialForWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  assertDefined(\n    verifiedCredential,\n    'Verified credential not found for Waas wallet account'\n  );\n\n  const hasDelegatedKeyShare =\n    verifiedCredential.walletProperties?.keyShares?.some(\n      (keyShare) => keyShare.backupLocation === 'delegated'\n    );\n\n  const hasDelegatedShareSet =\n    verifiedCredential.walletProperties?.otherShareSets?.some(\n      (shareSet) => shareSet.shareSetType === WaasWalletShareSetType.Delegated\n    );\n\n  return Boolean(hasDelegatedKeyShare || hasDelegatedShareSet);\n};\n","import type { ThresholdSignatureScheme } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport type { Chain } from '../../chain';\nimport { getWaasWalletProviderByChain } from '../getWaasWalletProviderByChain';\n\ntype ImportWaasPrivateKeyParams = {\n  chain: Chain;\n  privateKey: string;\n  thresholdSignatureScheme?: ThresholdSignatureScheme;\n};\n\n/**\n * Imports an existing private key to create a new WaaS wallet account.\n *\n * This function allows users to import their existing private key into\n * Dynamic's WaaS infrastructure for secure management.\n *\n * @param params.chain - The chain for the imported wallet.\n * @param params.privateKey - The private key to import.\n * @param [params.thresholdSignatureScheme] - Optional threshold signature scheme configuration. Default is TWO_OF_TWO.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves when the private key is successfully imported.\n * @notInstrumented\n */\nexport const importWaasPrivateKey = async (\n  { chain, privateKey, thresholdSignatureScheme }: ImportWaasPrivateKeyParams,\n  client = getDefaultClient()\n): Promise<void> => {\n  const provider = getWaasWalletProviderByChain({ chain }, client);\n\n  return provider.importPrivateKey({\n    privateKey,\n    thresholdSignatureScheme,\n  });\n};\n","import type {\n  BusinessAccountActionRequired,\n} from '../businessAccounts.types';\n\n/**\n * Narrows a governed mutation's result to the not-yet-authorized case.\n *\n * A governed action answers 202 with the bytes to sign, or with the proposal\n * collecting approvals — neither is an error, so both come back as a value. Use\n * this to tell them apart from the applied result.\n *\n * @param result - What a governed business-account mutation returned.\n * @returns True when the action still needs a signature or approvals.\n *\n * @example\n * ```ts\n * const result = await addWalletToBusinessAccount({ walletId });\n * if (isBusinessAccountActionRequired(result)) {\n *   await signIntent(result.intent);\n *   return;\n * }\n * console.log(result.members.length);\n * ```\n *\n * @see {@link BusinessAccountActionRequired} for the shape this narrows to.\n * @see {@link addWalletToBusinessAccount} for a governed mutation that can return it.\n * @notInstrumented\n */\nexport const isBusinessAccountActionRequired = <T extends object>(\n  result: BusinessAccountActionRequired | T\n): result is BusinessAccountActionRequired =>\n  'reason' in result &&\n  (result.reason === 'INTENT_REQUIRED' ||\n    result.reason === 'APPROVALS_REQUIRED');\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\n\n/**\n * Checks if the user Waas wallets are password protected.\n *\n * If the user's Waas wallets are password protected, it means that user's will have to be prompted for a\n * password for the first wallet action that happens on each session.\n * The password is also required for creating any new Waas wallets.\n *\n * @param client - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if the user has any password protected Waas wallets, false otherwise\n  * @notInstrumented\n */\nexport const isPasswordRequiredForWaasWallets = (\n  client = getDefaultClient()\n): boolean => {\n  const { user } = client;\n\n  assertDefined(user, 'User is not authenticated');\n\n  return user.verifiedCredentials.some((credential) =>\n    credential.walletProperties?.keyShares?.some(\n      (keyShare) => keyShare.passwordEncrypted\n    )\n  );\n};\n","import { BusinessAccountProposalStatus } from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { BusinessAccountProposal } from '../businessAccounts.types';\n\ntype ListProposalsParams = {\n  businessAccountId: string;\n  status?: 'pending';\n};\n\n/**\n * Lists a business account's governed-mutation proposals.\n *\n * @param params.businessAccountId - The business account whose proposals to list.\n * @param [params.status] - Filter to `pending` only; omit for every status.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The matching proposals.\n *\n * @example\n * ```ts\n * const pending = await listBusinessAccountProposals({ businessAccountId, status: 'pending' });\n * ```\n *\n * @see {@link approveBusinessAccountProposal}\n * @see {@link listBusinessAccountProposalsAwaitingMyApproval} for proposals across every account this caller belongs to.\n * @notInstrumented\n */\nexport const listBusinessAccountProposals = async (\n  { businessAccountId, status }: ListProposalsParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountProposal[]> => {\n  const apiClient = createApiClient({}, client);\n\n  const proposals = await apiClient.sdkListBusinessAccountProposals({\n    businessAccountId,\n    environmentId: getCore(client).environmentId,\n    status: status ? BusinessAccountProposalStatus.Pending : undefined,\n  });\n\n  // The generated model dates every timestamp field as `Date`; this SDK's\n  // public type keeps them as the raw ISO strings the wire actually carries.\n  return proposals as unknown as BusinessAccountProposal[];\n};\n","import { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { BusinessAccountProposal } from '../businessAccounts.types';\n\n/**\n * Every pending proposal awaiting this caller's approval, across every\n * business account they belong to. Not scoped to one account — the server\n * derives the scope from the caller's own memberships.\n *\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The proposals awaiting this caller's approval.\n *\n * @example\n * ```ts\n * const awaitingMe = await listBusinessAccountProposalsAwaitingMyApproval();\n * ```\n *\n * @see {@link approveBusinessAccountProposal}\n * @see {@link listBusinessAccountProposals} for one account's proposals instead.\n * @notInstrumented\n */\nexport const listBusinessAccountProposalsAwaitingMyApproval = async (\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountProposal[]> => {\n  const apiClient = createApiClient({}, client);\n\n  const proposals =\n    await apiClient.sdkListBusinessAccountProposalsAwaitingApproval({\n      environmentId: getCore(client).environmentId,\n    });\n\n  // The generated model dates every timestamp field as `Date`; this SDK's\n  // public type keeps them as the raw ISO strings the wire actually carries.\n  return proposals as unknown as BusinessAccountProposal[];\n};\n","import { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { BusinessAccountRoleDefinitions } from '../businessAccounts.types';\n\ntype ListRolesParams = {\n  businessAccountId: string;\n};\n\n/**\n * Lists the custom roles a business account has defined. Empty when none\n * are — that's an answer, not a missing resource.\n *\n * @param params.businessAccountId - The business account whose roles to list.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The account's custom roles, keyed by role name.\n *\n * @example\n * ```ts\n * const roles = await listBusinessAccountRoles({ businessAccountId });\n * console.log(roles.cfo?.inherits); // 'admin'\n * ```\n *\n * @see {@link defineBusinessAccountRole}\n * @see {@link deleteBusinessAccountRole}\n * @notInstrumented\n */\nexport const listBusinessAccountRoles = async (\n  { businessAccountId }: ListRolesParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountRoleDefinitions> => {\n  const apiClient = createApiClient({}, client);\n\n  const { roles } = await apiClient.sdkListBusinessAccountRoles({\n    businessAccountId,\n    environmentId: getCore(client).environmentId,\n  });\n\n  // The generated model types `inherits` as its own enum; this SDK's public\n  // type keeps it as the plain role-name union everywhere else already uses.\n  return roles as unknown as BusinessAccountRoleDefinitions;\n};\n","import { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { BusinessAccountList } from '../businessAccounts.types';\n\ntype ListBusinessAccountsParams = {\n  /**\n   * Filter to business accounts whose `externalRef` is one of these values.\n   * externalRef is not unique, so each value may match multiple accounts —\n   * the result is always the full array of matches (the caller is a member of).\n   */\n  externalRefs?: string[];\n};\n\n/**\n * Lists the business accounts the current user is a member of, scoped to the\n * active project environment. Optionally filter by `externalRefs`.\n *\n * @param [params] - Optional filters.\n * @param [params.externalRefs] - Return only accounts whose externalRef is in this list.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A paginated list of business accounts.\n * @notInstrumented\n */\nexport const listBusinessAccounts = async (\n  params?: ListBusinessAccountsParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountList> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  const result = await apiClient.sdkListBusinessAccounts({\n    environmentId: core.environmentId,\n    externalRef: params?.externalRefs,\n  });\n\n  return result as unknown as BusinessAccountList;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { getWaasWalletProviderFromWalletAccount } from '../getWaasWalletProviderFromWalletAccount';\n\ntype RefreshWaasWalletAccountSharesParams = {\n  password?: string;\n  walletAccount: WalletAccount;\n};\n\n/**\n * Refreshes the cryptographic key shares for a WaaS wallet account.\n *\n * This function generates new key shares for the wallet while maintaining\n * the same threshold signature scheme.\n *\n * @param params.walletAccount - The WaaS wallet account to refresh shares for.\n * @param [params.password] - Optional password for key share operations.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves when the key shares are refreshed.\n * @notInstrumented\n */\nexport const refreshWaasWalletAccountShares = async (\n  { walletAccount, password }: RefreshWaasWalletAccountSharesParams,\n  client = getDefaultClient()\n): Promise<void> => {\n  const provider = getWaasWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  return provider.refreshWalletAccountShares({\n    password,\n    walletAccount,\n  });\n};\n","import { WaasPolicyLayerUpdateRequestOpEnum } from '@dynamic-labs/sdk-api-core';\n\nimport type { WaasPolicyLayerResponse } from '../../waas.types';\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\n\ntype RemoveAccountPolicyRuleParams = {\n  businessAccountId: string;\n  ruleId: string;\n};\n\n/**\n * Removes a single rule from a business account's account-Layer. BA\n * owner/admin only. Calls the SDK API directly (no MPC step), so a\n * rejection surfaces as a thrown error.\n *\n * @param params.businessAccountId - The business account to remove the rule from.\n * @param params.ruleId - The id of the rule to remove.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The account-Layer as it stands after the rule is removed.\n * @notInstrumented\n */\nexport const removeAccountPolicyRule = async (\n  { businessAccountId, ruleId }: RemoveAccountPolicyRuleParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<WaasPolicyLayerResponse> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  return apiClient.updateBusinessAccountPolicyLayer({\n    businessAccountId,\n    environmentId: core.environmentId,\n    waasPolicyLayerUpdateRequest: {\n      op: WaasPolicyLayerUpdateRequestOpEnum.Remove,\n      ruleId,\n    },\n  });\n};\n","import { TokenScope } from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type {\n  BusinessAccountActionRequired,\n  BusinessAccountMember,\n  SignedBusinessAccountIntent,\n} from '../businessAccounts.types';\nimport { parseGovernedResponse } from '../parseGovernedResponse';\nimport { resendFields } from '../resendFields';\n\ntype RemoveMemberParams = {\n  autoExecute?: boolean;\n  businessAccountId: string;\n  signed?: SignedBusinessAccountIntent;\n  userId: string;\n};\n\n/**\n * Removes a member from a business account. Any signer rows the member held on\n * the account's wallets are torn down as part of the removal. The backend\n * refuses to remove the account's last owner.\n *\n * When the account governs `removeMember`, nothing is written and the 202\n * body is returned instead. Resend with `signed` (from\n * `signBusinessAccountIntent`) to move past `INTENT_REQUIRED`.\n *\n * @param params.businessAccountId - The business account to remove the member from.\n * @param params.userId - The id of the user to remove.\n * @param [params.autoExecute] - Whether to apply on the completing approval.\n *   Only meaningful on the first call.\n * @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The removed member, or the outstanding action required.\n *\n * @example\n * ```ts\n * const detail = await getBusinessAccount({ businessAccountId });\n * const member = detail.members[0];\n * await removeBusinessAccountMember({\n *   businessAccountId,\n *   userId: member.userId,\n * });\n * ```\n *\n * @see addBusinessAccountMember\n * @see getBusinessAccount\n * @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.\n * @notInstrumented\n */\nexport const removeBusinessAccountMember = async (\n  { businessAccountId, userId, autoExecute, signed }: RemoveMemberParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountActionRequired | BusinessAccountMember> => {\n  const core = getCore(client);\n  const apiClient = createApiClient(\n    { elevatedAccessTokenScope: TokenScope.BusinessAccountmemberremove },\n    client\n  );\n\n  // `Raw` returns the response before the generated 200 mapper runs, which\n  // assumes a member exists and throws on a governed 202's different shape.\n  // Reading the status first is how we tell the two apart.\n  const response = await apiClient.sdkRemoveBusinessAccountMemberRaw({\n    businessAccountId,\n    environmentId: core.environmentId,\n    removeBusinessAccountMemberSdkRequest: resendFields({\n      autoExecute,\n      signed,\n    }),\n    userId,\n  });\n\n  if (response.raw.status === 202) {\n    return parseGovernedResponse({\n      fnName: 'removeBusinessAccountMember',\n      response: response.raw,\n    });\n  }\n\n  const { member } = await response.value();\n  return member as BusinessAccountMember;\n};\n","import { TokenScope } from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type {\n  BusinessAccountActionRequired,\n  BusinessAccountSigner,\n  SignedBusinessAccountIntent,\n} from '../businessAccounts.types';\nimport { parseGovernedResponse } from '../parseGovernedResponse';\nimport { resendFields } from '../resendFields';\n\ntype RemoveSignerParams = {\n  autoExecute?: boolean;\n  businessAccountId: string;\n  signed?: SignedBusinessAccountIntent;\n  signerId: string;\n  walletId: string;\n};\n\n/**\n * Removes a signer from a business-account wallet. This detaches the signer's\n * share set from the wallet — it does not run an MPC ceremony — so the removed\n * identity can no longer sign for that wallet. The backend refuses to remove\n * the last remaining signer on a wallet.\n *\n * When the account governs `removeSignerFromWallet`, nothing is written and\n * the 202 body is returned instead. Resend with `signed` (from\n * `signBusinessAccountIntent`) to move past `INTENT_REQUIRED`.\n *\n * @param params.businessAccountId - The business account the wallet belongs to.\n * @param params.walletId - The wallet the signer is attached to.\n * @param params.signerId - The id of the signer to remove (`BusinessAccountSigner.id`).\n * @param [params.autoExecute] - Whether to apply on the completing approval.\n *   Only meaningful on the first call.\n * @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The removed signer, or the outstanding action required.\n *\n * @example\n * ```ts\n * const detail = await getBusinessAccount({ businessAccountId });\n * const signer = detail.signers[0];\n * await removeBusinessAccountSigner({\n *   businessAccountId,\n *   walletId: signer.walletId,\n *   signerId: signer.id,\n * });\n * ```\n *\n * @see addBusinessAccountSigner\n * @see getBusinessAccount\n * @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.\n * @notInstrumented\n */\nexport const removeBusinessAccountSigner = async (\n  { businessAccountId, walletId, signerId, autoExecute, signed }: RemoveSignerParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountActionRequired | BusinessAccountSigner> => {\n  const core = getCore(client);\n  const apiClient = createApiClient(\n    { elevatedAccessTokenScope: TokenScope.BusinessAccountsignerremove },\n    client\n  );\n\n  // `Raw` returns the response before the generated 200 mapper runs, which\n  // assumes a signer exists and throws on a governed 202's different shape.\n  // Reading the status first is how we tell the two apart.\n  const response = await apiClient.sdkRemoveBusinessAccountSignerRaw({\n    businessAccountId,\n    environmentId: core.environmentId,\n    removeBusinessAccountSignerSdkRequest: resendFields({\n      autoExecute,\n      signed,\n    }),\n    signerId,\n    walletId,\n  });\n\n  if (response.raw.status === 202) {\n    return parseGovernedResponse({\n      fnName: 'removeBusinessAccountSigner',\n      response: response.raw,\n    });\n  }\n\n  const { signer } = await response.value();\n  return signer as BusinessAccountSigner;\n};\n","import { TokenScope } from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport { refreshAuth } from '../../../user/refreshAuth';\nimport type {\n  BusinessAccountActionRequired,\n  BusinessAccountDetail,\n  SignedBusinessAccountIntent,\n} from '../businessAccounts.types';\nimport { parseGovernedResponse } from '../parseGovernedResponse';\nimport { resendFields } from '../resendFields';\n\ntype RemoveBusinessAccountWalletParams = {\n  autoExecute?: boolean;\n  businessAccountId: string;\n  signed?: SignedBusinessAccountIntent;\n  walletId: string;\n};\n\n/**\n * Removes a wallet from a business account (owner-/admin-only). The wallet and\n * all its associated signer rows are detached from the account.\n *\n * When the account governs `removeWallet`, nothing is written and the 202\n * body is returned instead. Resend with `signed` (from\n * `signBusinessAccountIntent`) to move past `INTENT_REQUIRED`.\n *\n * @param params.businessAccountId - The business account the wallet belongs to.\n * @param params.walletId - The wallet to remove (`BusinessAccountWallet.id`).\n * @param [params.autoExecute] - Whether to apply on the completing approval.\n *   Only meaningful on the first call.\n * @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The updated business account detail, or the outstanding action required.\n *\n * @example\n * ```ts\n * const detail = await getBusinessAccount({ businessAccountId });\n * await removeBusinessAccountWallet({\n *   businessAccountId,\n *   walletId: detail.wallets[0].id,\n * });\n * ```\n *\n * @see addWalletToBusinessAccount\n * @see getBusinessAccount\n * @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.\n * @notInstrumented\n */\nexport const removeBusinessAccountWallet = async (\n  { businessAccountId, walletId, autoExecute, signed }: RemoveBusinessAccountWalletParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountActionRequired | BusinessAccountDetail> => {\n  const core = getCore(client);\n  const apiClient = createApiClient(\n    { elevatedAccessTokenScope: TokenScope.BusinessAccountwalletremove },\n    client\n  );\n\n  // `Raw` returns the response before the generated 200 mapper runs, which\n  // assumes the detail's required arrays exist and throws on a governed\n  // 202's different shape. Reading the status first is how we tell the two\n  // apart.\n  const response = await apiClient.sdkRemoveBusinessAccountWalletRaw({\n    businessAccountId,\n    environmentId: core.environmentId,\n    removeBusinessAccountWalletSdkRequest: resendFields({\n      autoExecute,\n      signed,\n    }),\n    walletId,\n  });\n\n  if (response.raw.status === 202) {\n    return parseGovernedResponse({\n      fnName: 'removeBusinessAccountWallet',\n      response: response.raw,\n    });\n  }\n\n  const detail = await response.value();\n\n  // Removing a wallet detaches its businessAccount binding on the\n  // verifiedCredential; refresh local auth so the change is reflected.\n  await refreshAuth(client);\n\n  return detail as BusinessAccountDetail;\n};\n","import {\n  type WaasPolicyLayerRuleOperation,\n  WaasPolicyLayerRuleOperationOpEnum,\n} from '@dynamic-labs/sdk-api-core';\n\nimport { expandPolicyRules } from '../expandPolicyRules';\nimport type { PolicyRules, WaasPolicyRule } from '../policies.types';\nimport type { WaasChainEnum } from '../../waas.consts';\nimport { readCoveredRule } from '../readCoveredRule';\n\ntype BuildOperationForExistingRuleParams = {\n  chain: WaasChainEnum;\n  chainIds: number[];\n  existingRule: WaasPolicyRule;\n  rules: (keyof PolicyRules)[];\n};\n\n/**\n * Builds the operation to remove or rebuild `existingRule` when the\n * caller's requested keys touch it — outright removal when every key it\n * covers is being removed, or an upsert of the rule rebuilt from its\n * remaining keys when only some are. Returns undefined when none of the\n * requested keys touch this rule, when it's outside the sugar vocabulary,\n * or when it can't be identified without a `ruleId`.\n *\n * @param params.chain - The chain the rule to remove/rebuild applies to.\n * @param params.chainIds - The chain ids the rule to remove/rebuild applies to.\n * @param params.existingRule - The existing layer rule to check.\n * @param params.rules - The sugar keys to remove.\n * @returns The operation for this rule, or undefined when it isn't touched.\n * @notInstrumented\n */\nexport const buildOperationForExistingRule = ({\n  chain,\n  chainIds,\n  existingRule,\n  rules,\n}: BuildOperationForExistingRuleParams): WaasPolicyLayerRuleOperation | undefined => {\n  // Can't identify the rule to remove/rebuild without an id.\n  if (existingRule.ruleId === undefined) {\n    return undefined;\n  }\n\n  const covered = readCoveredRule(existingRule);\n  if (covered === undefined) {\n    return undefined;\n  }\n\n  const remainingKeys = covered.keys.filter((key) => !rules.includes(key));\n  if (remainingKeys.length === covered.keys.length) {\n    return undefined;\n  }\n\n  if (remainingKeys.length === 0) {\n    return {\n      op: WaasPolicyLayerRuleOperationOpEnum.Remove,\n      ruleId: existingRule.ruleId,\n    };\n  }\n\n  const remainingRules: PolicyRules = {};\n  for (const key of remainingKeys) {\n    Object.assign(remainingRules, { [key]: covered.values[key] });\n  }\n\n  const [rebuiltRule] = expandPolicyRules({ chain, chainIds, rules: remainingRules });\n  if (rebuiltRule === undefined) {\n    return undefined;\n  }\n\n  // Keeps the existing label only if the surviving rule is still the same name-owning kind.\n  const rebuiltKind = readCoveredRule(rebuiltRule)?.kind;\n  const keepsName = rebuiltKind === covered.kind;\n\n  return {\n    op: WaasPolicyLayerRuleOperationOpEnum.Upsert,\n    rule: {\n      ...rebuiltRule,\n      name: keepsName ? (existingRule.name ?? rebuiltRule.name) : rebuiltRule.name,\n      ruleId: existingRule.ruleId,\n    },\n  };\n};\n","import type { WaasPolicyLayerResponse } from '../../waas.types';\nimport type { WaasChainEnum } from '../../waas.consts';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { InvalidParamError } from '../../../../errors/InvalidParamError';\nimport { applyPolicyLayerBatch } from '../applyPolicyLayerBatch';\nimport { buildOperationForExistingRule } from '../buildOperationForExistingRule';\nimport { getResolvedPolicyLayer } from '../getResolvedPolicyLayer';\nimport type { PolicyRules, PolicyScope } from '../policies.types';\nimport { resolvePolicyScope } from '../resolvePolicyScope';\nimport { sameChainIds } from '../sameChainIds';\n\ntype RemovePolicyRulesParams = {\n  chain: WaasChainEnum;\n  chainIds?: number[];\n  rules: (keyof PolicyRules)[];\n  scope: PolicyScope;\n};\n\n/**\n * Removes the rules behind one or more {@link PolicyRules} keys from a\n * policy layer, in one atomic `batch` PATCH. For every existing rule the\n * given keys touch, either removes it outright or — when it also covers a\n * key the caller didn't ask to remove (e.g. an\n * `allowAddresses`+`maxAmountPerTransaction` rule with only the cap\n * removed) — rebuilds it from the remaining keys so that restriction\n * survives.\n *\n * @param params.scope - Which policy layer to update — see {@link resolvePolicyScope}.\n * @param params.chain - The chain the rules to remove apply to.\n * @param params.chainIds - The chain ids the rules to remove apply to; omit to target the wildcard rule that matches every chain id of `chain`.\n * @param params.rules - The sugar keys to remove.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The policy layer as it stands after the batch is applied.\n * @throws When none of the given keys match an existing rule for this chain scope, or via {@link resolvePolicyScope}'s scope-resolution errors.\n * @notInstrumented\n */\nexport const removePolicyRules = async (\n  { chain, chainIds, rules, scope }: RemovePolicyRulesParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<WaasPolicyLayerResponse> => {\n  const normalizedChainIds = chainIds ?? [];\n  const resolvedScope = resolvePolicyScope({ scope }, client);\n  const layer = await getResolvedPolicyLayer({ resolvedScope }, client);\n\n  const existingRulesInScope = (layer.layerContent.rules ?? []).filter(\n    (existingRule) =>\n      existingRule.chain === chain &&\n      sameChainIds({\n        existing: existingRule.chainIds,\n        requested: normalizedChainIds,\n      })\n  );\n\n  // Handles every matching rule, not just the first, so a duplicate from\n  // legacy data or {@link createPolicy}'s concurrent-write race doesn't\n  // survive removal.\n  const operations = existingRulesInScope\n    .map((existingRule) =>\n      buildOperationForExistingRule({\n        chain,\n        chainIds: normalizedChainIds,\n        existingRule,\n        rules,\n      })\n    )\n    .filter((operation) => operation !== undefined);\n\n  if (operations.length === 0) {\n    throw new InvalidParamError(\n      'removePolicyRules: none of the given rule keys matched an existing rule for this scope'\n    );\n  }\n\n  return applyPolicyLayerBatch({ operations, resolvedScope }, client);\n};\n","import { WaasSignerPolicyLayerUpdateRequestOpEnum } from '@dynamic-labs/sdk-api-core';\n\nimport type { WaasPolicyLayerResponse } from '../../waas.types';\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { assertDefined } from '../../../../utils/assertDefined';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { WalletAccount } from '../../../wallets/walletAccount';\n\ntype RemoveSignerPolicyRuleParams = {\n  ruleId: string;\n  /** Omit to target the caller's own active share set. */\n  shareSetId?: string;\n  walletAccount: WalletAccount;\n};\n\n/**\n * Removes a single rule from a signer's policy layer. Calls the SDK API\n * directly (no MPC step), so a rejection surfaces as a thrown error.\n *\n * @param params.walletAccount - The wallet account whose signer-Layer to update.\n * @param params.ruleId - The id of the rule to remove.\n * @param [params.shareSetId] - The share set to target; defaults to the caller's own. Only the wallet's own owner may target another share set.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The signer-Layer as it stands after the rule is removed.\n * @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).\n * @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.\n * @notInstrumented\n */\nexport const removeSignerPolicyRule = async (\n  { ruleId, shareSetId, walletAccount }: RemoveSignerPolicyRuleParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<WaasPolicyLayerResponse> => {\n  assertDefined(\n    walletAccount.verifiedCredentialId,\n    'removeSignerPolicyRule: cannot resolve a wallet id — use a verified wallet account'\n  );\n\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  return apiClient.updateWaasSignerSelfPolicyLayer({\n    environmentId: core.environmentId,\n    waasSignerPolicyLayerUpdateRequest: {\n      op: WaasSignerPolicyLayerUpdateRequestOpEnum.Remove,\n      ruleId,\n      shareSetId,\n    },\n    walletId: walletAccount.verifiedCredentialId,\n  });\n};\n","import { WaasPolicyLayerUpdateRequestOpEnum } from '@dynamic-labs/sdk-api-core';\n\nimport type { WaasPolicyLayerResponse } from '../../waas.types';\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { assertDefined } from '../../../../utils/assertDefined';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { WalletAccount } from '../../../wallets/walletAccount';\n\ntype RemoveWalletPolicyRuleParams = {\n  ruleId: string;\n  walletAccount: WalletAccount;\n};\n\n/**\n * Removes a single rule from a wallet's policy layer. Calls the SDK API\n * directly (no MPC step), so a rejection surfaces as a thrown error.\n *\n * @param params.walletAccount - The wallet account to remove the rule from.\n * @param params.ruleId - The id of the rule to remove.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The wallet-Layer as it stands after the rule is removed.\n * @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).\n * @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.\n * @notInstrumented\n */\nexport const removeWalletPolicyRule = async (\n  { ruleId, walletAccount }: RemoveWalletPolicyRuleParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<WaasPolicyLayerResponse> => {\n  assertDefined(\n    walletAccount.verifiedCredentialId,\n    'removeWalletPolicyRule: cannot resolve a wallet id — use a verified wallet account'\n  );\n\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  return apiClient.updateWaasWalletSelfPolicyLayer({\n    environmentId: core.environmentId,\n    waasPolicyLayerUpdateRequest: {\n      op: WaasPolicyLayerUpdateRequestOpEnum.Remove,\n      ruleId,\n    },\n    walletId: walletAccount.verifiedCredentialId,\n  });\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport { refreshAuth } from '../../user/refreshAuth';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { getWaasWalletProviderFromWalletAccount } from '../getWaasWalletProviderFromWalletAccount';\n\ntype RevokeWaasDelegationParams = {\n  password?: string;\n  walletAccount: WalletAccount;\n};\n\n/**\n * Revokes the delegation of a WaaS wallet account.\n *\n * @param params.walletAccount - The WaaS wallet account to revoke delegation for.\n * @param [params.password] - Optional password for delegation operations.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves when the delegation is revoked.\n  * @notInstrumented\n */\nexport const revokeWaasDelegation = async (\n  { password, walletAccount }: RevokeWaasDelegationParams,\n  client = getDefaultClient()\n): Promise<void> => {\n  const provider = getWaasWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  await provider.revokeDelegation({\n    password,\n    walletAccount,\n  });\n\n  await refreshAuth(client);\n};\n","import {\n  type SetBusinessAccountGovernanceSdkRequest,\n  TokenScope,\n} from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type {\n  BusinessAccountActionRequired,\n  BusinessAccountGovernance,\n  BusinessAccountMutationVersion,\n  SignedBusinessAccountIntent,\n} from '../businessAccounts.types';\nimport { parseGovernedResponse } from '../parseGovernedResponse';\nimport { resendFields } from '../resendFields';\n\ntype SetGovernanceParams = {\n  autoExecute?: boolean;\n  businessAccountId: string;\n  governance: BusinessAccountGovernance;\n  signed?: SignedBusinessAccountIntent;\n};\n\n/**\n * Replaces the account's entire governance section. Wholesale, not a merge —\n * an action left out of `governance` is refused rather than read as \"delete\n * its requirements\"; send it back with its existing requirements (or an\n * empty array) to keep or clear it.\n *\n * `setGovernance` is itself always governed at the capability-table floor\n * (owner-only today), so the 202 path applies here too: nothing is written\n * and the 202 body is returned instead. Resend with `signed` (from\n * `signBusinessAccountIntent`) to move past `INTENT_REQUIRED`.\n *\n * @param params.businessAccountId - The business account whose governance changes.\n * @param params.governance - The full governance section to write, keyed by\n *   governed action. Read the current value with `getBusinessAccountGovernance`\n *   first if you're changing only one action.\n * @param [params.autoExecute] - Whether to apply on the completing approval.\n *   Only meaningful on the first call.\n * @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The new document version, or the outstanding action required.\n *\n * @example\n * ```ts\n * const current = await getBusinessAccountGovernance({ businessAccountId });\n * await setBusinessAccountGovernance({\n *   businessAccountId,\n *   governance: {\n *     ...current,\n *     addMember: [{ id: 'one-admin', schemaVersion: 1, requiredApprovals: 1, eligibleApproverRoles: ['admin'] }],\n *   },\n * });\n * ```\n *\n * @see {@link getBusinessAccountGovernance} for reading the current section first.\n * @see {@link defineBusinessAccountRole} for defining a role governance can name.\n * @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.\n * @notInstrumented\n */\nexport const setBusinessAccountGovernance = async (\n  { businessAccountId, governance, autoExecute, signed }: SetGovernanceParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountActionRequired | BusinessAccountMutationVersion> => {\n  const core = getCore(client);\n  const apiClient = createApiClient(\n    { elevatedAccessTokenScope: TokenScope.BusinessAccountgovernanceupdate },\n    client\n  );\n\n  // `Raw` returns the response before the generated 200 mapper runs, which\n  // assumes the version-bump shape and throws on a governed 202's different\n  // shape. Reading the status first is how we tell the two apart.\n  const response = await apiClient.sdkSetBusinessAccountGovernanceRaw({\n    businessAccountId,\n    environmentId: core.environmentId,\n    setBusinessAccountGovernanceSdkRequest: {\n      // `approverCapabilities` is a generated enum; ours is a plain string so\n      // an account can name a capability the generator hasn't caught up with\n      // yet — cast rather than narrow the param type to the enum.\n      governance: governance as unknown as SetBusinessAccountGovernanceSdkRequest['governance'],\n      ...resendFields({ autoExecute, signed }),\n    },\n  });\n\n  if (response.raw.status === 202) {\n    return parseGovernedResponse({\n      fnName: 'setBusinessAccountGovernance',\n      response: response.raw,\n    });\n  }\n\n  return (await response.value()) as BusinessAccountMutationVersion;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { getWaasWalletProviderFromWalletAccount } from '../getWaasWalletProviderFromWalletAccount';\n\ntype SetWaasWalletAccountPasswordParams = {\n  password: string;\n  walletAccount: WalletAccount;\n};\n\n/**\n * Sets a password for a WaaS wallet account.\n *\n * @param params.walletAccount - The WaaS wallet account to set the password for.\n * @param params.password - The password to set for the wallet.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves when the password is successfully set.\n * @notInstrumented\n */\nexport const setWaasWalletAccountPassword = async (\n  { password, walletAccount }: SetWaasWalletAccountPasswordParams,\n  client = getDefaultClient()\n): Promise<void> => {\n  const provider = getWaasWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  return provider.setWaasWalletAccountPassword({\n    password,\n    walletAccount,\n  });\n};\n","import {\n  JwtVerifiedCredentialFormatEnum,\n  WalletProviderEnum,\n} from '@dynamic-labs/sdk-api-core';\n\nimport type { User } from '../../user/user.types';\n\n/** @notInstrumented */\nexport const userHasExternalWallet = (user: User): boolean => {\n  const hasExternalWallet = user?.verifiedCredentials.some(\n    (vc) =>\n      vc.format === JwtVerifiedCredentialFormatEnum.Blockchain &&\n      vc.walletProvider !== WalletProviderEnum.EmbeddedWallet\n  );\n\n  return hasExternalWallet;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport { assertDefined } from '../../../utils/assertDefined';\nimport type { Chain } from '../../chain';\nimport { userHasExternalWallet } from '../../wallets/userHasExternalWallet';\nimport { getChainsMissingWaasWalletAccounts } from '../getChainsMissingWaasWalletAccounts';\n\ntype ShouldAutoCreateWalletForChainParams = {\n  chain: Chain;\n};\n\n/**\n * Checks if a WaaS wallet should be automatically created for the specified blockchain.\n *\n * This function determines whether the current user configuration and project\n * settings require automatic wallet creation for the given chain, considering\n * whether the user already has an embedded wallet for the enabled chains or an external wallet.\n *\n * @param params.chain - The blockchain network to check.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns True if a wallet should be auto-created for the chain, false otherwise.\n * @notInstrumented\n */\nexport const shouldAutoCreateWalletForChain = (\n  { chain }: ShouldAutoCreateWalletForChainParams,\n  client = getDefaultClient()\n): boolean => {\n  assertDefined(client.projectSettings, 'Project settings are not available');\n\n  const embeddedWalletSettings = client.projectSettings.sdk.embeddedWallets;\n\n  const automaticEmbeddedWalletCreationEnabled =\n    embeddedWalletSettings?.automaticEmbeddedWalletCreation;\n\n  if (!automaticEmbeddedWalletCreationEnabled || !client.user) {\n    return false;\n  }\n\n  const automaticEmbeddedWalletCreationForExternalEnabled =\n    embeddedWalletSettings?.automaticEmbeddedWalletCreationForExternal;\n\n  // If user has an external wallet (e.g metamask, phantom, etc), should only\n  // create if automaticEmbeddedWalletCreationForExternalEnabled is true\n  const shouldCreateDynamicWaasWallet =\n    !userHasExternalWallet(client.user) ||\n    automaticEmbeddedWalletCreationForExternalEnabled;\n\n  if (!shouldCreateDynamicWaasWallet) {\n    return false;\n  }\n\n  const chainsMissingAutoCreatedWallet =\n    getChainsMissingWaasWalletAccounts(client);\n\n  return chainsMissingAutoCreatedWallet.includes(chain);\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { DynamicClient } from '../../../client/types/DynamicClient';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { getWaasWalletProviderFromWalletAccount } from '../getWaasWalletProviderFromWalletAccount';\n\ntype SignSerializedTransactionParams = {\n  chainId?: string;\n  serializedTransaction: string;\n  walletAccount: WalletAccount;\n};\n\ntype SignSerializedTransactionResult = { signature: string };\n\n/**\n * No gas estimation, balance check, or broadcast — unlike `transferAmount`.\n * Useful for exercising WaaS policy enforcement in isolation.\n *\n * @param params.walletAccount - The wallet account to sign with.\n * @param params.serializedTransaction - The raw serialized transaction (e.g. viem's `serializeTransaction`).\n * @param [params.chainId] - The chain id, if required by the target chain's signer.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The raw signature.\n * @notInstrumented\n */\nexport const signSerializedTransaction = async (\n  { chainId, serializedTransaction, walletAccount }: SignSerializedTransactionParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<SignSerializedTransactionResult> => {\n  const provider = getWaasWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  return provider.signSerializedTransaction({\n    chainId,\n    serializedTransaction,\n    walletAccount,\n  });\n};\n","import { TokenScope } from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport { logoutWithReason } from '../../../auth/logoutWithReason';\nimport type {\n  BusinessAccountActionRequired,\n  BusinessAccountDetail,\n  SignedBusinessAccountIntent,\n} from '../businessAccounts.types';\nimport { parseGovernedResponse } from '../parseGovernedResponse';\nimport { resendFields } from '../resendFields';\n\ntype TransferBusinessAccountOwnershipParams = {\n  autoExecute?: boolean;\n  businessAccountId: string;\n  newOwnerUserId: string;\n  signed?: SignedBusinessAccountIntent;\n};\n\n/**\n * Transfers ownership of a business account to another member. Owner-only: the\n * `newOwnerUserId` must already be a member, is promoted to owner, and the\n * current owner is atomically demoted to admin.\n *\n * When the account governs `transferOwnership`, nothing is written and the\n * 202 body is returned instead. Resend with `signed` (from\n * `signBusinessAccountIntent`) to move past `INTENT_REQUIRED`.\n *\n * @param params.businessAccountId - The business account whose ownership moves.\n * @param params.newOwnerUserId - The member to promote to owner.\n * @param [params.autoExecute] - Whether to apply on the completing approval.\n *   Only meaningful on the first call.\n * @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The updated business account detail, or the outstanding action required.\n *\n * @example\n * ```ts\n * const detail = await getBusinessAccount({ businessAccountId });\n * const target = detail.members.find((m) => m.role === 'admin');\n * await transferBusinessAccountOwnership({\n *   businessAccountId,\n *   newOwnerUserId: target.userId,\n * });\n * ```\n *\n * @see getBusinessAccount\n * @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.\n * @notInstrumented\n */\nexport const transferBusinessAccountOwnership = async (\n  { businessAccountId, newOwnerUserId, autoExecute, signed }: TransferBusinessAccountOwnershipParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountActionRequired | BusinessAccountDetail> => {\n  const core = getCore(client);\n  const apiClient = createApiClient(\n    { elevatedAccessTokenScope: TokenScope.BusinessAccounttransferOwnership },\n    client\n  );\n\n  // `Raw` returns the response before the generated 200 mapper runs, which\n  // assumes the detail's required arrays exist and throws on a governed\n  // 202's different shape. Reading the status first is how we tell the two\n  // apart.\n  const response = await apiClient.sdkTransferBusinessAccountOwnershipRaw({\n    businessAccountId,\n    environmentId: core.environmentId,\n    transferBusinessAccountOwnershipSdkRequest: {\n      newOwnerUserId,\n      ...resendFields({ autoExecute, signed }),\n    },\n  });\n\n  if (response.raw.status === 202) {\n    return parseGovernedResponse({\n      fnName: 'transferBusinessAccountOwnership',\n      response: response.raw,\n    });\n  }\n\n  const detail = await response.value();\n\n  // Ownership transfer demotes the caller (owner -> admin) and revokes their\n  // session server-side, so a token refresh would 401. Sign the caller out\n  // instead — they re-authenticate into their new (admin) scope.\n  await logoutWithReason(\n    { reason: 'business-account-ownership-transferred' },\n    client\n  );\n\n  return detail as BusinessAccountDetail;\n};\n","import type { GetWalletResponse } from '@dynamic-labs-wallet/browser-wallet-client';\n\nimport { getDefaultClient } from '../../../client/defaultClient';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { getWaasWalletProviderFromWalletAccount } from '../getWaasWalletProviderFromWalletAccount';\n\ntype UnlockWalletParams = {\n  password: string;\n  walletAccount: WalletAccount;\n};\n\n/**\n * Unlocks a WaaS wallet account.\n *\n * @param params.walletAccount - The WaaS wallet account to unlock.\n * @param params.password - The password to unlock the wallet.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves with the wallet information.\n  * @notInstrumented\n */\nexport const unlockWallet = async (\n  { password, walletAccount }: UnlockWalletParams,\n  client = getDefaultClient()\n): Promise<GetWalletResponse> => {\n  const provider = getWaasWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  return provider.unlockWallet({\n    password,\n    walletAccount,\n  });\n};\n","import { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { BusinessAccount } from '../businessAccounts.types';\n\ntype UpdateBusinessAccountParams = {\n  businessAccountId: string;\n  name: string;\n};\n\n/**\n * Renames a business account (owner-/admin-only). Calls the SDK API directly\n * (no MPC step), so a rejection surfaces as a thrown error.\n *\n * @param params.businessAccountId - The business account to rename.\n * @param params.name - The new name.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The updated business account.\n *\n * @example\n * ```ts\n * await updateBusinessAccount({ businessAccountId, name: 'Acme Inc' });\n * ```\n *\n * @see getBusinessAccount\n * @notInstrumented\n */\nexport const updateBusinessAccount = async (\n  { businessAccountId, name }: UpdateBusinessAccountParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccount> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  const account = await apiClient.sdkUpdateBusinessAccount({\n    businessAccountId,\n    environmentId: core.environmentId,\n    updateBusinessAccountSdkRequest: { name },\n  });\n\n  return account as BusinessAccount;\n};\n","import {\n  TokenScope,\n  type UpdateBusinessAccountMemberRoleSdkRequest,\n} from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type {\n  BuiltInBusinessAccountMemberRole,\n  BusinessAccountActionRequired,\n  BusinessAccountMember,\n  SignedBusinessAccountIntent,\n} from '../businessAccounts.types';\nimport { parseGovernedResponse } from '../parseGovernedResponse';\nimport { resendFields } from '../resendFields';\n\n/**\n * Roles a member can be reassigned to: a built-in other than owner, or one this\n * account defined. Ownership moves only via transferOwnership, which the API\n * refuses `owner` to enforce — the open branch cannot express that exclusion.\n */\ntype AssignableRole =\n  | Exclude<BuiltInBusinessAccountMemberRole, 'owner'>\n  | (string & {});\n\ntype UpdateBusinessAccountMemberRoleParams = {\n  autoExecute?: boolean;\n  businessAccountId: string;\n  role: AssignableRole;\n  signed?: SignedBusinessAccountIntent;\n  userId: string;\n};\n\n/**\n * Changes an existing member's role (owner-/admin-only) to any role the account\n * defines — a built-in or a custom one, including from one custom role to\n * another. Owner is not assignable here — use\n * `transferBusinessAccountOwnership` for that.\n *\n * When the account governs `updateMemberRole`, nothing is written and the\n * 202 body is returned instead. Resend with `signed` (from\n * `signBusinessAccountIntent`) to move past `INTENT_REQUIRED`.\n *\n * @param params.businessAccountId - The business account the member belongs to.\n * @param params.userId - The member whose role changes.\n * @param params.role - The new role: a built-in (`admin`, `viewer`) or a role\n *   this account defined.\n * @param [params.autoExecute] - Whether to apply on the completing approval.\n *   Only meaningful on the first call.\n * @param [params.signed] - A previously-signed intent, to resend past `INTENT_REQUIRED`.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The updated business account member, or the outstanding action required.\n *\n * @example\n * ```ts\n * await updateBusinessAccountMemberRole({\n *   businessAccountId,\n *   userId: member.userId,\n *   role: 'admin',\n * });\n * ```\n *\n * @see transferBusinessAccountOwnership\n * @see addBusinessAccountMember\n * @throws {UnexpectedConsentResponseError} When a governed account answers 202 with an unrecognized body.\n * @notInstrumented\n */\nexport const updateBusinessAccountMemberRole = async (\n  { businessAccountId, userId, role, autoExecute, signed }: UpdateBusinessAccountMemberRoleParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountActionRequired | BusinessAccountMember> => {\n  const core = getCore(client);\n  const apiClient = createApiClient(\n    { elevatedAccessTokenScope: TokenScope.BusinessAccountmemberroleupdate },\n    client\n  );\n\n  // `Raw` returns the response before the generated 200 mapper runs, which\n  // assumes a member exists and throws on a governed 202's different shape.\n  // Reading the status first is how we tell the two apart.\n  const response = await apiClient.sdkUpdateBusinessAccountMemberRoleRaw({\n    businessAccountId,\n    environmentId: core.environmentId,\n    updateBusinessAccountMemberRoleSdkRequest: {\n      // See addBusinessAccountMember: compiles against the generated enum and\n      // the string that replaces it, so no bump ordering is baked in here.\n      role: role as UpdateBusinessAccountMemberRoleSdkRequest['role'],\n      ...resendFields({ autoExecute, signed }),\n    },\n    userId,\n  });\n\n  if (response.raw.status === 202) {\n    return parseGovernedResponse({\n      fnName: 'updateBusinessAccountMemberRole',\n      response: response.raw,\n    });\n  }\n\n  return (await response.value()) as BusinessAccountMember;\n};\n","import { getDefaultClient } from '../../../client/defaultClient';\nimport type { WalletAccount } from '../../wallets/walletAccount';\nimport { getWaasWalletProviderFromWalletAccount } from '../getWaasWalletProviderFromWalletAccount';\n\ntype UpdateWaasPasswordParams = {\n  currentPassword: string;\n  newPassword: string;\n  walletAccount: WalletAccount;\n};\n\n/**\n * Updates the password for a WaaS wallet account.\n *\n * This function changes the password used to encrypt and protect the\n * cryptographic key shares for the specified wallet account.\n *\n * @param params.walletAccount - The WaaS wallet account to update the password for.\n * @param params.currentPassword - The current password for the wallet.\n * @param params.newPassword - The new password to set for the wallet.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns A promise that resolves when the password is successfully updated.\n * @notInstrumented\n */\nexport const updateWaasPassword = async (\n  { currentPassword, newPassword, walletAccount }: UpdateWaasPasswordParams,\n  client = getDefaultClient()\n): Promise<void> => {\n  const provider = getWaasWalletProviderFromWalletAccount(\n    { walletAccount },\n    client\n  );\n\n  return provider.updatePassword({\n    currentPassword,\n    newPassword,\n    walletAccount,\n  });\n};\n","import {\n  WaasPolicyLayerUpdateRequestOpEnum,\n} from '@dynamic-labs/sdk-api-core';\n\nimport type { WaasPolicyLayerResponse } from '../../waas.types';\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { WaasPolicyRule } from '../policies.types';\n\ntype UpsertAccountPolicyRuleParams = {\n  businessAccountId: string;\n  rule: WaasPolicyRule;\n};\n\n/**\n * Creates or updates a single rule on a business account's account-Layer\n * (rules applied to every wallet in the account). Build `rule` with\n * {@link buildAllowPolicyRule} / {@link buildDenyPolicyRule}. Omit\n * `rule.ruleId` to create a new rule (the enclave mints one for you); pass\n * an existing `ruleId` to update it in place. BA owner/admin only. Calls\n * the SDK API directly (no MPC step), so a rejection surfaces as a thrown\n * error.\n *\n * @param params.businessAccountId - The business account to apply the rule to.\n * @param params.rule - The rule to create or update.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The account-Layer as it stands after the rule is applied.\n * @notInstrumented\n */\nexport const upsertAccountPolicyRule = async (\n  { businessAccountId, rule }: UpsertAccountPolicyRuleParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<WaasPolicyLayerResponse> => {\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  return apiClient.updateBusinessAccountPolicyLayer({\n    businessAccountId,\n    environmentId: core.environmentId,\n    waasPolicyLayerUpdateRequest: {\n      op: WaasPolicyLayerUpdateRequestOpEnum.Upsert,\n      rule,\n    },\n  });\n};\n","import {\n  WaasSignerPolicyLayerUpdateRequestOpEnum,\n} from '@dynamic-labs/sdk-api-core';\n\nimport type { WaasPolicyLayerResponse } from '../../waas.types';\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { assertDefined } from '../../../../utils/assertDefined';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { WalletAccount } from '../../../wallets/walletAccount';\nimport type { WaasPolicyRule } from '../policies.types';\n\ntype UpsertSignerPolicyRuleParams = {\n  rule: WaasPolicyRule;\n  /** Omit to target the caller's own active share set. */\n  shareSetId?: string;\n  walletAccount: WalletAccount;\n};\n\n/**\n * Creates or updates a single rule on a signer's policy layer. Build `rule`\n * with {@link buildAllowPolicyRule} / {@link buildDenyPolicyRule}. Omit\n * `rule.ruleId` to create a new rule (the enclave mints one for you); pass an\n * existing `ruleId` to update it in place. Calls the SDK API directly (no MPC\n * step), so a rejection surfaces as a thrown error.\n *\n * @param params.walletAccount - The wallet account whose signer-Layer to update.\n * @param params.rule - The rule to create or update.\n * @param [params.shareSetId] - The share set to target; defaults to the caller's own. Only the wallet's own owner may target another share set.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The signer-Layer as it stands after the rule is applied.\n * @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).\n * @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.\n * @notInstrumented\n */\nexport const upsertSignerPolicyRule = async (\n  { rule, shareSetId, walletAccount }: UpsertSignerPolicyRuleParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<WaasPolicyLayerResponse> => {\n  assertDefined(\n    walletAccount.verifiedCredentialId,\n    'upsertSignerPolicyRule: cannot resolve a wallet id — use a verified wallet account'\n  );\n\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  return apiClient.updateWaasSignerSelfPolicyLayer({\n    environmentId: core.environmentId,\n    waasSignerPolicyLayerUpdateRequest: {\n      op: WaasSignerPolicyLayerUpdateRequestOpEnum.Upsert,\n      rule,\n      shareSetId,\n    },\n    walletId: walletAccount.verifiedCredentialId,\n  });\n};\n","import {\n  WaasPolicyLayerUpdateRequestOpEnum,\n} from '@dynamic-labs/sdk-api-core';\n\nimport type { WaasPolicyLayerResponse } from '../../waas.types';\nimport type { WaasPolicyRule } from '../policies.types';\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { assertDefined } from '../../../../utils/assertDefined';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { WalletAccount } from '../../../wallets/walletAccount';\n\ntype UpsertWalletPolicyRuleParams = {\n  rule: WaasPolicyRule;\n  walletAccount: WalletAccount;\n};\n\n/**\n * Creates or updates a single rule on a wallet's policy layer. Build `rule`\n * with {@link buildAllowPolicyRule} / {@link buildDenyPolicyRule}. Omit\n * `rule.ruleId` to create a new rule (the enclave mints one for you); pass an\n * existing `ruleId` to update it in place. Calls the SDK API directly (no MPC\n * step), so a rejection surfaces as a thrown error.\n *\n * @param params.walletAccount - The wallet account to apply the rule to.\n * @param params.rule - The rule to create or update.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The wallet-Layer as it stands after the rule is applied.\n * @throws {ValueMustBeDefinedError} When `walletAccount` has no `verifiedCredentialId` (it isn't a verified wallet account yet).\n * @throws {APIError} When the SDK API request fails, for example an unauthorized, not-found, or server error response.\n * @notInstrumented\n */\nexport const upsertWalletPolicyRule = async (\n  { rule, walletAccount }: UpsertWalletPolicyRuleParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<WaasPolicyLayerResponse> => {\n  assertDefined(\n    walletAccount.verifiedCredentialId,\n    'upsertWalletPolicyRule: cannot resolve a wallet id — use a verified wallet account'\n  );\n\n  const core = getCore(client);\n  const apiClient = createApiClient({}, client);\n\n  return apiClient.updateWaasWalletSelfPolicyLayer({\n    environmentId: core.environmentId,\n    waasPolicyLayerUpdateRequest: {\n      op: WaasPolicyLayerUpdateRequestOpEnum.Upsert,\n      rule,\n    },\n    walletId: walletAccount.verifiedCredentialId,\n  });\n};\n","import { TokenScope } from '@dynamic-labs/sdk-api-core';\n\nimport { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { BusinessAccountProposal } from '../businessAccounts.types';\n\ntype VetoProposalParams = {\n  businessAccountId: string;\n  proposalId: string;\n};\n\n/**\n * Vetoes a pending proposal — terminal: a vetoed proposal can never be\n * approved or executed afterward. Gated on its own scope\n * (`business_account:proposal:veto`), distinct from approving one, so a\n * caller with only approve-scoped access cannot veto instead.\n *\n * @param params.businessAccountId - The business account the proposal belongs to.\n * @param params.proposalId - The proposal to veto.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The proposal, now `status: 'vetoed'`.\n *\n * @example\n * ```ts\n * await vetoBusinessAccountProposal({ businessAccountId, proposalId });\n * ```\n *\n * @see {@link approveBusinessAccountProposal} for consenting to a proposal instead.\n * @see {@link BusinessAccountProposal} for the returned shape.\n * @notInstrumented\n */\nexport const vetoBusinessAccountProposal = async (\n  { businessAccountId, proposalId }: VetoProposalParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountProposal> => {\n  const apiClient = createApiClient(\n    { elevatedAccessTokenScope: TokenScope.BusinessAccountproposalveto },\n    client\n  );\n\n  const result = await apiClient.sdkVetoBusinessAccountProposal({\n    businessAccountId,\n    environmentId: getCore(client).environmentId,\n    proposalId,\n  });\n\n  // The generated model dates every timestamp field as `Date`; this SDK's\n  // public type keeps them as the raw ISO strings the wire actually carries.\n  return result as unknown as BusinessAccountProposal;\n};\n","import { getCore } from '../../../../client/core/getCore';\nimport { getDefaultClient } from '../../../../client/defaultClient';\nimport type { DynamicClient } from '../../../../client/types';\nimport { createApiClient } from '../../../apiClient/createApiClient';\nimport type { BusinessAccountProposal } from '../businessAccounts.types';\n\ntype WithdrawApprovalParams = {\n  businessAccountId: string;\n  proposalId: string;\n};\n\n/**\n * Withdraws this session's own approval from a proposal still collecting\n * them. The approval row is kept with `revokedAt` set rather than deleted —\n * consent is recorded as given and taken back, not erased — so approving\n * again afterward reuses the same row.\n *\n * @param params.businessAccountId - The business account the proposal belongs to.\n * @param params.proposalId - The proposal to withdraw this session's approval from.\n * @param [client] - The Dynamic client instance. Only required when using multiple Dynamic clients.\n * @returns The proposal, with this approval's count no longer contributing.\n *\n * @example\n * ```ts\n * await withdrawBusinessAccountProposalApproval({ businessAccountId, proposalId });\n * ```\n *\n * @see {@link approveBusinessAccountProposal} for approving (or re-approving) instead.\n * @see {@link BusinessAccountProposalApprovalRecord} for what `revokedAt` looks like once set.\n * @notInstrumented\n */\nexport const withdrawBusinessAccountProposalApproval = async (\n  { businessAccountId, proposalId }: WithdrawApprovalParams,\n  client: DynamicClient = getDefaultClient()\n): Promise<BusinessAccountProposal> => {\n  const apiClient = createApiClient({}, client);\n\n  const result = await apiClient.sdkWithdrawBusinessAccountProposalApproval({\n    businessAccountId,\n    environmentId: getCore(client).environmentId,\n    proposalId,\n  });\n\n  // The generated model dates every timestamp field as `Date`; this SDK's\n  // public type keeps them as the raw ISO strings the wire actually carries.\n  return result as unknown as BusinessAccountProposal;\n};\n","import { assertPackageVersion } from '@dynamic-labs-sdk/assert-package-version';\n\nimport {\n  name as packageName,\n  version as packageVersion,\n} from '../../package.json';\nassertPackageVersion(packageName, packageVersion);\n\nexport type {\n  GetWalletResponse,\n  MigrateFromFireblocksResponse,\n  WalletRecoveryState,\n} from '@dynamic-labs-wallet/browser-wallet-client';\nexport { NotWaasWalletProviderError } from '../errors/NotWaasWalletProviderError';\nexport {\n  TransactionBroadcastError,\n  type TransactionBroadcastErrorCode,\n  type TransactionBroadcastSubmissionState,\n} from '../errors/TransactionBroadcastError';\nexport {\n  WaasChainEnum,\n  WaasWalletShareSetType,\n} from '../modules/waas/waas.consts';\nexport type {\n  WaasPolicyLayerResponse,\n  WaasShareSet,\n} from '../modules/waas/waas.types';\nexport type { WaasPolicyRule } from '../modules/waas/policies/policies.types';\nexport type {\n  BuiltInBusinessAccountMemberRole,\n  BusinessAccount,\n  BusinessAccountActionRequired,\n  BusinessAccountApprovalRequirement,\n  BusinessAccountDetail,\n  BusinessAccountGovernance,\n  BusinessAccountGovernanceRequirement,\n  BusinessAccountList,\n  BusinessAccountMember,\n  BusinessAccountMemberRole,\n  BusinessAccountMutationIntent,\n  BusinessAccountMutationVersion,\n  BusinessAccountProposal,\n  BusinessAccountProposalApprovalRecord,\n  BusinessAccountProposalStillPending,\n  BusinessAccountProposalSubject,\n  BusinessAccountRequirementCondition,\n  BusinessAccountRoleDefinition,\n  BusinessAccountRoleDefinitions,\n  BusinessAccountSigner,\n  BusinessAccountSignerIdentifierType,\n  BusinessAccountSignerType,\n  BusinessAccountWalletSummary,\n  SignedBusinessAccountIntent,\n  SmsCountryCode,\n  SocialProvider,\n  TargetIdentity,\n} from '../modules/waas/businessAccounts/businessAccounts.types';\nexport { addBusinessAccountMember } from '../modules/waas/businessAccounts/addBusinessAccountMember';\nexport { addBusinessAccountSigner } from '../modules/waas/businessAccounts/addBusinessAccountSigner';\nexport { addWalletToBusinessAccount } from '../modules/waas/businessAccounts/addWalletToBusinessAccount';\nexport { approveBusinessAccountProposal } from '../modules/waas/businessAccounts/approveBusinessAccountProposal';\nexport { backupWaasKeySharesToGoogleDrive } from '../modules/waas/backupWaasKeySharesToGoogleDrive';\nexport { buildAllowPolicyRule } from '../modules/waas/policies/buildAllowPolicyRule';\nexport { buildDenyPolicyRule } from '../modules/waas/policies/buildDenyPolicyRule';\nexport { createBusinessAccount } from '../modules/waas/businessAccounts/createBusinessAccount';\nexport { createPolicy } from '../modules/waas/policies/createPolicy';\nexport { createWaasOfflineRecoveryShares } from '../modules/waas/createWaasOfflineRecoveryShares';\nexport { createWaasWalletAccounts } from '../modules/waas/createWaasWalletAccounts';\nexport { createWalletForBusinessAccount } from '../modules/waas/businessAccounts/createWalletForBusinessAccount';\nexport { defineBusinessAccountRole } from '../modules/waas/businessAccounts/defineBusinessAccountRole';\nexport { delegateWaasKeyShares } from '../modules/waas/delegateWaasKeyShares';\nexport { deleteBusinessAccountRole } from '../modules/waas/businessAccounts/deleteBusinessAccountRole';\nexport { desugarPolicyRules } from '../modules/waas/policies/desugarPolicyRules';\nexport { executeBusinessAccountProposal } from '../modules/waas/businessAccounts/executeBusinessAccountProposal';\nexport { expandPolicyRules } from '../modules/waas/policies/expandPolicyRules';\nexport { exportWaasClientKeyshares } from '../modules/waas/exportWaasClientKeyshares';\nexport { exportWaasPrivateKey } from '../modules/waas/exportWaasPrivateKey';\nexport { getAccountPolicyLayer } from '../modules/waas/policies/getAccountPolicyLayer';\nexport { getBusinessAccount } from '../modules/waas/businessAccounts/getBusinessAccount';\nexport { getBusinessAccountGovernance } from '../modules/waas/businessAccounts/getBusinessAccountGovernance';\nexport { getChainsMissingWaasWalletAccounts } from '../modules/waas/getChainsMissingWaasWalletAccounts';\nexport { getPolicy } from '../modules/waas/policies/getPolicy';\nexport { getSignerPolicyLayer } from '../modules/waas/policies/getSignerPolicyLayer';\nexport { getWalletAccountShareSets } from '../modules/waas/getWalletAccountShareSets';\nexport { getWalletPolicyLayer } from '../modules/waas/policies/getWalletPolicyLayer';\nexport { getWalletRecoveryState } from '../modules/waas/getWalletRecoveryState';\nexport { hasDelegatedAccess } from '../modules/waas/hasDelegatedAccess';\nexport { importWaasPrivateKey } from '../modules/waas/importWaasPrivateKey';\nexport { isBusinessAccountActionRequired } from '../modules/waas/businessAccounts/isBusinessAccountActionRequired';\nexport { isDynamicWaasEnabled } from '../modules/waas/isDynamicWaasEnabled';\nexport { isPasswordRequiredForWaasWallets } from '../modules/waas/isPasswordRequiredForWaasWallets';\nexport { isWaasWalletAccount } from '../modules/waas/isWaasWalletAccount';\nexport { isWalletCreationRequirement } from '../modules/waas/isWalletCreationRequirement/isWalletCreationRequirement';\nexport { listBusinessAccountProposals } from '../modules/waas/businessAccounts/listBusinessAccountProposals';\nexport { listBusinessAccountProposalsAwaitingMyApproval } from '../modules/waas/businessAccounts/listBusinessAccountProposalsAwaitingMyApproval';\nexport { listBusinessAccountRoles } from '../modules/waas/businessAccounts/listBusinessAccountRoles';\nexport { listBusinessAccounts } from '../modules/waas/businessAccounts/listBusinessAccounts';\nexport { migrateFromFireblocks } from '../modules/waas/migrateFromFireblocks';\nexport { normalizeWalletRequirements } from '../modules/waas/normalizeWalletRequirements/normalizeWalletRequirements';\nexport { refreshWaasWalletAccountShares } from '../modules/waas/refreshWaasWalletAccountShares';\nexport { removeAccountPolicyRule } from '../modules/waas/policies/removeAccountPolicyRule';\nexport { removeBusinessAccountMember } from '../modules/waas/businessAccounts/removeBusinessAccountMember';\nexport { removeBusinessAccountSigner } from '../modules/waas/businessAccounts/removeBusinessAccountSigner';\nexport { removeBusinessAccountWallet } from '../modules/waas/businessAccounts/removeBusinessAccountWallet';\nexport { removePolicyRules } from '../modules/waas/policies/removePolicyRules';\nexport { removeSignerPolicyRule } from '../modules/waas/policies/removeSignerPolicyRule';\nexport { removeWalletPolicyRule } from '../modules/waas/policies/removeWalletPolicyRule';\nexport { resolvePolicyScope } from '../modules/waas/policies/resolvePolicyScope';\nexport { revokeWaasDelegation } from '../modules/waas/revokeWaasDelegation';\nexport { setBusinessAccountGovernance } from '../modules/waas/businessAccounts/setBusinessAccountGovernance';\nexport { setWaasWalletAccountPassword } from '../modules/waas/setWaasWalletAccountPassword';\nexport { shouldAutoCreateWalletForChain } from '../modules/waas/shouldAutoCreateWalletForChain';\nexport {\n  type BusinessAccountIntent,\n  signBusinessAccountApproval,\n  type SignBusinessAccountApprovalResult,\n  signBusinessAccountIntent,\n  type SignBusinessAccountIntentResult,\n} from '../modules/sessionKeys/signBusinessAccountIntent/signBusinessAccountIntent';\nexport { signSerializedTransaction } from '../modules/waas/signSerializedTransaction';\nexport { transferBusinessAccountOwnership } from '../modules/waas/businessAccounts/transferBusinessAccountOwnership';\nexport { unlockWallet } from '../modules/waas/unlockWallet';\nexport { updateBusinessAccount } from '../modules/waas/businessAccounts/updateBusinessAccount';\nexport { updateBusinessAccountMemberRole } from '../modules/waas/businessAccounts/updateBusinessAccountMemberRole';\nexport { updateWaasPassword } from '../modules/waas/updateWaasPassword';\nexport { upsertAccountPolicyRule } from '../modules/waas/policies/upsertAccountPolicyRule';\nexport { upsertSignerPolicyRule } from '../modules/waas/policies/upsertSignerPolicyRule';\nexport { upsertWalletPolicyRule } from '../modules/waas/policies/upsertWalletPolicyRule';\nexport { vetoBusinessAccountProposal } from '../modules/waas/businessAccounts/vetoBusinessAccountProposal';\nexport { withdrawBusinessAccountProposalApproval } from '../modules/waas/businessAccounts/withdrawBusinessAccountProposalApproval';\nexport type {\n  WaasTransactionBroadcastEncoding,\n  WaasTransactionBroadcastResult,\n  WaasWalletAccount,\n  WalletCreationBitcoinConfig,\n  WalletCreationRequirement,\n} from '../modules/waas/waas.types';\nexport type {\n  PolicyRuleMaxAmountPerTransaction,\n  PolicyRules,\n  PolicyScope,\n} from '../modules/waas/policies/policies.types';\nexport type {\n  WalletAccountOwnShareSet,\n  WalletAccountShareSets,\n} from '../modules/waas/getWalletAccountShareSets';\nexport type { ResolvedPolicyScope } from '../modules/waas/policies/resolvePolicyScope';\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBA,MAAaA,kBAAgBC;;;;;;;AAS7B,MAAaC,2BAAyBC;;;;;;;;;;ACXtC,MAAa,wBAAwB,EACnC,QACA,qBACsC;CACtC,MAAM,YAAY,QAAQ,eAAe,OAAO;CAChD,MAAM,gBAAgB,QACpB,eAAe,cAAc,eAAe,eAC7C;AACD,KAAI,CAAC,aAAa,CAAC,cACjB,OAAM,IAAI,kBACR,GAAG,OAAO,kFACX;;;;;;ACpBL,MAAaC,yBAGT;CACF,OAAO,uBAAuB;CAC9B,gBAAgB,uBAAuB;CACvC,IAAI,uBAAuB;CAC3B,aAAa,uBAAuB;CACpC,iBAAiB,uBAAuB;CACxC,gBAAgB,uBAAuB;CACxC;;;;ACbD,IAAa,iCAAb,cAAoD,UAAU;CAC5D,YAAY,EAAE,WAAgC;AAC5C,QAAM;GACJ,OAAO;GACP,MAAM;GACN,SAAS;GACT,MAAM;GACN,cAAc;GACf,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACwBN,MAAa,wBAAwB,OAAO,EAC1C,QACA,eACyE;CACzE,MAAM,UAAW,MAAM,SAAS,MAAM;AACtC,KACG,QAAQ,WAAW,qBAClB,QAAQ,WAAW,wBACrB,CAAC,QAAQ,OAET,OAAM,IAAI,+BAA+B,EACvC,SAAS,GAAG,OAAO,wBACpB,CAAC;AAEJ,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACTT,MAAa,gBAAgB,EAC3B,aACA,cAC6C;CAC7C,GAAI,gBAAgB,SAAY,EAAE,GAAG,EAAE,aAAa;CACpD,GAAI,SACA;EAIE,QAAQ,OAAO;EACf,iBAAiB,OAAO;EACzB,GACD,EAAE;CACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACID,MAAa,2BAA2B,OACtC,EAAE,mBAAmB,gBAAgB,MAAM,aAAa,UACxD,SAAwB,kBAAkB,KACyB;AACnE,sBAAqB;EAAE,QAAQ;EAA4B;EAAgB,CAAC;CAE5E,MAAM,OAAO,QAAQ,OAAO;CAC5B,MAAM,YAAY,gBAChB,EAAE,0BAA0B,WAAW,0BAA0B,EACjE,OACD;CACD,MAAM,EAAE,QAAQ,YAAY,gBAAgB,gBAAgB,mBAC1D;CAKF,MAAM,WAAW,MAAM,UAAU,+BAA+B;EAC9D,oCAAoC;GAClC;GAGA,MAAO,QAAQ;GACf;GACgB;GAChB,MAAM,iBAAiB,uBAAuB,kBAAkB;GAChE;GACA,GAAG,aAAa;IAAE;IAAa;IAAQ,CAAC;GACzC;EACD;EACA,eAAe,KAAK;EACrB,CAAC;AAEF,KAAI,SAAS,IAAI,WAAW,IAC1B,QAAO,sBAAsB;EAC3B,QAAQ;EACR,UAAU,SAAS;EACpB,CAAC;AAGJ,QAAQ,MAAM,SAAS,OAAO;;;;;;AClFhC,MAAa,gCACX,EAAE,SACF,WACuB;CACvB,MAAM,eAAe,8BAA8B,EAAE,OAAO,EAAE,OAAO;AAErE,KAAI,CAAC,aAOH,OAAM,IAAI,2BAA2B,EACnC,mBAPsB,wBAAwB;EAC9C;EACA,aAAa,sBAAsB;EACnC,oBAAoB,mBAAmB;EACxC,CAAC,EAID,CAAC;AAGJ,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC6BT,MAAa,2BAA2B,OACtC,EACE,eACA,mBACA,UACA,gBACA,YACA,UACA,sBACA,QACA,mBAEF,SAAS,kBAAkB,KACiB;AAC5C,sBAAqB;EAAE,QAAQ;EAA4B;EAAgB,CAAC;AAI5E,KAAI,cAAc,kBAChB,eACE,mBACA,8EACD;CAKH,IAAI,4BAA4B;AAChC,KAAI,CAAC,2BAA2B;EAI9B,MAAM,eAAe,YAAY,cAAc;AAC/C,gBACE,cACA,iHACD;EACD,MAAM,OAAO,QAAQ,OAAO;AAS5B,+BAJgB,MAJE,gBAChB,EAAE,0BAA0B,WAAW,0BAA0B,EACjE,OACD,CAC+B,6BAA6B;GAC3D,eAAe,KAAK;GACpB,qCAAqC,EAAE,UAAU,cAAc;GAChE,CAAC,EAC6D;;CAWjE,MAAM,SAAS,MALE,6BACf,EAAE,OAAO,cAAc,OAAO,EAC9B,OACD,CAE6B,2BAA2B;EACvD,mBAAmB;EACnB;EACA;EACA;EACA;EACA,sBAAsB;EACtB;EACA;EACD,CAAC;AAMF,OAAMC,sBAAY,OAAO;AAIzB,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC5FT,MAAa,6BAA6B,OACxC,EAAE,mBAAmB,UAAU,aAAa,UAC5C,SAAwB,kBAAkB,KACyB;CACnE,MAAM,OAAO,QAAQ,OAAO;CAS5B,MAAM,WAAW,MARC,gBAChB,EAAE,0BAA0B,WAAW,2BAA2B,EAClE,OACD,CAKgC,gCAAgC;EAC/D,eAAe,KAAK;EACpB,qCAAqC;GACnC;GACA;GACA,GAAG,aAAa;IAAE;IAAa;IAAQ,CAAC;GACzC;EACF,CAAC;AAEF,KAAI,SAAS,IAAI,WAAW,IAE1B,QAAO,sBAAsB;EAC3B,QAAQ;EACR,UAAU,SAAS;EACpB,CAAC;CAGJ,MAAM,SAAS,MAAM,SAAS,OAAO;AAIrC,OAAMC,sBAAY,OAAO;AAEzB,QAAO;;;;;AC5ET,MAAM,oBAAoB,GAAW,MAAsB;AACzD,KAAI,IAAI,EAAG,QAAO;AAClB,KAAI,IAAI,EAAG,QAAO;AAClB,QAAO;;AAKT,MAAM,yBAAyB;AAE/B,IAAM,yBAAN,cAAqC,MAAM;CACzC,cAAc;AACZ,QACE,gDAAgD,uBAAuB,GACxE;AACD,OAAK,OAAO;;;AAKhB,MAAM,YAAY,OAAgB,UAA2B;AAC3D,KAAI,QAAQ,uBAAwB,OAAM,IAAI,wBAAwB;AACtE,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,MAAM,KAAK,SAAS,SAAS,MAAM,QAAQ,EAAE,CAAC;AACvD,KAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;EAC/C,MAAMC,SAAkC,OAAO,OAAO,KAAK;AAC3D,OAAK,MAAM,OAAO,OAAO,KAAK,MAAM,CAAC,KAAK,iBAAiB,EAAE;GAC3D,MAAM,QAAS,MAAkC;AACjD,OAAI,UAAU,OAAW;AACzB,UAAO,OAAO,SAAS,OAAO,QAAQ,EAAE;;AAE1C,SAAO;;AAET,QAAO;;;;;;;;;;;;;;;;;;;;AAqBT,MAAa,oBAAoB,QAC/B,KAAK,UAAU,SAAS,KAAK,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACoBlC,MAAa,4BAA4B,OACvC,EAAE,UACF,SAAwB,kBAAkB,KACG;AAQ7C,QAAO;EAAE;EAAQ,iBALO,MAFX,QAAQ,OAAO,CAEO,SAAS,KAC1C,WACA,iBAAiB,OAA6C,CAC/D;EAEiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDpC,MAAa,8BAA8B,OACzC,EACE,QACA,8BAAa,IAAI,MAAM,EAAC,aAAa,IAEvC,SAAwB,kBAAkB,KACK;AAW/C,QAAO;EAAE;EAAY,WARH,MAFL,QAAQ,OAAO,CAEC,SAAS,KACpC,WACA,iBAAiB;GACf;GACQ;GACT,CAAC,CACH;EAE+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACnHlC,MAAa,iCAAiC,OAC5C,EAAE,mBAAmB,YACrB,SAAwB,kBAAkB,KACL;CACrC,MAAM,EAAE,YAAY,cAAc,MAAM,4BACtC,EAAE,QAAQ,SAAS,QAAQ,EAC3B,OACD;AAmBD,QAZe,MALG,gBAChB,EAAE,0BAA0B,WAAW,gCAAgC,EACvE,OACD,CAE8B,kCAAkC;EAC/D,0CAA0C;GACxC,YAAY,IAAI,KAAK,WAAW;GAChC;GACD;EACD;EACA,eAAe,QAAQ,OAAO,CAAC;EAC/B,YAAY,SAAS;EACtB,CAAC;;;;;;;;;;;;;;;;;;ACtCJ,MAAa,mCAAmC,OAC9C,EACE,wBACA,UACA,iBAEF,SAAS,kBAAkB,KACT;AAMlB,QALiB,uCACf,EAAE,eAAe,EACjB,OACD,CAEe,6BAA6B;EAC3C;EACA;EACA;EACD,CAAC;;;;;;;;;;;;ACtCJ,MAAa,wBACX,UACoB;CACpB,GAAG;CACH,UAAU,mBAAmB;CAC9B;;;;;;;;;;;ACLD,MAAa,uBAAuB,UAA2C;CAC7E,GAAG;CACH,UAAU,mBAAmB;CAC9B;;;;;;;;;;;;;;;ACiBD,MAAa,wBAAwB,OACnC,QACA,SAAwB,kBAAkB,KACb;CAC7B,MAAM,OAAO,QAAQ,OAAO;CAG5B,MAAM,SAAS,MAFG,gBAAgB,EAAE,EAAE,OAAO,CAEd,yBAAyB;EACtD,iCAAiC;GAC/B,aAAa,QAAQ;GACrB,UAAU,QAAQ;GAClB,MAAM,QAAQ;GACf;EACD,eAAe,KAAK;EACrB,CAAC;AAKF,OAAMC,sBAAY,OAAO;AAEzB,QAAO;;;;;;;;;;;;;AC1BT,MAAa,yBACX,EAAE,YAAY,iBACd,WACqC;CACrC,MAAM,EAAE,kBAAkB,QAAQ,OAAO;CACzC,MAAM,YAAY,gBAAgB,EAAE,EAAE,OAAO;AAI7C,SAAQ,cAAc,QAAtB;EACE,KAAK,UACH,QAAO,UAAU,iCAAiC;GAChD,mBAAmB,cAAc;GACjC;GACA,8BAA8B;IAC5B,IAAI,mCAAmC;IACvC;IACD;GACF,CAAC;EACJ,KAAK,SACH,QAAO,UAAU,gCAAgC;GAC/C;GACA,8BAA8B;IAC5B,IAAI,mCAAmC;IACvC;IACD;GACD,UAAU,cAAc;GACzB,CAAC;EACJ,KAAK,SACH,QAAO,UAAU,gCAAgC;GAC/C;GACA,oCAAoC;IAClC,IAAI,yCAAyC;IAC7C;IACA,YAAY,cAAc;IAC3B;GACD,UAAU,cAAc;GACzB,CAAC;EACJ,SAAS;GAGP,MAAMC,iBAAwB;AAC9B,SAAM,IAAI,kBACR,4CAA4C,KAAK,UAAU,eAAe,CAAC,GAC5E;;;;;;;;;;;;;AChEP,MAAa,cAAgC,UAC3C,OAAO,KAAK,MAAM;;;;;;;;ACIpB,MAAa,mBAAmB,EAC9B,QACA,aAC+D;CAC/D;CACA,YAAY;CACb;;;;;;;;;;;ACRD,MAAaC,4BAA4D;CACvE,gBAAgB;CAChB,aAAa;CACb,eAAe;CACf,yBAAyB;CAC1B;;;;;;;;;;ACAD,MAAa,2BAA2B,EACtC,SAAS,EAAE,OAAO,YAClB,YACiD;AACjD,KAAI,CAAC,MAAM,kBAAkB,MAAM,eAAe,WAAW,EAC3D,QAAO;AAET,QAAO;EACL,WAAW,MAAM;EACjB;EACA;EACA,MAAM,MAAM,OAAO,kBAAkB,0BAA0B;EAC/D,UAAU,mBAAmB;EAC7B,GAAI,MAAM,0BACN,EAAE,YAAY,gBAAgB,MAAM,wBAAwB,EAAE,GAC9D,EAAE;EACP;;;;;;;;;;;;AChBH,MAAa,wBAAwB,EACnC,SAAS,EAAE,OAAO,YAClB,YACiD;AACjD,KAAI,MAAM,gBAAgB,KAAM,QAAO;AAEvC,QAAO;EACL;EACA;EACA,MAAM,MAAM,OAAO,eAAe,0BAA0B;EAC5D,uBAAuB,EAAE,aAAa,MAAM;EAC5C,UAAU,mBAAmB;EAC9B;;;;;;;;;ACfH,MAAa,0BAA0B,EACrC,SAAS,EAAE,OAAO,YAClB,YACiD;AACjD,KAAI,CAAC,MAAM,iBAAiB,MAAM,cAAc,WAAW,EACzD,QAAO;AAET,QAAO;EACL,WAAW,MAAM;EACjB;EACA;EACA,MAAM,MAAM,OAAO,iBAAiB,0BAA0B;EAC9D,UAAU,mBAAmB;EAC9B;;;;;;;;;;;ACVH,MAAa,oCAAoC,EAC/C,SAAS,EAAE,OAAO,YAClB,YACiD;CACjD,MAAM,6BAA6B,QAAQ,MAAM,gBAAgB,OAAO;AACxE,KAAI,CAAC,MAAM,2BAA2B,2BACpC,QAAO;AAET,QAAO;EACL;EACA;EACA,MAAM,MAAM,OAAO,2BAA2B,0BAA0B;EACxE,UAAU,mBAAmB;EAC7B,YAAY,gBAAgB,MAAM,wBAAwB;EAC3D;;;;;;;;;ACtBH,MAAa,gBAAgB,SAC1B,KAAK,cAAc,UAAa,KAAK,UAAU,SAAS,KACzD,KAAK,WAAW;;;;ACWlB,MAAM,+BAA+B,IAAI,IAXP;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAIA;;;;AAKD,MAAa,yBAAyB,SACnC,OAAO,KAAK,KAAK,CAA8B,MAC7C,QAAQ,CAAC,6BAA6B,IAAI,IAAI,IAAI,KAAK,QAAQ,KACjE,IACD,KAAK,YAAY,cAAc,QAC/B,KAAK,uBAAuB,mBAAmB,QAC/C,KAAK,uBAAuB,sBAAsB;;;;;;;;AC1BpD,MAAa,kBAAkB,EAC7B,OACA,kBAIwC;CACxC,QAAQ;CACR,GAAI,QAAQ,EAAE,OAAO,GAAG,EAAE;CAC3B;;;;;;;;;ACDD,MAAa,0BACX,SACqC;AAOrC,KAAI,EALF,KAAK,aAAa,mBAAmB,SACrC,KAAK,0BAA0B,WAC9B,KAAK,eAAe,UAAa,KAAK,WAAW,eAAe,WACjE,aAAa,KAAK,IAClB,CAAC,sBAAsB,KAAK,EAChB,QAAO;AAErB,QAAO;EACL,gBAAgB,KAAK;EACrB,GAAI,KAAK,YAAY,eAAe,SAChC,EACE,yBAAyB,eAAe;GACtC,OAAO,KAAK,WAAW;GACvB,YAAY,KAAK,WAAW;GAC7B,CAAC,EACH,GACD,EAAE;EACP;;;;;;;;;ACvBH,MAAa,uBACX,SACqC;AAOrC,KAAI,EALF,KAAK,aAAa,mBAAmB,QACrC,KAAK,uBAAuB,gBAAgB,QAC5C,KAAK,eAAe,UACpB,CAAC,aAAa,KAAK,IACnB,CAAC,sBAAsB,KAAK,EAChB,QAAO;AAErB,QAAO,EAAE,aAAa,MAAM;;;;;;;;;ACX9B,MAAa,yBACX,SACqC;AAOrC,KAAI,EALF,KAAK,aAAa,mBAAmB,QACrC,KAAK,0BAA0B,UAC/B,KAAK,eAAe,UACpB,aAAa,KAAK,IAClB,CAAC,sBAAsB,KAAK,EAChB,QAAO;AAErB,QAAO,EAAE,eAAe,KAAK,WAAW;;;;;;;;;ACV1C,MAAa,mCACX,SACqC;AAOrC,KAAI,EALF,KAAK,aAAa,mBAAmB,QACrC,KAAK,0BAA0B,UAC/B,KAAK,YAAY,eAAe,UAChC,CAAC,aAAa,KAAK,IACnB,CAAC,sBAAsB,KAAK,EAChB,QAAO;AAErB,QAAO,EACL,yBAAyB,eAAe;EACtC,OAAO,KAAK,WAAY;EACxB,YAAY,KAAK,WAAY;EAC9B,CAAC,EACH;;;;;;ACQH,MAAa,iBAAiB;CAC5B;CACA;CACA;CACA;CACD;;;;;;;;AAWD,MAAaC,aAAyD;CACpE,gBAAgB;EACd,WAAW;EACX,UAAU;EACX;CACD,aAAa;EACX,WAAW;EACX,UAAU;EACX;CACD,eAAe;EACb,WAAW;EACX,UAAU;EACX;CACD,yBAAyB;EACvB,WAAW;EACX,UAAU;EACX;CACF;;;;;;;;;;;;;;;;AChCD,MAAa,mBACX,SAC4B;AAC5B,KAAI,KAAK,uBAAuB,KAC9B;AAGF,MAAK,MAAM,QAAQ,gBAAgB;EACjC,MAAM,SAAS,WAAW,MAAM,SAAS,KAAK;AAC9C,MAAI,WAAW,OAAW;AAE1B,SAAO;GAAE,MAAM,WAAW,OAAO;GAAsB;GAAM;GAAQ;;;;;;;;;;;;;;;ACtCzE,MAAa,qBAAqB,UAChC,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM;CACxB,MAAM,MAAM,EAAE,UAAU;CACxB,MAAM,MAAM,EAAE,UAAU;AAExB,KAAI,MAAM,IAAK,QAAO;AACtB,KAAI,MAAM,IAAK,QAAO;AACtB,QAAO;EACP;;;;ACEJ,MAAM,mBAAmB,SACvB,gBAAgB,KAAK,EAAE,QAAQ,EAAE;;;;;;;;;;;;;;;AAgBnC,MAAa,sBAAsB,EACjC,WACA,iBACA,2BACyC;CACzC,MAAM,YAAY,IAAI,IAAI,gBAAgB,UAAU,CAAC;CAIrD,MAAM,UAAU,kBAAkB,qBAAqB,CACpD,QACE,iBACC,aAAa,WAAW,UACxB,CAAC,gBAAgB,IAAI,aAAa,OAAO,CAC5C,CACA,KAAK,UAAU;EAAE,MAAM,gBAAgB,KAAK;EAAE;EAAM,EAAE,CACtD,QAAQ,EAAE,WAAW,KAAK,MAAM,QAAQ,UAAU,IAAI,IAAI,CAAC,CAAC;CAE/D,MAAM,CAAC,QAAQ,GAAG,QAAQ;CAC1B,MAAM,aAAa,KAChB,QAAQ,EAAE,MAAM,WAAW;EAC1B,MAAM,WAAW,IAAI,IAAI,KAAK;AAC9B,SAAO,CAAC,QAAQ,MACb,UACC,MAAM,KAAK,WAAW,KAAK,UAC3B,MAAM,KAAK,MAAM,QAAQ,SAAS,IAAI,IAAI,CAAC,CAC9C;GACD,CACD,KAAK,EAAE,WAAW,KAAK;AAE1B,QAAO;EAAE,QAAQ,QAAQ;EAAM;EAAY;;;;;;;;;;;;;;;ACjD7C,MAAa,mBAAmB,EAC9B,WACA,QACA,YACmC;AACnC,KAAI,WAAW,OAAW,QAAO,UAAU;CAE3C,MAAM,YAAY,gBAAgB,UAAU,EAAE;CAC9C,MAAM,aAAa,gBAAgB,OAAO,EAAE;CAG5C,MAAM,iBAAiB,cAAc,UAAa,cAAc;CAChE,MAAM,iBACJ,cAAc,UAAa,MAAM,QAAQ,eAAe;AAE1D,QAAO,kBAAkB,CAAC,iBAAiB,OAAO,OAAO,UAAU;;;;;;;;;;;;;;;;;;ACLrE,MAAa,0BAA0B,EACrC,WACA,iBACA,sBACA,YACkE;CAClE,MAAM,EAAE,QAAQ,eAAe,mBAAmB;EAChD;EACA;EACA;EACD,CAAC;CAEF,MAAM,eAAe,QAAQ;CAE7B,MAAMC,aAA6C,CACjD;EACE,IAAI,mCAAmC;EACvC,MAAM,eACF;GACE,GAAG;GACH,MAAM,gBAAgB;IAAE;IAAW;IAAQ;IAAO,CAAC;GACnD,QAAQ;GACT,GACD;EACL,CACF;AAED,KAAI,aACF,iBAAgB,IAAI,aAAa;AAGnC,MAAK,MAAM,EAAE,YAAY,YAAY;AACnC,kBAAgB,IAAI,OAAO;AAC3B,aAAW,KAAK;GAAE,IAAI,mCAAmC;GAAQ;GAAQ,CAAC;;AAG5E,QAAO;;;;;;;;;;;;;;;;;ACxCT,MAAa,qBAAqB,EAChC,OACA,UACA,YAC+C;CAC/C,MAAM,UAAU;EAAE;EAAO,UAAU,YAAY,EAAE;EAAE;CAEnD,MAAM,WAAW,eAAe,SAAS,QAAQ;EAC/C,MAAM,OAAO,WAAW,KAAK,UAAU;GAAE;GAAS;GAAO,CAAC;AAC1D,SAAO,OAAO,CAAC,KAAK,GAAG,EAAE;GACzB;AAQF,KANwB,SAAS,MAC9B,SACC,KAAK,aAAa,mBAAmB,SACrC,KAAK,eAAe,WACnB,KAAK,cAAc,UAAa,KAAK,UAAU,WAAW,GAC9D,CAEC,OAAM,IAAI,kBACR,0KACD;AAGH,QAAO;;;;;;;;;;;ACjCT,MAAM,sBAAsB,UAC1B,MAAM,QAAQ,MAAM,GAAG,MAAM,SAAS,IAAI,UAAU;;;;;;;;;;;;;;;;;;AAmBtD,MAAa,yBAAyB,EACpC,sBACA,YAC8C;CAC9C,MAAMC,cAA2B,EAAE,GAAG,OAAO;AAE7C,MAAK,MAAM,gBAAgB,kBAAkB,qBAAqB,EAAE;EAClE,MAAM,UAAU,gBAAgB,aAAa;EAC7C,MAAM,uBACJ,YAAY,UACZ,QAAQ,KAAK,MAAM,QAAQ,mBAAmB,MAAM,KAAK,CAAC,IAC1D,QAAQ,KAAK,MAAM,QAAQ,CAAC,mBAAmB,MAAM,KAAK,CAAC;AAC7D,MAAI,YAAY,UAAa,CAAC,qBAC5B;AAGF,OAAK,MAAM,OAAO,QAAQ,KACxB,KAAI,CAAC,mBAAmB,MAAM,KAAK,IAAI,YAAY,SAAS,OAC1D,QAAO,OAAO,aAAa,GAAG,MAAM,QAAQ,OAAO,MAAM,CAAC;;AAKhE,QAAO;;;;;;;;;;;;ACzCT,MAAa,0BACX,EAAE,iBACF,WACqC;CACrC,MAAM,EAAE,kBAAkB,QAAQ,OAAO;CACzC,MAAM,YAAY,gBAAgB,EAAE,EAAE,OAAO;AAI7C,SAAQ,cAAc,QAAtB;EACE,KAAK,UACH,QAAO,UAAU,8BAA8B;GAC7C,mBAAmB,cAAc;GACjC;GACD,CAAC;EACJ,KAAK,SACH,QAAO,UAAU,6BAA6B;GAC5C;GACA,UAAU,cAAc;GACzB,CAAC;EACJ,KAAK,SACH,QAAO,UAAU,6BAA6B;GAC5C;GACA,YAAY,cAAc;GAC1B,UAAU,cAAc;GACzB,CAAC;EACJ,SAAS;GAGP,MAAMC,iBAAwB;AAC9B,SAAM,IAAI,kBACR,6CAA6C,KAAK,UAAU,eAAe,CAAC,GAC7E;;;;;;;;ACxCP,MAAM,gBACJ,kBACuC,oBAAoB,EAAE,eAAe,CAAC;;;;;;;;;;;;AAuB/E,MAAa,sBACX,EAAE,SACF,SAAwB,kBAAkB,KAClB;AACxB,KAAI,uBAAuB,MACzB,QAAO;EAAE,mBAAmB,MAAM;EAAmB,QAAQ;EAAW;AAG1E,KAAI,cAAc,MAChB,QAAO,MAAM,eAAe,SACxB;EAAE,QAAQ;EAAU,UAAU,MAAM;EAAU,GAC9C;EACE,YAAY,MAAM;EAClB,QAAQ;EACR,UAAU,MAAM;EACjB;CAGP,MAAM,sBAAsB,kBAAkB,OAAO,CAClD,OAAO,aAAa,CACpB,MACE,kBACC,cAAc,eAAe,MAAM,cACnC,cAAc,gBAAgB,MAC3B,aAAa,SAAS,eAAe,MAAM,WAC7C,CACJ;AAEH,eACE,qBAAqB,sBACrB,kEAAkE,MAAM,WAAW,uDACpF;AAED,QAAO;EACL,YAAY,MAAM;EAClB,QAAQ;EACR,UAAU,oBAAoB;EAC/B;;;;;;;;;;;;AC5DH,MAAa,gBAAgB,EAC3B,WAAW,EAAE,EACb,gBACiC;AACjC,KAAI,SAAS,WAAW,UAAU,OAAQ,QAAO;CAEjD,MAAM,iBAAiB,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,MAAM,IAAI,EAAE;CAC1D,MAAM,kBAAkB,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,MAAM,IAAI,EAAE;AAE5D,QAAO,eAAe,OAAO,IAAI,UAAU,OAAO,gBAAgB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC+B3E,MAAa,eAAe,OAC1B,EAAE,OAAO,UAAU,OAAO,SAC1B,SAAwB,kBAAkB,KACL;CAGrC,MAAM,qBAAqB,YAAY,EAAE;CAEzC,MAAM,gBAAgB,mBAAmB,EAAE,OAAO,EAAE,OAAO;CAG3D,MAAM,yBAFQ,MAAM,uBAAuB,EAAE,eAAe,EAAE,OAAO,EAEjC,aAAa,SAAS,EAAE,EAAE,QAC3D,iBACC,aAAa,UAAU,SACvB,aAAa;EACX,UAAU,aAAa;EACvB,WAAW;EACZ,CAAC,CACL;CAGD,MAAM,gBAAgB,kBAAkB;EACtC;EACA,UAAU;EACV,OAJkB,sBAAsB;GAAE;GAAsB;GAAO,CAAC;EAKzE,CAAC;AACF,KAAI,cAAc,WAAW,EAC3B,OAAM,IAAI,kBACR,sEACD;CAKH,MAAM,kCAAkB,IAAI,KAAa;CACzC,MAAMC,aAA6C,EAAE;AAErD,MAAK,MAAM,aAAa,cACtB,YAAW,KACT,GAAG,uBAAuB;EACxB;EACA;EACA;EACA;EACD,CAAC,CACH;AAGH,QAAO,sBAAsB;EAAE;EAAY;EAAe,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;ACpErE,MAAa,kCAAkC,OAC7C,EACE,0BACA,UACA,UACA,iBAEF,SAAS,kBAAkB,KACT;AAMlB,QALiB,uCACf,EAAE,eAAe,EACjB,OACD,CAEe,4BAA4B;EAC1C;EACA;EACA;EACA;EACD,CAAC;;;;;;;;;;;;;ACxCJ,MAAa,+BACX,SAEA,OAAO,SAAS,YAAY,SAAS,QAAQ,WAAW;;;;ACP1D,MAAM,+BAA+B;;;;;;;;;;;;AAkBrC,MAAa,+BAA+B,EAC1C,sBACA,YACoE;AACpE,KAAI,MAAM,WAAW,EACnB,QAAO,EAAE;CAGX,MAAM,CAAC,aAAa;AAEpB,KAAI,4BAA4B,UAAU,CACxC,QAAQ,MAAsC,KAAK,gBAAgB;AACjE,MAAI,YAAY,UAAU,SAAS,CAAC,YAAY,cAC9C,QAAO;GACL,GAAG;GACH,eAAe,EAAE,aAAa,8BAA8B;GAC7D;AAGH,SAAO;GACP;AAGJ,QAAQ,MAAkB,KAAK,UAAU;EACvC,MAAMC,cAAyC,EAAE,OAAO;AAExD,MAAI,UAAU,MACZ,aAAY,gBAAgB,wBAAwB,EAClD,aAAa,8BACd;AAGH,SAAO;GACP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACoBJ,MAAa,2BAA2B,OACtC,EACE,QACA,UACA,4BAEF,SAAS,kBAAkB,KACT;CAClB,MAAM,yBAAyB,4BAA4B,EAAE,OAAO,QAAQ,CAAC;CAI7E,MAAM,kBAAkB;EAAC;EAAQ;EAAO;EAAO;EAAO;EAAO;EAAO;EAAO;CAE3E,MAAM,uBAAuB,uBAAuB,QAAQ,gBAC1D,gBAAgB,SAAS,YAAY,MAAM,CAC5C;AAED,KAAI,qBAAqB,WAAW,EAClC;CAGF,MAAM,oCAAoB,IAAI,KAG3B;AAEH,MAAK,MAAM,eAAe,sBAAsB;EAC9C,MAAM,oBAAoB,wBAAwB;GAChD,OAAO,YAAY;GACnB,aAAa,sBAAsB;GACnC,oBAAoB,mBAAmB;GACxC,CAAC;AAEF,MAAI,CAAC,kBAAkB,IAAI,kBAAkB,EAAE;GAC7C,MAAM,iBAAiB,uBACrB,EAAE,mBAAmB,EACrB,OACD;AAED,OAAI,CAAC,eACH,OAAM,IAAI,2BAA2B,EACnC,mBACD,CAAC;AAGJ,OAAI,CAAC,qBAAqB,eAAe,CACvC,OAAM,IAAI,2BAA2B,EACnC,mBACD,CAAC;AAGJ,qBAAkB,IAAI,mBAAmB,eAAe;;;AAI5D,OAAM,QAAQ,IACZ,qBAAqB,KAAK,gBAAgB;EACxC,MAAM,oBAAoB,wBAAwB;GAChD,OAAO,YAAY;GACnB,aAAa,sBAAsB;GACnC,oBAAoB,mBAAmB;GACxC,CAAC;EAEF,MAAM,iBAAiB,kBAAkB,IAAI,kBAAkB;AAE/D,MAAI,CAAC,kBAAkB,CAAC,qBAAqB,eAAe,CAC1D,QAAO,QAAQ,SAAS;AAG1B,SAAO,eAAe,oBAAoB;GACxC,eAAe,YAAY;GAC3B;GACA;GACD,CAAC;GACF,CACH;AAED,OAAMC,sBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;ACpH3B,MAAa,iCAAiC,OAC5C,EACE,mBACA,OACA,UACA,4BAEF,SAAS,kBAAkB,KACuB;CAGlD,MAAM,SAAS,MAFE,6BAA6B,EAAE,OAAO,EAAE,OAAO,CAElC,oBAAoB;EAChD;EACA;EACA;EACD,CAAC;AAKF,OAAMC,sBAAY,OAAO;AAEzB,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACHT,MAAa,4BAA4B,OACvC,EAAE,mBAAmB,MAAM,UAAU,aAAa,UAClD,SAAwB,kBAAkB,KACkC;CAC5E,MAAM,OAAO,QAAQ,OAAO;CAS5B,MAAM,WAAW,MARC,gBAChB,EAAE,0BAA0B,WAAW,2BAA2B,EAClE,OACD,CAKgC,gCAAgC;EAC/D;EACA,qCAAqC;GACzB;GACV;GACA,GAAG,aAAa;IAAE;IAAa;IAAQ,CAAC;GACzC;EACD,eAAe,KAAK;EACrB,CAAC;AAEF,KAAI,SAAS,IAAI,WAAW,IAC1B,QAAO,sBAAsB;EAC3B,QAAQ;EACR,UAAU,SAAS;EACpB,CAAC;AAGJ,QAAQ,MAAM,SAAS,OAAO;;;;;;;;;;;;;;;;;;AC/DhC,MAAa,wBAAwB,OACnC,EAAE,oBAAoB,UAAU,iBAChC,SAAS,kBAAkB,KACT;AAMlB,OALiB,uCACf,EAAE,eAAe,EACjB,OACD,CAEc,kBAAkB;EAC/B;EACA;EACA;EACD,CAAC;AAEF,OAAMC,sBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACU3B,MAAa,4BAA4B,OACvC,EAAE,mBAAmB,MAAM,aAAa,UACxC,SAAwB,kBAAkB,KACkC;CAC5E,MAAM,OAAO,QAAQ,OAAO;CAS5B,MAAM,WAAW,MARC,gBAChB,EAAE,0BAA0B,WAAW,2BAA2B,EAClE,OACD,CAKgC,gCAAgC;EAC/D;EACA,qCAAqC,aAAa;GAChD;GACA;GACD,CAAC;EACF,eAAe,KAAK;EACpB;EACD,CAAC;AAEF,KAAI,SAAS,IAAI,WAAW,IAC1B,QAAO,sBAAsB;EAC3B,QAAQ;EACR,UAAU,SAAS;EACpB,CAAC;AAGJ,QAAQ,MAAM,SAAS,OAAO;;;;;ACtEhC,MAAMC,qBAAkD,IAAI,IAAI,CAC9D,kBACA,0BACD,CAAC;AAOF,MAAM,aAAa,EAAE,cAAc,oBACjC,cAAc,MACX,QACC,aAAa,IAAI,IAAI,IACpB,mBAAmB,IAAI,IAAI,IAC1B,CAAC,GAAG,mBAAmB,CAAC,MAAM,eAAe,aAAa,IAAI,WAAW,CAAC,CAC/E;;;;;;;;;;AAqBH,MAAa,uBAAuB,EAClC,cACA,YAC4D;AAC5D,MAAK,MAAM,OAAO,gBAAgB;EAChC,MAAM,aAAa,WAAW,KAAK,SAAS,MAAM;AAClD,MAAI,eAAe,OAAW;AAG9B,MAAI,CAAC,UAAU;GAAE;GAAc,eADT,OAAO,KAAK,WAAW;GACC,CAAC,CAC7C,QAAO;GAAE,MAAM;GAAK;GAAY;;;;;;;ACpDtC,MAAMC,uBAA4C,IAAI,IAAI;CACxD;CACA;CACA;CACD,CAAC;;;;;;;;;;;AAaF,MAAa,8BACX,UACsC;CACtC,MAAM,YAAY;AAElB,QACE,OAAO,UAAU,WAAW,YAC5B,OAAO,UAAU,kBAAkB,YACnC,OAAO,UAAU,gBAAgB,YACjC,OAAO,KAAK,MAAM,CAAC,OAAO,QAAQ,qBAAqB,IAAI,IAAI,CAAC;;;;;;;;;;;;;;;;ACFpE,MAAa,sBAAsB,EACjC,cACwD;CACxD,MAAMC,QAAqB,EAAE;CAC7B,MAAMC,WAA6B,EAAE;CACrC,MAAM,+BAAe,IAAI,KAAqB;AAE9C,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,2BAA2B,MAAM,CACnC;AAKF,MAAI,MAAM,uBAAuB,MAAM;AACrC,YAAS,KAAK,MAAM;AACpB;;EAGF,MAAM,UAAU,oBAAoB;GAAE;GAAc;GAAO,CAAC;AAE5D,MAAI,YAAY,QAAW;AACzB,YAAS,KAAK,MAAM;AACpB;;EAGF,MAAM,EAAE,MAAM,eAAe;AAE7B,SAAO,OAAO,OAAO,WAAW;AAEhC,OAAK,MAAM,OAAO,OAAO,KAAK,WAAW,CACvC,cAAa,IAAI,IAAsB;AAKzC,MAAI,MAAM,SAAS,0BAA0B,MAC3C,OAAM,QAAQ;GAAE,GAAG,MAAM;IAAQ,OAAO,MAAM;GAAM;;AAIxD,QAAO;EAAE;EAAO;EAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC1B5B,MAAa,iCAAiC,OAC5C,EAAE,mBAAmB,cACrB,SAAwB,kBAAkB,KACwC;CAMlF,MAAM,WAAW,MALC,gBAAgB,EAAE,EAAE,OAAO,CAKZ,qCAAqC;EACpE;EACA,eAAe,QAAQ,OAAO,CAAC;EAC/B;EACD,CAAC;AAEF,KAAI,SAAS,IAAI,WAAW,KAAK;EAC/B,MAAM,UAAW,MAAM,SAAS,IAAI,MAAM;AAC1C,MAAI,QAAQ,WAAW,wBAAwB,CAAC,QAAQ,OACtD,OAAM,IAAI,+BAA+B,EACvC,SAAS,uDACV,CAAC;AAEJ,SAAO;GACL,sBAAsB,QAAQ,wBAAwB,EAAE;GACxD,QAAQ,QAAQ;GAChB;GACA,QAAQ;GACT;;AAGH,QAAQ,MAAM,SAAS,OAAO;;;;;;;;;;;;;;;;;ACtDhC,MAAa,4BAA4B,OACvC,EAAE,UAAU,iBACZ,SAAS,kBAAkB,KACT;AAMlB,QALiB,uCACf,EAAE,eAAe,EACjB,OACD,CAEe,sBAAsB;EACpC;EACA;EACD,CAAC;;;;;;;;;;;;;;;;;;ACVJ,MAAa,uBAAuB,OAClC,EAAE,kBAAkB,UAAU,iBAC9B,SAAS,kBAAkB,KACT;AAMlB,QALiB,uCACf,EAAE,eAAe,EACjB,OACD,CAEe,iBAAiB;EAC/B;EACA;EACA;EACD,CAAC;;;;;;;;;;;;;;;AChBJ,MAAa,wBAAwB,OACnC,EAAE,qBACF,SAAwB,kBAAkB,KACL;CACrC,MAAM,OAAO,QAAQ,OAAO;AAG5B,QAFkB,gBAAgB,EAAE,EAAE,OAAO,CAE5B,8BAA8B;EAC7C;EACA,eAAe,KAAK;EACrB,CAAC;;;;;;;;;;;;;ACZJ,MAAa,qBAAqB,OAChC,EAAE,qBACF,SAAwB,kBAAkB,KACP;CACnC,MAAM,OAAO,QAAQ,OAAO;AAQ5B,QALe,MAFG,gBAAgB,EAAE,EAAE,OAAO,CAEd,0BAA0B;EACvD;EACA,eAAe,KAAK;EACrB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;ACIJ,MAAa,+BAA+B,OAC1C,EAAE,qBACF,SAAwB,kBAAkB,KACH;CAGvC,MAAM,EAAE,eAAe,MAFL,gBAAgB,EAAE,EAAE,OAAO,CAEN,gCAAgC;EACrE;EACA,eAAe,QAAQ,OAAO,CAAC;EAChC,CAAC;AAEF,QAAO;;;;;;AC/BT,MAAa,iCAAiC,EAC5C,MACA,YACiD;AAQjD,QAPkC,KAAK,oBAAoB,MACxD,OACC,GAAG,mBAAmB,mBAAmB,kBACzC,GAAG,SACH,oCAAoC,GAAG,MAAM,KAAK,MACrD;;;;;;;;;;;;;ACPH,MAAa,sCACX,SAAS,kBAAkB,KACf;CACZ,MAAM,kBAAkB,OAAO;AAE/B,eAAc,iBAAiB,qCAAqC;CAEpE,MAAM,yBAAyB,gBAAgB,IAAI;CAEnD,MAAM,gBAAgB,qBAAqB,OAAO;CAElD,MAAM,OAAO,OAAO;AAEpB,KAAI,CAAC,QAAQ,CAAC,cACZ,QAAO,EAAE;AAUX,SANE,wBAAwB,qBAAqB,QAC1C,UAAU,MAAM,QAClB,IAAI,EAAE,EACP,KAAK,UAAU,MAAM,KAAc,CAGV,QACxB,UAAU,CAAC,8BAA8B;EAAE;EAAO;EAAM,CAAC,CAC3D;;;;;;;;;;;;;;;;;;;;;;ACDH,MAAa,YAAY,OACvB,EAAE,OAAO,UAAU,SACnB,SAAwB,kBAAkB,KACb;CAC7B,MAAM,qBAAqB,YAAY,EAAE;CAEzC,MAAM,QAAQ,MAAM,uBAAuB,EAAE,eADvB,mBAAmB,EAAE,OAAO,EAAE,OAAO,EACC,EAAE,OAAO;CAQrE,MAAM,EAAE,OAAO,aAAa,mBAAmB,EAAE,UANzB,MAAM,aAAa,SAAS,EAAE,EAAE,QACrD,UACC,MAAM,UAAU,SAChB,aAAa;EAAE,UAAU,MAAM;EAAU,WAAW;EAAoB,CAAC,CAC5E,EAEyE,CAAC;AAE3E,QAAO;EACL,SAAS,MAAM;EACf;EACA;EACA,WAAW,MAAM;EAClB;;;;;;;;;;;;;;;;;;;AChCH,MAAa,uBAAuB,OAClC,EAAE,YAAY,iBACd,SAAwB,kBAAkB,KACL;AACrC,eACE,cAAc,sBACd,mFACD;CAED,MAAM,OAAO,QAAQ,OAAO;AAG5B,QAFkB,gBAAgB,EAAE,EAAE,OAAO,CAE5B,6BAA6B;EAC5C,eAAe,KAAK;EACpB;EACA,UAAU,cAAc;EACzB,CAAC;;;;;;;;;;;;;;AChBJ,MAAa,6BAA6B,EACxC,oBAC6D;CAC7D,MAAMC,MAA4C,cAAc,aAC5D;EACE,YAAY,cAAc;EAC1B,cAAc,cAAc;EAC7B,GACD;AAEJ,QAAO;EACL,QAAQ,cAAc,kBAAkB,EAAE;EAC1C;EACD;;;;;;;;;;;;;;;;AClBH,MAAa,uBAAuB,OAClC,EAAE,iBACF,SAAwB,kBAAkB,KACL;AACrC,eACE,cAAc,sBACd,mFACD;CAED,MAAM,OAAO,QAAQ,OAAO;AAG5B,QAFkB,gBAAgB,EAAE,EAAE,OAAO,CAE5B,6BAA6B;EAC5C,eAAe,KAAK;EACpB,UAAU,cAAc;EACzB,CAAC;;;;;;;;;;;;;ACnBJ,MAAa,yBAAyB,OACpC,EAAE,iBACF,SAAwB,kBAAkB,KACT;AAMjC,QALiB,uCACf,EAAE,eAAe,EACjB,OACD,CAEe,uBAAuB,EACrC,eACD,CAAC;;;;;;;;;;;;;ACXJ,MAAa,sBACX,EAAE,iBACF,SAAS,kBAAkB,KACf;CACZ,MAAM,qBAAqB,sCACzB,EAAE,eAAe,EACjB,OACD;AAED,eACE,oBACA,wDACD;CAED,MAAM,uBACJ,mBAAmB,kBAAkB,WAAW,MAC7C,aAAa,SAAS,mBAAmB,YAC3C;CAEH,MAAM,uBACJ,mBAAmB,kBAAkB,gBAAgB,MAClD,aAAa,SAAS,iBAAiB,uBAAuB,UAChE;AAEH,QAAO,QAAQ,wBAAwB,qBAAqB;;;;;;;;;;;;;;;;;;AClB9D,MAAa,uBAAuB,OAClC,EAAE,OAAO,YAAY,4BACrB,SAAS,kBAAkB,KACT;AAGlB,QAFiB,6BAA6B,EAAE,OAAO,EAAE,OAAO,CAEhD,iBAAiB;EAC/B;EACA;EACD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACNJ,MAAa,mCACX,WAEA,YAAY,WACX,OAAO,WAAW,qBACjB,OAAO,WAAW;;;;;;;;;;;;;;;ACnBtB,MAAa,oCACX,SAAS,kBAAkB,KACf;CACZ,MAAM,EAAE,SAAS;AAEjB,eAAc,MAAM,4BAA4B;AAEhD,QAAO,KAAK,oBAAoB,MAAM,eACpC,WAAW,kBAAkB,WAAW,MACrC,aAAa,SAAS,kBACxB,CACF;;;;;;;;;;;;;;;;;;;;;;ACKH,MAAa,+BAA+B,OAC1C,EAAE,mBAAmB,UACrB,SAAwB,kBAAkB,KACH;AAWvC,QARkB,MAFA,gBAAgB,EAAE,EAAE,OAAO,CAEX,gCAAgC;EAChE;EACA,eAAe,QAAQ,OAAO,CAAC;EAC/B,QAAQ,SAAS,8BAA8B,UAAU;EAC1D,CAAC;;;;;;;;;;;;;;;;;;;;;;ACjBJ,MAAa,iDAAiD,OAC5D,SAAwB,kBAAkB,KACH;AAUvC,QANE,MAHgB,gBAAgB,EAAE,EAAE,OAAO,CAG3B,gDAAgD,EAC9D,eAAe,QAAQ,OAAO,CAAC,eAChC,CAAC;;;;;;;;;;;;;;;;;;;;;;;ACHN,MAAa,2BAA2B,OACtC,EAAE,qBACF,SAAwB,kBAAkB,KACE;CAG5C,MAAM,EAAE,UAAU,MAFA,gBAAgB,EAAE,EAAE,OAAO,CAEX,4BAA4B;EAC5D;EACA,eAAe,QAAQ,OAAO,CAAC;EAChC,CAAC;AAIF,QAAO;;;;;;;;;;;;;;;AChBT,MAAa,uBAAuB,OAClC,QACA,SAAwB,kBAAkB,KACT;CACjC,MAAM,OAAO,QAAQ,OAAO;AAQ5B,QALe,MAFG,gBAAgB,EAAE,EAAE,OAAO,CAEd,wBAAwB;EACrD,eAAe,KAAK;EACpB,aAAa,QAAQ;EACtB,CAAC;;;;;;;;;;;;;;;;;ACdJ,MAAa,iCAAiC,OAC5C,EAAE,eAAe,YACjB,SAAS,kBAAkB,KACT;AAMlB,QALiB,uCACf,EAAE,eAAe,EACjB,OACD,CAEe,2BAA2B;EACzC;EACA;EACD,CAAC;;;;;;;;;;;;;;;;ACTJ,MAAa,0BAA0B,OACrC,EAAE,mBAAmB,UACrB,SAAwB,kBAAkB,KACL;CACrC,MAAM,OAAO,QAAQ,OAAO;AAG5B,QAFkB,gBAAgB,EAAE,EAAE,OAAO,CAE5B,iCAAiC;EAChD;EACA,eAAe,KAAK;EACpB,8BAA8B;GAC5B,IAAI,mCAAmC;GACvC;GACD;EACF,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACeJ,MAAa,8BAA8B,OACzC,EAAE,mBAAmB,QAAQ,aAAa,UAC1C,SAAwB,kBAAkB,KACyB;CACnE,MAAM,OAAO,QAAQ,OAAO;CAS5B,MAAM,WAAW,MARC,gBAChB,EAAE,0BAA0B,WAAW,6BAA6B,EACpE,OACD,CAKgC,kCAAkC;EACjE;EACA,eAAe,KAAK;EACpB,uCAAuC,aAAa;GAClD;GACA;GACD,CAAC;EACF;EACD,CAAC;AAEF,KAAI,SAAS,IAAI,WAAW,IAC1B,QAAO,sBAAsB;EAC3B,QAAQ;EACR,UAAU,SAAS;EACpB,CAAC;CAGJ,MAAM,EAAE,WAAW,MAAM,SAAS,OAAO;AACzC,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC3BT,MAAa,8BAA8B,OACzC,EAAE,mBAAmB,UAAU,UAAU,aAAa,UACtD,SAAwB,kBAAkB,KACyB;CACnE,MAAM,OAAO,QAAQ,OAAO;CAS5B,MAAM,WAAW,MARC,gBAChB,EAAE,0BAA0B,WAAW,6BAA6B,EACpE,OACD,CAKgC,kCAAkC;EACjE;EACA,eAAe,KAAK;EACpB,uCAAuC,aAAa;GAClD;GACA;GACD,CAAC;EACF;EACA;EACD,CAAC;AAEF,KAAI,SAAS,IAAI,WAAW,IAC1B,QAAO,sBAAsB;EAC3B,QAAQ;EACR,UAAU,SAAS;EACpB,CAAC;CAGJ,MAAM,EAAE,WAAW,MAAM,SAAS,OAAO;AACzC,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACrCT,MAAa,8BAA8B,OACzC,EAAE,mBAAmB,UAAU,aAAa,UAC5C,SAAwB,kBAAkB,KACyB;CACnE,MAAM,OAAO,QAAQ,OAAO;CAU5B,MAAM,WAAW,MATC,gBAChB,EAAE,0BAA0B,WAAW,6BAA6B,EACpE,OACD,CAMgC,kCAAkC;EACjE;EACA,eAAe,KAAK;EACpB,uCAAuC,aAAa;GAClD;GACA;GACD,CAAC;EACF;EACD,CAAC;AAEF,KAAI,SAAS,IAAI,WAAW,IAC1B,QAAO,sBAAsB;EAC3B,QAAQ;EACR,UAAU,SAAS;EACpB,CAAC;CAGJ,MAAM,SAAS,MAAM,SAAS,OAAO;AAIrC,OAAMC,sBAAY,OAAO;AAEzB,QAAO;;;;;;;;;;;;;;;;;;;;ACzDT,MAAa,iCAAiC,EAC5C,OACA,UACA,cACA,YACmF;AAEnF,KAAI,aAAa,WAAW,OAC1B;CAGF,MAAM,UAAU,gBAAgB,aAAa;AAC7C,KAAI,YAAY,OACd;CAGF,MAAM,gBAAgB,QAAQ,KAAK,QAAQ,QAAQ,CAAC,MAAM,SAAS,IAAI,CAAC;AACxE,KAAI,cAAc,WAAW,QAAQ,KAAK,OACxC;AAGF,KAAI,cAAc,WAAW,EAC3B,QAAO;EACL,IAAI,mCAAmC;EACvC,QAAQ,aAAa;EACtB;CAGH,MAAMC,iBAA8B,EAAE;AACtC,MAAK,MAAM,OAAO,cAChB,QAAO,OAAO,gBAAgB,GAAG,MAAM,QAAQ,OAAO,MAAM,CAAC;CAG/D,MAAM,CAAC,eAAe,kBAAkB;EAAE;EAAO;EAAU,OAAO;EAAgB,CAAC;AACnF,KAAI,gBAAgB,OAClB;CAKF,MAAM,YADc,gBAAgB,YAAY,EAAE,SAChB,QAAQ;AAE1C,QAAO;EACL,IAAI,mCAAmC;EACvC,MAAM;GACJ,GAAG;GACH,MAAM,YAAa,aAAa,QAAQ,YAAY,OAAQ,YAAY;GACxE,QAAQ,aAAa;GACtB;EACF;;;;;;;;;;;;;;;;;;;;;;;AC5CH,MAAa,oBAAoB,OAC/B,EAAE,OAAO,UAAU,OAAO,SAC1B,SAAwB,kBAAkB,KACL;CACrC,MAAM,qBAAqB,YAAY,EAAE;CACzC,MAAM,gBAAgB,mBAAmB,EAAE,OAAO,EAAE,OAAO;CAe3D,MAAM,eAdQ,MAAM,uBAAuB,EAAE,eAAe,EAAE,OAAO,EAEjC,aAAa,SAAS,EAAE,EAAE,QAC3D,iBACC,aAAa,UAAU,SACvB,aAAa;EACX,UAAU,aAAa;EACvB,WAAW;EACZ,CAAC,CACL,CAME,KAAK,iBACJ,8BAA8B;EAC5B;EACA,UAAU;EACV;EACA;EACD,CAAC,CACH,CACA,QAAQ,cAAc,cAAc,OAAU;AAEjD,KAAI,WAAW,WAAW,EACxB,OAAM,IAAI,kBACR,yFACD;AAGH,QAAO,sBAAsB;EAAE;EAAY;EAAe,EAAE,OAAO;;;;;;;;;;;;;;;;;;AC5CrE,MAAa,yBAAyB,OACpC,EAAE,QAAQ,YAAY,iBACtB,SAAwB,kBAAkB,KACL;AACrC,eACE,cAAc,sBACd,qFACD;CAED,MAAM,OAAO,QAAQ,OAAO;AAG5B,QAFkB,gBAAgB,EAAE,EAAE,OAAO,CAE5B,gCAAgC;EAC/C,eAAe,KAAK;EACpB,oCAAoC;GAClC,IAAI,yCAAyC;GAC7C;GACA;GACD;EACD,UAAU,cAAc;EACzB,CAAC;;;;;;;;;;;;;;;;;ACvBJ,MAAa,yBAAyB,OACpC,EAAE,QAAQ,iBACV,SAAwB,kBAAkB,KACL;AACrC,eACE,cAAc,sBACd,qFACD;CAED,MAAM,OAAO,QAAQ,OAAO;AAG5B,QAFkB,gBAAgB,EAAE,EAAE,OAAO,CAE5B,gCAAgC;EAC/C,eAAe,KAAK;EACpB,8BAA8B;GAC5B,IAAI,mCAAmC;GACvC;GACD;EACD,UAAU,cAAc;EACzB,CAAC;;;;;;;;;;;;;;AC3BJ,MAAa,uBAAuB,OAClC,EAAE,UAAU,iBACZ,SAAS,kBAAkB,KACT;AAMlB,OALiB,uCACf,EAAE,eAAe,EACjB,OACD,CAEc,iBAAiB;EAC9B;EACA;EACD,CAAC;AAEF,OAAMC,sBAAY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC8B3B,MAAa,+BAA+B,OAC1C,EAAE,mBAAmB,YAAY,aAAa,UAC9C,SAAwB,kBAAkB,KACkC;CAC5E,MAAM,OAAO,QAAQ,OAAO;CAS5B,MAAM,WAAW,MARC,gBAChB,EAAE,0BAA0B,WAAW,iCAAiC,EACxE,OACD,CAKgC,mCAAmC;EAClE;EACA,eAAe,KAAK;EACpB,wCAAwC;GAI1B;GACZ,GAAG,aAAa;IAAE;IAAa;IAAQ,CAAC;GACzC;EACF,CAAC;AAEF,KAAI,SAAS,IAAI,WAAW,IAC1B,QAAO,sBAAsB;EAC3B,QAAQ;EACR,UAAU,SAAS;EACpB,CAAC;AAGJ,QAAQ,MAAM,SAAS,OAAO;;;;;;;;;;;;;;AC7EhC,MAAa,+BAA+B,OAC1C,EAAE,UAAU,iBACZ,SAAS,kBAAkB,KACT;AAMlB,QALiB,uCACf,EAAE,eAAe,EACjB,OACD,CAEe,6BAA6B;EAC3C;EACA;EACD,CAAC;;;;;;ACtBJ,MAAa,yBAAyB,SAAwB;AAO5D,QAN0B,MAAM,oBAAoB,MACjD,OACC,GAAG,WAAW,gCAAgC,cAC9C,GAAG,mBAAmB,mBAAmB,eAC5C;;;;;;;;;;;;;;;;;ACSH,MAAa,kCACX,EAAE,SACF,SAAS,kBAAkB,KACf;AACZ,eAAc,OAAO,iBAAiB,qCAAqC;CAE3E,MAAM,yBAAyB,OAAO,gBAAgB,IAAI;AAK1D,KAAI,CAFF,wBAAwB,mCAEqB,CAAC,OAAO,KACrD,QAAO;CAGT,MAAM,oDACJ,wBAAwB;AAQ1B,KAAI,EAHF,CAAC,sBAAsB,OAAO,KAAK,IACnC,mDAGA,QAAO;AAMT,QAFE,mCAAmC,OAAO,CAEN,SAAS,MAAM;;;;;;;;;;;;;;;;AC7BvD,MAAa,4BAA4B,OACvC,EAAE,SAAS,uBAAuB,iBAClC,SAAwB,kBAAkB,KACG;AAM7C,QALiB,uCACf,EAAE,eAAe,EACjB,OACD,CAEe,0BAA0B;EACxC;EACA;EACA;EACD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACgBJ,MAAa,mCAAmC,OAC9C,EAAE,mBAAmB,gBAAgB,aAAa,UAClD,SAAwB,kBAAkB,KACyB;CACnE,MAAM,OAAO,QAAQ,OAAO;CAU5B,MAAM,WAAW,MATC,gBAChB,EAAE,0BAA0B,WAAW,kCAAkC,EACzE,OACD,CAMgC,uCAAuC;EACtE;EACA,eAAe,KAAK;EACpB,4CAA4C;GAC1C;GACA,GAAG,aAAa;IAAE;IAAa;IAAQ,CAAC;GACzC;EACF,CAAC;AAEF,KAAI,SAAS,IAAI,WAAW,IAC1B,QAAO,sBAAsB;EAC3B,QAAQ;EACR,UAAU,SAAS;EACpB,CAAC;CAGJ,MAAM,SAAS,MAAM,SAAS,OAAO;AAKrC,OAAMC,2BACJ,EAAE,QAAQ,0CAA0C,EACpD,OACD;AAED,QAAO;;;;;;;;;;;;;;ACzET,MAAa,eAAe,OAC1B,EAAE,UAAU,iBACZ,SAAS,kBAAkB,KACI;AAM/B,QALiB,uCACf,EAAE,eAAe,EACjB,OACD,CAEe,aAAa;EAC3B;EACA;EACD,CAAC;;;;;;;;;;;;;;;;;;;;;;ACJJ,MAAa,wBAAwB,OACnC,EAAE,mBAAmB,gBACrB,SAAwB,kBAAkB,KACb;CAC7B,MAAM,OAAO,QAAQ,OAAO;AAS5B,QANgB,MAFE,gBAAgB,EAAE,EAAE,OAAO,CAEb,yBAAyB;EACvD;EACA,eAAe,KAAK;EACpB,iCAAiC,EAAE,cAAM;EAC1C,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC8BJ,MAAa,kCAAkC,OAC7C,EAAE,mBAAmB,QAAQ,MAAM,aAAa,UAChD,SAAwB,kBAAkB,KACyB;CACnE,MAAM,OAAO,QAAQ,OAAO;CAS5B,MAAM,WAAW,MARC,gBAChB,EAAE,0BAA0B,WAAW,iCAAiC,EACxE,OACD,CAKgC,sCAAsC;EACrE;EACA,eAAe,KAAK;EACpB,2CAA2C;GAGnC;GACN,GAAG,aAAa;IAAE;IAAa;IAAQ,CAAC;GACzC;EACD;EACD,CAAC;AAEF,KAAI,SAAS,IAAI,WAAW,IAC1B,QAAO,sBAAsB;EAC3B,QAAQ;EACR,UAAU,SAAS;EACpB,CAAC;AAGJ,QAAQ,MAAM,SAAS,OAAO;;;;;;;;;;;;;;;;;;AC9EhC,MAAa,qBAAqB,OAChC,EAAE,iBAAiB,aAAa,iBAChC,SAAS,kBAAkB,KACT;AAMlB,QALiB,uCACf,EAAE,eAAe,EACjB,OACD,CAEe,eAAe;EAC7B;EACA;EACA;EACD,CAAC;;;;;;;;;;;;;;;;;;;;ACLJ,MAAa,0BAA0B,OACrC,EAAE,mBAAmB,QACrB,SAAwB,kBAAkB,KACL;CACrC,MAAM,OAAO,QAAQ,OAAO;AAG5B,QAFkB,gBAAgB,EAAE,EAAE,OAAO,CAE5B,iCAAiC;EAChD;EACA,eAAe,KAAK;EACpB,8BAA8B;GAC5B,IAAI,mCAAmC;GACvC;GACD;EACF,CAAC;;;;;;;;;;;;;;;;;;;;;ACTJ,MAAa,yBAAyB,OACpC,EAAE,MAAM,YAAY,iBACpB,SAAwB,kBAAkB,KACL;AACrC,eACE,cAAc,sBACd,qFACD;CAED,MAAM,OAAO,QAAQ,OAAO;AAG5B,QAFkB,gBAAgB,EAAE,EAAE,OAAO,CAE5B,gCAAgC;EAC/C,eAAe,KAAK;EACpB,oCAAoC;GAClC,IAAI,yCAAyC;GAC7C;GACA;GACD;EACD,UAAU,cAAc;EACzB,CAAC;;;;;;;;;;;;;;;;;;;;ACvBJ,MAAa,yBAAyB,OACpC,EAAE,MAAM,iBACR,SAAwB,kBAAkB,KACL;AACrC,eACE,cAAc,sBACd,qFACD;CAED,MAAM,OAAO,QAAQ,OAAO;AAG5B,QAFkB,gBAAgB,EAAE,EAAE,OAAO,CAE5B,gCAAgC;EAC/C,eAAe,KAAK;EACpB,8BAA8B;GAC5B,IAAI,mCAAmC;GACvC;GACD;EACD,UAAU,cAAc;EACzB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;ACnBJ,MAAa,8BAA8B,OACzC,EAAE,mBAAmB,cACrB,SAAwB,kBAAkB,KACL;AAcrC,QARe,MALG,gBAChB,EAAE,0BAA0B,WAAW,6BAA6B,EACpE,OACD,CAE8B,+BAA+B;EAC5D;EACA,eAAe,QAAQ,OAAO,CAAC;EAC/B;EACD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;ACfJ,MAAa,0CAA0C,OACrD,EAAE,mBAAmB,cACrB,SAAwB,kBAAkB,KACL;AAWrC,QARe,MAFG,gBAAgB,EAAE,EAAE,OAAO,CAEd,2CAA2C;EACxE;EACA,eAAe,QAAQ,OAAO,CAAC;EAC/B;EACD,CAAC;;;;;ACnCJ,qBAAqBC,MAAaC,QAAe"}