Embedded wallets (WaaS): MPC wallet creation and signing through the injected WaasEngine (hidden-webview reference implementation). Wallet enumeration: filter user.verifiedCredentials by walletProvider == embeddedWallet.
Implemented by WaasClientImpl; hosts can substitute this interface in tests.
createOfflineRecoveryShares' payload: mints a second, independent 2-of-2 offline-recovery share set — the client half uploads to Google Drive, the server half to the developer's webhook.
Optional WaaS security configuration, passed to UseWaas/useWaas at install time. Native-side only: never sent over the wire, never read by any flow — each platform host reads it directly when constructing its WaaS engine.
One rule on a wallet-, signer-, or account-policy-Layer (dynamic-labs sdk-api-core's WaasPolicyRule) — shared verbatim by request and response bodies (the response's own WaasPolicyLayerResponseRule differs only in making ruleId required, not worth splitting into a second model here). Omit ruleId to create a new rule (the enclave mints one); pass an existing id to update it in place. Deliberately does NOT model contractAbi (Array
Value cap carried on a WaasPolicyRule. asset omitted means the native asset of the rule's own chain; maxPerCall/totalLimit are decimal strings (smallest unit, e.g. wei) — same convention as every other on-chain amount in this DSL, to survive round-tripping without precision loss.
refreshWalletAccountShares' payload: reshares the client key share in place (same threshold signature scheme, new share material) without changing the share set's identity or role.
signTransaction's payload. Note senderAddress: this one call names the signing address differently from every other, and that is the page's own spelling.
getWalletAccountShareSets' result: this wallet account's own share set (absent for a non-WaaS wallet or one that carries no share-set data) and every other active share set on the same wallet. No network request — read straight off the already-fetched VerifiedCredential.
Whether an embedded wallet's client key share is password-encrypted at rest and, if so, whether this session still needs unlockWallet(...) before signing will succeed. walletReadyState: 'ready' | 'encrypted'.
Post-ceremony locking policy for create, import, and signing operations. Excludes unlock and password changes. Set once through WaasOptions at installation, not per call.
