@ledgerhq/revault-sdk 0.24.0 → 0.25.0

package/lib/bake.cjs

@@ -299,6 +299,7 @@ async function bakeWorkspace(options, logger) {
     existingWhitelists,
     existingPolicies,
     existingAccounts,
+    existingEntities,
     tradelinkNetworkBlueprint
   ] = await Promise.all([
     _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin1.client.users.list.query, { status: "ACTIVE" }),
@@ -306,6 +307,7 @@ async function bakeWorkspace(options, logger) {
     _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin1.client.whitelists.list.query, { status: "ACTIVE" }),
     _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin1.client.policies.list.query, { isPrivate: false }),
     _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin1.client.accounts.list.query, { status: "ACTIVE" }),
+    _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin1.client.entities.list.query, { status: "ACTIVE" }),
     admin1.client.tradelink.getNetworkBlueprint.query()
   ]);
   const tradelinkOrgExchangesByName = _lodash2.default.keyBy(_optionalChain([tradelinkNetworkBlueprint, 'optionalAccess', _7 => _7.exchanges]), "name");
@@ -364,19 +366,74 @@ async function bakeWorkspace(options, logger) {
       await createAccount(account, workspace);
     }
   }
+  if (workspace.entities) {
+    logTitle("Entities");
+    for (const entity of workspace.entities) {
+      await createEntity(entity);
+    }
+  }
+  async function editDomainObjectIfNeeded(params) {
+    const previousRequests = await admin1.client.requests.list.query({
+      type: params.requestTypes,
+      targetId: params.existingId,
+      state: "EXECUTED",
+      sortBy: "createdAt",
+      sortOrder: "desc",
+      pageSize: 1
+    });
+    if (_optionalChain([previousRequests, 'optionalAccess', _9 => _9.results]) && previousRequests.results.length > 0) {
+      const stateRequest = previousRequests.results[0];
+      _invariant2.default.call(void 0, 
+        stateRequest && params.requestTypes.includes(stateRequest.type),
+        `State request should be a ${params.requestTypes[0]} or ${params.requestTypes[1]} request`
+      );
+      const lastData = params.extractLastData(stateRequest.data);
+      if (_lodash2.default.isEqual(stripUndefinedDeep(params.editData), stripUndefinedDeep(lastData))) {
+        logger.info(`[SKIPPED] ${params.entityType} "${params.entityName}" has not changed`);
+        return "skipped";
+      }
+    }
+    logStep(`Editing ${params.entityType.toLowerCase()} "${params.entityName}"...`);
+    await createAndApproveRequest(params.editInput, [admin1, admin2], logger);
+    logger.info(`[EDITED] ${params.entityType} "${params.entityName}" has been edited`);
+    return "edited";
+  }
   async function createWhitelists(whitelists) {
     for (const whitelist of whitelists) {
       await createWhitelist(whitelist);
     }
     async function createWhitelist(whitelist) {
       const existing = existingWhitelists.find((w) => w.name === whitelist.name);
+      const normalizeAddresses = (addresses) => addresses.map(({ destinationTags, ...rest }) => ({
+        ...rest,
+        ..._optionalChain([destinationTags, 'optionalAccess', _10 => _10.length]) ? { destinationTags } : {}
+      }));
+      const whitelistEditData = {
+        name: whitelist.name,
+        addresses: normalizeAddresses(whitelist.addresses)
+      };
       if (existing) {
-        logger.info(`[SKIPPED] Whitelist "${whitelist.name}" already exists`);
+        await editDomainObjectIfNeeded({
+          entityType: "Whitelist",
+          entityName: whitelist.name,
+          existingId: existing.id,
+          editInput: {
+            type: "EDIT_WHITELIST",
+            targetId: existing.id,
+            data: { name: whitelist.name, addresses: whitelist.addresses }
+          },
+          editData: whitelistEditData,
+          requestTypes: ["CREATE_WHITELIST", "EDIT_WHITELIST"],
+          extractLastData: (data) => ({
+            name: data.name,
+            addresses: normalizeAddresses(data.addresses)
+          })
+        });
         return;
       }
       const input = {
         type: "CREATE_WHITELIST",
-        data: whitelist
+        data: { ...whitelist, description: _nullishCoalesce(whitelist.description, () => ( null)) }
       };
       const req = await createAndApproveRequest(input, [admin1, admin2], logger);
       logSubStep(`Whitelist "${whitelist.name}" has been created`);
@@ -400,7 +457,7 @@ async function bakeWorkspace(options, logger) {
         };
       }),
       threshold: rule.threshold,
-      whitelistIds: _optionalChain([rule, 'access', _9 => _9.whitelistNames, 'optionalAccess', _10 => _10.map, 'call', _11 => _11(whitelistIdFromName)])
+      whitelistIds: _optionalChain([rule, 'access', _11 => _11.whitelistNames, 'optionalAccess', _12 => _12.map, 'call', _13 => _13(whitelistIdFromName)])
     };
   }
   function rawSigningRuleFromManifest(rule) {
@@ -414,7 +471,6 @@ async function bakeWorkspace(options, logger) {
     };
   }
   async function createAccount(account, workspace2) {
-    let req = null;
     const existing = existingAccounts.find(
       (a) => a.currency === account.currency && a.index === account.index && (_nullishCoalesce(a.contractAddress, () => ( null))) === (_nullishCoalesce(account.contractAddress, () => ( null)))
     );
@@ -444,58 +500,41 @@ async function bakeWorkspace(options, logger) {
       index: account.index,
       governance
     };
-    const createInput = {
-      type: "CREATE_ACCOUNT",
-      data: accountData
-    };
     if (existing) {
-      const editInput = {
-        type: "EDIT_ACCOUNT",
-        targetId: existing.id,
-        data: { name: accountData.name, governance }
-      };
-      const previousAccountRequests = await admin1.client.requests.list.query({
-        type: ["CREATE_ACCOUNT", "EDIT_ACCOUNT"],
-        targetId: existing.id,
-        state: "EXECUTED",
-        sortBy: "createdAt",
-        sortOrder: "desc"
+      const editData = { name: accountData.name, governance };
+      const result = await editDomainObjectIfNeeded({
+        entityType: "Account",
+        entityName: account.name,
+        existingId: existing.id,
+        editInput: { type: "EDIT_ACCOUNT", targetId: existing.id, data: editData },
+        editData,
+        requestTypes: ["CREATE_ACCOUNT", "EDIT_ACCOUNT"],
+        extractLastData: (data) => ({ name: data.name, governance: data.governance })
       });
-      if (_optionalChain([previousAccountRequests, 'optionalAccess', _12 => _12.results]) && previousAccountRequests.results.length > 0) {
-        const stateRequest = _optionalChain([previousAccountRequests, 'access', _13 => _13.results, 'optionalAccess', _14 => _14[0]]);
-        _invariant2.default.call(void 0, 
-          stateRequest && (stateRequest.type === "EDIT_ACCOUNT" || stateRequest.type === "CREATE_ACCOUNT"),
-          "State request should be an edit account request"
-        );
-        if (_lodash2.default.isEqual(
-          stripUndefinedDeep(accountData.governance),
-          stripUndefinedDeep(stateRequest.data.governance)
-        ) && accountData.name === stateRequest.data.name) {
-          logger.info(`[SKIPPED] Account "${account.name}" has not changed`);
-          await activateHederaAccount(account, workspace2, existing.id);
-          return;
-        }
-        req = await createAndApproveRequest(editInput, [admin1, admin2], logger);
-        logger.info(`[EDITED] Account "${account.name}" has been edited`);
-        return;
+      if (result === "skipped") {
+        await activateHederaAccount(account, workspace2, existing.id);
       }
-    } else {
-      logStep(`Creating account "${account.name}"`);
-      req = await createAndApproveRequest(createInput, [admin1, admin2], logger);
-      const createdAccount = await admin1.client.accounts.findById.query({ id: req.targetId });
-      existingAccounts.push(createdAccount);
+      return;
     }
-    if (account.governance.type === "TRADELINK" && req) {
+    logStep(`Creating account "${account.name}"`);
+    const createInput = {
+      type: "CREATE_ACCOUNT",
+      data: accountData
+    };
+    const req = await createAndApproveRequest(createInput, [admin1, admin2], logger);
+    const createdAccount = await admin1.client.accounts.findById.query({ id: req.targetId });
+    existingAccounts.push(createdAccount);
+    if (account.governance.type === "TRADELINK") {
       logStep(`Activating tradelink account "${account.name}"`);
       const assetManagerId = assetManagerIdFromName(account.governance.assetManager);
-      const assetManager = _optionalChain([existingTradelinkNetwork, 'optionalAccess', _15 => _15.assetManagers, 'access', _16 => _16.find, 'call', _17 => _17(
+      const assetManager = _optionalChain([existingTradelinkNetwork, 'optionalAccess', _14 => _14.assetManagers, 'access', _15 => _15.find, 'call', _16 => _16(
         (assetManager2) => assetManager2.id === assetManagerId
       )]);
       _invariant2.default.call(void 0, assetManager, `Asset manager for account exists`);
       const loggedAssetManagerOperators = await Promise.all(
         assetManager.groups.flatMap(
           ({ quorum, userIds }) => userIds.slice(0, quorum).map((userId) => {
-            const deviceIndex = _optionalChain([usersWithDeviceIndex, 'access', _18 => _18.find, 'call', _19 => _19((o) => o.user.id === userId), 'optionalAccess', _20 => _20.deviceIndex]);
+            const deviceIndex = _optionalChain([usersWithDeviceIndex, 'access', _17 => _17.find, 'call', _18 => _18((o) => o.user.id === userId), 'optionalAccess', _19 => _19.deviceIndex]);
             return workspaceEngine.withDeviceIndex(deviceIndex).login();
           })
         )
@@ -506,7 +545,7 @@ async function bakeWorkspace(options, logger) {
         logger
       );
     }
-    if (_optionalChain([req, 'optionalAccess', _21 => _21.targetId])) {
+    if (req.targetId) {
       await activateHederaAccount(account, workspace2, req.targetId);
     }
     logSubStep(`Account ${account.name} has been created`);
@@ -515,7 +554,7 @@ async function bakeWorkspace(options, logger) {
     if (account.currency === "hedera" && account.contractAddress === void 0 && workspace2.hederaData && accountId) {
       const salt = engine.__options.salt;
       const hederaAccountsForSalt = workspace2.hederaData[salt];
-      const hederaAccountData = _optionalChain([hederaAccountsForSalt, 'optionalAccess', _22 => _22.find, 'call', _23 => _23(
+      const hederaAccountData = _optionalChain([hederaAccountsForSalt, 'optionalAccess', _20 => _20.find, 'call', _21 => _21(
         (h) => h.index === account.index && h.activate
       )]);
       if (hederaAccountData) {
@@ -601,21 +640,30 @@ async function bakeWorkspace(options, logger) {
   }
   async function createGroup(group) {
     const existing = existingGroups.find((g) => g.name === group.name);
+    const members = group.members.map(userIdFromDeviceIndexOrName);
+    const groupData = {
+      name: group.name,
+      description: "",
+      members
+    };
     if (existing) {
-      logger.info(`[SKIPPED] Group "${group.name}" already exists`);
+      await editDomainObjectIfNeeded({
+        entityType: "Group",
+        entityName: group.name,
+        existingId: existing.id,
+        editInput: { type: "EDIT_GROUP", targetId: existing.id, data: groupData },
+        editData: groupData,
+        requestTypes: ["CREATE_GROUP", "EDIT_GROUP"],
+        extractLastData: (data) => ({ ...data, description: _nullishCoalesce(data.description, () => ( "")) })
+      });
       return;
     }
     logStep(`Creating group ${group.name}...`);
-    const members = group.members.map(userIdFromDeviceIndexOrName);
     logSubStep("Creating request...");
     let request = await admin1.client.requests.create.mutate({
       request: {
         type: "CREATE_GROUP",
-        data: {
-          name: group.name,
-          description: "",
-          members
-        }
+        data: groupData
       }
     });
     request = await approveRequest(request, [admin1, admin2], logger);
@@ -625,8 +673,25 @@ async function bakeWorkspace(options, logger) {
   }
   async function createPolicy(policy) {
     const existing = existingPolicies.find((p) => p.name === policy.name);
+    const policyEditData = {
+      name: policy.name,
+      description: "",
+      govRules: policy.rules.map(govRuleFromManifest)
+    };
     if (existing) {
-      logger.info(`[SKIPPED] Policy "${policy.name}" already exists`);
+      await editDomainObjectIfNeeded({
+        entityType: "Policy",
+        entityName: policy.name,
+        existingId: existing.id,
+        editInput: { type: "EDIT_POLICY", targetId: existing.id, data: policyEditData },
+        editData: policyEditData,
+        requestTypes: ["CREATE_POLICY", "EDIT_POLICY"],
+        extractLastData: (data) => ({
+          name: data.name,
+          description: _nullishCoalesce(data.description, () => ( "")),
+          govRules: data.govRules
+        })
+      });
       return;
     }
     logStep(`Creating policy ${policy.name}...`);
@@ -635,10 +700,8 @@ async function bakeWorkspace(options, logger) {
       request: {
         type: "CREATE_POLICY",
         data: {
-          name: policy.name,
-          currency: policy.currency,
-          description: "",
-          govRules: policy.rules.map(govRuleFromManifest)
+          ...policyEditData,
+          currency: policy.currency
         }
       }
     });
@@ -662,6 +725,37 @@ async function bakeWorkspace(options, logger) {
     await createAndApproveRequest(input, [admin1, admin2], logger);
     logSubStep(`Workspace rule for "${permission}" has been edited`);
   }
+  async function createEntity(entity) {
+    const existing = existingEntities.find((e) => e.name === entity.name);
+    const accountIds = (_nullishCoalesce(entity.accounts, () => ( []))).map(accountIdFromName);
+    const memberIds = (_nullishCoalesce(entity.members, () => ( []))).map(userIdFromUserName);
+    const entityEditData = { name: entity.name, accountIds, memberIds };
+    if (existing) {
+      await editDomainObjectIfNeeded({
+        entityType: "Entity",
+        entityName: entity.name,
+        existingId: existing.id,
+        editInput: { type: "EDIT_ENTITY", targetId: existing.id, data: entityEditData },
+        editData: entityEditData,
+        requestTypes: ["CREATE_ENTITY", "EDIT_ENTITY"],
+        extractLastData: (data) => ({
+          name: data.name,
+          accountIds: data.accountIds,
+          memberIds: data.memberIds
+        })
+      });
+      return;
+    }
+    logStep(`Creating entity "${entity.name}"...`);
+    const input = {
+      type: "CREATE_ENTITY",
+      data: entityEditData
+    };
+    const request = await createAndApproveRequest(input, [admin1, admin2], logger);
+    logSubStep(`Entity "${entity.name}" has been created`);
+    const createdEntity = await admin1.client.entities.findById.query({ id: request.targetId });
+    existingEntities.push(createdEntity);
+  }
   async function createTradelink(tradelink) {
     if (tradelink.custodian) {
       if (existingTradelinkNetwork === null) {
@@ -822,20 +916,25 @@ async function bakeWorkspace(options, logger) {
     _invariant2.default.call(void 0, whitelist, `Whitelist ${whitelistName} not found`);
     return whitelist.id;
   }
+  function accountIdFromName(accountName) {
+    const account = existingAccounts.find((a) => a.name === accountName);
+    _invariant2.default.call(void 0, account, `Account "${accountName}" not found`);
+    return account.id;
+  }
   function assetManagerIdFromName(assetManagerName) {
     const orgAssetManager = tradelinkOrgAssetManagersByName[assetManagerName];
     _invariant2.default.call(void 0, 
       orgAssetManager,
       `Can't find Tradelink organization asset manager ${assetManagerName}`
     );
-    const assetManager = _optionalChain([existingTradelinkNetwork, 'optionalAccess', _24 => _24.assetManagers, 'access', _25 => _25.find, 'call', _26 => _26(
+    const assetManager = _optionalChain([existingTradelinkNetwork, 'optionalAccess', _22 => _22.assetManagers, 'access', _23 => _23.find, 'call', _24 => _24(
       (assetManager2) => assetManager2.tradelinkId === orgAssetManager.tradelinkId
     )]);
     _invariant2.default.call(void 0, assetManager, `Can't find Tradelink assetManager ${assetManagerName}`);
     return assetManager.id;
   }
   function exchangeIdFromName(exchangeName) {
-    const exchange = _optionalChain([existingTradelinkNetwork, 'optionalAccess', _27 => _27.exchanges, 'access', _28 => _28.find, 'call', _29 => _29((exchange2) => {
+    const exchange = _optionalChain([existingTradelinkNetwork, 'optionalAccess', _25 => _25.exchanges, 'access', _26 => _26.find, 'call', _27 => _27((exchange2) => {
       const orgExchange = tradelinkOrgExchangesByName[exchangeName];
       _invariant2.default.call(void 0, orgExchange, `Can't find Tradelink organization exchange ${exchange2.tradelinkId}`);
       return orgExchange.name === exchangeName;
@@ -854,6 +953,239 @@ async function bakeWorkspace(options, logger) {
   }
 }
 
+// src/bake/recipe-workspace.ts
+
+
+async function recipeWorkspace(options, logger) {
+  const { engine, workspaceName } = options;
+  const workspaceEngine = engine.withWorkspace(workspaceName);
+  const findDeviceIndex = _chunkLH4QQXUHcjs.createDeviceIndexResolver.call(void 0, workspaceEngine);
+  logger.info("Authenticating with admin...");
+  const admin = await workspaceEngine.withDeviceIndex(4).login();
+  logger.info("Fetching existing data...");
+  const [
+    existingUsers,
+    existingGroups,
+    existingWhitelists,
+    publicPolicies,
+    privatePolicies,
+    existingAccounts,
+    existingEntities,
+    existingWorkspaceRules
+  ] = await Promise.all([
+    _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin.client.users.list.query, { status: "ACTIVE" }),
+    _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin.client.groups.list.query, { status: "ACTIVE" }),
+    _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin.client.whitelists.list.query, { status: "ACTIVE" }),
+    _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin.client.policies.list.query, { isPrivate: false }),
+    _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin.client.policies.list.query, { isPrivate: true }),
+    _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin.client.accounts.list.query, { status: "ACTIVE" }),
+    _chunkLH4QQXUHcjs.fetchAll.call(void 0, admin.client.entities.list.query, { status: "ACTIVE" }),
+    admin.client.governance.listWorkspaceRules.query()
+  ]);
+  const existingPolicies = [...publicPolicies, ...privatePolicies];
+  const existingPsdUsers = existingUsers.filter((user) => user.deviceType === "PSD");
+  const existingApiUsers = existingUsers.filter((user) => user.deviceType === "API");
+  logger.info("Resolving device indexes...");
+  const psdUsersWithIndex = await resolveDevicesIndexes(existingPsdUsers);
+  logger.info("Reading users...");
+  const adminIndexes = psdUsersWithIndex.filter((u) => u.user.role === "ADMIN").map((u) => u.deviceIndex);
+  const operatorIndexes = psdUsersWithIndex.filter((u) => u.user.role === "OPERATOR").map((u) => u.deviceIndex);
+  const apiUsers = existingApiUsers.map((user) => {
+    const role = _tspattern.match.call(void 0, user.role).with("ADMIN", "OPERATOR", (role2) => role2).with("READ_ONLY_API_KEY", (role2) => {
+      throw new Error(`Unexpected API user role "${role2}" for user ${user.name}`);
+    }).exhaustive();
+    return {
+      name: user.name,
+      role,
+      pubKey: user.pubKey,
+      viewAll: user.legacyViewAll
+    };
+  });
+  logger.info("Reading groups...");
+  const groups = existingGroups.map((group) => ({
+    name: group.name,
+    members: group.members.map((member) => resolveUserIdentifier(member.id))
+  }));
+  logger.info("Reading whitelists...");
+  const whitelists = existingWhitelists.map((whitelist) => ({
+    name: whitelist.name,
+    description: _nullishCoalesce(whitelist.description, () => ( void 0)),
+    type: "TRANSACTION",
+    addresses: whitelist.addresses.map((addr) => ({
+      name: addr.name,
+      currency: addr.currency,
+      address: addr.address,
+      ..._optionalChain([addr, 'access', _28 => _28.destinationTags, 'optionalAccess', _29 => _29.length]) ? { destinationTags: addr.destinationTags } : {}
+    }))
+  }));
+  logger.info("Reading policies...");
+  const policies = publicPolicies.map((policy) => ({
+    name: policy.name,
+    currency: policy.currency,
+    rules: policy.rules.map(govRuleToManifest)
+  }));
+  logger.info("Reading accounts...");
+  const accounts = existingAccounts.map((account) => {
+    const governance = _tspattern.match.call(void 0, account.governance).with({ type: "CLASSIC" }, (gov) => {
+      const policy = existingPolicies.find((p) => p.id === gov.policyId);
+      _invariant2.default.call(void 0, policy, `Policy ${gov.policyId} not found for account ${account.name}`);
+      return policy.isPrivate ? {
+        type: "CLASSIC",
+        rules: policy.rules.map(govRuleToManifest)
+      } : {
+        type: "POLICY",
+        policy: policy.name
+      };
+    }).with({ type: "RAW_SIGNING" }, (gov) => {
+      const policy = existingPolicies.find((p) => p.id === gov.policyId);
+      _invariant2.default.call(void 0, policy, `Policy ${gov.policyId} not found for account ${account.name}`);
+      return {
+        type: "RAW_SIGNING",
+        rules: policy.rules.map((rule) => ({
+          type: "SIGN_DIGESTS",
+          steps: rule.reviewSteps.map((step) => {
+            _invariant2.default.call(void 0, "userIds" in step, "RAW_SIGNING rules only support user steps");
+            return {
+              quorum: step.quorum,
+              members: step.userIds.map(resolveUserToDeviceIndexOrName)
+            };
+          })
+        }))
+      };
+    }).with({ type: "TRADELINK" }, (gov) => ({
+      type: "TRADELINK",
+      assetManager: resolveAssetManagerName(gov.assetManagerId),
+      exchanges: gov.exchangeConfigs.map((exchangeConfig) => ({
+        name: resolveExchangeName(exchangeConfig.exchangeId),
+        ...exchangeConfig.repledgeAuthorized ? { repledgeAuthorized: true } : {},
+        ...exchangeConfig.needsAssetManagerApprovalForSettlements ? { needsAssetManagerApprovalForSettlements: true } : {}
+      }))
+    })).exhaustive();
+    return {
+      name: account.name,
+      currency: account.currency,
+      index: account.index,
+      ...account.contractAddress ? { contractAddress: account.contractAddress } : {},
+      ...account.tokenIdentifier ? { tokenIdentifier: account.tokenIdentifier } : {},
+      governance
+    };
+  });
+  logger.info("Reading entities...");
+  const entities = existingEntities.map((entity) => ({
+    name: entity.name,
+    ...entity.accountIds.length > 0 ? { accounts: entity.accountIds.map(accountNameFromId) } : {},
+    ...entity.memberIds.length > 0 ? { members: entity.memberIds.map(userNameFromId) } : {}
+  }));
+  logger.info("Reading workspace rules...");
+  const workspaceRules = existingWorkspaceRules.results.filter((rule) => rule.permission !== "ROOT").map((rule) => {
+    _invariant2.default.call(void 0, 
+      rule.reviewSteps.length === 1,
+      "Only one review step supported for workspace rules in manifest"
+    );
+    const step = rule.reviewSteps[0];
+    const quorum = step.quorum;
+    _invariant2.default.call(void 0, rule.permission !== "ROOT", "filtered out");
+    return {
+      permission: rule.permission,
+      quorum,
+      members: step.userIds.map(resolveUserToDeviceIndexOrName)
+    };
+  });
+  const workspace = {
+    users: {
+      ...adminIndexes.length > 0 ? { admins: adminIndexes } : {},
+      ...operatorIndexes.length > 0 ? { operators: operatorIndexes } : {},
+      ...apiUsers.length > 0 ? { api: apiUsers } : {}
+    },
+    ...groups.length > 0 ? { groups } : {},
+    ...whitelists.length > 0 ? { whitelists } : {},
+    ...policies.length > 0 ? { policies } : {},
+    ...accounts.length > 0 ? { accounts } : {},
+    ...entities.length > 0 ? { entities } : {},
+    ...workspaceRules.length > 0 ? { workspaceRules } : {}
+  };
+  logger.info("Recipe completed");
+  return workspace;
+  async function resolveDevicesIndexes(users) {
+    const result = [];
+    for (const user of users) {
+      _invariant2.default.call(void 0, user.deviceUserId, `User ${user.id} does not have any device user id`);
+      const deviceIndex = await findDeviceIndex(user.deviceUserId);
+      result.push({ user, deviceIndex });
+    }
+    return result;
+  }
+  function resolveUserIdentifier(userId) {
+    const psdUser = psdUsersWithIndex.find((u) => u.user.id === userId);
+    if (psdUser) return psdUser.deviceIndex;
+    const apiUser = existingApiUsers.find((u) => u.id === userId);
+    if (apiUser) return apiUser.name;
+    throw new Error(`User ${userId} not found`);
+  }
+  function resolveUserToDeviceIndexOrName(userId) {
+    return resolveUserIdentifier(userId);
+  }
+  function validateGovernanceRuleType(value) {
+    _invariant2.default.call(void 0, 
+      ["SEND", "STAKE", "DEPLOY_CONTRACT", "EXECUTE_CONTRACT", "SIGN_MESSAGE", "RECEIVE"].includes(
+        value
+      ),
+      "Unexpected governance rule type: " + value
+    );
+    return value;
+  }
+  function govRuleToManifest(rule) {
+    const operationType = validateGovernanceRuleType(rule.operationType);
+    const threshold = rule.threshold !== void 0 && (rule.threshold.min !== null || rule.threshold.max !== null) ? { threshold: { min: rule.threshold.min, max: rule.threshold.max } } : {};
+    return {
+      type: operationType,
+      steps: rule.reviewSteps.map((step) => {
+        if ("groupId" in step) {
+          const group = existingGroups.find((g) => g.id === step.groupId);
+          _invariant2.default.call(void 0, group, `Group ${step.groupId} not found`);
+          return { quorum: step.quorum, group: group.name };
+        }
+        return {
+          quorum: step.quorum,
+          members: step.userIds.map(resolveUserToDeviceIndexOrName)
+        };
+      }),
+      ...threshold,
+      ...rule.whitelistIds && rule.whitelistIds.length > 0 ? { whitelistNames: rule.whitelistIds.map(whitelistNameFromId) } : {}
+    };
+  }
+  function whitelistNameFromId(whitelistId) {
+    const whitelist = existingWhitelists.find((w) => w.id === whitelistId);
+    _invariant2.default.call(void 0, whitelist, `Whitelist ${whitelistId} not found`);
+    return whitelist.name;
+  }
+  function accountNameFromId(accountId) {
+    const account = existingAccounts.find((a) => a.id === accountId);
+    _invariant2.default.call(void 0, account, `Account ${accountId} not found`);
+    return account.name;
+  }
+  function userNameFromId(userId) {
+    const user = existingApiUsers.find((u) => u.id === userId);
+    _invariant2.default.call(void 0, user, `API user ${userId} not found`);
+    return user.name;
+  }
+  function resolveAssetManagerName(assetManagerId) {
+    return assetManagerId;
+  }
+  function resolveExchangeName(exchangeId) {
+    return exchangeId;
+  }
+}
+
+// src/bake/recipe.ts
+async function recipeManifest(options, logger) {
+  const workspace = await recipeWorkspace(options, logger);
+  return {
+    manifestVersion: 2,
+    workspace
+  };
+}
+
 // src/bake/types.ts
 var _zod = require('zod'); var _zod2 = _interopRequireDefault(_zod);
 var zManifestUser = _zod2.default.number().meta({ description: "User device index" });
@@ -878,7 +1210,7 @@ var zManifestWhitelistAddress = _zod2.default.object({
 }).strict();
 var zManifestWhitelist = _zod2.default.object({
   name: _zod2.default.string().meta({ description: "Whitelist name" }),
-  description: _zod2.default.string().optional().default("").meta({ description: "Whitelist description" }),
+  description: _zod2.default.string().optional().meta({ description: "Whitelist description" }),
   type: _zod2.default.enum(["TRANSACTION", "SMART_CONTRACT"]).optional().default("TRANSACTION").meta({ description: "Whitelist type" }),
   addresses: _zod2.default.array(zManifestWhitelistAddress).meta({ description: "Whitelist addresses" })
 }).strict().meta({ description: "Whitelist" });
@@ -907,8 +1239,8 @@ var zManifestGovernanceRule = _zod2.default.object({
   ]),
   steps: _zod2.default.array(zManifestGovernanceStep).min(1),
   threshold: _zod2.default.object({
-    min: _zod2.default.string(),
-    max: _zod2.default.string()
+    min: _zod2.default.string().nullable(),
+    max: _zod2.default.string().nullable()
   }).optional(),
   whitelistNames: _zod2.default.array(_zod2.default.string()).optional()
 }).strict();
@@ -957,6 +1289,11 @@ var zManifestAccount = _zod2.default.object({
   tokenIdentifier: _zod2.default.string().optional(),
   governance: zManifestAccountGovernance
 }).strict();
+var zManifestEntity = _zod2.default.object({
+  name: _zod2.default.string().min(1).max(19).meta({ description: "Entity name" }),
+  accounts: _zod2.default.array(_zod2.default.string()).optional().meta({ description: "Account names to include in this entity" }),
+  members: _zod2.default.array(_zod2.default.string()).optional().meta({ description: "API operator names to include in this entity" })
+}).strict().meta({ description: "Entity" });
 var zManifestHederaData = _zod2.default.object({
   index: _zod2.default.number(),
   onChainId: _zod2.default.string(),
@@ -1015,6 +1352,7 @@ var zManifestWorkspace = _zod2.default.object({
   whitelists: _zod2.default.array(zManifestWhitelist).optional(),
   policies: _zod2.default.array(zManifestPolicy).optional(),
   accounts: _zod2.default.array(zManifestAccount).optional(),
+  entities: _zod2.default.array(zManifestEntity).optional(),
   hederaData: _zod2.default.record(_zod2.default.string(), _zod2.default.array(zManifestHederaData)).optional(),
   pledges: _zod2.default.array(zManifestPledgeAdjustment).optional(),
   workspaceRules: _zod2.default.array(zManifestWorkspaceRule).optional()
@@ -1073,7 +1411,8 @@ async function bakeManifest(options, logger) {
 
 
 
-exports.bakeManifest = bakeManifest; exports.bakePledgeAdjustment = bakePledgeAdjustment; exports.createAndApproveRequest = createAndApproveRequest; exports.zManifest = zManifest; exports.zManifestPolicy = zManifestPolicy;
+
+exports.bakeManifest = bakeManifest; exports.bakePledgeAdjustment = bakePledgeAdjustment; exports.createAndApproveRequest = createAndApproveRequest; exports.recipeManifest = recipeManifest; exports.zManifest = zManifest; exports.zManifestPolicy = zManifestPolicy;
 /* v8 ignore else - TODO bake empty tradelink org -- @preserve */
 /* v8 ignore else -- @preserve */
 //# sourceMappingURL=bake.cjs.map