@ledgerhq/revault-sdk 0.25.0 → 0.25.1

package/lib/bake.js

@@ -1,1418 +1,1263 @@
-import {
-  createDeviceIndexResolver,
-  fetchAll
-} from "./chunk-AXI72NFY.js";
-import {
-  genKeys
-} from "./chunk-KV5FO7N5.js";
-
-// src/bake/index.ts
-import invariant5 from "invariant";
-
-// src/bake/bake-pledge.ts
-import invariant2 from "invariant";
-
-// src/bake/utils.ts
+import { n as createDeviceIndexResolver, r as fetchAll } from "./utils-BGbdjOP9.js";
+import { t as genKeys } from "./crypto-CPCBrCSZ.js";
 import invariant from "invariant";
+import _ from "lodash";
+import { match } from "ts-pattern";
+import z from "zod";
+//#region src/bake/utils.ts
 function createBakeLogHelpers(logger) {
-  return {
-    logTitle(title) {
-      logger.info(`:: ${title} ::`);
-    },
-    logStep(msg) {
-      logger.info(`=> ${msg}`);
-    },
-    logSubStep(msg) {
-      logger.info(`   -> ${msg}`);
-    }
-  };
+	return {
+		logTitle(title) {
+			logger.info(`:: ${title} ::`);
+		},
+		logStep(msg) {
+			logger.info(`=> ${msg}`);
+		},
+		logSubStep(msg) {
+			logger.info(`   -> ${msg}`);
+		}
+	};
 }
-var IS_REQUEST_STATE_END_STATE = {
-  // end states:
-  ABORTED: true,
-  BLOCKED: true,
-  EXECUTED: true,
-  EXPIRED: true,
-  FAILED: true,
-  STUCK: true,
-  // not end states:
-  EXECUTING: false,
-  INITIAL: false,
-  PENDING_APPROVAL: false
+const IS_REQUEST_STATE_END_STATE = {
+	ABORTED: true,
+	BLOCKED: true,
+	EXECUTED: true,
+	EXPIRED: true,
+	FAILED: true,
+	STUCK: true,
+	EXECUTING: false,
+	INITIAL: false,
+	PENDING_APPROVAL: false
 };
-var isEndState = (state) => IS_REQUEST_STATE_END_STATE[state];
-var DEFAULT_POLL_INTERVAL_MS = 250;
-var DEFAULT_TIMEOUT_MS = 6e4;
-var wait = (ms) => {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+const isEndState = (state) => IS_REQUEST_STATE_END_STATE[state];
+const DEFAULT_POLL_INTERVAL_MS = 250;
+const DEFAULT_TIMEOUT_MS = 6e4;
+const wait = (ms) => {
+	return new Promise((resolve) => setTimeout(resolve, ms));
 };
+/**
+* Poll a request until its inflight field is false, indicating it has been processed by the system.
+* Returns the updated request once inflight is false.
+* Throws if the timeout is exceeded before inflight becomes false.
+*/
 async function waitForRequestInflightDone(client, request, logger, options) {
-  const { logSubStep } = createBakeLogHelpers(logger);
-  if (request.inflight === void 0) {
-    return request;
-  }
-  logSubStep(`Waiting for inflight request to be processed...`);
-  const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const deadline = Date.now() + timeoutMs;
-  const pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-  let updated = request;
-  while (Date.now() < deadline) {
-    await wait(pollIntervalMs);
-    updated = await client.requests.findById.query({ id: request.id });
-    if (updated.inflight === void 0) {
-      return updated;
-    }
-  }
-  throw new Error(
-    `Timed out waiting for request ${request.id} inflight to be processed (last inflight: ${JSON.stringify(
-      updated.inflight
-    )})`
-  );
+	const { logSubStep } = createBakeLogHelpers(logger);
+	if (request.inflight === void 0) return request;
+	logSubStep(`Waiting for inflight request to be processed...`);
+	const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+	const deadline = Date.now() + timeoutMs;
+	const pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+	let updated = request;
+	while (Date.now() < deadline) {
+		await wait(pollIntervalMs);
+		updated = await client.requests.findById.query({ id: request.id });
+		if (updated.inflight === void 0) return updated;
+	}
+	throw new Error(`Timed out waiting for request ${request.id} inflight to be processed (last inflight: ${JSON.stringify(updated.inflight)})`);
 }
+/**
+* Poll a request until it reaches a terminal state (EXECUTED, FAILED, etc.).
+*
+* Returns the request once it is no longer in EXECUTING/STUCK state.
+* Throws if the request reaches FAILED or STUCK state, or if the timeout is exceeded.
+*/
 async function waitForRequestExecuted(client, request, logger, options) {
-  const { logSubStep } = createBakeLogHelpers(logger);
-  if (isEndState(request.state)) {
-    if (request.state === "EXECUTED") {
-      return request;
-    }
-    throw new Error(`Request is in error state ${request.state}`);
-  }
-  const pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-  const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const deadline = Date.now() + timeoutMs;
-  logSubStep(`Waiting for request to be executed...`);
-  let updated = request;
-  while (Date.now() < deadline) {
-    await wait(pollIntervalMs);
-    updated = await client.requests.findById.query({ id: request.id });
-    if (isEndState(updated.state)) {
-      if (updated.state === "EXECUTED") {
-        return updated;
-      }
-      throw new Error(`Request is in error state ${updated.state}`);
-    }
-  }
-  throw new Error(
-    `Timed out waiting for request ${request.id} to reach a terminal state (last state: ${updated.state})`
-  );
+	const { logSubStep } = createBakeLogHelpers(logger);
+	if (isEndState(request.state)) {
+		if (request.state === "EXECUTED") return request;
+		throw new Error(`Request is in error state ${request.state}`);
+	}
+	const pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+	const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+	const deadline = Date.now() + timeoutMs;
+	logSubStep(`Waiting for request to be executed...`);
+	let updated = request;
+	while (Date.now() < deadline) {
+		await wait(pollIntervalMs);
+		updated = await client.requests.findById.query({ id: request.id });
+		if (isEndState(updated.state)) {
+			if (updated.state === "EXECUTED") return updated;
+			throw new Error(`Request is in error state ${updated.state}`);
+		}
+	}
+	throw new Error(`Timed out waiting for request ${request.id} to reach a terminal state (last state: ${updated.state})`);
 }
 async function approveRequest(request, approvers, logger) {
-  const { logSubStep } = createBakeLogHelpers(logger);
-  for (let i = 0; i < approvers.length; i++) {
-    logSubStep(`Collecting approval (${i + 1}/${approvers.length})...`);
-    const approver = approvers[i];
-    request = await approver.approve(request);
-    request = await waitForRequestInflightDone(approver.client, request, logger);
-  }
-  return waitForRequestExecuted(approvers[0].client, request, logger);
+	const { logSubStep } = createBakeLogHelpers(logger);
+	for (let i = 0; i < approvers.length; i++) {
+		logSubStep(`Collecting approval (${i + 1}/${approvers.length})...`);
+		const approver = approvers[i];
+		request = await approver.approve(request);
+		request = await waitForRequestInflightDone(approver.client, request, logger);
+	}
+	return waitForRequestExecuted(approvers[0].client, request, logger);
 }
 async function createAndApproveRequest(input, approvers, logger) {
-  const { logSubStep } = createBakeLogHelpers(logger);
-  const creator = approvers[0];
-  invariant(creator, "Need at least 1 user to create a request");
-  logSubStep(`Creating request of type ${input.type}...`);
-  const request = await creator.client.requests.create.mutate({ request: input });
-  return approveRequest(request, approvers, logger);
+	const { logSubStep } = createBakeLogHelpers(logger);
+	const creator = approvers[0];
+	invariant(creator, "Need at least 1 user to create a request");
+	logSubStep(`Creating request of type ${input.type}...`);
+	return approveRequest(await creator.client.requests.create.mutate({ request: input }), approvers, logger);
 }
 function stripUndefinedDeep(obj) {
-  if (Array.isArray(obj)) {
-    return obj.map(stripUndefinedDeep);
-  }
-  if (obj && typeof obj === "object") {
-    return Object.fromEntries(
-      Object.entries(obj).filter(([_2, v]) => v !== void 0).map(([k, v]) => [k, stripUndefinedDeep(v)])
-    );
-  }
-  return obj;
+	if (Array.isArray(obj)) return obj.map(stripUndefinedDeep);
+	if (obj && typeof obj === "object") return Object.fromEntries(Object.entries(obj).filter(([_, v]) => v !== void 0).map(([k, v]) => [k, stripUndefinedDeep(v)]));
+	return obj;
 }
-
-// src/bake/bake-pledge.ts
-var flattenApprovers = (groups) => {
-  return groups.reduce((acc, cur) => {
-    acc.push(...cur.userIds.slice(0, cur.quorum));
-    return acc;
-  }, []);
+//#endregion
+//#region src/bake/bake-pledge.ts
+const flattenApprovers = (groups) => {
+	return groups.reduce((acc, cur) => {
+		acc.push(...cur.userIds.slice(0, cur.quorum));
+		return acc;
+	}, []);
 };
 async function bakePledgeAdjustment(options, logger) {
-  const { pledgeAdjustment, engine } = options;
-  const getDeviceIndex = createDeviceIndexResolver(engine);
-  logger.info("Logging in with admin...");
-  const admin = await engine.withDeviceIndex(4).login();
-  logger.info("Fetching account, tradelink blueprint and network...");
-  const [matchingAccounts, blueprint, network] = await Promise.all([
-    fetchAll(admin.client.accounts.list.query, { name: pledgeAdjustment.account }),
-    admin.client.tradelink.getNetworkBlueprint.query(),
-    admin.client.tradelink.getNetwork.query()
-  ]);
-  const account = matchingAccounts.find((account2) => account2.name === pledgeAdjustment.account);
-  invariant2(account, `Account ${pledgeAdjustment.account} not found`);
-  invariant2(blueprint, "Tradelink blueprint is not created yet");
-  invariant2(network, "Tradelink network is not created yet");
-  const exchange = network.exchanges.find((exchange2) => {
-    const blueprintExchange = blueprint.exchanges.find(
-      (blueprintExchange2) => blueprintExchange2.tradelinkId === exchange2.tradelinkId
-    );
-    invariant2(blueprintExchange, `Exchange ${exchange2.tradelinkId} not found in blueprint`);
-    return blueprintExchange.name === pledgeAdjustment.exchange;
-  });
-  invariant2(exchange, `Exchange ${pledgeAdjustment.exchange} not found in network`);
-  const governance = account.governance;
-  invariant2(governance.type === "TRADELINK", "Account governance is not TRADELINK");
-  const assetManager = network.assetManagers.find((am) => am.id === governance.assetManagerId);
-  invariant2(assetManager, `Asset manager ${governance.assetManagerId} not found in network`);
-  const exchangeIsConfiguredForAccount = !!governance.exchangeConfigs.find(
-    (e) => e.exchangeId === exchange.id
-  );
-  invariant2(
-    exchangeIsConfiguredForAccount,
-    `Exchange ${exchange.id} is not configured for account ${account.id}`
-  );
-  const approverIds = [
-    ...flattenApprovers(assetManager.groups),
-    ...flattenApprovers(exchange.groups)
-  ];
-  const approvers = await Promise.all(
-    approverIds.map(
-      (id) => admin.client.users.findById.query({ id }).then((user) => getDeviceIndex(user.deviceUserId)).then((index) => engine.withDeviceIndex(index).login())
-    )
-  );
-  await createAndApproveRequest(
-    {
-      type: "TRADELINK_ADJUST_PLEDGE",
-      data: {
-        accountId: account.id,
-        exchangeId: exchange.id,
-        amount: pledgeAdjustment.amount
-      }
-    },
-    approvers,
-    logger
-  );
-  logger.info(
-    `Successfully adjusted pledge for account ${pledgeAdjustment.account} on exchange ${pledgeAdjustment.exchange}`
-  );
+	const { pledgeAdjustment, engine } = options;
+	const getDeviceIndex = createDeviceIndexResolver(engine);
+	logger.info("Logging in with admin...");
+	const admin = await engine.withDeviceIndex(4).login();
+	logger.info("Fetching account, tradelink blueprint and network...");
+	const [matchingAccounts, blueprint, network] = await Promise.all([
+		fetchAll(admin.client.accounts.list.query, { name: pledgeAdjustment.account }),
+		admin.client.tradelink.getNetworkBlueprint.query(),
+		admin.client.tradelink.getNetwork.query()
+	]);
+	const account = matchingAccounts.find((account) => account.name === pledgeAdjustment.account);
+	invariant(account, `Account ${pledgeAdjustment.account} not found`);
+	invariant(blueprint, "Tradelink blueprint is not created yet");
+	invariant(network, "Tradelink network is not created yet");
+	const exchange = network.exchanges.find((exchange) => {
+		const blueprintExchange = blueprint.exchanges.find((blueprintExchange) => blueprintExchange.tradelinkId === exchange.tradelinkId);
+		invariant(blueprintExchange, `Exchange ${exchange.tradelinkId} not found in blueprint`);
+		return blueprintExchange.name === pledgeAdjustment.exchange;
+	});
+	invariant(exchange, `Exchange ${pledgeAdjustment.exchange} not found in network`);
+	const governance = account.governance;
+	invariant(governance.type === "TRADELINK", "Account governance is not TRADELINK");
+	const assetManager = network.assetManagers.find((am) => am.id === governance.assetManagerId);
+	invariant(assetManager, `Asset manager ${governance.assetManagerId} not found in network`);
+	invariant(!!governance.exchangeConfigs.find((e) => e.exchangeId === exchange.id), `Exchange ${exchange.id} is not configured for account ${account.id}`);
+	const approverIds = [...flattenApprovers(assetManager.groups), ...flattenApprovers(exchange.groups)];
+	const approvers = await Promise.all(approverIds.map((id) => admin.client.users.findById.query({ id }).then((user) => getDeviceIndex(user.deviceUserId)).then((index) => engine.withDeviceIndex(index).login())));
+	await createAndApproveRequest({
+		type: "TRADELINK_ADJUST_PLEDGE",
+		data: {
+			accountId: account.id,
+			exchangeId: exchange.id,
+			amount: pledgeAdjustment.amount
+		}
+	}, approvers, logger);
+	logger.info(`Successfully adjusted pledge for account ${pledgeAdjustment.account} on exchange ${pledgeAdjustment.exchange}`);
 }
-
-// src/bake/bake-tradelink-organization.ts
+//#endregion
+//#region src/bake/bake-tradelink-organization.ts
 async function bakeTradelinkOrganization(options, logger) {
-  const { tradelink, engine, rootAuthToken, networkBlueprint } = options;
-  const { logStep } = createBakeLogHelpers(logger);
-  const rootClient = engine.createClient({ rootAuthToken });
-  if (tradelink.exchanges) {
-    logStep("Creating Tradelink organization exchanges...");
-    const existingOrgExchanges = await rootClient.tradelink.root.listOrgExchanges.query();
-    for (const orgExchange of tradelink.exchanges) {
-      const existingOrgExchange = existingOrgExchanges.find((e) => e.name === orgExchange.name);
-      if (existingOrgExchange) {
-        logger.info(
-          `[SKIPPED] Organization exchange ${existingOrgExchange.name} (${existingOrgExchange.code}) already exists`
-        );
-      } else {
-        await rootClient.tradelink.root.createOrgExchange.mutate({
-          code: orgExchange.code,
-          name: orgExchange.name,
-          logoUrl: orgExchange.logo
-        });
-        logger.info(`Created organization exchange ${orgExchange.name} (${orgExchange.code})`);
-      }
-    }
-  }
-  if (tradelink.assetManagers) {
-    logStep("Creating Tradelink organization asset managers...");
-    const existingAssetManagers = await rootClient.tradelink.root.listOrgAssetManagers.query();
-    for (const orgAssetManager of tradelink.assetManagers) {
-      const existingOrgAssetManager = existingAssetManagers.find(
-        (e) => e.name === orgAssetManager.name
-      );
-      if (existingOrgAssetManager) {
-        logger.info(
-          `[SKIPPED] Organization asset manager ${existingOrgAssetManager.name} (${existingOrgAssetManager.code}) already exists`
-        );
-      } else {
-        await rootClient.tradelink.root.createOrgAssetManager.mutate({
-          code: orgAssetManager.code,
-          name: orgAssetManager.name,
-          logoUrl: orgAssetManager.logo
-        });
-        logger.info(
-          `Created organization asset manager ${orgAssetManager.name} (${orgAssetManager.code})`
-        );
-      }
-    }
-  }
-  if (tradelink.custodians) {
-    logStep("Creating Tradelink organization custodians...");
-    const existingCustodians = await rootClient.tradelink.root.listOrgCustodians.query();
-    for (const orgCustodian of tradelink.custodians) {
-      const existingOrgCustodian = existingCustodians.find((e) => e.name === orgCustodian.name);
-      if (existingOrgCustodian) {
-        logger.info(
-          `[SKIPPED] Organization custodian ${existingOrgCustodian.name} (${existingOrgCustodian.code}) already exists`
-        );
-      } else {
-        await rootClient.tradelink.root.createOrgCustodian.mutate({
-          code: orgCustodian.code,
-          name: orgCustodian.name,
-          logoUrl: orgCustodian.logo
-        });
-        logger.info(`Created organization custodian ${orgCustodian.name} (${orgCustodian.code})`);
-      }
-    }
-  }
-  if (networkBlueprint) {
-    logStep("Creating Tradelink network blueprint...");
-    const { workspaceName, blueprint } = networkBlueprint;
-    const existingBlueprints = await rootClient.tradelink.root.listNetworkBlueprints.query();
-    const existingBlueprint = existingBlueprints.find((e) => e.workspaceName === workspaceName);
-    if (existingBlueprint) {
-      logger.info(`[SKIPPED] Network blueprint for ${workspaceName} workspace already exists`);
-    } else {
-      await rootClient.tradelink.root.createNetworkBlueprint.mutate({
-        workspaceName,
-        custodian: { name: blueprint.custodian },
-        exchanges: blueprint.exchanges.map((_2) => ({ name: _2 })),
-        assetManagers: blueprint.assetManagers.map((_2) => ({ name: _2 }))
-      });
-      logger.info(`Created network blueprint for ${networkBlueprint.workspaceName} workspace`);
-    }
-  }
+	const { tradelink, engine, rootAuthToken, networkBlueprint } = options;
+	const { logStep } = createBakeLogHelpers(logger);
+	const rootClient = engine.createClient({ rootAuthToken });
+	/* v8 ignore else - TODO bake empty tradelink org -- @preserve */
+	if (tradelink.exchanges) {
+		logStep("Creating Tradelink organization exchanges...");
+		const existingOrgExchanges = await rootClient.tradelink.root.listOrgExchanges.query();
+		for (const orgExchange of tradelink.exchanges) {
+			const existingOrgExchange = existingOrgExchanges.find((e) => e.name === orgExchange.name);
+			if (existingOrgExchange) logger.info(`[SKIPPED] Organization exchange ${existingOrgExchange.name} (${existingOrgExchange.code}) already exists`);
+			else {
+				await rootClient.tradelink.root.createOrgExchange.mutate({
+					code: orgExchange.code,
+					name: orgExchange.name,
+					logoUrl: orgExchange.logo
+				});
+				logger.info(`Created organization exchange ${orgExchange.name} (${orgExchange.code})`);
+			}
+		}
+	}
+	/* v8 ignore else -- @preserve */
+	if (tradelink.assetManagers) {
+		logStep("Creating Tradelink organization asset managers...");
+		const existingAssetManagers = await rootClient.tradelink.root.listOrgAssetManagers.query();
+		for (const orgAssetManager of tradelink.assetManagers) {
+			const existingOrgAssetManager = existingAssetManagers.find((e) => e.name === orgAssetManager.name);
+			if (existingOrgAssetManager) logger.info(`[SKIPPED] Organization asset manager ${existingOrgAssetManager.name} (${existingOrgAssetManager.code}) already exists`);
+			else {
+				await rootClient.tradelink.root.createOrgAssetManager.mutate({
+					code: orgAssetManager.code,
+					name: orgAssetManager.name,
+					logoUrl: orgAssetManager.logo
+				});
+				logger.info(`Created organization asset manager ${orgAssetManager.name} (${orgAssetManager.code})`);
+			}
+		}
+	}
+	/* v8 ignore else -- @preserve */
+	if (tradelink.custodians) {
+		logStep("Creating Tradelink organization custodians...");
+		const existingCustodians = await rootClient.tradelink.root.listOrgCustodians.query();
+		for (const orgCustodian of tradelink.custodians) {
+			const existingOrgCustodian = existingCustodians.find((e) => e.name === orgCustodian.name);
+			if (existingOrgCustodian) logger.info(`[SKIPPED] Organization custodian ${existingOrgCustodian.name} (${existingOrgCustodian.code}) already exists`);
+			else {
+				await rootClient.tradelink.root.createOrgCustodian.mutate({
+					code: orgCustodian.code,
+					name: orgCustodian.name,
+					logoUrl: orgCustodian.logo
+				});
+				logger.info(`Created organization custodian ${orgCustodian.name} (${orgCustodian.code})`);
+			}
+		}
+	}
+	/* v8 ignore else -- @preserve */
+	if (networkBlueprint) {
+		logStep("Creating Tradelink network blueprint...");
+		const { workspaceName, blueprint } = networkBlueprint;
+		if ((await rootClient.tradelink.root.listNetworkBlueprints.query()).find((e) => e.workspaceName === workspaceName)) logger.info(`[SKIPPED] Network blueprint for ${workspaceName} workspace already exists`);
+		else {
+			await rootClient.tradelink.root.createNetworkBlueprint.mutate({
+				workspaceName,
+				custodian: { name: blueprint.custodian },
+				exchanges: blueprint.exchanges.map((_) => ({ name: _ })),
+				assetManagers: blueprint.assetManagers.map((_) => ({ name: _ }))
+			});
+			logger.info(`Created network blueprint for ${networkBlueprint.workspaceName} workspace`);
+		}
+	}
 }
-
-// src/bake/bake-workspace.ts
-import invariant3 from "invariant";
-import _ from "lodash";
-import { match } from "ts-pattern";
+//#endregion
+//#region src/bake/bake-workspace.ts
 async function bakeWorkspace(options, logger) {
-  const { workspace, engine, workspaceName } = options;
-  const workspaceEngine = engine.withWorkspace(workspaceName);
-  const { logTitle, logStep, logSubStep } = createBakeLogHelpers(logger);
-  const findDeviceIndex = createDeviceIndexResolver(workspaceEngine);
-  logger.info("Authenticating with two admins...");
-  const [admin1, admin2] = await Promise.all([
-    workspaceEngine.withDeviceIndex(4).login(),
-    workspaceEngine.withDeviceIndex(5).login()
-  ]);
-  logger.info("Fetching existing data...");
-  const [
-    existingUsers,
-    existingGroups,
-    existingWhitelists,
-    existingPolicies,
-    existingAccounts,
-    existingEntities,
-    tradelinkNetworkBlueprint
-  ] = await Promise.all([
-    fetchAll(admin1.client.users.list.query, { status: "ACTIVE" }),
-    fetchAll(admin1.client.groups.list.query, { status: "ACTIVE" }),
-    fetchAll(admin1.client.whitelists.list.query, { status: "ACTIVE" }),
-    fetchAll(admin1.client.policies.list.query, { isPrivate: false }),
-    fetchAll(admin1.client.accounts.list.query, { status: "ACTIVE" }),
-    fetchAll(admin1.client.entities.list.query, { status: "ACTIVE" }),
-    admin1.client.tradelink.getNetworkBlueprint.query()
-  ]);
-  const tradelinkOrgExchangesByName = _.keyBy(tradelinkNetworkBlueprint?.exchanges, "name");
-  const tradelinkOrgAssetManagersByName = _.keyBy(tradelinkNetworkBlueprint?.assetManagers, "name");
-  let existingTradelinkNetwork = await admin1.client.tradelink.getNetwork.query();
-  const existingPsdUsers = existingUsers.filter((user) => user.deviceType === "PSD");
-  const existingApiUsers = existingUsers.filter((user) => user.deviceType === "API");
-  const usersWithDeviceIndex = await resolveDevicesIndexes(existingPsdUsers);
-  if (workspace.users) {
-    logTitle("Users");
-    if (workspace.users.admins) {
-      for (const deviceIndex of workspace.users.admins) {
-        await createUser("ADMIN", deviceIndex);
-      }
-    }
-    if (workspace.users.operators) {
-      for (const deviceIndex of workspace.users.operators) {
-        await createUser("OPERATOR", deviceIndex);
-      }
-    }
-    if (workspace.users.api) {
-      for (const apiUser of workspace.users.api) {
-        await createApiUser(apiUser);
-      }
-    }
-  }
-  if (workspace.workspaceRules) {
-    logTitle("Workspace Rules");
-    for (const workspaceRule of workspace.workspaceRules) {
-      await createWorkspaceRule(workspaceRule);
-    }
-  }
-  if (workspace.groups) {
-    logTitle("Groups");
-    for (const group of workspace.groups) {
-      await createGroup(group);
-    }
-  }
-  if (workspace.whitelists) {
-    logTitle("Whitelists");
-    await createWhitelists(workspace.whitelists);
-  }
-  if (workspace.policies) {
-    logTitle("Policies");
-    for (const policy of workspace.policies) {
-      await createPolicy(policy);
-    }
-  }
-  if (workspace.tradelink) {
-    logTitle("Tradelink");
-    await createTradelink(workspace.tradelink);
-  }
-  if (workspace.accounts) {
-    logTitle("Accounts");
-    for (const account of workspace.accounts) {
-      await createAccount(account, workspace);
-    }
-  }
-  if (workspace.entities) {
-    logTitle("Entities");
-    for (const entity of workspace.entities) {
-      await createEntity(entity);
-    }
-  }
-  async function editDomainObjectIfNeeded(params) {
-    const previousRequests = await admin1.client.requests.list.query({
-      type: params.requestTypes,
-      targetId: params.existingId,
-      state: "EXECUTED",
-      sortBy: "createdAt",
-      sortOrder: "desc",
-      pageSize: 1
-    });
-    if (previousRequests?.results && previousRequests.results.length > 0) {
-      const stateRequest = previousRequests.results[0];
-      invariant3(
-        stateRequest && params.requestTypes.includes(stateRequest.type),
-        `State request should be a ${params.requestTypes[0]} or ${params.requestTypes[1]} request`
-      );
-      const lastData = params.extractLastData(stateRequest.data);
-      if (_.isEqual(stripUndefinedDeep(params.editData), stripUndefinedDeep(lastData))) {
-        logger.info(`[SKIPPED] ${params.entityType} "${params.entityName}" has not changed`);
-        return "skipped";
-      }
-    }
-    logStep(`Editing ${params.entityType.toLowerCase()} "${params.entityName}"...`);
-    await createAndApproveRequest(params.editInput, [admin1, admin2], logger);
-    logger.info(`[EDITED] ${params.entityType} "${params.entityName}" has been edited`);
-    return "edited";
-  }
-  async function createWhitelists(whitelists) {
-    for (const whitelist of whitelists) {
-      await createWhitelist(whitelist);
-    }
-    async function createWhitelist(whitelist) {
-      const existing = existingWhitelists.find((w) => w.name === whitelist.name);
-      const normalizeAddresses = (addresses) => addresses.map(({ destinationTags, ...rest }) => ({
-        ...rest,
-        ...destinationTags?.length ? { destinationTags } : {}
-      }));
-      const whitelistEditData = {
-        name: whitelist.name,
-        addresses: normalizeAddresses(whitelist.addresses)
-      };
-      if (existing) {
-        await editDomainObjectIfNeeded({
-          entityType: "Whitelist",
-          entityName: whitelist.name,
-          existingId: existing.id,
-          editInput: {
-            type: "EDIT_WHITELIST",
-            targetId: existing.id,
-            data: { name: whitelist.name, addresses: whitelist.addresses }
-          },
-          editData: whitelistEditData,
-          requestTypes: ["CREATE_WHITELIST", "EDIT_WHITELIST"],
-          extractLastData: (data) => ({
-            name: data.name,
-            addresses: normalizeAddresses(data.addresses)
-          })
-        });
-        return;
-      }
-      const input = {
-        type: "CREATE_WHITELIST",
-        data: { ...whitelist, description: whitelist.description ?? null }
-      };
-      const req = await createAndApproveRequest(input, [admin1, admin2], logger);
-      logSubStep(`Whitelist "${whitelist.name}" has been created`);
-      const createdWhitelist = await admin1.client.whitelists.findById.query({ id: req.targetId });
-      existingWhitelists.push(createdWhitelist);
-    }
-  }
-  function govRuleFromManifest(rule) {
-    return {
-      operationType: rule.type,
-      reviewSteps: rule.steps.map((step) => {
-        if ("group" in step) {
-          return {
-            quorum: step.quorum,
-            groupId: groupIdFromName(step.group)
-          };
-        }
-        return {
-          quorum: step.quorum,
-          userIds: step.members.map(userIdFromDeviceIndexOrName)
-        };
-      }),
-      threshold: rule.threshold,
-      whitelistIds: rule.whitelistNames?.map(whitelistIdFromName)
-    };
-  }
-  function rawSigningRuleFromManifest(rule) {
-    return {
-      operationType: rule.type,
-      // RAW_SIGNING only supports steps with userIds (no groups)
-      reviewSteps: rule.steps.map((step) => ({
-        quorum: step.quorum,
-        userIds: step.members.map(userIdFromDeviceIndexOrName)
-      }))
-    };
-  }
-  async function createAccount(account, workspace2) {
-    const existing = existingAccounts.find(
-      (a) => a.currency === account.currency && a.index === account.index && (a.contractAddress ?? null) === (account.contractAddress ?? null)
-    );
-    const governance = match(account.governance).with({ type: "TRADELINK" }, (gov) => ({
-      type: "TRADELINK",
-      assetManagerId: assetManagerIdFromName(gov.assetManager),
-      exchangeConfigs: gov.exchanges.map((exchangeConfig) => ({
-        exchangeId: exchangeIdFromName(exchangeConfig.name),
-        repledgeAuthorized: exchangeConfig.repledgeAuthorized === true,
-        needsAssetManagerApprovalForSettlements: exchangeConfig.needsAssetManagerApprovalForSettlements === true
-      }))
-    })).with({ type: "RAW_SIGNING" }, (gov) => ({
-      type: "RAW_SIGNING",
-      policy: { rules: gov.rules.map(rawSigningRuleFromManifest) }
-    })).with({ type: "CLASSIC" }, (gov) => ({
-      type: "CLASSIC",
-      policy: { rules: gov.rules.map(govRuleFromManifest) }
-    })).with({ type: "POLICY" }, (gov) => ({
-      type: "CLASSIC",
-      policy: { policyId: policyIdFromName(gov.policy) }
-    })).exhaustive();
-    const accountData = {
-      name: account.name,
-      currency: account.currency,
-      contractAddress: account.contractAddress ?? null,
-      tokenIdentifier: account.tokenIdentifier ?? null,
-      index: account.index,
-      governance
-    };
-    if (existing) {
-      const editData = { name: accountData.name, governance };
-      const result = await editDomainObjectIfNeeded({
-        entityType: "Account",
-        entityName: account.name,
-        existingId: existing.id,
-        editInput: { type: "EDIT_ACCOUNT", targetId: existing.id, data: editData },
-        editData,
-        requestTypes: ["CREATE_ACCOUNT", "EDIT_ACCOUNT"],
-        extractLastData: (data) => ({ name: data.name, governance: data.governance })
-      });
-      if (result === "skipped") {
-        await activateHederaAccount(account, workspace2, existing.id);
-      }
-      return;
-    }
-    logStep(`Creating account "${account.name}"`);
-    const createInput = {
-      type: "CREATE_ACCOUNT",
-      data: accountData
-    };
-    const req = await createAndApproveRequest(createInput, [admin1, admin2], logger);
-    const createdAccount = await admin1.client.accounts.findById.query({ id: req.targetId });
-    existingAccounts.push(createdAccount);
-    if (account.governance.type === "TRADELINK") {
-      logStep(`Activating tradelink account "${account.name}"`);
-      const assetManagerId = assetManagerIdFromName(account.governance.assetManager);
-      const assetManager = existingTradelinkNetwork?.assetManagers.find(
-        (assetManager2) => assetManager2.id === assetManagerId
-      );
-      invariant3(assetManager, `Asset manager for account exists`);
-      const loggedAssetManagerOperators = await Promise.all(
-        assetManager.groups.flatMap(
-          ({ quorum, userIds }) => userIds.slice(0, quorum).map((userId) => {
-            const deviceIndex = usersWithDeviceIndex.find((o) => o.user.id === userId)?.deviceIndex;
-            return workspaceEngine.withDeviceIndex(deviceIndex).login();
-          })
-        )
-      );
-      await createAndApproveRequest(
-        { type: "TRADELINK_ACTIVATE_ACCOUNT", targetId: req.targetId, data: null },
-        loggedAssetManagerOperators,
-        logger
-      );
-    }
-    if (req.targetId) {
-      await activateHederaAccount(account, workspace2, req.targetId);
-    }
-    logSubStep(`Account ${account.name} has been created`);
-  }
-  async function activateHederaAccount(account, workspace2, accountId) {
-    if (account.currency === "hedera" && account.contractAddress === void 0 && workspace2.hederaData && accountId) {
-      const salt = engine.__options.salt;
-      const hederaAccountsForSalt = workspace2.hederaData[salt];
-      const hederaAccountData = hederaAccountsForSalt?.find(
-        (h) => h.index === account.index && h.activate
-      );
-      if (hederaAccountData) {
-        try {
-          await admin1.client.accounts.hedera.activateAccount.mutate({
-            id: accountId,
-            onchainId: hederaAccountData.onChainId
-          });
-          logSubStep(`Hedera account "${account.name}" has been activated`);
-        } catch (error) {
-          logger.warning(`Activation for "${account.name}" failed: ${error}`);
-        }
-      }
-    }
-  }
-  async function createUser(role, deviceIndex) {
-    const userEngine = workspaceEngine.withDeviceIndex(deviceIndex);
-    const deviceId = await userEngine.device.getDeviceUserId();
-    const existing = existingUsers.find((user) => user.deviceUserId === deviceId);
-    if (existing) {
-      logger.info(`[SKIPPED] User with device index ${deviceIndex} already exists`);
-      return;
-    }
-    const name = `${role === "ADMIN" ? "Admin" : "Operator"} ${deviceIndex}`;
-    logStep(`Creating ${name}`);
-    logSubStep("Creating invitation...");
-    let registration = await admin1.client.userRegistrations.invite.mutate({
-      name,
-      role,
-      deviceUserId: deviceId,
-      psdModel: "STAX"
-    });
-    logSubStep("Completing registration...");
-    registration = await userEngine.register(registration);
-    logSubStep("Creating request...");
-    let req = await admin1.client.requests.create.mutate({
-      request: {
-        type: "CREATE_PSD_USER",
-        data: { registrationId: registration.id }
-      }
-    });
-    req = await approveRequest(req, [admin1, admin2], logger);
-    logSubStep(`${name} has been created`);
-    const createdUser = await admin1.client.users.findById.query({ id: req.targetId });
-    existingUsers.push(createdUser);
-    usersWithDeviceIndex.push({ user: createdUser, deviceIndex });
-  }
-  async function createApiUser(apiUser) {
-    const pubKey = apiUser.pubKey ?? genKeys(apiUser.name).hexPubKey;
-    const existing = existingApiUsers.find(
-      (user) => user.pubKey === pubKey || user.name === apiUser.name
-    );
-    if (existing) {
-      logger.info(
-        `[SKIPPED] API user already exists with name "${apiUser.name}" or public key "${pubKey}"`
-      );
-      return;
-    }
-    logStep(`Creating API user "${apiUser.name}"...`);
-    logSubStep("Creating request...");
-    let req = await admin1.client.requests.create.mutate({
-      request: {
-        type: "CREATE_API_USER",
-        data: {
-          name: apiUser.name,
-          role: apiUser.role,
-          pubKey,
-          viewAll: apiUser.viewAll
-        }
-      }
-    });
-    req = await approveRequest(req, [admin1, admin2], logger);
-    logSubStep(`API user "${apiUser.name}" has been created`);
-    logSubStep("Generating credentials...");
-    const credentials = await admin1.client.users.resetApiUserCredentials.mutate({
-      id: req.targetId
-    });
-    logSubStep(
-      `API user "${apiUser.name}" credentials have been generated: apiKeyId=${credentials.apiKeyId}, apiKeySecret=${credentials.apiKeySecret}`
-    );
-    const createdUser = await admin1.client.users.findById.query({ id: req.targetId });
-    existingApiUsers.push(createdUser);
-  }
-  async function createGroup(group) {
-    const existing = existingGroups.find((g) => g.name === group.name);
-    const members = group.members.map(userIdFromDeviceIndexOrName);
-    const groupData = {
-      name: group.name,
-      description: "",
-      members
-    };
-    if (existing) {
-      await editDomainObjectIfNeeded({
-        entityType: "Group",
-        entityName: group.name,
-        existingId: existing.id,
-        editInput: { type: "EDIT_GROUP", targetId: existing.id, data: groupData },
-        editData: groupData,
-        requestTypes: ["CREATE_GROUP", "EDIT_GROUP"],
-        extractLastData: (data) => ({ ...data, description: data.description ?? "" })
-      });
-      return;
-    }
-    logStep(`Creating group ${group.name}...`);
-    logSubStep("Creating request...");
-    let request = await admin1.client.requests.create.mutate({
-      request: {
-        type: "CREATE_GROUP",
-        data: groupData
-      }
-    });
-    request = await approveRequest(request, [admin1, admin2], logger);
-    logSubStep(`${group.name} has been created`);
-    const createdGroup = await admin1.client.groups.findById.query({ id: request.targetId });
-    existingGroups.push(createdGroup);
-  }
-  async function createPolicy(policy) {
-    const existing = existingPolicies.find((p) => p.name === policy.name);
-    const policyEditData = {
-      name: policy.name,
-      description: "",
-      govRules: policy.rules.map(govRuleFromManifest)
-    };
-    if (existing) {
-      await editDomainObjectIfNeeded({
-        entityType: "Policy",
-        entityName: policy.name,
-        existingId: existing.id,
-        editInput: { type: "EDIT_POLICY", targetId: existing.id, data: policyEditData },
-        editData: policyEditData,
-        requestTypes: ["CREATE_POLICY", "EDIT_POLICY"],
-        extractLastData: (data) => ({
-          name: data.name,
-          description: data.description ?? "",
-          govRules: data.govRules
-        })
-      });
-      return;
-    }
-    logStep(`Creating policy ${policy.name}...`);
-    logSubStep("Creating request...");
-    let request = await admin1.client.requests.create.mutate({
-      request: {
-        type: "CREATE_POLICY",
-        data: {
-          ...policyEditData,
-          currency: policy.currency
-        }
-      }
-    });
-    request = await approveRequest(request, [admin1, admin2], logger);
-    logSubStep(`${policy.name} has been created`);
-    const createdPolicy = await admin1.client.policies.findById.query({ id: request.targetId });
-    existingPolicies.push(createdPolicy);
-  }
-  async function createWorkspaceRule(workspaceRule) {
-    const { permission, quorum, members } = workspaceRule;
-    logStep(`Editing workspace rule for ${permission}...`);
-    const userIds = members.map(userIdFromDeviceIndexOrName);
-    logSubStep("Creating request...");
-    const input = {
-      type: "EDIT_WORKSPACE_RULE",
-      data: {
-        permission,
-        reviewConfig: [{ quorum, userIds }]
-      }
-    };
-    await createAndApproveRequest(input, [admin1, admin2], logger);
-    logSubStep(`Workspace rule for "${permission}" has been edited`);
-  }
-  async function createEntity(entity) {
-    const existing = existingEntities.find((e) => e.name === entity.name);
-    const accountIds = (entity.accounts ?? []).map(accountIdFromName);
-    const memberIds = (entity.members ?? []).map(userIdFromUserName);
-    const entityEditData = { name: entity.name, accountIds, memberIds };
-    if (existing) {
-      await editDomainObjectIfNeeded({
-        entityType: "Entity",
-        entityName: entity.name,
-        existingId: existing.id,
-        editInput: { type: "EDIT_ENTITY", targetId: existing.id, data: entityEditData },
-        editData: entityEditData,
-        requestTypes: ["CREATE_ENTITY", "EDIT_ENTITY"],
-        extractLastData: (data) => ({
-          name: data.name,
-          accountIds: data.accountIds,
-          memberIds: data.memberIds
-        })
-      });
-      return;
-    }
-    logStep(`Creating entity "${entity.name}"...`);
-    const input = {
-      type: "CREATE_ENTITY",
-      data: entityEditData
-    };
-    const request = await createAndApproveRequest(input, [admin1, admin2], logger);
-    logSubStep(`Entity "${entity.name}" has been created`);
-    const createdEntity = await admin1.client.entities.findById.query({ id: request.targetId });
-    existingEntities.push(createdEntity);
-  }
-  async function createTradelink(tradelink) {
-    if (tradelink.custodian) {
-      if (existingTradelinkNetwork === null) {
-        logStep("Creating custodian config...");
-        const { settlement, withdraw, arbitration } = tradelink.custodian;
-        const data = {
-          settlement: settlement.map(tradelinkReviewStepFromManifest),
-          withdraw: withdraw.map(tradelinkReviewStepFromManifest),
-          arbitration: arbitration.map(tradelinkReviewStepFromManifest)
-        };
-        logSubStep("Creating request...");
-        const request = await admin1.client.requests.create.mutate({
-          request: {
-            type: "TRADELINK_CREATE_CUSTODIAN",
-            data
-          }
-        });
-        await approveRequest(request, [admin1, admin2], logger);
-        logSubStep("Tradelink custodian config has been created");
-        existingTradelinkNetwork = await admin1.client.tradelink.getNetwork.query();
-      } else {
-        logger.info("[SKIPPED] Custodian config already exists");
-      }
-      const networkBlueprint = await admin1.client.tradelink.getNetworkBlueprint.query();
-      if (networkBlueprint !== null) {
-        if (tradelink.exchanges !== void 0) {
-          await createTradelinkExchanges(networkBlueprint, tradelink.exchanges);
-        }
-        if (tradelink.assetManagers !== void 0) {
-          await createTradelinkAssetManagers(networkBlueprint, tradelink.assetManagers);
-        }
-      } else {
-        logger.error(
-          "Will not create exchanges and asset managers because there is no network blueprint for current workspace"
-        );
-      }
-    }
-  }
-  async function createTradelinkExchanges(networkBlueprint, exchanges) {
-    invariant3(existingTradelinkNetwork !== null, "Network should exist");
-    const blueprintExchanges = networkBlueprint.exchanges;
-    for (const exchange of exchanges) {
-      const blueprintExchange = blueprintExchanges.find(({ name }) => name === exchange.name);
-      invariant3(
-        blueprintExchange !== void 0,
-        `Exchange ${exchange.name} does not exist in network blueprint`
-      );
-      const exchangeId = blueprintExchange.tradelinkId;
-      logStep(`Creating exchange ${exchange.name}...`);
-      if (existingTradelinkNetwork.exchanges.find(({ tradelinkId }) => tradelinkId === exchangeId) !== void 0) {
-        logger.info(`[SKIPPED] Exchange "${exchange.name}" already exists`);
-        continue;
-      }
-      logSubStep("Creating request...");
-      const request = await admin1.client.requests.create.mutate({
-        request: {
-          type: "TRADELINK_CREATE_EXCHANGE",
-          data: {
-            tradelinkId: exchangeId,
-            groups: exchange.groups.map(tradelinkReviewStepFromManifest),
-            whitelist: exchange.whitelist
-          }
-        }
-      });
-      const loggedExchangeOperators = await Promise.all(
-        exchange.groups.flatMap(
-          ({ quorum, members }) => members.slice(0, quorum).map((deviceIndex) => workspaceEngine.withDeviceIndex(deviceIndex).login())
-        )
-      );
-      await approveRequest(request, [admin1, admin2, ...loggedExchangeOperators], logger);
-      existingTradelinkNetwork = await admin1.client.tradelink.getNetwork.query();
-      invariant3(existingTradelinkNetwork !== null, "Tradelink network exists");
-    }
-  }
-  async function createTradelinkAssetManagers(networkBlueprint, assetManagers) {
-    invariant3(existingTradelinkNetwork !== null, "Network should exist");
-    const blueprintAssetManagers = networkBlueprint.assetManagers;
-    for (const assetManager of assetManagers) {
-      const blueprintAssetManager = blueprintAssetManagers.find(
-        ({ name }) => name === assetManager.name
-      );
-      invariant3(
-        blueprintAssetManager !== void 0,
-        `AssetManager ${assetManager.name} does not exist in network blueprint`
-      );
-      const assetManagerId = blueprintAssetManager.tradelinkId;
-      logStep(`Creating assetManager ${assetManager.name}...`);
-      if (existingTradelinkNetwork.assetManagers.find(
-        ({ tradelinkId }) => tradelinkId === assetManagerId
-      ) !== void 0) {
-        logger.info(`[SKIPPED] Asset manager "${assetManager.name}" already exists`);
-        continue;
-      }
-      logSubStep("Creating request...");
-      const request = await admin1.client.requests.create.mutate({
-        request: {
-          type: "TRADELINK_CREATE_ASSET_MANAGER",
-          data: {
-            tradelinkId: assetManagerId,
-            groups: assetManager.groups.map(tradelinkReviewStepFromManifest),
-            whitelist: assetManager.whitelist
-          }
-        }
-      });
-      const loggedAssetManagerOperators = await Promise.all(
-        assetManager.groups.flatMap(
-          ({ quorum, members }) => members.slice(0, quorum).map((deviceIndex) => workspaceEngine.withDeviceIndex(deviceIndex).login())
-        )
-      );
-      await approveRequest(request, [admin1, admin2, ...loggedAssetManagerOperators], logger);
-      existingTradelinkNetwork = await admin1.client.tradelink.getNetwork.query();
-      invariant3(existingTradelinkNetwork !== null, "Tradelink network exists");
-    }
-  }
-  async function resolveDevicesIndexes(users) {
-    const usersWithDeviceIndex2 = await users.reduce(
-      (acc, cur) => acc.then(async (acc2) => {
-        acc2.push(await withDeviceIndex(cur));
-        return acc2;
-      }),
-      Promise.resolve([])
-    );
-    return usersWithDeviceIndex2;
-  }
-  async function withDeviceIndex(user) {
-    invariant3(user.deviceUserId, `User ${user.id} does not have any device user id`);
-    const deviceIndex = await findDeviceIndex(user.deviceUserId);
-    return { user, deviceIndex };
-  }
-  function userIdFromDeviceIndex(deviceIndex) {
-    const corresponding = usersWithDeviceIndex.find((o) => o.deviceIndex === deviceIndex);
-    invariant3(corresponding, `No user with device index ${deviceIndex}`);
-    return corresponding.user.id;
-  }
-  function userIdFromUserName(name) {
-    const user = existingApiUsers.find((u) => u.name === name);
-    invariant3(user, `User ${name} not found`);
-    return user.id;
-  }
-  function userIdFromDeviceIndexOrName(identifier) {
-    if (typeof identifier === "number") {
-      return userIdFromDeviceIndex(identifier);
-    }
-    return userIdFromUserName(identifier);
-  }
-  function groupIdFromName(groupName) {
-    const group = existingGroups.find((g) => g.name === groupName);
-    invariant3(group, `Group ${groupName} not found`);
-    return group.id;
-  }
-  function policyIdFromName(policyName) {
-    const policy = existingPolicies.find((g) => g.name === policyName);
-    invariant3(policy, `Policy ${policyName} not found`);
-    return policy.id;
-  }
-  function whitelistIdFromName(whitelistName) {
-    const whitelist = existingWhitelists.find((w) => w.name === whitelistName);
-    invariant3(whitelist, `Whitelist ${whitelistName} not found`);
-    return whitelist.id;
-  }
-  function accountIdFromName(accountName) {
-    const account = existingAccounts.find((a) => a.name === accountName);
-    invariant3(account, `Account "${accountName}" not found`);
-    return account.id;
-  }
-  function assetManagerIdFromName(assetManagerName) {
-    const orgAssetManager = tradelinkOrgAssetManagersByName[assetManagerName];
-    invariant3(
-      orgAssetManager,
-      `Can't find Tradelink organization asset manager ${assetManagerName}`
-    );
-    const assetManager = existingTradelinkNetwork?.assetManagers.find(
-      (assetManager2) => assetManager2.tradelinkId === orgAssetManager.tradelinkId
-    );
-    invariant3(assetManager, `Can't find Tradelink assetManager ${assetManagerName}`);
-    return assetManager.id;
-  }
-  function exchangeIdFromName(exchangeName) {
-    const exchange = existingTradelinkNetwork?.exchanges.find((exchange2) => {
-      const orgExchange = tradelinkOrgExchangesByName[exchangeName];
-      invariant3(orgExchange, `Can't find Tradelink organization exchange ${exchange2.tradelinkId}`);
-      return orgExchange.name === exchangeName;
-    });
-    invariant3(exchange, `Can't find Tradelink exchange ${exchangeName}`);
-    return exchange.id;
-  }
-  function tradelinkReviewStepFromManifest({
-    members,
-    quorum
-  }) {
-    return {
-      userIds: members.map(userIdFromDeviceIndex),
-      quorum
-    };
-  }
+	const { workspace, engine, workspaceName } = options;
+	const workspaceEngine = engine.withWorkspace(workspaceName);
+	const { logTitle, logStep, logSubStep } = createBakeLogHelpers(logger);
+	const findDeviceIndex = createDeviceIndexResolver(workspaceEngine);
+	logger.info("Authenticating with two admins...");
+	const [admin1, admin2] = await Promise.all([workspaceEngine.withDeviceIndex(4).login(), workspaceEngine.withDeviceIndex(5).login()]);
+	logger.info("Fetching existing data...");
+	const [existingUsers, existingGroups, existingWhitelists, existingPolicies, existingAccounts, existingEntities, tradelinkNetworkBlueprint] = await Promise.all([
+		fetchAll(admin1.client.users.list.query, { status: "ACTIVE" }),
+		fetchAll(admin1.client.groups.list.query, { status: "ACTIVE" }),
+		fetchAll(admin1.client.whitelists.list.query, { status: "ACTIVE" }),
+		fetchAll(admin1.client.policies.list.query, { isPrivate: false }),
+		fetchAll(admin1.client.accounts.list.query, { status: "ACTIVE" }),
+		fetchAll(admin1.client.entities.list.query, { status: "ACTIVE" }),
+		admin1.client.tradelink.getNetworkBlueprint.query()
+	]);
+	const tradelinkOrgExchangesByName = _.keyBy(tradelinkNetworkBlueprint?.exchanges, "name");
+	const tradelinkOrgAssetManagersByName = _.keyBy(tradelinkNetworkBlueprint?.assetManagers, "name");
+	let existingTradelinkNetwork = await admin1.client.tradelink.getNetwork.query();
+	const existingPsdUsers = existingUsers.filter((user) => user.deviceType === "PSD");
+	const existingApiUsers = existingUsers.filter((user) => user.deviceType === "API");
+	const usersWithDeviceIndex = await resolveDevicesIndexes(existingPsdUsers);
+	if (workspace.users) {
+		logTitle("Users");
+		if (workspace.users.admins) for (const deviceIndex of workspace.users.admins) await createUser("ADMIN", deviceIndex);
+		/* v8 ignore else -- @preserve */
+		if (workspace.users.operators) for (const deviceIndex of workspace.users.operators) await createUser("OPERATOR", deviceIndex);
+		if (workspace.users.api) for (const apiUser of workspace.users.api) await createApiUser(apiUser);
+	}
+	if (workspace.workspaceRules) {
+		logTitle("Workspace Rules");
+		for (const workspaceRule of workspace.workspaceRules) await createWorkspaceRule(workspaceRule);
+	}
+	if (workspace.groups) {
+		logTitle("Groups");
+		for (const group of workspace.groups) await createGroup(group);
+	}
+	if (workspace.whitelists) {
+		logTitle("Whitelists");
+		await createWhitelists(workspace.whitelists);
+	}
+	if (workspace.policies) {
+		logTitle("Policies");
+		for (const policy of workspace.policies) await createPolicy(policy);
+	}
+	if (workspace.tradelink) {
+		logTitle("Tradelink");
+		await createTradelink(workspace.tradelink);
+	}
+	if (workspace.accounts) {
+		logTitle("Accounts");
+		for (const account of workspace.accounts) await createAccount(account, workspace);
+	}
+	if (workspace.entities) {
+		logTitle("Entities");
+		for (const entity of workspace.entities) await createEntity(entity);
+	}
+	async function editDomainObjectIfNeeded(params) {
+		const previousRequests = await admin1.client.requests.list.query({
+			type: params.requestTypes,
+			targetId: params.existingId,
+			state: "EXECUTED",
+			sortBy: "createdAt",
+			sortOrder: "desc",
+			pageSize: 1
+		});
+		if (previousRequests?.results && previousRequests.results.length > 0) {
+			const stateRequest = previousRequests.results[0];
+			invariant(stateRequest && params.requestTypes.includes(stateRequest.type), `State request should be a ${params.requestTypes[0]} or ${params.requestTypes[1]} request`);
+			const lastData = params.extractLastData(stateRequest.data);
+			if (_.isEqual(stripUndefinedDeep(params.editData), stripUndefinedDeep(lastData))) {
+				logger.info(`[SKIPPED] ${params.entityType} "${params.entityName}" has not changed`);
+				return "skipped";
+			}
+		}
+		logStep(`Editing ${params.entityType.toLowerCase()} "${params.entityName}"...`);
+		await createAndApproveRequest(params.editInput, [admin1, admin2], logger);
+		logger.info(`[EDITED] ${params.entityType} "${params.entityName}" has been edited`);
+		return "edited";
+	}
+	async function createWhitelists(whitelists) {
+		for (const whitelist of whitelists) await createWhitelist(whitelist);
+		async function createWhitelist(whitelist) {
+			const existing = existingWhitelists.find((w) => w.name === whitelist.name);
+			const normalizeAddresses = (addresses) => addresses.map(({ destinationTags, ...rest }) => ({
+				...rest,
+				...destinationTags?.length ? { destinationTags } : {}
+			}));
+			const whitelistEditData = {
+				name: whitelist.name,
+				addresses: normalizeAddresses(whitelist.addresses)
+			};
+			if (existing) {
+				await editDomainObjectIfNeeded({
+					entityType: "Whitelist",
+					entityName: whitelist.name,
+					existingId: existing.id,
+					editInput: {
+						type: "EDIT_WHITELIST",
+						targetId: existing.id,
+						data: {
+							name: whitelist.name,
+							addresses: whitelist.addresses
+						}
+					},
+					editData: whitelistEditData,
+					requestTypes: ["CREATE_WHITELIST", "EDIT_WHITELIST"],
+					extractLastData: (data) => ({
+						name: data.name,
+						addresses: normalizeAddresses(data.addresses)
+					})
+				});
+				return;
+			}
+			const req = await createAndApproveRequest({
+				type: "CREATE_WHITELIST",
+				data: {
+					...whitelist,
+					description: whitelist.description ?? null
+				}
+			}, [admin1, admin2], logger);
+			logSubStep(`Whitelist "${whitelist.name}" has been created`);
+			const createdWhitelist = await admin1.client.whitelists.findById.query({ id: req.targetId });
+			existingWhitelists.push(createdWhitelist);
+		}
+	}
+	function govRuleFromManifest(rule) {
+		return {
+			operationType: rule.type,
+			reviewSteps: rule.steps.map((step) => {
+				if ("group" in step) return {
+					quorum: step.quorum,
+					groupId: groupIdFromName(step.group)
+				};
+				return {
+					quorum: step.quorum,
+					userIds: step.members.map(userIdFromDeviceIndexOrName)
+				};
+			}),
+			threshold: rule.threshold,
+			whitelistIds: rule.whitelistNames?.map(whitelistIdFromName)
+		};
+	}
+	function rawSigningRuleFromManifest(rule) {
+		return {
+			operationType: rule.type,
+			reviewSteps: rule.steps.map((step) => ({
+				quorum: step.quorum,
+				userIds: step.members.map(userIdFromDeviceIndexOrName)
+			}))
+		};
+	}
+	async function createAccount(account, workspace) {
+		const existing = existingAccounts.find((a) => a.currency === account.currency && a.index === account.index && (a.contractAddress ?? null) === (account.contractAddress ?? null));
+		const governance = match(account.governance).with({ type: "TRADELINK" }, (gov) => ({
+			type: "TRADELINK",
+			assetManagerId: assetManagerIdFromName(gov.assetManager),
+			exchangeConfigs: gov.exchanges.map((exchangeConfig) => ({
+				exchangeId: exchangeIdFromName(exchangeConfig.name),
+				repledgeAuthorized: exchangeConfig.repledgeAuthorized === true,
+				needsAssetManagerApprovalForSettlements: exchangeConfig.needsAssetManagerApprovalForSettlements === true
+			}))
+		})).with({ type: "RAW_SIGNING" }, (gov) => ({
+			type: "RAW_SIGNING",
+			policy: { rules: gov.rules.map(rawSigningRuleFromManifest) }
+		})).with({ type: "CLASSIC" }, (gov) => ({
+			type: "CLASSIC",
+			policy: { rules: gov.rules.map(govRuleFromManifest) }
+		})).with({ type: "POLICY" }, (gov) => ({
+			type: "CLASSIC",
+			policy: { policyId: policyIdFromName(gov.policy) }
+		})).exhaustive();
+		const accountData = {
+			name: account.name,
+			currency: account.currency,
+			contractAddress: account.contractAddress ?? null,
+			tokenIdentifier: account.tokenIdentifier ?? null,
+			index: account.index,
+			governance
+		};
+		if (existing) {
+			const editData = {
+				name: accountData.name,
+				governance
+			};
+			if (await editDomainObjectIfNeeded({
+				entityType: "Account",
+				entityName: account.name,
+				existingId: existing.id,
+				editInput: {
+					type: "EDIT_ACCOUNT",
+					targetId: existing.id,
+					data: editData
+				},
+				editData,
+				requestTypes: ["CREATE_ACCOUNT", "EDIT_ACCOUNT"],
+				extractLastData: (data) => ({
+					name: data.name,
+					governance: data.governance
+				})
+			}) === "skipped") await activateHederaAccount(account, workspace, existing.id);
+			return;
+		}
+		logStep(`Creating account "${account.name}"`);
+		const req = await createAndApproveRequest({
+			type: "CREATE_ACCOUNT",
+			data: accountData
+		}, [admin1, admin2], logger);
+		const createdAccount = await admin1.client.accounts.findById.query({ id: req.targetId });
+		existingAccounts.push(createdAccount);
+		if (account.governance.type === "TRADELINK") {
+			logStep(`Activating tradelink account "${account.name}"`);
+			const assetManagerId = assetManagerIdFromName(account.governance.assetManager);
+			const assetManager = existingTradelinkNetwork?.assetManagers.find((assetManager) => assetManager.id === assetManagerId);
+			invariant(assetManager, `Asset manager for account exists`);
+			const loggedAssetManagerOperators = await Promise.all(assetManager.groups.flatMap(({ quorum, userIds }) => userIds.slice(0, quorum).map((userId) => {
+				const deviceIndex = usersWithDeviceIndex.find((o) => o.user.id === userId)?.deviceIndex;
+				return workspaceEngine.withDeviceIndex(deviceIndex).login();
+			})));
+			await createAndApproveRequest({
+				type: "TRADELINK_ACTIVATE_ACCOUNT",
+				targetId: req.targetId,
+				data: null
+			}, loggedAssetManagerOperators, logger);
+		}
+		if (req.targetId) await activateHederaAccount(account, workspace, req.targetId);
+		logSubStep(`Account ${account.name} has been created`);
+	}
+	async function activateHederaAccount(account, workspace, accountId) {
+		if (account.currency === "hedera" && account.contractAddress === void 0 && workspace.hederaData && accountId) {
+			const salt = engine.__options.salt;
+			const hederaAccountData = workspace.hederaData[salt]?.find((h) => h.index === account.index && h.activate);
+			if (hederaAccountData) try {
+				await admin1.client.accounts.hedera.activateAccount.mutate({
+					id: accountId,
+					onchainId: hederaAccountData.onChainId
+				});
+				logSubStep(`Hedera account "${account.name}" has been activated`);
+			} catch (error) {
+				logger.warning(`Activation for "${account.name}" failed: ${error}`);
+			}
+		}
+	}
+	async function createUser(role, deviceIndex) {
+		const userEngine = workspaceEngine.withDeviceIndex(deviceIndex);
+		const deviceId = await userEngine.device.getDeviceUserId();
+		if (existingUsers.find((user) => user.deviceUserId === deviceId)) {
+			logger.info(`[SKIPPED] User with device index ${deviceIndex} already exists`);
+			return;
+		}
+		const name = `${role === "ADMIN" ? "Admin" : "Operator"} ${deviceIndex}`;
+		logStep(`Creating ${name}`);
+		logSubStep("Creating invitation...");
+		let registration = await admin1.client.userRegistrations.invite.mutate({
+			name,
+			role,
+			deviceUserId: deviceId,
+			psdModel: "STAX"
+		});
+		logSubStep("Completing registration...");
+		registration = await userEngine.register(registration);
+		logSubStep("Creating request...");
+		let req = await admin1.client.requests.create.mutate({ request: {
+			type: "CREATE_PSD_USER",
+			data: { registrationId: registration.id }
+		} });
+		req = await approveRequest(req, [admin1, admin2], logger);
+		logSubStep(`${name} has been created`);
+		const createdUser = await admin1.client.users.findById.query({ id: req.targetId });
+		existingUsers.push(createdUser);
+		usersWithDeviceIndex.push({
+			user: createdUser,
+			deviceIndex
+		});
+	}
+	async function createApiUser(apiUser) {
+		const pubKey = apiUser.pubKey ?? genKeys(apiUser.name).hexPubKey;
+		if (existingApiUsers.find((user) => user.pubKey === pubKey || user.name === apiUser.name)) {
+			logger.info(`[SKIPPED] API user already exists with name "${apiUser.name}" or public key "${pubKey}"`);
+			return;
+		}
+		logStep(`Creating API user "${apiUser.name}"...`);
+		logSubStep("Creating request...");
+		let req = await admin1.client.requests.create.mutate({ request: {
+			type: "CREATE_API_USER",
+			data: {
+				name: apiUser.name,
+				role: apiUser.role,
+				pubKey,
+				viewAll: apiUser.viewAll
+			}
+		} });
+		req = await approveRequest(req, [admin1, admin2], logger);
+		logSubStep(`API user "${apiUser.name}" has been created`);
+		logSubStep("Generating credentials...");
+		const credentials = await admin1.client.users.resetApiUserCredentials.mutate({ id: req.targetId });
+		logSubStep(`API user "${apiUser.name}" credentials have been generated: apiKeyId=${credentials.apiKeyId}, apiKeySecret=${credentials.apiKeySecret}`);
+		const createdUser = await admin1.client.users.findById.query({ id: req.targetId });
+		existingApiUsers.push(createdUser);
+	}
+	async function createGroup(group) {
+		const existing = existingGroups.find((g) => g.name === group.name);
+		const members = group.members.map(userIdFromDeviceIndexOrName);
+		const groupData = {
+			name: group.name,
+			description: "",
+			members
+		};
+		if (existing) {
+			await editDomainObjectIfNeeded({
+				entityType: "Group",
+				entityName: group.name,
+				existingId: existing.id,
+				editInput: {
+					type: "EDIT_GROUP",
+					targetId: existing.id,
+					data: groupData
+				},
+				editData: groupData,
+				requestTypes: ["CREATE_GROUP", "EDIT_GROUP"],
+				extractLastData: (data) => ({
+					...data,
+					description: data.description ?? ""
+				})
+			});
+			return;
+		}
+		logStep(`Creating group ${group.name}...`);
+		logSubStep("Creating request...");
+		let request = await admin1.client.requests.create.mutate({ request: {
+			type: "CREATE_GROUP",
+			data: groupData
+		} });
+		request = await approveRequest(request, [admin1, admin2], logger);
+		logSubStep(`${group.name} has been created`);
+		const createdGroup = await admin1.client.groups.findById.query({ id: request.targetId });
+		existingGroups.push(createdGroup);
+	}
+	async function createPolicy(policy) {
+		const existing = existingPolicies.find((p) => p.name === policy.name);
+		const policyEditData = {
+			name: policy.name,
+			description: "",
+			govRules: policy.rules.map(govRuleFromManifest)
+		};
+		if (existing) {
+			await editDomainObjectIfNeeded({
+				entityType: "Policy",
+				entityName: policy.name,
+				existingId: existing.id,
+				editInput: {
+					type: "EDIT_POLICY",
+					targetId: existing.id,
+					data: policyEditData
+				},
+				editData: policyEditData,
+				requestTypes: ["CREATE_POLICY", "EDIT_POLICY"],
+				extractLastData: (data) => ({
+					name: data.name,
+					description: data.description ?? "",
+					govRules: data.govRules
+				})
+			});
+			return;
+		}
+		logStep(`Creating policy ${policy.name}...`);
+		logSubStep("Creating request...");
+		let request = await admin1.client.requests.create.mutate({ request: {
+			type: "CREATE_POLICY",
+			data: {
+				...policyEditData,
+				currency: policy.currency
+			}
+		} });
+		request = await approveRequest(request, [admin1, admin2], logger);
+		logSubStep(`${policy.name} has been created`);
+		const createdPolicy = await admin1.client.policies.findById.query({ id: request.targetId });
+		existingPolicies.push(createdPolicy);
+	}
+	async function createWorkspaceRule(workspaceRule) {
+		const { permission, quorum, members } = workspaceRule;
+		logStep(`Editing workspace rule for ${permission}...`);
+		const userIds = members.map(userIdFromDeviceIndexOrName);
+		logSubStep("Creating request...");
+		await createAndApproveRequest({
+			type: "EDIT_WORKSPACE_RULE",
+			data: {
+				permission,
+				reviewConfig: [{
+					quorum,
+					userIds
+				}]
+			}
+		}, [admin1, admin2], logger);
+		logSubStep(`Workspace rule for "${permission}" has been edited`);
+	}
+	async function createEntity(entity) {
+		const existing = existingEntities.find((e) => e.name === entity.name);
+		const accountIds = (entity.accounts ?? []).map(accountIdFromName);
+		const memberIds = (entity.members ?? []).map(userIdFromUserName);
+		const entityEditData = {
+			name: entity.name,
+			accountIds,
+			memberIds
+		};
+		if (existing) {
+			await editDomainObjectIfNeeded({
+				entityType: "Entity",
+				entityName: entity.name,
+				existingId: existing.id,
+				editInput: {
+					type: "EDIT_ENTITY",
+					targetId: existing.id,
+					data: entityEditData
+				},
+				editData: entityEditData,
+				requestTypes: ["CREATE_ENTITY", "EDIT_ENTITY"],
+				extractLastData: (data) => ({
+					name: data.name,
+					accountIds: data.accountIds,
+					memberIds: data.memberIds
+				})
+			});
+			return;
+		}
+		logStep(`Creating entity "${entity.name}"...`);
+		const request = await createAndApproveRequest({
+			type: "CREATE_ENTITY",
+			data: entityEditData
+		}, [admin1, admin2], logger);
+		logSubStep(`Entity "${entity.name}" has been created`);
+		const createdEntity = await admin1.client.entities.findById.query({ id: request.targetId });
+		existingEntities.push(createdEntity);
+	}
+	async function createTradelink(tradelink) {
+		/* v8 ignore else -- @preserve */
+		if (tradelink.custodian) {
+			if (existingTradelinkNetwork === null) {
+				logStep("Creating custodian config...");
+				const { settlement, withdraw, arbitration } = tradelink.custodian;
+				const data = {
+					settlement: settlement.map(tradelinkReviewStepFromManifest),
+					withdraw: withdraw.map(tradelinkReviewStepFromManifest),
+					arbitration: arbitration.map(tradelinkReviewStepFromManifest)
+				};
+				logSubStep("Creating request...");
+				await approveRequest(await admin1.client.requests.create.mutate({ request: {
+					type: "TRADELINK_CREATE_CUSTODIAN",
+					data
+				} }), [admin1, admin2], logger);
+				logSubStep("Tradelink custodian config has been created");
+				existingTradelinkNetwork = await admin1.client.tradelink.getNetwork.query();
+			} else logger.info("[SKIPPED] Custodian config already exists");
+			const networkBlueprint = await admin1.client.tradelink.getNetworkBlueprint.query();
+			if (networkBlueprint !== null) {
+				/* v8 ignore else -- @preserve */
+				if (tradelink.exchanges !== void 0) await createTradelinkExchanges(networkBlueprint, tradelink.exchanges);
+				/* v8 ignore else -- @preserve */
+				if (tradelink.assetManagers !== void 0) await createTradelinkAssetManagers(networkBlueprint, tradelink.assetManagers);
+			} else logger.error("Will not create exchanges and asset managers because there is no network blueprint for current workspace");
+		}
+	}
+	async function createTradelinkExchanges(networkBlueprint, exchanges) {
+		invariant(existingTradelinkNetwork !== null, "Network should exist");
+		const blueprintExchanges = networkBlueprint.exchanges;
+		for (const exchange of exchanges) {
+			const blueprintExchange = blueprintExchanges.find(({ name }) => name === exchange.name);
+			invariant(blueprintExchange !== void 0, `Exchange ${exchange.name} does not exist in network blueprint`);
+			const exchangeId = blueprintExchange.tradelinkId;
+			logStep(`Creating exchange ${exchange.name}...`);
+			if (existingTradelinkNetwork.exchanges.find(({ tradelinkId }) => tradelinkId === exchangeId) !== void 0) {
+				logger.info(`[SKIPPED] Exchange "${exchange.name}" already exists`);
+				continue;
+			}
+			logSubStep("Creating request...");
+			await approveRequest(await admin1.client.requests.create.mutate({ request: {
+				type: "TRADELINK_CREATE_EXCHANGE",
+				data: {
+					tradelinkId: exchangeId,
+					groups: exchange.groups.map(tradelinkReviewStepFromManifest),
+					whitelist: exchange.whitelist
+				}
+			} }), [
+				admin1,
+				admin2,
+				...await Promise.all(exchange.groups.flatMap(({ quorum, members }) => members.slice(0, quorum).map((deviceIndex) => workspaceEngine.withDeviceIndex(deviceIndex).login())))
+			], logger);
+			existingTradelinkNetwork = await admin1.client.tradelink.getNetwork.query();
+			invariant(existingTradelinkNetwork !== null, "Tradelink network exists");
+		}
+	}
+	async function createTradelinkAssetManagers(networkBlueprint, assetManagers) {
+		invariant(existingTradelinkNetwork !== null, "Network should exist");
+		const blueprintAssetManagers = networkBlueprint.assetManagers;
+		for (const assetManager of assetManagers) {
+			const blueprintAssetManager = blueprintAssetManagers.find(({ name }) => name === assetManager.name);
+			invariant(blueprintAssetManager !== void 0, `AssetManager ${assetManager.name} does not exist in network blueprint`);
+			const assetManagerId = blueprintAssetManager.tradelinkId;
+			logStep(`Creating assetManager ${assetManager.name}...`);
+			if (existingTradelinkNetwork.assetManagers.find(({ tradelinkId }) => tradelinkId === assetManagerId) !== void 0) {
+				logger.info(`[SKIPPED] Asset manager "${assetManager.name}" already exists`);
+				continue;
+			}
+			logSubStep("Creating request...");
+			await approveRequest(await admin1.client.requests.create.mutate({ request: {
+				type: "TRADELINK_CREATE_ASSET_MANAGER",
+				data: {
+					tradelinkId: assetManagerId,
+					groups: assetManager.groups.map(tradelinkReviewStepFromManifest),
+					whitelist: assetManager.whitelist
+				}
+			} }), [
+				admin1,
+				admin2,
+				...await Promise.all(assetManager.groups.flatMap(({ quorum, members }) => members.slice(0, quorum).map((deviceIndex) => workspaceEngine.withDeviceIndex(deviceIndex).login())))
+			], logger);
+			existingTradelinkNetwork = await admin1.client.tradelink.getNetwork.query();
+			invariant(existingTradelinkNetwork !== null, "Tradelink network exists");
+		}
+	}
+	async function resolveDevicesIndexes(users) {
+		return await users.reduce((acc, cur) => acc.then(async (acc) => {
+			acc.push(await withDeviceIndex(cur));
+			return acc;
+		}), Promise.resolve([]));
+	}
+	async function withDeviceIndex(user) {
+		invariant(user.deviceUserId, `User ${user.id} does not have any device user id`);
+		return {
+			user,
+			deviceIndex: await findDeviceIndex(user.deviceUserId)
+		};
+	}
+	function userIdFromDeviceIndex(deviceIndex) {
+		const corresponding = usersWithDeviceIndex.find((o) => o.deviceIndex === deviceIndex);
+		invariant(corresponding, `No user with device index ${deviceIndex}`);
+		return corresponding.user.id;
+	}
+	function userIdFromUserName(name) {
+		const user = existingApiUsers.find((u) => u.name === name);
+		invariant(user, `User ${name} not found`);
+		return user.id;
+	}
+	function userIdFromDeviceIndexOrName(identifier) {
+		if (typeof identifier === "number") return userIdFromDeviceIndex(identifier);
+		return userIdFromUserName(identifier);
+	}
+	function groupIdFromName(groupName) {
+		const group = existingGroups.find((g) => g.name === groupName);
+		invariant(group, `Group ${groupName} not found`);
+		return group.id;
+	}
+	function policyIdFromName(policyName) {
+		const policy = existingPolicies.find((g) => g.name === policyName);
+		invariant(policy, `Policy ${policyName} not found`);
+		return policy.id;
+	}
+	function whitelistIdFromName(whitelistName) {
+		const whitelist = existingWhitelists.find((w) => w.name === whitelistName);
+		invariant(whitelist, `Whitelist ${whitelistName} not found`);
+		return whitelist.id;
+	}
+	function accountIdFromName(accountName) {
+		const account = existingAccounts.find((a) => a.name === accountName);
+		invariant(account, `Account "${accountName}" not found`);
+		return account.id;
+	}
+	function assetManagerIdFromName(assetManagerName) {
+		const orgAssetManager = tradelinkOrgAssetManagersByName[assetManagerName];
+		invariant(orgAssetManager, `Can't find Tradelink organization asset manager ${assetManagerName}`);
+		const assetManager = existingTradelinkNetwork?.assetManagers.find((assetManager) => assetManager.tradelinkId === orgAssetManager.tradelinkId);
+		invariant(assetManager, `Can't find Tradelink assetManager ${assetManagerName}`);
+		return assetManager.id;
+	}
+	function exchangeIdFromName(exchangeName) {
+		const exchange = existingTradelinkNetwork?.exchanges.find((exchange) => {
+			const orgExchange = tradelinkOrgExchangesByName[exchangeName];
+			invariant(orgExchange, `Can't find Tradelink organization exchange ${exchange.tradelinkId}`);
+			return orgExchange.name === exchangeName;
+		});
+		invariant(exchange, `Can't find Tradelink exchange ${exchangeName}`);
+		return exchange.id;
+	}
+	function tradelinkReviewStepFromManifest({ members, quorum }) {
+		return {
+			userIds: members.map(userIdFromDeviceIndex),
+			quorum
+		};
+	}
 }
-
-// src/bake/recipe-workspace.ts
-import invariant4 from "invariant";
-import { match as match2 } from "ts-pattern";
+//#endregion
+//#region src/bake/recipe-workspace.ts
 async function recipeWorkspace(options, logger) {
-  const { engine, workspaceName } = options;
-  const workspaceEngine = engine.withWorkspace(workspaceName);
-  const findDeviceIndex = createDeviceIndexResolver(workspaceEngine);
-  logger.info("Authenticating with admin...");
-  const admin = await workspaceEngine.withDeviceIndex(4).login();
-  logger.info("Fetching existing data...");
-  const [
-    existingUsers,
-    existingGroups,
-    existingWhitelists,
-    publicPolicies,
-    privatePolicies,
-    existingAccounts,
-    existingEntities,
-    existingWorkspaceRules
-  ] = await Promise.all([
-    fetchAll(admin.client.users.list.query, { status: "ACTIVE" }),
-    fetchAll(admin.client.groups.list.query, { status: "ACTIVE" }),
-    fetchAll(admin.client.whitelists.list.query, { status: "ACTIVE" }),
-    fetchAll(admin.client.policies.list.query, { isPrivate: false }),
-    fetchAll(admin.client.policies.list.query, { isPrivate: true }),
-    fetchAll(admin.client.accounts.list.query, { status: "ACTIVE" }),
-    fetchAll(admin.client.entities.list.query, { status: "ACTIVE" }),
-    admin.client.governance.listWorkspaceRules.query()
-  ]);
-  const existingPolicies = [...publicPolicies, ...privatePolicies];
-  const existingPsdUsers = existingUsers.filter((user) => user.deviceType === "PSD");
-  const existingApiUsers = existingUsers.filter((user) => user.deviceType === "API");
-  logger.info("Resolving device indexes...");
-  const psdUsersWithIndex = await resolveDevicesIndexes(existingPsdUsers);
-  logger.info("Reading users...");
-  const adminIndexes = psdUsersWithIndex.filter((u) => u.user.role === "ADMIN").map((u) => u.deviceIndex);
-  const operatorIndexes = psdUsersWithIndex.filter((u) => u.user.role === "OPERATOR").map((u) => u.deviceIndex);
-  const apiUsers = existingApiUsers.map((user) => {
-    const role = match2(user.role).with("ADMIN", "OPERATOR", (role2) => role2).with("READ_ONLY_API_KEY", (role2) => {
-      throw new Error(`Unexpected API user role "${role2}" for user ${user.name}`);
-    }).exhaustive();
-    return {
-      name: user.name,
-      role,
-      pubKey: user.pubKey,
-      viewAll: user.legacyViewAll
-    };
-  });
-  logger.info("Reading groups...");
-  const groups = existingGroups.map((group) => ({
-    name: group.name,
-    members: group.members.map((member) => resolveUserIdentifier(member.id))
-  }));
-  logger.info("Reading whitelists...");
-  const whitelists = existingWhitelists.map((whitelist) => ({
-    name: whitelist.name,
-    description: whitelist.description ?? void 0,
-    type: "TRANSACTION",
-    addresses: whitelist.addresses.map((addr) => ({
-      name: addr.name,
-      currency: addr.currency,
-      address: addr.address,
-      ...addr.destinationTags?.length ? { destinationTags: addr.destinationTags } : {}
-    }))
-  }));
-  logger.info("Reading policies...");
-  const policies = publicPolicies.map((policy) => ({
-    name: policy.name,
-    currency: policy.currency,
-    rules: policy.rules.map(govRuleToManifest)
-  }));
-  logger.info("Reading accounts...");
-  const accounts = existingAccounts.map((account) => {
-    const governance = match2(account.governance).with({ type: "CLASSIC" }, (gov) => {
-      const policy = existingPolicies.find((p) => p.id === gov.policyId);
-      invariant4(policy, `Policy ${gov.policyId} not found for account ${account.name}`);
-      return policy.isPrivate ? {
-        type: "CLASSIC",
-        rules: policy.rules.map(govRuleToManifest)
-      } : {
-        type: "POLICY",
-        policy: policy.name
-      };
-    }).with({ type: "RAW_SIGNING" }, (gov) => {
-      const policy = existingPolicies.find((p) => p.id === gov.policyId);
-      invariant4(policy, `Policy ${gov.policyId} not found for account ${account.name}`);
-      return {
-        type: "RAW_SIGNING",
-        rules: policy.rules.map((rule) => ({
-          type: "SIGN_DIGESTS",
-          steps: rule.reviewSteps.map((step) => {
-            invariant4("userIds" in step, "RAW_SIGNING rules only support user steps");
-            return {
-              quorum: step.quorum,
-              members: step.userIds.map(resolveUserToDeviceIndexOrName)
-            };
-          })
-        }))
-      };
-    }).with({ type: "TRADELINK" }, (gov) => ({
-      type: "TRADELINK",
-      assetManager: resolveAssetManagerName(gov.assetManagerId),
-      exchanges: gov.exchangeConfigs.map((exchangeConfig) => ({
-        name: resolveExchangeName(exchangeConfig.exchangeId),
-        ...exchangeConfig.repledgeAuthorized ? { repledgeAuthorized: true } : {},
-        ...exchangeConfig.needsAssetManagerApprovalForSettlements ? { needsAssetManagerApprovalForSettlements: true } : {}
-      }))
-    })).exhaustive();
-    return {
-      name: account.name,
-      currency: account.currency,
-      index: account.index,
-      ...account.contractAddress ? { contractAddress: account.contractAddress } : {},
-      ...account.tokenIdentifier ? { tokenIdentifier: account.tokenIdentifier } : {},
-      governance
-    };
-  });
-  logger.info("Reading entities...");
-  const entities = existingEntities.map((entity) => ({
-    name: entity.name,
-    ...entity.accountIds.length > 0 ? { accounts: entity.accountIds.map(accountNameFromId) } : {},
-    ...entity.memberIds.length > 0 ? { members: entity.memberIds.map(userNameFromId) } : {}
-  }));
-  logger.info("Reading workspace rules...");
-  const workspaceRules = existingWorkspaceRules.results.filter((rule) => rule.permission !== "ROOT").map((rule) => {
-    invariant4(
-      rule.reviewSteps.length === 1,
-      "Only one review step supported for workspace rules in manifest"
-    );
-    const step = rule.reviewSteps[0];
-    const quorum = step.quorum;
-    invariant4(rule.permission !== "ROOT", "filtered out");
-    return {
-      permission: rule.permission,
-      quorum,
-      members: step.userIds.map(resolveUserToDeviceIndexOrName)
-    };
-  });
-  const workspace = {
-    users: {
-      ...adminIndexes.length > 0 ? { admins: adminIndexes } : {},
-      ...operatorIndexes.length > 0 ? { operators: operatorIndexes } : {},
-      ...apiUsers.length > 0 ? { api: apiUsers } : {}
-    },
-    ...groups.length > 0 ? { groups } : {},
-    ...whitelists.length > 0 ? { whitelists } : {},
-    ...policies.length > 0 ? { policies } : {},
-    ...accounts.length > 0 ? { accounts } : {},
-    ...entities.length > 0 ? { entities } : {},
-    ...workspaceRules.length > 0 ? { workspaceRules } : {}
-  };
-  logger.info("Recipe completed");
-  return workspace;
-  async function resolveDevicesIndexes(users) {
-    const result = [];
-    for (const user of users) {
-      invariant4(user.deviceUserId, `User ${user.id} does not have any device user id`);
-      const deviceIndex = await findDeviceIndex(user.deviceUserId);
-      result.push({ user, deviceIndex });
-    }
-    return result;
-  }
-  function resolveUserIdentifier(userId) {
-    const psdUser = psdUsersWithIndex.find((u) => u.user.id === userId);
-    if (psdUser) return psdUser.deviceIndex;
-    const apiUser = existingApiUsers.find((u) => u.id === userId);
-    if (apiUser) return apiUser.name;
-    throw new Error(`User ${userId} not found`);
-  }
-  function resolveUserToDeviceIndexOrName(userId) {
-    return resolveUserIdentifier(userId);
-  }
-  function validateGovernanceRuleType(value) {
-    invariant4(
-      ["SEND", "STAKE", "DEPLOY_CONTRACT", "EXECUTE_CONTRACT", "SIGN_MESSAGE", "RECEIVE"].includes(
-        value
-      ),
-      "Unexpected governance rule type: " + value
-    );
-    return value;
-  }
-  function govRuleToManifest(rule) {
-    const operationType = validateGovernanceRuleType(rule.operationType);
-    const threshold = rule.threshold !== void 0 && (rule.threshold.min !== null || rule.threshold.max !== null) ? { threshold: { min: rule.threshold.min, max: rule.threshold.max } } : {};
-    return {
-      type: operationType,
-      steps: rule.reviewSteps.map((step) => {
-        if ("groupId" in step) {
-          const group = existingGroups.find((g) => g.id === step.groupId);
-          invariant4(group, `Group ${step.groupId} not found`);
-          return { quorum: step.quorum, group: group.name };
-        }
-        return {
-          quorum: step.quorum,
-          members: step.userIds.map(resolveUserToDeviceIndexOrName)
-        };
-      }),
-      ...threshold,
-      ...rule.whitelistIds && rule.whitelistIds.length > 0 ? { whitelistNames: rule.whitelistIds.map(whitelistNameFromId) } : {}
-    };
-  }
-  function whitelistNameFromId(whitelistId) {
-    const whitelist = existingWhitelists.find((w) => w.id === whitelistId);
-    invariant4(whitelist, `Whitelist ${whitelistId} not found`);
-    return whitelist.name;
-  }
-  function accountNameFromId(accountId) {
-    const account = existingAccounts.find((a) => a.id === accountId);
-    invariant4(account, `Account ${accountId} not found`);
-    return account.name;
-  }
-  function userNameFromId(userId) {
-    const user = existingApiUsers.find((u) => u.id === userId);
-    invariant4(user, `API user ${userId} not found`);
-    return user.name;
-  }
-  function resolveAssetManagerName(assetManagerId) {
-    return assetManagerId;
-  }
-  function resolveExchangeName(exchangeId) {
-    return exchangeId;
-  }
+	const { engine, workspaceName } = options;
+	const workspaceEngine = engine.withWorkspace(workspaceName);
+	const findDeviceIndex = createDeviceIndexResolver(workspaceEngine);
+	logger.info("Authenticating with admin...");
+	const admin = await workspaceEngine.withDeviceIndex(4).login();
+	logger.info("Fetching existing data...");
+	const [existingUsers, existingGroups, existingWhitelists, publicPolicies, privatePolicies, existingAccounts, existingEntities, existingWorkspaceRules] = await Promise.all([
+		fetchAll(admin.client.users.list.query, { status: "ACTIVE" }),
+		fetchAll(admin.client.groups.list.query, { status: "ACTIVE" }),
+		fetchAll(admin.client.whitelists.list.query, { status: "ACTIVE" }),
+		fetchAll(admin.client.policies.list.query, { isPrivate: false }),
+		fetchAll(admin.client.policies.list.query, { isPrivate: true }),
+		fetchAll(admin.client.accounts.list.query, { status: "ACTIVE" }),
+		fetchAll(admin.client.entities.list.query, { status: "ACTIVE" }),
+		admin.client.governance.listWorkspaceRules.query()
+	]);
+	const existingPolicies = [...publicPolicies, ...privatePolicies];
+	const existingPsdUsers = existingUsers.filter((user) => user.deviceType === "PSD");
+	const existingApiUsers = existingUsers.filter((user) => user.deviceType === "API");
+	logger.info("Resolving device indexes...");
+	const psdUsersWithIndex = await resolveDevicesIndexes(existingPsdUsers);
+	logger.info("Reading users...");
+	const adminIndexes = psdUsersWithIndex.filter((u) => u.user.role === "ADMIN").map((u) => u.deviceIndex);
+	const operatorIndexes = psdUsersWithIndex.filter((u) => u.user.role === "OPERATOR").map((u) => u.deviceIndex);
+	const apiUsers = existingApiUsers.map((user) => {
+		const role = match(user.role).with("ADMIN", "OPERATOR", (role) => role).with("READ_ONLY_API_KEY", (role) => {
+			throw new Error(`Unexpected API user role "${role}" for user ${user.name}`);
+		}).exhaustive();
+		return {
+			name: user.name,
+			role,
+			pubKey: user.pubKey,
+			viewAll: user.legacyViewAll
+		};
+	});
+	logger.info("Reading groups...");
+	const groups = existingGroups.map((group) => ({
+		name: group.name,
+		members: group.members.map((member) => resolveUserIdentifier(member.id))
+	}));
+	logger.info("Reading whitelists...");
+	const whitelists = existingWhitelists.map((whitelist) => ({
+		name: whitelist.name,
+		description: whitelist.description ?? void 0,
+		type: "TRANSACTION",
+		addresses: whitelist.addresses.map((addr) => ({
+			name: addr.name,
+			currency: addr.currency,
+			address: addr.address,
+			...addr.destinationTags?.length ? { destinationTags: addr.destinationTags } : {}
+		}))
+	}));
+	logger.info("Reading policies...");
+	const policies = publicPolicies.map((policy) => ({
+		name: policy.name,
+		currency: policy.currency,
+		rules: policy.rules.map(govRuleToManifest)
+	}));
+	logger.info("Reading accounts...");
+	const accounts = existingAccounts.map((account) => {
+		const governance = match(account.governance).with({ type: "CLASSIC" }, (gov) => {
+			const policy = existingPolicies.find((p) => p.id === gov.policyId);
+			invariant(policy, `Policy ${gov.policyId} not found for account ${account.name}`);
+			return policy.isPrivate ? {
+				type: "CLASSIC",
+				rules: policy.rules.map(govRuleToManifest)
+			} : {
+				type: "POLICY",
+				policy: policy.name
+			};
+		}).with({ type: "RAW_SIGNING" }, (gov) => {
+			const policy = existingPolicies.find((p) => p.id === gov.policyId);
+			invariant(policy, `Policy ${gov.policyId} not found for account ${account.name}`);
+			return {
+				type: "RAW_SIGNING",
+				rules: policy.rules.map((rule) => ({
+					type: "SIGN_DIGESTS",
+					steps: rule.reviewSteps.map((step) => {
+						invariant("userIds" in step, "RAW_SIGNING rules only support user steps");
+						return {
+							quorum: step.quorum,
+							members: step.userIds.map(resolveUserToDeviceIndexOrName)
+						};
+					})
+				}))
+			};
+		}).with({ type: "TRADELINK" }, (gov) => ({
+			type: "TRADELINK",
+			assetManager: resolveAssetManagerName(gov.assetManagerId),
+			exchanges: gov.exchangeConfigs.map((exchangeConfig) => ({
+				name: resolveExchangeName(exchangeConfig.exchangeId),
+				...exchangeConfig.repledgeAuthorized ? { repledgeAuthorized: true } : {},
+				...exchangeConfig.needsAssetManagerApprovalForSettlements ? { needsAssetManagerApprovalForSettlements: true } : {}
+			}))
+		})).exhaustive();
+		return {
+			name: account.name,
+			currency: account.currency,
+			index: account.index,
+			...account.contractAddress ? { contractAddress: account.contractAddress } : {},
+			...account.tokenIdentifier ? { tokenIdentifier: account.tokenIdentifier } : {},
+			governance
+		};
+	});
+	logger.info("Reading entities...");
+	const entities = existingEntities.map((entity) => ({
+		name: entity.name,
+		...entity.accountIds.length > 0 ? { accounts: entity.accountIds.map(accountNameFromId) } : {},
+		...entity.memberIds.length > 0 ? { members: entity.memberIds.map(userNameFromId) } : {}
+	}));
+	logger.info("Reading workspace rules...");
+	const workspaceRules = existingWorkspaceRules.results.filter((rule) => rule.permission !== "ROOT").map((rule) => {
+		invariant(rule.reviewSteps.length === 1, "Only one review step supported for workspace rules in manifest");
+		const step = rule.reviewSteps[0];
+		const quorum = step.quorum;
+		invariant(rule.permission !== "ROOT", "filtered out");
+		return {
+			permission: rule.permission,
+			quorum,
+			members: step.userIds.map(resolveUserToDeviceIndexOrName)
+		};
+	});
+	const workspace = {
+		users: {
+			...adminIndexes.length > 0 ? { admins: adminIndexes } : {},
+			...operatorIndexes.length > 0 ? { operators: operatorIndexes } : {},
+			...apiUsers.length > 0 ? { api: apiUsers } : {}
+		},
+		...groups.length > 0 ? { groups } : {},
+		...whitelists.length > 0 ? { whitelists } : {},
+		...policies.length > 0 ? { policies } : {},
+		...accounts.length > 0 ? { accounts } : {},
+		...entities.length > 0 ? { entities } : {},
+		...workspaceRules.length > 0 ? { workspaceRules } : {}
+	};
+	logger.info("Recipe completed");
+	return workspace;
+	async function resolveDevicesIndexes(users) {
+		const result = [];
+		for (const user of users) {
+			invariant(user.deviceUserId, `User ${user.id} does not have any device user id`);
+			const deviceIndex = await findDeviceIndex(user.deviceUserId);
+			result.push({
+				user,
+				deviceIndex
+			});
+		}
+		return result;
+	}
+	function resolveUserIdentifier(userId) {
+		const psdUser = psdUsersWithIndex.find((u) => u.user.id === userId);
+		if (psdUser) return psdUser.deviceIndex;
+		const apiUser = existingApiUsers.find((u) => u.id === userId);
+		if (apiUser) return apiUser.name;
+		throw new Error(`User ${userId} not found`);
+	}
+	function resolveUserToDeviceIndexOrName(userId) {
+		return resolveUserIdentifier(userId);
+	}
+	function validateGovernanceRuleType(value) {
+		invariant([
+			"SEND",
+			"STAKE",
+			"DEPLOY_CONTRACT",
+			"EXECUTE_CONTRACT",
+			"SIGN_MESSAGE",
+			"RECEIVE"
+		].includes(value), "Unexpected governance rule type: " + value);
+		return value;
+	}
+	function govRuleToManifest(rule) {
+		const operationType = validateGovernanceRuleType(rule.operationType);
+		const threshold = rule.threshold !== void 0 && (rule.threshold.min !== null || rule.threshold.max !== null) ? { threshold: {
+			min: rule.threshold.min,
+			max: rule.threshold.max
+		} } : {};
+		return {
+			type: operationType,
+			steps: rule.reviewSteps.map((step) => {
+				if ("groupId" in step) {
+					const group = existingGroups.find((g) => g.id === step.groupId);
+					invariant(group, `Group ${step.groupId} not found`);
+					return {
+						quorum: step.quorum,
+						group: group.name
+					};
+				}
+				return {
+					quorum: step.quorum,
+					members: step.userIds.map(resolveUserToDeviceIndexOrName)
+				};
+			}),
+			...threshold,
+			...rule.whitelistIds && rule.whitelistIds.length > 0 ? { whitelistNames: rule.whitelistIds.map(whitelistNameFromId) } : {}
+		};
+	}
+	function whitelistNameFromId(whitelistId) {
+		const whitelist = existingWhitelists.find((w) => w.id === whitelistId);
+		invariant(whitelist, `Whitelist ${whitelistId} not found`);
+		return whitelist.name;
+	}
+	function accountNameFromId(accountId) {
+		const account = existingAccounts.find((a) => a.id === accountId);
+		invariant(account, `Account ${accountId} not found`);
+		return account.name;
+	}
+	function userNameFromId(userId) {
+		const user = existingApiUsers.find((u) => u.id === userId);
+		invariant(user, `API user ${userId} not found`);
+		return user.name;
+	}
+	function resolveAssetManagerName(assetManagerId) {
+		return assetManagerId;
+	}
+	function resolveExchangeName(exchangeId) {
+		return exchangeId;
+	}
 }
-
-// src/bake/recipe.ts
+//#endregion
+//#region src/bake/recipe.ts
 async function recipeManifest(options, logger) {
-  const workspace = await recipeWorkspace(options, logger);
-  return {
-    manifestVersion: 2,
-    workspace
-  };
+	return {
+		manifestVersion: 2,
+		workspace: await recipeWorkspace(options, logger)
+	};
 }
-
-// src/bake/types.ts
-import z from "zod";
-var zManifestUser = z.number().meta({ description: "User device index" });
-var zManifestUserName = z.string().meta({ description: "User name" });
-var zManifestApiUser = z.object({
-  name: z.string().meta({ description: "API user name" }),
-  role: z.enum(["ADMIN", "OPERATOR"]).meta({ description: "API user role" }).default("OPERATOR"),
-  pubKey: z.string().meta({
-    description: "API user public key. If not provided, one will be generated using the name as entropy"
-  }).optional(),
-  viewAll: z.boolean().meta({ description: "Whether the API user can view all accounts" })
+//#endregion
+//#region src/bake/types.ts
+const zManifestUser = z.number().meta({ description: "User device index" });
+const zManifestUserName = z.string().meta({ description: "User name" });
+const zManifestApiUser = z.object({
+	name: z.string().meta({ description: "API user name" }),
+	role: z.enum(["ADMIN", "OPERATOR"]).meta({ description: "API user role" }).default("OPERATOR"),
+	pubKey: z.string().meta({ description: "API user public key. If not provided, one will be generated using the name as entropy" }).optional(),
+	viewAll: z.boolean().meta({ description: "Whether the API user can view all accounts" })
 });
-var zManifestGroup = z.object({
-  name: z.string().meta({ description: "Group name" }),
-  members: z.array(z.union([zManifestUser, zManifestUserName])).meta({ description: "Group members" })
+const zManifestGroup = z.object({
+	name: z.string().meta({ description: "Group name" }),
+	members: z.array(z.union([zManifestUser, zManifestUserName])).meta({ description: "Group members" })
 }).strict().meta({ description: "Operators group" });
-var zManifestWhitelistAddress = z.object({
-  name: z.string().meta({ description: "Whitelist address name" }),
-  currency: z.string().meta({ description: "Whitelist address currency" }),
-  address: z.string().meta({ description: "Whitelist address" }),
-  destinationTags: z.array(z.string()).optional().meta({ description: "List of destination tags (applicable for Ripple currency)" })
+const zManifestWhitelistAddress = z.object({
+	name: z.string().meta({ description: "Whitelist address name" }),
+	currency: z.string().meta({ description: "Whitelist address currency" }),
+	address: z.string().meta({ description: "Whitelist address" }),
+	destinationTags: z.array(z.string()).optional().meta({ description: "List of destination tags (applicable for Ripple currency)" })
 }).strict();
-var zManifestWhitelist = z.object({
-  name: z.string().meta({ description: "Whitelist name" }),
-  description: z.string().optional().meta({ description: "Whitelist description" }),
-  type: z.enum(["TRANSACTION", "SMART_CONTRACT"]).optional().default("TRANSACTION").meta({ description: "Whitelist type" }),
-  addresses: z.array(zManifestWhitelistAddress).meta({ description: "Whitelist addresses" })
+const zManifestWhitelist = z.object({
+	name: z.string().meta({ description: "Whitelist name" }),
+	description: z.string().optional().meta({ description: "Whitelist description" }),
+	type: z.enum(["TRANSACTION", "SMART_CONTRACT"]).optional().default("TRANSACTION").meta({ description: "Whitelist type" }),
+	addresses: z.array(zManifestWhitelistAddress).meta({ description: "Whitelist addresses" })
 }).strict().meta({ description: "Whitelist" });
-var zManifestGovernanceStepWithUsers = z.object({
-  quorum: z.number(),
-  members: z.array(z.union([zManifestUser, zManifestUserName]))
+const zManifestGovernanceStepWithUsers = z.object({
+	quorum: z.number(),
+	members: z.array(z.union([zManifestUser, zManifestUserName]))
 }).strict();
-var zManifestGovernanceStepWithGroup = z.object({
-  quorum: z.number(),
-  group: z.string()
+const zManifestGovernanceStepWithGroup = z.object({
+	quorum: z.number(),
+	group: z.string()
 }).strict();
-var zManifestGovernanceStep = z.union([
-  zManifestGovernanceStepWithUsers,
-  zManifestGovernanceStepWithGroup
-]);
-var zManifestGovernanceRule = z.object({
-  // TODO see if there is a way to import this from `api` package
-  // (the challenge there is that enums are not transpiled)
-  type: z.enum([
-    "SEND",
-    "STAKE",
-    "DEPLOY_CONTRACT",
-    "EXECUTE_CONTRACT",
-    "SIGN_MESSAGE",
-    "RECEIVE"
-  ]),
-  steps: z.array(zManifestGovernanceStep).min(1),
-  threshold: z.object({
-    min: z.string().nullable(),
-    max: z.string().nullable()
-  }).optional(),
-  whitelistNames: z.array(z.string()).optional()
+const zManifestGovernanceStep = z.union([zManifestGovernanceStepWithUsers, zManifestGovernanceStepWithGroup]);
+const zManifestGovernanceRule = z.object({
+	type: z.enum([
+		"SEND",
+		"STAKE",
+		"DEPLOY_CONTRACT",
+		"EXECUTE_CONTRACT",
+		"SIGN_MESSAGE",
+		"RECEIVE"
+	]),
+	steps: z.array(zManifestGovernanceStep).min(1),
+	threshold: z.object({
+		min: z.string().nullable(),
+		max: z.string().nullable()
+	}).optional(),
+	whitelistNames: z.array(z.string()).optional()
 }).strict();
-var zManifestPolicy = z.object({
-  name: z.string(),
-  currency: z.string().nullable(),
-  rules: z.array(zManifestGovernanceRule)
+const zManifestPolicy = z.object({
+	name: z.string(),
+	currency: z.string().nullable(),
+	rules: z.array(zManifestGovernanceRule)
 }).strict();
-var zManifestClassicAccountGovernance = z.object({
-  type: z.literal("CLASSIC"),
-  rules: z.array(zManifestGovernanceRule)
+const zManifestClassicAccountGovernance = z.object({
+	type: z.literal("CLASSIC"),
+	rules: z.array(zManifestGovernanceRule)
 }).strict();
-var zManifestClassicAccountGovernanceWithPolicy = z.object({
-  type: z.literal("POLICY"),
-  policy: z.string()
+const zManifestClassicAccountGovernanceWithPolicy = z.object({
+	type: z.literal("POLICY"),
+	policy: z.string()
 }).strict();
-var zManifestTradelinkExchangeConfig = z.object({
-  name: z.string().meta({ description: "Exchange name" }),
-  repledgeAuthorized: z.boolean().optional().meta({ description: "Whether repledge is authorized" }),
-  needsAssetManagerApprovalForSettlements: z.boolean().optional().meta({ description: "Whether asset manager pre approval is needed" })
+const zManifestTradelinkExchangeConfig = z.object({
+	name: z.string().meta({ description: "Exchange name" }),
+	repledgeAuthorized: z.boolean().optional().meta({ description: "Whether repledge is authorized" }),
+	needsAssetManagerApprovalForSettlements: z.boolean().optional().meta({ description: "Whether asset manager pre approval is needed" })
 }).strict();
-var zManifestTradelinkAccountGovernance = z.object({
-  type: z.literal("TRADELINK"),
-  assetManager: z.string().meta({ description: "Asset manager name" }),
-  exchanges: z.array(zManifestTradelinkExchangeConfig)
+const zManifestTradelinkAccountGovernance = z.object({
+	type: z.literal("TRADELINK"),
+	assetManager: z.string().meta({ description: "Asset manager name" }),
+	exchanges: z.array(zManifestTradelinkExchangeConfig)
 }).strict();
-var zManifestRawSigningGovernanceRule = z.object({
-  type: z.literal("SIGN_DIGESTS"),
-  steps: z.array(zManifestGovernanceStepWithUsers).min(1)
+const zManifestRawSigningGovernanceRule = z.object({
+	type: z.literal("SIGN_DIGESTS"),
+	steps: z.array(zManifestGovernanceStepWithUsers).min(1)
 }).strict();
-var zManifestRawSigningAccountGovernance = z.object({
-  type: z.literal("RAW_SIGNING"),
-  rules: z.array(zManifestRawSigningGovernanceRule)
+const zManifestRawSigningAccountGovernance = z.object({
+	type: z.literal("RAW_SIGNING"),
+	rules: z.array(zManifestRawSigningGovernanceRule)
 }).strict();
-var zManifestAccountGovernance = z.discriminatedUnion("type", [
-  zManifestClassicAccountGovernance,
-  zManifestTradelinkAccountGovernance,
-  zManifestRawSigningAccountGovernance,
-  zManifestClassicAccountGovernanceWithPolicy
+const zManifestAccountGovernance = z.discriminatedUnion("type", [
+	zManifestClassicAccountGovernance,
+	zManifestTradelinkAccountGovernance,
+	zManifestRawSigningAccountGovernance,
+	zManifestClassicAccountGovernanceWithPolicy
 ]);
-var zManifestAccount = z.object({
-  name: z.string(),
-  currency: z.string(),
-  index: z.number().nonnegative(),
-  contractAddress: z.string().optional(),
-  tokenIdentifier: z.string().optional(),
-  governance: zManifestAccountGovernance
+const zManifestAccount = z.object({
+	name: z.string(),
+	currency: z.string(),
+	index: z.number().nonnegative(),
+	contractAddress: z.string().optional(),
+	tokenIdentifier: z.string().optional(),
+	governance: zManifestAccountGovernance
 }).strict();
-var zManifestEntity = z.object({
-  name: z.string().min(1).max(19).meta({ description: "Entity name" }),
-  accounts: z.array(z.string()).optional().meta({ description: "Account names to include in this entity" }),
-  members: z.array(z.string()).optional().meta({ description: "API operator names to include in this entity" })
+const zManifestEntity = z.object({
+	name: z.string().min(1).max(19).meta({ description: "Entity name" }),
+	accounts: z.array(z.string()).optional().meta({ description: "Account names to include in this entity" }),
+	members: z.array(z.string()).optional().meta({ description: "API operator names to include in this entity" })
 }).strict().meta({ description: "Entity" });
-var zManifestHederaData = z.object({
-  index: z.number(),
-  onChainId: z.string(),
-  activate: z.boolean().default(true)
+const zManifestHederaData = z.object({
+	index: z.number(),
+	onChainId: z.string(),
+	activate: z.boolean().default(true)
 }).strict();
-var zManifestPledgeAdjustment = z.object({
-  account: z.string(),
-  exchange: z.string(),
-  amount: z.string()
+const zManifestPledgeAdjustment = z.object({
+	account: z.string(),
+	exchange: z.string(),
+	amount: z.string()
 }).strict();
-var zManifestTradelinkGroup = z.object({
-  members: z.array(zManifestUser),
-  quorum: z.number()
+const zManifestTradelinkGroup = z.object({
+	members: z.array(zManifestUser),
+	quorum: z.number()
 }).strict().meta({ description: "Tradelink group" });
-var zManifestTradelinkGroups = z.array(zManifestTradelinkGroup);
-var zManifestTradelinkWhitelistAddress = z.object({
-  name: z.string().min(1),
-  currency: z.string().min(1),
-  address: z.string().min(1)
+const zManifestTradelinkGroups = z.array(zManifestTradelinkGroup);
+const zManifestTradelinkWhitelistAddress = z.object({
+	name: z.string().min(1),
+	currency: z.string().min(1),
+	address: z.string().min(1)
 }).strict().meta({ description: "Tradelink whitelist address" });
-var zManifestTradelinkWhitelist = z.array(zManifestTradelinkWhitelistAddress).meta({ description: "Tradelink whitelist" });
-var zManifestTradelinkEntity = z.object({
-  name: z.string(),
-  groups: zManifestTradelinkGroups,
-  whitelist: zManifestTradelinkWhitelist
+const zManifestTradelinkWhitelist = z.array(zManifestTradelinkWhitelistAddress).meta({ description: "Tradelink whitelist" });
+const zManifestTradelinkEntity = z.object({
+	name: z.string(),
+	groups: zManifestTradelinkGroups,
+	whitelist: zManifestTradelinkWhitelist
 }).strict();
-var zManifestTradelinkCustodian = z.object({
-  settlement: zManifestTradelinkGroups,
-  withdraw: zManifestTradelinkGroups,
-  arbitration: zManifestTradelinkGroups
+const zManifestTradelinkCustodian = z.object({
+	settlement: zManifestTradelinkGroups,
+	withdraw: zManifestTradelinkGroups,
+	arbitration: zManifestTradelinkGroups
 }).strict();
-var zManifestTradelinkNetworkBlueprint = z.object({
-  custodian: z.string(),
-  exchanges: z.array(z.string()),
-  assetManagers: z.array(z.string())
+const zManifestTradelinkNetworkBlueprint = z.object({
+	custodian: z.string(),
+	exchanges: z.array(z.string()),
+	assetManagers: z.array(z.string())
 }).strict();
-var zManifestTradelinkNetwork = z.object({
-  networkBlueprint: zManifestTradelinkNetworkBlueprint.optional(),
-  custodian: zManifestTradelinkCustodian.optional(),
-  exchanges: z.array(zManifestTradelinkEntity).optional(),
-  assetManagers: z.array(zManifestTradelinkEntity).optional()
+const zManifestTradelinkNetwork = z.object({
+	networkBlueprint: zManifestTradelinkNetworkBlueprint.optional(),
+	custodian: zManifestTradelinkCustodian.optional(),
+	exchanges: z.array(zManifestTradelinkEntity).optional(),
+	assetManagers: z.array(zManifestTradelinkEntity).optional()
 }).strict().meta({ description: "Tradelink network configuration" });
-var zManifestWorkspaceRule = z.object({
-  permission: z.enum(["CREATE_ACCOUNT_WITH_POLICY"]),
-  quorum: z.number().min(1),
-  members: z.array(z.union([zManifestUser, zManifestUserName]))
+const zManifestWorkspaceRule = z.object({
+	permission: z.enum(["CREATE_ACCOUNT_WITH_POLICY"]),
+	quorum: z.number().min(1),
+	members: z.array(z.union([zManifestUser, zManifestUserName]))
 }).strict().meta({ description: "Workspace rule for granting permissions" });
-var zManifestWorkspace = z.object({
-  tradelink: zManifestTradelinkNetwork.optional(),
-  users: z.object({
-    admins: z.array(zManifestUser).optional(),
-    operators: z.array(zManifestUser).optional(),
-    api: z.array(zManifestApiUser).optional()
-  }).optional(),
-  groups: z.array(zManifestGroup).optional(),
-  whitelists: z.array(zManifestWhitelist).optional(),
-  policies: z.array(zManifestPolicy).optional(),
-  accounts: z.array(zManifestAccount).optional(),
-  entities: z.array(zManifestEntity).optional(),
-  hederaData: z.record(z.string(), z.array(zManifestHederaData)).optional(),
-  pledges: z.array(zManifestPledgeAdjustment).optional(),
-  workspaceRules: z.array(zManifestWorkspaceRule).optional()
+const zManifestWorkspace = z.object({
+	tradelink: zManifestTradelinkNetwork.optional(),
+	users: z.object({
+		admins: z.array(zManifestUser).optional(),
+		operators: z.array(zManifestUser).optional(),
+		api: z.array(zManifestApiUser).optional()
+	}).optional(),
+	groups: z.array(zManifestGroup).optional(),
+	whitelists: z.array(zManifestWhitelist).optional(),
+	policies: z.array(zManifestPolicy).optional(),
+	accounts: z.array(zManifestAccount).optional(),
+	entities: z.array(zManifestEntity).optional(),
+	hederaData: z.record(z.string(), z.array(zManifestHederaData)).optional(),
+	pledges: z.array(zManifestPledgeAdjustment).optional(),
+	workspaceRules: z.array(zManifestWorkspaceRule).optional()
 }).strict().meta({ description: "Workspace configuration" });
-var zManifestTradelinkOrgEntity = z.object({
-  name: z.string(),
-  code: z.string(),
-  logo: z.string()
+const zManifestTradelinkOrgEntity = z.object({
+	name: z.string(),
+	code: z.string(),
+	logo: z.string()
 }).strict().meta({ description: "Tradelink organization entity" });
-var zManifestTradelinkOrg = z.object({
-  exchanges: z.array(zManifestTradelinkOrgEntity).optional(),
-  assetManagers: z.array(zManifestTradelinkOrgEntity).optional(),
-  custodians: z.array(zManifestTradelinkOrgEntity).optional()
+const zManifestTradelinkOrg = z.object({
+	exchanges: z.array(zManifestTradelinkOrgEntity).optional(),
+	assetManagers: z.array(zManifestTradelinkOrgEntity).optional(),
+	custodians: z.array(zManifestTradelinkOrgEntity).optional()
 }).strict().meta({ description: "Tradelink organization configuration" });
-var zManifest = z.object({
-  manifestVersion: z.literal(2),
-  tradelink: zManifestTradelinkOrg.optional(),
-  workspace: zManifestWorkspace.optional()
+const zManifest = z.object({
+	manifestVersion: z.literal(2),
+	tradelink: zManifestTradelinkOrg.optional(),
+	workspace: zManifestWorkspace.optional()
 }).strict();
-
-// src/bake/index.ts
+//#endregion
+//#region src/bake/index.ts
 async function bakeManifest(options, logger) {
-  const {
-    engine,
-    workspaceName,
-    rootAuthToken,
-    manifest: { tradelink, workspace }
-  } = options;
-  if (tradelink) {
-    invariant5(rootAuthToken, `rootAuthToken is required to create Tradelink org entities`);
-    await bakeTradelinkOrganization(
-      {
-        engine,
-        tradelink,
-        rootAuthToken,
-        ...workspace?.tradelink?.networkBlueprint && workspaceName ? { networkBlueprint: { blueprint: workspace.tradelink.networkBlueprint, workspaceName } } : {}
-      },
-      logger
-    );
-  }
-  if (workspace) {
-    invariant5(workspaceName, `Can't bake workspace without specifying a workspace name`);
-    await bakeWorkspace({ engine, workspace, workspaceName }, logger);
-    if (workspace.pledges) {
-      const engineWithWorkspace = engine.withWorkspace(workspaceName);
-      for (const pledgeAdjustment of workspace.pledges) {
-        await bakePledgeAdjustment({ engine: engineWithWorkspace, pledgeAdjustment }, logger);
-      }
-    }
-  }
-  logger.info("Successfully baked");
+	const { engine, workspaceName, rootAuthToken, manifest: { tradelink, workspace } } = options;
+	if (tradelink) {
+		invariant(rootAuthToken, `rootAuthToken is required to create Tradelink org entities`);
+		await bakeTradelinkOrganization({
+			engine,
+			tradelink,
+			rootAuthToken,
+			...workspace?.tradelink?.networkBlueprint && workspaceName ? { networkBlueprint: {
+				blueprint: workspace.tradelink.networkBlueprint,
+				workspaceName
+			} } : {}
+		}, logger);
+	}
+	if (workspace) {
+		invariant(workspaceName, `Can't bake workspace without specifying a workspace name`);
+		await bakeWorkspace({
+			engine,
+			workspace,
+			workspaceName
+		}, logger);
+		if (workspace.pledges) {
+			const engineWithWorkspace = engine.withWorkspace(workspaceName);
+			for (const pledgeAdjustment of workspace.pledges) await bakePledgeAdjustment({
+				engine: engineWithWorkspace,
+				pledgeAdjustment
+			}, logger);
+		}
+	}
+	logger.info("Successfully baked");
 }
-export {
-  bakeManifest,
-  bakePledgeAdjustment,
-  createAndApproveRequest,
-  recipeManifest,
-  zManifest,
-  zManifestPolicy
-};
-/* v8 ignore else - TODO bake empty tradelink org -- @preserve */
-/* v8 ignore else -- @preserve */
+//#endregion
+export { bakeManifest, bakePledgeAdjustment, createAndApproveRequest, recipeManifest, zManifest, zManifestPolicy };
+
 //# sourceMappingURL=bake.js.map