@metamask-previews/wallet-cli 0.0.0-preview-acc8294b8 → 0.0.0-preview-5959fe813

package/CHANGELOG.md

@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - Wire the `transactionController` slot in the daemon wallet's instance options, so the daemon runs the `TransactionController` with an explicit CLI-appropriate configuration (swaps processing disabled, no client hooks) rather than relying on the controller's implicit defaults ([#9509](https://github.com/MetaMask/core/pull/9509))
+- Wire the `gasFeeController` slot in the daemon wallet's instance options, passing `clientId: 'cli'` so the CLI identifies itself to the gas estimation API, now that `@metamask/wallet` requires this option ([#9527](https://github.com/MetaMask/core/pull/9527))
 - Add the `mm wallet unlock` command, which dispatches `KeyringController:submitPassword` over the daemon socket, allowing the keyring to be unlocked after a daemon start with no password or after a `mm daemon call KeyringController:setLocked` ([#8821](https://github.com/MetaMask/core/pull/8821))
 - Add the `mm daemon list` command, which prints the messenger actions the running daemon can dispatch via `daemon call`, enumerated from the live messenger so the list cannot drift from what `call` accepts ([#9339](https://github.com/MetaMask/core/pull/9339))
 - Add the `mm daemon` command suite (`start`, `stop`, `status`, `purge`, and `call`) for running the wallet daemon and dispatching messenger actions over its socket ([#9255](https://github.com/MetaMask/core/pull/9255))
@@ -20,10 +21,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- The daemon client (`sendCommand`) now retries only on `ECONNREFUSED`, not `ECONNRESET`, since a reset can drop after the daemon has already acted on a request — re-sending could execute a non-idempotent action (e.g. a transaction broadcast) twice ([#9608](https://github.com/MetaMask/core/pull/9608))
 - `--password` / `MM_WALLET_PASSWORD` is now optional on `mm daemon start`; on subsequent runs, omitting it starts the daemon with a locked keyring, and the persisted vault is auto-unlocked when a password is supplied ([#8821](https://github.com/MetaMask/core/pull/8821))
 - The daemon RPC server now validates `params` against each handler's superstruct before dispatch, returning a `-32602 invalidParams` error on mismatch instead of passing raw params to the handler ([#8846](https://github.com/MetaMask/core/pull/8846))
 - Report daemon socket connection errors consistently across `mm daemon call` and `mm daemon list` ([#9339](https://github.com/MetaMask/core/pull/9339))
 - Bump `@metamask/wallet` from `^3.0.0` to `^7.0.1` ([#9218](https://github.com/MetaMask/core/pull/9218), [#9263](https://github.com/MetaMask/core/pull/9263), [#9349](https://github.com/MetaMask/core/pull/9349), [#9396](https://github.com/MetaMask/core/pull/9396), [#9470](https://github.com/MetaMask/core/pull/9470))
 - Wrap daemon password and SRP in opaque `Password` and `Srp` types that redact on logging; validated and unwrapped only at trust boundaries ([#8863](https://github.com/MetaMask/core/pull/8863))
+- Bump `@metamask/wallet` from `^7.0.1` to `8.0.0`. ([#9609](https://github.com/MetaMask/core/pull/9609))
 
 [Unreleased]: https://github.com/MetaMask/core/

package/dist/daemon/daemon-client.cjs

@@ -27,8 +27,12 @@ async function connectSocket(socketPath) {
  *
  * Opens a connection, writes one JSON-RPC request line, reads one JSON-RPC
  * response line, then closes the connection. Retries once after a short delay
- * on transient connection errors (ECONNREFUSED, ECONNRESET). Verifies that the
- * response `id` matches the outgoing request `id`.
+ * only on `ECONNREFUSED` — the connection was never established, so the daemon
+ * provably never received the request and re-sending is safe. Does not retry
+ * on `ECONNRESET`, which can drop after the daemon has already received and
+ * acted on the request: blindly re-sending could execute a non-idempotent
+ * action (e.g. a transaction broadcast) twice, so it is surfaced to the caller
+ * instead. Verifies that the response `id` matches the outgoing request `id`.
  *
  * @param options - Command options.
  * @param options.socketPath - The Unix socket path.
@@ -66,8 +70,13 @@ async function sendCommand({ socketPath, method, params, timeoutMs, }) {
         return await attempt();
     }
     catch (error) {
-        if (!(0, utils_js_1.isErrorWithCode)(error, 'ECONNREFUSED') &&
-            !(0, utils_js_1.isErrorWithCode)(error, 'ECONNRESET')) {
+        // Only retry on ECONNREFUSED: the connection was never established, so the
+        // daemon provably never received the request and re-sending is safe.
+        // ECONNRESET can drop *after* the daemon received and began (or finished)
+        // processing the request, so blindly re-sending a non-idempotent request
+        // (e.g. a transaction broadcast) could execute it twice. Surface it to the
+        // caller instead of retrying.
+        if (!(0, utils_js_1.isErrorWithCode)(error, 'ECONNREFUSED')) {
             throw error;
         }
         await new Promise((resolve) => setTimeout(resolve, 100));

package/dist/daemon/daemon-client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"daemon-client.cjs","sourceRoot":"","sources":["../../src/daemon/daemon-client.ts"],"names":[],"mappings":";;;AACA,2CAA0D;AAC1D,6CAAyC;AACzC,uCAA4C;AAG5C,sDAAuD;AACvD,0CAA6C;AAE7C,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAgBlC,KAAK,UAAU,aAAa,CAAC,UAAkB;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAA,2BAAgB,EAAC,UAAU,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACnC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,wEAAwE;YACxE,wCAAwC;YACxC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,WAAW,CAAC,EAChC,UAAU,EACV,MAAM,EACN,MAAM,EACN,SAAS,GACU;IACnB,MAAM,EAAE,GAAG,IAAA,wBAAU,GAAE,CAAC;IACxB,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,KAAK;QACd,EAAE;QACF,MAAM;QACN,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;IAEF,MAAM,gBAAgB,GAAG,SAAS,IAAI,kBAAkB,CAAC;IAEzD,MAAM,OAAO,GAAG,KAAK,IAA8B,EAAE;QACnD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,IAAA,0BAAS,EAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,MAAM,IAAA,yBAAQ,EAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACjD,IAAA,+BAAuB,EAAC,MAAM,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CACpG,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IACE,CAAC,IAAA,0BAAe,EAAC,KAAK,EAAE,cAAc,CAAC;YACvC,CAAC,IAAA,0BAAe,EAAC,KAAK,EAAE,YAAY,CAAC,EACrC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACzD,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AA9CD,kCA8CC;AAwCD;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,KAAc;IACzC,IACE,IAAA,0BAAe,EAAC,KAAK,EAAE,cAAc,CAAC;QACtC,IAAA,0BAAe,EAAC,KAAK,EAAE,YAAY,CAAC,EACpC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAA,0BAAe,EAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,IAAA,0BAAe,EAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACxE,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,uBAAuB,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,KAAK,YAAY,KAAK;QACtB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAC7C,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAC3C,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,EAC/B,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,UAAU,CAAC,UAAkB;IACjD,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAK,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,IAAA,0BAAe,EAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9B,CAAC;QACD,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;SACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAdD,gCAcC","sourcesContent":["import type { JsonRpcParams, JsonRpcResponse } from '@metamask/utils';\nimport { assertIsJsonRpcResponse } from '@metamask/utils';\nimport { randomUUID } from 'node:crypto';\nimport { createConnection } from 'node:net';\nimport type { Socket } from 'node:net';\n\nimport { readLine, writeLine } from './socket-line.js';\nimport { isErrorWithCode } from './utils.js';\n\nconst DEFAULT_TIMEOUT_MS = 30_000;\n\n/**\n * Options for {@link sendCommand}.\n */\ntype SendCommandOptions = {\n  /** The Unix socket path. */\n  socketPath: string;\n  /** The RPC method name. */\n  method: string;\n  /** Optional method parameters (object or positional array). */\n  params?: JsonRpcParams | undefined;\n  /** Response read timeout in milliseconds (default: 30 000). */\n  timeoutMs?: number | undefined;\n};\n\nasync function connectSocket(socketPath: string): Promise<Socket> {\n  return new Promise((resolve, reject) => {\n    const socket = createConnection(socketPath, () => {\n      socket.removeAllListeners('error');\n      resolve(socket);\n    });\n    socket.on('error', (error) => {\n      // A failed connect never reaches the caller, so destroy the socket here\n      // to avoid leaking its file descriptor.\n      socket.destroy();\n      reject(error);\n    });\n  });\n}\n\n/**\n * Send a JSON-RPC request to the daemon over a Unix socket and return the\n * response.\n *\n * Opens a connection, writes one JSON-RPC request line, reads one JSON-RPC\n * response line, then closes the connection. Retries once after a short delay\n * on transient connection errors (ECONNREFUSED, ECONNRESET). Verifies that the\n * response `id` matches the outgoing request `id`.\n *\n * @param options - Command options.\n * @param options.socketPath - The Unix socket path.\n * @param options.method - The RPC method name.\n * @param options.params - Optional method parameters.\n * @param options.timeoutMs - Read timeout in milliseconds.\n * @returns The parsed JSON-RPC response.\n */\nexport async function sendCommand({\n  socketPath,\n  method,\n  params,\n  timeoutMs,\n}: SendCommandOptions): Promise<JsonRpcResponse> {\n  const id = randomUUID();\n  const request = {\n    jsonrpc: '2.0',\n    id,\n    method,\n    ...(params === undefined ? {} : { params }),\n  };\n\n  const effectiveTimeout = timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\n  const attempt = async (): Promise<JsonRpcResponse> => {\n    const socket = await connectSocket(socketPath);\n    try {\n      await writeLine(socket, JSON.stringify(request));\n      const responseLine = await readLine(socket, effectiveTimeout);\n      const parsed: unknown = JSON.parse(responseLine);\n      assertIsJsonRpcResponse(parsed);\n      if (parsed.id !== id) {\n        throw new Error(\n          `JSON-RPC response id ${JSON.stringify(parsed.id)} does not match request id ${JSON.stringify(id)}`,\n        );\n      }\n      return parsed;\n    } finally {\n      socket.destroy();\n    }\n  };\n\n  try {\n    return await attempt();\n  } catch (error: unknown) {\n    if (\n      !isErrorWithCode(error, 'ECONNREFUSED') &&\n      !isErrorWithCode(error, 'ECONNRESET')\n    ) {\n      throw error;\n    }\n    await new Promise((resolve) => setTimeout(resolve, 100));\n    return attempt();\n  }\n}\n\n/**\n * Why an unreachable daemon cannot be queried.\n *\n * - `'refused'`: connection refused after retry (`ECONNREFUSED` / `ECONNRESET`).\n *   Typical of a daemon that has crashed or is mid-restart.\n * - `'timeout'`: the daemon accepted the connection but did not respond within\n *   the read timeout — most likely wedged on a long-running operation.\n * - `'permission'`: the socket exists but cannot be opened (`EACCES` / `EPERM`).\n *   The daemon almost certainly belongs to another user.\n * - `'protocol'`: the daemon responded but the response did not parse as a\n *   valid JSON-RPC response, or the response id did not match.\n * - `'other'`: anything else.\n */\nexport type PingUnreachableReason =\n  | 'refused'\n  | 'timeout'\n  | 'permission'\n  | 'protocol'\n  | 'other';\n\n/**\n * Outcome of a daemon health check.\n *\n * - `'responsive'`: the daemon answered a `getStatus` RPC.\n * - `'absent'`: the socket connect attempt failed with `ENOENT`, i.e. no\n *   socket file exists at the path. No daemon present.\n * - `'unreachable'`: any other non-success outcome. The daemon may still be\n *   alive but is not responding. Callers should not silently take over the\n *   slot or assume the daemon is dead. The `reason` field categorises the\n *   failure so callers can distinguish a wedged sibling daemon from a\n *   foreign-user daemon from a transient crash. User-initiated stop / purge\n *   flows may still escalate to signals against the recorded PID.\n */\nexport type PingResult =\n  | { status: 'responsive' }\n  | { status: 'absent' }\n  | { status: 'unreachable'; reason: PingUnreachableReason; error: Error };\n\n/**\n * Normalize an unknown throw into a real Error instance so that downstream\n * consumers (which read `.message`) cannot crash on string/object throws.\n *\n * @param error - The caught value.\n * @returns An Error mirroring the caught value.\n */\nfunction toError(error: unknown): Error {\n  return error instanceof Error ? error : new Error(String(error));\n}\n\n/**\n * Categorise an unreachable error by Node errno / message shape so callers can\n * make decisions per failure mode rather than parsing message strings.\n *\n * @param error - The caught value.\n * @returns A {@link PingUnreachableReason} label.\n */\nfunction classifyUnreachable(error: unknown): PingUnreachableReason {\n  if (\n    isErrorWithCode(error, 'ECONNREFUSED') ||\n    isErrorWithCode(error, 'ECONNRESET')\n  ) {\n    return 'refused';\n  }\n  if (isErrorWithCode(error, 'EACCES') || isErrorWithCode(error, 'EPERM')) {\n    return 'permission';\n  }\n  if (error instanceof Error && error.message === 'Socket read timed out') {\n    return 'timeout';\n  }\n  if (\n    error instanceof Error &&\n    (error.message.includes('JSON-RPC response id') ||\n      /Expected .* JSON-RPC/u.test(error.message) ||\n      error.name === 'SyntaxError')\n  ) {\n    return 'protocol';\n  }\n  return 'other';\n}\n\n/**\n * Check whether the daemon is running by sending a lightweight `getStatus`\n * RPC call. Distinguishes \"no daemon present\" (socket file missing) from\n * \"daemon present but unreachable\" (socket file exists but the daemon is\n * wedged, mid-shutdown, or owned by a different user).\n *\n * @param socketPath - The Unix socket path.\n * @returns A {@link PingResult} describing the daemon's reachability.\n */\nexport async function pingDaemon(socketPath: string): Promise<PingResult> {\n  try {\n    await sendCommand({ socketPath, method: 'getStatus', timeoutMs: 3_000 });\n    return { status: 'responsive' };\n  } catch (error: unknown) {\n    if (isErrorWithCode(error, 'ENOENT')) {\n      return { status: 'absent' };\n    }\n    return {\n      status: 'unreachable',\n      reason: classifyUnreachable(error),\n      error: toError(error),\n    };\n  }\n}\n"]}
+{"version":3,"file":"daemon-client.cjs","sourceRoot":"","sources":["../../src/daemon/daemon-client.ts"],"names":[],"mappings":";;;AACA,2CAA0D;AAC1D,6CAAyC;AACzC,uCAA4C;AAG5C,sDAAuD;AACvD,0CAA6C;AAE7C,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAgBlC,KAAK,UAAU,aAAa,CAAC,UAAkB;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAA,2BAAgB,EAAC,UAAU,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACnC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,wEAAwE;YACxE,wCAAwC;YACxC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACI,KAAK,UAAU,WAAW,CAAC,EAChC,UAAU,EACV,MAAM,EACN,MAAM,EACN,SAAS,GACU;IACnB,MAAM,EAAE,GAAG,IAAA,wBAAU,GAAE,CAAC;IACxB,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,KAAK;QACd,EAAE;QACF,MAAM;QACN,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;IAEF,MAAM,gBAAgB,GAAG,SAAS,IAAI,kBAAkB,CAAC;IAEzD,MAAM,OAAO,GAAG,KAAK,IAA8B,EAAE;QACnD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,IAAA,0BAAS,EAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,MAAM,IAAA,yBAAQ,EAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACjD,IAAA,+BAAuB,EAAC,MAAM,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CACpG,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,2EAA2E;QAC3E,qEAAqE;QACrE,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,8BAA8B;QAC9B,IAAI,CAAC,IAAA,0BAAe,EAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACzD,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAjDD,kCAiDC;AAyCD;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,KAAc;IACzC,IACE,IAAA,0BAAe,EAAC,KAAK,EAAE,cAAc,CAAC;QACtC,IAAA,0BAAe,EAAC,KAAK,EAAE,YAAY,CAAC,EACpC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAA,0BAAe,EAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,IAAA,0BAAe,EAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACxE,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,uBAAuB,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,KAAK,YAAY,KAAK;QACtB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAC7C,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAC3C,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,EAC/B,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,UAAU,CAAC,UAAkB;IACjD,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAK,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,IAAA,0BAAe,EAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9B,CAAC;QACD,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;SACtB,CAAC;IACJ,CAAC;AACH,CAAC;AAdD,gCAcC","sourcesContent":["import type { JsonRpcParams, JsonRpcResponse } from '@metamask/utils';\nimport { assertIsJsonRpcResponse } from '@metamask/utils';\nimport { randomUUID } from 'node:crypto';\nimport { createConnection } from 'node:net';\nimport type { Socket } from 'node:net';\n\nimport { readLine, writeLine } from './socket-line.js';\nimport { isErrorWithCode } from './utils.js';\n\nconst DEFAULT_TIMEOUT_MS = 30_000;\n\n/**\n * Options for {@link sendCommand}.\n */\ntype SendCommandOptions = {\n  /** The Unix socket path. */\n  socketPath: string;\n  /** The RPC method name. */\n  method: string;\n  /** Optional method parameters (object or positional array). */\n  params?: JsonRpcParams | undefined;\n  /** Response read timeout in milliseconds (default: 30 000). */\n  timeoutMs?: number | undefined;\n};\n\nasync function connectSocket(socketPath: string): Promise<Socket> {\n  return new Promise((resolve, reject) => {\n    const socket = createConnection(socketPath, () => {\n      socket.removeAllListeners('error');\n      resolve(socket);\n    });\n    socket.on('error', (error) => {\n      // A failed connect never reaches the caller, so destroy the socket here\n      // to avoid leaking its file descriptor.\n      socket.destroy();\n      reject(error);\n    });\n  });\n}\n\n/**\n * Send a JSON-RPC request to the daemon over a Unix socket and return the\n * response.\n *\n * Opens a connection, writes one JSON-RPC request line, reads one JSON-RPC\n * response line, then closes the connection. Retries once after a short delay\n * only on `ECONNREFUSED` — the connection was never established, so the daemon\n * provably never received the request and re-sending is safe. Does not retry\n * on `ECONNRESET`, which can drop after the daemon has already received and\n * acted on the request: blindly re-sending could execute a non-idempotent\n * action (e.g. a transaction broadcast) twice, so it is surfaced to the caller\n * instead. Verifies that the response `id` matches the outgoing request `id`.\n *\n * @param options - Command options.\n * @param options.socketPath - The Unix socket path.\n * @param options.method - The RPC method name.\n * @param options.params - Optional method parameters.\n * @param options.timeoutMs - Read timeout in milliseconds.\n * @returns The parsed JSON-RPC response.\n */\nexport async function sendCommand({\n  socketPath,\n  method,\n  params,\n  timeoutMs,\n}: SendCommandOptions): Promise<JsonRpcResponse> {\n  const id = randomUUID();\n  const request = {\n    jsonrpc: '2.0',\n    id,\n    method,\n    ...(params === undefined ? {} : { params }),\n  };\n\n  const effectiveTimeout = timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\n  const attempt = async (): Promise<JsonRpcResponse> => {\n    const socket = await connectSocket(socketPath);\n    try {\n      await writeLine(socket, JSON.stringify(request));\n      const responseLine = await readLine(socket, effectiveTimeout);\n      const parsed: unknown = JSON.parse(responseLine);\n      assertIsJsonRpcResponse(parsed);\n      if (parsed.id !== id) {\n        throw new Error(\n          `JSON-RPC response id ${JSON.stringify(parsed.id)} does not match request id ${JSON.stringify(id)}`,\n        );\n      }\n      return parsed;\n    } finally {\n      socket.destroy();\n    }\n  };\n\n  try {\n    return await attempt();\n  } catch (error: unknown) {\n    // Only retry on ECONNREFUSED: the connection was never established, so the\n    // daemon provably never received the request and re-sending is safe.\n    // ECONNRESET can drop *after* the daemon received and began (or finished)\n    // processing the request, so blindly re-sending a non-idempotent request\n    // (e.g. a transaction broadcast) could execute it twice. Surface it to the\n    // caller instead of retrying.\n    if (!isErrorWithCode(error, 'ECONNREFUSED')) {\n      throw error;\n    }\n    await new Promise((resolve) => setTimeout(resolve, 100));\n    return attempt();\n  }\n}\n\n/**\n * Why an unreachable daemon cannot be queried.\n *\n * - `'refused'`: the connection could not be completed — `ECONNREFUSED`\n *   (retried once) or `ECONNRESET` (a mid-request drop, not retried). Typical\n *   of a daemon that has crashed or is mid-restart.\n * - `'timeout'`: the daemon accepted the connection but did not respond within\n *   the read timeout — most likely wedged on a long-running operation.\n * - `'permission'`: the socket exists but cannot be opened (`EACCES` / `EPERM`).\n *   The daemon almost certainly belongs to another user.\n * - `'protocol'`: the daemon responded but the response did not parse as a\n *   valid JSON-RPC response, or the response id did not match.\n * - `'other'`: anything else.\n */\nexport type PingUnreachableReason =\n  | 'refused'\n  | 'timeout'\n  | 'permission'\n  | 'protocol'\n  | 'other';\n\n/**\n * Outcome of a daemon health check.\n *\n * - `'responsive'`: the daemon answered a `getStatus` RPC.\n * - `'absent'`: the socket connect attempt failed with `ENOENT`, i.e. no\n *   socket file exists at the path. No daemon present.\n * - `'unreachable'`: any other non-success outcome. The daemon may still be\n *   alive but is not responding. Callers should not silently take over the\n *   slot or assume the daemon is dead. The `reason` field categorises the\n *   failure so callers can distinguish a wedged sibling daemon from a\n *   foreign-user daemon from a transient crash. User-initiated stop / purge\n *   flows may still escalate to signals against the recorded PID.\n */\nexport type PingResult =\n  | { status: 'responsive' }\n  | { status: 'absent' }\n  | { status: 'unreachable'; reason: PingUnreachableReason; error: Error };\n\n/**\n * Normalize an unknown throw into a real Error instance so that downstream\n * consumers (which read `.message`) cannot crash on string/object throws.\n *\n * @param error - The caught value.\n * @returns An Error mirroring the caught value.\n */\nfunction toError(error: unknown): Error {\n  return error instanceof Error ? error : new Error(String(error));\n}\n\n/**\n * Categorise an unreachable error by Node errno / message shape so callers can\n * make decisions per failure mode rather than parsing message strings.\n *\n * @param error - The caught value.\n * @returns A {@link PingUnreachableReason} label.\n */\nfunction classifyUnreachable(error: unknown): PingUnreachableReason {\n  if (\n    isErrorWithCode(error, 'ECONNREFUSED') ||\n    isErrorWithCode(error, 'ECONNRESET')\n  ) {\n    return 'refused';\n  }\n  if (isErrorWithCode(error, 'EACCES') || isErrorWithCode(error, 'EPERM')) {\n    return 'permission';\n  }\n  if (error instanceof Error && error.message === 'Socket read timed out') {\n    return 'timeout';\n  }\n  if (\n    error instanceof Error &&\n    (error.message.includes('JSON-RPC response id') ||\n      /Expected .* JSON-RPC/u.test(error.message) ||\n      error.name === 'SyntaxError')\n  ) {\n    return 'protocol';\n  }\n  return 'other';\n}\n\n/**\n * Check whether the daemon is running by sending a lightweight `getStatus`\n * RPC call. Distinguishes \"no daemon present\" (socket file missing) from\n * \"daemon present but unreachable\" (socket file exists but the daemon is\n * wedged, mid-shutdown, or owned by a different user).\n *\n * @param socketPath - The Unix socket path.\n * @returns A {@link PingResult} describing the daemon's reachability.\n */\nexport async function pingDaemon(socketPath: string): Promise<PingResult> {\n  try {\n    await sendCommand({ socketPath, method: 'getStatus', timeoutMs: 3_000 });\n    return { status: 'responsive' };\n  } catch (error: unknown) {\n    if (isErrorWithCode(error, 'ENOENT')) {\n      return { status: 'absent' };\n    }\n    return {\n      status: 'unreachable',\n      reason: classifyUnreachable(error),\n      error: toError(error),\n    };\n  }\n}\n"]}

package/dist/daemon/daemon-client.d.cts

@@ -18,8 +18,12 @@ type SendCommandOptions = {
  *
  * Opens a connection, writes one JSON-RPC request line, reads one JSON-RPC
  * response line, then closes the connection. Retries once after a short delay
- * on transient connection errors (ECONNREFUSED, ECONNRESET). Verifies that the
- * response `id` matches the outgoing request `id`.
+ * only on `ECONNREFUSED` — the connection was never established, so the daemon
+ * provably never received the request and re-sending is safe. Does not retry
+ * on `ECONNRESET`, which can drop after the daemon has already received and
+ * acted on the request: blindly re-sending could execute a non-idempotent
+ * action (e.g. a transaction broadcast) twice, so it is surfaced to the caller
+ * instead. Verifies that the response `id` matches the outgoing request `id`.
  *
  * @param options - Command options.
  * @param options.socketPath - The Unix socket path.
@@ -32,8 +36,9 @@ export declare function sendCommand({ socketPath, method, params, timeoutMs, }:
 /**
  * Why an unreachable daemon cannot be queried.
  *
- * - `'refused'`: connection refused after retry (`ECONNREFUSED` / `ECONNRESET`).
- *   Typical of a daemon that has crashed or is mid-restart.
+ * - `'refused'`: the connection could not be completed — `ECONNREFUSED`
+ *   (retried once) or `ECONNRESET` (a mid-request drop, not retried). Typical
+ *   of a daemon that has crashed or is mid-restart.
  * - `'timeout'`: the daemon accepted the connection but did not respond within
  *   the read timeout — most likely wedged on a long-running operation.
  * - `'permission'`: the socket exists but cannot be opened (`EACCES` / `EPERM`).

package/dist/daemon/daemon-client.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon-client.d.cts","sourceRoot":"","sources":["../../src/daemon/daemon-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,wBAAwB;AAWtE;;GAEG;AACH,KAAK,kBAAkB,GAAG;IACxB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,MAAM,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACnC,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAAC;AAiBF;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,WAAW,CAAC,EAChC,UAAU,EACV,MAAM,EACN,MAAM,EACN,SAAS,GACV,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CAyC/C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,qBAAqB,GAC7B,SAAS,GACT,SAAS,GACT,YAAY,GACZ,UAAU,GACV,OAAO,CAAC;AAEZ;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GACxB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AA4C3E;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAcxE"}
+{"version":3,"file":"daemon-client.d.cts","sourceRoot":"","sources":["../../src/daemon/daemon-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,wBAAwB;AAWtE;;GAEG;AACH,KAAK,kBAAkB,GAAG;IACxB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,MAAM,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACnC,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAAC;AAiBF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,WAAW,CAAC,EAChC,UAAU,EACV,MAAM,EACN,MAAM,EACN,SAAS,GACV,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CA4C/C;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,qBAAqB,GAC7B,SAAS,GACT,SAAS,GACT,YAAY,GACZ,UAAU,GACV,OAAO,CAAC;AAEZ;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GACxB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AA4C3E;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAcxE"}

package/dist/daemon/daemon-client.d.mts

@@ -18,8 +18,12 @@ type SendCommandOptions = {
  *
  * Opens a connection, writes one JSON-RPC request line, reads one JSON-RPC
  * response line, then closes the connection. Retries once after a short delay
- * on transient connection errors (ECONNREFUSED, ECONNRESET). Verifies that the
- * response `id` matches the outgoing request `id`.
+ * only on `ECONNREFUSED` — the connection was never established, so the daemon
+ * provably never received the request and re-sending is safe. Does not retry
+ * on `ECONNRESET`, which can drop after the daemon has already received and
+ * acted on the request: blindly re-sending could execute a non-idempotent
+ * action (e.g. a transaction broadcast) twice, so it is surfaced to the caller
+ * instead. Verifies that the response `id` matches the outgoing request `id`.
  *
  * @param options - Command options.
  * @param options.socketPath - The Unix socket path.
@@ -32,8 +36,9 @@ export declare function sendCommand({ socketPath, method, params, timeoutMs, }:
 /**
  * Why an unreachable daemon cannot be queried.
  *
- * - `'refused'`: connection refused after retry (`ECONNREFUSED` / `ECONNRESET`).
- *   Typical of a daemon that has crashed or is mid-restart.
+ * - `'refused'`: the connection could not be completed — `ECONNREFUSED`
+ *   (retried once) or `ECONNRESET` (a mid-request drop, not retried). Typical
+ *   of a daemon that has crashed or is mid-restart.
  * - `'timeout'`: the daemon accepted the connection but did not respond within
  *   the read timeout — most likely wedged on a long-running operation.
  * - `'permission'`: the socket exists but cannot be opened (`EACCES` / `EPERM`).

package/dist/daemon/daemon-client.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon-client.d.mts","sourceRoot":"","sources":["../../src/daemon/daemon-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,wBAAwB;AAWtE;;GAEG;AACH,KAAK,kBAAkB,GAAG;IACxB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,MAAM,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACnC,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAAC;AAiBF;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,WAAW,CAAC,EAChC,UAAU,EACV,MAAM,EACN,MAAM,EACN,SAAS,GACV,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CAyC/C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,qBAAqB,GAC7B,SAAS,GACT,SAAS,GACT,YAAY,GACZ,UAAU,GACV,OAAO,CAAC;AAEZ;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GACxB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AA4C3E;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAcxE"}
+{"version":3,"file":"daemon-client.d.mts","sourceRoot":"","sources":["../../src/daemon/daemon-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,wBAAwB;AAWtE;;GAEG;AACH,KAAK,kBAAkB,GAAG;IACxB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,MAAM,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACnC,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC,CAAC;AAiBF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,WAAW,CAAC,EAChC,UAAU,EACV,MAAM,EACN,MAAM,EACN,SAAS,GACV,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CA4C/C;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,qBAAqB,GAC7B,SAAS,GACT,SAAS,GACT,YAAY,GACZ,UAAU,GACV,OAAO,CAAC;AAEZ;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GACxB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC;AA4C3E;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAcxE"}

package/dist/daemon/daemon-client.mjs

@@ -24,8 +24,12 @@ async function connectSocket(socketPath) {
  *
  * Opens a connection, writes one JSON-RPC request line, reads one JSON-RPC
  * response line, then closes the connection. Retries once after a short delay
- * on transient connection errors (ECONNREFUSED, ECONNRESET). Verifies that the
- * response `id` matches the outgoing request `id`.
+ * only on `ECONNREFUSED` — the connection was never established, so the daemon
+ * provably never received the request and re-sending is safe. Does not retry
+ * on `ECONNRESET`, which can drop after the daemon has already received and
+ * acted on the request: blindly re-sending could execute a non-idempotent
+ * action (e.g. a transaction broadcast) twice, so it is surfaced to the caller
+ * instead. Verifies that the response `id` matches the outgoing request `id`.
  *
  * @param options - Command options.
  * @param options.socketPath - The Unix socket path.
@@ -63,8 +67,13 @@ export async function sendCommand({ socketPath, method, params, timeoutMs, }) {
         return await attempt();
     }
     catch (error) {
-        if (!isErrorWithCode(error, 'ECONNREFUSED') &&
-            !isErrorWithCode(error, 'ECONNRESET')) {
+        // Only retry on ECONNREFUSED: the connection was never established, so the
+        // daemon provably never received the request and re-sending is safe.
+        // ECONNRESET can drop *after* the daemon received and began (or finished)
+        // processing the request, so blindly re-sending a non-idempotent request
+        // (e.g. a transaction broadcast) could execute it twice. Surface it to the
+        // caller instead of retrying.
+        if (!isErrorWithCode(error, 'ECONNREFUSED')) {
             throw error;
         }
         await new Promise((resolve) => setTimeout(resolve, 100));

package/dist/daemon/daemon-client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"daemon-client.mjs","sourceRoot":"","sources":["../../src/daemon/daemon-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,wBAAwB;AAC1D,OAAO,EAAE,UAAU,EAAE,oBAAoB;AACzC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB;AAG5C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,0BAAyB;AACvD,OAAO,EAAE,eAAe,EAAE,oBAAmB;AAE7C,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAgBlC,KAAK,UAAU,aAAa,CAAC,UAAkB;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACnC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,wEAAwE;YACxE,wCAAwC;YACxC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAChC,UAAU,EACV,MAAM,EACN,MAAM,EACN,SAAS,GACU;IACnB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,KAAK;QACd,EAAE;QACF,MAAM;QACN,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;IAEF,MAAM,gBAAgB,GAAG,SAAS,IAAI,kBAAkB,CAAC;IAEzD,MAAM,OAAO,GAAG,KAAK,IAA8B,EAAE;QACnD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACjD,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CACpG,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IACE,CAAC,eAAe,CAAC,KAAK,EAAE,cAAc,CAAC;YACvC,CAAC,eAAe,CAAC,KAAK,EAAE,YAAY,CAAC,EACrC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACzD,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAwCD;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,KAAc;IACzC,IACE,eAAe,CAAC,KAAK,EAAE,cAAc,CAAC;QACtC,eAAe,CAAC,KAAK,EAAE,YAAY,CAAC,EACpC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACxE,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,uBAAuB,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,KAAK,YAAY,KAAK;QACtB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAC7C,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAC3C,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,EAC/B,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkB;IACjD,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAK,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9B,CAAC;QACD,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;SACtB,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type { JsonRpcParams, JsonRpcResponse } from '@metamask/utils';\nimport { assertIsJsonRpcResponse } from '@metamask/utils';\nimport { randomUUID } from 'node:crypto';\nimport { createConnection } from 'node:net';\nimport type { Socket } from 'node:net';\n\nimport { readLine, writeLine } from './socket-line.js';\nimport { isErrorWithCode } from './utils.js';\n\nconst DEFAULT_TIMEOUT_MS = 30_000;\n\n/**\n * Options for {@link sendCommand}.\n */\ntype SendCommandOptions = {\n  /** The Unix socket path. */\n  socketPath: string;\n  /** The RPC method name. */\n  method: string;\n  /** Optional method parameters (object or positional array). */\n  params?: JsonRpcParams | undefined;\n  /** Response read timeout in milliseconds (default: 30 000). */\n  timeoutMs?: number | undefined;\n};\n\nasync function connectSocket(socketPath: string): Promise<Socket> {\n  return new Promise((resolve, reject) => {\n    const socket = createConnection(socketPath, () => {\n      socket.removeAllListeners('error');\n      resolve(socket);\n    });\n    socket.on('error', (error) => {\n      // A failed connect never reaches the caller, so destroy the socket here\n      // to avoid leaking its file descriptor.\n      socket.destroy();\n      reject(error);\n    });\n  });\n}\n\n/**\n * Send a JSON-RPC request to the daemon over a Unix socket and return the\n * response.\n *\n * Opens a connection, writes one JSON-RPC request line, reads one JSON-RPC\n * response line, then closes the connection. Retries once after a short delay\n * on transient connection errors (ECONNREFUSED, ECONNRESET). Verifies that the\n * response `id` matches the outgoing request `id`.\n *\n * @param options - Command options.\n * @param options.socketPath - The Unix socket path.\n * @param options.method - The RPC method name.\n * @param options.params - Optional method parameters.\n * @param options.timeoutMs - Read timeout in milliseconds.\n * @returns The parsed JSON-RPC response.\n */\nexport async function sendCommand({\n  socketPath,\n  method,\n  params,\n  timeoutMs,\n}: SendCommandOptions): Promise<JsonRpcResponse> {\n  const id = randomUUID();\n  const request = {\n    jsonrpc: '2.0',\n    id,\n    method,\n    ...(params === undefined ? {} : { params }),\n  };\n\n  const effectiveTimeout = timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\n  const attempt = async (): Promise<JsonRpcResponse> => {\n    const socket = await connectSocket(socketPath);\n    try {\n      await writeLine(socket, JSON.stringify(request));\n      const responseLine = await readLine(socket, effectiveTimeout);\n      const parsed: unknown = JSON.parse(responseLine);\n      assertIsJsonRpcResponse(parsed);\n      if (parsed.id !== id) {\n        throw new Error(\n          `JSON-RPC response id ${JSON.stringify(parsed.id)} does not match request id ${JSON.stringify(id)}`,\n        );\n      }\n      return parsed;\n    } finally {\n      socket.destroy();\n    }\n  };\n\n  try {\n    return await attempt();\n  } catch (error: unknown) {\n    if (\n      !isErrorWithCode(error, 'ECONNREFUSED') &&\n      !isErrorWithCode(error, 'ECONNRESET')\n    ) {\n      throw error;\n    }\n    await new Promise((resolve) => setTimeout(resolve, 100));\n    return attempt();\n  }\n}\n\n/**\n * Why an unreachable daemon cannot be queried.\n *\n * - `'refused'`: connection refused after retry (`ECONNREFUSED` / `ECONNRESET`).\n *   Typical of a daemon that has crashed or is mid-restart.\n * - `'timeout'`: the daemon accepted the connection but did not respond within\n *   the read timeout — most likely wedged on a long-running operation.\n * - `'permission'`: the socket exists but cannot be opened (`EACCES` / `EPERM`).\n *   The daemon almost certainly belongs to another user.\n * - `'protocol'`: the daemon responded but the response did not parse as a\n *   valid JSON-RPC response, or the response id did not match.\n * - `'other'`: anything else.\n */\nexport type PingUnreachableReason =\n  | 'refused'\n  | 'timeout'\n  | 'permission'\n  | 'protocol'\n  | 'other';\n\n/**\n * Outcome of a daemon health check.\n *\n * - `'responsive'`: the daemon answered a `getStatus` RPC.\n * - `'absent'`: the socket connect attempt failed with `ENOENT`, i.e. no\n *   socket file exists at the path. No daemon present.\n * - `'unreachable'`: any other non-success outcome. The daemon may still be\n *   alive but is not responding. Callers should not silently take over the\n *   slot or assume the daemon is dead. The `reason` field categorises the\n *   failure so callers can distinguish a wedged sibling daemon from a\n *   foreign-user daemon from a transient crash. User-initiated stop / purge\n *   flows may still escalate to signals against the recorded PID.\n */\nexport type PingResult =\n  | { status: 'responsive' }\n  | { status: 'absent' }\n  | { status: 'unreachable'; reason: PingUnreachableReason; error: Error };\n\n/**\n * Normalize an unknown throw into a real Error instance so that downstream\n * consumers (which read `.message`) cannot crash on string/object throws.\n *\n * @param error - The caught value.\n * @returns An Error mirroring the caught value.\n */\nfunction toError(error: unknown): Error {\n  return error instanceof Error ? error : new Error(String(error));\n}\n\n/**\n * Categorise an unreachable error by Node errno / message shape so callers can\n * make decisions per failure mode rather than parsing message strings.\n *\n * @param error - The caught value.\n * @returns A {@link PingUnreachableReason} label.\n */\nfunction classifyUnreachable(error: unknown): PingUnreachableReason {\n  if (\n    isErrorWithCode(error, 'ECONNREFUSED') ||\n    isErrorWithCode(error, 'ECONNRESET')\n  ) {\n    return 'refused';\n  }\n  if (isErrorWithCode(error, 'EACCES') || isErrorWithCode(error, 'EPERM')) {\n    return 'permission';\n  }\n  if (error instanceof Error && error.message === 'Socket read timed out') {\n    return 'timeout';\n  }\n  if (\n    error instanceof Error &&\n    (error.message.includes('JSON-RPC response id') ||\n      /Expected .* JSON-RPC/u.test(error.message) ||\n      error.name === 'SyntaxError')\n  ) {\n    return 'protocol';\n  }\n  return 'other';\n}\n\n/**\n * Check whether the daemon is running by sending a lightweight `getStatus`\n * RPC call. Distinguishes \"no daemon present\" (socket file missing) from\n * \"daemon present but unreachable\" (socket file exists but the daemon is\n * wedged, mid-shutdown, or owned by a different user).\n *\n * @param socketPath - The Unix socket path.\n * @returns A {@link PingResult} describing the daemon's reachability.\n */\nexport async function pingDaemon(socketPath: string): Promise<PingResult> {\n  try {\n    await sendCommand({ socketPath, method: 'getStatus', timeoutMs: 3_000 });\n    return { status: 'responsive' };\n  } catch (error: unknown) {\n    if (isErrorWithCode(error, 'ENOENT')) {\n      return { status: 'absent' };\n    }\n    return {\n      status: 'unreachable',\n      reason: classifyUnreachable(error),\n      error: toError(error),\n    };\n  }\n}\n"]}
+{"version":3,"file":"daemon-client.mjs","sourceRoot":"","sources":["../../src/daemon/daemon-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,wBAAwB;AAC1D,OAAO,EAAE,UAAU,EAAE,oBAAoB;AACzC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB;AAG5C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,0BAAyB;AACvD,OAAO,EAAE,eAAe,EAAE,oBAAmB;AAE7C,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAgBlC,KAAK,UAAU,aAAa,CAAC,UAAkB;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACnC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3B,wEAAwE;YACxE,wCAAwC;YACxC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAChC,UAAU,EACV,MAAM,EACN,MAAM,EACN,SAAS,GACU;IACnB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,KAAK;QACd,EAAE;QACF,MAAM;QACN,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;IAEF,MAAM,gBAAgB,GAAG,SAAS,IAAI,kBAAkB,CAAC;IAEzD,MAAM,OAAO,GAAG,KAAK,IAA8B,EAAE;QACnD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACjD,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CACpG,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,2EAA2E;QAC3E,qEAAqE;QACrE,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,8BAA8B;QAC9B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACzD,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAyCD;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,KAAc;IACzC,IACE,eAAe,CAAC,KAAK,EAAE,cAAc,CAAC;QACtC,eAAe,CAAC,KAAK,EAAE,YAAY,CAAC,EACpC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACxE,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,uBAAuB,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,KAAK,YAAY,KAAK;QACtB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAC7C,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAC3C,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,EAC/B,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkB;IACjD,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAK,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9B,CAAC;QACD,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;SACtB,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type { JsonRpcParams, JsonRpcResponse } from '@metamask/utils';\nimport { assertIsJsonRpcResponse } from '@metamask/utils';\nimport { randomUUID } from 'node:crypto';\nimport { createConnection } from 'node:net';\nimport type { Socket } from 'node:net';\n\nimport { readLine, writeLine } from './socket-line.js';\nimport { isErrorWithCode } from './utils.js';\n\nconst DEFAULT_TIMEOUT_MS = 30_000;\n\n/**\n * Options for {@link sendCommand}.\n */\ntype SendCommandOptions = {\n  /** The Unix socket path. */\n  socketPath: string;\n  /** The RPC method name. */\n  method: string;\n  /** Optional method parameters (object or positional array). */\n  params?: JsonRpcParams | undefined;\n  /** Response read timeout in milliseconds (default: 30 000). */\n  timeoutMs?: number | undefined;\n};\n\nasync function connectSocket(socketPath: string): Promise<Socket> {\n  return new Promise((resolve, reject) => {\n    const socket = createConnection(socketPath, () => {\n      socket.removeAllListeners('error');\n      resolve(socket);\n    });\n    socket.on('error', (error) => {\n      // A failed connect never reaches the caller, so destroy the socket here\n      // to avoid leaking its file descriptor.\n      socket.destroy();\n      reject(error);\n    });\n  });\n}\n\n/**\n * Send a JSON-RPC request to the daemon over a Unix socket and return the\n * response.\n *\n * Opens a connection, writes one JSON-RPC request line, reads one JSON-RPC\n * response line, then closes the connection. Retries once after a short delay\n * only on `ECONNREFUSED` — the connection was never established, so the daemon\n * provably never received the request and re-sending is safe. Does not retry\n * on `ECONNRESET`, which can drop after the daemon has already received and\n * acted on the request: blindly re-sending could execute a non-idempotent\n * action (e.g. a transaction broadcast) twice, so it is surfaced to the caller\n * instead. Verifies that the response `id` matches the outgoing request `id`.\n *\n * @param options - Command options.\n * @param options.socketPath - The Unix socket path.\n * @param options.method - The RPC method name.\n * @param options.params - Optional method parameters.\n * @param options.timeoutMs - Read timeout in milliseconds.\n * @returns The parsed JSON-RPC response.\n */\nexport async function sendCommand({\n  socketPath,\n  method,\n  params,\n  timeoutMs,\n}: SendCommandOptions): Promise<JsonRpcResponse> {\n  const id = randomUUID();\n  const request = {\n    jsonrpc: '2.0',\n    id,\n    method,\n    ...(params === undefined ? {} : { params }),\n  };\n\n  const effectiveTimeout = timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\n  const attempt = async (): Promise<JsonRpcResponse> => {\n    const socket = await connectSocket(socketPath);\n    try {\n      await writeLine(socket, JSON.stringify(request));\n      const responseLine = await readLine(socket, effectiveTimeout);\n      const parsed: unknown = JSON.parse(responseLine);\n      assertIsJsonRpcResponse(parsed);\n      if (parsed.id !== id) {\n        throw new Error(\n          `JSON-RPC response id ${JSON.stringify(parsed.id)} does not match request id ${JSON.stringify(id)}`,\n        );\n      }\n      return parsed;\n    } finally {\n      socket.destroy();\n    }\n  };\n\n  try {\n    return await attempt();\n  } catch (error: unknown) {\n    // Only retry on ECONNREFUSED: the connection was never established, so the\n    // daemon provably never received the request and re-sending is safe.\n    // ECONNRESET can drop *after* the daemon received and began (or finished)\n    // processing the request, so blindly re-sending a non-idempotent request\n    // (e.g. a transaction broadcast) could execute it twice. Surface it to the\n    // caller instead of retrying.\n    if (!isErrorWithCode(error, 'ECONNREFUSED')) {\n      throw error;\n    }\n    await new Promise((resolve) => setTimeout(resolve, 100));\n    return attempt();\n  }\n}\n\n/**\n * Why an unreachable daemon cannot be queried.\n *\n * - `'refused'`: the connection could not be completed — `ECONNREFUSED`\n *   (retried once) or `ECONNRESET` (a mid-request drop, not retried). Typical\n *   of a daemon that has crashed or is mid-restart.\n * - `'timeout'`: the daemon accepted the connection but did not respond within\n *   the read timeout — most likely wedged on a long-running operation.\n * - `'permission'`: the socket exists but cannot be opened (`EACCES` / `EPERM`).\n *   The daemon almost certainly belongs to another user.\n * - `'protocol'`: the daemon responded but the response did not parse as a\n *   valid JSON-RPC response, or the response id did not match.\n * - `'other'`: anything else.\n */\nexport type PingUnreachableReason =\n  | 'refused'\n  | 'timeout'\n  | 'permission'\n  | 'protocol'\n  | 'other';\n\n/**\n * Outcome of a daemon health check.\n *\n * - `'responsive'`: the daemon answered a `getStatus` RPC.\n * - `'absent'`: the socket connect attempt failed with `ENOENT`, i.e. no\n *   socket file exists at the path. No daemon present.\n * - `'unreachable'`: any other non-success outcome. The daemon may still be\n *   alive but is not responding. Callers should not silently take over the\n *   slot or assume the daemon is dead. The `reason` field categorises the\n *   failure so callers can distinguish a wedged sibling daemon from a\n *   foreign-user daemon from a transient crash. User-initiated stop / purge\n *   flows may still escalate to signals against the recorded PID.\n */\nexport type PingResult =\n  | { status: 'responsive' }\n  | { status: 'absent' }\n  | { status: 'unreachable'; reason: PingUnreachableReason; error: Error };\n\n/**\n * Normalize an unknown throw into a real Error instance so that downstream\n * consumers (which read `.message`) cannot crash on string/object throws.\n *\n * @param error - The caught value.\n * @returns An Error mirroring the caught value.\n */\nfunction toError(error: unknown): Error {\n  return error instanceof Error ? error : new Error(String(error));\n}\n\n/**\n * Categorise an unreachable error by Node errno / message shape so callers can\n * make decisions per failure mode rather than parsing message strings.\n *\n * @param error - The caught value.\n * @returns A {@link PingUnreachableReason} label.\n */\nfunction classifyUnreachable(error: unknown): PingUnreachableReason {\n  if (\n    isErrorWithCode(error, 'ECONNREFUSED') ||\n    isErrorWithCode(error, 'ECONNRESET')\n  ) {\n    return 'refused';\n  }\n  if (isErrorWithCode(error, 'EACCES') || isErrorWithCode(error, 'EPERM')) {\n    return 'permission';\n  }\n  if (error instanceof Error && error.message === 'Socket read timed out') {\n    return 'timeout';\n  }\n  if (\n    error instanceof Error &&\n    (error.message.includes('JSON-RPC response id') ||\n      /Expected .* JSON-RPC/u.test(error.message) ||\n      error.name === 'SyntaxError')\n  ) {\n    return 'protocol';\n  }\n  return 'other';\n}\n\n/**\n * Check whether the daemon is running by sending a lightweight `getStatus`\n * RPC call. Distinguishes \"no daemon present\" (socket file missing) from\n * \"daemon present but unreachable\" (socket file exists but the daemon is\n * wedged, mid-shutdown, or owned by a different user).\n *\n * @param socketPath - The Unix socket path.\n * @returns A {@link PingResult} describing the daemon's reachability.\n */\nexport async function pingDaemon(socketPath: string): Promise<PingResult> {\n  try {\n    await sendCommand({ socketPath, method: 'getStatus', timeoutMs: 3_000 });\n    return { status: 'responsive' };\n  } catch (error: unknown) {\n    if (isErrorWithCode(error, 'ENOENT')) {\n      return { status: 'absent' };\n    }\n    return {\n      status: 'unreachable',\n      reason: classifyUnreachable(error),\n      error: toError(error),\n    };\n  }\n}\n"]}

package/dist/daemon/wallet-factory.cjs

@@ -47,6 +47,11 @@ function buildInstanceOptions(infuraProjectId) {
         connectivityController: {
             connectivityAdapter: new wallet_1.AlwaysOnlineAdapter(),
         },
+        gasFeeController: {
+            // Identifies the CLI to the gas estimation API via the `X-Client-Id`
+            // header.
+            clientId: 'cli',
+        },
         networkController: {
             infuraProjectId,
         },

package/dist/daemon/wallet-factory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"wallet-factory.cjs","sourceRoot":"","sources":["../../src/daemon/wallet-factory.ts"],"names":[],"mappings":";;;AAAA,6FAKkD;AAClD,+DAAmE;AAEnE,6CAI0B;AAE1B,+CAAsC;AAEtC,uEAAgE;AAChE,mEAA8E;AAI9E,MAAM,uBAAuB,GAAG,UAAU,CAAC;AAuB3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAS,oBAAoB,CAC3B,eAAuB;IAEvB,OAAO;QACL,kBAAkB,EAAE;YAClB,6DAA6D;YAC7D,mBAAmB,EAAE,GAAc,EAAE,CAAC,SAAS;SAChD;QACD,sBAAsB,EAAE;YACtB,mBAAmB,EAAE,IAAI,4BAAmB,EAAE;SAC/C;QACD,iBAAiB,EAAE;YACjB,eAAe;SAChB;QACD,2BAA2B,EAAE;YAC3B,sBAAsB,EAAE,IAAI,uDAAsB,CAAC;gBACjD,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,MAAM,EAAE;oBACN,qEAAqE;oBACrE,iEAAiE;oBACjE,MAAM,EAAE,2CAAU,CAAC,SAAS;oBAC5B,YAAY,EAAE,iDAAgB,CAAC,IAAI;oBACnC,WAAW,EAAE,gDAAe,CAAC,UAAU;iBACxC;aACF,CAAC;YACF,gBAAgB,EAAE,GAAW,EAAE,CAAC,KAAK;YACrC,aAAa,EAAE,OAAO;SACvB;QACD,cAAc,EAAE;YACd,OAAO,EAAE,IAAI,wCAAsB,EAAE;SACtC;QACD,qBAAqB,EAAE;YACrB,+DAA+D;YAC/D,mEAAmE;YACnE,8CAA8C;YAC9C,YAAY,EAAE,IAAI;YAClB,uEAAuE;YACvE,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,4BAA4B;YAC5B,KAAK,EAAE,EAAE;SACV;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACI,KAAK,UAAU,YAAY,CAAC,EACjC,YAAY,EACZ,QAAQ,EACR,GAAG,EACH,eAAe,EACf,GAAG,GACgB;IACnB,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,CAAC,OAAe,EAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,gCAAa,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,MAA0B,CAAC;IAC/B,IAAI,WAAqC,CAAC;IAC1C,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;QACtE,WAAW,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAE1C,sEAAsE;QACtE,mEAAmE;QACnE,kCAAkC;QAClC,IAAI,WAAW,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,4EAA4E;gBAC1E,mEAAmE,CACtE,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,IAAI,eAAM,CAAC;YAClB,KAAK;YACL,eAAe,EAAE,oBAAoB,CAAC,eAAe,CAAC;SACvD,CAAC,CAAC;QACH,WAAW,GAAG,IAAA,mCAAkB,EAC9B,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,kBAAkB,EACzB,KAAK,EACL,KAAK,CACN,CAAC;QAEF,wEAAwE;QACxE,2EAA2E;QAC3E,yEAAyE;QACzE,uEAAuE;QACvE,2EAA2E;QAC3E,kCAAkC;QAClC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CACrC,CAAC,MAAM,EAAmC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAC1E,CAAC;QACF,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,KAAK,CAAC,4BAA4B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,iCAAiC,YAAY,CAAC,MAAM,+EAA+E,WAAW,EAAE,CACjJ,CAAC;QACJ,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,wEAAwE;YACxE,uEAAuE;YACvE,8DAA8D;YAC9D,6CAA6C;YAC7C,MAAM,IAAA,mCAA0B,EAC9B,MAAM,EACL,QAAqB,CAAC,MAAM,EAAE,EAC/B,GAAG,CAAC,MAAM,EAAE,CACb,CAAC;QACJ,CAAC;aAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CACzB,kCAAkC,EAClC,QAAQ,CAAC,MAAM,EAAE,CAClB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,CAAC,KAAK,CAAC,EAAE,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,cAAyC,CAAC;QAC9C,OAAO;YACL,MAAM;YACN,OAAO,EAAE,KAAK,IAAI,EAAE,CAClB,CAAC,cAAc,KAAd,cAAc,GAAK,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,EAAC;SACnE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAElD,IAAI,WAAW,IAAI,YAAY,KAAK,uBAAuB,EAAE,CAAC;YAC5D,wEAAwE;YACxE,0EAA0E;YAC1E,sEAAsE;YACtE,4DAA4D;YAC5D,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,YAAY,EAAE,GAAG,YAAY,MAAM,EAAE,GAAG,YAAY,MAAM,CAAC,CAAC,GAAG,CAC9D,CAAC,IAAI,EAAE,EAAE,CACP,IAAA,aAAE,EAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAgB,EAAE,EAAE;gBACnD,KAAK,CACH,oBAAoB,IAAI,8BAA8B,MAAM,CAAC,OAAO,CAAC,EAAE,CACxE,CAAC;YACJ,CAAC,CAAC,CACL,CACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AA7GD,oCA6GC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,kBAAkB,CAC/B,KAAoB,EACpB,eAAuB,EACvB,KAAa;IAEb,MAAM,KAAK,GAAG,IAAI,eAAM,CAAC;QACvB,eAAe,EAAE,oBAAoB,CAAC,eAAe,CAAC;KACvD,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,IAAA,0BAAS,EAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACpD,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC7C,KAAK,CAAC,kCAAkC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,QAAQ,CACrB,WAAqC,EACrC,MAA0B,EAC1B,KAAoB,EACpB,KAAa;IAEb,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,WAAW,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,mDAAmD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,4CAA4C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,yCAAyC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC1B,KAA8C;IAE9C,OAAO,OAAO,KAAK,CAAC,iBAAiB,EAAE,KAAK,KAAK,QAAQ,CAAC;AAC5D,CAAC","sourcesContent":["import {\n  ClientConfigApiService,\n  ClientType,\n  DistributionType,\n  EnvironmentType,\n} from '@metamask/remote-feature-flag-controller';\nimport { InMemoryStorageAdapter } from '@metamask/storage-service';\nimport type { Json } from '@metamask/utils';\nimport {\n  AlwaysOnlineAdapter,\n  importSecretRecoveryPhrase,\n  Wallet,\n} from '@metamask/wallet';\nimport type { WalletOptions } from '@metamask/wallet';\nimport { rm } from 'node:fs/promises';\n\nimport { KeyValueStore } from '../persistence/KeyValueStore.js';\nimport { loadState, subscribeToChanges } from '../persistence/persistence.js';\nimport type { Password, Srp } from './secrets.js';\nimport type { Logger } from './types.js';\n\nconst IN_MEMORY_DATABASE_PATH = ':memory:';\n\nexport type CreateWalletConfig = {\n  databasePath: string;\n  password?: Password;\n  srp: Srp;\n  infuraProjectId: string;\n  log?: Logger;\n};\n\nexport type CreateWalletResult = {\n  wallet: Wallet;\n  /**\n   * Tear down everything `createWallet` set up, in the order that keeps\n   * in-flight persistence writes valid: stop the state-change subscription,\n   * destroy the wallet, then close the store (closing first would cause a\n   * teardown-time persistence write to fail). Resilient — a failure in any\n   * step is logged and the remaining steps still run — and idempotent (repeat\n   * calls coalesce onto the same teardown).\n   */\n  dispose: () => Promise<void>;\n};\n\n/**\n * Build the per-instance options the daemon's `Wallet` is constructed with.\n *\n * Returns a fresh set on every call so the metadata probe and the real wallet\n * never share adapter/service instances (the probe is destroyed, which may\n * tear those instances down).\n *\n * Only the slots wired on `@metamask/wallet` today are populated:\n * - `storageService` — backed by an in-memory adapter. This is the wallet's\n *   large-blob store (snap source, caches), distinct from the SQLite\n *   `KeyValueStore` that persists controller state; no wired controller\n *   offloads durable data to it yet, so in-memory suffices.\n * - `connectivityController` — the `AlwaysOnlineAdapter` exported for\n *   node-like hosts that have no platform connectivity signal.\n * - `networkController` — the Infura project ID used to reach Infura RPC\n *   endpoints.\n * - `remoteFeatureFlagController` — a `ClientConfigApiService` fetching real\n *   flags over the network.\n * - `approvalController` — a no-op `showApprovalRequest` (the daemon is\n *   headless).\n * - `transactionController` — swaps processing disabled and no client hooks;\n *   see the slot's inline comment for why the daemon relies on the\n *   controller's defaults for everything else.\n *\n * The optional `keyringController` slot is intentionally omitted so the\n * controller's built-in defaults (e.g. the PBKDF2 encryptor) apply.\n *\n * @param infuraProjectId - The Infura project ID for the `NetworkController`.\n * @returns The `instanceOptions` for the `Wallet` constructor.\n */\nfunction buildInstanceOptions(\n  infuraProjectId: string,\n): WalletOptions['instanceOptions'] {\n  return {\n    approvalController: {\n      // TODO: surface approval requests over the daemon transport.\n      showApprovalRequest: (): undefined => undefined,\n    },\n    connectivityController: {\n      connectivityAdapter: new AlwaysOnlineAdapter(),\n    },\n    networkController: {\n      infuraProjectId,\n    },\n    remoteFeatureFlagController: {\n      clientConfigApiService: new ClientConfigApiService({\n        fetch: globalThis.fetch,\n        config: {\n          // TODO: switch to a CLI-specific `ClientType` once one exists; until\n          // then `Extension` buckets feature flags as an extension client.\n          client: ClientType.Extension,\n          distribution: DistributionType.Main,\n          environment: EnvironmentType.Production,\n        },\n      }),\n      getMetaMetricsId: (): string => 'cli',\n      clientVersion: '0.0.0',\n    },\n    storageService: {\n      storage: new InMemoryStorageAdapter(),\n    },\n    transactionController: {\n      // The CLI exposes no swaps surface, so skip the swaps-specific\n      // post-processing a full wallet client runs (mobile makes the same\n      // choice; the extension keeps swaps enabled).\n      disableSwaps: true,\n      // No CLI-specific transaction hooks: the controller's built-in publish\n      // path broadcasts through the wired `NetworkController` provider, and the\n      // remaining hooks (metrics, notifications, gas-fee tokens) are client-UI\n      // concerns the headless daemon has no equivalent for. Every other option\n      // (`getPermittedAccounts`, `isSimulationEnabled`, `trace`, …) is left at\n      // the controller's default.\n      hooks: {},\n    },\n  };\n}\n\n/**\n * Create a configured `Wallet` for daemon use, backed by a SQLite key-value\n * store for controller-state persistence.\n *\n * Loads any previously-persisted controller state from the store, seeds the\n * wallet with it, then subscribes the store to subsequent state changes so all\n * persist-flagged properties are written through.\n *\n * If the store does not yet contain a keyring vault (first run), the supplied\n * secret recovery phrase is imported using the supplied password. On\n * subsequent runs, the persisted vault is reused: when a password is\n * supplied, the wallet is unlocked via `KeyringController:submitPassword` so\n * keyring-bound messenger actions work immediately; when no password is\n * supplied, the wallet starts locked and the caller is expected to invoke\n * `mm wallet unlock` before any keyring-bound operation. First-run startup\n * without a password is rejected (the SRP cannot be imported without one).\n * On a subsequent run, a wrong password rejects startup with a `Failed to\n * unlock the persisted vault` error that wraps the `submitPassword` rejection.\n *\n * On any failure after the store is opened, the store is closed (and the wallet\n * destroyed, if constructed). On a first-run failure, the on-disk database is\n * also removed so a retry does not latch onto an orphaned partial vault — this\n * covers in-process failures only; a hard crash (SIGKILL/power loss) mid-import\n * can still leave a vault on disk.\n *\n * @param config - Wallet configuration.\n * @param config.databasePath - Path to the SQLite database file (or\n * `':memory:'` for ephemeral use).\n * @param config.password - The wallet password. Optional on subsequent runs;\n * when omitted, the daemon starts with a locked keyring. Required on first\n * run (to import the SRP).\n * @param config.srp - The secret recovery phrase (BIP-39 mnemonic). Used\n * only on first run.\n * @param config.infuraProjectId - The Infura project ID for the\n * `NetworkController`.\n * @param config.log - Optional logger for persistence-write and teardown\n * failures. Without it, failures fall back to `console.error` (which a detached\n * daemon's `stdio: 'ignore'` discards).\n * @returns The `Wallet` and a `dispose` handle that tears it down.\n */\nexport async function createWallet({\n  databasePath,\n  password,\n  srp,\n  infuraProjectId,\n  log,\n}: CreateWalletConfig): Promise<CreateWalletResult> {\n  const logFn = log ?? ((message: string): void => console.error(message));\n  const store = new KeyValueStore(databasePath);\n  let wallet: Wallet | undefined;\n  let unsubscribe: (() => void) | undefined;\n  let wasFirstRun = false;\n\n  try {\n    const state = await loadPersistedState(store, infuraProjectId, logFn);\n    wasFirstRun = !hasPersistedKeyring(state);\n\n    // Validate the first-run precondition BEFORE constructing the wallet,\n    // so a doomed startup doesn't build a Wallet (and wire persistence\n    // handlers) just to tear it down.\n    if (wasFirstRun && password === undefined) {\n      throw new Error(\n        'A password is required on first run to import the secret recovery phrase. ' +\n          'Pass `--password` (or `MM_WALLET_PASSWORD`) on `mm daemon start`.',\n      );\n    }\n\n    wallet = new Wallet({\n      state,\n      instanceOptions: buildInstanceOptions(infuraProjectId),\n    });\n    unsubscribe = subscribeToChanges(\n      wallet.messenger,\n      wallet.controllerMetadata,\n      store,\n      logFn,\n    );\n\n    // Complete post-construction controller setup before serving requests —\n    // e.g. `NetworkController.init` applies the selected network so a provider\n    // is available. `init` settles every step independently; a rejected step\n    // leaves the wallet only partially usable, so abort startup (the catch\n    // below tears down and, on first run, removes the partial database) rather\n    // than serving a degraded daemon.\n    const initResults = await wallet.init();\n    const initFailures = initResults.filter(\n      (result): result is PromiseRejectedResult => result.status === 'rejected',\n    );\n    for (const failure of initFailures) {\n      logFn(`Wallet init step failed: ${String(failure.reason)}`);\n    }\n    if (initFailures.length > 0) {\n      const firstReason = String(initFailures[0].reason);\n      throw new Error(\n        `Wallet initialization failed (${initFailures.length} step(s)); refusing to serve a partially initialized wallet. First failure: ${firstReason}`,\n      );\n    }\n\n    if (wasFirstRun) {\n      // The precondition check above throws when `wasFirstRun && password ===\n      // undefined`, so `password` is defined here. TS does not correlate the\n      // two separate variables, so it cannot narrow `password` from\n      // `wasFirstRun` alone — hence the assertion.\n      await importSecretRecoveryPhrase(\n        wallet,\n        (password as Password).unwrap(),\n        srp.unwrap(),\n      );\n    } else if (password !== undefined) {\n      try {\n        await wallet.messenger.call(\n          'KeyringController:submitPassword',\n          password.unwrap(),\n        );\n      } catch (error) {\n        throw new Error(\n          `Failed to unlock the persisted vault: ${String(error)}`,\n        );\n      }\n    }\n\n    let disposePromise: Promise<void> | undefined;\n    return {\n      wallet,\n      dispose: async () =>\n        (disposePromise ??= teardown(unsubscribe, wallet, store, logFn)),\n    };\n  } catch (error) {\n    await teardown(unsubscribe, wallet, store, logFn);\n\n    if (wasFirstRun && databasePath !== IN_MEMORY_DATABASE_PATH) {\n      // Best-effort cleanup of the on-disk SQLite files (main, WAL, SHM) so a\n      // partially-persisted KeyringController vault cannot mislead the next run\n      // into skipping SRP import. Covers in-process failures only — a crash\n      // (SIGKILL/power loss) mid-import leaves the vault on disk.\n      await Promise.all(\n        [databasePath, `${databasePath}-wal`, `${databasePath}-shm`].map(\n          (path) =>\n            rm(path, { force: true }).catch((rmError: unknown) => {\n              logFn(\n                `Failed to remove ${path} during first-run cleanup: ${String(rmError)}`,\n              );\n            }),\n        ),\n      );\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Load persisted controller state, filtered to currently persist-flagged\n * properties.\n *\n * `loadState` filters against the live controller metadata, but that metadata\n * is only knowable from a constructed `Wallet` — and its output is what seeds\n * the real wallet. So this constructs a short-lived probe purely to read the\n * metadata, then tears it down.\n *\n * TODO: drop the probe once `@metamask/wallet` exposes controller metadata\n * without constructing a `Wallet`.\n *\n * @param store - The key-value store to read from.\n * @param infuraProjectId - The Infura project ID for the probe's\n * `NetworkController`.\n * @param logFn - Logger for a probe-teardown failure.\n * @returns The filtered persisted state, suitable for the `Wallet` `state`\n * option.\n */\nasync function loadPersistedState(\n  store: KeyValueStore,\n  infuraProjectId: string,\n  logFn: Logger,\n): Promise<Record<string, Record<string, Json>>> {\n  const probe = new Wallet({\n    instanceOptions: buildInstanceOptions(infuraProjectId),\n  });\n  try {\n    return loadState(store, probe.controllerMetadata);\n  } finally {\n    await probe.destroy().catch((error: unknown) => {\n      logFn(`Metadata probe destroy failed: ${String(error)}`);\n    });\n  }\n}\n\n/**\n * Persistence-safe teardown of a wallet and its store; see {@link\n * CreateWalletResult.dispose} for the ordering rationale. Each step is\n * best-effort, so a failure is logged and the remaining steps still run.\n *\n * @param unsubscribe - The persistence-subscription unsubscribe function, if\n * one was registered.\n * @param wallet - The wallet to destroy, if one was constructed.\n * @param store - The store to close.\n * @param logFn - Logger for step failures.\n */\nasync function teardown(\n  unsubscribe: (() => void) | undefined,\n  wallet: Wallet | undefined,\n  store: KeyValueStore,\n  logFn: Logger,\n): Promise<void> {\n  if (unsubscribe) {\n    try {\n      unsubscribe();\n    } catch (error) {\n      logFn(`Persistence unsubscribe failed during teardown: ${String(error)}`);\n    }\n  }\n  if (wallet) {\n    try {\n      await wallet.destroy();\n    } catch (error) {\n      logFn(`wallet.destroy() failed during teardown: ${String(error)}`);\n    }\n  }\n  try {\n    store.close();\n  } catch (error) {\n    logFn(`store.close() failed during teardown: ${String(error)}`);\n  }\n}\n\n/**\n * Determine whether the loaded state already contains a keyring vault.\n *\n * The KeyringController persists its `vault` once an SRP has been imported, so\n * its presence indicates that first-run setup completed before.\n *\n * @param state - The state loaded from the key-value store.\n * @returns True if a KeyringController vault string is present.\n */\nfunction hasPersistedKeyring(\n  state: Record<string, Record<string, unknown>>,\n): boolean {\n  return typeof state.KeyringController?.vault === 'string';\n}\n"]}
+{"version":3,"file":"wallet-factory.cjs","sourceRoot":"","sources":["../../src/daemon/wallet-factory.ts"],"names":[],"mappings":";;;AAAA,6FAKkD;AAClD,+DAAmE;AAEnE,6CAI0B;AAE1B,+CAAsC;AAEtC,uEAAgE;AAChE,mEAA8E;AAI9E,MAAM,uBAAuB,GAAG,UAAU,CAAC;AAuB3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAS,oBAAoB,CAC3B,eAAuB;IAEvB,OAAO;QACL,kBAAkB,EAAE;YAClB,6DAA6D;YAC7D,mBAAmB,EAAE,GAAc,EAAE,CAAC,SAAS;SAChD;QACD,sBAAsB,EAAE;YACtB,mBAAmB,EAAE,IAAI,4BAAmB,EAAE;SAC/C;QACD,gBAAgB,EAAE;YAChB,qEAAqE;YACrE,UAAU;YACV,QAAQ,EAAE,KAAK;SAChB;QACD,iBAAiB,EAAE;YACjB,eAAe;SAChB;QACD,2BAA2B,EAAE;YAC3B,sBAAsB,EAAE,IAAI,uDAAsB,CAAC;gBACjD,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,MAAM,EAAE;oBACN,qEAAqE;oBACrE,iEAAiE;oBACjE,MAAM,EAAE,2CAAU,CAAC,SAAS;oBAC5B,YAAY,EAAE,iDAAgB,CAAC,IAAI;oBACnC,WAAW,EAAE,gDAAe,CAAC,UAAU;iBACxC;aACF,CAAC;YACF,gBAAgB,EAAE,GAAW,EAAE,CAAC,KAAK;YACrC,aAAa,EAAE,OAAO;SACvB;QACD,cAAc,EAAE;YACd,OAAO,EAAE,IAAI,wCAAsB,EAAE;SACtC;QACD,qBAAqB,EAAE;YACrB,+DAA+D;YAC/D,mEAAmE;YACnE,8CAA8C;YAC9C,YAAY,EAAE,IAAI;YAClB,uEAAuE;YACvE,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,4BAA4B;YAC5B,KAAK,EAAE,EAAE;SACV;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACI,KAAK,UAAU,YAAY,CAAC,EACjC,YAAY,EACZ,QAAQ,EACR,GAAG,EACH,eAAe,EACf,GAAG,GACgB;IACnB,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,CAAC,OAAe,EAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,gCAAa,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,MAA0B,CAAC;IAC/B,IAAI,WAAqC,CAAC;IAC1C,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;QACtE,WAAW,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAE1C,sEAAsE;QACtE,mEAAmE;QACnE,kCAAkC;QAClC,IAAI,WAAW,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,4EAA4E;gBAC1E,mEAAmE,CACtE,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,IAAI,eAAM,CAAC;YAClB,KAAK;YACL,eAAe,EAAE,oBAAoB,CAAC,eAAe,CAAC;SACvD,CAAC,CAAC;QACH,WAAW,GAAG,IAAA,mCAAkB,EAC9B,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,kBAAkB,EACzB,KAAK,EACL,KAAK,CACN,CAAC;QAEF,wEAAwE;QACxE,2EAA2E;QAC3E,yEAAyE;QACzE,uEAAuE;QACvE,2EAA2E;QAC3E,kCAAkC;QAClC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CACrC,CAAC,MAAM,EAAmC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAC1E,CAAC;QACF,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,KAAK,CAAC,4BAA4B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,iCAAiC,YAAY,CAAC,MAAM,+EAA+E,WAAW,EAAE,CACjJ,CAAC;QACJ,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,wEAAwE;YACxE,uEAAuE;YACvE,8DAA8D;YAC9D,6CAA6C;YAC7C,MAAM,IAAA,mCAA0B,EAC9B,MAAM,EACL,QAAqB,CAAC,MAAM,EAAE,EAC/B,GAAG,CAAC,MAAM,EAAE,CACb,CAAC;QACJ,CAAC;aAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CACzB,kCAAkC,EAClC,QAAQ,CAAC,MAAM,EAAE,CAClB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,CAAC,KAAK,CAAC,EAAE,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,cAAyC,CAAC;QAC9C,OAAO;YACL,MAAM;YACN,OAAO,EAAE,KAAK,IAAI,EAAE,CAClB,CAAC,cAAc,KAAd,cAAc,GAAK,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,EAAC;SACnE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAElD,IAAI,WAAW,IAAI,YAAY,KAAK,uBAAuB,EAAE,CAAC;YAC5D,wEAAwE;YACxE,0EAA0E;YAC1E,sEAAsE;YACtE,4DAA4D;YAC5D,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,YAAY,EAAE,GAAG,YAAY,MAAM,EAAE,GAAG,YAAY,MAAM,CAAC,CAAC,GAAG,CAC9D,CAAC,IAAI,EAAE,EAAE,CACP,IAAA,aAAE,EAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAgB,EAAE,EAAE;gBACnD,KAAK,CACH,oBAAoB,IAAI,8BAA8B,MAAM,CAAC,OAAO,CAAC,EAAE,CACxE,CAAC;YACJ,CAAC,CAAC,CACL,CACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AA7GD,oCA6GC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,kBAAkB,CAC/B,KAAoB,EACpB,eAAuB,EACvB,KAAa;IAEb,MAAM,KAAK,GAAG,IAAI,eAAM,CAAC;QACvB,eAAe,EAAE,oBAAoB,CAAC,eAAe,CAAC;KACvD,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,IAAA,0BAAS,EAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACpD,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC7C,KAAK,CAAC,kCAAkC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,QAAQ,CACrB,WAAqC,EACrC,MAA0B,EAC1B,KAAoB,EACpB,KAAa;IAEb,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,WAAW,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,mDAAmD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,4CAA4C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,yCAAyC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC1B,KAA8C;IAE9C,OAAO,OAAO,KAAK,CAAC,iBAAiB,EAAE,KAAK,KAAK,QAAQ,CAAC;AAC5D,CAAC","sourcesContent":["import {\n  ClientConfigApiService,\n  ClientType,\n  DistributionType,\n  EnvironmentType,\n} from '@metamask/remote-feature-flag-controller';\nimport { InMemoryStorageAdapter } from '@metamask/storage-service';\nimport type { Json } from '@metamask/utils';\nimport {\n  AlwaysOnlineAdapter,\n  importSecretRecoveryPhrase,\n  Wallet,\n} from '@metamask/wallet';\nimport type { WalletOptions } from '@metamask/wallet';\nimport { rm } from 'node:fs/promises';\n\nimport { KeyValueStore } from '../persistence/KeyValueStore.js';\nimport { loadState, subscribeToChanges } from '../persistence/persistence.js';\nimport type { Password, Srp } from './secrets.js';\nimport type { Logger } from './types.js';\n\nconst IN_MEMORY_DATABASE_PATH = ':memory:';\n\nexport type CreateWalletConfig = {\n  databasePath: string;\n  password?: Password;\n  srp: Srp;\n  infuraProjectId: string;\n  log?: Logger;\n};\n\nexport type CreateWalletResult = {\n  wallet: Wallet;\n  /**\n   * Tear down everything `createWallet` set up, in the order that keeps\n   * in-flight persistence writes valid: stop the state-change subscription,\n   * destroy the wallet, then close the store (closing first would cause a\n   * teardown-time persistence write to fail). Resilient — a failure in any\n   * step is logged and the remaining steps still run — and idempotent (repeat\n   * calls coalesce onto the same teardown).\n   */\n  dispose: () => Promise<void>;\n};\n\n/**\n * Build the per-instance options the daemon's `Wallet` is constructed with.\n *\n * Returns a fresh set on every call so the metadata probe and the real wallet\n * never share adapter/service instances (the probe is destroyed, which may\n * tear those instances down).\n *\n * Only the slots wired on `@metamask/wallet` today are populated:\n * - `storageService` — backed by an in-memory adapter. This is the wallet's\n *   large-blob store (snap source, caches), distinct from the SQLite\n *   `KeyValueStore` that persists controller state; no wired controller\n *   offloads durable data to it yet, so in-memory suffices.\n * - `connectivityController` — the `AlwaysOnlineAdapter` exported for\n *   node-like hosts that have no platform connectivity signal.\n * - `networkController` — the Infura project ID used to reach Infura RPC\n *   endpoints.\n * - `remoteFeatureFlagController` — a `ClientConfigApiService` fetching real\n *   flags over the network.\n * - `approvalController` — a no-op `showApprovalRequest` (the daemon is\n *   headless).\n * - `transactionController` — swaps processing disabled and no client hooks;\n *   see the slot's inline comment for why the daemon relies on the\n *   controller's defaults for everything else.\n *\n * The optional `keyringController` slot is intentionally omitted so the\n * controller's built-in defaults (e.g. the PBKDF2 encryptor) apply.\n *\n * @param infuraProjectId - The Infura project ID for the `NetworkController`.\n * @returns The `instanceOptions` for the `Wallet` constructor.\n */\nfunction buildInstanceOptions(\n  infuraProjectId: string,\n): WalletOptions['instanceOptions'] {\n  return {\n    approvalController: {\n      // TODO: surface approval requests over the daemon transport.\n      showApprovalRequest: (): undefined => undefined,\n    },\n    connectivityController: {\n      connectivityAdapter: new AlwaysOnlineAdapter(),\n    },\n    gasFeeController: {\n      // Identifies the CLI to the gas estimation API via the `X-Client-Id`\n      // header.\n      clientId: 'cli',\n    },\n    networkController: {\n      infuraProjectId,\n    },\n    remoteFeatureFlagController: {\n      clientConfigApiService: new ClientConfigApiService({\n        fetch: globalThis.fetch,\n        config: {\n          // TODO: switch to a CLI-specific `ClientType` once one exists; until\n          // then `Extension` buckets feature flags as an extension client.\n          client: ClientType.Extension,\n          distribution: DistributionType.Main,\n          environment: EnvironmentType.Production,\n        },\n      }),\n      getMetaMetricsId: (): string => 'cli',\n      clientVersion: '0.0.0',\n    },\n    storageService: {\n      storage: new InMemoryStorageAdapter(),\n    },\n    transactionController: {\n      // The CLI exposes no swaps surface, so skip the swaps-specific\n      // post-processing a full wallet client runs (mobile makes the same\n      // choice; the extension keeps swaps enabled).\n      disableSwaps: true,\n      // No CLI-specific transaction hooks: the controller's built-in publish\n      // path broadcasts through the wired `NetworkController` provider, and the\n      // remaining hooks (metrics, notifications, gas-fee tokens) are client-UI\n      // concerns the headless daemon has no equivalent for. Every other option\n      // (`getPermittedAccounts`, `isSimulationEnabled`, `trace`, …) is left at\n      // the controller's default.\n      hooks: {},\n    },\n  };\n}\n\n/**\n * Create a configured `Wallet` for daemon use, backed by a SQLite key-value\n * store for controller-state persistence.\n *\n * Loads any previously-persisted controller state from the store, seeds the\n * wallet with it, then subscribes the store to subsequent state changes so all\n * persist-flagged properties are written through.\n *\n * If the store does not yet contain a keyring vault (first run), the supplied\n * secret recovery phrase is imported using the supplied password. On\n * subsequent runs, the persisted vault is reused: when a password is\n * supplied, the wallet is unlocked via `KeyringController:submitPassword` so\n * keyring-bound messenger actions work immediately; when no password is\n * supplied, the wallet starts locked and the caller is expected to invoke\n * `mm wallet unlock` before any keyring-bound operation. First-run startup\n * without a password is rejected (the SRP cannot be imported without one).\n * On a subsequent run, a wrong password rejects startup with a `Failed to\n * unlock the persisted vault` error that wraps the `submitPassword` rejection.\n *\n * On any failure after the store is opened, the store is closed (and the wallet\n * destroyed, if constructed). On a first-run failure, the on-disk database is\n * also removed so a retry does not latch onto an orphaned partial vault — this\n * covers in-process failures only; a hard crash (SIGKILL/power loss) mid-import\n * can still leave a vault on disk.\n *\n * @param config - Wallet configuration.\n * @param config.databasePath - Path to the SQLite database file (or\n * `':memory:'` for ephemeral use).\n * @param config.password - The wallet password. Optional on subsequent runs;\n * when omitted, the daemon starts with a locked keyring. Required on first\n * run (to import the SRP).\n * @param config.srp - The secret recovery phrase (BIP-39 mnemonic). Used\n * only on first run.\n * @param config.infuraProjectId - The Infura project ID for the\n * `NetworkController`.\n * @param config.log - Optional logger for persistence-write and teardown\n * failures. Without it, failures fall back to `console.error` (which a detached\n * daemon's `stdio: 'ignore'` discards).\n * @returns The `Wallet` and a `dispose` handle that tears it down.\n */\nexport async function createWallet({\n  databasePath,\n  password,\n  srp,\n  infuraProjectId,\n  log,\n}: CreateWalletConfig): Promise<CreateWalletResult> {\n  const logFn = log ?? ((message: string): void => console.error(message));\n  const store = new KeyValueStore(databasePath);\n  let wallet: Wallet | undefined;\n  let unsubscribe: (() => void) | undefined;\n  let wasFirstRun = false;\n\n  try {\n    const state = await loadPersistedState(store, infuraProjectId, logFn);\n    wasFirstRun = !hasPersistedKeyring(state);\n\n    // Validate the first-run precondition BEFORE constructing the wallet,\n    // so a doomed startup doesn't build a Wallet (and wire persistence\n    // handlers) just to tear it down.\n    if (wasFirstRun && password === undefined) {\n      throw new Error(\n        'A password is required on first run to import the secret recovery phrase. ' +\n          'Pass `--password` (or `MM_WALLET_PASSWORD`) on `mm daemon start`.',\n      );\n    }\n\n    wallet = new Wallet({\n      state,\n      instanceOptions: buildInstanceOptions(infuraProjectId),\n    });\n    unsubscribe = subscribeToChanges(\n      wallet.messenger,\n      wallet.controllerMetadata,\n      store,\n      logFn,\n    );\n\n    // Complete post-construction controller setup before serving requests —\n    // e.g. `NetworkController.init` applies the selected network so a provider\n    // is available. `init` settles every step independently; a rejected step\n    // leaves the wallet only partially usable, so abort startup (the catch\n    // below tears down and, on first run, removes the partial database) rather\n    // than serving a degraded daemon.\n    const initResults = await wallet.init();\n    const initFailures = initResults.filter(\n      (result): result is PromiseRejectedResult => result.status === 'rejected',\n    );\n    for (const failure of initFailures) {\n      logFn(`Wallet init step failed: ${String(failure.reason)}`);\n    }\n    if (initFailures.length > 0) {\n      const firstReason = String(initFailures[0].reason);\n      throw new Error(\n        `Wallet initialization failed (${initFailures.length} step(s)); refusing to serve a partially initialized wallet. First failure: ${firstReason}`,\n      );\n    }\n\n    if (wasFirstRun) {\n      // The precondition check above throws when `wasFirstRun && password ===\n      // undefined`, so `password` is defined here. TS does not correlate the\n      // two separate variables, so it cannot narrow `password` from\n      // `wasFirstRun` alone — hence the assertion.\n      await importSecretRecoveryPhrase(\n        wallet,\n        (password as Password).unwrap(),\n        srp.unwrap(),\n      );\n    } else if (password !== undefined) {\n      try {\n        await wallet.messenger.call(\n          'KeyringController:submitPassword',\n          password.unwrap(),\n        );\n      } catch (error) {\n        throw new Error(\n          `Failed to unlock the persisted vault: ${String(error)}`,\n        );\n      }\n    }\n\n    let disposePromise: Promise<void> | undefined;\n    return {\n      wallet,\n      dispose: async () =>\n        (disposePromise ??= teardown(unsubscribe, wallet, store, logFn)),\n    };\n  } catch (error) {\n    await teardown(unsubscribe, wallet, store, logFn);\n\n    if (wasFirstRun && databasePath !== IN_MEMORY_DATABASE_PATH) {\n      // Best-effort cleanup of the on-disk SQLite files (main, WAL, SHM) so a\n      // partially-persisted KeyringController vault cannot mislead the next run\n      // into skipping SRP import. Covers in-process failures only — a crash\n      // (SIGKILL/power loss) mid-import leaves the vault on disk.\n      await Promise.all(\n        [databasePath, `${databasePath}-wal`, `${databasePath}-shm`].map(\n          (path) =>\n            rm(path, { force: true }).catch((rmError: unknown) => {\n              logFn(\n                `Failed to remove ${path} during first-run cleanup: ${String(rmError)}`,\n              );\n            }),\n        ),\n      );\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Load persisted controller state, filtered to currently persist-flagged\n * properties.\n *\n * `loadState` filters against the live controller metadata, but that metadata\n * is only knowable from a constructed `Wallet` — and its output is what seeds\n * the real wallet. So this constructs a short-lived probe purely to read the\n * metadata, then tears it down.\n *\n * TODO: drop the probe once `@metamask/wallet` exposes controller metadata\n * without constructing a `Wallet`.\n *\n * @param store - The key-value store to read from.\n * @param infuraProjectId - The Infura project ID for the probe's\n * `NetworkController`.\n * @param logFn - Logger for a probe-teardown failure.\n * @returns The filtered persisted state, suitable for the `Wallet` `state`\n * option.\n */\nasync function loadPersistedState(\n  store: KeyValueStore,\n  infuraProjectId: string,\n  logFn: Logger,\n): Promise<Record<string, Record<string, Json>>> {\n  const probe = new Wallet({\n    instanceOptions: buildInstanceOptions(infuraProjectId),\n  });\n  try {\n    return loadState(store, probe.controllerMetadata);\n  } finally {\n    await probe.destroy().catch((error: unknown) => {\n      logFn(`Metadata probe destroy failed: ${String(error)}`);\n    });\n  }\n}\n\n/**\n * Persistence-safe teardown of a wallet and its store; see {@link\n * CreateWalletResult.dispose} for the ordering rationale. Each step is\n * best-effort, so a failure is logged and the remaining steps still run.\n *\n * @param unsubscribe - The persistence-subscription unsubscribe function, if\n * one was registered.\n * @param wallet - The wallet to destroy, if one was constructed.\n * @param store - The store to close.\n * @param logFn - Logger for step failures.\n */\nasync function teardown(\n  unsubscribe: (() => void) | undefined,\n  wallet: Wallet | undefined,\n  store: KeyValueStore,\n  logFn: Logger,\n): Promise<void> {\n  if (unsubscribe) {\n    try {\n      unsubscribe();\n    } catch (error) {\n      logFn(`Persistence unsubscribe failed during teardown: ${String(error)}`);\n    }\n  }\n  if (wallet) {\n    try {\n      await wallet.destroy();\n    } catch (error) {\n      logFn(`wallet.destroy() failed during teardown: ${String(error)}`);\n    }\n  }\n  try {\n    store.close();\n  } catch (error) {\n    logFn(`store.close() failed during teardown: ${String(error)}`);\n  }\n}\n\n/**\n * Determine whether the loaded state already contains a keyring vault.\n *\n * The KeyringController persists its `vault` once an SRP has been imported, so\n * its presence indicates that first-run setup completed before.\n *\n * @param state - The state loaded from the key-value store.\n * @returns True if a KeyringController vault string is present.\n */\nfunction hasPersistedKeyring(\n  state: Record<string, Record<string, unknown>>,\n): boolean {\n  return typeof state.KeyringController?.vault === 'string';\n}\n"]}

package/dist/daemon/wallet-factory.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"wallet-factory.d.cts","sourceRoot":"","sources":["../../src/daemon/wallet-factory.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,MAAM,EACP,yBAAyB;AAM1B,OAAO,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,sBAAqB;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,oBAAmB;AAIzC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,GAAG,EAAE,GAAG,CAAC;IACT,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC;AA+EF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,YAAY,CAAC,EACjC,YAAY,EACZ,QAAQ,EACR,GAAG,EACH,eAAe,EACf,GAAG,GACJ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAuGlD"}
+{"version":3,"file":"wallet-factory.d.cts","sourceRoot":"","sources":["../../src/daemon/wallet-factory.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,MAAM,EACP,yBAAyB;AAM1B,OAAO,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,sBAAqB;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,oBAAmB;AAIzC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,GAAG,EAAE,GAAG,CAAC;IACT,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC;AAoFF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,YAAY,CAAC,EACjC,YAAY,EACZ,QAAQ,EACR,GAAG,EACH,eAAe,EACf,GAAG,GACJ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAuGlD"}

package/dist/daemon/wallet-factory.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"wallet-factory.d.mts","sourceRoot":"","sources":["../../src/daemon/wallet-factory.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,MAAM,EACP,yBAAyB;AAM1B,OAAO,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,sBAAqB;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,oBAAmB;AAIzC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,GAAG,EAAE,GAAG,CAAC;IACT,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC;AA+EF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,YAAY,CAAC,EACjC,YAAY,EACZ,QAAQ,EACR,GAAG,EACH,eAAe,EACf,GAAG,GACJ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAuGlD"}
+{"version":3,"file":"wallet-factory.d.mts","sourceRoot":"","sources":["../../src/daemon/wallet-factory.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,MAAM,EACP,yBAAyB;AAM1B,OAAO,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,sBAAqB;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,oBAAmB;AAIzC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,GAAG,EAAE,GAAG,CAAC;IACT,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC;AAoFF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,YAAY,CAAC,EACjC,YAAY,EACZ,QAAQ,EACR,GAAG,EACH,eAAe,EACf,GAAG,GACJ,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAuGlD"}

package/dist/daemon/wallet-factory.mjs

@@ -44,6 +44,11 @@ function buildInstanceOptions(infuraProjectId) {
         connectivityController: {
             connectivityAdapter: new AlwaysOnlineAdapter(),
         },
+        gasFeeController: {
+            // Identifies the CLI to the gas estimation API via the `X-Client-Id`
+            // header.
+            clientId: 'cli',
+        },
         networkController: {
             infuraProjectId,
         },

package/dist/daemon/wallet-factory.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"wallet-factory.mjs","sourceRoot":"","sources":["../../src/daemon/wallet-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,eAAe,EAChB,iDAAiD;AAClD,OAAO,EAAE,sBAAsB,EAAE,kCAAkC;AAEnE,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,MAAM,EACP,yBAAyB;AAE1B,OAAO,EAAE,EAAE,EAAE,yBAAyB;AAEtC,OAAO,EAAE,aAAa,EAAE,yCAAwC;AAChE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,uCAAsC;AAI9E,MAAM,uBAAuB,GAAG,UAAU,CAAC;AAuB3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAS,oBAAoB,CAC3B,eAAuB;IAEvB,OAAO;QACL,kBAAkB,EAAE;YAClB,6DAA6D;YAC7D,mBAAmB,EAAE,GAAc,EAAE,CAAC,SAAS;SAChD;QACD,sBAAsB,EAAE;YACtB,mBAAmB,EAAE,IAAI,mBAAmB,EAAE;SAC/C;QACD,iBAAiB,EAAE;YACjB,eAAe;SAChB;QACD,2BAA2B,EAAE;YAC3B,sBAAsB,EAAE,IAAI,sBAAsB,CAAC;gBACjD,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,MAAM,EAAE;oBACN,qEAAqE;oBACrE,iEAAiE;oBACjE,MAAM,EAAE,UAAU,CAAC,SAAS;oBAC5B,YAAY,EAAE,gBAAgB,CAAC,IAAI;oBACnC,WAAW,EAAE,eAAe,CAAC,UAAU;iBACxC;aACF,CAAC;YACF,gBAAgB,EAAE,GAAW,EAAE,CAAC,KAAK;YACrC,aAAa,EAAE,OAAO;SACvB;QACD,cAAc,EAAE;YACd,OAAO,EAAE,IAAI,sBAAsB,EAAE;SACtC;QACD,qBAAqB,EAAE;YACrB,+DAA+D;YAC/D,mEAAmE;YACnE,8CAA8C;YAC9C,YAAY,EAAE,IAAI;YAClB,uEAAuE;YACvE,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,4BAA4B;YAC5B,KAAK,EAAE,EAAE;SACV;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,YAAY,EACZ,QAAQ,EACR,GAAG,EACH,eAAe,EACf,GAAG,GACgB;IACnB,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,CAAC,OAAe,EAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,MAA0B,CAAC;IAC/B,IAAI,WAAqC,CAAC;IAC1C,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;QACtE,WAAW,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAE1C,sEAAsE;QACtE,mEAAmE;QACnE,kCAAkC;QAClC,IAAI,WAAW,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,4EAA4E;gBAC1E,mEAAmE,CACtE,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,IAAI,MAAM,CAAC;YAClB,KAAK;YACL,eAAe,EAAE,oBAAoB,CAAC,eAAe,CAAC;SACvD,CAAC,CAAC;QACH,WAAW,GAAG,kBAAkB,CAC9B,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,kBAAkB,EACzB,KAAK,EACL,KAAK,CACN,CAAC;QAEF,wEAAwE;QACxE,2EAA2E;QAC3E,yEAAyE;QACzE,uEAAuE;QACvE,2EAA2E;QAC3E,kCAAkC;QAClC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CACrC,CAAC,MAAM,EAAmC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAC1E,CAAC;QACF,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,KAAK,CAAC,4BAA4B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,iCAAiC,YAAY,CAAC,MAAM,+EAA+E,WAAW,EAAE,CACjJ,CAAC;QACJ,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,wEAAwE;YACxE,uEAAuE;YACvE,8DAA8D;YAC9D,6CAA6C;YAC7C,MAAM,0BAA0B,CAC9B,MAAM,EACL,QAAqB,CAAC,MAAM,EAAE,EAC/B,GAAG,CAAC,MAAM,EAAE,CACb,CAAC;QACJ,CAAC;aAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CACzB,kCAAkC,EAClC,QAAQ,CAAC,MAAM,EAAE,CAClB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,CAAC,KAAK,CAAC,EAAE,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,cAAyC,CAAC;QAC9C,OAAO;YACL,MAAM;YACN,OAAO,EAAE,KAAK,IAAI,EAAE,CAClB,CAAC,cAAc,KAAd,cAAc,GAAK,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,EAAC;SACnE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAElD,IAAI,WAAW,IAAI,YAAY,KAAK,uBAAuB,EAAE,CAAC;YAC5D,wEAAwE;YACxE,0EAA0E;YAC1E,sEAAsE;YACtE,4DAA4D;YAC5D,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,YAAY,EAAE,GAAG,YAAY,MAAM,EAAE,GAAG,YAAY,MAAM,CAAC,CAAC,GAAG,CAC9D,CAAC,IAAI,EAAE,EAAE,CACP,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAgB,EAAE,EAAE;gBACnD,KAAK,CACH,oBAAoB,IAAI,8BAA8B,MAAM,CAAC,OAAO,CAAC,EAAE,CACxE,CAAC;YACJ,CAAC,CAAC,CACL,CACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,kBAAkB,CAC/B,KAAoB,EACpB,eAAuB,EACvB,KAAa;IAEb,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC;QACvB,eAAe,EAAE,oBAAoB,CAAC,eAAe,CAAC;KACvD,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACpD,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC7C,KAAK,CAAC,kCAAkC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,QAAQ,CACrB,WAAqC,EACrC,MAA0B,EAC1B,KAAoB,EACpB,KAAa;IAEb,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,WAAW,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,mDAAmD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,4CAA4C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,yCAAyC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC1B,KAA8C;IAE9C,OAAO,OAAO,KAAK,CAAC,iBAAiB,EAAE,KAAK,KAAK,QAAQ,CAAC;AAC5D,CAAC","sourcesContent":["import {\n  ClientConfigApiService,\n  ClientType,\n  DistributionType,\n  EnvironmentType,\n} from '@metamask/remote-feature-flag-controller';\nimport { InMemoryStorageAdapter } from '@metamask/storage-service';\nimport type { Json } from '@metamask/utils';\nimport {\n  AlwaysOnlineAdapter,\n  importSecretRecoveryPhrase,\n  Wallet,\n} from '@metamask/wallet';\nimport type { WalletOptions } from '@metamask/wallet';\nimport { rm } from 'node:fs/promises';\n\nimport { KeyValueStore } from '../persistence/KeyValueStore.js';\nimport { loadState, subscribeToChanges } from '../persistence/persistence.js';\nimport type { Password, Srp } from './secrets.js';\nimport type { Logger } from './types.js';\n\nconst IN_MEMORY_DATABASE_PATH = ':memory:';\n\nexport type CreateWalletConfig = {\n  databasePath: string;\n  password?: Password;\n  srp: Srp;\n  infuraProjectId: string;\n  log?: Logger;\n};\n\nexport type CreateWalletResult = {\n  wallet: Wallet;\n  /**\n   * Tear down everything `createWallet` set up, in the order that keeps\n   * in-flight persistence writes valid: stop the state-change subscription,\n   * destroy the wallet, then close the store (closing first would cause a\n   * teardown-time persistence write to fail). Resilient — a failure in any\n   * step is logged and the remaining steps still run — and idempotent (repeat\n   * calls coalesce onto the same teardown).\n   */\n  dispose: () => Promise<void>;\n};\n\n/**\n * Build the per-instance options the daemon's `Wallet` is constructed with.\n *\n * Returns a fresh set on every call so the metadata probe and the real wallet\n * never share adapter/service instances (the probe is destroyed, which may\n * tear those instances down).\n *\n * Only the slots wired on `@metamask/wallet` today are populated:\n * - `storageService` — backed by an in-memory adapter. This is the wallet's\n *   large-blob store (snap source, caches), distinct from the SQLite\n *   `KeyValueStore` that persists controller state; no wired controller\n *   offloads durable data to it yet, so in-memory suffices.\n * - `connectivityController` — the `AlwaysOnlineAdapter` exported for\n *   node-like hosts that have no platform connectivity signal.\n * - `networkController` — the Infura project ID used to reach Infura RPC\n *   endpoints.\n * - `remoteFeatureFlagController` — a `ClientConfigApiService` fetching real\n *   flags over the network.\n * - `approvalController` — a no-op `showApprovalRequest` (the daemon is\n *   headless).\n * - `transactionController` — swaps processing disabled and no client hooks;\n *   see the slot's inline comment for why the daemon relies on the\n *   controller's defaults for everything else.\n *\n * The optional `keyringController` slot is intentionally omitted so the\n * controller's built-in defaults (e.g. the PBKDF2 encryptor) apply.\n *\n * @param infuraProjectId - The Infura project ID for the `NetworkController`.\n * @returns The `instanceOptions` for the `Wallet` constructor.\n */\nfunction buildInstanceOptions(\n  infuraProjectId: string,\n): WalletOptions['instanceOptions'] {\n  return {\n    approvalController: {\n      // TODO: surface approval requests over the daemon transport.\n      showApprovalRequest: (): undefined => undefined,\n    },\n    connectivityController: {\n      connectivityAdapter: new AlwaysOnlineAdapter(),\n    },\n    networkController: {\n      infuraProjectId,\n    },\n    remoteFeatureFlagController: {\n      clientConfigApiService: new ClientConfigApiService({\n        fetch: globalThis.fetch,\n        config: {\n          // TODO: switch to a CLI-specific `ClientType` once one exists; until\n          // then `Extension` buckets feature flags as an extension client.\n          client: ClientType.Extension,\n          distribution: DistributionType.Main,\n          environment: EnvironmentType.Production,\n        },\n      }),\n      getMetaMetricsId: (): string => 'cli',\n      clientVersion: '0.0.0',\n    },\n    storageService: {\n      storage: new InMemoryStorageAdapter(),\n    },\n    transactionController: {\n      // The CLI exposes no swaps surface, so skip the swaps-specific\n      // post-processing a full wallet client runs (mobile makes the same\n      // choice; the extension keeps swaps enabled).\n      disableSwaps: true,\n      // No CLI-specific transaction hooks: the controller's built-in publish\n      // path broadcasts through the wired `NetworkController` provider, and the\n      // remaining hooks (metrics, notifications, gas-fee tokens) are client-UI\n      // concerns the headless daemon has no equivalent for. Every other option\n      // (`getPermittedAccounts`, `isSimulationEnabled`, `trace`, …) is left at\n      // the controller's default.\n      hooks: {},\n    },\n  };\n}\n\n/**\n * Create a configured `Wallet` for daemon use, backed by a SQLite key-value\n * store for controller-state persistence.\n *\n * Loads any previously-persisted controller state from the store, seeds the\n * wallet with it, then subscribes the store to subsequent state changes so all\n * persist-flagged properties are written through.\n *\n * If the store does not yet contain a keyring vault (first run), the supplied\n * secret recovery phrase is imported using the supplied password. On\n * subsequent runs, the persisted vault is reused: when a password is\n * supplied, the wallet is unlocked via `KeyringController:submitPassword` so\n * keyring-bound messenger actions work immediately; when no password is\n * supplied, the wallet starts locked and the caller is expected to invoke\n * `mm wallet unlock` before any keyring-bound operation. First-run startup\n * without a password is rejected (the SRP cannot be imported without one).\n * On a subsequent run, a wrong password rejects startup with a `Failed to\n * unlock the persisted vault` error that wraps the `submitPassword` rejection.\n *\n * On any failure after the store is opened, the store is closed (and the wallet\n * destroyed, if constructed). On a first-run failure, the on-disk database is\n * also removed so a retry does not latch onto an orphaned partial vault — this\n * covers in-process failures only; a hard crash (SIGKILL/power loss) mid-import\n * can still leave a vault on disk.\n *\n * @param config - Wallet configuration.\n * @param config.databasePath - Path to the SQLite database file (or\n * `':memory:'` for ephemeral use).\n * @param config.password - The wallet password. Optional on subsequent runs;\n * when omitted, the daemon starts with a locked keyring. Required on first\n * run (to import the SRP).\n * @param config.srp - The secret recovery phrase (BIP-39 mnemonic). Used\n * only on first run.\n * @param config.infuraProjectId - The Infura project ID for the\n * `NetworkController`.\n * @param config.log - Optional logger for persistence-write and teardown\n * failures. Without it, failures fall back to `console.error` (which a detached\n * daemon's `stdio: 'ignore'` discards).\n * @returns The `Wallet` and a `dispose` handle that tears it down.\n */\nexport async function createWallet({\n  databasePath,\n  password,\n  srp,\n  infuraProjectId,\n  log,\n}: CreateWalletConfig): Promise<CreateWalletResult> {\n  const logFn = log ?? ((message: string): void => console.error(message));\n  const store = new KeyValueStore(databasePath);\n  let wallet: Wallet | undefined;\n  let unsubscribe: (() => void) | undefined;\n  let wasFirstRun = false;\n\n  try {\n    const state = await loadPersistedState(store, infuraProjectId, logFn);\n    wasFirstRun = !hasPersistedKeyring(state);\n\n    // Validate the first-run precondition BEFORE constructing the wallet,\n    // so a doomed startup doesn't build a Wallet (and wire persistence\n    // handlers) just to tear it down.\n    if (wasFirstRun && password === undefined) {\n      throw new Error(\n        'A password is required on first run to import the secret recovery phrase. ' +\n          'Pass `--password` (or `MM_WALLET_PASSWORD`) on `mm daemon start`.',\n      );\n    }\n\n    wallet = new Wallet({\n      state,\n      instanceOptions: buildInstanceOptions(infuraProjectId),\n    });\n    unsubscribe = subscribeToChanges(\n      wallet.messenger,\n      wallet.controllerMetadata,\n      store,\n      logFn,\n    );\n\n    // Complete post-construction controller setup before serving requests —\n    // e.g. `NetworkController.init` applies the selected network so a provider\n    // is available. `init` settles every step independently; a rejected step\n    // leaves the wallet only partially usable, so abort startup (the catch\n    // below tears down and, on first run, removes the partial database) rather\n    // than serving a degraded daemon.\n    const initResults = await wallet.init();\n    const initFailures = initResults.filter(\n      (result): result is PromiseRejectedResult => result.status === 'rejected',\n    );\n    for (const failure of initFailures) {\n      logFn(`Wallet init step failed: ${String(failure.reason)}`);\n    }\n    if (initFailures.length > 0) {\n      const firstReason = String(initFailures[0].reason);\n      throw new Error(\n        `Wallet initialization failed (${initFailures.length} step(s)); refusing to serve a partially initialized wallet. First failure: ${firstReason}`,\n      );\n    }\n\n    if (wasFirstRun) {\n      // The precondition check above throws when `wasFirstRun && password ===\n      // undefined`, so `password` is defined here. TS does not correlate the\n      // two separate variables, so it cannot narrow `password` from\n      // `wasFirstRun` alone — hence the assertion.\n      await importSecretRecoveryPhrase(\n        wallet,\n        (password as Password).unwrap(),\n        srp.unwrap(),\n      );\n    } else if (password !== undefined) {\n      try {\n        await wallet.messenger.call(\n          'KeyringController:submitPassword',\n          password.unwrap(),\n        );\n      } catch (error) {\n        throw new Error(\n          `Failed to unlock the persisted vault: ${String(error)}`,\n        );\n      }\n    }\n\n    let disposePromise: Promise<void> | undefined;\n    return {\n      wallet,\n      dispose: async () =>\n        (disposePromise ??= teardown(unsubscribe, wallet, store, logFn)),\n    };\n  } catch (error) {\n    await teardown(unsubscribe, wallet, store, logFn);\n\n    if (wasFirstRun && databasePath !== IN_MEMORY_DATABASE_PATH) {\n      // Best-effort cleanup of the on-disk SQLite files (main, WAL, SHM) so a\n      // partially-persisted KeyringController vault cannot mislead the next run\n      // into skipping SRP import. Covers in-process failures only — a crash\n      // (SIGKILL/power loss) mid-import leaves the vault on disk.\n      await Promise.all(\n        [databasePath, `${databasePath}-wal`, `${databasePath}-shm`].map(\n          (path) =>\n            rm(path, { force: true }).catch((rmError: unknown) => {\n              logFn(\n                `Failed to remove ${path} during first-run cleanup: ${String(rmError)}`,\n              );\n            }),\n        ),\n      );\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Load persisted controller state, filtered to currently persist-flagged\n * properties.\n *\n * `loadState` filters against the live controller metadata, but that metadata\n * is only knowable from a constructed `Wallet` — and its output is what seeds\n * the real wallet. So this constructs a short-lived probe purely to read the\n * metadata, then tears it down.\n *\n * TODO: drop the probe once `@metamask/wallet` exposes controller metadata\n * without constructing a `Wallet`.\n *\n * @param store - The key-value store to read from.\n * @param infuraProjectId - The Infura project ID for the probe's\n * `NetworkController`.\n * @param logFn - Logger for a probe-teardown failure.\n * @returns The filtered persisted state, suitable for the `Wallet` `state`\n * option.\n */\nasync function loadPersistedState(\n  store: KeyValueStore,\n  infuraProjectId: string,\n  logFn: Logger,\n): Promise<Record<string, Record<string, Json>>> {\n  const probe = new Wallet({\n    instanceOptions: buildInstanceOptions(infuraProjectId),\n  });\n  try {\n    return loadState(store, probe.controllerMetadata);\n  } finally {\n    await probe.destroy().catch((error: unknown) => {\n      logFn(`Metadata probe destroy failed: ${String(error)}`);\n    });\n  }\n}\n\n/**\n * Persistence-safe teardown of a wallet and its store; see {@link\n * CreateWalletResult.dispose} for the ordering rationale. Each step is\n * best-effort, so a failure is logged and the remaining steps still run.\n *\n * @param unsubscribe - The persistence-subscription unsubscribe function, if\n * one was registered.\n * @param wallet - The wallet to destroy, if one was constructed.\n * @param store - The store to close.\n * @param logFn - Logger for step failures.\n */\nasync function teardown(\n  unsubscribe: (() => void) | undefined,\n  wallet: Wallet | undefined,\n  store: KeyValueStore,\n  logFn: Logger,\n): Promise<void> {\n  if (unsubscribe) {\n    try {\n      unsubscribe();\n    } catch (error) {\n      logFn(`Persistence unsubscribe failed during teardown: ${String(error)}`);\n    }\n  }\n  if (wallet) {\n    try {\n      await wallet.destroy();\n    } catch (error) {\n      logFn(`wallet.destroy() failed during teardown: ${String(error)}`);\n    }\n  }\n  try {\n    store.close();\n  } catch (error) {\n    logFn(`store.close() failed during teardown: ${String(error)}`);\n  }\n}\n\n/**\n * Determine whether the loaded state already contains a keyring vault.\n *\n * The KeyringController persists its `vault` once an SRP has been imported, so\n * its presence indicates that first-run setup completed before.\n *\n * @param state - The state loaded from the key-value store.\n * @returns True if a KeyringController vault string is present.\n */\nfunction hasPersistedKeyring(\n  state: Record<string, Record<string, unknown>>,\n): boolean {\n  return typeof state.KeyringController?.vault === 'string';\n}\n"]}
+{"version":3,"file":"wallet-factory.mjs","sourceRoot":"","sources":["../../src/daemon/wallet-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,eAAe,EAChB,iDAAiD;AAClD,OAAO,EAAE,sBAAsB,EAAE,kCAAkC;AAEnE,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,MAAM,EACP,yBAAyB;AAE1B,OAAO,EAAE,EAAE,EAAE,yBAAyB;AAEtC,OAAO,EAAE,aAAa,EAAE,yCAAwC;AAChE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,uCAAsC;AAI9E,MAAM,uBAAuB,GAAG,UAAU,CAAC;AAuB3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAS,oBAAoB,CAC3B,eAAuB;IAEvB,OAAO;QACL,kBAAkB,EAAE;YAClB,6DAA6D;YAC7D,mBAAmB,EAAE,GAAc,EAAE,CAAC,SAAS;SAChD;QACD,sBAAsB,EAAE;YACtB,mBAAmB,EAAE,IAAI,mBAAmB,EAAE;SAC/C;QACD,gBAAgB,EAAE;YAChB,qEAAqE;YACrE,UAAU;YACV,QAAQ,EAAE,KAAK;SAChB;QACD,iBAAiB,EAAE;YACjB,eAAe;SAChB;QACD,2BAA2B,EAAE;YAC3B,sBAAsB,EAAE,IAAI,sBAAsB,CAAC;gBACjD,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,MAAM,EAAE;oBACN,qEAAqE;oBACrE,iEAAiE;oBACjE,MAAM,EAAE,UAAU,CAAC,SAAS;oBAC5B,YAAY,EAAE,gBAAgB,CAAC,IAAI;oBACnC,WAAW,EAAE,eAAe,CAAC,UAAU;iBACxC;aACF,CAAC;YACF,gBAAgB,EAAE,GAAW,EAAE,CAAC,KAAK;YACrC,aAAa,EAAE,OAAO;SACvB;QACD,cAAc,EAAE;YACd,OAAO,EAAE,IAAI,sBAAsB,EAAE;SACtC;QACD,qBAAqB,EAAE;YACrB,+DAA+D;YAC/D,mEAAmE;YACnE,8CAA8C;YAC9C,YAAY,EAAE,IAAI;YAClB,uEAAuE;YACvE,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,4BAA4B;YAC5B,KAAK,EAAE,EAAE;SACV;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,YAAY,EACZ,QAAQ,EACR,GAAG,EACH,eAAe,EACf,GAAG,GACgB;IACnB,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,CAAC,OAAe,EAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,YAAY,CAAC,CAAC;IAC9C,IAAI,MAA0B,CAAC;IAC/B,IAAI,WAAqC,CAAC;IAC1C,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;QACtE,WAAW,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAE1C,sEAAsE;QACtE,mEAAmE;QACnE,kCAAkC;QAClC,IAAI,WAAW,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,4EAA4E;gBAC1E,mEAAmE,CACtE,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,IAAI,MAAM,CAAC;YAClB,KAAK;YACL,eAAe,EAAE,oBAAoB,CAAC,eAAe,CAAC;SACvD,CAAC,CAAC;QACH,WAAW,GAAG,kBAAkB,CAC9B,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,kBAAkB,EACzB,KAAK,EACL,KAAK,CACN,CAAC;QAEF,wEAAwE;QACxE,2EAA2E;QAC3E,yEAAyE;QACzE,uEAAuE;QACvE,2EAA2E;QAC3E,kCAAkC;QAClC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CACrC,CAAC,MAAM,EAAmC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAC1E,CAAC;QACF,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,KAAK,CAAC,4BAA4B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,iCAAiC,YAAY,CAAC,MAAM,+EAA+E,WAAW,EAAE,CACjJ,CAAC;QACJ,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,wEAAwE;YACxE,uEAAuE;YACvE,8DAA8D;YAC9D,6CAA6C;YAC7C,MAAM,0BAA0B,CAC9B,MAAM,EACL,QAAqB,CAAC,MAAM,EAAE,EAC/B,GAAG,CAAC,MAAM,EAAE,CACb,CAAC;QACJ,CAAC;aAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CACzB,kCAAkC,EAClC,QAAQ,CAAC,MAAM,EAAE,CAClB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,CAAC,KAAK,CAAC,EAAE,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,cAAyC,CAAC;QAC9C,OAAO;YACL,MAAM;YACN,OAAO,EAAE,KAAK,IAAI,EAAE,CAClB,CAAC,cAAc,KAAd,cAAc,GAAK,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,EAAC;SACnE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAElD,IAAI,WAAW,IAAI,YAAY,KAAK,uBAAuB,EAAE,CAAC;YAC5D,wEAAwE;YACxE,0EAA0E;YAC1E,sEAAsE;YACtE,4DAA4D;YAC5D,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,YAAY,EAAE,GAAG,YAAY,MAAM,EAAE,GAAG,YAAY,MAAM,CAAC,CAAC,GAAG,CAC9D,CAAC,IAAI,EAAE,EAAE,CACP,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAgB,EAAE,EAAE;gBACnD,KAAK,CACH,oBAAoB,IAAI,8BAA8B,MAAM,CAAC,OAAO,CAAC,EAAE,CACxE,CAAC;YACJ,CAAC,CAAC,CACL,CACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,kBAAkB,CAC/B,KAAoB,EACpB,eAAuB,EACvB,KAAa;IAEb,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC;QACvB,eAAe,EAAE,oBAAoB,CAAC,eAAe,CAAC;KACvD,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACpD,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC7C,KAAK,CAAC,kCAAkC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,QAAQ,CACrB,WAAqC,EACrC,MAA0B,EAC1B,KAAoB,EACpB,KAAa;IAEb,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,WAAW,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,mDAAmD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,4CAA4C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,yCAAyC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC1B,KAA8C;IAE9C,OAAO,OAAO,KAAK,CAAC,iBAAiB,EAAE,KAAK,KAAK,QAAQ,CAAC;AAC5D,CAAC","sourcesContent":["import {\n  ClientConfigApiService,\n  ClientType,\n  DistributionType,\n  EnvironmentType,\n} from '@metamask/remote-feature-flag-controller';\nimport { InMemoryStorageAdapter } from '@metamask/storage-service';\nimport type { Json } from '@metamask/utils';\nimport {\n  AlwaysOnlineAdapter,\n  importSecretRecoveryPhrase,\n  Wallet,\n} from '@metamask/wallet';\nimport type { WalletOptions } from '@metamask/wallet';\nimport { rm } from 'node:fs/promises';\n\nimport { KeyValueStore } from '../persistence/KeyValueStore.js';\nimport { loadState, subscribeToChanges } from '../persistence/persistence.js';\nimport type { Password, Srp } from './secrets.js';\nimport type { Logger } from './types.js';\n\nconst IN_MEMORY_DATABASE_PATH = ':memory:';\n\nexport type CreateWalletConfig = {\n  databasePath: string;\n  password?: Password;\n  srp: Srp;\n  infuraProjectId: string;\n  log?: Logger;\n};\n\nexport type CreateWalletResult = {\n  wallet: Wallet;\n  /**\n   * Tear down everything `createWallet` set up, in the order that keeps\n   * in-flight persistence writes valid: stop the state-change subscription,\n   * destroy the wallet, then close the store (closing first would cause a\n   * teardown-time persistence write to fail). Resilient — a failure in any\n   * step is logged and the remaining steps still run — and idempotent (repeat\n   * calls coalesce onto the same teardown).\n   */\n  dispose: () => Promise<void>;\n};\n\n/**\n * Build the per-instance options the daemon's `Wallet` is constructed with.\n *\n * Returns a fresh set on every call so the metadata probe and the real wallet\n * never share adapter/service instances (the probe is destroyed, which may\n * tear those instances down).\n *\n * Only the slots wired on `@metamask/wallet` today are populated:\n * - `storageService` — backed by an in-memory adapter. This is the wallet's\n *   large-blob store (snap source, caches), distinct from the SQLite\n *   `KeyValueStore` that persists controller state; no wired controller\n *   offloads durable data to it yet, so in-memory suffices.\n * - `connectivityController` — the `AlwaysOnlineAdapter` exported for\n *   node-like hosts that have no platform connectivity signal.\n * - `networkController` — the Infura project ID used to reach Infura RPC\n *   endpoints.\n * - `remoteFeatureFlagController` — a `ClientConfigApiService` fetching real\n *   flags over the network.\n * - `approvalController` — a no-op `showApprovalRequest` (the daemon is\n *   headless).\n * - `transactionController` — swaps processing disabled and no client hooks;\n *   see the slot's inline comment for why the daemon relies on the\n *   controller's defaults for everything else.\n *\n * The optional `keyringController` slot is intentionally omitted so the\n * controller's built-in defaults (e.g. the PBKDF2 encryptor) apply.\n *\n * @param infuraProjectId - The Infura project ID for the `NetworkController`.\n * @returns The `instanceOptions` for the `Wallet` constructor.\n */\nfunction buildInstanceOptions(\n  infuraProjectId: string,\n): WalletOptions['instanceOptions'] {\n  return {\n    approvalController: {\n      // TODO: surface approval requests over the daemon transport.\n      showApprovalRequest: (): undefined => undefined,\n    },\n    connectivityController: {\n      connectivityAdapter: new AlwaysOnlineAdapter(),\n    },\n    gasFeeController: {\n      // Identifies the CLI to the gas estimation API via the `X-Client-Id`\n      // header.\n      clientId: 'cli',\n    },\n    networkController: {\n      infuraProjectId,\n    },\n    remoteFeatureFlagController: {\n      clientConfigApiService: new ClientConfigApiService({\n        fetch: globalThis.fetch,\n        config: {\n          // TODO: switch to a CLI-specific `ClientType` once one exists; until\n          // then `Extension` buckets feature flags as an extension client.\n          client: ClientType.Extension,\n          distribution: DistributionType.Main,\n          environment: EnvironmentType.Production,\n        },\n      }),\n      getMetaMetricsId: (): string => 'cli',\n      clientVersion: '0.0.0',\n    },\n    storageService: {\n      storage: new InMemoryStorageAdapter(),\n    },\n    transactionController: {\n      // The CLI exposes no swaps surface, so skip the swaps-specific\n      // post-processing a full wallet client runs (mobile makes the same\n      // choice; the extension keeps swaps enabled).\n      disableSwaps: true,\n      // No CLI-specific transaction hooks: the controller's built-in publish\n      // path broadcasts through the wired `NetworkController` provider, and the\n      // remaining hooks (metrics, notifications, gas-fee tokens) are client-UI\n      // concerns the headless daemon has no equivalent for. Every other option\n      // (`getPermittedAccounts`, `isSimulationEnabled`, `trace`, …) is left at\n      // the controller's default.\n      hooks: {},\n    },\n  };\n}\n\n/**\n * Create a configured `Wallet` for daemon use, backed by a SQLite key-value\n * store for controller-state persistence.\n *\n * Loads any previously-persisted controller state from the store, seeds the\n * wallet with it, then subscribes the store to subsequent state changes so all\n * persist-flagged properties are written through.\n *\n * If the store does not yet contain a keyring vault (first run), the supplied\n * secret recovery phrase is imported using the supplied password. On\n * subsequent runs, the persisted vault is reused: when a password is\n * supplied, the wallet is unlocked via `KeyringController:submitPassword` so\n * keyring-bound messenger actions work immediately; when no password is\n * supplied, the wallet starts locked and the caller is expected to invoke\n * `mm wallet unlock` before any keyring-bound operation. First-run startup\n * without a password is rejected (the SRP cannot be imported without one).\n * On a subsequent run, a wrong password rejects startup with a `Failed to\n * unlock the persisted vault` error that wraps the `submitPassword` rejection.\n *\n * On any failure after the store is opened, the store is closed (and the wallet\n * destroyed, if constructed). On a first-run failure, the on-disk database is\n * also removed so a retry does not latch onto an orphaned partial vault — this\n * covers in-process failures only; a hard crash (SIGKILL/power loss) mid-import\n * can still leave a vault on disk.\n *\n * @param config - Wallet configuration.\n * @param config.databasePath - Path to the SQLite database file (or\n * `':memory:'` for ephemeral use).\n * @param config.password - The wallet password. Optional on subsequent runs;\n * when omitted, the daemon starts with a locked keyring. Required on first\n * run (to import the SRP).\n * @param config.srp - The secret recovery phrase (BIP-39 mnemonic). Used\n * only on first run.\n * @param config.infuraProjectId - The Infura project ID for the\n * `NetworkController`.\n * @param config.log - Optional logger for persistence-write and teardown\n * failures. Without it, failures fall back to `console.error` (which a detached\n * daemon's `stdio: 'ignore'` discards).\n * @returns The `Wallet` and a `dispose` handle that tears it down.\n */\nexport async function createWallet({\n  databasePath,\n  password,\n  srp,\n  infuraProjectId,\n  log,\n}: CreateWalletConfig): Promise<CreateWalletResult> {\n  const logFn = log ?? ((message: string): void => console.error(message));\n  const store = new KeyValueStore(databasePath);\n  let wallet: Wallet | undefined;\n  let unsubscribe: (() => void) | undefined;\n  let wasFirstRun = false;\n\n  try {\n    const state = await loadPersistedState(store, infuraProjectId, logFn);\n    wasFirstRun = !hasPersistedKeyring(state);\n\n    // Validate the first-run precondition BEFORE constructing the wallet,\n    // so a doomed startup doesn't build a Wallet (and wire persistence\n    // handlers) just to tear it down.\n    if (wasFirstRun && password === undefined) {\n      throw new Error(\n        'A password is required on first run to import the secret recovery phrase. ' +\n          'Pass `--password` (or `MM_WALLET_PASSWORD`) on `mm daemon start`.',\n      );\n    }\n\n    wallet = new Wallet({\n      state,\n      instanceOptions: buildInstanceOptions(infuraProjectId),\n    });\n    unsubscribe = subscribeToChanges(\n      wallet.messenger,\n      wallet.controllerMetadata,\n      store,\n      logFn,\n    );\n\n    // Complete post-construction controller setup before serving requests —\n    // e.g. `NetworkController.init` applies the selected network so a provider\n    // is available. `init` settles every step independently; a rejected step\n    // leaves the wallet only partially usable, so abort startup (the catch\n    // below tears down and, on first run, removes the partial database) rather\n    // than serving a degraded daemon.\n    const initResults = await wallet.init();\n    const initFailures = initResults.filter(\n      (result): result is PromiseRejectedResult => result.status === 'rejected',\n    );\n    for (const failure of initFailures) {\n      logFn(`Wallet init step failed: ${String(failure.reason)}`);\n    }\n    if (initFailures.length > 0) {\n      const firstReason = String(initFailures[0].reason);\n      throw new Error(\n        `Wallet initialization failed (${initFailures.length} step(s)); refusing to serve a partially initialized wallet. First failure: ${firstReason}`,\n      );\n    }\n\n    if (wasFirstRun) {\n      // The precondition check above throws when `wasFirstRun && password ===\n      // undefined`, so `password` is defined here. TS does not correlate the\n      // two separate variables, so it cannot narrow `password` from\n      // `wasFirstRun` alone — hence the assertion.\n      await importSecretRecoveryPhrase(\n        wallet,\n        (password as Password).unwrap(),\n        srp.unwrap(),\n      );\n    } else if (password !== undefined) {\n      try {\n        await wallet.messenger.call(\n          'KeyringController:submitPassword',\n          password.unwrap(),\n        );\n      } catch (error) {\n        throw new Error(\n          `Failed to unlock the persisted vault: ${String(error)}`,\n        );\n      }\n    }\n\n    let disposePromise: Promise<void> | undefined;\n    return {\n      wallet,\n      dispose: async () =>\n        (disposePromise ??= teardown(unsubscribe, wallet, store, logFn)),\n    };\n  } catch (error) {\n    await teardown(unsubscribe, wallet, store, logFn);\n\n    if (wasFirstRun && databasePath !== IN_MEMORY_DATABASE_PATH) {\n      // Best-effort cleanup of the on-disk SQLite files (main, WAL, SHM) so a\n      // partially-persisted KeyringController vault cannot mislead the next run\n      // into skipping SRP import. Covers in-process failures only — a crash\n      // (SIGKILL/power loss) mid-import leaves the vault on disk.\n      await Promise.all(\n        [databasePath, `${databasePath}-wal`, `${databasePath}-shm`].map(\n          (path) =>\n            rm(path, { force: true }).catch((rmError: unknown) => {\n              logFn(\n                `Failed to remove ${path} during first-run cleanup: ${String(rmError)}`,\n              );\n            }),\n        ),\n      );\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Load persisted controller state, filtered to currently persist-flagged\n * properties.\n *\n * `loadState` filters against the live controller metadata, but that metadata\n * is only knowable from a constructed `Wallet` — and its output is what seeds\n * the real wallet. So this constructs a short-lived probe purely to read the\n * metadata, then tears it down.\n *\n * TODO: drop the probe once `@metamask/wallet` exposes controller metadata\n * without constructing a `Wallet`.\n *\n * @param store - The key-value store to read from.\n * @param infuraProjectId - The Infura project ID for the probe's\n * `NetworkController`.\n * @param logFn - Logger for a probe-teardown failure.\n * @returns The filtered persisted state, suitable for the `Wallet` `state`\n * option.\n */\nasync function loadPersistedState(\n  store: KeyValueStore,\n  infuraProjectId: string,\n  logFn: Logger,\n): Promise<Record<string, Record<string, Json>>> {\n  const probe = new Wallet({\n    instanceOptions: buildInstanceOptions(infuraProjectId),\n  });\n  try {\n    return loadState(store, probe.controllerMetadata);\n  } finally {\n    await probe.destroy().catch((error: unknown) => {\n      logFn(`Metadata probe destroy failed: ${String(error)}`);\n    });\n  }\n}\n\n/**\n * Persistence-safe teardown of a wallet and its store; see {@link\n * CreateWalletResult.dispose} for the ordering rationale. Each step is\n * best-effort, so a failure is logged and the remaining steps still run.\n *\n * @param unsubscribe - The persistence-subscription unsubscribe function, if\n * one was registered.\n * @param wallet - The wallet to destroy, if one was constructed.\n * @param store - The store to close.\n * @param logFn - Logger for step failures.\n */\nasync function teardown(\n  unsubscribe: (() => void) | undefined,\n  wallet: Wallet | undefined,\n  store: KeyValueStore,\n  logFn: Logger,\n): Promise<void> {\n  if (unsubscribe) {\n    try {\n      unsubscribe();\n    } catch (error) {\n      logFn(`Persistence unsubscribe failed during teardown: ${String(error)}`);\n    }\n  }\n  if (wallet) {\n    try {\n      await wallet.destroy();\n    } catch (error) {\n      logFn(`wallet.destroy() failed during teardown: ${String(error)}`);\n    }\n  }\n  try {\n    store.close();\n  } catch (error) {\n    logFn(`store.close() failed during teardown: ${String(error)}`);\n  }\n}\n\n/**\n * Determine whether the loaded state already contains a keyring vault.\n *\n * The KeyringController persists its `vault` once an SRP has been imported, so\n * its presence indicates that first-run setup completed before.\n *\n * @param state - The state loaded from the key-value store.\n * @returns True if a KeyringController vault string is present.\n */\nfunction hasPersistedKeyring(\n  state: Record<string, Record<string, unknown>>,\n): boolean {\n  return typeof state.KeyringController?.vault === 'string';\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metamask-previews/wallet-cli",
-  "version": "0.0.0-preview-acc8294b8",
+  "version": "0.0.0-preview-5959fe813",
   "description": "The CLI of @metamask/wallet",
   "keywords": [
     "Ethereum",
@@ -55,7 +55,7 @@
     "@metamask/storage-service": "^1.0.2",
     "@metamask/superstruct": "^3.1.0",
     "@metamask/utils": "^11.11.0",
-    "@metamask/wallet": "^7.0.1",
+    "@metamask/wallet": "^8.0.0",
     "@oclif/core": "^4.10.5",
     "better-sqlite3": "^12.9.0",
     "immer": "^9.0.6"
@@ -64,11 +64,11 @@
     "@metamask/auto-changelog": "^6.1.0",
     "@ts-bridge/cli": "^0.6.4",
     "@types/better-sqlite3": "^7.6.13",
-    "@types/jest": "^29.5.14",
+    "@types/jest": "^30.0.0",
     "deepmerge": "^4.2.2",
-    "jest": "^29.7.0",
-    "jest-environment-node": "^29.7.0",
-    "ts-jest": "^29.2.5",
+    "jest": "^30.4.2",
+    "jest-environment-node": "^30.4.1",
+    "ts-jest": "^29.4.11",
     "tsx": "^4.20.5",
     "typescript": "~5.3.3"
   },