@metamask/ramps-controller 17.0.0 → 17.2.0

package/dist/RampsController.cjs

@@ -10,16 +10,16 @@ var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
     return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
 };
-var _RampsController_instances, _RampsController_requestCacheTTL, _RampsController_requestCacheMaxSize, _RampsController_getDefaultRedirectUrl, _RampsController_pendingRequests, _RampsController_pendingResourceCount, _RampsController_pendingResourceGeneration, _RampsController_orderPollingMeta, _RampsController_orderPollingTimer, _RampsController_isPolling, _RampsController_initPromise, _RampsController_clearPendingResourceCountForDependentResources, _RampsController_abortDependentRequests, _RampsController_isAllProvidersEnabled, _RampsController_mutateRequests, _RampsController_removeRequestState, _RampsController_cleanupState, _RampsController_requireRegion, _RampsController_isRegionCurrent, _RampsController_isTokenCurrent, _RampsController_isProviderCurrent, _RampsController_updateResourceField, _RampsController_setResourceLoading, _RampsController_setResourceError, _RampsController_updateRequestState, _RampsController_runInit, _RampsController_syncUserRegionFromCountriesCatalog, _RampsController_pickWidenedQuote, _RampsController_getSupportingProvidersForRegion, _RampsController_filterProviderIdsBySupport, _RampsController_resolveProviderIdsForQuote, _RampsController_getPreferredProviderIdsFromOrders, _RampsController_refreshOrder, _RampsController_pollPendingOrders, _RampsController_syncTransakAuthOnError, _RampsController_getNormalizedTransakError;
+var _RampsController_instances, _RampsController_requestCacheTTL, _RampsController_requestCacheMaxSize, _RampsController_getDefaultRedirectUrl, _RampsController_pendingRequests, _RampsController_pendingResourceCount, _RampsController_pendingResourceGeneration, _RampsController_orderPollingMeta, _RampsController_orderPollingTimer, _RampsController_isPolling, _RampsController_initPromise, _RampsController_clearPendingResourceCountForDependentResources, _RampsController_abortDependentRequests, _RampsController_resolveAllProvidersFlag, _RampsController_mutateRequests, _RampsController_removeRequestState, _RampsController_cleanupState, _RampsController_requireRegion, _RampsController_isRegionCurrent, _RampsController_isTokenCurrent, _RampsController_isProviderCurrent, _RampsController_updateResourceField, _RampsController_setResourceLoading, _RampsController_setResourceError, _RampsController_updateRequestState, _RampsController_runInit, _RampsController_syncUserRegionFromCountriesCatalog, _RampsController_pickWidenedQuote, _RampsController_getSupportingProvidersForRegion, _RampsController_filterProviderIdsBySupport, _RampsController_resolveProviderIdsForQuote, _RampsController_getPreferredProviderIdsFromOrders, _RampsController_refreshOrder, _RampsController_pollPendingOrders, _RampsController_syncTransakAuthOnError, _RampsController_getNormalizedTransakError;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RampsController = exports.getInternalOrderCode = exports.getDefaultRampsControllerState = exports.RAMPS_CONTROLLER_REQUIRED_SERVICE_ACTIONS = exports.controllerName = void 0;
 const base_controller_1 = require("@metamask/base-controller");
 const controller_utils_1 = require("@metamask/controller-utils");
-const featureFlags_1 = require("./featureFlags.cjs");
-const providerAvailability_1 = require("./providerAvailability.cjs");
-const rampsErrorCodes_1 = require("./rampsErrorCodes.cjs");
-const RampsService_1 = require("./RampsService.cjs");
-const RequestCache_1 = require("./RequestCache.cjs");
+const featureFlags_js_1 = require("./featureFlags.cjs");
+const providerAvailability_js_1 = require("./providerAvailability.cjs");
+const rampsErrorCodes_js_1 = require("./rampsErrorCodes.cjs");
+const RampsService_js_1 = require("./RampsService.cjs");
+const RequestCache_js_1 = require("./RequestCache.cjs");
 // === GENERAL ===
 /**
  * The name of the {@link RampsController}, used to namespace the
@@ -57,6 +57,7 @@ exports.RAMPS_CONTROLLER_REQUIRED_SERVICE_ACTIONS = [
     'TransakService:getUserLimits',
     'TransakService:requestOtt',
     'TransakService:generatePaymentWidgetUrl',
+    'TransakService:createWidgetUrl',
     'TransakService:submitPurposeOfUsageForm',
     'TransakService:patchUser',
     'TransakService:submitSsnDetails',
@@ -85,7 +86,7 @@ function hasHttpStatus(error) {
 function getRampsErrorInfo(error) {
     if (error instanceof controller_utils_1.BrokenCircuitError && hasStringMessage(error)) {
         return {
-            errorKey: rampsErrorCodes_1.RAMPS_ERROR_CODES.CIRCUIT_BREAKER_OPEN,
+            errorKey: rampsErrorCodes_js_1.RAMPS_ERROR_CODES.CIRCUIT_BREAKER_OPEN,
             message: error.message,
         };
     }
@@ -98,7 +99,7 @@ function getRampsErrorInfo(error) {
     }
     if (rawMessage?.includes(CIRCUIT_BREAKER_OPEN_ERROR)) {
         return {
-            errorKey: rampsErrorCodes_1.RAMPS_ERROR_CODES.CIRCUIT_BREAKER_OPEN,
+            errorKey: rampsErrorCodes_js_1.RAMPS_ERROR_CODES.CIRCUIT_BREAKER_OPEN,
             message: rawMessage,
         };
     }
@@ -354,16 +355,16 @@ function getInternalOrderCode(orderOrId) {
 exports.getInternalOrderCode = getInternalOrderCode;
 // === ORDER POLLING CONSTANTS ===
 const TERMINAL_ORDER_STATUSES = new Set([
-    RampsService_1.RampsOrderStatus.Completed,
-    RampsService_1.RampsOrderStatus.Failed,
-    RampsService_1.RampsOrderStatus.Cancelled,
-    RampsService_1.RampsOrderStatus.IdExpired,
+    RampsService_js_1.RampsOrderStatus.Completed,
+    RampsService_js_1.RampsOrderStatus.Failed,
+    RampsService_js_1.RampsOrderStatus.Cancelled,
+    RampsService_js_1.RampsOrderStatus.IdExpired,
 ]);
 const PENDING_ORDER_STATUSES = new Set([
-    RampsService_1.RampsOrderStatus.Pending,
-    RampsService_1.RampsOrderStatus.Created,
-    RampsService_1.RampsOrderStatus.Unknown,
-    RampsService_1.RampsOrderStatus.Precreated,
+    RampsService_js_1.RampsOrderStatus.Pending,
+    RampsService_js_1.RampsOrderStatus.Created,
+    RampsService_js_1.RampsOrderStatus.Unknown,
+    RampsService_js_1.RampsOrderStatus.Precreated,
 ]);
 const DEFAULT_POLLING_INTERVAL_MS = 30000;
 const MAX_ERROR_COUNT = 5;
@@ -407,6 +408,7 @@ const MESSENGER_EXPOSED_METHODS = [
     'transakGetUserLimits',
     'transakRequestOtt',
     'transakGeneratePaymentWidgetUrl',
+    'transakCreateWidgetUrl',
     'transakSubmitPurposeOfUsageForm',
     'transakPatchUser',
     'transakSubmitSsnDetails',
@@ -443,7 +445,7 @@ class RampsController extends base_controller_1.BaseController {
      * redirect URL used for the widened quote fetch when the caller omits
      * `redirectUrl`. Defaults to a callback returning `undefined`.
      */
-    constructor({ messenger, state = {}, requestCacheTTL = RequestCache_1.DEFAULT_REQUEST_CACHE_TTL, requestCacheMaxSize = RequestCache_1.DEFAULT_REQUEST_CACHE_MAX_SIZE, getDefaultRedirectUrl, }) {
+    constructor({ messenger, state = {}, requestCacheTTL = RequestCache_js_1.DEFAULT_REQUEST_CACHE_TTL, requestCacheMaxSize = RequestCache_js_1.DEFAULT_REQUEST_CACHE_MAX_SIZE, getDefaultRedirectUrl, }) {
         super({
             messenger,
             metadata: rampsControllerMetadata,
@@ -532,7 +534,7 @@ class RampsController extends base_controller_1.BaseController {
         // If cache is not expired, return the cached data
         if (!options?.forceRefresh) {
             const cached = this.state.requests[cacheKey];
-            if (cached && !(0, RequestCache_1.isCacheExpired)(cached, ttl)) {
+            if (cached && !(0, RequestCache_js_1.isCacheExpired)(cached, ttl)) {
                 return cached.data;
             }
         }
@@ -545,7 +547,7 @@ class RampsController extends base_controller_1.BaseController {
             ? (__classPrivateFieldGet(this, _RampsController_pendingResourceGeneration, "f").get(resourceType) ?? 0)
             : undefined;
         // Update state to loading
-        __classPrivateFieldGet(this, _RampsController_instances, "m", _RampsController_updateRequestState).call(this, cacheKey, (0, RequestCache_1.createLoadingState)());
+        __classPrivateFieldGet(this, _RampsController_instances, "m", _RampsController_updateRequestState).call(this, cacheKey, (0, RequestCache_js_1.createLoadingState)());
         // Set resource-level loading state (only on cache miss). Ref-count so concurrent
         // requests for the same resource type (different cache keys) keep isLoading true.
         if (resourceType) {
@@ -562,7 +564,7 @@ class RampsController extends base_controller_1.BaseController {
                 if (abortController.signal.aborted) {
                     throw new Error('Request was aborted');
                 }
-                __classPrivateFieldGet(this, _RampsController_instances, "m", _RampsController_updateRequestState).call(this, cacheKey, (0, RequestCache_1.createSuccessState)(data, lastFetchedAt));
+                __classPrivateFieldGet(this, _RampsController_instances, "m", _RampsController_updateRequestState).call(this, cacheKey, (0, RequestCache_js_1.createSuccessState)(data, lastFetchedAt));
                 if (resourceType) {
                     const isCurrent = !options?.isResultCurrent || options.isResultCurrent();
                     if (isCurrent) {
@@ -576,7 +578,7 @@ class RampsController extends base_controller_1.BaseController {
                     throw error;
                 }
                 const { errorInfo, normalizedError } = getNormalizedRampsError(error);
-                __classPrivateFieldGet(this, _RampsController_instances, "m", _RampsController_updateRequestState).call(this, cacheKey, (0, RequestCache_1.createErrorState)(errorInfo.message, lastFetchedAt, errorInfo.errorKey));
+                __classPrivateFieldGet(this, _RampsController_instances, "m", _RampsController_updateRequestState).call(this, cacheKey, (0, RequestCache_js_1.createErrorState)(errorInfo.message, lastFetchedAt, errorInfo.errorKey));
                 if (resourceType) {
                     const isCurrent = !options?.isResultCurrent || options.isResultCurrent();
                     if (isCurrent) {
@@ -762,7 +764,7 @@ class RampsController extends base_controller_1.BaseController {
      * @returns An array of countries.
      */
     async getCountries(options) {
-        const cacheKey = (0, RequestCache_1.createCacheKey)('getCountries', []);
+        const cacheKey = (0, RequestCache_js_1.createCacheKey)('getCountries', []);
         const countries = await this.executeRequest(cacheKey, async () => {
             return this.messenger.call('RampsService:getCountries');
         }, { ...options, resourceType: 'countries' });
@@ -785,7 +787,7 @@ class RampsController extends base_controller_1.BaseController {
     async getTokens(region, action = 'buy', options) {
         const regionToUse = region ?? __classPrivateFieldGet(this, _RampsController_instances, "m", _RampsController_requireRegion).call(this);
         const normalizedRegion = regionToUse.toLowerCase().trim();
-        const cacheKey = (0, RequestCache_1.createCacheKey)('getTokens', [
+        const cacheKey = (0, RequestCache_js_1.createCacheKey)('getTokens', [
             normalizedRegion,
             action,
             options?.provider,
@@ -850,7 +852,7 @@ class RampsController extends base_controller_1.BaseController {
     async getProviders(region, options) {
         const regionToUse = region ?? __classPrivateFieldGet(this, _RampsController_instances, "m", _RampsController_requireRegion).call(this);
         const normalizedRegion = regionToUse.toLowerCase().trim();
-        const cacheKey = (0, RequestCache_1.createCacheKey)('getProviders', [
+        const cacheKey = (0, RequestCache_js_1.createCacheKey)('getProviders', [
             normalizedRegion,
             options?.provider,
             options?.crypto,
@@ -890,7 +892,7 @@ class RampsController extends base_controller_1.BaseController {
         const assetIdToUse = options?.assetId ?? this.state.tokens.selected?.assetId ?? '';
         const providerToUse = options?.provider ?? this.state.providers.selected?.id ?? '';
         const normalizedRegion = regionCode.toLowerCase().trim();
-        const cacheKey = (0, RequestCache_1.createCacheKey)('getPaymentMethods', [
+        const cacheKey = (0, RequestCache_js_1.createCacheKey)('getPaymentMethods', [
             normalizedRegion,
             assetIdToUse,
             providerToUse,
@@ -1014,7 +1016,13 @@ class RampsController extends base_controller_1.BaseController {
         const wantsAutoSelection = !options.providers &&
             (options.autoSelectProvider === true ||
                 options.restrictToKnownOrNativeProviders === true);
-        const widenToAllProviders = wantsAutoSelection && __classPrivateFieldGet(this, _RampsController_instances, "m", _RampsController_isAllProvidersEnabled).call(this);
+        // Single flag read per call: the enabled bit and the allowlist come from
+        // the same `RemoteFeatureFlagController` state snapshot, so a flag edit
+        // during the awaited quote fetch cannot produce a mixed read.
+        const { enabled: allProvidersEnabled, allowlist: providerAllowlist } = wantsAutoSelection
+            ? __classPrivateFieldGet(this, _RampsController_instances, "m", _RampsController_resolveAllProvidersFlag).call(this)
+            : { enabled: false, allowlist: undefined };
+        const widenToAllProviders = wantsAutoSelection && allProvidersEnabled;
         let providersToUse;
         let widenedProviderCatalog = this.state.providers.data;
         if (options.providers) {
@@ -1086,7 +1094,7 @@ class RampsController extends base_controller_1.BaseController {
         // (flag off) never injects.
         const effectiveRedirectUrl = options.redirectUrl ??
             (widenToAllProviders ? __classPrivateFieldGet(this, _RampsController_getDefaultRedirectUrl, "f").call(this) : undefined);
-        const cacheKey = (0, RequestCache_1.createCacheKey)('getQuotes', [
+        const cacheKey = (0, RequestCache_js_1.createCacheKey)('getQuotes', [
             normalizedRegion,
             normalizedFiat,
             normalizedAssetId,
@@ -1125,6 +1133,7 @@ class RampsController extends base_controller_1.BaseController {
             amount: options.amount,
             fiat: normalizedFiat,
             providers: widenedProviderCatalog,
+            allowlist: providerAllowlist,
         });
         if (!selectedQuote) {
             // No quote fits the published provider limits: surface "no quote"
@@ -1263,7 +1272,7 @@ class RampsController extends base_controller_1.BaseController {
                 logos: { light: '', dark: '', height: 0, width: 0 },
             },
             walletAddress,
-            status: RampsService_1.RampsOrderStatus.Precreated,
+            status: RampsService_js_1.RampsOrderStatus.Precreated,
             orderType: 'buy',
             createdAt: Date.now(),
             isOnlyLink: false,
@@ -1621,6 +1630,25 @@ class RampsController extends base_controller_1.BaseController {
     transakGeneratePaymentWidgetUrl(ottToken, quote, walletAddress, extraParams) {
         return this.messenger.call('TransakService:generatePaymentWidgetUrl', ottToken, quote, walletAddress, extraParams);
     }
+    /**
+     * Creates a Transak payment widget URL via the ramps API proxy, which
+     * injects the partner API key server-side. Replaces the OTT flow
+     * ({@link transakRequestOtt} + {@link transakGeneratePaymentWidgetUrl}).
+     *
+     * @param quote - The buy quote to pre-fill in the widget.
+     * @param walletAddress - The destination wallet address.
+     * @param extraParams - Optional additional widget parameters (e.g. theming).
+     * @returns The single-use widget URL.
+     */
+    async transakCreateWidgetUrl(quote, walletAddress, extraParams) {
+        try {
+            return await this.messenger.call('TransakService:createWidgetUrl', quote, walletAddress, extraParams);
+        }
+        catch (error) {
+            throw __classPrivateFieldGet(this, _RampsController_instances, "m", _RampsController_getNormalizedTransakError).call(this, error, { syncAuth: true })
+                .normalizedError;
+        }
+    }
     /**
      * Submits the user's purpose of usage form for KYC compliance.
      *
@@ -1773,13 +1801,16 @@ _RampsController_requestCacheTTL = new WeakMap(), _RampsController_requestCacheM
             __classPrivateFieldGet(this, _RampsController_instances, "m", _RampsController_removeRequestState).call(this, cacheKey);
         }
     }
-}, _RampsController_isAllProvidersEnabled = function _RampsController_isAllProvidersEnabled() {
+}, _RampsController_resolveAllProvidersFlag = function _RampsController_resolveAllProvidersFlag() {
     try {
         const remoteFeatureFlagState = this.messenger.call('RemoteFeatureFlagController:getState');
-        return (0, featureFlags_1.isHeadlessAllProvidersEnabled)(remoteFeatureFlagState);
+        return {
+            enabled: (0, featureFlags_js_1.isHeadlessAllProvidersEnabled)(remoteFeatureFlagState),
+            allowlist: (0, featureFlags_js_1.getHeadlessProviderAllowlist)(remoteFeatureFlagState),
+        };
     }
     catch {
-        return false;
+        return { enabled: false };
     }
 }, _RampsController_mutateRequests = function _RampsController_mutateRequests(fn) {
     this.update((state) => {
@@ -1830,8 +1861,8 @@ _RampsController_requestCacheTTL = new WeakMap(), _RampsController_requestCacheM
         const keys = Object.keys(requests);
         for (const key of keys) {
             const entry = requests[key];
-            if (entry?.status === RequestCache_1.RequestStatus.SUCCESS &&
-                (0, RequestCache_1.isCacheExpired)(entry, ttl)) {
+            if (entry?.status === RequestCache_js_1.RequestStatus.SUCCESS &&
+                (0, RequestCache_js_1.isCacheExpired)(entry, ttl)) {
                 delete requests[key];
             }
         }
@@ -1892,8 +1923,13 @@ _RampsController_requestCacheTTL = new WeakMap(), _RampsController_requestCacheM
     this.update((state) => {
         state.userRegion = userRegion;
     });
-}, _RampsController_pickWidenedQuote = function _RampsController_pickWidenedQuote(response, { amount, fiat, providers, }) {
+}, _RampsController_pickWidenedQuote = function _RampsController_pickWidenedQuote(response, { amount, fiat, providers, allowlist, }) {
     const providerByCode = new Map(providers.map((provider) => [provider.id, provider]));
+    const allowedProviderIds = allowlist && allowlist.length > 0
+        ? new Set(allowlist.map(featureFlags_js_1.normalizeHeadlessProviderId))
+        : undefined;
+    const isAllowedProvider = (quote) => !allowedProviderIds ||
+        allowedProviderIds.has((0, featureFlags_js_1.normalizeHeadlessProviderId)(quote.provider));
     const fitsProviderLimits = (quote) => {
         const provider = providerByCode.get(quote.provider);
         const limit = provider?.limits?.fiat?.[fiat]?.[quote.quote.paymentMethod];
@@ -1904,7 +1940,7 @@ _RampsController_requestCacheTTL = new WeakMap(), _RampsController_requestCacheM
         }
         return amount >= limit.minAmount && amount <= limit.maxAmount;
     };
-    const candidates = response.success.filter(fitsProviderLimits);
+    const candidates = response.success.filter((quote) => isAllowedProvider(quote) && fitsProviderLimits(quote));
     if (candidates.length === 0) {
         return undefined;
     }
@@ -1952,7 +1988,7 @@ async function _RampsController_getSupportingProvidersForRegion({ assetId, regio
     // Case-insensitive CAIP-19 matching is shared with headless-buy consumers
     // via `getProvidersServingAsset`, so the controller and the UI region gate
     // cannot disagree about which providers serve the asset.
-    const supporting = (0, providerAvailability_1.getProvidersServingAsset)(providers, assetId);
+    const supporting = (0, providerAvailability_js_1.getProvidersServingAsset)(providers, assetId);
     return { supporting, all: providers };
 }, _RampsController_filterProviderIdsBySupport = 
 /**
@@ -2045,7 +2081,7 @@ async function _RampsController_resolveProviderIdsForQuote({ assetId, region, pr
 }, _RampsController_getPreferredProviderIdsFromOrders = function _RampsController_getPreferredProviderIdsFromOrders() {
     const orderedIds = [];
     const completedOrders = this.state.orders
-        .filter((order) => order.status === RampsService_1.RampsOrderStatus.Completed && order.provider?.id)
+        .filter((order) => order.status === RampsService_js_1.RampsOrderStatus.Completed && order.provider?.id)
         .sort((orderA, orderB) => orderB.createdAt - orderA.createdAt);
     for (const order of completedOrders) {
         const id = order.provider?.id;
@@ -2073,7 +2109,7 @@ async function _RampsController_refreshOrder(order) {
             lastTimeFetched: 0,
             errorCount: 0,
         };
-        if (updatedOrder.status === RampsService_1.RampsOrderStatus.Unknown) {
+        if (updatedOrder.status === RampsService_js_1.RampsOrderStatus.Unknown) {
             meta.errorCount = Math.min(meta.errorCount + 1, MAX_ERROR_COUNT);
         }
         else {