@metamask/snaps-controllers 0.27.1 → 0.29.0

package/dist/snaps/SnapController.js

@@ -21,7 +21,7 @@ var __rest = (this && this.__rest) || function (s, e) {
         }
     return t;
 };
-var _SnapController_instances, _SnapController_closeAllConnections, _SnapController_environmentEndowmentPermissions, _SnapController_featureFlags, _SnapController_fetchFunction, _SnapController_idleTimeCheckInterval, _SnapController_checkSnapBlockList, _SnapController_maxIdleTime, _SnapController_detectSnapLocation, _SnapController_rollbackSnapshots, _SnapController_timeoutForLastRequestStatus, _SnapController_statusMachine, _SnapController_initializeStateMachine, _SnapController_registerMessageHandlers, _SnapController_pollForLastRequestStatus, _SnapController_blockSnap, _SnapController_unblockSnap, _SnapController_assertIsUnblocked, _SnapController_stopSnapsLastRequestPastMax, _SnapController_transition, _SnapController_terminateSnap, _SnapController_add, _SnapController_startSnap, _SnapController_getEndowments, _SnapController_set, _SnapController_fetchSnap, _SnapController_processSnapPermissions, _SnapController_getRpcRequestHandler, _SnapController_executeWithTimeout, _SnapController_recordSnapRpcRequestStart, _SnapController_recordSnapRpcRequestFinish, _SnapController_getRollbackSnapshot, _SnapController_createRollbackSnapshot, _SnapController_rollbackSnap, _SnapController_rollbackSnaps, _SnapController_getRuntime, _SnapController_getRuntimeExpect, _SnapController_setupRuntime, _SnapController_calculatePermissionsChange, _SnapController_isValidUpdate;
+var _SnapController_instances, _SnapController_closeAllConnections, _SnapController_environmentEndowmentPermissions, _SnapController_excludedPermissions, _SnapController_featureFlags, _SnapController_fetchFunction, _SnapController_idleTimeCheckInterval, _SnapController_registry, _SnapController_maxIdleTime, _SnapController_detectSnapLocation, _SnapController_rollbackSnapshots, _SnapController_timeoutForLastRequestStatus, _SnapController_statusMachine, _SnapController_initializeStateMachine, _SnapController_registerMessageHandlers, _SnapController_pollForLastRequestStatus, _SnapController_blockSnap, _SnapController_unblockSnap, _SnapController_assertIsInstallAllowed, _SnapController_stopSnapsLastRequestPastMax, _SnapController_transition, _SnapController_terminateSnap, _SnapController_removeSnapFromSubjects, _SnapController_add, _SnapController_startSnap, _SnapController_getEndowments, _SnapController_set, _SnapController_fetchSnap, _SnapController_processSnapPermissions, _SnapController_getRpcRequestHandler, _SnapController_executeWithTimeout, _SnapController_recordSnapRpcRequestStart, _SnapController_recordSnapRpcRequestFinish, _SnapController_getRollbackSnapshot, _SnapController_createRollbackSnapshot, _SnapController_rollbackSnap, _SnapController_rollbackSnaps, _SnapController_getRuntime, _SnapController_getRuntimeExpect, _SnapController_setupRuntime, _SnapController_calculatePermissionsChange, _SnapController_isValidUpdate;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SnapController = exports.SNAP_APPROVAL_UPDATE = exports.SNAP_APPROVAL_INSTALL = exports.controllerName = void 0;
 const base_controller_1 = require("@metamask/base-controller");
@@ -33,10 +33,12 @@ const fsm_1 = require("@xstate/fsm");
 const eth_rpc_errors_1 = require("eth-rpc-errors");
 const nanoid_1 = require("nanoid");
 const fsm_2 = require("../fsm");
+const logging_1 = require("../logging");
 const utils_2 = require("../utils");
 const endowments_1 = require("./endowments");
 const rpc_1 = require("./endowments/rpc");
 const location_1 = require("./location");
+const registry_1 = require("./registry");
 const RequestQueue_1 = require("./RequestQueue");
 const Timer_1 = require("./Timer");
 exports.controllerName = 'SnapController';
@@ -46,7 +48,6 @@ exports.SNAP_APPROVAL_UPDATE = 'wallet_updateSnap';
 const TRUNCATED_SNAP_PROPERTIES = new Set([
     'initialPermissions',
     'id',
-    'permissionName',
     'version',
     'enabled',
     'blocked',
@@ -80,7 +81,7 @@ const name = 'SnapController';
  * - Start: Initializes the snap in its SES realm with the authorized permissions.
  */
 class SnapController extends base_controller_1.BaseControllerV2 {
-    constructor({ closeAllConnections, messenger, state, environmentEndowmentPermissions = [], idleTimeCheckInterval = (0, utils_1.inMilliseconds)(5, utils_1.Duration.Second), checkBlockList, maxIdleTime = (0, utils_1.inMilliseconds)(30, utils_1.Duration.Second), maxRequestTime = (0, utils_1.inMilliseconds)(60, utils_1.Duration.Second), fetchFunction = globalThis.fetch.bind(globalThis), featureFlags = {}, detectSnapLocation: detectSnapLocationFunction = location_1.detectSnapLocation, }) {
+    constructor({ closeAllConnections, messenger, state, environmentEndowmentPermissions = [], excludedPermissions = {}, idleTimeCheckInterval = (0, utils_1.inMilliseconds)(5, utils_1.Duration.Second), registry = new registry_1.JsonSnapsRegistry(), maxIdleTime = (0, utils_1.inMilliseconds)(30, utils_1.Duration.Second), maxRequestTime = (0, utils_1.inMilliseconds)(60, utils_1.Duration.Second), fetchFunction = globalThis.fetch.bind(globalThis), featureFlags = {}, detectSnapLocation: detectSnapLocationFunction = location_1.detectSnapLocation, }) {
         var _a, _b;
         super({
             messenger,
@@ -125,10 +126,11 @@ class SnapController extends base_controller_1.BaseControllerV2 {
         _SnapController_instances.add(this);
         _SnapController_closeAllConnections.set(this, void 0);
         _SnapController_environmentEndowmentPermissions.set(this, void 0);
+        _SnapController_excludedPermissions.set(this, void 0);
         _SnapController_featureFlags.set(this, void 0);
         _SnapController_fetchFunction.set(this, void 0);
         _SnapController_idleTimeCheckInterval.set(this, void 0);
-        _SnapController_checkSnapBlockList.set(this, void 0);
+        _SnapController_registry.set(this, void 0);
         _SnapController_maxIdleTime.set(this, void 0);
         _SnapController_detectSnapLocation.set(this, void 0);
         _SnapController_rollbackSnapshots.set(this, void 0);
@@ -136,10 +138,11 @@ class SnapController extends base_controller_1.BaseControllerV2 {
         _SnapController_statusMachine.set(this, void 0);
         __classPrivateFieldSet(this, _SnapController_closeAllConnections, closeAllConnections, "f");
         __classPrivateFieldSet(this, _SnapController_environmentEndowmentPermissions, environmentEndowmentPermissions, "f");
+        __classPrivateFieldSet(this, _SnapController_excludedPermissions, excludedPermissions, "f");
         __classPrivateFieldSet(this, _SnapController_featureFlags, featureFlags, "f");
         __classPrivateFieldSet(this, _SnapController_fetchFunction, fetchFunction, "f");
         __classPrivateFieldSet(this, _SnapController_idleTimeCheckInterval, idleTimeCheckInterval, "f");
-        __classPrivateFieldSet(this, _SnapController_checkSnapBlockList, checkBlockList, "f");
+        __classPrivateFieldSet(this, _SnapController_registry, registry, "f");
         __classPrivateFieldSet(this, _SnapController_maxIdleTime, maxIdleTime, "f");
         this.maxRequestTime = maxRequestTime;
         __classPrivateFieldSet(this, _SnapController_detectSnapLocation, detectSnapLocationFunction, "f");
@@ -170,40 +173,26 @@ class SnapController extends base_controller_1.BaseControllerV2 {
      * for more information.
      */
     async updateBlockedSnaps() {
-        const blockedSnaps = await __classPrivateFieldGet(this, _SnapController_checkSnapBlockList, "f").call(this, Object.values(this.state.snaps).reduce((blockListArg, snap) => {
+        const blockedSnaps = await __classPrivateFieldGet(this, _SnapController_registry, "f").get(Object.values(this.state.snaps).reduce((blockListArg, snap) => {
             blockListArg[snap.id] = {
                 version: snap.version,
-                shasum: snap.manifest.source.shasum,
+                checksum: snap.manifest.source.shasum,
             };
             return blockListArg;
         }, {}));
-        await Promise.all(Object.entries(blockedSnaps).map(async (_a) => {
-            var [snapId, _b] = _a, { blocked } = _b, blockData = __rest(_b, ["blocked"]);
-            if (blocked) {
-                return __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_blockSnap).call(this, snapId, blockData);
+        await Promise.all(Object.entries(blockedSnaps).map(async ([snapId, { status, reason }]) => {
+            if (status === registry_1.SnapsRegistryStatus.Blocked) {
+                return __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_blockSnap).call(this, snapId, reason);
             }
             return __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_unblockSnap).call(this, snapId);
         }));
     }
-    /**
-     * Checks the block list to determine whether a version of a snap is blocked.
-     *
-     * @param snapId - The snap id to check.
-     * @param snapInfo - Snap information containing version and shasum.
-     * @returns Whether the version of the snap is blocked or not.
-     */
-    async isBlocked(snapId, snapInfo) {
-        const result = await __classPrivateFieldGet(this, _SnapController_checkSnapBlockList, "f").call(this, {
-            [snapId]: snapInfo,
-        });
-        return result[snapId].blocked;
-    }
     _onUnhandledSnapError(snapId, error) {
         this.stopSnap(snapId, snaps_utils_1.SnapStatusEvents.Crash)
             .then(() => this.addSnapError(error))
             .catch((stopSnapError) => {
             // TODO: Decide how to handle errors.
-            console.error(stopSnapError);
+            (0, snaps_utils_1.logError)(stopSnapError);
         });
     }
     _onOutboundRequest(snapId) {
@@ -475,9 +464,7 @@ class SnapController extends base_controller_1.BaseControllerV2 {
             // affect the host environment while we are deleting it.
             await this.disableSnap(snapId);
             this.revokeAllSnapPermissions(snapId);
-            const permissionName = (0, snaps_utils_1.getSnapPermissionName)(snapId);
-            // Revoke all subjects access to the snap
-            this.messagingSystem.call('PermissionController:revokePermissionForAllSubjects', permissionName);
+            __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_removeSnapFromSubjects).call(this, snapId);
             this.snapsRuntimeData.delete(snapId);
             this.update((state) => {
                 delete state.snaps[snapId];
@@ -530,15 +517,14 @@ class SnapController extends base_controller_1.BaseControllerV2 {
      * @returns The serialized permitted snaps for the origin.
      */
     getPermittedSnaps(origin) {
-        var _a;
-        return Object.values((_a = this.messagingSystem.call('PermissionController:getPermissions', origin)) !== null && _a !== void 0 ? _a : {}).reduce((permittedSnaps, perm) => {
-            if (perm.parentCapability.startsWith(snaps_utils_1.SNAP_PREFIX)) {
-                const snapId = perm.parentCapability.replace(snaps_utils_1.SNAP_PREFIX_REGEX, '');
-                const snap = this.get(snapId);
-                const truncatedSnap = this.getTruncated(snapId);
-                if (truncatedSnap && (snap === null || snap === void 0 ? void 0 : snap.status) !== snaps_utils_1.SnapStatus.Installing) {
-                    permittedSnaps[snapId] = truncatedSnap;
-                }
+        var _a, _b, _c, _d, _e;
+        const permissions = (_a = this.messagingSystem.call('PermissionController:getPermissions', origin)) !== null && _a !== void 0 ? _a : {};
+        const snaps = (_e = (_d = (_c = (_b = permissions[rpc_methods_1.WALLET_SNAP_PERMISSION_KEY]) === null || _b === void 0 ? void 0 : _b.caveats) === null || _c === void 0 ? void 0 : _c.find((caveat) => caveat.type === snaps_utils_1.SnapCaveatType.SnapIds)) === null || _d === void 0 ? void 0 : _d.value) !== null && _e !== void 0 ? _e : {};
+        return Object.keys(snaps).reduce((permittedSnaps, snapId) => {
+            const snap = this.get(snapId);
+            const truncatedSnap = this.getTruncated(snapId);
+            if (truncatedSnap && (snap === null || snap === void 0 ? void 0 : snap.status) !== snaps_utils_1.SnapStatus.Installing) {
+                permittedSnaps[snapId] = truncatedSnap;
             }
             return permittedSnaps;
         }, {});
@@ -566,8 +552,8 @@ class SnapController extends base_controller_1.BaseControllerV2 {
                 if (error) {
                     throw eth_rpc_errors_1.ethErrors.rpc.invalidParams(`The "version" field must be a valid SemVer version range if specified. Received: "${rawVersion}".`);
                 }
-                const permissionName = (0, snaps_utils_1.getSnapPermissionName)(snapId);
-                if (!this.messagingSystem.call('PermissionController:hasPermission', origin, permissionName)) {
+                const permissions = this.messagingSystem.call('PermissionController:getPermissions', origin);
+                if (!(0, snaps_utils_1.isSnapPermitted)(permissions, snapId)) {
                     throw eth_rpc_errors_1.ethErrors.provider.unauthorized(`Not authorized to install snap "${snapId}". Request the permission for the snap before attempting to install it.`);
                 }
                 const isUpdate = pendingUpdates.includes(snapId);
@@ -611,15 +597,16 @@ class SnapController extends base_controller_1.BaseControllerV2 {
         const location = __classPrivateFieldGet(this, _SnapController_detectSnapLocation, "f").call(this, snapId, {
             versionRange,
             fetch: __classPrivateFieldGet(this, _SnapController_fetchFunction, "f"),
+            allowLocal: __classPrivateFieldGet(this, _SnapController_featureFlags, "f").allowLocalSnaps,
         });
         const existingSnap = this.getTruncated(snapId);
         // For devX we always re-install local snaps.
         if (existingSnap && !location.shouldAlwaysReload) {
-            if ((0, snaps_utils_1.satisfiesVersionRange)(existingSnap.version, versionRange)) {
+            if ((0, utils_1.satisfiesVersionRange)(existingSnap.version, versionRange)) {
                 return existingSnap;
             }
             if (__classPrivateFieldGet(this, _SnapController_featureFlags, "f").dappsCanUpdateSnaps === true) {
-                const updateResult = await this.updateSnap(origin, snapId, versionRange, location);
+                const updateResult = await this.updateSnap(origin, snapId, location, versionRange);
                 if (updateResult === null) {
                     throw eth_rpc_errors_1.ethErrors.rpc.invalidParams(`Snap "${snapId}@${existingSnap.version}" is already installed. Couldn't update to a version inside requested "${versionRange}" range.`);
                 }
@@ -647,7 +634,7 @@ class SnapController extends base_controller_1.BaseControllerV2 {
             return truncated;
         }
         catch (error) {
-            console.error(`Error when adding snap.`, error);
+            (0, snaps_utils_1.logError)(`Error when adding snap.`, error);
             throw error;
         }
     }
@@ -665,25 +652,25 @@ class SnapController extends base_controller_1.BaseControllerV2 {
      *
      * @param origin - The origin requesting the snap update.
      * @param snapId - The id of the Snap to be updated.
-     * @param newVersionRange - A semver version range in which the maximum version will be chosen.
      * @param location - Optional location that was already used during installation flow.
+     * @param newVersionRange - A semver version range in which the maximum version will be chosen.
      * @returns The snap metadata if updated, `null` otherwise.
      */
-    async updateSnap(origin, snapId, newVersionRange = snaps_utils_1.DEFAULT_REQUESTED_SNAP_VERSION, location) {
+    async updateSnap(origin, snapId, location, newVersionRange = snaps_utils_1.DEFAULT_REQUESTED_SNAP_VERSION) {
         var _a;
         const snap = this.getExpect(snapId);
-        if (!(0, snaps_utils_1.isValidSemVerRange)(newVersionRange)) {
+        if (!(0, utils_1.isValidSemVerRange)(newVersionRange)) {
             throw new Error(`Received invalid snap version range: "${newVersionRange}".`);
         }
-        const newSnap = await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_fetchSnap).call(this, snapId, location !== null && location !== void 0 ? location : __classPrivateFieldGet(this, _SnapController_detectSnapLocation, "f").call(this, snapId, { versionRange: newVersionRange }));
+        const newSnap = await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_fetchSnap).call(this, snapId, location);
         const newVersion = newSnap.manifest.result.version;
-        if (!(0, snaps_utils_1.gtVersion)(newVersion, snap.version)) {
-            console.warn(`Tried updating snap "${snapId}" within "${newVersionRange}" version range, but newer version "${snap.version}" is already installed`);
+        if (!(0, utils_1.gtVersion)(newVersion, snap.version)) {
+            (0, snaps_utils_1.logWarning)(`Tried updating snap "${snapId}" within "${newVersionRange}" version range, but newer version "${snap.version}" is already installed`);
             return null;
         }
-        await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_assertIsUnblocked).call(this, snapId, {
+        await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_assertIsInstallAllowed).call(this, snapId, {
             version: newVersion,
-            shasum: newSnap.manifest.result.source.shasum,
+            checksum: newSnap.manifest.result.source.shasum,
         });
         const processedPermissions = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_processSnapPermissions).call(this, newSnap.manifest.result.initialPermissions);
         const { newPermissions, unusedPermissions, approvedPermissions } = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_calculatePermissionsChange).call(this, snapId, processedPermissions);
@@ -734,9 +721,10 @@ class SnapController extends base_controller_1.BaseControllerV2 {
             rollbackSnapshot.permissions.granted = Object.keys(approvedNewPermissions);
             rollbackSnapshot.permissions.requestData = requestData;
         }
+        const normalizedSourcePath = (0, snaps_utils_1.normalizeRelative)(newSnap.manifest.result.source.location.npm.filePath);
         const sourceCode = (_a = newSnap.files
-            .find((file) => file.path === newSnap.manifest.result.source.location.npm.filePath)) === null || _a === void 0 ? void 0 : _a.toString();
-        (0, utils_1.assert)(sourceCode !== undefined);
+            .find((file) => file.path === normalizedSourcePath)) === null || _a === void 0 ? void 0 : _a.toString();
+        (0, utils_1.assert)(typeof sourceCode === 'string' && sourceCode.length > 0, `Invalid source code for snap "${snapId}".`);
         try {
             await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_startSnap).call(this, { snapId, sourceCode });
         }
@@ -747,6 +735,16 @@ class SnapController extends base_controller_1.BaseControllerV2 {
         this.messagingSystem.publish('SnapController:snapUpdated', truncatedSnap, snap.version);
         return truncatedSnap;
     }
+    /**
+     * Get metadata for the given snap ID.
+     *
+     * @param snapId - The ID of the snap to get metadata for.
+     * @returns The metadata for the given snap ID, or `null` if the snap is not
+     * verified.
+     */
+    async getRegistryMetadata(snapId) {
+        return await __classPrivateFieldGet(this, _SnapController_registry, "f").getMetadata(snapId);
+    }
     /**
      * Initiates a request for the given snap's initial permissions.
      * Must be called in order. See processRequestedSnap.
@@ -758,12 +756,19 @@ class SnapController extends base_controller_1.BaseControllerV2 {
      * @returns The snap's approvedPermissions.
      */
     async authorize(origin, snapId) {
-        console.info(`Authorizing snap: ${snapId}`);
+        (0, logging_1.log)(`Authorizing snap: ${snapId}`);
         const snapsState = this.state.snaps;
         const snap = snapsState[snapId];
         const { initialPermissions } = snap;
         try {
             const processedPermissions = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_processSnapPermissions).call(this, initialPermissions);
+            const excludedPermissionErrors = Object.keys(processedPermissions).reduce((errors, permission) => {
+                if ((0, utils_1.hasProperty)(__classPrivateFieldGet(this, _SnapController_excludedPermissions, "f"), permission)) {
+                    errors.push(__classPrivateFieldGet(this, _SnapController_excludedPermissions, "f")[permission]);
+                }
+                return errors;
+            }, []);
+            (0, utils_1.assert)(excludedPermissionErrors.length === 0, `One or more permissions are not allowed:\n${excludedPermissionErrors.join('\n')}`);
             const id = (0, nanoid_1.nanoid)();
             const _a = (await this.messagingSystem.call('ApprovalController:addRequest', {
                 origin,
@@ -836,7 +841,7 @@ class SnapController extends base_controller_1.BaseControllerV2 {
     }
 }
 exports.SnapController = SnapController;
-_SnapController_closeAllConnections = new WeakMap(), _SnapController_environmentEndowmentPermissions = new WeakMap(), _SnapController_featureFlags = new WeakMap(), _SnapController_fetchFunction = new WeakMap(), _SnapController_idleTimeCheckInterval = new WeakMap(), _SnapController_checkSnapBlockList = new WeakMap(), _SnapController_maxIdleTime = new WeakMap(), _SnapController_detectSnapLocation = new WeakMap(), _SnapController_rollbackSnapshots = new WeakMap(), _SnapController_timeoutForLastRequestStatus = new WeakMap(), _SnapController_statusMachine = new WeakMap(), _SnapController_instances = new WeakSet(), _SnapController_initializeStateMachine = function _SnapController_initializeStateMachine() {
+_SnapController_closeAllConnections = new WeakMap(), _SnapController_environmentEndowmentPermissions = new WeakMap(), _SnapController_excludedPermissions = new WeakMap(), _SnapController_featureFlags = new WeakMap(), _SnapController_fetchFunction = new WeakMap(), _SnapController_idleTimeCheckInterval = new WeakMap(), _SnapController_registry = new WeakMap(), _SnapController_maxIdleTime = new WeakMap(), _SnapController_detectSnapLocation = new WeakMap(), _SnapController_rollbackSnapshots = new WeakMap(), _SnapController_timeoutForLastRequestStatus = new WeakMap(), _SnapController_statusMachine = new WeakMap(), _SnapController_instances = new WeakSet(), _SnapController_initializeStateMachine = function _SnapController_initializeStateMachine() {
     const disableGuard = ({ snapId }) => {
         return this.getExpect(snapId).enabled;
     };
@@ -880,6 +885,7 @@ _SnapController_closeAllConnections = new WeakMap(), _SnapController_environment
                         target: snaps_utils_1.SnapStatus.Running,
                         cond: disableGuard,
                     },
+                    [snaps_utils_1.SnapStatusEvents.Update]: snaps_utils_1.SnapStatus.Updating,
                 },
             },
         },
@@ -903,11 +909,12 @@ _SnapController_closeAllConnections = new WeakMap(), _SnapController_environment
     this.messagingSystem.registerActionHandler(`${exports.controllerName}:getAll`, (...args) => this.getAllSnaps(...args));
     this.messagingSystem.registerActionHandler(`${exports.controllerName}:incrementActiveReferences`, (...args) => this.incrementActiveReferences(...args));
     this.messagingSystem.registerActionHandler(`${exports.controllerName}:decrementActiveReferences`, (...args) => this.decrementActiveReferences(...args));
+    this.messagingSystem.registerActionHandler(`${exports.controllerName}:getRegistryMetadata`, async (...args) => this.getRegistryMetadata(...args));
 }, _SnapController_pollForLastRequestStatus = function _SnapController_pollForLastRequestStatus() {
     __classPrivateFieldSet(this, _SnapController_timeoutForLastRequestStatus, setTimeout(() => {
         __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_stopSnapsLastRequestPastMax).call(this).catch((error) => {
             // TODO: Decide how to handle errors.
-            console.error(error);
+            (0, snaps_utils_1.logError)(error);
         });
         __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_pollForLastRequestStatus).call(this);
     }, __classPrivateFieldGet(this, _SnapController_idleTimeCheckInterval, "f")), "f");
@@ -931,7 +938,7 @@ async function _SnapController_blockSnap(snapId, blockedSnapInfo) {
         await this.disableSnap(snapId);
     }
     catch (error) {
-        console.error(`Encountered error when stopping blocked snap "${snapId}".`, error);
+        (0, snaps_utils_1.logError)(`Encountered error when stopping blocked snap "${snapId}".`, error);
     }
     this.messagingSystem.publish(`${exports.controllerName}:snapBlocked`, snapId, blockedSnapInfo);
 }, _SnapController_unblockSnap = function _SnapController_unblockSnap(snapId) {
@@ -943,17 +950,18 @@ async function _SnapController_blockSnap(snapId, blockedSnapInfo) {
         delete state.snaps[snapId].blockInformation;
     });
     this.messagingSystem.publish(`${exports.controllerName}:snapUnblocked`, snapId);
-}, _SnapController_assertIsUnblocked = 
-/**
- * Asserts that a version of a snap is not blocked. Succeeds automatically
- * if {@link SnapController._checkSnapBlockList} is undefined.
- *
- * @param snapId - The id of the snap to check.
- * @param snapInfo - Snap information containing version and shasum.
- */
-async function _SnapController_assertIsUnblocked(snapId, snapInfo) {
-    if (await this.isBlocked(snapId, snapInfo)) {
-        throw new Error(`Cannot install version "${snapInfo.version}" of snap "${snapId}": the version is blocked.`);
+}, _SnapController_assertIsInstallAllowed = async function _SnapController_assertIsInstallAllowed(snapId, snapInfo) {
+    var _a, _b;
+    const results = await __classPrivateFieldGet(this, _SnapController_registry, "f").get({
+        [snapId]: snapInfo,
+    });
+    const result = results[snapId];
+    if (result.status === registry_1.SnapsRegistryStatus.Blocked) {
+        throw new Error(`Cannot install version "${snapInfo.version}" of snap "${snapId}": The version is blocked. ${(_b = (_a = result.reason) === null || _a === void 0 ? void 0 : _a.explanation) !== null && _b !== void 0 ? _b : ''}`);
+    }
+    else if (__classPrivateFieldGet(this, _SnapController_featureFlags, "f").requireAllowlist &&
+        result.status !== registry_1.SnapsRegistryStatus.Verified) {
+        throw new Error(`Cannot install version "${snapInfo.version}" of snap "${snapId}": The snap is not on the allow list.`);
     }
 }, _SnapController_stopSnapsLastRequestPastMax = async function _SnapController_stopSnapsLastRequestPastMax() {
     const entries = [...this.snapsRuntimeData.entries()];
@@ -980,6 +988,19 @@ async function _SnapController_assertIsUnblocked(snapId, snapInfo) {
 async function _SnapController_terminateSnap(snapId) {
     await this.messagingSystem.call('ExecutionService:terminateSnap', snapId);
     this.messagingSystem.publish('SnapController:snapTerminated', this.getTruncatedExpect(snapId));
+}, _SnapController_removeSnapFromSubjects = function _SnapController_removeSnapFromSubjects(snapId) {
+    var _a, _b, _c, _d;
+    const subjects = this.messagingSystem.call('PermissionController:getSubjectNames');
+    for (const subject of subjects) {
+        const subjectPermissions = this.messagingSystem.call('PermissionController:getPermissions', subject);
+        const snapIdsCaveat = ((_c = (_b = (_a = subjectPermissions === null || subjectPermissions === void 0 ? void 0 : subjectPermissions[rpc_methods_1.WALLET_SNAP_PERMISSION_KEY]) === null || _a === void 0 ? void 0 : _a.caveats) === null || _b === void 0 ? void 0 : _b.find((caveat) => caveat.type === snaps_utils_1.SnapCaveatType.SnapIds)) !== null && _c !== void 0 ? _c : {});
+        const caveatHasSnap = Boolean((_d = snapIdsCaveat.value) === null || _d === void 0 ? void 0 : _d[snapId]);
+        if (caveatHasSnap) {
+            const newCaveatValue = Object.assign({}, snapIdsCaveat.value);
+            delete newCaveatValue[snapId];
+            this.messagingSystem.call('PermissionController:updateCaveat', subject, rpc_methods_1.WALLET_SNAP_PERMISSION_KEY, snaps_utils_1.SnapCaveatType.SnapIds, newCaveatValue);
+        }
+    }
 }, _SnapController_add = 
 /**
  * Returns a promise representing the complete installation of the requested snap.
@@ -996,14 +1017,14 @@ async function _SnapController_add(args) {
     __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_setupRuntime).call(this, snapId, { sourceCode: null, state: null });
     const runtime = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_getRuntimeExpect).call(this, snapId);
     if (!runtime.installPromise) {
-        console.info(`Adding snap: ${snapId}`);
+        (0, logging_1.log)(`Adding snap: ${snapId}`);
         // If fetching and setting the snap succeeds, this property will be set
         // to null in the authorize() method.
         runtime.installPromise = (async () => {
             const fetchedSnap = await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_fetchSnap).call(this, snapId, location);
-            await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_assertIsUnblocked).call(this, snapId, {
+            await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_assertIsInstallAllowed).call(this, snapId, {
                 version: fetchedSnap.manifest.result.version,
-                shasum: fetchedSnap.manifest.result.source.shasum,
+                checksum: fetchedSnap.manifest.result.source.shasum,
             });
             return __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_set).call(this, Object.assign(Object.assign(Object.assign({}, args), fetchedSnap), { id: snapId }));
         })();
@@ -1066,7 +1087,7 @@ async function _SnapController_getEndowments(snapId) {
         // This is a bug in TypeScript: https://github.com/microsoft/TypeScript/issues/48313
         // eslint-disable-next-line @typescript-eslint/restrict-plus-operands
         snaps_utils_1.DEFAULT_ENDOWMENTS.length + allEndowments.length) {
-        console.error('Duplicate endowments found. Default endowments should not be requested.', allEndowments);
+        (0, snaps_utils_1.logError)('Duplicate endowments found. Default endowments should not be requested.', allEndowments);
     }
     return dedupedEndowments;
 }, _SnapController_set = function _SnapController_set(args) {
@@ -1074,17 +1095,18 @@ async function _SnapController_getEndowments(snapId) {
     const { id: snapId, origin, manifest, files, versionRange = snaps_utils_1.DEFAULT_REQUESTED_SNAP_VERSION, isUpdate = false, } = args;
     (0, snaps_utils_1.assertIsSnapManifest)(manifest.result);
     const { version } = manifest.result;
-    if (!(0, snaps_utils_1.satisfiesVersionRange)(version, versionRange)) {
+    if (!(0, utils_1.satisfiesVersionRange)(version, versionRange)) {
         throw new Error(`Version mismatch. Manifest for "${snapId}" specifies version "${version}" which doesn't satisfy requested version range "${versionRange}"`);
     }
+    const normalizedSourcePath = (0, snaps_utils_1.normalizeRelative)(manifest.result.source.location.npm.filePath);
+    const { iconPath } = manifest.result.source.location.npm;
+    const normalizedIconPath = iconPath && (0, snaps_utils_1.normalizeRelative)(iconPath);
     const sourceCode = (_a = files
-        .find((file) => file.path === manifest.result.source.location.npm.filePath)) === null || _a === void 0 ? void 0 : _a.toString();
-    const svgIcon = files.find((file) => manifest.result.source.location.npm.iconPath !== undefined &&
-        file.path === manifest.result.source.location.npm.iconPath);
-    (0, utils_1.assert)(sourceCode !== undefined);
-    if (typeof sourceCode !== 'string' || sourceCode.length === 0) {
-        throw new Error(`Invalid source code for snap "${snapId}".`);
-    }
+        .find((file) => file.path === normalizedSourcePath)) === null || _a === void 0 ? void 0 : _a.toString();
+    const svgIcon = normalizedIconPath
+        ? files.find((file) => file.path === normalizedIconPath)
+        : undefined;
+    (0, utils_1.assert)(typeof sourceCode === 'string' && sourceCode.length > 0, `Invalid source code for snap "${snapId}".`);
     const snapsState = this.state.snaps;
     const existingSnap = snapsState[snapId];
     const previousVersionHistory = (_b = existingSnap === null || existingSnap === void 0 ? void 0 : existingSnap.versionHistory) !== null && _b !== void 0 ? _b : [];
@@ -1099,9 +1121,7 @@ async function _SnapController_getEndowments(snapId) {
     const snap = Object.assign(Object.assign({}, existingSnap), { 
         // Note that the snap will be unblocked and enabled, regardless of its
         // previous state.
-        blocked: false, enabled: true, 
-        // So we can easily correlate the snap with its permission
-        permissionName: (0, snaps_utils_1.getSnapPermissionName)(snapId), id: snapId, initialPermissions: manifest.result.initialPermissions, manifest: manifest.result, status: __classPrivateFieldGet(this, _SnapController_statusMachine, "f").config.initial, version,
+        blocked: false, enabled: true, id: snapId, initialPermissions: manifest.result.initialPermissions, manifest: manifest.result, status: __classPrivateFieldGet(this, _SnapController_statusMachine, "f").config.initial, version,
         versionHistory });
     // If the snap was blocked, it isn't any longer
     delete snap.blockInformation;
@@ -1135,12 +1155,13 @@ async function _SnapController_fetchSnap(snapId, location) {
     try {
         const manifest = await location.manifest();
         const sourceCode = await location.fetch(manifest.result.source.location.npm.filePath);
-        (0, snaps_utils_1.validateSnapShasum)(manifest.result, sourceCode.toString());
         const { iconPath } = manifest.result.source.location.npm;
+        const svgIcon = iconPath ? await location.fetch(iconPath) : undefined;
         const files = [sourceCode];
-        if (iconPath) {
-            files.push(await location.fetch(iconPath));
+        if (svgIcon) {
+            files.push(svgIcon);
         }
+        (0, snaps_utils_1.validateSnapShasum)({ manifest, sourceCode, svgIcon });
         return { manifest, files, location };
     }
     catch (error) {
@@ -1245,6 +1266,7 @@ async function _SnapController_executeWithTimeout(snapId, promise, timer) {
     const isLongRunning = this.messagingSystem.call('PermissionController:hasPermission', snapId, endowments_1.SnapEndowments.LongRunning);
     // Long running snaps have timeouts disabled
     if (isLongRunning) {
+        (0, snaps_utils_1.logWarning)(`${endowments_1.SnapEndowments.LongRunning} will soon be deprecated. For more information please see https://github.com/MetaMask/snaps-monorepo/issues/945.`);
         return promise;
     }
     const result = await (0, utils_2.withTimeout)(promise, timer !== null && timer !== void 0 ? timer : this.maxRequestTime);
@@ -1360,10 +1382,10 @@ async function _SnapController_rollbackSnaps(snapIds) {
     return { newPermissions, unusedPermissions, approvedPermissions };
 }, _SnapController_isValidUpdate = function _SnapController_isValidUpdate(snapId, newVersionRange) {
     const existingSnap = this.getExpect(snapId);
-    if ((0, snaps_utils_1.satisfiesVersionRange)(existingSnap.version, newVersionRange)) {
+    if ((0, utils_1.satisfiesVersionRange)(existingSnap.version, newVersionRange)) {
         return false;
     }
-    if ((0, snaps_utils_1.gtRange)(existingSnap.version, newVersionRange)) {
+    if ((0, utils_1.gtRange)(existingSnap.version, newVersionRange)) {
         return false;
     }
     return true;