@metamask/snaps-controllers 0.29.0 → 0.31.0

package/dist/snaps/location/npm.js.map

@@ -1 +1 @@
-{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../../src/snaps/location/npm.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,uDAS+B;AAC/B,2CAOyB;AACzB,kEAAmC;AACnC,gEAA8C;AAC9C,gDAAwB;AACxB,6EAAsE;AAEtE,2CAAmD;AAInD,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;AAsB1D,MAAa,WAAW;IAOtB,YAAY,GAAQ,EAAE,OAAkC,EAAE;;;QACxD,MAAM,qBAAqB,GAAG,MAAA,IAAI,CAAC,qBAAqB,mCAAI,KAAK,CAAC;QAClE,MAAM,aAAa,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtE,MAAM,cAAc,GAAG,MAAA,IAAI,CAAC,YAAY,mCAAI,4CAA8B,CAAC;QAE3E,IAAA,oBAAY,EAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,6BAAe,EAAE,mBAAmB,CAAC,CAAC;QAEnE,IAAI,QAAsB,CAAC;QAC3B,IACE,GAAG,CAAC,IAAI,KAAK,EAAE;YACf,GAAG,CAAC,IAAI,KAAK,EAAE;YACf,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,QAAQ,KAAK,EAAE,EACnB;YACA,QAAQ,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAC;SAC1C;aAAM;YACL,QAAQ,GAAG,UAAU,CAAC;YACtB,IAAI,GAAG,CAAC,QAAQ,EAAE;gBAChB,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC;gBACzB,IAAI,GAAG,CAAC,QAAQ,EAAE;oBAChB,QAAQ,IAAI,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;iBAChC;gBACD,QAAQ,IAAI,GAAG,CAAC;aACjB;YACD,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC;YACrB,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,IAAA,cAAM,EACJ,qBAAqB,EACrB,IAAI,SAAS,CACX,qDAAqD,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAC7E,CACF,CAAC;SACH;QAED,IAAA,cAAM,EACJ,QAAQ,CAAC,QAAQ,KAAK,GAAG;YACvB,QAAQ,CAAC,MAAM,KAAK,EAAE;YACtB,QAAQ,CAAC,IAAI,KAAK,EAAE,CACvB,CAAC;QAEF,IAAA,cAAM,EACJ,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAC3C,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAC5D,CAAC;QACF,IAAI,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC/B,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;YAC/B,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACpC;QAED,IAAI,CAAC,IAAI,GAAG;YACV,cAAc;YACd,QAAQ;YACR,WAAW;YACX,KAAK,EAAE,aAAa;SACrB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,iBAAiB,EAAE;YAC1B,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;SACvC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5C,KAAK,CAAC,MAAM,GAAG,IAAA,gCAAkB,EAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,iBAAiB,GAAG,KAAkC,CAAC;QAE5D,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY;QACtB,MAAM,YAAY,GAAG,IAAA,+BAAiB,EAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE;YACf,MAAM,uBAAA,IAAI,qDAAU,MAAd,IAAI,CAAY,CAAC;YACvB,IAAA,cAAM,EAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;SAClC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAA,cAAM,EACJ,KAAK,KAAK,SAAS,EACnB,IAAI,SAAS,CAAC,SAAS,IAAI,yBAAyB,CAAC,CACtD,CAAC;QACF,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;IAC/B,CAAC;IAED,IAAI,OAAO;QACT,IAAA,cAAM,EACJ,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,EAC/B,6DAA6D,CAC9D,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;IAC3B,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC5B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;IAClC,CAAC;CA0CF;AAvJD,kCAuJC;gEAxCC,KAAK;IACH,IAAA,cAAM,EAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,EAAE,aAAa,CAAC,GAAG,MAAM,eAAe,CAC5D,IAAI,CAAC,IAAI,CAAC,WAAW,EACrB,IAAI,CAAC,IAAI,CAAC,cAAc,EACxB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAClB,IAAI,CAAC,IAAI,CAAC,KAAK,CAChB,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC;IAElC,IAAI,aAAa,GAAG,QAAQ,CAAC;IAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,EAAE,EAAE;QACtC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7C,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,EAAE,EAAE;YACtC,aAAa,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;SACpD;QACD,aAAa,IAAI,GAAG,CAAC;KACtB;IACD,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAEzC,gFAAgF;IAChF,kHAAkH;IAClH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,IAAA,cAAI,EACF,aAAa,CAAC,eAAe,CAAC;QAC9B,4EAA4E;QAC5E,iDAAiD;QACjD,+EAA+E;QAC/E,IAAA,sBAAkB,EAAC,CAAC,CAAC,EACrB,mBAAmB,CACjB,GAAG,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,EAC5C,IAAI,CAAC,KAAK,CACX,EACD,CAAC,KAAK,EAAE,EAAE;YACR,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACpC,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAGH,6CAA6C;AAC7C,MAAM,yBAAyB,GAAG,SAAS,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,eAAe,CAC5B,WAAmB,EACnB,YAAyB,EACzB,WAAyB,EACzB,aAA2B;;IAE3B,MAAM,eAAe,GAAG,MAAM,CAC5B,MAAM,aAAa,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAClE,CAAC,IAAI,EAAE,CAAC;IAET,IAAI,CAAC,IAAA,gBAAQ,EAAC,eAAe,CAAC,EAAE;QAC9B,MAAM,IAAI,KAAK,CACb,4BAA4B,WAAW,sBAAsB,CAC9D,CAAC;KACH;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAC,eAAuB,aAAvB,eAAe,uBAAf,eAAe,CAAU,QAAQ,mCAAI,EAAE,CAAC,CAAC,GAAG,CACxE,CAAC,OAAO,EAAE,EAAE;QACV,IAAA,6BAAqB,EAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;IAEF,MAAM,aAAa,GAAG,IAAA,8BAAgB,EAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAE/D,IAAI,aAAa,KAAK,IAAI,EAAE;QAC1B,MAAM,IAAI,KAAK,CACb,kEAAkE,WAAW,iCAAiC,YAAY,IAAI,CAC/H,CAAC;KACH;IAED,MAAM,gBAAgB,GAAG,MAAA,MAAA,MAAC,eAAuB,aAAvB,eAAe,uBAAf,eAAe,CAAU,QAAQ,0CAAG,aAAa,CAAC,0CACxE,IAAI,0CAAE,OAAO,CAAC;IAElB,IACE,CAAC,IAAA,wBAAU,EAAC,gBAAgB,CAAC;QAC7B,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC7C;QACA,MAAM,IAAI,KAAK,CACb,iEAAiE,WAAW,IAAI,CACjF,CAAC;KACH;IAED,4EAA4E;IAC5E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAChD,aAAa,CAAC,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;IACjD,aAAa,CAAC,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;IAEjD,kEAAkE;IAClE,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE;QAChD,MAAM,IAAI,KAAK,CAAC,wCAAwC,WAAW,IAAI,CAAC,CAAC;KAC1E;IACD,2FAA2F;IAC3F,MAAM,iBAAiB,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACxE,IAAA,cAAM,EAAC,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,QAAQ,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IACpD,IAAA,cAAM,EACJ,WAAW,IAAI,yBAAyB,EACxC,iCAAiC,CAClC,CAAC;IACF,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAE9C;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,MAAsB;IAC3C,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,EAAE;QAC1C,OAAO,MAA6B,CAAC;KACtC;IAED,OAAO,IAAI,qDAAuB,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,aAAqB,EACrB,KAA+B;IAE/B,IAAA,cAAM,EACJ,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC3B,4FAA4F,CAC7F,CAAC;IAEF,IAAA,cAAM,EACJ,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,EAChC,qCAAqC,CACtC,CAAC;IACF,oEAAoE;IACpE,2CAA2C;IAC3C,MAAM,aAAa,GAAG,IAAA,oBAAU,GAAE,CAAC;IAEnC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,2EAA2E;IAC3E,qBAAqB;IACrB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;QACtD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;QACtD,IAAI,UAAU,KAAK,MAAM,EAAE;YACzB,mDAAmD;YACnD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;YAC7D,OAAO,WAAW,CAAC,IAAI,CACrB,IAAA,uBAAM,EAAC,CAAC,IAAI,EAAE,EAAE;gBACd,IAAI;oBACF,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC;oBAC7B,8EAA8E;oBAC9E,IAAA,cAAM,EACJ,SAAS,GAAG,yBAAyB,EACrC,iCAAiC,yBAAyB,SAAS,CACpE,CAAC;oBACF,MAAM,KAAK,GAAG,IAAI,yBAAW,CAAC;wBAC5B,KAAK,EAAE,IAAI;wBACX,IAAI;wBACJ,IAAI,EAAE;4BACJ,aAAa,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE;yBACvD;qBACF,CAAC,CAAC;oBACH,wFAAwF;oBACxF,IAAA,cAAM,EACJ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAChB,uDAAuD,CACxD,CAAC;oBACF,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBACvB,OAAO,IAAI,EAAE,CAAC;iBACf;gBAAC,OAAO,KAAK,EAAE;oBACd,OAAO,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;iBACrC;YACH,CAAC,CAAC,CACH,CAAC;SACH;QAED,4EAA4E;QAC5E,0EAA0E;QAC1E,6CAA6C;QAC7C,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACpC,OAAO,WAAW,CAAC,MAAM,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,OAAO,aAAa,CAAC;AACvB,CAAC","sourcesContent":["import {\n  createSnapManifest,\n  DEFAULT_REQUESTED_SNAP_VERSION,\n  getTargetVersion,\n  isValidUrl,\n  NpmSnapIdStruct,\n  SnapManifest,\n  VirtualFile,\n  normalizeRelative,\n} from '@metamask/snaps-utils';\nimport {\n  assert,\n  assertIsSemVerVersion,\n  assertStruct,\n  isObject,\n  SemVerRange,\n  SemVerVersion,\n} from '@metamask/utils';\nimport concat from 'concat-stream';\nimport createGunzipStream from 'gunzip-maybe';\nimport pump from 'pump';\nimport { ReadableWebToNodeStream } from 'readable-web-to-node-stream';\nimport { Readable, Writable } from 'stream';\nimport { extract as tarExtract } from 'tar-stream';\n\nimport { DetectSnapLocationOptions, SnapLocation } from './location';\n\nconst DEFAULT_NPM_REGISTRY = 'https://registry.npmjs.org';\n\ninterface NpmMeta {\n  registry: URL;\n  packageName: string;\n  requestedRange: SemVerRange;\n  version?: string;\n  fetch: typeof fetch;\n}\nexport interface NpmOptions {\n  /**\n   * @default DEFAULT_REQUESTED_SNAP_VERSION\n   */\n  versionRange?: SemVerRange;\n  /**\n   * Whether to allow custom NPM registries outside of {@link DEFAULT_NPM_REGISTRY}.\n   *\n   * @default false\n   */\n  allowCustomRegistries?: boolean;\n}\n\nexport class NpmLocation implements SnapLocation {\n  private readonly meta: NpmMeta;\n\n  private validatedManifest?: VirtualFile<SnapManifest>;\n\n  private files?: Map<string, VirtualFile>;\n\n  constructor(url: URL, opts: DetectSnapLocationOptions = {}) {\n    const allowCustomRegistries = opts.allowCustomRegistries ?? false;\n    const fetchFunction = opts.fetch ?? globalThis.fetch.bind(globalThis);\n    const requestedRange = opts.versionRange ?? DEFAULT_REQUESTED_SNAP_VERSION;\n\n    assertStruct(url.toString(), NpmSnapIdStruct, 'Invalid Snap Id: ');\n\n    let registry: string | URL;\n    if (\n      url.host === '' &&\n      url.port === '' &&\n      url.username === '' &&\n      url.password === ''\n    ) {\n      registry = new URL(DEFAULT_NPM_REGISTRY);\n    } else {\n      registry = 'https://';\n      if (url.username) {\n        registry += url.username;\n        if (url.password) {\n          registry += `:${url.password}`;\n        }\n        registry += '@';\n      }\n      registry += url.host;\n      registry = new URL(registry);\n      assert(\n        allowCustomRegistries,\n        new TypeError(\n          `Custom NPM registries are disabled, tried to use \"${registry.toString()}\".`,\n        ),\n      );\n    }\n\n    assert(\n      registry.pathname === '/' &&\n        registry.search === '' &&\n        registry.hash === '',\n    );\n\n    assert(\n      url.pathname !== '' && url.pathname !== '/',\n      new TypeError('The package name in NPM location is empty.'),\n    );\n    let packageName = url.pathname;\n    if (packageName.startsWith('/')) {\n      packageName = packageName.slice(1);\n    }\n\n    this.meta = {\n      requestedRange,\n      registry,\n      packageName,\n      fetch: fetchFunction,\n    };\n  }\n\n  async manifest(): Promise<VirtualFile<SnapManifest>> {\n    if (this.validatedManifest) {\n      return this.validatedManifest.clone();\n    }\n\n    const vfile = await this.fetch('snap.manifest.json');\n    const result = JSON.parse(vfile.toString());\n    vfile.result = createSnapManifest(result);\n    this.validatedManifest = vfile as VirtualFile<SnapManifest>;\n\n    return this.manifest();\n  }\n\n  async fetch(path: string): Promise<VirtualFile> {\n    const relativePath = normalizeRelative(path);\n    if (!this.files) {\n      await this.#lazyInit();\n      assert(this.files !== undefined);\n    }\n    const vfile = this.files.get(relativePath);\n    assert(\n      vfile !== undefined,\n      new TypeError(`File \"${path}\" not found in package.`),\n    );\n    return vfile.clone();\n  }\n\n  get packageName(): string {\n    return this.meta.packageName;\n  }\n\n  get version(): string {\n    assert(\n      this.meta.version !== undefined,\n      'Tried to access version without first fetching NPM package.',\n    );\n    return this.meta.version;\n  }\n\n  get registry(): URL {\n    return this.meta.registry;\n  }\n\n  get versionRange(): SemVerRange {\n    return this.meta.requestedRange;\n  }\n\n  async #lazyInit() {\n    assert(this.files === undefined);\n    const [tarballResponse, actualVersion] = await fetchNpmTarball(\n      this.meta.packageName,\n      this.meta.requestedRange,\n      this.meta.registry,\n      this.meta.fetch,\n    );\n    this.meta.version = actualVersion;\n\n    let canonicalBase = 'npm://';\n    if (this.meta.registry.username !== '') {\n      canonicalBase += this.meta.registry.username;\n      if (this.meta.registry.password !== '') {\n        canonicalBase += `:${this.meta.registry.password}`;\n      }\n      canonicalBase += '@';\n    }\n    canonicalBase += this.meta.registry.host;\n\n    // TODO(ritave): Lazily extract files instead of up-front extracting all of them\n    //               We would need to replace tar-stream package because it requires immediate consumption of streams.\n    await new Promise<void>((resolve, reject) => {\n      this.files = new Map();\n      pump(\n        getNodeStream(tarballResponse),\n        // The \"gz\" in \"tgz\" stands for \"gzip\". The tarball needs to be decompressed\n        // before we can actually grab any files from it.\n        // To prevent recursion-based zip bombs, we set a maximum recursion depth of 1.\n        createGunzipStream(1),\n        createTarballStream(\n          `${canonicalBase}/${this.meta.packageName}/`,\n          this.files,\n        ),\n        (error) => {\n          error ? reject(error) : resolve();\n        },\n      );\n    });\n  }\n}\n\n// Safety limit for tarballs, 250 MB in bytes\nconst TARBALL_SIZE_SAFETY_LIMIT = 262144000;\n\n/**\n * Fetches the tarball (`.tgz` file) of the specified package and version from\n * the public npm registry. Throws an error if fetching fails.\n *\n * @param packageName - The name of the package whose tarball to fetch.\n * @param versionRange - The SemVer range of the package to fetch. The highest\n * version satisfying the range will be fetched.\n * @param registryUrl - The URL of the npm registry to fetch the tarball from.\n * @param fetchFunction - The fetch function to use. Defaults to the global\n * {@link fetch}. Useful for Node.js compatibility.\n * @returns A tuple of the {@link Response} for the package tarball and the\n * actual version of the package.\n */\nasync function fetchNpmTarball(\n  packageName: string,\n  versionRange: SemVerRange,\n  registryUrl: URL | string,\n  fetchFunction: typeof fetch,\n): Promise<[ReadableStream, SemVerVersion]> {\n  const packageMetadata = await (\n    await fetchFunction(new URL(packageName, registryUrl).toString())\n  ).json();\n\n  if (!isObject(packageMetadata)) {\n    throw new Error(\n      `Failed to fetch package \"${packageName}\" metadata from npm.`,\n    );\n  }\n\n  const versions = Object.keys((packageMetadata as any)?.versions ?? {}).map(\n    (version) => {\n      assertIsSemVerVersion(version);\n      return version;\n    },\n  );\n\n  const targetVersion = getTargetVersion(versions, versionRange);\n\n  if (targetVersion === null) {\n    throw new Error(\n      `Failed to find a matching version in npm metadata for package \"${packageName}\" and requested semver range \"${versionRange}\".`,\n    );\n  }\n\n  const tarballUrlString = (packageMetadata as any)?.versions?.[targetVersion]\n    ?.dist?.tarball;\n\n  if (\n    !isValidUrl(tarballUrlString) ||\n    !tarballUrlString.toString().endsWith('.tgz')\n  ) {\n    throw new Error(\n      `Failed to find valid tarball URL in NPM metadata for package \"${packageName}\".`,\n    );\n  }\n\n  // Override the tarball hostname/protocol with registryUrl hostname/protocol\n  const newRegistryUrl = new URL(registryUrl);\n  const newTarballUrl = new URL(tarballUrlString);\n  newTarballUrl.hostname = newRegistryUrl.hostname;\n  newTarballUrl.protocol = newRegistryUrl.protocol;\n\n  // Perform a raw fetch because we want the Response object itself.\n  const tarballResponse = await fetchFunction(newTarballUrl.toString());\n  if (!tarballResponse.ok || !tarballResponse.body) {\n    throw new Error(`Failed to fetch tarball for package \"${packageName}\".`);\n  }\n  // We assume that NPM is a good actor and provides us with a valid `content-length` header.\n  const tarballSizeString = tarballResponse.headers.get('content-length');\n  assert(tarballSizeString, 'Snap tarball has invalid content-length');\n  const tarballSize = parseInt(tarballSizeString, 10);\n  assert(\n    tarballSize <= TARBALL_SIZE_SAFETY_LIMIT,\n    'Snap tarball exceeds size limit',\n  );\n  return [tarballResponse.body, targetVersion];\n}\n\n/**\n * The paths of files within npm tarballs appear to always be prefixed with\n * \"package/\".\n */\nconst NPM_TARBALL_PATH_PREFIX = /^package\\//u;\n\n/**\n * Converts a {@link ReadableStream} to a Node.js {@link Readable}\n * stream. Returns the stream directly if it is already a Node.js stream.\n * We can't use the native Web {@link ReadableStream} directly because the\n * other stream libraries we use expect Node.js streams.\n *\n * @param stream - The stream to convert.\n * @returns The given stream as a Node.js Readable stream.\n */\nfunction getNodeStream(stream: ReadableStream): Readable {\n  if (typeof stream.getReader !== 'function') {\n    return stream as unknown as Readable;\n  }\n\n  return new ReadableWebToNodeStream(stream);\n}\n\n/**\n * Creates a `tar-stream` that will get the necessary files from an npm Snap\n * package tarball (`.tgz` file).\n *\n * @param canonicalBase - A base URI as specified in {@link https://github.com/MetaMask/SIPs/blob/main/SIPS/sip-8.md SIP-8}. Starting with 'npm:'. Will be used for canonicalPath vfile argument.\n * @param files - An object to write target file contents to.\n * @returns The {@link Writable} tarball extraction stream.\n */\nfunction createTarballStream(\n  canonicalBase: string,\n  files: Map<string, VirtualFile>,\n): Writable {\n  assert(\n    canonicalBase.endsWith('/'),\n    \"Base needs to end with '/' for relative paths to be added as children instead of siblings.\",\n  );\n\n  assert(\n    canonicalBase.startsWith('npm:'),\n    'Protocol mismatch, expected \"npm:\".',\n  );\n  // `tar-stream` is pretty old-school, so we create it first and then\n  // instrument it by adding event listeners.\n  const extractStream = tarExtract();\n\n  let totalSize = 0;\n\n  // \"entry\" is fired for every discreet entity in the tarball. This includes\n  // files and folders.\n  extractStream.on('entry', (header, entryStream, next) => {\n    const { name: headerName, type: headerType } = header;\n    if (headerType === 'file') {\n      // The name is a path if the header type is \"file\".\n      const path = headerName.replace(NPM_TARBALL_PATH_PREFIX, '');\n      return entryStream.pipe(\n        concat((data) => {\n          try {\n            totalSize += data.byteLength;\n            // To prevent zip bombs, we set a safety limit for the total size of tarballs.\n            assert(\n              totalSize < TARBALL_SIZE_SAFETY_LIMIT,\n              `Snap tarball exceeds limit of ${TARBALL_SIZE_SAFETY_LIMIT} bytes.`,\n            );\n            const vfile = new VirtualFile({\n              value: data,\n              path,\n              data: {\n                canonicalPath: new URL(path, canonicalBase).toString(),\n              },\n            });\n            // We disallow files having identical paths as it may confuse our checksum calculations.\n            assert(\n              !files.has(path),\n              'Malformed tarball, multiple files with the same path.',\n            );\n            files.set(path, vfile);\n            return next();\n          } catch (error) {\n            return extractStream.destroy(error);\n          }\n        }),\n      );\n    }\n\n    // If we get here, the entry is not a file, and we want to ignore. The entry\n    // stream must be drained, or the extractStream will stop reading. This is\n    // effectively a no-op for the current entry.\n    entryStream.on('end', () => next());\n    return entryStream.resume();\n  });\n  return extractStream;\n}\n"]}
+{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../../src/snaps/location/npm.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,uDAS+B;AAC/B,2CAOyB;AACzB,kEAAmC;AACnC,gEAA8C;AAC9C,gDAAwB;AACxB,6EAAsE;AAEtE,2CAAmD;AAInD,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;AAsB1D,MAAa,WAAW;IAOtB,YAAY,GAAQ,EAAE,OAAkC,EAAE;;QACxD,MAAM,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,IAAI,KAAK,CAAC;QAClE,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtE,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,IAAI,4CAA8B,CAAC;QAE3E,IAAA,oBAAY,EAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,6BAAe,EAAE,mBAAmB,CAAC,CAAC;QAEnE,IAAI,QAAsB,CAAC;QAC3B,IACE,GAAG,CAAC,IAAI,KAAK,EAAE;YACf,GAAG,CAAC,IAAI,KAAK,EAAE;YACf,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,QAAQ,KAAK,EAAE,EACnB;YACA,QAAQ,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAC;SAC1C;aAAM;YACL,QAAQ,GAAG,UAAU,CAAC;YACtB,IAAI,GAAG,CAAC,QAAQ,EAAE;gBAChB,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC;gBACzB,IAAI,GAAG,CAAC,QAAQ,EAAE;oBAChB,QAAQ,IAAI,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;iBAChC;gBACD,QAAQ,IAAI,GAAG,CAAC;aACjB;YACD,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC;YACrB,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,IAAA,cAAM,EACJ,qBAAqB,EACrB,IAAI,SAAS,CACX,qDAAqD,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAC7E,CACF,CAAC;SACH;QAED,IAAA,cAAM,EACJ,QAAQ,CAAC,QAAQ,KAAK,GAAG;YACvB,QAAQ,CAAC,MAAM,KAAK,EAAE;YACtB,QAAQ,CAAC,IAAI,KAAK,EAAE,CACvB,CAAC;QAEF,IAAA,cAAM,EACJ,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAC3C,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAC5D,CAAC;QACF,IAAI,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC/B,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;YAC/B,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACpC;QAED,IAAI,CAAC,IAAI,GAAG;YACV,cAAc;YACd,QAAQ;YACR,WAAW;YACX,KAAK,EAAE,aAAa;SACrB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,iBAAiB,EAAE;YAC1B,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;SACvC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5C,KAAK,CAAC,MAAM,GAAG,IAAA,gCAAkB,EAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,iBAAiB,GAAG,KAAkC,CAAC;QAE5D,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY;QACtB,MAAM,YAAY,GAAG,IAAA,+BAAiB,EAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE;YACf,MAAM,uBAAA,IAAI,qDAAU,MAAd,IAAI,CAAY,CAAC;YACvB,IAAA,cAAM,EAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;SAClC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAA,cAAM,EACJ,KAAK,KAAK,SAAS,EACnB,IAAI,SAAS,CAAC,SAAS,IAAI,yBAAyB,CAAC,CACtD,CAAC;QACF,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;IAC/B,CAAC;IAED,IAAI,OAAO;QACT,IAAA,cAAM,EACJ,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,EAC/B,6DAA6D,CAC9D,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;IAC3B,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC5B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;IAClC,CAAC;CA0CF;AAvJD,kCAuJC;gEAxCC,KAAK;IACH,IAAA,cAAM,EAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,EAAE,aAAa,CAAC,GAAG,MAAM,eAAe,CAC5D,IAAI,CAAC,IAAI,CAAC,WAAW,EACrB,IAAI,CAAC,IAAI,CAAC,cAAc,EACxB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAClB,IAAI,CAAC,IAAI,CAAC,KAAK,CAChB,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC;IAElC,IAAI,aAAa,GAAG,QAAQ,CAAC;IAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,EAAE,EAAE;QACtC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7C,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,EAAE,EAAE;YACtC,aAAa,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;SACpD;QACD,aAAa,IAAI,GAAG,CAAC;KACtB;IACD,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAEzC,gFAAgF;IAChF,kHAAkH;IAClH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,IAAA,cAAI,EACF,aAAa,CAAC,eAAe,CAAC;QAC9B,4EAA4E;QAC5E,iDAAiD;QACjD,+EAA+E;QAC/E,IAAA,sBAAkB,EAAC,CAAC,CAAC,EACrB,mBAAmB,CACjB,GAAG,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,EAC5C,IAAI,CAAC,KAAK,CACX,EACD,CAAC,KAAK,EAAE,EAAE;YACR,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACpC,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAGH,6CAA6C;AAC7C,MAAM,yBAAyB,GAAG,SAAS,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,eAAe,CAC5B,WAAmB,EACnB,YAAyB,EACzB,WAAyB,EACzB,aAA2B;IAE3B,MAAM,eAAe,GAAG,MAAM,aAAa,CACzC,IAAI,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAC7C,CAAC;IACF,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE;QACvB,MAAM,IAAI,KAAK,CACb,oDAAoD,eAAe,CAAC,MAAM,GAAG,CAC9E,CAAC;KACH;IACD,MAAM,eAAe,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,CAAC;IAErD,IAAI,CAAC,IAAA,gBAAQ,EAAC,eAAe,CAAC,EAAE;QAC9B,MAAM,IAAI,KAAK,CACb,4BAA4B,WAAW,sBAAsB,CAC9D,CAAC;KACH;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAE,eAAuB,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CACxE,CAAC,OAAO,EAAE,EAAE;QACV,IAAA,6BAAqB,EAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;IAEF,MAAM,aAAa,GAAG,IAAA,8BAAgB,EAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAE/D,IAAI,aAAa,KAAK,IAAI,EAAE;QAC1B,MAAM,IAAI,KAAK,CACb,kEAAkE,WAAW,iCAAiC,YAAY,IAAI,CAC/H,CAAC;KACH;IAED,MAAM,gBAAgB,GAAI,eAAuB,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC;QAC1E,EAAE,IAAI,EAAE,OAAO,CAAC;IAElB,IACE,CAAC,IAAA,wBAAU,EAAC,gBAAgB,CAAC;QAC7B,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC7C;QACA,MAAM,IAAI,KAAK,CACb,iEAAiE,WAAW,IAAI,CACjF,CAAC;KACH;IAED,4EAA4E;IAC5E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAChD,aAAa,CAAC,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;IACjD,aAAa,CAAC,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;IAEjD,kEAAkE;IAClE,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE;QAChD,MAAM,IAAI,KAAK,CAAC,wCAAwC,WAAW,IAAI,CAAC,CAAC;KAC1E;IACD,2FAA2F;IAC3F,MAAM,iBAAiB,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACxE,IAAA,cAAM,EAAC,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,QAAQ,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IACpD,IAAA,cAAM,EACJ,WAAW,IAAI,yBAAyB,EACxC,iCAAiC,CAClC,CAAC;IACF,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAE9C;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,MAAsB;IAC3C,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,EAAE;QAC1C,OAAO,MAA6B,CAAC;KACtC;IAED,OAAO,IAAI,qDAAuB,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,aAAqB,EACrB,KAA+B;IAE/B,IAAA,cAAM,EACJ,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC3B,4FAA4F,CAC7F,CAAC;IAEF,IAAA,cAAM,EACJ,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,EAChC,qCAAqC,CACtC,CAAC;IACF,oEAAoE;IACpE,2CAA2C;IAC3C,MAAM,aAAa,GAAG,IAAA,oBAAU,GAAE,CAAC;IAEnC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,2EAA2E;IAC3E,qBAAqB;IACrB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;QACtD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;QACtD,IAAI,UAAU,KAAK,MAAM,EAAE;YACzB,mDAAmD;YACnD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;YAC7D,OAAO,WAAW,CAAC,IAAI,CACrB,IAAA,uBAAM,EAAC,CAAC,IAAI,EAAE,EAAE;gBACd,IAAI;oBACF,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC;oBAC7B,8EAA8E;oBAC9E,IAAA,cAAM,EACJ,SAAS,GAAG,yBAAyB,EACrC,iCAAiC,yBAAyB,SAAS,CACpE,CAAC;oBACF,MAAM,KAAK,GAAG,IAAI,yBAAW,CAAC;wBAC5B,KAAK,EAAE,IAAI;wBACX,IAAI;wBACJ,IAAI,EAAE;4BACJ,aAAa,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE;yBACvD;qBACF,CAAC,CAAC;oBACH,wFAAwF;oBACxF,IAAA,cAAM,EACJ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAChB,uDAAuD,CACxD,CAAC;oBACF,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBACvB,OAAO,IAAI,EAAE,CAAC;iBACf;gBAAC,OAAO,KAAK,EAAE;oBACd,OAAO,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;iBACrC;YACH,CAAC,CAAC,CACH,CAAC;SACH;QAED,4EAA4E;QAC5E,0EAA0E;QAC1E,6CAA6C;QAC7C,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACpC,OAAO,WAAW,CAAC,MAAM,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,OAAO,aAAa,CAAC;AACvB,CAAC","sourcesContent":["import {\n  createSnapManifest,\n  DEFAULT_REQUESTED_SNAP_VERSION,\n  getTargetVersion,\n  isValidUrl,\n  NpmSnapIdStruct,\n  SnapManifest,\n  VirtualFile,\n  normalizeRelative,\n} from '@metamask/snaps-utils';\nimport {\n  assert,\n  assertIsSemVerVersion,\n  assertStruct,\n  isObject,\n  SemVerRange,\n  SemVerVersion,\n} from '@metamask/utils';\nimport concat from 'concat-stream';\nimport createGunzipStream from 'gunzip-maybe';\nimport pump from 'pump';\nimport { ReadableWebToNodeStream } from 'readable-web-to-node-stream';\nimport { Readable, Writable } from 'stream';\nimport { extract as tarExtract } from 'tar-stream';\n\nimport { DetectSnapLocationOptions, SnapLocation } from './location';\n\nconst DEFAULT_NPM_REGISTRY = 'https://registry.npmjs.org';\n\ninterface NpmMeta {\n  registry: URL;\n  packageName: string;\n  requestedRange: SemVerRange;\n  version?: string;\n  fetch: typeof fetch;\n}\nexport interface NpmOptions {\n  /**\n   * @default DEFAULT_REQUESTED_SNAP_VERSION\n   */\n  versionRange?: SemVerRange;\n  /**\n   * Whether to allow custom NPM registries outside of {@link DEFAULT_NPM_REGISTRY}.\n   *\n   * @default false\n   */\n  allowCustomRegistries?: boolean;\n}\n\nexport class NpmLocation implements SnapLocation {\n  private readonly meta: NpmMeta;\n\n  private validatedManifest?: VirtualFile<SnapManifest>;\n\n  private files?: Map<string, VirtualFile>;\n\n  constructor(url: URL, opts: DetectSnapLocationOptions = {}) {\n    const allowCustomRegistries = opts.allowCustomRegistries ?? false;\n    const fetchFunction = opts.fetch ?? globalThis.fetch.bind(globalThis);\n    const requestedRange = opts.versionRange ?? DEFAULT_REQUESTED_SNAP_VERSION;\n\n    assertStruct(url.toString(), NpmSnapIdStruct, 'Invalid Snap Id: ');\n\n    let registry: string | URL;\n    if (\n      url.host === '' &&\n      url.port === '' &&\n      url.username === '' &&\n      url.password === ''\n    ) {\n      registry = new URL(DEFAULT_NPM_REGISTRY);\n    } else {\n      registry = 'https://';\n      if (url.username) {\n        registry += url.username;\n        if (url.password) {\n          registry += `:${url.password}`;\n        }\n        registry += '@';\n      }\n      registry += url.host;\n      registry = new URL(registry);\n      assert(\n        allowCustomRegistries,\n        new TypeError(\n          `Custom NPM registries are disabled, tried to use \"${registry.toString()}\".`,\n        ),\n      );\n    }\n\n    assert(\n      registry.pathname === '/' &&\n        registry.search === '' &&\n        registry.hash === '',\n    );\n\n    assert(\n      url.pathname !== '' && url.pathname !== '/',\n      new TypeError('The package name in NPM location is empty.'),\n    );\n    let packageName = url.pathname;\n    if (packageName.startsWith('/')) {\n      packageName = packageName.slice(1);\n    }\n\n    this.meta = {\n      requestedRange,\n      registry,\n      packageName,\n      fetch: fetchFunction,\n    };\n  }\n\n  async manifest(): Promise<VirtualFile<SnapManifest>> {\n    if (this.validatedManifest) {\n      return this.validatedManifest.clone();\n    }\n\n    const vfile = await this.fetch('snap.manifest.json');\n    const result = JSON.parse(vfile.toString());\n    vfile.result = createSnapManifest(result);\n    this.validatedManifest = vfile as VirtualFile<SnapManifest>;\n\n    return this.manifest();\n  }\n\n  async fetch(path: string): Promise<VirtualFile> {\n    const relativePath = normalizeRelative(path);\n    if (!this.files) {\n      await this.#lazyInit();\n      assert(this.files !== undefined);\n    }\n    const vfile = this.files.get(relativePath);\n    assert(\n      vfile !== undefined,\n      new TypeError(`File \"${path}\" not found in package.`),\n    );\n    return vfile.clone();\n  }\n\n  get packageName(): string {\n    return this.meta.packageName;\n  }\n\n  get version(): string {\n    assert(\n      this.meta.version !== undefined,\n      'Tried to access version without first fetching NPM package.',\n    );\n    return this.meta.version;\n  }\n\n  get registry(): URL {\n    return this.meta.registry;\n  }\n\n  get versionRange(): SemVerRange {\n    return this.meta.requestedRange;\n  }\n\n  async #lazyInit() {\n    assert(this.files === undefined);\n    const [tarballResponse, actualVersion] = await fetchNpmTarball(\n      this.meta.packageName,\n      this.meta.requestedRange,\n      this.meta.registry,\n      this.meta.fetch,\n    );\n    this.meta.version = actualVersion;\n\n    let canonicalBase = 'npm://';\n    if (this.meta.registry.username !== '') {\n      canonicalBase += this.meta.registry.username;\n      if (this.meta.registry.password !== '') {\n        canonicalBase += `:${this.meta.registry.password}`;\n      }\n      canonicalBase += '@';\n    }\n    canonicalBase += this.meta.registry.host;\n\n    // TODO(ritave): Lazily extract files instead of up-front extracting all of them\n    //               We would need to replace tar-stream package because it requires immediate consumption of streams.\n    await new Promise<void>((resolve, reject) => {\n      this.files = new Map();\n      pump(\n        getNodeStream(tarballResponse),\n        // The \"gz\" in \"tgz\" stands for \"gzip\". The tarball needs to be decompressed\n        // before we can actually grab any files from it.\n        // To prevent recursion-based zip bombs, we set a maximum recursion depth of 1.\n        createGunzipStream(1),\n        createTarballStream(\n          `${canonicalBase}/${this.meta.packageName}/`,\n          this.files,\n        ),\n        (error) => {\n          error ? reject(error) : resolve();\n        },\n      );\n    });\n  }\n}\n\n// Safety limit for tarballs, 250 MB in bytes\nconst TARBALL_SIZE_SAFETY_LIMIT = 262144000;\n\n/**\n * Fetches the tarball (`.tgz` file) of the specified package and version from\n * the public npm registry. Throws an error if fetching fails.\n *\n * @param packageName - The name of the package whose tarball to fetch.\n * @param versionRange - The SemVer range of the package to fetch. The highest\n * version satisfying the range will be fetched.\n * @param registryUrl - The URL of the npm registry to fetch the tarball from.\n * @param fetchFunction - The fetch function to use. Defaults to the global\n * {@link fetch}. Useful for Node.js compatibility.\n * @returns A tuple of the {@link Response} for the package tarball and the\n * actual version of the package.\n */\nasync function fetchNpmTarball(\n  packageName: string,\n  versionRange: SemVerRange,\n  registryUrl: URL | string,\n  fetchFunction: typeof fetch,\n): Promise<[ReadableStream, SemVerVersion]> {\n  const packageResponse = await fetchFunction(\n    new URL(packageName, registryUrl).toString(),\n  );\n  if (!packageResponse.ok) {\n    throw new Error(\n      `Failed to fetch NPM registry entry. Status code: ${packageResponse.status}.`,\n    );\n  }\n  const packageMetadata = await packageResponse.json();\n\n  if (!isObject(packageMetadata)) {\n    throw new Error(\n      `Failed to fetch package \"${packageName}\" metadata from npm.`,\n    );\n  }\n\n  const versions = Object.keys((packageMetadata as any)?.versions ?? {}).map(\n    (version) => {\n      assertIsSemVerVersion(version);\n      return version;\n    },\n  );\n\n  const targetVersion = getTargetVersion(versions, versionRange);\n\n  if (targetVersion === null) {\n    throw new Error(\n      `Failed to find a matching version in npm metadata for package \"${packageName}\" and requested semver range \"${versionRange}\".`,\n    );\n  }\n\n  const tarballUrlString = (packageMetadata as any)?.versions?.[targetVersion]\n    ?.dist?.tarball;\n\n  if (\n    !isValidUrl(tarballUrlString) ||\n    !tarballUrlString.toString().endsWith('.tgz')\n  ) {\n    throw new Error(\n      `Failed to find valid tarball URL in NPM metadata for package \"${packageName}\".`,\n    );\n  }\n\n  // Override the tarball hostname/protocol with registryUrl hostname/protocol\n  const newRegistryUrl = new URL(registryUrl);\n  const newTarballUrl = new URL(tarballUrlString);\n  newTarballUrl.hostname = newRegistryUrl.hostname;\n  newTarballUrl.protocol = newRegistryUrl.protocol;\n\n  // Perform a raw fetch because we want the Response object itself.\n  const tarballResponse = await fetchFunction(newTarballUrl.toString());\n  if (!tarballResponse.ok || !tarballResponse.body) {\n    throw new Error(`Failed to fetch tarball for package \"${packageName}\".`);\n  }\n  // We assume that NPM is a good actor and provides us with a valid `content-length` header.\n  const tarballSizeString = tarballResponse.headers.get('content-length');\n  assert(tarballSizeString, 'Snap tarball has invalid content-length');\n  const tarballSize = parseInt(tarballSizeString, 10);\n  assert(\n    tarballSize <= TARBALL_SIZE_SAFETY_LIMIT,\n    'Snap tarball exceeds size limit',\n  );\n  return [tarballResponse.body, targetVersion];\n}\n\n/**\n * The paths of files within npm tarballs appear to always be prefixed with\n * \"package/\".\n */\nconst NPM_TARBALL_PATH_PREFIX = /^package\\//u;\n\n/**\n * Converts a {@link ReadableStream} to a Node.js {@link Readable}\n * stream. Returns the stream directly if it is already a Node.js stream.\n * We can't use the native Web {@link ReadableStream} directly because the\n * other stream libraries we use expect Node.js streams.\n *\n * @param stream - The stream to convert.\n * @returns The given stream as a Node.js Readable stream.\n */\nfunction getNodeStream(stream: ReadableStream): Readable {\n  if (typeof stream.getReader !== 'function') {\n    return stream as unknown as Readable;\n  }\n\n  return new ReadableWebToNodeStream(stream);\n}\n\n/**\n * Creates a `tar-stream` that will get the necessary files from an npm Snap\n * package tarball (`.tgz` file).\n *\n * @param canonicalBase - A base URI as specified in {@link https://github.com/MetaMask/SIPs/blob/main/SIPS/sip-8.md SIP-8}. Starting with 'npm:'. Will be used for canonicalPath vfile argument.\n * @param files - An object to write target file contents to.\n * @returns The {@link Writable} tarball extraction stream.\n */\nfunction createTarballStream(\n  canonicalBase: string,\n  files: Map<string, VirtualFile>,\n): Writable {\n  assert(\n    canonicalBase.endsWith('/'),\n    \"Base needs to end with '/' for relative paths to be added as children instead of siblings.\",\n  );\n\n  assert(\n    canonicalBase.startsWith('npm:'),\n    'Protocol mismatch, expected \"npm:\".',\n  );\n  // `tar-stream` is pretty old-school, so we create it first and then\n  // instrument it by adding event listeners.\n  const extractStream = tarExtract();\n\n  let totalSize = 0;\n\n  // \"entry\" is fired for every discreet entity in the tarball. This includes\n  // files and folders.\n  extractStream.on('entry', (header, entryStream, next) => {\n    const { name: headerName, type: headerType } = header;\n    if (headerType === 'file') {\n      // The name is a path if the header type is \"file\".\n      const path = headerName.replace(NPM_TARBALL_PATH_PREFIX, '');\n      return entryStream.pipe(\n        concat((data) => {\n          try {\n            totalSize += data.byteLength;\n            // To prevent zip bombs, we set a safety limit for the total size of tarballs.\n            assert(\n              totalSize < TARBALL_SIZE_SAFETY_LIMIT,\n              `Snap tarball exceeds limit of ${TARBALL_SIZE_SAFETY_LIMIT} bytes.`,\n            );\n            const vfile = new VirtualFile({\n              value: data,\n              path,\n              data: {\n                canonicalPath: new URL(path, canonicalBase).toString(),\n              },\n            });\n            // We disallow files having identical paths as it may confuse our checksum calculations.\n            assert(\n              !files.has(path),\n              'Malformed tarball, multiple files with the same path.',\n            );\n            files.set(path, vfile);\n            return next();\n          } catch (error) {\n            return extractStream.destroy(error);\n          }\n        }),\n      );\n    }\n\n    // If we get here, the entry is not a file, and we want to ignore. The entry\n    // stream must be drained, or the extractStream will stop reading. This is\n    // effectively a no-op for the current entry.\n    entryStream.on('end', () => next());\n    return entryStream.resume();\n  });\n  return extractStream;\n}\n"]}

package/dist/snaps/registry/json.js

@@ -44,9 +44,8 @@ class JsonSnapsRegistry {
      * verified.
      */
     async getMetadata(snapId) {
-        var _a, _b;
         const database = await __classPrivateFieldGet(this, _JsonSnapsRegistry_instances, "m", _JsonSnapsRegistry_getDatabase).call(this);
-        return (_b = (_a = database === null || database === void 0 ? void 0 : database.verifiedSnaps[snapId]) === null || _a === void 0 ? void 0 : _a.metadata) !== null && _b !== void 0 ? _b : null;
+        return database?.verifiedSnaps[snapId]?.metadata ?? null;
     }
 }
 exports.JsonSnapsRegistry = JsonSnapsRegistry;
@@ -60,7 +59,7 @@ _JsonSnapsRegistry_url = new WeakMap(), _JsonSnapsRegistry_database = new WeakMa
             }
             __classPrivateFieldSet(this, _JsonSnapsRegistry_database, await response.json(), "f");
         }
-        catch (_a) {
+        catch {
             // Ignore
         }
     }
@@ -70,9 +69,8 @@ _JsonSnapsRegistry_url = new WeakMap(), _JsonSnapsRegistry_database = new WeakMa
     }
     return __classPrivateFieldGet(this, _JsonSnapsRegistry_database, "f");
 }, _JsonSnapsRegistry_getSingle = async function _JsonSnapsRegistry_getSingle(snapId, snapInfo) {
-    var _a;
     const database = await __classPrivateFieldGet(this, _JsonSnapsRegistry_instances, "m", _JsonSnapsRegistry_getDatabase).call(this);
-    const blockedEntry = database === null || database === void 0 ? void 0 : database.blockedSnaps.find((blocked) => {
+    const blockedEntry = database?.blockedSnaps.find((blocked) => {
         if ('id' in blocked) {
             return (blocked.id === snapId &&
                 (0, utils_1.satisfiesVersionRange)(snapInfo.version, blocked.versionRange));
@@ -85,8 +83,8 @@ _JsonSnapsRegistry_url = new WeakMap(), _JsonSnapsRegistry_database = new WeakMa
             reason: blockedEntry.reason,
         };
     }
-    const verified = database === null || database === void 0 ? void 0 : database.verifiedSnaps[snapId];
-    const version = (_a = verified === null || verified === void 0 ? void 0 : verified.versions) === null || _a === void 0 ? void 0 : _a[snapInfo.version];
+    const verified = database?.verifiedSnaps[snapId];
+    const version = verified?.versions?.[snapInfo.version];
     if (version && version.checksum === snapInfo.checksum) {
         return { status: registry_1.SnapsRegistryStatus.Verified };
     }

package/dist/snaps/registry/json.js.map

@@ -1 +1 @@
-{"version":3,"file":"json.js","sourceRoot":"","sources":["../../../src/snaps/registry/json.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAEA,2CAAwD;AAExD,yCAOoB;AAEpB,kCAAkC;AAClC,MAAM,iBAAiB,GACrB,4EAA4E,CAAC;AAQ/E,MAAa,iBAAiB;IAS5B,YAAY,EACV,GAAG,GAAG,iBAAiB,EACvB,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EACjD,yBAAyB,GAAG,IAAI,MACP,EAAE;;QAZ7B,yCAAa;QAEb,sCAA0C,IAAI,EAAC;QAE/C,mDAA6B;QAE7B,+DAAoC;QAOlC,uBAAA,IAAI,0BAAQ,GAAG,MAAA,CAAC;QAChB,uBAAA,IAAI,oCAAkB,aAAa,MAAA,CAAC;QACpC,uBAAA,IAAI,gDAA8B,yBAAyB,MAAA,CAAC;IAC9D,CAAC;IAmDM,KAAK,CAAC,GAAG,CACd,KAA2B;QAE3B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAEjC,KAAK,EAAE,eAAe,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE;YAC9C,MAAM,MAAM,GAAG,MAAM,uBAAA,IAAI,kEAAW,MAAf,IAAI,EAAY,MAAM,EAAE,QAAQ,CAAC,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;YACrB,OAAO,GAAG,CAAC;QACb,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,WAAW,CACtB,MAAc;;QAEd,MAAM,QAAQ,GAAG,MAAM,uBAAA,IAAI,oEAAa,MAAjB,IAAI,CAAe,CAAC;QAC3C,OAAO,MAAA,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,aAAa,CAAC,MAAM,CAAC,0CAAE,QAAQ,mCAAI,IAAI,CAAC;IAC3D,CAAC;CACF;AA9FD,8CA8FC;oRA3EC,KAAK;IACH,IAAI,uBAAA,IAAI,mCAAU,KAAK,IAAI,EAAE;QAC3B,0DAA0D;QAC1D,IAAI;YACF,MAAM,QAAQ,GAAG,MAAM,uBAAA,IAAI,wCAAe,MAAnB,IAAI,EAAgB,uBAAA,IAAI,8BAAK,CAAC,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAChB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;aACpD;YACD,uBAAA,IAAI,+BAAa,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAA,CAAC;SACxC;QAAC,WAAM;YACN,SAAS;SACV;KACF;IACD,0DAA0D;IAC1D,IAAI,uBAAA,IAAI,oDAA2B,IAAI,uBAAA,IAAI,mCAAU,KAAK,IAAI,EAAE;QAC9D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;KACzE;IACD,OAAO,uBAAA,IAAI,mCAAU,CAAC;AACxB,CAAC,iCAED,KAAK,uCAAY,MAAc,EAAE,QAA2B;;IAC1D,MAAM,QAAQ,GAAG,MAAM,uBAAA,IAAI,oEAAa,MAAjB,IAAI,CAAe,CAAC;IAE3C,MAAM,YAAY,GAAG,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3D,IAAI,IAAI,IAAI,OAAO,EAAE;YACnB,OAAO,CACL,OAAO,CAAC,EAAE,KAAK,MAAM;gBACrB,IAAA,6BAAqB,EAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAC9D,CAAC;SACH;QAED,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,IAAI,YAAY,EAAE;QAChB,OAAO;YACL,MAAM,EAAE,8BAAmB,CAAC,OAAO;YACnC,MAAM,EAAE,YAAY,CAAC,MAAM;SAC5B,CAAC;KACH;IAED,MAAM,QAAQ,GAAG,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,QAAQ,0CAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE;QACrD,OAAO,EAAE,MAAM,EAAE,8BAAmB,CAAC,QAAQ,EAAE,CAAC;KACjD;IACD,OAAO,EAAE,MAAM,EAAE,8BAAmB,CAAC,UAAU,EAAE,CAAC;AACpD,CAAC","sourcesContent":["import { SnapsRegistryDatabase } from '@metamask/snaps-registry';\nimport { SnapId } from '@metamask/snaps-utils';\nimport { satisfiesVersionRange } from '@metamask/utils';\n\nimport {\n  SnapsRegistry,\n  SnapsRegistryInfo,\n  SnapsRegistryMetadata,\n  SnapsRegistryRequest,\n  SnapsRegistryResult,\n  SnapsRegistryStatus,\n} from './registry';\n\n// TODO: Replace with a Codefi URL\nconst SNAP_REGISTRY_URL =\n  'https://cdn.jsdelivr.net/gh/MetaMask/snaps-registry@main/src/registry.json';\n\nexport type JsonSnapsRegistryArgs = {\n  fetchFunction?: typeof fetch;\n  url?: string;\n  failOnUnavailableRegistry?: boolean;\n};\n\nexport class JsonSnapsRegistry implements SnapsRegistry {\n  #url: string;\n\n  #database: SnapsRegistryDatabase | null = null;\n\n  #fetchFunction: typeof fetch;\n\n  #failOnUnavailableRegistry: boolean;\n\n  constructor({\n    url = SNAP_REGISTRY_URL,\n    fetchFunction = globalThis.fetch.bind(globalThis),\n    failOnUnavailableRegistry = true,\n  }: JsonSnapsRegistryArgs = {}) {\n    this.#url = url;\n    this.#fetchFunction = fetchFunction;\n    this.#failOnUnavailableRegistry = failOnUnavailableRegistry;\n  }\n\n  async #getDatabase(): Promise<SnapsRegistryDatabase | null> {\n    if (this.#database === null) {\n      // TODO: Decide if we should persist this between sessions\n      try {\n        const response = await this.#fetchFunction(this.#url);\n        if (!response.ok) {\n          throw new Error('Failed to fetch Snaps registry.');\n        }\n        this.#database = await response.json();\n      } catch {\n        // Ignore\n      }\n    }\n    // If the database is still null and we require it, throw.\n    if (this.#failOnUnavailableRegistry && this.#database === null) {\n      throw new Error('Snaps registry is unavailable, installation blocked.');\n    }\n    return this.#database;\n  }\n\n  async #getSingle(snapId: SnapId, snapInfo: SnapsRegistryInfo) {\n    const database = await this.#getDatabase();\n\n    const blockedEntry = database?.blockedSnaps.find((blocked) => {\n      if ('id' in blocked) {\n        return (\n          blocked.id === snapId &&\n          satisfiesVersionRange(snapInfo.version, blocked.versionRange)\n        );\n      }\n\n      return blocked.checksum === snapInfo.checksum;\n    });\n\n    if (blockedEntry) {\n      return {\n        status: SnapsRegistryStatus.Blocked,\n        reason: blockedEntry.reason,\n      };\n    }\n\n    const verified = database?.verifiedSnaps[snapId];\n    const version = verified?.versions?.[snapInfo.version];\n    if (version && version.checksum === snapInfo.checksum) {\n      return { status: SnapsRegistryStatus.Verified };\n    }\n    return { status: SnapsRegistryStatus.Unverified };\n  }\n\n  public async get(\n    snaps: SnapsRegistryRequest,\n  ): Promise<Record<SnapId, SnapsRegistryResult>> {\n    return Object.entries(snaps).reduce<\n      Promise<Record<SnapId, SnapsRegistryResult>>\n    >(async (previousPromise, [snapId, snapInfo]) => {\n      const result = await this.#getSingle(snapId, snapInfo);\n      const acc = await previousPromise;\n      acc[snapId] = result;\n      return acc;\n    }, Promise.resolve({}));\n  }\n\n  /**\n   * Get metadata for the given snap ID.\n   *\n   * @param snapId - The ID of the snap to get metadata for.\n   * @returns The metadata for the given snap ID, or `null` if the snap is not\n   * verified.\n   */\n  public async getMetadata(\n    snapId: SnapId,\n  ): Promise<SnapsRegistryMetadata | null> {\n    const database = await this.#getDatabase();\n    return database?.verifiedSnaps[snapId]?.metadata ?? null;\n  }\n}\n"]}
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../../src/snaps/registry/json.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAEA,2CAAwD;AAExD,yCAOoB;AAEpB,kCAAkC;AAClC,MAAM,iBAAiB,GACrB,4EAA4E,CAAC;AAQ/E,MAAa,iBAAiB;IAS5B,YAAY,EACV,GAAG,GAAG,iBAAiB,EACvB,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EACjD,yBAAyB,GAAG,IAAI,MACP,EAAE;;QAZ7B,yCAAa;QAEb,sCAA0C,IAAI,EAAC;QAE/C,mDAA6B;QAE7B,+DAAoC;QAOlC,uBAAA,IAAI,0BAAQ,GAAG,MAAA,CAAC;QAChB,uBAAA,IAAI,oCAAkB,aAAa,MAAA,CAAC;QACpC,uBAAA,IAAI,gDAA8B,yBAAyB,MAAA,CAAC;IAC9D,CAAC;IAmDM,KAAK,CAAC,GAAG,CACd,KAA2B;QAE3B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAEjC,KAAK,EAAE,eAAe,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE;YAC9C,MAAM,MAAM,GAAG,MAAM,uBAAA,IAAI,kEAAW,MAAf,IAAI,EAAY,MAAM,EAAE,QAAQ,CAAC,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;YACrB,OAAO,GAAG,CAAC;QACb,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,WAAW,CACtB,MAAc;QAEd,MAAM,QAAQ,GAAG,MAAM,uBAAA,IAAI,oEAAa,MAAjB,IAAI,CAAe,CAAC;QAC3C,OAAO,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC;IAC3D,CAAC;CACF;AA9FD,8CA8FC;oRA3EC,KAAK;IACH,IAAI,uBAAA,IAAI,mCAAU,KAAK,IAAI,EAAE;QAC3B,0DAA0D;QAC1D,IAAI;YACF,MAAM,QAAQ,GAAG,MAAM,uBAAA,IAAI,wCAAe,MAAnB,IAAI,EAAgB,uBAAA,IAAI,8BAAK,CAAC,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAChB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;aACpD;YACD,uBAAA,IAAI,+BAAa,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAA,CAAC;SACxC;QAAC,MAAM;YACN,SAAS;SACV;KACF;IACD,0DAA0D;IAC1D,IAAI,uBAAA,IAAI,oDAA2B,IAAI,uBAAA,IAAI,mCAAU,KAAK,IAAI,EAAE;QAC9D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;KACzE;IACD,OAAO,uBAAA,IAAI,mCAAU,CAAC;AACxB,CAAC,iCAED,KAAK,uCAAY,MAAc,EAAE,QAA2B;IAC1D,MAAM,QAAQ,GAAG,MAAM,uBAAA,IAAI,oEAAa,MAAjB,IAAI,CAAe,CAAC;IAE3C,MAAM,YAAY,GAAG,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3D,IAAI,IAAI,IAAI,OAAO,EAAE;YACnB,OAAO,CACL,OAAO,CAAC,EAAE,KAAK,MAAM;gBACrB,IAAA,6BAAqB,EAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAC9D,CAAC;SACH;QAED,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,IAAI,YAAY,EAAE;QAChB,OAAO;YACL,MAAM,EAAE,8BAAmB,CAAC,OAAO;YACnC,MAAM,EAAE,YAAY,CAAC,MAAM;SAC5B,CAAC;KACH;IAED,MAAM,QAAQ,GAAG,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE;QACrD,OAAO,EAAE,MAAM,EAAE,8BAAmB,CAAC,QAAQ,EAAE,CAAC;KACjD;IACD,OAAO,EAAE,MAAM,EAAE,8BAAmB,CAAC,UAAU,EAAE,CAAC;AACpD,CAAC","sourcesContent":["import { SnapsRegistryDatabase } from '@metamask/snaps-registry';\nimport { SnapId } from '@metamask/snaps-utils';\nimport { satisfiesVersionRange } from '@metamask/utils';\n\nimport {\n  SnapsRegistry,\n  SnapsRegistryInfo,\n  SnapsRegistryMetadata,\n  SnapsRegistryRequest,\n  SnapsRegistryResult,\n  SnapsRegistryStatus,\n} from './registry';\n\n// TODO: Replace with a Codefi URL\nconst SNAP_REGISTRY_URL =\n  'https://cdn.jsdelivr.net/gh/MetaMask/snaps-registry@main/src/registry.json';\n\nexport type JsonSnapsRegistryArgs = {\n  fetchFunction?: typeof fetch;\n  url?: string;\n  failOnUnavailableRegistry?: boolean;\n};\n\nexport class JsonSnapsRegistry implements SnapsRegistry {\n  #url: string;\n\n  #database: SnapsRegistryDatabase | null = null;\n\n  #fetchFunction: typeof fetch;\n\n  #failOnUnavailableRegistry: boolean;\n\n  constructor({\n    url = SNAP_REGISTRY_URL,\n    fetchFunction = globalThis.fetch.bind(globalThis),\n    failOnUnavailableRegistry = true,\n  }: JsonSnapsRegistryArgs = {}) {\n    this.#url = url;\n    this.#fetchFunction = fetchFunction;\n    this.#failOnUnavailableRegistry = failOnUnavailableRegistry;\n  }\n\n  async #getDatabase(): Promise<SnapsRegistryDatabase | null> {\n    if (this.#database === null) {\n      // TODO: Decide if we should persist this between sessions\n      try {\n        const response = await this.#fetchFunction(this.#url);\n        if (!response.ok) {\n          throw new Error('Failed to fetch Snaps registry.');\n        }\n        this.#database = await response.json();\n      } catch {\n        // Ignore\n      }\n    }\n    // If the database is still null and we require it, throw.\n    if (this.#failOnUnavailableRegistry && this.#database === null) {\n      throw new Error('Snaps registry is unavailable, installation blocked.');\n    }\n    return this.#database;\n  }\n\n  async #getSingle(snapId: SnapId, snapInfo: SnapsRegistryInfo) {\n    const database = await this.#getDatabase();\n\n    const blockedEntry = database?.blockedSnaps.find((blocked) => {\n      if ('id' in blocked) {\n        return (\n          blocked.id === snapId &&\n          satisfiesVersionRange(snapInfo.version, blocked.versionRange)\n        );\n      }\n\n      return blocked.checksum === snapInfo.checksum;\n    });\n\n    if (blockedEntry) {\n      return {\n        status: SnapsRegistryStatus.Blocked,\n        reason: blockedEntry.reason,\n      };\n    }\n\n    const verified = database?.verifiedSnaps[snapId];\n    const version = verified?.versions?.[snapInfo.version];\n    if (version && version.checksum === snapInfo.checksum) {\n      return { status: SnapsRegistryStatus.Verified };\n    }\n    return { status: SnapsRegistryStatus.Unverified };\n  }\n\n  public async get(\n    snaps: SnapsRegistryRequest,\n  ): Promise<Record<SnapId, SnapsRegistryResult>> {\n    return Object.entries(snaps).reduce<\n      Promise<Record<SnapId, SnapsRegistryResult>>\n    >(async (previousPromise, [snapId, snapInfo]) => {\n      const result = await this.#getSingle(snapId, snapInfo);\n      const acc = await previousPromise;\n      acc[snapId] = result;\n      return acc;\n    }, Promise.resolve({}));\n  }\n\n  /**\n   * Get metadata for the given snap ID.\n   *\n   * @param snapId - The ID of the snap to get metadata for.\n   * @returns The metadata for the given snap ID, or `null` if the snap is not\n   * verified.\n   */\n  public async getMetadata(\n    snapId: SnapId,\n  ): Promise<SnapsRegistryMetadata | null> {\n    const database = await this.#getDatabase();\n    return database?.verifiedSnaps[snapId]?.metadata ?? null;\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metamask/snaps-controllers",
-  "version": "0.29.0",
+  "version": "0.31.0",
   "description": "Controllers for MetaMask Snaps.",
   "repository": {
     "type": "git",
@@ -16,8 +16,9 @@
   ],
   "scripts": {
     "test:prepare": "yarn mkdirp test/fixtures && ./scripts/generate-fixtures.sh",
-    "test": "yarn test:prepare && jest && yarn posttest",
-    "posttest": "jest-it-up --margin 0.25",
+    "test": "rimraf coverage && yarn test:prepare && jest && yarn test:browser && yarn posttest",
+    "posttest": "ts-node scripts/coverage.ts && rimraf coverage/jest coverage/wdio",
+    "test:browser": "wdio run wdio.config.ts",
     "test:ci": "yarn test",
     "build:tsc": "tsc --project tsconfig.build.json",
     "build": "yarn build:tsc",
@@ -28,20 +29,22 @@
     "lint": "yarn lint:eslint && yarn lint:misc --check",
     "lint:fix": "yarn lint:eslint --fix && yarn lint:misc --write",
     "lint:changelog": "yarn auto-changelog validate",
+    "prepare-manifest:preview": "../../scripts/prepare-preview-manifest.sh",
+    "publish:preview": "yarn npm publish --tag preview",
     "publish:package": "../../scripts/publish-package.sh"
   },
   "dependencies": {
-    "@metamask/approval-controller": "^1.1.0",
-    "@metamask/base-controller": "^1.1.2",
+    "@metamask/approval-controller": "^2.0.0",
+    "@metamask/base-controller": "^2.0.0",
     "@metamask/object-multiplex": "^1.1.0",
-    "@metamask/permission-controller": "^2.0.0",
+    "@metamask/permission-controller": "^3.0.0",
     "@metamask/post-message-stream": "^6.1.0",
-    "@metamask/rpc-methods": "^0.29.0",
-    "@metamask/snaps-execution-environments": "^0.29.0",
-    "@metamask/snaps-registry": "^1.1.0",
-    "@metamask/snaps-utils": "^0.29.0",
-    "@metamask/subject-metadata-controller": "^1.0.1",
-    "@metamask/utils": "^3.4.1",
+    "@metamask/rpc-methods": "^0.31.0",
+    "@metamask/snaps-execution-environments": "^0.31.0",
+    "@metamask/snaps-registry": "^1.1.1",
+    "@metamask/snaps-utils": "^0.31.0",
+    "@metamask/subject-metadata-controller": "^2.0.0",
+    "@metamask/utils": "^5.0.0",
     "@xstate/fsm": "^2.0.0",
     "concat-stream": "^2.0.0",
     "cron-parser": "^4.5.0",
@@ -56,6 +59,8 @@
     "tar-stream": "^2.2.0"
   },
   "devDependencies": {
+    "@esbuild-plugins/node-globals-polyfill": "^0.2.3",
+    "@esbuild-plugins/node-modules-polyfill": "^0.2.2",
     "@lavamoat/allow-scripts": "^2.0.3",
     "@metamask/auto-changelog": "^3.1.0",
     "@metamask/eslint-config": "^11.0.0",
@@ -67,11 +72,18 @@
     "@types/concat-stream": "^2.0.0",
     "@types/gunzip-maybe": "^1.4.0",
     "@types/jest": "^27.5.1",
+    "@types/mocha": "^10.0.1",
     "@types/pump": "^1.1.1",
     "@types/readable-stream": "^2.3.9",
     "@types/tar-stream": "^2.2.2",
     "@typescript-eslint/eslint-plugin": "^5.42.1",
     "@typescript-eslint/parser": "^5.42.1",
+    "@wdio/browser-runner": "^8.3.10",
+    "@wdio/cli": "^8.3.10",
+    "@wdio/globals": "^8.3.10",
+    "@wdio/mocha-framework": "^8.3.0",
+    "@wdio/spec-reporter": "^8.3.0",
+    "@wdio/static-server-service": "^8.3.0",
     "deepmerge": "^4.2.2",
     "eslint": "^8.27.0",
     "eslint-config-prettier": "^8.5.0",
@@ -80,18 +92,26 @@
     "eslint-plugin-jsdoc": "^39.6.2",
     "eslint-plugin-node": "^11.1.0",
     "eslint-plugin-prettier": "^4.2.1",
+    "expect-webdriverio": "^4.1.2",
+    "istanbul-lib-coverage": "^3.2.0",
+    "istanbul-lib-report": "^3.0.0",
+    "istanbul-reports": "^3.1.5",
     "jest": "^29.0.2",
-    "jest-environment-jsdom": "^29.0.2",
     "jest-fetch-mock": "^3.0.3",
     "jest-it-up": "^2.0.0",
-    "jsdom": "^19.0.0",
     "mkdirp": "^1.0.4",
     "prettier": "^2.7.1",
     "prettier-plugin-packagejson": "^2.2.11",
     "rimraf": "^3.0.2",
     "serve-handler": "^6.1.5",
     "ts-jest": "^29.0.0",
-    "typescript": "~4.8.4"
+    "ts-node": "^10.9.1",
+    "typescript": "~4.8.4",
+    "vite": "^4.1.4",
+    "vite-tsconfig-paths": "^4.0.5",
+    "wdio-chromedriver-service": "^8.1.1",
+    "wdio-geckodriver-service": "^4.1.0",
+    "webdriverio": "^8.3.10"
   },
   "engines": {
     "node": ">=16.0.0"

package/dist/services/iframe/test/fixJSDOMPostMessageEventSource.d.ts

@@ -1,3 +0,0 @@
-import { IframeExecutionService } from '../IframeExecutionService';
-declare const fixJSDOMPostMessageEventSource: (iframeExecutionService: IframeExecutionService) => () => void;
-export default fixJSDOMPostMessageEventSource;

package/dist/services/iframe/test/fixJSDOMPostMessageEventSource.js

@@ -1,34 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-// Fix for JSDOM not setting `event.origin` or `event.source`: https://github.com/jsdom/jsdom/issues/2745
-const fixJSDOMPostMessageEventSource = (iframeExecutionService) => {
-    const listener = (event) => {
-        if (event.source === null && !event.origin) {
-            let source;
-            let origin;
-            if (event.data.target === 'child') {
-                source = window;
-                origin = window.location.origin;
-            }
-            else if (event.data.target === 'parent') {
-                // @ts-expect-error Accessing private property
-                const { worker } = iframeExecutionService.jobs.values().next().value;
-                source = worker;
-                origin = iframeExecutionService.iframeUrl.toString();
-            }
-            if (event.data.target) {
-                event.stopImmediatePropagation();
-                const args = Object.assign(Object.assign(Object.assign({}, event), { data: event.data, source,
-                    origin }));
-                const eventWithOrigin = new MessageEvent('message', args);
-                window.dispatchEvent(eventWithOrigin);
-            }
-        }
-    };
-    window.addEventListener('message', listener);
-    return () => {
-        window.removeEventListener('message', listener);
-    };
-};
-exports.default = fixJSDOMPostMessageEventSource;
-//# sourceMappingURL=fixJSDOMPostMessageEventSource.js.map

package/dist/services/iframe/test/fixJSDOMPostMessageEventSource.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"fixJSDOMPostMessageEventSource.js","sourceRoot":"","sources":["../../../../src/services/iframe/test/fixJSDOMPostMessageEventSource.ts"],"names":[],"mappings":";;AAEA,yGAAyG;AACzG,MAAM,8BAA8B,GAAG,CACrC,sBAA8C,EAC9C,EAAE;IACF,MAAM,QAAQ,GAAG,CAAC,KAAmB,EAAE,EAAE;QACvC,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAC1C,IAAI,MAAM,CAAC;YACX,IAAI,MAAM,CAAC;YACX,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE;gBACjC,MAAM,GAAG,MAAM,CAAC;gBAChB,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;aACjC;iBAAM,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE;gBACzC,8CAA8C;gBAC9C,MAAM,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;gBACrE,MAAM,GAAG,MAAM,CAAC;gBAChB,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;aACtD;YAED,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE;gBACrB,KAAK,CAAC,wBAAwB,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,iCACrB,KAAK,KACR,IAAI,EAAE,KAAK,CAAC,IAAI,EAChB,MAAM;oBACN,MAAM,IACN,CAAC;gBACH,MAAM,eAAe,GAAiB,IAAI,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBACxE,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;aACvC;SACF;IACH,CAAC,CAAC;IAEF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAE7C,OAAO,GAAG,EAAE;QACV,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,kBAAe,8BAA8B,CAAC","sourcesContent":["import { IframeExecutionService } from '../IframeExecutionService';\n\n// Fix for JSDOM not setting `event.origin` or `event.source`: https://github.com/jsdom/jsdom/issues/2745\nconst fixJSDOMPostMessageEventSource = (\n  iframeExecutionService: IframeExecutionService,\n) => {\n  const listener = (event: MessageEvent) => {\n    if (event.source === null && !event.origin) {\n      let source;\n      let origin;\n      if (event.data.target === 'child') {\n        source = window;\n        origin = window.location.origin;\n      } else if (event.data.target === 'parent') {\n        // @ts-expect-error Accessing private property\n        const { worker } = iframeExecutionService.jobs.values().next().value;\n        source = worker;\n        origin = iframeExecutionService.iframeUrl.toString();\n      }\n\n      if (event.data.target) {\n        event.stopImmediatePropagation();\n        const args = Object.assign({\n          ...event,\n          data: event.data,\n          source,\n          origin,\n        });\n        const eventWithOrigin: MessageEvent = new MessageEvent('message', args);\n        window.dispatchEvent(eventWithOrigin);\n      }\n    }\n  };\n\n  window.addEventListener('message', listener);\n\n  return () => {\n    window.removeEventListener('message', listener);\n  };\n};\n\nexport default fixJSDOMPostMessageEventSource;\n"]}