@metamask/snaps-controllers 0.30.0 → 0.32.0

package/dist/snaps/SnapController.js

@@ -10,20 +10,9 @@ var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
     return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
 };
-var __rest = (this && this.__rest) || function (s, e) {
-    var t = {};
-    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
-        t[p] = s[p];
-    if (s != null && typeof Object.getOwnPropertySymbols === "function")
-        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
-            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
-                t[p[i]] = s[p[i]];
-        }
-    return t;
-};
-var _SnapController_instances, _SnapController_closeAllConnections, _SnapController_environmentEndowmentPermissions, _SnapController_excludedPermissions, _SnapController_featureFlags, _SnapController_fetchFunction, _SnapController_idleTimeCheckInterval, _SnapController_registry, _SnapController_maxIdleTime, _SnapController_detectSnapLocation, _SnapController_rollbackSnapshots, _SnapController_timeoutForLastRequestStatus, _SnapController_statusMachine, _SnapController_initializeStateMachine, _SnapController_registerMessageHandlers, _SnapController_pollForLastRequestStatus, _SnapController_blockSnap, _SnapController_unblockSnap, _SnapController_assertIsInstallAllowed, _SnapController_stopSnapsLastRequestPastMax, _SnapController_transition, _SnapController_terminateSnap, _SnapController_removeSnapFromSubjects, _SnapController_add, _SnapController_startSnap, _SnapController_getEndowments, _SnapController_set, _SnapController_fetchSnap, _SnapController_processSnapPermissions, _SnapController_getRpcRequestHandler, _SnapController_executeWithTimeout, _SnapController_recordSnapRpcRequestStart, _SnapController_recordSnapRpcRequestFinish, _SnapController_getRollbackSnapshot, _SnapController_createRollbackSnapshot, _SnapController_rollbackSnap, _SnapController_rollbackSnaps, _SnapController_getRuntime, _SnapController_getRuntimeExpect, _SnapController_setupRuntime, _SnapController_calculatePermissionsChange, _SnapController_isValidUpdate;
+var _SnapController_instances, _SnapController_closeAllConnections, _SnapController_environmentEndowmentPermissions, _SnapController_excludedPermissions, _SnapController_featureFlags, _SnapController_fetchFunction, _SnapController_idleTimeCheckInterval, _SnapController_maxIdleTime, _SnapController_detectSnapLocation, _SnapController_rollbackSnapshots, _SnapController_timeoutForLastRequestStatus, _SnapController_statusMachine, _SnapController_initializeStateMachine, _SnapController_registerMessageHandlers, _SnapController_pollForLastRequestStatus, _SnapController_blockSnap, _SnapController_unblockSnap, _SnapController_assertIsInstallAllowed, _SnapController_stopSnapsLastRequestPastMax, _SnapController_transition, _SnapController_terminateSnap, _SnapController_removeSnapFromSubjects, _SnapController_createApproval, _SnapController_updateApproval, _SnapController_add, _SnapController_startSnap, _SnapController_getEndowments, _SnapController_set, _SnapController_fetchSnap, _SnapController_processSnapPermissions, _SnapController_validateSnapPermissions, _SnapController_getRpcRequestHandler, _SnapController_executeWithTimeout, _SnapController_recordSnapRpcRequestStart, _SnapController_recordSnapRpcRequestFinish, _SnapController_getRollbackSnapshot, _SnapController_createRollbackSnapshot, _SnapController_rollbackSnap, _SnapController_rollbackSnaps, _SnapController_getRuntime, _SnapController_getRuntimeExpect, _SnapController_setupRuntime, _SnapController_calculatePermissionsChange, _SnapController_isValidUpdate;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SnapController = exports.SNAP_APPROVAL_UPDATE = exports.SNAP_APPROVAL_INSTALL = exports.controllerName = void 0;
+exports.SnapController = exports.SNAP_APPROVAL_RESULT = exports.SNAP_APPROVAL_UPDATE = exports.SNAP_APPROVAL_INSTALL = exports.controllerName = void 0;
 const base_controller_1 = require("@metamask/base-controller");
 const rpc_methods_1 = require("@metamask/rpc-methods");
 const snaps_utils_1 = require("@metamask/snaps-utils");
@@ -45,6 +34,7 @@ exports.controllerName = 'SnapController';
 // TODO: Figure out how to name these
 exports.SNAP_APPROVAL_INSTALL = 'wallet_installSnap';
 exports.SNAP_APPROVAL_UPDATE = 'wallet_updateSnap';
+exports.SNAP_APPROVAL_RESULT = 'wallet_installSnapResult';
 const TRUNCATED_SNAP_PROPERTIES = new Set([
     'initialPermissions',
     'id',
@@ -81,8 +71,7 @@ const name = 'SnapController';
  * - Start: Initializes the snap in its SES realm with the authorized permissions.
  */
 class SnapController extends base_controller_1.BaseControllerV2 {
-    constructor({ closeAllConnections, messenger, state, environmentEndowmentPermissions = [], excludedPermissions = {}, idleTimeCheckInterval = (0, utils_1.inMilliseconds)(5, utils_1.Duration.Second), registry = new registry_1.JsonSnapsRegistry(), maxIdleTime = (0, utils_1.inMilliseconds)(30, utils_1.Duration.Second), maxRequestTime = (0, utils_1.inMilliseconds)(60, utils_1.Duration.Second), fetchFunction = globalThis.fetch.bind(globalThis), featureFlags = {}, detectSnapLocation: detectSnapLocationFunction = location_1.detectSnapLocation, }) {
-        var _a, _b;
+    constructor({ closeAllConnections, messenger, state, environmentEndowmentPermissions = [], excludedPermissions = {}, idleTimeCheckInterval = (0, utils_1.inMilliseconds)(5, utils_1.Duration.Second), maxIdleTime = (0, utils_1.inMilliseconds)(30, utils_1.Duration.Second), maxRequestTime = (0, utils_1.inMilliseconds)(60, utils_1.Duration.Second), fetchFunction = globalThis.fetch.bind(globalThis), featureFlags = {}, detectSnapLocation: detectSnapLocationFunction = location_1.detectSnapLocation, }) {
         super({
             messenger,
             metadata: {
@@ -103,9 +92,12 @@ class SnapController extends base_controller_1.BaseControllerV2 {
                     persist: (snaps) => {
                         return Object.values(snaps)
                             .map((snap) => {
-                            return Object.assign(Object.assign({}, snap), { sourceCode: __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_getRuntimeExpect).call(this, snap.id).sourceCode, 
+                            return {
+                                ...snap,
+                                sourceCode: __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_getRuntimeExpect).call(this, snap.id).sourceCode,
                                 // At the time state is rehydrated, no snap will be running.
-                                status: snaps_utils_1.SnapStatus.Stopped });
+                                status: snaps_utils_1.SnapStatus.Stopped,
+                            };
                         })
                             .reduce((memo, snap) => {
                             memo[snap.id] = snap;
@@ -116,12 +108,18 @@ class SnapController extends base_controller_1.BaseControllerV2 {
                 },
             },
             name,
-            state: Object.assign(Object.assign({}, defaultState), Object.assign(Object.assign({}, state), { snaps: Object.values((_a = state === null || state === void 0 ? void 0 : state.snaps) !== null && _a !== void 0 ? _a : {}).reduce((memo, snap) => {
-                    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-                    const { sourceCode } = snap, rest = __rest(snap, ["sourceCode"]);
-                    memo[snap.id] = rest;
-                    return memo;
-                }, {}) })),
+            state: {
+                ...defaultState,
+                ...{
+                    ...state,
+                    snaps: Object.values(state?.snaps ?? {}).reduce((memo, snap) => {
+                        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                        const { sourceCode, ...rest } = snap;
+                        memo[snap.id] = rest;
+                        return memo;
+                    }, {}),
+                },
+            },
         });
         _SnapController_instances.add(this);
         _SnapController_closeAllConnections.set(this, void 0);
@@ -130,7 +128,6 @@ class SnapController extends base_controller_1.BaseControllerV2 {
         _SnapController_featureFlags.set(this, void 0);
         _SnapController_fetchFunction.set(this, void 0);
         _SnapController_idleTimeCheckInterval.set(this, void 0);
-        _SnapController_registry.set(this, void 0);
         _SnapController_maxIdleTime.set(this, void 0);
         _SnapController_detectSnapLocation.set(this, void 0);
         _SnapController_rollbackSnapshots.set(this, void 0);
@@ -142,7 +139,6 @@ class SnapController extends base_controller_1.BaseControllerV2 {
         __classPrivateFieldSet(this, _SnapController_featureFlags, featureFlags, "f");
         __classPrivateFieldSet(this, _SnapController_fetchFunction, fetchFunction, "f");
         __classPrivateFieldSet(this, _SnapController_idleTimeCheckInterval, idleTimeCheckInterval, "f");
-        __classPrivateFieldSet(this, _SnapController_registry, registry, "f");
         __classPrivateFieldSet(this, _SnapController_maxIdleTime, maxIdleTime, "f");
         this.maxRequestTime = maxRequestTime;
         __classPrivateFieldSet(this, _SnapController_detectSnapLocation, detectSnapLocationFunction, "f");
@@ -159,13 +155,10 @@ class SnapController extends base_controller_1.BaseControllerV2 {
         /* eslint-enable @typescript-eslint/unbound-method */
         __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_initializeStateMachine).call(this);
         __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_registerMessageHandlers).call(this);
-        Object.values((_b = state === null || state === void 0 ? void 0 : state.snaps) !== null && _b !== void 0 ? _b : {}).forEach((snap) => {
-            var _a, _b;
-            return __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_setupRuntime).call(this, snap.id, {
-                sourceCode: snap.sourceCode,
-                state: (_b = (_a = state === null || state === void 0 ? void 0 : state.snapStates) === null || _a === void 0 ? void 0 : _a[snap.id]) !== null && _b !== void 0 ? _b : null,
-            });
-        });
+        Object.values(state?.snaps ?? {}).forEach((snap) => __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_setupRuntime).call(this, snap.id, {
+            sourceCode: snap.sourceCode,
+            state: state?.snapStates?.[snap.id] ?? null,
+        }));
     }
     /**
      * Checks all installed snaps against the block list and
@@ -173,7 +166,7 @@ class SnapController extends base_controller_1.BaseControllerV2 {
      * for more information.
      */
     async updateBlockedSnaps() {
-        const blockedSnaps = await __classPrivateFieldGet(this, _SnapController_registry, "f").get(Object.values(this.state.snaps).reduce((blockListArg, snap) => {
+        const blockedSnaps = await this.messagingSystem.call('SnapsRegistry:get', Object.values(this.state.snaps).reduce((blockListArg, snap) => {
             blockListArg[snap.id] = {
                 version: snap.version,
                 checksum: snap.manifest.source.shasum,
@@ -388,7 +381,10 @@ class SnapController extends base_controller_1.BaseControllerV2 {
     addSnapError(snapError) {
         this.update((state) => {
             const id = (0, nanoid_1.nanoid)();
-            state.snapErrors[id] = Object.assign(Object.assign({}, snapError), { internalID: id });
+            state.snapErrors[id] = {
+                ...snapError,
+                internalID: id,
+            };
         });
     }
     /**
@@ -419,7 +415,7 @@ class SnapController extends base_controller_1.BaseControllerV2 {
      */
     async getSnapState(snapId) {
         const { state } = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_getRuntimeExpect).call(this, snapId);
-        return state !== null && state !== void 0 ? state : null;
+        return state ?? null;
     }
     /**
      * Completely clear the controller's state: delete all associated data,
@@ -517,13 +513,12 @@ class SnapController extends base_controller_1.BaseControllerV2 {
      * @returns The serialized permitted snaps for the origin.
      */
     getPermittedSnaps(origin) {
-        var _a, _b, _c, _d, _e;
-        const permissions = (_a = this.messagingSystem.call('PermissionController:getPermissions', origin)) !== null && _a !== void 0 ? _a : {};
-        const snaps = (_e = (_d = (_c = (_b = permissions[rpc_methods_1.WALLET_SNAP_PERMISSION_KEY]) === null || _b === void 0 ? void 0 : _b.caveats) === null || _c === void 0 ? void 0 : _c.find((caveat) => caveat.type === snaps_utils_1.SnapCaveatType.SnapIds)) === null || _d === void 0 ? void 0 : _d.value) !== null && _e !== void 0 ? _e : {};
+        const permissions = this.messagingSystem.call('PermissionController:getPermissions', origin) ?? {};
+        const snaps = permissions[rpc_methods_1.WALLET_SNAP_PERMISSION_KEY]?.caveats?.find((caveat) => caveat.type === snaps_utils_1.SnapCaveatType.SnapIds)?.value ?? {};
         return Object.keys(snaps).reduce((permittedSnaps, snapId) => {
             const snap = this.get(snapId);
             const truncatedSnap = this.getTruncated(snapId);
-            if (truncatedSnap && (snap === null || snap === void 0 ? void 0 : snap.status) !== snaps_utils_1.SnapStatus.Installing) {
+            if (truncatedSnap && snap?.status !== snaps_utils_1.SnapStatus.Installing) {
                 permittedSnaps[snapId] = truncatedSnap;
             }
             return permittedSnaps;
@@ -542,22 +537,25 @@ class SnapController extends base_controller_1.BaseControllerV2 {
     async installSnaps(origin, requestedSnaps) {
         const result = {};
         const snapIds = Object.keys(requestedSnaps);
-        // Existing snaps may need to be updated
-        const pendingUpdates = snapIds.filter((snapId) => this.has(snapId));
-        // Non-existing snaps will need to be installed
-        const pendingInstalls = snapIds.filter((snapId) => !pendingUpdates.includes(snapId));
+        const pendingUpdates = [];
+        const pendingInstalls = [];
         try {
             for (const [snapId, { version: rawVersion }] of Object.entries(requestedSnaps)) {
+                (0, snaps_utils_1.assertIsValidSnapId)(snapId);
                 const [error, version] = (0, snaps_utils_1.resolveVersionRange)(rawVersion);
                 if (error) {
                     throw eth_rpc_errors_1.ethErrors.rpc.invalidParams(`The "version" field must be a valid SemVer version range if specified. Received: "${rawVersion}".`);
                 }
-                const permissions = this.messagingSystem.call('PermissionController:getPermissions', origin);
-                if (!(0, snaps_utils_1.isSnapPermitted)(permissions, snapId)) {
-                    throw eth_rpc_errors_1.ethErrors.provider.unauthorized(`Not authorized to install snap "${snapId}". Request the permission for the snap before attempting to install it.`);
-                }
-                const isUpdate = pendingUpdates.includes(snapId);
+                const location = __classPrivateFieldGet(this, _SnapController_detectSnapLocation, "f").call(this, snapId, {
+                    versionRange: version,
+                    fetch: __classPrivateFieldGet(this, _SnapController_fetchFunction, "f"),
+                    allowLocal: __classPrivateFieldGet(this, _SnapController_featureFlags, "f").allowLocalSnaps,
+                });
+                // Existing snaps may need to be updated, unless they should be re-installed (e.g. local snaps)
+                // Everything else is treated as an install
+                const isUpdate = this.has(snapId) && !location.shouldAlwaysReload;
                 if (isUpdate && __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_isValidUpdate).call(this, snapId, version)) {
+                    pendingUpdates.push(snapId);
                     let rollbackSnapshot = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_getRollbackSnapshot).call(this, snapId);
                     if (rollbackSnapshot === undefined) {
                         const prevSourceCode = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_getRuntimeExpect).call(this, snapId).sourceCode;
@@ -569,7 +567,10 @@ class SnapController extends base_controller_1.BaseControllerV2 {
                         throw new Error('This snap is already being updated.');
                     }
                 }
-                result[snapId] = await this.processRequestedSnap(origin, snapId, version);
+                else if (!isUpdate) {
+                    pendingInstalls.push(snapId);
+                }
+                result[snapId] = await this.processRequestedSnap(origin, snapId, location, version);
             }
             snapIds.forEach((snapId) => __classPrivateFieldGet(this, _SnapController_rollbackSnapshots, "f").delete(snapId));
         }
@@ -589,16 +590,11 @@ class SnapController extends base_controller_1.BaseControllerV2 {
      *
      * @param origin - The origin requesting the snap.
      * @param snapId - The id of the snap.
+     * @param location - The location implementation of the snap.
      * @param versionRange - The semver range of the snap to install.
      * @returns The resulting snap object, or an error if something went wrong.
      */
-    async processRequestedSnap(origin, snapId, versionRange) {
-        (0, snaps_utils_1.validateSnapId)(snapId);
-        const location = __classPrivateFieldGet(this, _SnapController_detectSnapLocation, "f").call(this, snapId, {
-            versionRange,
-            fetch: __classPrivateFieldGet(this, _SnapController_fetchFunction, "f"),
-            allowLocal: __classPrivateFieldGet(this, _SnapController_featureFlags, "f").allowLocalSnaps,
-        });
+    async processRequestedSnap(origin, snapId, location, versionRange) {
         const existingSnap = this.getTruncated(snapId);
         // For devX we always re-install local snaps.
         if (existingSnap && !location.shouldAlwaysReload) {
@@ -606,35 +602,55 @@ class SnapController extends base_controller_1.BaseControllerV2 {
                 return existingSnap;
             }
             if (__classPrivateFieldGet(this, _SnapController_featureFlags, "f").dappsCanUpdateSnaps === true) {
-                const updateResult = await this.updateSnap(origin, snapId, location, versionRange);
-                if (updateResult === null) {
-                    throw eth_rpc_errors_1.ethErrors.rpc.invalidParams(`Snap "${snapId}@${existingSnap.version}" is already installed. Couldn't update to a version inside requested "${versionRange}" range.`);
-                }
-                return updateResult;
+                return await this.updateSnap(origin, snapId, location, versionRange);
             }
             throw eth_rpc_errors_1.ethErrors.rpc.invalidParams(`Version mismatch with already installed snap. ${snapId}@${existingSnap.version} doesn't satisfy requested version ${versionRange}.`);
         }
+        let pendingApproval = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_createApproval).call(this, {
+            origin,
+            snapId,
+            type: exports.SNAP_APPROVAL_INSTALL,
+        });
         // Existing snaps must be stopped before overwriting
         if (existingSnap && this.isRunning(snapId)) {
             await this.stopSnap(snapId, snaps_utils_1.SnapStatusEvents.Stop);
         }
+        // Existing snaps that should be re-installed should not maintain their existing permissions
+        if (existingSnap && location.shouldAlwaysReload) {
+            this.revokeAllSnapPermissions(snapId);
+        }
         try {
             const { sourceCode } = await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_add).call(this, {
                 origin,
                 id: snapId,
                 location,
+                versionRange,
+            });
+            await this.authorize(snapId, pendingApproval);
+            pendingApproval = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_createApproval).call(this, {
+                origin,
+                snapId,
+                type: exports.SNAP_APPROVAL_RESULT,
             });
-            await this.authorize(origin, snapId);
             await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_startSnap).call(this, {
                 snapId,
                 sourceCode,
             });
             const truncated = this.getTruncatedExpect(snapId);
+            __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_updateApproval).call(this, pendingApproval.id, {
+                loading: false,
+                type: exports.SNAP_APPROVAL_INSTALL,
+            });
             this.messagingSystem.publish(`SnapController:snapInstalled`, truncated);
             return truncated;
         }
         catch (error) {
             (0, snaps_utils_1.logError)(`Error when adding snap.`, error);
+            __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_updateApproval).call(this, pendingApproval.id, {
+                loading: false,
+                type: exports.SNAP_APPROVAL_INSTALL,
+                error: error instanceof Error ? error.message : error.toString(),
+            });
             throw error;
         }
     }
@@ -652,88 +668,108 @@ class SnapController extends base_controller_1.BaseControllerV2 {
      *
      * @param origin - The origin requesting the snap update.
      * @param snapId - The id of the Snap to be updated.
-     * @param location - Optional location that was already used during installation flow.
+     * @param location - The location implementation of the snap.
      * @param newVersionRange - A semver version range in which the maximum version will be chosen.
      * @returns The snap metadata if updated, `null` otherwise.
      */
     async updateSnap(origin, snapId, location, newVersionRange = snaps_utils_1.DEFAULT_REQUESTED_SNAP_VERSION) {
-        var _a;
-        const snap = this.getExpect(snapId);
         if (!(0, utils_1.isValidSemVerRange)(newVersionRange)) {
             throw new Error(`Received invalid snap version range: "${newVersionRange}".`);
         }
-        const newSnap = await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_fetchSnap).call(this, snapId, location);
-        const newVersion = newSnap.manifest.result.version;
-        if (!(0, utils_1.gtVersion)(newVersion, snap.version)) {
-            (0, snaps_utils_1.logWarning)(`Tried updating snap "${snapId}" within "${newVersionRange}" version range, but newer version "${snap.version}" is already installed`);
-            return null;
-        }
-        await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_assertIsInstallAllowed).call(this, snapId, {
-            version: newVersion,
-            checksum: newSnap.manifest.result.source.shasum,
-        });
-        const processedPermissions = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_processSnapPermissions).call(this, newSnap.manifest.result.initialPermissions);
-        const { newPermissions, unusedPermissions, approvedPermissions } = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_calculatePermissionsChange).call(this, snapId, processedPermissions);
-        const id = (0, nanoid_1.nanoid)();
-        const _b = (await this.messagingSystem.call('ApprovalController:addRequest', {
+        let pendingApproval = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_createApproval).call(this, {
             origin,
-            id,
+            snapId,
             type: exports.SNAP_APPROVAL_UPDATE,
-            requestData: {
-                // First two keys mirror installation params
-                metadata: { id, origin: snapId, dappOrigin: origin },
+        });
+        try {
+            const snap = this.getExpect(snapId);
+            const newSnap = await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_fetchSnap).call(this, snapId, location);
+            const newVersion = newSnap.manifest.result.version;
+            if (!(0, utils_1.gtVersion)(newVersion, snap.version)) {
+                throw eth_rpc_errors_1.ethErrors.rpc.invalidParams(`Snap "${snapId}@${snap.version}" is already installed. Couldn't update to a version inside requested "${newVersionRange}" range.`);
+            }
+            if (!(0, utils_1.satisfiesVersionRange)(newVersion, newVersionRange)) {
+                throw new Error(`Version mismatch. Manifest for "${snapId}" specifies version "${newVersion}" which doesn't satisfy requested version range "${newVersionRange}".`);
+            }
+            await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_assertIsInstallAllowed).call(this, snapId, {
+                version: newVersion,
+                checksum: newSnap.manifest.result.source.shasum,
+            });
+            const processedPermissions = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_processSnapPermissions).call(this, newSnap.manifest.result.initialPermissions);
+            __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_validateSnapPermissions).call(this, processedPermissions);
+            const { newPermissions, unusedPermissions, approvedPermissions } = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_calculatePermissionsChange).call(this, snapId, processedPermissions);
+            __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_updateApproval).call(this, pendingApproval.id, {
                 permissions: newPermissions,
-                snapId,
                 newVersion: newSnap.manifest.result.version,
                 newPermissions,
                 approvedPermissions,
                 unusedPermissions,
-            },
-        }, true)), { permissions: approvedNewPermissions } = _b, requestData = __rest(_b, ["permissions"]);
-        if (this.isRunning(snapId)) {
-            await this.stopSnap(snapId, snaps_utils_1.SnapStatusEvents.Stop);
-        }
-        __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_transition).call(this, snapId, snaps_utils_1.SnapStatusEvents.Update);
-        __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_set).call(this, {
-            origin,
-            id: snapId,
-            manifest: newSnap.manifest,
-            files: newSnap.files,
-            versionRange: newVersionRange,
-            isUpdate: true,
-        });
-        const unusedPermissionsKeys = Object.keys(unusedPermissions);
-        if ((0, utils_1.isNonEmptyArray)(unusedPermissionsKeys)) {
-            this.messagingSystem.call('PermissionController:revokePermissions', {
-                [snapId]: unusedPermissionsKeys,
+                loading: false,
             });
-        }
-        if ((0, utils_1.isNonEmptyArray)(Object.keys(approvedNewPermissions))) {
-            this.messagingSystem.call('PermissionController:grantPermissions', {
-                approvedPermissions: approvedNewPermissions,
-                subject: { origin: snapId },
-                requestData,
+            const { permissions: approvedNewPermissions, ...requestData } = (await pendingApproval.promise);
+            pendingApproval = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_createApproval).call(this, {
+                origin,
+                snapId,
+                type: exports.SNAP_APPROVAL_RESULT,
             });
+            if (this.isRunning(snapId)) {
+                await this.stopSnap(snapId, snaps_utils_1.SnapStatusEvents.Stop);
+            }
+            __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_transition).call(this, snapId, snaps_utils_1.SnapStatusEvents.Update);
+            __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_set).call(this, {
+                origin,
+                id: snapId,
+                manifest: newSnap.manifest,
+                files: newSnap.files,
+                isUpdate: true,
+            });
+            const unusedPermissionsKeys = Object.keys(unusedPermissions);
+            if ((0, utils_1.isNonEmptyArray)(unusedPermissionsKeys)) {
+                this.messagingSystem.call('PermissionController:revokePermissions', {
+                    [snapId]: unusedPermissionsKeys,
+                });
+            }
+            if ((0, utils_1.isNonEmptyArray)(Object.keys(approvedNewPermissions))) {
+                this.messagingSystem.call('PermissionController:grantPermissions', {
+                    approvedPermissions: approvedNewPermissions,
+                    subject: { origin: snapId },
+                    requestData,
+                });
+            }
+            const rollbackSnapshot = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_getRollbackSnapshot).call(this, snapId);
+            if (rollbackSnapshot !== undefined) {
+                rollbackSnapshot.permissions.revoked = unusedPermissions;
+                rollbackSnapshot.permissions.granted = Object.keys(approvedNewPermissions);
+                rollbackSnapshot.permissions.requestData = requestData;
+            }
+            const normalizedSourcePath = (0, snaps_utils_1.normalizeRelative)(newSnap.manifest.result.source.location.npm.filePath);
+            const sourceCode = newSnap.files
+                .find((file) => file.path === normalizedSourcePath)
+                ?.toString();
+            (0, utils_1.assert)(typeof sourceCode === 'string' && sourceCode.length > 0, `Invalid source code for snap "${snapId}".`);
+            try {
+                await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_startSnap).call(this, { snapId, sourceCode });
+            }
+            catch {
+                throw new Error(`Snap ${snapId} crashed with updated source code.`);
+            }
+            const truncatedSnap = this.getTruncatedExpect(snapId);
+            this.messagingSystem.publish('SnapController:snapUpdated', truncatedSnap, snap.version);
+            __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_updateApproval).call(this, pendingApproval.id, {
+                loading: false,
+                type: exports.SNAP_APPROVAL_UPDATE,
+            });
+            return truncatedSnap;
         }
-        const rollbackSnapshot = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_getRollbackSnapshot).call(this, snapId);
-        if (rollbackSnapshot !== undefined) {
-            rollbackSnapshot.permissions.revoked = unusedPermissions;
-            rollbackSnapshot.permissions.granted = Object.keys(approvedNewPermissions);
-            rollbackSnapshot.permissions.requestData = requestData;
-        }
-        const normalizedSourcePath = (0, snaps_utils_1.normalizeRelative)(newSnap.manifest.result.source.location.npm.filePath);
-        const sourceCode = (_a = newSnap.files
-            .find((file) => file.path === normalizedSourcePath)) === null || _a === void 0 ? void 0 : _a.toString();
-        (0, utils_1.assert)(typeof sourceCode === 'string' && sourceCode.length > 0, `Invalid source code for snap "${snapId}".`);
-        try {
-            await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_startSnap).call(this, { snapId, sourceCode });
-        }
-        catch (_c) {
-            throw new Error(`Snap ${snapId} crashed with updated source code.`);
+        catch (error) {
+            (0, snaps_utils_1.logError)(`Error when updating snap,`, error);
+            __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_updateApproval).call(this, pendingApproval.id, {
+                loading: false,
+                error: error instanceof Error ? error.message : error.toString(),
+                type: exports.SNAP_APPROVAL_UPDATE,
+            });
+            throw error;
         }
-        const truncatedSnap = this.getTruncatedExpect(snapId);
-        this.messagingSystem.publish('SnapController:snapUpdated', truncatedSnap, snap.version);
-        return truncatedSnap;
     }
     /**
      * Get metadata for the given snap ID.
@@ -743,7 +779,7 @@ class SnapController extends base_controller_1.BaseControllerV2 {
      * verified.
      */
     async getRegistryMetadata(snapId) {
-        return await __classPrivateFieldGet(this, _SnapController_registry, "f").getMetadata(snapId);
+        return await this.messagingSystem.call('SnapsRegistry:getMetadata', snapId);
     }
     /**
      * Initiates a request for the given snap's initial permissions.
@@ -751,36 +787,23 @@ class SnapController extends base_controller_1.BaseControllerV2 {
      *
      * This function is not hash private yet because of tests.
      *
-     * @param origin - The origin of the install request.
      * @param snapId - The id of the Snap.
+     * @param pendingApproval - Pending approval to update.
      * @returns The snap's approvedPermissions.
      */
-    async authorize(origin, snapId) {
+    async authorize(snapId, pendingApproval) {
         (0, logging_1.log)(`Authorizing snap: ${snapId}`);
         const snapsState = this.state.snaps;
         const snap = snapsState[snapId];
         const { initialPermissions } = snap;
         try {
             const processedPermissions = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_processSnapPermissions).call(this, initialPermissions);
-            const excludedPermissionErrors = Object.keys(processedPermissions).reduce((errors, permission) => {
-                if ((0, utils_1.hasProperty)(__classPrivateFieldGet(this, _SnapController_excludedPermissions, "f"), permission)) {
-                    errors.push(__classPrivateFieldGet(this, _SnapController_excludedPermissions, "f")[permission]);
-                }
-                return errors;
-            }, []);
-            (0, utils_1.assert)(excludedPermissionErrors.length === 0, `One or more permissions are not allowed:\n${excludedPermissionErrors.join('\n')}`);
-            const id = (0, nanoid_1.nanoid)();
-            const _a = (await this.messagingSystem.call('ApprovalController:addRequest', {
-                origin,
-                id,
-                type: exports.SNAP_APPROVAL_INSTALL,
-                requestData: {
-                    // Mirror previous installation metadata
-                    metadata: { id, origin: snapId, dappOrigin: origin },
-                    permissions: processedPermissions,
-                    snapId,
-                },
-            }, true)), { permissions: approvedPermissions } = _a, requestData = __rest(_a, ["permissions"]);
+            __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_validateSnapPermissions).call(this, processedPermissions);
+            __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_updateApproval).call(this, pendingApproval.id, {
+                loading: false,
+                permissions: processedPermissions,
+            });
+            const { permissions: approvedPermissions, ...requestData } = (await pendingApproval.promise);
             if ((0, utils_1.isNonEmptyArray)(Object.keys(approvedPermissions))) {
                 this.messagingSystem.call('PermissionController:grantPermissions', {
                     approvedPermissions,
@@ -823,9 +846,9 @@ class SnapController extends base_controller_1.BaseControllerV2 {
         }
         if (permissionName === endowments_1.SnapEndowments.Rpc) {
             const subject = this.messagingSystem.call('SubjectMetadataController:getSubjectMetadata', origin);
-            const isSnap = (subject === null || subject === void 0 ? void 0 : subject.subjectType) === subject_metadata_controller_1.SubjectType.Snap;
+            const isSnap = subject?.subjectType === subject_metadata_controller_1.SubjectType.Snap;
             const permissions = this.messagingSystem.call('PermissionController:getPermissions', snapId);
-            const rpcPermission = permissions === null || permissions === void 0 ? void 0 : permissions[endowments_1.SnapEndowments.Rpc];
+            const rpcPermission = permissions?.[endowments_1.SnapEndowments.Rpc];
             (0, utils_1.assert)(rpcPermission);
             const origins = (0, rpc_1.getRpcCaveatOrigins)(rpcPermission);
             (0, utils_1.assert)(origins);
@@ -841,7 +864,7 @@ class SnapController extends base_controller_1.BaseControllerV2 {
     }
 }
 exports.SnapController = SnapController;
-_SnapController_closeAllConnections = new WeakMap(), _SnapController_environmentEndowmentPermissions = new WeakMap(), _SnapController_excludedPermissions = new WeakMap(), _SnapController_featureFlags = new WeakMap(), _SnapController_fetchFunction = new WeakMap(), _SnapController_idleTimeCheckInterval = new WeakMap(), _SnapController_registry = new WeakMap(), _SnapController_maxIdleTime = new WeakMap(), _SnapController_detectSnapLocation = new WeakMap(), _SnapController_rollbackSnapshots = new WeakMap(), _SnapController_timeoutForLastRequestStatus = new WeakMap(), _SnapController_statusMachine = new WeakMap(), _SnapController_instances = new WeakSet(), _SnapController_initializeStateMachine = function _SnapController_initializeStateMachine() {
+_SnapController_closeAllConnections = new WeakMap(), _SnapController_environmentEndowmentPermissions = new WeakMap(), _SnapController_excludedPermissions = new WeakMap(), _SnapController_featureFlags = new WeakMap(), _SnapController_fetchFunction = new WeakMap(), _SnapController_idleTimeCheckInterval = new WeakMap(), _SnapController_maxIdleTime = new WeakMap(), _SnapController_detectSnapLocation = new WeakMap(), _SnapController_rollbackSnapshots = new WeakMap(), _SnapController_timeoutForLastRequestStatus = new WeakMap(), _SnapController_statusMachine = new WeakMap(), _SnapController_instances = new WeakSet(), _SnapController_initializeStateMachine = function _SnapController_initializeStateMachine() {
     const disableGuard = ({ snapId }) => {
         return this.getExpect(snapId).enabled;
     };
@@ -862,6 +885,7 @@ _SnapController_closeAllConnections = new WeakMap(), _SnapController_environment
                         target: snaps_utils_1.SnapStatus.Running,
                         cond: disableGuard,
                     },
+                    [snaps_utils_1.SnapStatusEvents.Stop]: snaps_utils_1.SnapStatus.Stopped,
                 },
             },
             [snaps_utils_1.SnapStatus.Running]: {
@@ -951,13 +975,12 @@ async function _SnapController_blockSnap(snapId, blockedSnapInfo) {
     });
     this.messagingSystem.publish(`${exports.controllerName}:snapUnblocked`, snapId);
 }, _SnapController_assertIsInstallAllowed = async function _SnapController_assertIsInstallAllowed(snapId, snapInfo) {
-    var _a, _b;
-    const results = await __classPrivateFieldGet(this, _SnapController_registry, "f").get({
+    const results = await this.messagingSystem.call('SnapsRegistry:get', {
         [snapId]: snapInfo,
     });
     const result = results[snapId];
     if (result.status === registry_1.SnapsRegistryStatus.Blocked) {
-        throw new Error(`Cannot install version "${snapInfo.version}" of snap "${snapId}": The version is blocked. ${(_b = (_a = result.reason) === null || _a === void 0 ? void 0 : _a.explanation) !== null && _b !== void 0 ? _b : ''}`);
+        throw new Error(`Cannot install version "${snapInfo.version}" of snap "${snapId}": The version is blocked. ${result.reason?.explanation ?? ''}`);
     }
     else if (__classPrivateFieldGet(this, _SnapController_featureFlags, "f").requireAllowlist &&
         result.status !== registry_1.SnapsRegistryStatus.Verified) {
@@ -989,14 +1012,16 @@ async function _SnapController_terminateSnap(snapId) {
     await this.messagingSystem.call('ExecutionService:terminateSnap', snapId);
     this.messagingSystem.publish('SnapController:snapTerminated', this.getTruncatedExpect(snapId));
 }, _SnapController_removeSnapFromSubjects = function _SnapController_removeSnapFromSubjects(snapId) {
-    var _a, _b, _c, _d;
     const subjects = this.messagingSystem.call('PermissionController:getSubjectNames');
     for (const subject of subjects) {
         const subjectPermissions = this.messagingSystem.call('PermissionController:getPermissions', subject);
-        const snapIdsCaveat = ((_c = (_b = (_a = subjectPermissions === null || subjectPermissions === void 0 ? void 0 : subjectPermissions[rpc_methods_1.WALLET_SNAP_PERMISSION_KEY]) === null || _a === void 0 ? void 0 : _a.caveats) === null || _b === void 0 ? void 0 : _b.find((caveat) => caveat.type === snaps_utils_1.SnapCaveatType.SnapIds)) !== null && _c !== void 0 ? _c : {});
-        const caveatHasSnap = Boolean((_d = snapIdsCaveat.value) === null || _d === void 0 ? void 0 : _d[snapId]);
+        const snapIdsCaveat = (subjectPermissions?.[rpc_methods_1.WALLET_SNAP_PERMISSION_KEY]?.caveats?.find((caveat) => caveat.type === snaps_utils_1.SnapCaveatType.SnapIds) ??
+            {});
+        const caveatHasSnap = Boolean(snapIdsCaveat.value?.[snapId]);
         if (caveatHasSnap) {
-            const newCaveatValue = Object.assign({}, snapIdsCaveat.value);
+            const newCaveatValue = {
+                ...snapIdsCaveat.value,
+            };
             delete newCaveatValue[snapId];
             if (Object.keys(newCaveatValue).length > 0) {
                 this.messagingSystem.call('PermissionController:updateCaveat', subject, rpc_methods_1.WALLET_SNAP_PERMISSION_KEY, snaps_utils_1.SnapCaveatType.SnapIds, newCaveatValue);
@@ -1008,6 +1033,32 @@ async function _SnapController_terminateSnap(snapId) {
             }
         }
     }
+}, _SnapController_createApproval = function _SnapController_createApproval({ origin, snapId, type, }) {
+    const id = (0, nanoid_1.nanoid)();
+    const promise = this.messagingSystem.call('ApprovalController:addRequest', {
+        origin,
+        id,
+        type,
+        requestData: {
+            // Mirror previous installation metadata
+            metadata: { id, origin: snapId, dappOrigin: origin },
+            snapId,
+        },
+        requestState: {
+            loading: true,
+        },
+    }, true);
+    return { id, promise };
+}, _SnapController_updateApproval = function _SnapController_updateApproval(id, requestState) {
+    try {
+        this.messagingSystem.call('ApprovalController:updateRequestState', {
+            id,
+            requestState,
+        });
+    }
+    catch {
+        // Do nothing
+    }
 }, _SnapController_add = 
 /**
  * Returns a promise representing the complete installation of the requested snap.
@@ -1019,8 +1070,7 @@ async function _SnapController_terminateSnap(snapId) {
  * @returns The resulting snap object.
  */
 async function _SnapController_add(args) {
-    const { id: snapId, location } = args;
-    (0, snaps_utils_1.validateSnapId)(snapId);
+    const { id: snapId, location, versionRange } = args;
     __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_setupRuntime).call(this, snapId, { sourceCode: null, state: null });
     const runtime = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_getRuntimeExpect).call(this, snapId);
     if (!runtime.installPromise) {
@@ -1029,11 +1079,20 @@ async function _SnapController_add(args) {
         // to null in the authorize() method.
         runtime.installPromise = (async () => {
             const fetchedSnap = await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_fetchSnap).call(this, snapId, location);
+            const manifest = fetchedSnap.manifest.result;
+            (0, snaps_utils_1.assertIsSnapManifest)(manifest);
+            if (!(0, utils_1.satisfiesVersionRange)(manifest.version, versionRange)) {
+                throw new Error(`Version mismatch. Manifest for "${snapId}" specifies version "${manifest.version}" which doesn't satisfy requested version range "${versionRange}".`);
+            }
             await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_assertIsInstallAllowed).call(this, snapId, {
-                version: fetchedSnap.manifest.result.version,
-                checksum: fetchedSnap.manifest.result.source.shasum,
+                version: manifest.version,
+                checksum: manifest.source.shasum,
+            });
+            return __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_set).call(this, {
+                ...args,
+                ...fetchedSnap,
+                id: snapId,
             });
-            return __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_set).call(this, Object.assign(Object.assign(Object.assign({}, args), fetchedSnap), { id: snapId }));
         })();
     }
     try {
@@ -1051,7 +1110,10 @@ async function _SnapController_add(args) {
         throw new Error(`Snap "${snapId}" is already started.`);
     }
     try {
-        const result = await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_executeWithTimeout).call(this, snapId, this.messagingSystem.call('ExecutionService:executeSnap', Object.assign(Object.assign({}, snapData), { endowments: await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_getEndowments).call(this, snapId) })));
+        const result = await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_executeWithTimeout).call(this, snapId, this.messagingSystem.call('ExecutionService:executeSnap', {
+            ...snapData,
+            endowments: await __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_getEndowments).call(this, snapId),
+        }));
         __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_transition).call(this, snapId, snaps_utils_1.SnapStatusEvents.Start);
         return result;
     }
@@ -1098,25 +1160,22 @@ async function _SnapController_getEndowments(snapId) {
     }
     return dedupedEndowments;
 }, _SnapController_set = function _SnapController_set(args) {
-    var _a, _b;
-    const { id: snapId, origin, manifest, files, versionRange = snaps_utils_1.DEFAULT_REQUESTED_SNAP_VERSION, isUpdate = false, } = args;
+    const { id: snapId, origin, manifest, files, isUpdate = false } = args;
     (0, snaps_utils_1.assertIsSnapManifest)(manifest.result);
     const { version } = manifest.result;
-    if (!(0, utils_1.satisfiesVersionRange)(version, versionRange)) {
-        throw new Error(`Version mismatch. Manifest for "${snapId}" specifies version "${version}" which doesn't satisfy requested version range "${versionRange}"`);
-    }
     const normalizedSourcePath = (0, snaps_utils_1.normalizeRelative)(manifest.result.source.location.npm.filePath);
     const { iconPath } = manifest.result.source.location.npm;
     const normalizedIconPath = iconPath && (0, snaps_utils_1.normalizeRelative)(iconPath);
-    const sourceCode = (_a = files
-        .find((file) => file.path === normalizedSourcePath)) === null || _a === void 0 ? void 0 : _a.toString();
+    const sourceCode = files
+        .find((file) => file.path === normalizedSourcePath)
+        ?.toString();
     const svgIcon = normalizedIconPath
         ? files.find((file) => file.path === normalizedIconPath)
         : undefined;
     (0, utils_1.assert)(typeof sourceCode === 'string' && sourceCode.length > 0, `Invalid source code for snap "${snapId}".`);
     const snapsState = this.state.snaps;
     const existingSnap = snapsState[snapId];
-    const previousVersionHistory = (_b = existingSnap === null || existingSnap === void 0 ? void 0 : existingSnap.versionHistory) !== null && _b !== void 0 ? _b : [];
+    const previousVersionHistory = existingSnap?.versionHistory ?? [];
     const versionHistory = [
         ...previousVersionHistory,
         {
@@ -1125,11 +1184,20 @@ async function _SnapController_getEndowments(snapId) {
             origin,
         },
     ];
-    const snap = Object.assign(Object.assign({}, existingSnap), { 
+    const snap = {
+        // Restore relevant snap state if it exists
+        ...existingSnap,
         // Note that the snap will be unblocked and enabled, regardless of its
         // previous state.
-        blocked: false, enabled: true, id: snapId, initialPermissions: manifest.result.initialPermissions, manifest: manifest.result, status: __classPrivateFieldGet(this, _SnapController_statusMachine, "f").config.initial, version,
-        versionHistory });
+        blocked: false,
+        enabled: true,
+        id: snapId,
+        initialPermissions: manifest.result.initialPermissions,
+        manifest: manifest.result,
+        status: __classPrivateFieldGet(this, _SnapController_statusMachine, "f").config.initial,
+        version,
+        versionHistory,
+    };
     // If the snap was blocked, it isn't any longer
     delete snap.blockInformation;
     // store the snap back in state
@@ -1146,8 +1214,8 @@ async function _SnapController_getEndowments(snapId) {
     }
     const runtime = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_getRuntimeExpect).call(this, snapId);
     runtime.sourceCode = sourceCode;
-    this.messagingSystem.publish(`SnapController:snapAdded`, snap, svgIcon === null || svgIcon === void 0 ? void 0 : svgIcon.toString());
-    return Object.assign(Object.assign({}, snap), { sourceCode });
+    this.messagingSystem.publish(`SnapController:snapAdded`, snap, svgIcon?.toString());
+    return { ...snap, sourceCode };
 }, _SnapController_fetchSnap = 
 /**
  * Fetches the manifest and source code of a snap.
@@ -1178,7 +1246,7 @@ async function _SnapController_fetchSnap(snapId, location) {
         throw new Error(`Failed to fetch Snap "${snapId}": ${message}.`);
     }
 }, _SnapController_processSnapPermissions = function _SnapController_processSnapPermissions(initialPermissions) {
-    return (0, snaps_utils_1.fromEntries)(Object.entries(initialPermissions).map(([initialPermission, value]) => {
+    return Object.fromEntries(Object.entries(initialPermissions).map(([initialPermission, value]) => {
         if ((0, utils_1.hasProperty)(rpc_methods_1.caveatMappers, initialPermission)) {
             return [initialPermission, rpc_methods_1.caveatMappers[initialPermission](value)];
         }
@@ -1194,6 +1262,17 @@ async function _SnapController_fetchSnap(snapId, location) {
             value,
         ];
     }));
+}, _SnapController_validateSnapPermissions = function _SnapController_validateSnapPermissions(processedPermissions) {
+    const permissionKeys = Object.keys(processedPermissions);
+    const handlerPermissions = Object.values(endowments_1.handlerEndowments);
+    (0, utils_1.assert)(permissionKeys.some((key) => handlerPermissions.includes(key)), `A snap must request at least one of the following permissions: ${handlerPermissions.join(', ')}.`);
+    const excludedPermissionErrors = permissionKeys.reduce((errors, permission) => {
+        if ((0, utils_1.hasProperty)(__classPrivateFieldGet(this, _SnapController_excludedPermissions, "f"), permission)) {
+            errors.push(__classPrivateFieldGet(this, _SnapController_excludedPermissions, "f")[permission]);
+        }
+        return errors;
+    }, []);
+    (0, utils_1.assert)(excludedPermissionErrors.length === 0, `One or more permissions are not allowed:\n${excludedPermissionErrors.join('\n')}`);
 }, _SnapController_getRpcRequestHandler = function _SnapController_getRpcRequestHandler(snapId) {
     const runtime = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_getRuntimeExpect).call(this, snapId);
     const existingHandler = runtime.rpcHandler;
@@ -1234,7 +1313,7 @@ async function _SnapController_fetchSnap(snapId, location) {
         }
         let _request = request;
         if (!(0, utils_1.hasProperty)(request, 'jsonrpc')) {
-            _request = Object.assign(Object.assign({}, request), { jsonrpc: '2.0' });
+            _request = { ...request, jsonrpc: '2.0' };
         }
         else if (request.jsonrpc !== '2.0') {
             throw eth_rpc_errors_1.ethErrors.rpc.invalidRequest({
@@ -1276,7 +1355,7 @@ async function _SnapController_executeWithTimeout(snapId, promise, timer) {
         (0, snaps_utils_1.logWarning)(`${endowments_1.SnapEndowments.LongRunning} will soon be deprecated. For more information please see https://github.com/MetaMask/snaps-monorepo/issues/945.`);
         return promise;
     }
-    const result = await (0, utils_2.withTimeout)(promise, timer !== null && timer !== void 0 ? timer : this.maxRequestTime);
+    const result = await (0, utils_2.withTimeout)(promise, timer ?? this.maxRequestTime);
     if (result === utils_2.hasTimedOut) {
         throw new Error('The request timed out.');
     }
@@ -1317,16 +1396,26 @@ async function _SnapController_executeWithTimeout(snapId, promise, timer) {
  * @throws {@link Error}. If a snapshot does not exist.
  */
 async function _SnapController_rollbackSnap(snapId) {
-    var _a;
     const rollbackSnapshot = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_getRollbackSnapshot).call(this, snapId);
     if (!rollbackSnapshot) {
         throw new Error('A snapshot does not exist for this snap.');
     }
     await this.stopSnap(snapId, snaps_utils_1.SnapStatusEvents.Stop);
+    // Always set to stopped even if it wasn't running initially
+    if (this.get(snapId)?.status !== snaps_utils_1.SnapStatus.Stopped) {
+        __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_transition).call(this, snapId, snaps_utils_1.SnapStatusEvents.Stop);
+    }
     const { statePatches, sourceCode, permissions } = rollbackSnapshot;
-    if (statePatches === null || statePatches === void 0 ? void 0 : statePatches.length) {
+    if (statePatches?.length) {
         this.applyPatches(statePatches);
     }
+    // Reset snap status, as we may have been in another state when we stored state patches
+    // But now we are 100% in a stopped state
+    if (this.get(snapId)?.status !== snaps_utils_1.SnapStatus.Stopped) {
+        this.update((state) => {
+            state.snaps[snapId].status = snaps_utils_1.SnapStatus.Stopped;
+        });
+    }
     if (sourceCode) {
         const runtime = __classPrivateFieldGet(this, _SnapController_instances, "m", _SnapController_getRuntimeExpect).call(this, snapId);
         runtime.sourceCode = sourceCode;
@@ -1338,7 +1427,7 @@ async function _SnapController_rollbackSnap(snapId) {
             requestData: permissions.requestData,
         });
     }
-    if ((_a = permissions.granted) === null || _a === void 0 ? void 0 : _a.length) {
+    if (permissions.granted?.length) {
         this.messagingSystem.call('PermissionController:revokePermissions', {
             [snapId]: permissions.granted,
         });
@@ -1364,7 +1453,6 @@ async function _SnapController_rollbackSnaps(snapIds) {
     (0, utils_1.assert)(runtime !== undefined, new Error(`Snap "${snapId}" runtime data not found`));
     return runtime;
 }, _SnapController_setupRuntime = function _SnapController_setupRuntime(snapId, data) {
-    var _a;
     if (this.snapsRuntimeData.has(snapId)) {
         return;
     }
@@ -1372,13 +1460,22 @@ async function _SnapController_rollbackSnaps(snapIds) {
     const interpreter = (0, fsm_1.interpret)(__classPrivateFieldGet(this, _SnapController_statusMachine, "f"));
     interpreter.start({
         context: { snapId },
-        value: (_a = snap === null || snap === void 0 ? void 0 : snap.status) !== null && _a !== void 0 ? _a : __classPrivateFieldGet(this, _SnapController_statusMachine, "f").config.initial,
+        value: snap?.status ??
+            __classPrivateFieldGet(this, _SnapController_statusMachine, "f").config.initial,
     });
     (0, fsm_2.forceStrict)(interpreter);
-    this.snapsRuntimeData.set(snapId, Object.assign({ lastRequest: null, rpcHandler: null, installPromise: null, activeReferences: 0, pendingInboundRequests: [], pendingOutboundRequests: 0, interpreter }, data));
+    this.snapsRuntimeData.set(snapId, {
+        lastRequest: null,
+        rpcHandler: null,
+        installPromise: null,
+        activeReferences: 0,
+        pendingInboundRequests: [],
+        pendingOutboundRequests: 0,
+        interpreter,
+        ...data,
+    });
 }, _SnapController_calculatePermissionsChange = function _SnapController_calculatePermissionsChange(snapId, desiredPermissionsSet) {
-    var _a;
-    const oldPermissions = (_a = this.messagingSystem.call('PermissionController:getPermissions', snapId)) !== null && _a !== void 0 ? _a : {};
+    const oldPermissions = this.messagingSystem.call('PermissionController:getPermissions', snapId) ?? {};
     const newPermissions = (0, utils_2.setDiff)(desiredPermissionsSet, oldPermissions);
     // TODO(ritave): The assumption that these are unused only holds so long as we do not
     //               permit dynamic permission requests.