@metamask/snaps-controllers 3.3.0 → 3.4.1

package/dist/esm/snaps/location/npm.js

@@ -31,8 +31,8 @@ import { assert, assertIsSemVerVersion, assertStruct, isObject, isValidSemVerVer
 import concat from 'concat-stream';
 import getNpmTarballUrl from 'get-npm-tarball-url';
 import createGunzipStream from 'gunzip-maybe';
+import { pipeline } from 'readable-stream';
 import { ReadableWebToNodeStream } from 'readable-web-to-node-stream';
-import { pipeline } from 'stream';
 import { extract as tarExtract } from 'tar-stream';
 export const DEFAULT_NPM_REGISTRY = new URL('https://registry.npmjs.org');
 var _lazyInit = /*#__PURE__*/ new WeakSet();

package/dist/esm/snaps/location/npm.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/snaps/location/npm.ts"],"sourcesContent":["import type { SnapManifest } from '@metamask/snaps-utils';\nimport {\n  createSnapManifest,\n  DEFAULT_REQUESTED_SNAP_VERSION,\n  getTargetVersion,\n  isValidUrl,\n  NpmSnapIdStruct,\n  VirtualFile,\n  normalizeRelative,\n  parseJson,\n} from '@metamask/snaps-utils';\nimport type { SemVerRange, SemVerVersion } from '@metamask/utils';\nimport {\n  assert,\n  assertIsSemVerVersion,\n  assertStruct,\n  isObject,\n  isValidSemVerVersion,\n} from '@metamask/utils';\nimport concat from 'concat-stream';\nimport getNpmTarballUrl from 'get-npm-tarball-url';\nimport createGunzipStream from 'gunzip-maybe';\nimport { ReadableWebToNodeStream } from 'readable-web-to-node-stream';\nimport { pipeline } from 'stream';\nimport type { Readable, Writable } from 'stream';\nimport { extract as tarExtract } from 'tar-stream';\n\nimport type { DetectSnapLocationOptions, SnapLocation } from './location';\n\nexport const DEFAULT_NPM_REGISTRY = new URL('https://registry.npmjs.org');\n\ninterface NpmMeta {\n  registry: URL;\n  packageName: string;\n  requestedRange: SemVerRange;\n  version?: string;\n  fetch: typeof fetch;\n  resolveVersion: (range: SemVerRange) => Promise<SemVerRange>;\n}\nexport interface NpmOptions {\n  /**\n   * @default DEFAULT_REQUESTED_SNAP_VERSION\n   */\n  versionRange?: SemVerRange;\n  /**\n   * Whether to allow custom NPM registries outside of {@link DEFAULT_NPM_REGISTRY}.\n   *\n   * @default false\n   */\n  allowCustomRegistries?: boolean;\n}\n\nexport class NpmLocation implements SnapLocation {\n  private readonly meta: NpmMeta;\n\n  private validatedManifest?: VirtualFile<SnapManifest>;\n\n  private files?: Map<string, VirtualFile>;\n\n  constructor(url: URL, opts: DetectSnapLocationOptions = {}) {\n    const allowCustomRegistries = opts.allowCustomRegistries ?? false;\n    const fetchFunction = opts.fetch ?? globalThis.fetch.bind(globalThis);\n    const requestedRange = opts.versionRange ?? DEFAULT_REQUESTED_SNAP_VERSION;\n    const defaultResolve = async (range: SemVerRange) => range;\n    const resolveVersion = opts.resolveVersion ?? defaultResolve;\n\n    assertStruct(url.toString(), NpmSnapIdStruct, 'Invalid Snap Id: ');\n\n    let registry: string | URL;\n    if (\n      url.host === '' &&\n      url.port === '' &&\n      url.username === '' &&\n      url.password === ''\n    ) {\n      registry = DEFAULT_NPM_REGISTRY;\n    } else {\n      registry = 'https://';\n      if (url.username) {\n        registry += url.username;\n        if (url.password) {\n          registry += `:${url.password}`;\n        }\n        registry += '@';\n      }\n      registry += url.host;\n      registry = new URL(registry);\n      assert(\n        allowCustomRegistries,\n        new TypeError(\n          `Custom NPM registries are disabled, tried to use \"${registry.toString()}\".`,\n        ),\n      );\n    }\n\n    assert(\n      registry.pathname === '/' &&\n        registry.search === '' &&\n        registry.hash === '',\n    );\n\n    assert(\n      url.pathname !== '' && url.pathname !== '/',\n      new TypeError('The package name in NPM location is empty.'),\n    );\n    let packageName = url.pathname;\n    if (packageName.startsWith('/')) {\n      packageName = packageName.slice(1);\n    }\n\n    this.meta = {\n      requestedRange,\n      registry,\n      packageName,\n      fetch: fetchFunction,\n      resolveVersion,\n    };\n  }\n\n  async manifest(): Promise<VirtualFile<SnapManifest>> {\n    if (this.validatedManifest) {\n      return this.validatedManifest.clone();\n    }\n\n    const vfile = await this.fetch('snap.manifest.json');\n    const result = parseJson(vfile.toString());\n    vfile.result = createSnapManifest(result);\n    this.validatedManifest = vfile as VirtualFile<SnapManifest>;\n\n    return this.manifest();\n  }\n\n  async fetch(path: string): Promise<VirtualFile> {\n    const relativePath = normalizeRelative(path);\n    if (!this.files) {\n      await this.#lazyInit();\n      assert(this.files !== undefined);\n    }\n    const vfile = this.files.get(relativePath);\n    assert(\n      vfile !== undefined,\n      new TypeError(`File \"${path}\" not found in package.`),\n    );\n    return vfile.clone();\n  }\n\n  get packageName(): string {\n    return this.meta.packageName;\n  }\n\n  get version(): string {\n    assert(\n      this.meta.version !== undefined,\n      'Tried to access version without first fetching NPM package.',\n    );\n    return this.meta.version;\n  }\n\n  get registry(): URL {\n    return this.meta.registry;\n  }\n\n  get versionRange(): SemVerRange {\n    return this.meta.requestedRange;\n  }\n\n  async #lazyInit() {\n    assert(this.files === undefined);\n    const resolvedVersion = await this.meta.resolveVersion(\n      this.meta.requestedRange,\n    );\n    const [tarballResponse, actualVersion] = await fetchNpmTarball(\n      this.meta.packageName,\n      resolvedVersion,\n      this.meta.registry,\n      this.meta.fetch,\n    );\n    this.meta.version = actualVersion;\n\n    let canonicalBase = 'npm://';\n    if (this.meta.registry.username !== '') {\n      canonicalBase += this.meta.registry.username;\n      if (this.meta.registry.password !== '') {\n        canonicalBase += `:${this.meta.registry.password}`;\n      }\n      canonicalBase += '@';\n    }\n    canonicalBase += this.meta.registry.host;\n\n    // TODO(ritave): Lazily extract files instead of up-front extracting all of them\n    //               We would need to replace tar-stream package because it requires immediate consumption of streams.\n    await new Promise<void>((resolve, reject) => {\n      this.files = new Map();\n      pipeline(\n        getNodeStream(tarballResponse),\n        // The \"gz\" in \"tgz\" stands for \"gzip\". The tarball needs to be decompressed\n        // before we can actually grab any files from it.\n        // To prevent recursion-based zip bombs, we set a maximum recursion depth of 1.\n        createGunzipStream(1),\n        createTarballStream(\n          `${canonicalBase}/${this.meta.packageName}/`,\n          this.files,\n        ),\n        (error) => {\n          error ? reject(error) : resolve();\n        },\n      );\n    });\n  }\n}\n\n// Safety limit for tarballs, 250 MB in bytes\nconst TARBALL_SIZE_SAFETY_LIMIT = 262144000;\n\n// Incomplete type\nexport type PartialNpmMetadata = {\n  versions: Record<string, { dist: { tarball: string } }>;\n};\n\n/**\n * Fetches the NPM metadata of the specified package from\n * the public npm registry.\n *\n * @param packageName - The name of the package whose metadata to fetch.\n * @param registryUrl - The URL of the npm registry to fetch the metadata from.\n * @param fetchFunction - The fetch function to use. Defaults to the global\n * {@link fetch}. Useful for Node.js compatibility.\n * @returns The NPM metadata object.\n * @throws If fetching the metadata fails.\n */\nexport async function fetchNpmMetadata(\n  packageName: string,\n  registryUrl: URL | string,\n  fetchFunction: typeof fetch,\n): Promise<PartialNpmMetadata> {\n  const packageResponse = await fetchFunction(\n    new URL(packageName, registryUrl).toString(),\n  );\n  if (!packageResponse.ok) {\n    throw new Error(\n      `Failed to fetch NPM registry entry. Status code: ${packageResponse.status}.`,\n    );\n  }\n  const packageMetadata = await packageResponse.json();\n\n  if (!isObject(packageMetadata)) {\n    throw new Error(\n      `Failed to fetch package \"${packageName}\" metadata from npm.`,\n    );\n  }\n\n  return packageMetadata as PartialNpmMetadata;\n}\n\n/**\n * Resolves a version range to a version using the NPM registry.\n *\n * Unless the version range is already a version, then the NPM registry is skipped.\n *\n * @param packageName - The name of the package whose metadata to fetch.\n * @param versionRange - The version range of the package.\n * @param registryUrl - The URL of the npm registry to fetch the metadata from.\n * @param fetchFunction - The fetch function to use. Defaults to the global\n * {@link fetch}. Useful for Node.js compatibility.\n * @returns An object containing the resolved version and a URL for its tarball.\n * @throws If fetching the metadata fails.\n */\nasync function resolveNpmVersion(\n  packageName: string,\n  versionRange: SemVerRange,\n  registryUrl: URL,\n  fetchFunction: typeof fetch,\n): Promise<{ tarballURL: string; targetVersion: SemVerVersion }> {\n  // If the version range is already a static version we don't need to look for the metadata.\n  if (\n    registryUrl.toString() === DEFAULT_NPM_REGISTRY.toString() &&\n    isValidSemVerVersion(versionRange)\n  ) {\n    return {\n      tarballURL: getNpmTarballUrl(packageName, versionRange),\n      targetVersion: versionRange,\n    };\n  }\n\n  const packageMetadata = await fetchNpmMetadata(\n    packageName,\n    registryUrl,\n    fetchFunction,\n  );\n\n  const versions = Object.keys(packageMetadata?.versions ?? {}).map(\n    (version) => {\n      assertIsSemVerVersion(version);\n      return version;\n    },\n  );\n\n  const targetVersion = getTargetVersion(versions, versionRange);\n\n  if (targetVersion === null) {\n    throw new Error(\n      `Failed to find a matching version in npm metadata for package \"${packageName}\" and requested semver range \"${versionRange}\".`,\n    );\n  }\n\n  const tarballURL = packageMetadata?.versions?.[targetVersion]?.dist?.tarball;\n\n  return { tarballURL, targetVersion };\n}\n\n/**\n * Fetches the tarball (`.tgz` file) of the specified package and version from\n * the public npm registry.\n *\n * @param packageName - The name of the package whose tarball to fetch.\n * @param versionRange - The SemVer range of the package to fetch. The highest\n * version satisfying the range will be fetched.\n * @param registryUrl - The URL of the npm registry to fetch the tarball from.\n * @param fetchFunction - The fetch function to use. Defaults to the global\n * {@link fetch}. Useful for Node.js compatibility.\n * @returns A tuple of the {@link Response} for the package tarball and the\n * actual version of the package.\n * @throws If fetching the tarball fails.\n */\nasync function fetchNpmTarball(\n  packageName: string,\n  versionRange: SemVerRange,\n  registryUrl: URL,\n  fetchFunction: typeof fetch,\n): Promise<[ReadableStream, SemVerVersion]> {\n  const { tarballURL, targetVersion } = await resolveNpmVersion(\n    packageName,\n    versionRange,\n    registryUrl,\n    fetchFunction,\n  );\n\n  if (!isValidUrl(tarballURL) || !tarballURL.toString().endsWith('.tgz')) {\n    throw new Error(\n      `Failed to find valid tarball URL in NPM metadata for package \"${packageName}\".`,\n    );\n  }\n\n  // Override the tarball hostname/protocol with registryUrl hostname/protocol\n  const newRegistryUrl = new URL(registryUrl);\n  const newTarballUrl = new URL(tarballURL);\n  newTarballUrl.hostname = newRegistryUrl.hostname;\n  newTarballUrl.protocol = newRegistryUrl.protocol;\n\n  // Perform a raw fetch because we want the Response object itself.\n  const tarballResponse = await fetchFunction(newTarballUrl.toString());\n  if (!tarballResponse.ok || !tarballResponse.body) {\n    throw new Error(`Failed to fetch tarball for package \"${packageName}\".`);\n  }\n  // We assume that NPM is a good actor and provides us with a valid `content-length` header.\n  const tarballSizeString = tarballResponse.headers.get('content-length');\n  assert(tarballSizeString, 'Snap tarball has invalid content-length');\n  const tarballSize = parseInt(tarballSizeString, 10);\n  assert(\n    tarballSize <= TARBALL_SIZE_SAFETY_LIMIT,\n    'Snap tarball exceeds size limit',\n  );\n  return [tarballResponse.body, targetVersion];\n}\n\n/**\n * The paths of files within npm tarballs appear to always be prefixed with\n * \"package/\".\n */\nconst NPM_TARBALL_PATH_PREFIX = /^package\\//u;\n\n/**\n * Converts a {@link ReadableStream} to a Node.js {@link Readable}\n * stream. Returns the stream directly if it is already a Node.js stream.\n * We can't use the native Web {@link ReadableStream} directly because the\n * other stream libraries we use expect Node.js streams.\n *\n * @param stream - The stream to convert.\n * @returns The given stream as a Node.js Readable stream.\n */\nfunction getNodeStream(stream: ReadableStream): Readable {\n  if (typeof stream.getReader !== 'function') {\n    return stream as unknown as Readable;\n  }\n\n  return new ReadableWebToNodeStream(stream);\n}\n\n/**\n * Creates a `tar-stream` that will get the necessary files from an npm Snap\n * package tarball (`.tgz` file).\n *\n * @param canonicalBase - A base URI as specified in {@link https://github.com/MetaMask/SIPs/blob/main/SIPS/sip-8.md SIP-8}. Starting with 'npm:'. Will be used for canonicalPath vfile argument.\n * @param files - An object to write target file contents to.\n * @returns The {@link Writable} tarball extraction stream.\n */\nfunction createTarballStream(\n  canonicalBase: string,\n  files: Map<string, VirtualFile>,\n): Writable {\n  assert(\n    canonicalBase.endsWith('/'),\n    \"Base needs to end with '/' for relative paths to be added as children instead of siblings.\",\n  );\n\n  assert(\n    canonicalBase.startsWith('npm:'),\n    'Protocol mismatch, expected \"npm:\".',\n  );\n  // `tar-stream` is pretty old-school, so we create it first and then\n  // instrument it by adding event listeners.\n  const extractStream = tarExtract();\n\n  let totalSize = 0;\n\n  // \"entry\" is fired for every discreet entity in the tarball. This includes\n  // files and folders.\n  extractStream.on('entry', (header, entryStream, next) => {\n    const { name: headerName, type: headerType } = header;\n    if (headerType === 'file') {\n      // The name is a path if the header type is \"file\".\n      const path = headerName.replace(NPM_TARBALL_PATH_PREFIX, '');\n      return entryStream.pipe(\n        concat({ encoding: 'uint8array' }, (data) => {\n          try {\n            totalSize += data.byteLength;\n            // To prevent zip bombs, we set a safety limit for the total size of tarballs.\n            assert(\n              totalSize < TARBALL_SIZE_SAFETY_LIMIT,\n              `Snap tarball exceeds limit of ${TARBALL_SIZE_SAFETY_LIMIT} bytes.`,\n            );\n            const vfile = new VirtualFile({\n              value: data,\n              path,\n              data: {\n                canonicalPath: new URL(path, canonicalBase).toString(),\n              },\n            });\n            // We disallow files having identical paths as it may confuse our checksum calculations.\n            assert(\n              !files.has(path),\n              'Malformed tarball, multiple files with the same path.',\n            );\n            files.set(path, vfile);\n            return next();\n          } catch (error) {\n            return extractStream.destroy(error);\n          }\n        }),\n      );\n    }\n\n    // If we get here, the entry is not a file, and we want to ignore. The entry\n    // stream must be drained, or the extractStream will stop reading. This is\n    // effectively a no-op for the current entry.\n    entryStream.on('end', () => next());\n    return entryStream.resume();\n  });\n  return extractStream;\n}\n"],"names":["createSnapManifest","DEFAULT_REQUESTED_SNAP_VERSION","getTargetVersion","isValidUrl","NpmSnapIdStruct","VirtualFile","normalizeRelative","parseJson","assert","assertIsSemVerVersion","assertStruct","isObject","isValidSemVerVersion","concat","getNpmTarballUrl","createGunzipStream","ReadableWebToNodeStream","pipeline","extract","tarExtract","DEFAULT_NPM_REGISTRY","URL","NpmLocation","manifest","validatedManifest","clone","vfile","fetch","result","toString","path","relativePath","files","lazyInit","undefined","get","TypeError","packageName","meta","version","registry","versionRange","requestedRange","constructor","url","opts","allowCustomRegistries","fetchFunction","globalThis","bind","defaultResolve","range","resolveVersion","host","port","username","password","pathname","search","hash","startsWith","slice","resolvedVersion","tarballResponse","actualVersion","fetchNpmTarball","canonicalBase","Promise","resolve","reject","Map","getNodeStream","createTarballStream","error","TARBALL_SIZE_SAFETY_LIMIT","fetchNpmMetadata","registryUrl","packageResponse","ok","Error","status","packageMetadata","json","resolveNpmVersion","tarballURL","targetVersion","versions","Object","keys","map","dist","tarball","endsWith","newRegistryUrl","newTarballUrl","hostname","protocol","body","tarballSizeString","headers","tarballSize","parseInt","NPM_TARBALL_PATH_PREFIX","stream","getReader","extractStream","totalSize","on","header","entryStream","next","name","headerName","type","headerType","replace","pipe","encoding","data","byteLength","value","canonicalPath","has","set","destroy","resume"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,SACEA,kBAAkB,EAClBC,8BAA8B,EAC9BC,gBAAgB,EAChBC,UAAU,EACVC,eAAe,EACfC,WAAW,EACXC,iBAAiB,EACjBC,SAAS,QACJ,wBAAwB;AAE/B,SACEC,MAAM,EACNC,qBAAqB,EACrBC,YAAY,EACZC,QAAQ,EACRC,oBAAoB,QACf,kBAAkB;AACzB,OAAOC,YAAY,gBAAgB;AACnC,OAAOC,sBAAsB,sBAAsB;AACnD,OAAOC,wBAAwB,eAAe;AAC9C,SAASC,uBAAuB,QAAQ,8BAA8B;AACtE,SAASC,QAAQ,QAAQ,SAAS;AAElC,SAASC,WAAWC,UAAU,QAAQ,aAAa;AAInD,OAAO,MAAMC,uBAAuB,IAAIC,IAAI,8BAA8B;IAyIlE;AAlHR,OAAO,MAAMC;IAmEX,MAAMC,WAA+C;QACnD,IAAI,IAAI,CAACC,iBAAiB,EAAE;YAC1B,OAAO,IAAI,CAACA,iBAAiB,CAACC,KAAK;QACrC;QAEA,MAAMC,QAAQ,MAAM,IAAI,CAACC,KAAK,CAAC;QAC/B,MAAMC,SAASrB,UAAUmB,MAAMG,QAAQ;QACvCH,MAAME,MAAM,GAAG5B,mBAAmB4B;QAClC,IAAI,CAACJ,iBAAiB,GAAGE;QAEzB,OAAO,IAAI,CAACH,QAAQ;IACtB;IAEA,MAAMI,MAAMG,IAAY,EAAwB;QAC9C,MAAMC,eAAezB,kBAAkBwB;QACvC,IAAI,CAAC,IAAI,CAACE,KAAK,EAAE;YACf,MAAM,0BAAA,IAAI,EAAEC,WAAAA,eAAN,IAAI;YACVzB,OAAO,IAAI,CAACwB,KAAK,KAAKE;QACxB;QACA,MAAMR,QAAQ,IAAI,CAACM,KAAK,CAACG,GAAG,CAACJ;QAC7BvB,OACEkB,UAAUQ,WACV,IAAIE,UAAU,CAAC,MAAM,EAAEN,KAAK,uBAAuB,CAAC;QAEtD,OAAOJ,MAAMD,KAAK;IACpB;IAEA,IAAIY,cAAsB;QACxB,OAAO,IAAI,CAACC,IAAI,CAACD,WAAW;IAC9B;IAEA,IAAIE,UAAkB;QACpB/B,OACE,IAAI,CAAC8B,IAAI,CAACC,OAAO,KAAKL,WACtB;QAEF,OAAO,IAAI,CAACI,IAAI,CAACC,OAAO;IAC1B;IAEA,IAAIC,WAAgB;QAClB,OAAO,IAAI,CAACF,IAAI,CAACE,QAAQ;IAC3B;IAEA,IAAIC,eAA4B;QAC9B,OAAO,IAAI,CAACH,IAAI,CAACI,cAAc;IACjC;IAzGAC,YAAYC,GAAQ,EAAEC,OAAkC,CAAC,CAAC,CAAE;QA2G5D,iCAAM;QAjHN,uBAAiBP,QAAjB,KAAA;QAEA,uBAAQd,qBAAR,KAAA;QAEA,uBAAQQ,SAAR,KAAA;QAGE,MAAMc,wBAAwBD,KAAKC,qBAAqB,IAAI;QAC5D,MAAMC,gBAAgBF,KAAKlB,KAAK,IAAIqB,WAAWrB,KAAK,CAACsB,IAAI,CAACD;QAC1D,MAAMN,iBAAiBG,KAAKJ,YAAY,IAAIxC;QAC5C,MAAMiD,iBAAiB,OAAOC,QAAuBA;QACrD,MAAMC,iBAAiBP,KAAKO,cAAc,IAAIF;QAE9CxC,aAAakC,IAAIf,QAAQ,IAAIzB,iBAAiB;QAE9C,IAAIoC;QACJ,IACEI,IAAIS,IAAI,KAAK,MACbT,IAAIU,IAAI,KAAK,MACbV,IAAIW,QAAQ,KAAK,MACjBX,IAAIY,QAAQ,KAAK,IACjB;YACAhB,WAAWpB;QACb,OAAO;YACLoB,WAAW;YACX,IAAII,IAAIW,QAAQ,EAAE;gBAChBf,YAAYI,IAAIW,QAAQ;gBACxB,IAAIX,IAAIY,QAAQ,EAAE;oBAChBhB,YAAY,CAAC,CAAC,EAAEI,IAAIY,QAAQ,CAAC,CAAC;gBAChC;gBACAhB,YAAY;YACd;YACAA,YAAYI,IAAIS,IAAI;YACpBb,WAAW,IAAInB,IAAImB;YACnBhC,OACEsC,uBACA,IAAIV,UACF,CAAC,kDAAkD,EAAEI,SAASX,QAAQ,GAAG,EAAE,CAAC;QAGlF;QAEArB,OACEgC,SAASiB,QAAQ,KAAK,OACpBjB,SAASkB,MAAM,KAAK,MACpBlB,SAASmB,IAAI,KAAK;QAGtBnD,OACEoC,IAAIa,QAAQ,KAAK,MAAMb,IAAIa,QAAQ,KAAK,KACxC,IAAIrB,UAAU;QAEhB,IAAIC,cAAcO,IAAIa,QAAQ;QAC9B,IAAIpB,YAAYuB,UAAU,CAAC,MAAM;YAC/BvB,cAAcA,YAAYwB,KAAK,CAAC;QAClC;QAEA,IAAI,CAACvB,IAAI,GAAG;YACVI;YACAF;YACAH;YACAV,OAAOoB;YACPK;QACF;IACF;AA4FF;AA3CE,eAAA;IACE5C,OAAO,IAAI,CAACwB,KAAK,KAAKE;IACtB,MAAM4B,kBAAkB,MAAM,IAAI,CAACxB,IAAI,CAACc,cAAc,CACpD,IAAI,CAACd,IAAI,CAACI,cAAc;IAE1B,MAAM,CAACqB,iBAAiBC,cAAc,GAAG,MAAMC,gBAC7C,IAAI,CAAC3B,IAAI,CAACD,WAAW,EACrByB,iBACA,IAAI,CAACxB,IAAI,CAACE,QAAQ,EAClB,IAAI,CAACF,IAAI,CAACX,KAAK;IAEjB,IAAI,CAACW,IAAI,CAACC,OAAO,GAAGyB;IAEpB,IAAIE,gBAAgB;IACpB,IAAI,IAAI,CAAC5B,IAAI,CAACE,QAAQ,CAACe,QAAQ,KAAK,IAAI;QACtCW,iBAAiB,IAAI,CAAC5B,IAAI,CAACE,QAAQ,CAACe,QAAQ;QAC5C,IAAI,IAAI,CAACjB,IAAI,CAACE,QAAQ,CAACgB,QAAQ,KAAK,IAAI;YACtCU,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC5B,IAAI,CAACE,QAAQ,CAACgB,QAAQ,CAAC,CAAC;QACpD;QACAU,iBAAiB;IACnB;IACAA,iBAAiB,IAAI,CAAC5B,IAAI,CAACE,QAAQ,CAACa,IAAI;IAExC,gFAAgF;IAChF,kHAAkH;IAClH,MAAM,IAAIc,QAAc,CAACC,SAASC;QAChC,IAAI,CAACrC,KAAK,GAAG,IAAIsC;QACjBrD,SACEsD,cAAcR,kBACd,4EAA4E;QAC5E,iDAAiD;QACjD,+EAA+E;QAC/EhD,mBAAmB,IACnByD,oBACE,CAAC,EAAEN,cAAc,CAAC,EAAE,IAAI,CAAC5B,IAAI,CAACD,WAAW,CAAC,CAAC,CAAC,EAC5C,IAAI,CAACL,KAAK,GAEZ,CAACyC;YACCA,QAAQJ,OAAOI,SAASL;QAC1B;IAEJ;AACF;AAGF,6CAA6C;AAC7C,MAAMM,4BAA4B;AAOlC;;;;;;;;;;CAUC,GACD,OAAO,eAAeC,iBACpBtC,WAAmB,EACnBuC,WAAyB,EACzB7B,aAA2B;IAE3B,MAAM8B,kBAAkB,MAAM9B,cAC5B,IAAI1B,IAAIgB,aAAauC,aAAa/C,QAAQ;IAE5C,IAAI,CAACgD,gBAAgBC,EAAE,EAAE;QACvB,MAAM,IAAIC,MACR,CAAC,iDAAiD,EAAEF,gBAAgBG,MAAM,CAAC,CAAC,CAAC;IAEjF;IACA,MAAMC,kBAAkB,MAAMJ,gBAAgBK,IAAI;IAElD,IAAI,CAACvE,SAASsE,kBAAkB;QAC9B,MAAM,IAAIF,MACR,CAAC,yBAAyB,EAAE1C,YAAY,oBAAoB,CAAC;IAEjE;IAEA,OAAO4C;AACT;AAEA;;;;;;;;;;;;CAYC,GACD,eAAeE,kBACb9C,WAAmB,EACnBI,YAAyB,EACzBmC,WAAgB,EAChB7B,aAA2B;IAE3B,2FAA2F;IAC3F,IACE6B,YAAY/C,QAAQ,OAAOT,qBAAqBS,QAAQ,MACxDjB,qBAAqB6B,eACrB;QACA,OAAO;YACL2C,YAAYtE,iBAAiBuB,aAAaI;YAC1C4C,eAAe5C;QACjB;IACF;IAEA,MAAMwC,kBAAkB,MAAMN,iBAC5BtC,aACAuC,aACA7B;IAGF,MAAMuC,WAAWC,OAAOC,IAAI,CAACP,iBAAiBK,YAAY,CAAC,GAAGG,GAAG,CAC/D,CAAClD;QACC9B,sBAAsB8B;QACtB,OAAOA;IACT;IAGF,MAAM8C,gBAAgBnF,iBAAiBoF,UAAU7C;IAEjD,IAAI4C,kBAAkB,MAAM;QAC1B,MAAM,IAAIN,MACR,CAAC,+DAA+D,EAAE1C,YAAY,8BAA8B,EAAEI,aAAa,EAAE,CAAC;IAElI;IAEA,MAAM2C,aAAaH,iBAAiBK,UAAU,CAACD,cAAc,EAAEK,MAAMC;IAErE,OAAO;QAAEP;QAAYC;IAAc;AACrC;AAEA;;;;;;;;;;;;;CAaC,GACD,eAAepB,gBACb5B,WAAmB,EACnBI,YAAyB,EACzBmC,WAAgB,EAChB7B,aAA2B;IAE3B,MAAM,EAAEqC,UAAU,EAAEC,aAAa,EAAE,GAAG,MAAMF,kBAC1C9C,aACAI,cACAmC,aACA7B;IAGF,IAAI,CAAC5C,WAAWiF,eAAe,CAACA,WAAWvD,QAAQ,GAAG+D,QAAQ,CAAC,SAAS;QACtE,MAAM,IAAIb,MACR,CAAC,8DAA8D,EAAE1C,YAAY,EAAE,CAAC;IAEpF;IAEA,4EAA4E;IAC5E,MAAMwD,iBAAiB,IAAIxE,IAAIuD;IAC/B,MAAMkB,gBAAgB,IAAIzE,IAAI+D;IAC9BU,cAAcC,QAAQ,GAAGF,eAAeE,QAAQ;IAChDD,cAAcE,QAAQ,GAAGH,eAAeG,QAAQ;IAEhD,kEAAkE;IAClE,MAAMjC,kBAAkB,MAAMhB,cAAc+C,cAAcjE,QAAQ;IAClE,IAAI,CAACkC,gBAAgBe,EAAE,IAAI,CAACf,gBAAgBkC,IAAI,EAAE;QAChD,MAAM,IAAIlB,MAAM,CAAC,qCAAqC,EAAE1C,YAAY,EAAE,CAAC;IACzE;IACA,2FAA2F;IAC3F,MAAM6D,oBAAoBnC,gBAAgBoC,OAAO,CAAChE,GAAG,CAAC;IACtD3B,OAAO0F,mBAAmB;IAC1B,MAAME,cAAcC,SAASH,mBAAmB;IAChD1F,OACE4F,eAAe1B,2BACf;IAEF,OAAO;QAACX,gBAAgBkC,IAAI;QAAEZ;KAAc;AAC9C;AAEA;;;CAGC,GACD,MAAMiB,0BAA0B;AAEhC;;;;;;;;CAQC,GACD,SAAS/B,cAAcgC,MAAsB;IAC3C,IAAI,OAAOA,OAAOC,SAAS,KAAK,YAAY;QAC1C,OAAOD;IACT;IAEA,OAAO,IAAIvF,wBAAwBuF;AACrC;AAEA;;;;;;;CAOC,GACD,SAAS/B,oBACPN,aAAqB,EACrBlC,KAA+B;IAE/BxB,OACE0D,cAAc0B,QAAQ,CAAC,MACvB;IAGFpF,OACE0D,cAAcN,UAAU,CAAC,SACzB;IAEF,oEAAoE;IACpE,2CAA2C;IAC3C,MAAM6C,gBAAgBtF;IAEtB,IAAIuF,YAAY;IAEhB,2EAA2E;IAC3E,qBAAqB;IACrBD,cAAcE,EAAE,CAAC,SAAS,CAACC,QAAQC,aAAaC;QAC9C,MAAM,EAAEC,MAAMC,UAAU,EAAEC,MAAMC,UAAU,EAAE,GAAGN;QAC/C,IAAIM,eAAe,QAAQ;YACzB,mDAAmD;YACnD,MAAMpF,OAAOkF,WAAWG,OAAO,CAACb,yBAAyB;YACzD,OAAOO,YAAYO,IAAI,CACrBvG,OAAO;gBAAEwG,UAAU;YAAa,GAAG,CAACC;gBAClC,IAAI;oBACFZ,aAAaY,KAAKC,UAAU;oBAC5B,8EAA8E;oBAC9E/G,OACEkG,YAAYhC,2BACZ,CAAC,8BAA8B,EAAEA,0BAA0B,OAAO,CAAC;oBAErE,MAAMhD,QAAQ,IAAIrB,YAAY;wBAC5BmH,OAAOF;wBACPxF;wBACAwF,MAAM;4BACJG,eAAe,IAAIpG,IAAIS,MAAMoC,eAAerC,QAAQ;wBACtD;oBACF;oBACA,wFAAwF;oBACxFrB,OACE,CAACwB,MAAM0F,GAAG,CAAC5F,OACX;oBAEFE,MAAM2F,GAAG,CAAC7F,MAAMJ;oBAChB,OAAOoF;gBACT,EAAE,OAAOrC,OAAO;oBACd,OAAOgC,cAAcmB,OAAO,CAACnD;gBAC/B;YACF;QAEJ;QAEA,4EAA4E;QAC5E,0EAA0E;QAC1E,6CAA6C;QAC7CoC,YAAYF,EAAE,CAAC,OAAO,IAAMG;QAC5B,OAAOD,YAAYgB,MAAM;IAC3B;IACA,OAAOpB;AACT"}
+{"version":3,"sources":["../../../../src/snaps/location/npm.ts"],"sourcesContent":["import type { SnapManifest } from '@metamask/snaps-utils';\nimport {\n  createSnapManifest,\n  DEFAULT_REQUESTED_SNAP_VERSION,\n  getTargetVersion,\n  isValidUrl,\n  NpmSnapIdStruct,\n  VirtualFile,\n  normalizeRelative,\n  parseJson,\n} from '@metamask/snaps-utils';\nimport type { SemVerRange, SemVerVersion } from '@metamask/utils';\nimport {\n  assert,\n  assertIsSemVerVersion,\n  assertStruct,\n  isObject,\n  isValidSemVerVersion,\n} from '@metamask/utils';\nimport concat from 'concat-stream';\nimport getNpmTarballUrl from 'get-npm-tarball-url';\nimport createGunzipStream from 'gunzip-maybe';\nimport { pipeline } from 'readable-stream';\nimport type { Readable, Writable } from 'readable-stream';\nimport { ReadableWebToNodeStream } from 'readable-web-to-node-stream';\nimport { extract as tarExtract } from 'tar-stream';\n\nimport type { DetectSnapLocationOptions, SnapLocation } from './location';\n\nexport const DEFAULT_NPM_REGISTRY = new URL('https://registry.npmjs.org');\n\ninterface NpmMeta {\n  registry: URL;\n  packageName: string;\n  requestedRange: SemVerRange;\n  version?: string;\n  fetch: typeof fetch;\n  resolveVersion: (range: SemVerRange) => Promise<SemVerRange>;\n}\nexport interface NpmOptions {\n  /**\n   * @default DEFAULT_REQUESTED_SNAP_VERSION\n   */\n  versionRange?: SemVerRange;\n  /**\n   * Whether to allow custom NPM registries outside of {@link DEFAULT_NPM_REGISTRY}.\n   *\n   * @default false\n   */\n  allowCustomRegistries?: boolean;\n}\n\nexport class NpmLocation implements SnapLocation {\n  private readonly meta: NpmMeta;\n\n  private validatedManifest?: VirtualFile<SnapManifest>;\n\n  private files?: Map<string, VirtualFile>;\n\n  constructor(url: URL, opts: DetectSnapLocationOptions = {}) {\n    const allowCustomRegistries = opts.allowCustomRegistries ?? false;\n    const fetchFunction = opts.fetch ?? globalThis.fetch.bind(globalThis);\n    const requestedRange = opts.versionRange ?? DEFAULT_REQUESTED_SNAP_VERSION;\n    const defaultResolve = async (range: SemVerRange) => range;\n    const resolveVersion = opts.resolveVersion ?? defaultResolve;\n\n    assertStruct(url.toString(), NpmSnapIdStruct, 'Invalid Snap Id: ');\n\n    let registry: string | URL;\n    if (\n      url.host === '' &&\n      url.port === '' &&\n      url.username === '' &&\n      url.password === ''\n    ) {\n      registry = DEFAULT_NPM_REGISTRY;\n    } else {\n      registry = 'https://';\n      if (url.username) {\n        registry += url.username;\n        if (url.password) {\n          registry += `:${url.password}`;\n        }\n        registry += '@';\n      }\n      registry += url.host;\n      registry = new URL(registry);\n      assert(\n        allowCustomRegistries,\n        new TypeError(\n          `Custom NPM registries are disabled, tried to use \"${registry.toString()}\".`,\n        ),\n      );\n    }\n\n    assert(\n      registry.pathname === '/' &&\n        registry.search === '' &&\n        registry.hash === '',\n    );\n\n    assert(\n      url.pathname !== '' && url.pathname !== '/',\n      new TypeError('The package name in NPM location is empty.'),\n    );\n    let packageName = url.pathname;\n    if (packageName.startsWith('/')) {\n      packageName = packageName.slice(1);\n    }\n\n    this.meta = {\n      requestedRange,\n      registry,\n      packageName,\n      fetch: fetchFunction,\n      resolveVersion,\n    };\n  }\n\n  async manifest(): Promise<VirtualFile<SnapManifest>> {\n    if (this.validatedManifest) {\n      return this.validatedManifest.clone();\n    }\n\n    const vfile = await this.fetch('snap.manifest.json');\n    const result = parseJson(vfile.toString());\n    vfile.result = createSnapManifest(result);\n    this.validatedManifest = vfile as VirtualFile<SnapManifest>;\n\n    return this.manifest();\n  }\n\n  async fetch(path: string): Promise<VirtualFile> {\n    const relativePath = normalizeRelative(path);\n    if (!this.files) {\n      await this.#lazyInit();\n      assert(this.files !== undefined);\n    }\n    const vfile = this.files.get(relativePath);\n    assert(\n      vfile !== undefined,\n      new TypeError(`File \"${path}\" not found in package.`),\n    );\n    return vfile.clone();\n  }\n\n  get packageName(): string {\n    return this.meta.packageName;\n  }\n\n  get version(): string {\n    assert(\n      this.meta.version !== undefined,\n      'Tried to access version without first fetching NPM package.',\n    );\n    return this.meta.version;\n  }\n\n  get registry(): URL {\n    return this.meta.registry;\n  }\n\n  get versionRange(): SemVerRange {\n    return this.meta.requestedRange;\n  }\n\n  async #lazyInit() {\n    assert(this.files === undefined);\n    const resolvedVersion = await this.meta.resolveVersion(\n      this.meta.requestedRange,\n    );\n    const [tarballResponse, actualVersion] = await fetchNpmTarball(\n      this.meta.packageName,\n      resolvedVersion,\n      this.meta.registry,\n      this.meta.fetch,\n    );\n    this.meta.version = actualVersion;\n\n    let canonicalBase = 'npm://';\n    if (this.meta.registry.username !== '') {\n      canonicalBase += this.meta.registry.username;\n      if (this.meta.registry.password !== '') {\n        canonicalBase += `:${this.meta.registry.password}`;\n      }\n      canonicalBase += '@';\n    }\n    canonicalBase += this.meta.registry.host;\n\n    // TODO(ritave): Lazily extract files instead of up-front extracting all of them\n    //               We would need to replace tar-stream package because it requires immediate consumption of streams.\n    await new Promise<void>((resolve, reject) => {\n      this.files = new Map();\n      pipeline(\n        getNodeStream(tarballResponse),\n        // The \"gz\" in \"tgz\" stands for \"gzip\". The tarball needs to be decompressed\n        // before we can actually grab any files from it.\n        // To prevent recursion-based zip bombs, we set a maximum recursion depth of 1.\n        createGunzipStream(1),\n        createTarballStream(\n          `${canonicalBase}/${this.meta.packageName}/`,\n          this.files,\n        ),\n        (error: unknown) => {\n          error ? reject(error) : resolve();\n        },\n      );\n    });\n  }\n}\n\n// Safety limit for tarballs, 250 MB in bytes\nconst TARBALL_SIZE_SAFETY_LIMIT = 262144000;\n\n// Incomplete type\nexport type PartialNpmMetadata = {\n  versions: Record<string, { dist: { tarball: string } }>;\n};\n\n/**\n * Fetches the NPM metadata of the specified package from\n * the public npm registry.\n *\n * @param packageName - The name of the package whose metadata to fetch.\n * @param registryUrl - The URL of the npm registry to fetch the metadata from.\n * @param fetchFunction - The fetch function to use. Defaults to the global\n * {@link fetch}. Useful for Node.js compatibility.\n * @returns The NPM metadata object.\n * @throws If fetching the metadata fails.\n */\nexport async function fetchNpmMetadata(\n  packageName: string,\n  registryUrl: URL | string,\n  fetchFunction: typeof fetch,\n): Promise<PartialNpmMetadata> {\n  const packageResponse = await fetchFunction(\n    new URL(packageName, registryUrl).toString(),\n  );\n  if (!packageResponse.ok) {\n    throw new Error(\n      `Failed to fetch NPM registry entry. Status code: ${packageResponse.status}.`,\n    );\n  }\n  const packageMetadata = await packageResponse.json();\n\n  if (!isObject(packageMetadata)) {\n    throw new Error(\n      `Failed to fetch package \"${packageName}\" metadata from npm.`,\n    );\n  }\n\n  return packageMetadata as PartialNpmMetadata;\n}\n\n/**\n * Resolves a version range to a version using the NPM registry.\n *\n * Unless the version range is already a version, then the NPM registry is skipped.\n *\n * @param packageName - The name of the package whose metadata to fetch.\n * @param versionRange - The version range of the package.\n * @param registryUrl - The URL of the npm registry to fetch the metadata from.\n * @param fetchFunction - The fetch function to use. Defaults to the global\n * {@link fetch}. Useful for Node.js compatibility.\n * @returns An object containing the resolved version and a URL for its tarball.\n * @throws If fetching the metadata fails.\n */\nasync function resolveNpmVersion(\n  packageName: string,\n  versionRange: SemVerRange,\n  registryUrl: URL,\n  fetchFunction: typeof fetch,\n): Promise<{ tarballURL: string; targetVersion: SemVerVersion }> {\n  // If the version range is already a static version we don't need to look for the metadata.\n  if (\n    registryUrl.toString() === DEFAULT_NPM_REGISTRY.toString() &&\n    isValidSemVerVersion(versionRange)\n  ) {\n    return {\n      tarballURL: getNpmTarballUrl(packageName, versionRange),\n      targetVersion: versionRange,\n    };\n  }\n\n  const packageMetadata = await fetchNpmMetadata(\n    packageName,\n    registryUrl,\n    fetchFunction,\n  );\n\n  const versions = Object.keys(packageMetadata?.versions ?? {}).map(\n    (version) => {\n      assertIsSemVerVersion(version);\n      return version;\n    },\n  );\n\n  const targetVersion = getTargetVersion(versions, versionRange);\n\n  if (targetVersion === null) {\n    throw new Error(\n      `Failed to find a matching version in npm metadata for package \"${packageName}\" and requested semver range \"${versionRange}\".`,\n    );\n  }\n\n  const tarballURL = packageMetadata?.versions?.[targetVersion]?.dist?.tarball;\n\n  return { tarballURL, targetVersion };\n}\n\n/**\n * Fetches the tarball (`.tgz` file) of the specified package and version from\n * the public npm registry.\n *\n * @param packageName - The name of the package whose tarball to fetch.\n * @param versionRange - The SemVer range of the package to fetch. The highest\n * version satisfying the range will be fetched.\n * @param registryUrl - The URL of the npm registry to fetch the tarball from.\n * @param fetchFunction - The fetch function to use. Defaults to the global\n * {@link fetch}. Useful for Node.js compatibility.\n * @returns A tuple of the {@link Response} for the package tarball and the\n * actual version of the package.\n * @throws If fetching the tarball fails.\n */\nasync function fetchNpmTarball(\n  packageName: string,\n  versionRange: SemVerRange,\n  registryUrl: URL,\n  fetchFunction: typeof fetch,\n): Promise<[ReadableStream, SemVerVersion]> {\n  const { tarballURL, targetVersion } = await resolveNpmVersion(\n    packageName,\n    versionRange,\n    registryUrl,\n    fetchFunction,\n  );\n\n  if (!isValidUrl(tarballURL) || !tarballURL.toString().endsWith('.tgz')) {\n    throw new Error(\n      `Failed to find valid tarball URL in NPM metadata for package \"${packageName}\".`,\n    );\n  }\n\n  // Override the tarball hostname/protocol with registryUrl hostname/protocol\n  const newRegistryUrl = new URL(registryUrl);\n  const newTarballUrl = new URL(tarballURL);\n  newTarballUrl.hostname = newRegistryUrl.hostname;\n  newTarballUrl.protocol = newRegistryUrl.protocol;\n\n  // Perform a raw fetch because we want the Response object itself.\n  const tarballResponse = await fetchFunction(newTarballUrl.toString());\n  if (!tarballResponse.ok || !tarballResponse.body) {\n    throw new Error(`Failed to fetch tarball for package \"${packageName}\".`);\n  }\n  // We assume that NPM is a good actor and provides us with a valid `content-length` header.\n  const tarballSizeString = tarballResponse.headers.get('content-length');\n  assert(tarballSizeString, 'Snap tarball has invalid content-length');\n  const tarballSize = parseInt(tarballSizeString, 10);\n  assert(\n    tarballSize <= TARBALL_SIZE_SAFETY_LIMIT,\n    'Snap tarball exceeds size limit',\n  );\n  return [tarballResponse.body, targetVersion];\n}\n\n/**\n * The paths of files within npm tarballs appear to always be prefixed with\n * \"package/\".\n */\nconst NPM_TARBALL_PATH_PREFIX = /^package\\//u;\n\n/**\n * Converts a {@link ReadableStream} to a Node.js {@link Readable}\n * stream. Returns the stream directly if it is already a Node.js stream.\n * We can't use the native Web {@link ReadableStream} directly because the\n * other stream libraries we use expect Node.js streams.\n *\n * @param stream - The stream to convert.\n * @returns The given stream as a Node.js Readable stream.\n */\nfunction getNodeStream(stream: ReadableStream): Readable {\n  if (typeof stream.getReader !== 'function') {\n    return stream as unknown as Readable;\n  }\n\n  return new ReadableWebToNodeStream(stream);\n}\n\n/**\n * Creates a `tar-stream` that will get the necessary files from an npm Snap\n * package tarball (`.tgz` file).\n *\n * @param canonicalBase - A base URI as specified in {@link https://github.com/MetaMask/SIPs/blob/main/SIPS/sip-8.md SIP-8}. Starting with 'npm:'. Will be used for canonicalPath vfile argument.\n * @param files - An object to write target file contents to.\n * @returns The {@link Writable} tarball extraction stream.\n */\nfunction createTarballStream(\n  canonicalBase: string,\n  files: Map<string, VirtualFile>,\n): Writable {\n  assert(\n    canonicalBase.endsWith('/'),\n    \"Base needs to end with '/' for relative paths to be added as children instead of siblings.\",\n  );\n\n  assert(\n    canonicalBase.startsWith('npm:'),\n    'Protocol mismatch, expected \"npm:\".',\n  );\n  // `tar-stream` is pretty old-school, so we create it first and then\n  // instrument it by adding event listeners.\n  const extractStream = tarExtract();\n\n  let totalSize = 0;\n\n  // \"entry\" is fired for every discreet entity in the tarball. This includes\n  // files and folders.\n  extractStream.on('entry', (header, entryStream, next) => {\n    const { name: headerName, type: headerType } = header;\n    if (headerType === 'file') {\n      // The name is a path if the header type is \"file\".\n      const path = headerName.replace(NPM_TARBALL_PATH_PREFIX, '');\n      return entryStream.pipe(\n        concat({ encoding: 'uint8array' }, (data) => {\n          try {\n            totalSize += data.byteLength;\n            // To prevent zip bombs, we set a safety limit for the total size of tarballs.\n            assert(\n              totalSize < TARBALL_SIZE_SAFETY_LIMIT,\n              `Snap tarball exceeds limit of ${TARBALL_SIZE_SAFETY_LIMIT} bytes.`,\n            );\n            const vfile = new VirtualFile({\n              value: data,\n              path,\n              data: {\n                canonicalPath: new URL(path, canonicalBase).toString(),\n              },\n            });\n            // We disallow files having identical paths as it may confuse our checksum calculations.\n            assert(\n              !files.has(path),\n              'Malformed tarball, multiple files with the same path.',\n            );\n            files.set(path, vfile);\n            return next();\n          } catch (error) {\n            return extractStream.destroy(error);\n          }\n        }),\n      );\n    }\n\n    // If we get here, the entry is not a file, and we want to ignore. The entry\n    // stream must be drained, or the extractStream will stop reading. This is\n    // effectively a no-op for the current entry.\n    entryStream.on('end', () => next());\n    return entryStream.resume();\n  });\n  return extractStream;\n}\n"],"names":["createSnapManifest","DEFAULT_REQUESTED_SNAP_VERSION","getTargetVersion","isValidUrl","NpmSnapIdStruct","VirtualFile","normalizeRelative","parseJson","assert","assertIsSemVerVersion","assertStruct","isObject","isValidSemVerVersion","concat","getNpmTarballUrl","createGunzipStream","pipeline","ReadableWebToNodeStream","extract","tarExtract","DEFAULT_NPM_REGISTRY","URL","NpmLocation","manifest","validatedManifest","clone","vfile","fetch","result","toString","path","relativePath","files","lazyInit","undefined","get","TypeError","packageName","meta","version","registry","versionRange","requestedRange","constructor","url","opts","allowCustomRegistries","fetchFunction","globalThis","bind","defaultResolve","range","resolveVersion","host","port","username","password","pathname","search","hash","startsWith","slice","resolvedVersion","tarballResponse","actualVersion","fetchNpmTarball","canonicalBase","Promise","resolve","reject","Map","getNodeStream","createTarballStream","error","TARBALL_SIZE_SAFETY_LIMIT","fetchNpmMetadata","registryUrl","packageResponse","ok","Error","status","packageMetadata","json","resolveNpmVersion","tarballURL","targetVersion","versions","Object","keys","map","dist","tarball","endsWith","newRegistryUrl","newTarballUrl","hostname","protocol","body","tarballSizeString","headers","tarballSize","parseInt","NPM_TARBALL_PATH_PREFIX","stream","getReader","extractStream","totalSize","on","header","entryStream","next","name","headerName","type","headerType","replace","pipe","encoding","data","byteLength","value","canonicalPath","has","set","destroy","resume"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,SACEA,kBAAkB,EAClBC,8BAA8B,EAC9BC,gBAAgB,EAChBC,UAAU,EACVC,eAAe,EACfC,WAAW,EACXC,iBAAiB,EACjBC,SAAS,QACJ,wBAAwB;AAE/B,SACEC,MAAM,EACNC,qBAAqB,EACrBC,YAAY,EACZC,QAAQ,EACRC,oBAAoB,QACf,kBAAkB;AACzB,OAAOC,YAAY,gBAAgB;AACnC,OAAOC,sBAAsB,sBAAsB;AACnD,OAAOC,wBAAwB,eAAe;AAC9C,SAASC,QAAQ,QAAQ,kBAAkB;AAE3C,SAASC,uBAAuB,QAAQ,8BAA8B;AACtE,SAASC,WAAWC,UAAU,QAAQ,aAAa;AAInD,OAAO,MAAMC,uBAAuB,IAAIC,IAAI,8BAA8B;IAyIlE;AAlHR,OAAO,MAAMC;IAmEX,MAAMC,WAA+C;QACnD,IAAI,IAAI,CAACC,iBAAiB,EAAE;YAC1B,OAAO,IAAI,CAACA,iBAAiB,CAACC,KAAK;QACrC;QAEA,MAAMC,QAAQ,MAAM,IAAI,CAACC,KAAK,CAAC;QAC/B,MAAMC,SAASrB,UAAUmB,MAAMG,QAAQ;QACvCH,MAAME,MAAM,GAAG5B,mBAAmB4B;QAClC,IAAI,CAACJ,iBAAiB,GAAGE;QAEzB,OAAO,IAAI,CAACH,QAAQ;IACtB;IAEA,MAAMI,MAAMG,IAAY,EAAwB;QAC9C,MAAMC,eAAezB,kBAAkBwB;QACvC,IAAI,CAAC,IAAI,CAACE,KAAK,EAAE;YACf,MAAM,0BAAA,IAAI,EAAEC,WAAAA,eAAN,IAAI;YACVzB,OAAO,IAAI,CAACwB,KAAK,KAAKE;QACxB;QACA,MAAMR,QAAQ,IAAI,CAACM,KAAK,CAACG,GAAG,CAACJ;QAC7BvB,OACEkB,UAAUQ,WACV,IAAIE,UAAU,CAAC,MAAM,EAAEN,KAAK,uBAAuB,CAAC;QAEtD,OAAOJ,MAAMD,KAAK;IACpB;IAEA,IAAIY,cAAsB;QACxB,OAAO,IAAI,CAACC,IAAI,CAACD,WAAW;IAC9B;IAEA,IAAIE,UAAkB;QACpB/B,OACE,IAAI,CAAC8B,IAAI,CAACC,OAAO,KAAKL,WACtB;QAEF,OAAO,IAAI,CAACI,IAAI,CAACC,OAAO;IAC1B;IAEA,IAAIC,WAAgB;QAClB,OAAO,IAAI,CAACF,IAAI,CAACE,QAAQ;IAC3B;IAEA,IAAIC,eAA4B;QAC9B,OAAO,IAAI,CAACH,IAAI,CAACI,cAAc;IACjC;IAzGAC,YAAYC,GAAQ,EAAEC,OAAkC,CAAC,CAAC,CAAE;QA2G5D,iCAAM;QAjHN,uBAAiBP,QAAjB,KAAA;QAEA,uBAAQd,qBAAR,KAAA;QAEA,uBAAQQ,SAAR,KAAA;QAGE,MAAMc,wBAAwBD,KAAKC,qBAAqB,IAAI;QAC5D,MAAMC,gBAAgBF,KAAKlB,KAAK,IAAIqB,WAAWrB,KAAK,CAACsB,IAAI,CAACD;QAC1D,MAAMN,iBAAiBG,KAAKJ,YAAY,IAAIxC;QAC5C,MAAMiD,iBAAiB,OAAOC,QAAuBA;QACrD,MAAMC,iBAAiBP,KAAKO,cAAc,IAAIF;QAE9CxC,aAAakC,IAAIf,QAAQ,IAAIzB,iBAAiB;QAE9C,IAAIoC;QACJ,IACEI,IAAIS,IAAI,KAAK,MACbT,IAAIU,IAAI,KAAK,MACbV,IAAIW,QAAQ,KAAK,MACjBX,IAAIY,QAAQ,KAAK,IACjB;YACAhB,WAAWpB;QACb,OAAO;YACLoB,WAAW;YACX,IAAII,IAAIW,QAAQ,EAAE;gBAChBf,YAAYI,IAAIW,QAAQ;gBACxB,IAAIX,IAAIY,QAAQ,EAAE;oBAChBhB,YAAY,CAAC,CAAC,EAAEI,IAAIY,QAAQ,CAAC,CAAC;gBAChC;gBACAhB,YAAY;YACd;YACAA,YAAYI,IAAIS,IAAI;YACpBb,WAAW,IAAInB,IAAImB;YACnBhC,OACEsC,uBACA,IAAIV,UACF,CAAC,kDAAkD,EAAEI,SAASX,QAAQ,GAAG,EAAE,CAAC;QAGlF;QAEArB,OACEgC,SAASiB,QAAQ,KAAK,OACpBjB,SAASkB,MAAM,KAAK,MACpBlB,SAASmB,IAAI,KAAK;QAGtBnD,OACEoC,IAAIa,QAAQ,KAAK,MAAMb,IAAIa,QAAQ,KAAK,KACxC,IAAIrB,UAAU;QAEhB,IAAIC,cAAcO,IAAIa,QAAQ;QAC9B,IAAIpB,YAAYuB,UAAU,CAAC,MAAM;YAC/BvB,cAAcA,YAAYwB,KAAK,CAAC;QAClC;QAEA,IAAI,CAACvB,IAAI,GAAG;YACVI;YACAF;YACAH;YACAV,OAAOoB;YACPK;QACF;IACF;AA4FF;AA3CE,eAAA;IACE5C,OAAO,IAAI,CAACwB,KAAK,KAAKE;IACtB,MAAM4B,kBAAkB,MAAM,IAAI,CAACxB,IAAI,CAACc,cAAc,CACpD,IAAI,CAACd,IAAI,CAACI,cAAc;IAE1B,MAAM,CAACqB,iBAAiBC,cAAc,GAAG,MAAMC,gBAC7C,IAAI,CAAC3B,IAAI,CAACD,WAAW,EACrByB,iBACA,IAAI,CAACxB,IAAI,CAACE,QAAQ,EAClB,IAAI,CAACF,IAAI,CAACX,KAAK;IAEjB,IAAI,CAACW,IAAI,CAACC,OAAO,GAAGyB;IAEpB,IAAIE,gBAAgB;IACpB,IAAI,IAAI,CAAC5B,IAAI,CAACE,QAAQ,CAACe,QAAQ,KAAK,IAAI;QACtCW,iBAAiB,IAAI,CAAC5B,IAAI,CAACE,QAAQ,CAACe,QAAQ;QAC5C,IAAI,IAAI,CAACjB,IAAI,CAACE,QAAQ,CAACgB,QAAQ,KAAK,IAAI;YACtCU,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC5B,IAAI,CAACE,QAAQ,CAACgB,QAAQ,CAAC,CAAC;QACpD;QACAU,iBAAiB;IACnB;IACAA,iBAAiB,IAAI,CAAC5B,IAAI,CAACE,QAAQ,CAACa,IAAI;IAExC,gFAAgF;IAChF,kHAAkH;IAClH,MAAM,IAAIc,QAAc,CAACC,SAASC;QAChC,IAAI,CAACrC,KAAK,GAAG,IAAIsC;QACjBtD,SACEuD,cAAcR,kBACd,4EAA4E;QAC5E,iDAAiD;QACjD,+EAA+E;QAC/EhD,mBAAmB,IACnByD,oBACE,CAAC,EAAEN,cAAc,CAAC,EAAE,IAAI,CAAC5B,IAAI,CAACD,WAAW,CAAC,CAAC,CAAC,EAC5C,IAAI,CAACL,KAAK,GAEZ,CAACyC;YACCA,QAAQJ,OAAOI,SAASL;QAC1B;IAEJ;AACF;AAGF,6CAA6C;AAC7C,MAAMM,4BAA4B;AAOlC;;;;;;;;;;CAUC,GACD,OAAO,eAAeC,iBACpBtC,WAAmB,EACnBuC,WAAyB,EACzB7B,aAA2B;IAE3B,MAAM8B,kBAAkB,MAAM9B,cAC5B,IAAI1B,IAAIgB,aAAauC,aAAa/C,QAAQ;IAE5C,IAAI,CAACgD,gBAAgBC,EAAE,EAAE;QACvB,MAAM,IAAIC,MACR,CAAC,iDAAiD,EAAEF,gBAAgBG,MAAM,CAAC,CAAC,CAAC;IAEjF;IACA,MAAMC,kBAAkB,MAAMJ,gBAAgBK,IAAI;IAElD,IAAI,CAACvE,SAASsE,kBAAkB;QAC9B,MAAM,IAAIF,MACR,CAAC,yBAAyB,EAAE1C,YAAY,oBAAoB,CAAC;IAEjE;IAEA,OAAO4C;AACT;AAEA;;;;;;;;;;;;CAYC,GACD,eAAeE,kBACb9C,WAAmB,EACnBI,YAAyB,EACzBmC,WAAgB,EAChB7B,aAA2B;IAE3B,2FAA2F;IAC3F,IACE6B,YAAY/C,QAAQ,OAAOT,qBAAqBS,QAAQ,MACxDjB,qBAAqB6B,eACrB;QACA,OAAO;YACL2C,YAAYtE,iBAAiBuB,aAAaI;YAC1C4C,eAAe5C;QACjB;IACF;IAEA,MAAMwC,kBAAkB,MAAMN,iBAC5BtC,aACAuC,aACA7B;IAGF,MAAMuC,WAAWC,OAAOC,IAAI,CAACP,iBAAiBK,YAAY,CAAC,GAAGG,GAAG,CAC/D,CAAClD;QACC9B,sBAAsB8B;QACtB,OAAOA;IACT;IAGF,MAAM8C,gBAAgBnF,iBAAiBoF,UAAU7C;IAEjD,IAAI4C,kBAAkB,MAAM;QAC1B,MAAM,IAAIN,MACR,CAAC,+DAA+D,EAAE1C,YAAY,8BAA8B,EAAEI,aAAa,EAAE,CAAC;IAElI;IAEA,MAAM2C,aAAaH,iBAAiBK,UAAU,CAACD,cAAc,EAAEK,MAAMC;IAErE,OAAO;QAAEP;QAAYC;IAAc;AACrC;AAEA;;;;;;;;;;;;;CAaC,GACD,eAAepB,gBACb5B,WAAmB,EACnBI,YAAyB,EACzBmC,WAAgB,EAChB7B,aAA2B;IAE3B,MAAM,EAAEqC,UAAU,EAAEC,aAAa,EAAE,GAAG,MAAMF,kBAC1C9C,aACAI,cACAmC,aACA7B;IAGF,IAAI,CAAC5C,WAAWiF,eAAe,CAACA,WAAWvD,QAAQ,GAAG+D,QAAQ,CAAC,SAAS;QACtE,MAAM,IAAIb,MACR,CAAC,8DAA8D,EAAE1C,YAAY,EAAE,CAAC;IAEpF;IAEA,4EAA4E;IAC5E,MAAMwD,iBAAiB,IAAIxE,IAAIuD;IAC/B,MAAMkB,gBAAgB,IAAIzE,IAAI+D;IAC9BU,cAAcC,QAAQ,GAAGF,eAAeE,QAAQ;IAChDD,cAAcE,QAAQ,GAAGH,eAAeG,QAAQ;IAEhD,kEAAkE;IAClE,MAAMjC,kBAAkB,MAAMhB,cAAc+C,cAAcjE,QAAQ;IAClE,IAAI,CAACkC,gBAAgBe,EAAE,IAAI,CAACf,gBAAgBkC,IAAI,EAAE;QAChD,MAAM,IAAIlB,MAAM,CAAC,qCAAqC,EAAE1C,YAAY,EAAE,CAAC;IACzE;IACA,2FAA2F;IAC3F,MAAM6D,oBAAoBnC,gBAAgBoC,OAAO,CAAChE,GAAG,CAAC;IACtD3B,OAAO0F,mBAAmB;IAC1B,MAAME,cAAcC,SAASH,mBAAmB;IAChD1F,OACE4F,eAAe1B,2BACf;IAEF,OAAO;QAACX,gBAAgBkC,IAAI;QAAEZ;KAAc;AAC9C;AAEA;;;CAGC,GACD,MAAMiB,0BAA0B;AAEhC;;;;;;;;CAQC,GACD,SAAS/B,cAAcgC,MAAsB;IAC3C,IAAI,OAAOA,OAAOC,SAAS,KAAK,YAAY;QAC1C,OAAOD;IACT;IAEA,OAAO,IAAItF,wBAAwBsF;AACrC;AAEA;;;;;;;CAOC,GACD,SAAS/B,oBACPN,aAAqB,EACrBlC,KAA+B;IAE/BxB,OACE0D,cAAc0B,QAAQ,CAAC,MACvB;IAGFpF,OACE0D,cAAcN,UAAU,CAAC,SACzB;IAEF,oEAAoE;IACpE,2CAA2C;IAC3C,MAAM6C,gBAAgBtF;IAEtB,IAAIuF,YAAY;IAEhB,2EAA2E;IAC3E,qBAAqB;IACrBD,cAAcE,EAAE,CAAC,SAAS,CAACC,QAAQC,aAAaC;QAC9C,MAAM,EAAEC,MAAMC,UAAU,EAAEC,MAAMC,UAAU,EAAE,GAAGN;QAC/C,IAAIM,eAAe,QAAQ;YACzB,mDAAmD;YACnD,MAAMpF,OAAOkF,WAAWG,OAAO,CAACb,yBAAyB;YACzD,OAAOO,YAAYO,IAAI,CACrBvG,OAAO;gBAAEwG,UAAU;YAAa,GAAG,CAACC;gBAClC,IAAI;oBACFZ,aAAaY,KAAKC,UAAU;oBAC5B,8EAA8E;oBAC9E/G,OACEkG,YAAYhC,2BACZ,CAAC,8BAA8B,EAAEA,0BAA0B,OAAO,CAAC;oBAErE,MAAMhD,QAAQ,IAAIrB,YAAY;wBAC5BmH,OAAOF;wBACPxF;wBACAwF,MAAM;4BACJG,eAAe,IAAIpG,IAAIS,MAAMoC,eAAerC,QAAQ;wBACtD;oBACF;oBACA,wFAAwF;oBACxFrB,OACE,CAACwB,MAAM0F,GAAG,CAAC5F,OACX;oBAEFE,MAAM2F,GAAG,CAAC7F,MAAMJ;oBAChB,OAAOoF;gBACT,EAAE,OAAOrC,OAAO;oBACd,OAAOgC,cAAcmB,OAAO,CAACnD;gBAC/B;YACF;QAEJ;QAEA,4EAA4E;QAC5E,0EAA0E;QAC1E,6CAA6C;QAC7CoC,YAAYF,EAAE,CAAC,OAAO,IAAMG;QAC5B,OAAOD,YAAYgB,MAAM;IAC3B;IACA,OAAOpB;AACT"}

package/dist/esm/snaps/registry/json.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/snaps/registry/json.ts"],"sourcesContent":["import type { RestrictedControllerMessenger } from '@metamask/base-controller';\nimport { BaseControllerV2 as BaseController } from '@metamask/base-controller';\nimport type { SnapsRegistryDatabase } from '@metamask/snaps-registry';\nimport { verify } from '@metamask/snaps-registry';\nimport { getTargetVersion, type SnapId } from '@metamask/snaps-utils';\nimport type { Hex, SemVerRange, SemVerVersion } from '@metamask/utils';\nimport {\n  assert,\n  assertIsSemVerRange,\n  Duration,\n  inMilliseconds,\n  satisfiesVersionRange,\n} from '@metamask/utils';\n\nimport type {\n  SnapsRegistry,\n  SnapsRegistryInfo,\n  SnapsRegistryMetadata,\n  SnapsRegistryRequest,\n  SnapsRegistryResult,\n} from './registry';\nimport { SnapsRegistryStatus } from './registry';\n\n// TODO: Replace with a Codefi URL\nconst SNAP_REGISTRY_URL =\n  'https://cdn.jsdelivr.net/gh/MetaMask/snaps-registry@gh-pages/latest/registry.json';\n\nconst SNAP_REGISTRY_SIGNATURE_URL =\n  'https://cdn.jsdelivr.net/gh/MetaMask/snaps-registry@gh-pages/latest/signature.json';\n\ntype JsonSnapsRegistryUrl = {\n  registry: string;\n  signature: string;\n};\n\nexport type JsonSnapsRegistryArgs = {\n  messenger: SnapsRegistryMessenger;\n  state?: SnapsRegistryState;\n  fetchFunction?: typeof fetch;\n  url?: JsonSnapsRegistryUrl;\n  recentFetchThreshold?: number;\n  refetchOnAllowlistMiss?: boolean;\n  failOnUnavailableRegistry?: boolean;\n  publicKey?: Hex;\n};\n\nexport type GetResult = {\n  type: `${typeof controllerName}:get`;\n  handler: SnapsRegistry['get'];\n};\n\nexport type ResolveVersion = {\n  type: `${typeof controllerName}:resolveVersion`;\n  handler: SnapsRegistry['resolveVersion'];\n};\n\nexport type GetMetadata = {\n  type: `${typeof controllerName}:getMetadata`;\n  handler: SnapsRegistry['getMetadata'];\n};\n\nexport type Update = {\n  type: `${typeof controllerName}:update`;\n  handler: SnapsRegistry['update'];\n};\n\nexport type SnapsRegistryActions =\n  | GetResult\n  | GetMetadata\n  | Update\n  | ResolveVersion;\n\nexport type SnapsRegistryEvents = never;\n\nexport type SnapsRegistryMessenger = RestrictedControllerMessenger<\n  'SnapsRegistry',\n  SnapsRegistryActions,\n  SnapsRegistryEvents,\n  SnapsRegistryActions['type'],\n  SnapsRegistryEvents['type']\n>;\n\nexport type SnapsRegistryState = {\n  database: SnapsRegistryDatabase | null;\n  lastUpdated: number | null;\n};\n\nconst controllerName = 'SnapsRegistry';\n\nconst defaultState = {\n  database: null,\n  lastUpdated: null,\n};\n\nexport class JsonSnapsRegistry extends BaseController<\n  typeof controllerName,\n  SnapsRegistryState,\n  SnapsRegistryMessenger\n> {\n  #url: JsonSnapsRegistryUrl;\n\n  #publicKey?: Hex;\n\n  #fetchFunction: typeof fetch;\n\n  #recentFetchThreshold: number;\n\n  #refetchOnAllowlistMiss: boolean;\n\n  #failOnUnavailableRegistry: boolean;\n\n  #currentUpdate: Promise<void> | null;\n\n  constructor({\n    messenger,\n    state,\n    url = {\n      registry: SNAP_REGISTRY_URL,\n      signature: SNAP_REGISTRY_SIGNATURE_URL,\n    },\n    publicKey,\n    fetchFunction = globalThis.fetch.bind(globalThis),\n    recentFetchThreshold = inMilliseconds(5, Duration.Minute),\n    failOnUnavailableRegistry = true,\n    refetchOnAllowlistMiss = true,\n  }: JsonSnapsRegistryArgs) {\n    super({\n      messenger,\n      metadata: {\n        database: { persist: true, anonymous: false },\n        lastUpdated: { persist: true, anonymous: false },\n      },\n      name: controllerName,\n      state: {\n        ...defaultState,\n        ...state,\n      },\n    });\n    this.#url = url;\n    this.#publicKey = publicKey;\n    this.#fetchFunction = fetchFunction;\n    this.#recentFetchThreshold = recentFetchThreshold;\n    this.#refetchOnAllowlistMiss = refetchOnAllowlistMiss;\n    this.#failOnUnavailableRegistry = failOnUnavailableRegistry;\n    this.#currentUpdate = null;\n\n    this.messagingSystem.registerActionHandler(\n      'SnapsRegistry:get',\n      async (...args) => this.#get(...args),\n    );\n\n    this.messagingSystem.registerActionHandler(\n      'SnapsRegistry:getMetadata',\n      async (...args) => this.#getMetadata(...args),\n    );\n\n    this.messagingSystem.registerActionHandler(\n      'SnapsRegistry:resolveVersion',\n      async (...args) => this.#resolveVersion(...args),\n    );\n\n    this.messagingSystem.registerActionHandler(\n      'SnapsRegistry:update',\n      async () => this.#triggerUpdate(),\n    );\n  }\n\n  #wasRecentlyFetched() {\n    return (\n      this.state.lastUpdated &&\n      Date.now() - this.state.lastUpdated < this.#recentFetchThreshold\n    );\n  }\n\n  /**\n   * Triggers an update of the registry database.\n   *\n   * If an existing update is in progress this function will await that update.\n   */\n  async #triggerUpdate() {\n    // If an update is ongoing, wait for that.\n    if (this.#currentUpdate) {\n      await this.#currentUpdate;\n      return;\n    }\n    // If no update exists, create promise and store globally.\n    if (this.#currentUpdate === null) {\n      this.#currentUpdate = this.#update();\n    }\n    await this.#currentUpdate;\n    this.#currentUpdate = null;\n  }\n\n  /**\n   * Updates the registry database if the registry hasn't been updated recently.\n   *\n   * NOTE: SHOULD NOT be called directly, instead `triggerUpdate` should be used.\n   */\n  async #update() {\n    // No-op if we recently fetched the registry.\n    if (this.#wasRecentlyFetched()) {\n      return;\n    }\n\n    try {\n      const database = await this.#safeFetch(this.#url.registry);\n\n      if (this.#publicKey) {\n        const signature = await this.#safeFetch(this.#url.signature);\n        await this.#verifySignature(database, signature);\n      }\n\n      this.update((state) => {\n        state.database = JSON.parse(database);\n        state.lastUpdated = Date.now();\n      });\n    } catch {\n      // Ignore\n    }\n  }\n\n  async #getDatabase(): Promise<SnapsRegistryDatabase | null> {\n    if (this.state.database === null) {\n      await this.#triggerUpdate();\n    }\n\n    // If the database is still null and we require it, throw.\n    if (this.#failOnUnavailableRegistry && this.state.database === null) {\n      throw new Error('Snaps registry is unavailable, installation blocked.');\n    }\n    return this.state.database;\n  }\n\n  async #getSingle(\n    snapId: SnapId,\n    snapInfo: SnapsRegistryInfo,\n    refetch = false,\n  ): Promise<SnapsRegistryResult> {\n    const database = await this.#getDatabase();\n\n    const blockedEntry = database?.blockedSnaps.find((blocked) => {\n      if ('id' in blocked) {\n        return (\n          blocked.id === snapId &&\n          satisfiesVersionRange(snapInfo.version, blocked.versionRange)\n        );\n      }\n\n      return blocked.checksum === snapInfo.checksum;\n    });\n\n    if (blockedEntry) {\n      return {\n        status: SnapsRegistryStatus.Blocked,\n        reason: blockedEntry.reason,\n      };\n    }\n\n    const verified = database?.verifiedSnaps[snapId];\n    const version = verified?.versions?.[snapInfo.version];\n    if (version && version.checksum === snapInfo.checksum) {\n      return { status: SnapsRegistryStatus.Verified };\n    }\n    // For now, if we have an allowlist miss, we can refetch once and try again.\n    if (this.#refetchOnAllowlistMiss && !refetch) {\n      await this.#triggerUpdate();\n      return this.#getSingle(snapId, snapInfo, true);\n    }\n    return { status: SnapsRegistryStatus.Unverified };\n  }\n\n  async #get(\n    snaps: SnapsRegistryRequest,\n  ): Promise<Record<SnapId, SnapsRegistryResult>> {\n    return Object.entries(snaps).reduce<\n      Promise<Record<SnapId, SnapsRegistryResult>>\n    >(async (previousPromise, [snapId, snapInfo]) => {\n      const result = await this.#getSingle(snapId, snapInfo);\n      const acc = await previousPromise;\n      acc[snapId] = result;\n      return acc;\n    }, Promise.resolve({}));\n  }\n\n  /**\n   * Find an allowlisted version within a specified version range.\n   *\n   * @param snapId - The ID of the snap we are trying to resolve a version for.\n   * @param versionRange - The version range.\n   * @param refetch - An optional flag used to determine if we are refetching the registry.\n   * @returns An allowlisted version within the specified version range.\n   * @throws If an allowlisted version does not exist within the version range.\n   */\n  async #resolveVersion(\n    snapId: SnapId,\n    versionRange: SemVerRange,\n    refetch = false,\n  ): Promise<SemVerRange> {\n    const database = await this.#getDatabase();\n    const versions = database?.verifiedSnaps[snapId]?.versions ?? null;\n\n    if (!versions && this.#refetchOnAllowlistMiss && !refetch) {\n      await this.#triggerUpdate();\n      return this.#resolveVersion(snapId, versionRange, true);\n    }\n\n    assert(versions, 'The snap is not on the allowlist');\n\n    const targetVersion = getTargetVersion(\n      Object.keys(versions) as SemVerVersion[],\n      versionRange,\n    );\n\n    if (!targetVersion && this.#refetchOnAllowlistMiss && !refetch) {\n      await this.#triggerUpdate();\n      return this.#resolveVersion(snapId, versionRange, true);\n    }\n\n    assert(\n      targetVersion,\n      'No matching versions of the snap are on the allowlist',\n    );\n\n    // A semver version is technically also a valid semver range.\n    assertIsSemVerRange(targetVersion);\n    return targetVersion;\n  }\n\n  /**\n   * Get metadata for the given snap ID.\n   *\n   * @param snapId - The ID of the snap to get metadata for.\n   * @returns The metadata for the given snap ID, or `null` if the snap is not\n   * verified.\n   */\n  async #getMetadata(snapId: SnapId): Promise<SnapsRegistryMetadata | null> {\n    const database = await this.#getDatabase();\n    return database?.verifiedSnaps[snapId]?.metadata ?? null;\n  }\n\n  /**\n   * Verify the signature of the registry.\n   *\n   * @param database - The registry database.\n   * @param signature - The signature of the registry.\n   * @throws If the signature is invalid.\n   * @private\n   */\n  async #verifySignature(database: string, signature: string) {\n    assert(this.#publicKey, 'No public key provided.');\n\n    const valid = await verify({\n      registry: database,\n      signature: JSON.parse(signature),\n      publicKey: this.#publicKey,\n    });\n\n    assert(valid, 'Invalid registry signature.');\n  }\n\n  /**\n   * Fetch the given URL, throwing if the response is not OK.\n   *\n   * @param url - The URL to fetch.\n   * @returns The response body.\n   * @private\n   */\n  async #safeFetch(url: string) {\n    const response = await this.#fetchFunction(url);\n    if (!response.ok) {\n      throw new Error(`Failed to fetch ${url}.`);\n    }\n\n    return await response.text();\n  }\n}\n"],"names":["BaseControllerV2","BaseController","verify","getTargetVersion","assert","assertIsSemVerRange","Duration","inMilliseconds","satisfiesVersionRange","SnapsRegistryStatus","SNAP_REGISTRY_URL","SNAP_REGISTRY_SIGNATURE_URL","controllerName","defaultState","database","lastUpdated","JsonSnapsRegistry","constructor","messenger","state","url","registry","signature","publicKey","fetchFunction","globalThis","fetch","bind","recentFetchThreshold","Minute","failOnUnavailableRegistry","refetchOnAllowlistMiss","metadata","persist","anonymous","name","currentUpdate","messagingSystem","registerActionHandler","args","get","getMetadata","resolveVersion","triggerUpdate","Date","now","update","wasRecentlyFetched","safeFetch","verifySignature","JSON","parse","Error","snapId","snapInfo","refetch","getDatabase","blockedEntry","blockedSnaps","find","blocked","id","version","versionRange","checksum","status","Blocked","reason","verified","verifiedSnaps","versions","Verified","getSingle","Unverified","snaps","Object","entries","reduce","previousPromise","result","acc","Promise","resolve","targetVersion","keys","valid","response","ok","text"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,SAASA,oBAAoBC,cAAc,QAAQ,4BAA4B;AAE/E,SAASC,MAAM,QAAQ,2BAA2B;AAClD,SAASC,gBAAgB,QAAqB,wBAAwB;AAEtE,SACEC,MAAM,EACNC,mBAAmB,EACnBC,QAAQ,EACRC,cAAc,EACdC,qBAAqB,QAChB,kBAAkB;AASzB,SAASC,mBAAmB,QAAQ,aAAa;AAEjD,kCAAkC;AAClC,MAAMC,oBACJ;AAEF,MAAMC,8BACJ;AA2DF,MAAMC,iBAAiB;AAEvB,MAAMC,eAAe;IACnBC,UAAU;IACVC,aAAa;AACf;IAOE,oCAEA,0CAEA,8CAEA,qDAEA,uDAEA,0DAEA,8CAwDA,mDAYM,8CAmBA,uCAuBA,4CAYA,0CAsCA,oCAsBA,+CA0CA,4CAaA,gDAmBA;AAjRR,OAAO,MAAMC,0BAA0Bf;IAmBrCgB,YAAY,EACVC,SAAS,EACTC,KAAK,EACLC,MAAM;QACJC,UAAUX;QACVY,WAAWX;IACb,CAAC,EACDY,SAAS,EACTC,gBAAgBC,WAAWC,KAAK,CAACC,IAAI,CAACF,WAAW,EACjDG,uBAAuBrB,eAAe,GAAGD,SAASuB,MAAM,CAAC,EACzDC,4BAA4B,IAAI,EAChCC,yBAAyB,IAAI,EACP,CAAE;QACxB,KAAK,CAAC;YACJb;YACAc,UAAU;gBACRlB,UAAU;oBAAEmB,SAAS;oBAAMC,WAAW;gBAAM;gBAC5CnB,aAAa;oBAAEkB,SAAS;oBAAMC,WAAW;gBAAM;YACjD;YACAC,MAAMvB;YACNO,OAAO;gBACL,GAAGN,YAAY;gBACf,GAAGM,KAAK;YACV;QACF;QA8BF,iCAAA;QAOA;;;;GAIC,GACD,iCAAM;QAcN;;;;GAIC,GACD,iCAAM;QAuBN,iCAAM;QAYN,iCAAM;QAsCN,iCAAM;QAaN;;;;;;;;GAQC,GACD,iCAAM;QAmCN;;;;;;GAMC,GACD,iCAAM;QAKN;;;;;;;GAOC,GACD,iCAAM;QAYN;;;;;;GAMC,GACD,iCAAM;QA5QN,gCAAA;;mBAAA,KAAA;;QAEA,gCAAA;;mBAAA,KAAA;;QAEA,gCAAA;;mBAAA,KAAA;;QAEA,gCAAA;;mBAAA,KAAA;;QAEA,gCAAA;;mBAAA,KAAA;;QAEA,gCAAA;;mBAAA,KAAA;;QAEA,gCAAA;;mBAAA,KAAA;;uCA2BQC,MAAMA;uCACNG,YAAYA;uCACZC,gBAAgBA;uCAChBI,uBAAuBA;uCACvBG,yBAAyBA;uCACzBD,4BAA4BA;uCAC5BM,gBAAgB;QAEtB,IAAI,CAACC,eAAe,CAACC,qBAAqB,CACxC,qBACA,OAAO,GAAGC,OAAS,0BAAA,IAAI,EAAEC,MAAAA,UAAN,IAAI,KAASD;QAGlC,IAAI,CAACF,eAAe,CAACC,qBAAqB,CACxC,6BACA,OAAO,GAAGC,OAAS,0BAAA,IAAI,EAAEE,cAAAA,kBAAN,IAAI,KAAiBF;QAG1C,IAAI,CAACF,eAAe,CAACC,qBAAqB,CACxC,gCACA,OAAO,GAAGC,OAAS,0BAAA,IAAI,EAAEG,iBAAAA,qBAAN,IAAI,KAAoBH;QAG7C,IAAI,CAACF,eAAe,CAACC,qBAAqB,CACxC,wBACA,UAAY,0BAAA,IAAI,EAAEK,gBAAAA,oBAAN,IAAI;IAEpB;AAkNF;AAhNE,SAAA;IACE,OACE,IAAI,CAACxB,KAAK,CAACJ,WAAW,IACtB6B,KAAKC,GAAG,KAAK,IAAI,CAAC1B,KAAK,CAACJ,WAAW,4BAAG,IAAI,EAAEa;AAEhD;AAOA,eAAA;IACE,0CAA0C;IAC1C,6BAAI,IAAI,EAAEQ,iBAAe;QACvB,+BAAM,IAAI,EAAEA;QACZ;IACF;IACA,0DAA0D;IAC1D,IAAI,yBAAA,IAAI,EAAEA,oBAAkB,MAAM;uCAC1BA,gBAAgB,0BAAA,IAAI,EAAEU,SAAAA,aAAN,IAAI;IAC5B;IACA,+BAAM,IAAI,EAAEV;mCACNA,gBAAgB;AACxB;AAOA,eAAA;IACE,6CAA6C;IAC7C,IAAI,0BAAA,IAAI,EAAEW,qBAAAA,yBAAN,IAAI,GAAwB;QAC9B;IACF;IAEA,IAAI;QACF,MAAMjC,WAAW,MAAM,0BAAA,IAAI,EAAEkC,YAAAA,gBAAN,IAAI,EAAY,yBAAA,IAAI,EAAE5B,MAAIC,QAAQ;QAEzD,6BAAI,IAAI,EAAEE,aAAW;YACnB,MAAMD,YAAY,MAAM,0BAAA,IAAI,EAAE0B,YAAAA,gBAAN,IAAI,EAAY,yBAAA,IAAI,EAAE5B,MAAIE,SAAS;YAC3D,MAAM,0BAAA,IAAI,EAAE2B,kBAAAA,sBAAN,IAAI,EAAkBnC,UAAUQ;QACxC;QAEA,IAAI,CAACwB,MAAM,CAAC,CAAC3B;YACXA,MAAML,QAAQ,GAAGoC,KAAKC,KAAK,CAACrC;YAC5BK,MAAMJ,WAAW,GAAG6B,KAAKC,GAAG;QAC9B;IACF,EAAE,OAAM;IACN,SAAS;IACX;AACF;AAEA,eAAA;IACE,IAAI,IAAI,CAAC1B,KAAK,CAACL,QAAQ,KAAK,MAAM;QAChC,MAAM,0BAAA,IAAI,EAAE6B,gBAAAA,oBAAN,IAAI;IACZ;IAEA,0DAA0D;IAC1D,IAAI,yBAAA,IAAI,EAAEb,+BAA6B,IAAI,CAACX,KAAK,CAACL,QAAQ,KAAK,MAAM;QACnE,MAAM,IAAIsC,MAAM;IAClB;IACA,OAAO,IAAI,CAACjC,KAAK,CAACL,QAAQ;AAC5B;AAEA,eAAA,UACEuC,MAAc,EACdC,QAA2B,EAC3BC,UAAU,KAAK;IAEf,MAAMzC,WAAW,MAAM,0BAAA,IAAI,EAAE0C,cAAAA,kBAAN,IAAI;IAE3B,MAAMC,eAAe3C,UAAU4C,aAAaC,KAAK,CAACC;QAChD,IAAI,QAAQA,SAAS;YACnB,OACEA,QAAQC,EAAE,KAAKR,UACf7C,sBAAsB8C,SAASQ,OAAO,EAAEF,QAAQG,YAAY;QAEhE;QAEA,OAAOH,QAAQI,QAAQ,KAAKV,SAASU,QAAQ;IAC/C;IAEA,IAAIP,cAAc;QAChB,OAAO;YACLQ,QAAQxD,oBAAoByD,OAAO;YACnCC,QAAQV,aAAaU,MAAM;QAC7B;IACF;IAEA,MAAMC,WAAWtD,UAAUuD,aAAa,CAAChB,OAAO;IAChD,MAAMS,UAAUM,UAAUE,UAAU,CAAChB,SAASQ,OAAO,CAAC;IACtD,IAAIA,WAAWA,QAAQE,QAAQ,KAAKV,SAASU,QAAQ,EAAE;QACrD,OAAO;YAAEC,QAAQxD,oBAAoB8D,QAAQ;QAAC;IAChD;IACA,4EAA4E;IAC5E,IAAI,yBAAA,IAAI,EAAExC,4BAA0B,CAACwB,SAAS;QAC5C,MAAM,0BAAA,IAAI,EAAEZ,gBAAAA,oBAAN,IAAI;QACV,OAAO,0BAAA,IAAI,EAAE6B,YAAAA,gBAAN,IAAI,EAAYnB,QAAQC,UAAU;IAC3C;IACA,OAAO;QAAEW,QAAQxD,oBAAoBgE,UAAU;IAAC;AAClD;AAEA,eAAA,IACEC,KAA2B;IAE3B,OAAOC,OAAOC,OAAO,CAACF,OAAOG,MAAM,CAEjC,OAAOC,iBAAiB,CAACzB,QAAQC,SAAS;QAC1C,MAAMyB,SAAS,MAAM,0BAAA,IAAI,EAAEP,YAAAA,gBAAN,IAAI,EAAYnB,QAAQC;QAC7C,MAAM0B,MAAM,MAAMF;QAClBE,GAAG,CAAC3B,OAAO,GAAG0B;QACd,OAAOC;IACT,GAAGC,QAAQC,OAAO,CAAC,CAAC;AACtB;AAWA,eAAA,eACE7B,MAAc,EACdU,YAAyB,EACzBR,UAAU,KAAK;IAEf,MAAMzC,WAAW,MAAM,0BAAA,IAAI,EAAE0C,cAAAA,kBAAN,IAAI;IAC3B,MAAMc,WAAWxD,UAAUuD,aAAa,CAAChB,OAAO,EAAEiB,YAAY;IAE9D,IAAI,CAACA,qCAAY,IAAI,EAAEvC,4BAA0B,CAACwB,SAAS;QACzD,MAAM,0BAAA,IAAI,EAAEZ,gBAAAA,oBAAN,IAAI;QACV,OAAO,0BAAA,IAAI,EAAED,iBAAAA,qBAAN,IAAI,EAAiBW,QAAQU,cAAc;IACpD;IAEA3D,OAAOkE,UAAU;IAEjB,MAAMa,gBAAgBhF,iBACpBwE,OAAOS,IAAI,CAACd,WACZP;IAGF,IAAI,CAACoB,0CAAiB,IAAI,EAAEpD,4BAA0B,CAACwB,SAAS;QAC9D,MAAM,0BAAA,IAAI,EAAEZ,gBAAAA,oBAAN,IAAI;QACV,OAAO,0BAAA,IAAI,EAAED,iBAAAA,qBAAN,IAAI,EAAiBW,QAAQU,cAAc;IACpD;IAEA3D,OACE+E,eACA;IAGF,6DAA6D;IAC7D9E,oBAAoB8E;IACpB,OAAOA;AACT;AASA,eAAA,YAAmB9B,MAAc;IAC/B,MAAMvC,WAAW,MAAM,0BAAA,IAAI,EAAE0C,cAAAA,kBAAN,IAAI;IAC3B,OAAO1C,UAAUuD,aAAa,CAAChB,OAAO,EAAErB,YAAY;AACtD;AAUA,eAAA,gBAAuBlB,QAAgB,EAAEQ,SAAiB;IACxDlB,gCAAO,IAAI,EAAEmB,aAAW;IAExB,MAAM8D,QAAQ,MAAMnF,OAAO;QACzBmB,UAAUP;QACVQ,WAAW4B,KAAKC,KAAK,CAAC7B;QACtBC,SAAS,2BAAE,IAAI,EAAEA;IACnB;IAEAnB,OAAOiF,OAAO;AAChB;AASA,eAAA,UAAiBjE,GAAW;IAC1B,MAAMkE,WAAW,MAAM,yBAAA,IAAI,EAAE9D,qBAAN,IAAI,EAAgBJ;IAC3C,IAAI,CAACkE,SAASC,EAAE,EAAE;QAChB,MAAM,IAAInC,MAAM,CAAC,gBAAgB,EAAEhC,IAAI,CAAC,CAAC;IAC3C;IAEA,OAAO,MAAMkE,SAASE,IAAI;AAC5B"}
+{"version":3,"sources":["../../../../src/snaps/registry/json.ts"],"sourcesContent":["import type { RestrictedControllerMessenger } from '@metamask/base-controller';\nimport { BaseControllerV2 as BaseController } from '@metamask/base-controller';\nimport type { SnapsRegistryDatabase } from '@metamask/snaps-registry';\nimport { verify } from '@metamask/snaps-registry';\nimport { getTargetVersion } from '@metamask/snaps-utils';\nimport type { Hex, SemVerRange, SemVerVersion } from '@metamask/utils';\nimport {\n  assert,\n  assertIsSemVerRange,\n  Duration,\n  inMilliseconds,\n  satisfiesVersionRange,\n} from '@metamask/utils';\n\nimport type {\n  SnapsRegistry,\n  SnapsRegistryInfo,\n  SnapsRegistryMetadata,\n  SnapsRegistryRequest,\n  SnapsRegistryResult,\n} from './registry';\nimport { SnapsRegistryStatus } from './registry';\n\n// TODO: Replace with a Codefi URL\nconst SNAP_REGISTRY_URL =\n  'https://cdn.jsdelivr.net/gh/MetaMask/snaps-registry@gh-pages/latest/registry.json';\n\nconst SNAP_REGISTRY_SIGNATURE_URL =\n  'https://cdn.jsdelivr.net/gh/MetaMask/snaps-registry@gh-pages/latest/signature.json';\n\ntype JsonSnapsRegistryUrl = {\n  registry: string;\n  signature: string;\n};\n\nexport type JsonSnapsRegistryArgs = {\n  messenger: SnapsRegistryMessenger;\n  state?: SnapsRegistryState;\n  fetchFunction?: typeof fetch;\n  url?: JsonSnapsRegistryUrl;\n  recentFetchThreshold?: number;\n  refetchOnAllowlistMiss?: boolean;\n  failOnUnavailableRegistry?: boolean;\n  publicKey?: Hex;\n};\n\nexport type GetResult = {\n  type: `${typeof controllerName}:get`;\n  handler: SnapsRegistry['get'];\n};\n\nexport type ResolveVersion = {\n  type: `${typeof controllerName}:resolveVersion`;\n  handler: SnapsRegistry['resolveVersion'];\n};\n\nexport type GetMetadata = {\n  type: `${typeof controllerName}:getMetadata`;\n  handler: SnapsRegistry['getMetadata'];\n};\n\nexport type Update = {\n  type: `${typeof controllerName}:update`;\n  handler: SnapsRegistry['update'];\n};\n\nexport type SnapsRegistryActions =\n  | GetResult\n  | GetMetadata\n  | Update\n  | ResolveVersion;\n\nexport type SnapsRegistryEvents = never;\n\nexport type SnapsRegistryMessenger = RestrictedControllerMessenger<\n  'SnapsRegistry',\n  SnapsRegistryActions,\n  SnapsRegistryEvents,\n  SnapsRegistryActions['type'],\n  SnapsRegistryEvents['type']\n>;\n\nexport type SnapsRegistryState = {\n  database: SnapsRegistryDatabase | null;\n  lastUpdated: number | null;\n};\n\nconst controllerName = 'SnapsRegistry';\n\nconst defaultState = {\n  database: null,\n  lastUpdated: null,\n};\n\nexport class JsonSnapsRegistry extends BaseController<\n  typeof controllerName,\n  SnapsRegistryState,\n  SnapsRegistryMessenger\n> {\n  #url: JsonSnapsRegistryUrl;\n\n  #publicKey?: Hex;\n\n  #fetchFunction: typeof fetch;\n\n  #recentFetchThreshold: number;\n\n  #refetchOnAllowlistMiss: boolean;\n\n  #failOnUnavailableRegistry: boolean;\n\n  #currentUpdate: Promise<void> | null;\n\n  constructor({\n    messenger,\n    state,\n    url = {\n      registry: SNAP_REGISTRY_URL,\n      signature: SNAP_REGISTRY_SIGNATURE_URL,\n    },\n    publicKey,\n    fetchFunction = globalThis.fetch.bind(globalThis),\n    recentFetchThreshold = inMilliseconds(5, Duration.Minute),\n    failOnUnavailableRegistry = true,\n    refetchOnAllowlistMiss = true,\n  }: JsonSnapsRegistryArgs) {\n    super({\n      messenger,\n      metadata: {\n        database: { persist: true, anonymous: false },\n        lastUpdated: { persist: true, anonymous: false },\n      },\n      name: controllerName,\n      state: {\n        ...defaultState,\n        ...state,\n      },\n    });\n    this.#url = url;\n    this.#publicKey = publicKey;\n    this.#fetchFunction = fetchFunction;\n    this.#recentFetchThreshold = recentFetchThreshold;\n    this.#refetchOnAllowlistMiss = refetchOnAllowlistMiss;\n    this.#failOnUnavailableRegistry = failOnUnavailableRegistry;\n    this.#currentUpdate = null;\n\n    this.messagingSystem.registerActionHandler(\n      'SnapsRegistry:get',\n      async (...args) => this.#get(...args),\n    );\n\n    this.messagingSystem.registerActionHandler(\n      'SnapsRegistry:getMetadata',\n      async (...args) => this.#getMetadata(...args),\n    );\n\n    this.messagingSystem.registerActionHandler(\n      'SnapsRegistry:resolveVersion',\n      async (...args) => this.#resolveVersion(...args),\n    );\n\n    this.messagingSystem.registerActionHandler(\n      'SnapsRegistry:update',\n      async () => this.#triggerUpdate(),\n    );\n  }\n\n  #wasRecentlyFetched() {\n    return (\n      this.state.lastUpdated &&\n      Date.now() - this.state.lastUpdated < this.#recentFetchThreshold\n    );\n  }\n\n  /**\n   * Triggers an update of the registry database.\n   *\n   * If an existing update is in progress this function will await that update.\n   */\n  async #triggerUpdate() {\n    // If an update is ongoing, wait for that.\n    if (this.#currentUpdate) {\n      await this.#currentUpdate;\n      return;\n    }\n    // If no update exists, create promise and store globally.\n    if (this.#currentUpdate === null) {\n      this.#currentUpdate = this.#update();\n    }\n    await this.#currentUpdate;\n    this.#currentUpdate = null;\n  }\n\n  /**\n   * Updates the registry database if the registry hasn't been updated recently.\n   *\n   * NOTE: SHOULD NOT be called directly, instead `triggerUpdate` should be used.\n   */\n  async #update() {\n    // No-op if we recently fetched the registry.\n    if (this.#wasRecentlyFetched()) {\n      return;\n    }\n\n    try {\n      const database = await this.#safeFetch(this.#url.registry);\n\n      if (this.#publicKey) {\n        const signature = await this.#safeFetch(this.#url.signature);\n        await this.#verifySignature(database, signature);\n      }\n\n      this.update((state) => {\n        state.database = JSON.parse(database);\n        state.lastUpdated = Date.now();\n      });\n    } catch {\n      // Ignore\n    }\n  }\n\n  async #getDatabase(): Promise<SnapsRegistryDatabase | null> {\n    if (this.state.database === null) {\n      await this.#triggerUpdate();\n    }\n\n    // If the database is still null and we require it, throw.\n    if (this.#failOnUnavailableRegistry && this.state.database === null) {\n      throw new Error('Snaps registry is unavailable, installation blocked.');\n    }\n    return this.state.database;\n  }\n\n  async #getSingle(\n    snapId: string,\n    snapInfo: SnapsRegistryInfo,\n    refetch = false,\n  ): Promise<SnapsRegistryResult> {\n    const database = await this.#getDatabase();\n\n    const blockedEntry = database?.blockedSnaps.find((blocked) => {\n      if ('id' in blocked) {\n        return (\n          blocked.id === snapId &&\n          satisfiesVersionRange(snapInfo.version, blocked.versionRange)\n        );\n      }\n\n      return blocked.checksum === snapInfo.checksum;\n    });\n\n    if (blockedEntry) {\n      return {\n        status: SnapsRegistryStatus.Blocked,\n        reason: blockedEntry.reason,\n      };\n    }\n\n    const verified = database?.verifiedSnaps[snapId];\n    const version = verified?.versions?.[snapInfo.version];\n    if (version && version.checksum === snapInfo.checksum) {\n      return { status: SnapsRegistryStatus.Verified };\n    }\n    // For now, if we have an allowlist miss, we can refetch once and try again.\n    if (this.#refetchOnAllowlistMiss && !refetch) {\n      await this.#triggerUpdate();\n      return this.#getSingle(snapId, snapInfo, true);\n    }\n    return { status: SnapsRegistryStatus.Unverified };\n  }\n\n  async #get(\n    snaps: SnapsRegistryRequest,\n  ): Promise<Record<string, SnapsRegistryResult>> {\n    return Object.entries(snaps).reduce<\n      Promise<Record<string, SnapsRegistryResult>>\n    >(async (previousPromise, [snapId, snapInfo]) => {\n      const result = await this.#getSingle(snapId, snapInfo);\n      const acc = await previousPromise;\n      acc[snapId] = result;\n      return acc;\n    }, Promise.resolve({}));\n  }\n\n  /**\n   * Find an allowlisted version within a specified version range.\n   *\n   * @param snapId - The ID of the snap we are trying to resolve a version for.\n   * @param versionRange - The version range.\n   * @param refetch - An optional flag used to determine if we are refetching the registry.\n   * @returns An allowlisted version within the specified version range.\n   * @throws If an allowlisted version does not exist within the version range.\n   */\n  async #resolveVersion(\n    snapId: string,\n    versionRange: SemVerRange,\n    refetch = false,\n  ): Promise<SemVerRange> {\n    const database = await this.#getDatabase();\n    const versions = database?.verifiedSnaps[snapId]?.versions ?? null;\n\n    if (!versions && this.#refetchOnAllowlistMiss && !refetch) {\n      await this.#triggerUpdate();\n      return this.#resolveVersion(snapId, versionRange, true);\n    }\n\n    assert(versions, 'The snap is not on the allowlist');\n\n    const targetVersion = getTargetVersion(\n      Object.keys(versions) as SemVerVersion[],\n      versionRange,\n    );\n\n    if (!targetVersion && this.#refetchOnAllowlistMiss && !refetch) {\n      await this.#triggerUpdate();\n      return this.#resolveVersion(snapId, versionRange, true);\n    }\n\n    assert(\n      targetVersion,\n      'No matching versions of the snap are on the allowlist',\n    );\n\n    // A semver version is technically also a valid semver range.\n    assertIsSemVerRange(targetVersion);\n    return targetVersion;\n  }\n\n  /**\n   * Get metadata for the given snap ID.\n   *\n   * @param snapId - The ID of the snap to get metadata for.\n   * @returns The metadata for the given snap ID, or `null` if the snap is not\n   * verified.\n   */\n  async #getMetadata(snapId: string): Promise<SnapsRegistryMetadata | null> {\n    const database = await this.#getDatabase();\n    return database?.verifiedSnaps[snapId]?.metadata ?? null;\n  }\n\n  /**\n   * Verify the signature of the registry.\n   *\n   * @param database - The registry database.\n   * @param signature - The signature of the registry.\n   * @throws If the signature is invalid.\n   * @private\n   */\n  async #verifySignature(database: string, signature: string) {\n    assert(this.#publicKey, 'No public key provided.');\n\n    const valid = await verify({\n      registry: database,\n      signature: JSON.parse(signature),\n      publicKey: this.#publicKey,\n    });\n\n    assert(valid, 'Invalid registry signature.');\n  }\n\n  /**\n   * Fetch the given URL, throwing if the response is not OK.\n   *\n   * @param url - The URL to fetch.\n   * @returns The response body.\n   * @private\n   */\n  async #safeFetch(url: string) {\n    const response = await this.#fetchFunction(url);\n    if (!response.ok) {\n      throw new Error(`Failed to fetch ${url}.`);\n    }\n\n    return await response.text();\n  }\n}\n"],"names":["BaseControllerV2","BaseController","verify","getTargetVersion","assert","assertIsSemVerRange","Duration","inMilliseconds","satisfiesVersionRange","SnapsRegistryStatus","SNAP_REGISTRY_URL","SNAP_REGISTRY_SIGNATURE_URL","controllerName","defaultState","database","lastUpdated","JsonSnapsRegistry","constructor","messenger","state","url","registry","signature","publicKey","fetchFunction","globalThis","fetch","bind","recentFetchThreshold","Minute","failOnUnavailableRegistry","refetchOnAllowlistMiss","metadata","persist","anonymous","name","currentUpdate","messagingSystem","registerActionHandler","args","get","getMetadata","resolveVersion","triggerUpdate","Date","now","update","wasRecentlyFetched","safeFetch","verifySignature","JSON","parse","Error","snapId","snapInfo","refetch","getDatabase","blockedEntry","blockedSnaps","find","blocked","id","version","versionRange","checksum","status","Blocked","reason","verified","verifiedSnaps","versions","Verified","getSingle","Unverified","snaps","Object","entries","reduce","previousPromise","result","acc","Promise","resolve","targetVersion","keys","valid","response","ok","text"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,SAASA,oBAAoBC,cAAc,QAAQ,4BAA4B;AAE/E,SAASC,MAAM,QAAQ,2BAA2B;AAClD,SAASC,gBAAgB,QAAQ,wBAAwB;AAEzD,SACEC,MAAM,EACNC,mBAAmB,EACnBC,QAAQ,EACRC,cAAc,EACdC,qBAAqB,QAChB,kBAAkB;AASzB,SAASC,mBAAmB,QAAQ,aAAa;AAEjD,kCAAkC;AAClC,MAAMC,oBACJ;AAEF,MAAMC,8BACJ;AA2DF,MAAMC,iBAAiB;AAEvB,MAAMC,eAAe;IACnBC,UAAU;IACVC,aAAa;AACf;IAOE,oCAEA,0CAEA,8CAEA,qDAEA,uDAEA,0DAEA,8CAwDA,mDAYM,8CAmBA,uCAuBA,4CAYA,0CAsCA,oCAsBA,+CA0CA,4CAaA,gDAmBA;AAjRR,OAAO,MAAMC,0BAA0Bf;IAmBrCgB,YAAY,EACVC,SAAS,EACTC,KAAK,EACLC,MAAM;QACJC,UAAUX;QACVY,WAAWX;IACb,CAAC,EACDY,SAAS,EACTC,gBAAgBC,WAAWC,KAAK,CAACC,IAAI,CAACF,WAAW,EACjDG,uBAAuBrB,eAAe,GAAGD,SAASuB,MAAM,CAAC,EACzDC,4BAA4B,IAAI,EAChCC,yBAAyB,IAAI,EACP,CAAE;QACxB,KAAK,CAAC;YACJb;YACAc,UAAU;gBACRlB,UAAU;oBAAEmB,SAAS;oBAAMC,WAAW;gBAAM;gBAC5CnB,aAAa;oBAAEkB,SAAS;oBAAMC,WAAW;gBAAM;YACjD;YACAC,MAAMvB;YACNO,OAAO;gBACL,GAAGN,YAAY;gBACf,GAAGM,KAAK;YACV;QACF;QA8BF,iCAAA;QAOA;;;;GAIC,GACD,iCAAM;QAcN;;;;GAIC,GACD,iCAAM;QAuBN,iCAAM;QAYN,iCAAM;QAsCN,iCAAM;QAaN;;;;;;;;GAQC,GACD,iCAAM;QAmCN;;;;;;GAMC,GACD,iCAAM;QAKN;;;;;;;GAOC,GACD,iCAAM;QAYN;;;;;;GAMC,GACD,iCAAM;QA5QN,gCAAA;;mBAAA,KAAA;;QAEA,gCAAA;;mBAAA,KAAA;;QAEA,gCAAA;;mBAAA,KAAA;;QAEA,gCAAA;;mBAAA,KAAA;;QAEA,gCAAA;;mBAAA,KAAA;;QAEA,gCAAA;;mBAAA,KAAA;;QAEA,gCAAA;;mBAAA,KAAA;;uCA2BQC,MAAMA;uCACNG,YAAYA;uCACZC,gBAAgBA;uCAChBI,uBAAuBA;uCACvBG,yBAAyBA;uCACzBD,4BAA4BA;uCAC5BM,gBAAgB;QAEtB,IAAI,CAACC,eAAe,CAACC,qBAAqB,CACxC,qBACA,OAAO,GAAGC,OAAS,0BAAA,IAAI,EAAEC,MAAAA,UAAN,IAAI,KAASD;QAGlC,IAAI,CAACF,eAAe,CAACC,qBAAqB,CACxC,6BACA,OAAO,GAAGC,OAAS,0BAAA,IAAI,EAAEE,cAAAA,kBAAN,IAAI,KAAiBF;QAG1C,IAAI,CAACF,eAAe,CAACC,qBAAqB,CACxC,gCACA,OAAO,GAAGC,OAAS,0BAAA,IAAI,EAAEG,iBAAAA,qBAAN,IAAI,KAAoBH;QAG7C,IAAI,CAACF,eAAe,CAACC,qBAAqB,CACxC,wBACA,UAAY,0BAAA,IAAI,EAAEK,gBAAAA,oBAAN,IAAI;IAEpB;AAkNF;AAhNE,SAAA;IACE,OACE,IAAI,CAACxB,KAAK,CAACJ,WAAW,IACtB6B,KAAKC,GAAG,KAAK,IAAI,CAAC1B,KAAK,CAACJ,WAAW,4BAAG,IAAI,EAAEa;AAEhD;AAOA,eAAA;IACE,0CAA0C;IAC1C,6BAAI,IAAI,EAAEQ,iBAAe;QACvB,+BAAM,IAAI,EAAEA;QACZ;IACF;IACA,0DAA0D;IAC1D,IAAI,yBAAA,IAAI,EAAEA,oBAAkB,MAAM;uCAC1BA,gBAAgB,0BAAA,IAAI,EAAEU,SAAAA,aAAN,IAAI;IAC5B;IACA,+BAAM,IAAI,EAAEV;mCACNA,gBAAgB;AACxB;AAOA,eAAA;IACE,6CAA6C;IAC7C,IAAI,0BAAA,IAAI,EAAEW,qBAAAA,yBAAN,IAAI,GAAwB;QAC9B;IACF;IAEA,IAAI;QACF,MAAMjC,WAAW,MAAM,0BAAA,IAAI,EAAEkC,YAAAA,gBAAN,IAAI,EAAY,yBAAA,IAAI,EAAE5B,MAAIC,QAAQ;QAEzD,6BAAI,IAAI,EAAEE,aAAW;YACnB,MAAMD,YAAY,MAAM,0BAAA,IAAI,EAAE0B,YAAAA,gBAAN,IAAI,EAAY,yBAAA,IAAI,EAAE5B,MAAIE,SAAS;YAC3D,MAAM,0BAAA,IAAI,EAAE2B,kBAAAA,sBAAN,IAAI,EAAkBnC,UAAUQ;QACxC;QAEA,IAAI,CAACwB,MAAM,CAAC,CAAC3B;YACXA,MAAML,QAAQ,GAAGoC,KAAKC,KAAK,CAACrC;YAC5BK,MAAMJ,WAAW,GAAG6B,KAAKC,GAAG;QAC9B;IACF,EAAE,OAAM;IACN,SAAS;IACX;AACF;AAEA,eAAA;IACE,IAAI,IAAI,CAAC1B,KAAK,CAACL,QAAQ,KAAK,MAAM;QAChC,MAAM,0BAAA,IAAI,EAAE6B,gBAAAA,oBAAN,IAAI;IACZ;IAEA,0DAA0D;IAC1D,IAAI,yBAAA,IAAI,EAAEb,+BAA6B,IAAI,CAACX,KAAK,CAACL,QAAQ,KAAK,MAAM;QACnE,MAAM,IAAIsC,MAAM;IAClB;IACA,OAAO,IAAI,CAACjC,KAAK,CAACL,QAAQ;AAC5B;AAEA,eAAA,UACEuC,MAAc,EACdC,QAA2B,EAC3BC,UAAU,KAAK;IAEf,MAAMzC,WAAW,MAAM,0BAAA,IAAI,EAAE0C,cAAAA,kBAAN,IAAI;IAE3B,MAAMC,eAAe3C,UAAU4C,aAAaC,KAAK,CAACC;QAChD,IAAI,QAAQA,SAAS;YACnB,OACEA,QAAQC,EAAE,KAAKR,UACf7C,sBAAsB8C,SAASQ,OAAO,EAAEF,QAAQG,YAAY;QAEhE;QAEA,OAAOH,QAAQI,QAAQ,KAAKV,SAASU,QAAQ;IAC/C;IAEA,IAAIP,cAAc;QAChB,OAAO;YACLQ,QAAQxD,oBAAoByD,OAAO;YACnCC,QAAQV,aAAaU,MAAM;QAC7B;IACF;IAEA,MAAMC,WAAWtD,UAAUuD,aAAa,CAAChB,OAAO;IAChD,MAAMS,UAAUM,UAAUE,UAAU,CAAChB,SAASQ,OAAO,CAAC;IACtD,IAAIA,WAAWA,QAAQE,QAAQ,KAAKV,SAASU,QAAQ,EAAE;QACrD,OAAO;YAAEC,QAAQxD,oBAAoB8D,QAAQ;QAAC;IAChD;IACA,4EAA4E;IAC5E,IAAI,yBAAA,IAAI,EAAExC,4BAA0B,CAACwB,SAAS;QAC5C,MAAM,0BAAA,IAAI,EAAEZ,gBAAAA,oBAAN,IAAI;QACV,OAAO,0BAAA,IAAI,EAAE6B,YAAAA,gBAAN,IAAI,EAAYnB,QAAQC,UAAU;IAC3C;IACA,OAAO;QAAEW,QAAQxD,oBAAoBgE,UAAU;IAAC;AAClD;AAEA,eAAA,IACEC,KAA2B;IAE3B,OAAOC,OAAOC,OAAO,CAACF,OAAOG,MAAM,CAEjC,OAAOC,iBAAiB,CAACzB,QAAQC,SAAS;QAC1C,MAAMyB,SAAS,MAAM,0BAAA,IAAI,EAAEP,YAAAA,gBAAN,IAAI,EAAYnB,QAAQC;QAC7C,MAAM0B,MAAM,MAAMF;QAClBE,GAAG,CAAC3B,OAAO,GAAG0B;QACd,OAAOC;IACT,GAAGC,QAAQC,OAAO,CAAC,CAAC;AACtB;AAWA,eAAA,eACE7B,MAAc,EACdU,YAAyB,EACzBR,UAAU,KAAK;IAEf,MAAMzC,WAAW,MAAM,0BAAA,IAAI,EAAE0C,cAAAA,kBAAN,IAAI;IAC3B,MAAMc,WAAWxD,UAAUuD,aAAa,CAAChB,OAAO,EAAEiB,YAAY;IAE9D,IAAI,CAACA,qCAAY,IAAI,EAAEvC,4BAA0B,CAACwB,SAAS;QACzD,MAAM,0BAAA,IAAI,EAAEZ,gBAAAA,oBAAN,IAAI;QACV,OAAO,0BAAA,IAAI,EAAED,iBAAAA,qBAAN,IAAI,EAAiBW,QAAQU,cAAc;IACpD;IAEA3D,OAAOkE,UAAU;IAEjB,MAAMa,gBAAgBhF,iBACpBwE,OAAOS,IAAI,CAACd,WACZP;IAGF,IAAI,CAACoB,0CAAiB,IAAI,EAAEpD,4BAA0B,CAACwB,SAAS;QAC9D,MAAM,0BAAA,IAAI,EAAEZ,gBAAAA,oBAAN,IAAI;QACV,OAAO,0BAAA,IAAI,EAAED,iBAAAA,qBAAN,IAAI,EAAiBW,QAAQU,cAAc;IACpD;IAEA3D,OACE+E,eACA;IAGF,6DAA6D;IAC7D9E,oBAAoB8E;IACpB,OAAOA;AACT;AASA,eAAA,YAAmB9B,MAAc;IAC/B,MAAMvC,WAAW,MAAM,0BAAA,IAAI,EAAE0C,cAAAA,kBAAN,IAAI;IAC3B,OAAO1C,UAAUuD,aAAa,CAAChB,OAAO,EAAErB,YAAY;AACtD;AAUA,eAAA,gBAAuBlB,QAAgB,EAAEQ,SAAiB;IACxDlB,gCAAO,IAAI,EAAEmB,aAAW;IAExB,MAAM8D,QAAQ,MAAMnF,OAAO;QACzBmB,UAAUP;QACVQ,WAAW4B,KAAKC,KAAK,CAAC7B;QACtBC,SAAS,2BAAE,IAAI,EAAEA;IACnB;IAEAnB,OAAOiF,OAAO;AAChB;AASA,eAAA,UAAiBjE,GAAW;IAC1B,MAAMkE,WAAW,MAAM,yBAAA,IAAI,EAAE9D,qBAAN,IAAI,EAAgBJ;IAC3C,IAAI,CAACkE,SAASC,EAAE,EAAE;QAChB,MAAM,IAAInC,MAAM,CAAC,gBAAgB,EAAEhC,IAAI,CAAC,CAAC;IAC3C;IAEA,OAAO,MAAMkE,SAASE,IAAI;AAC5B"}

package/dist/esm/snaps/registry/registry.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/snaps/registry/registry.ts"],"sourcesContent":["import type {\n  BlockReason,\n  SnapsRegistryDatabase,\n} from '@metamask/snaps-registry';\nimport type { SnapId, ValidatedSnapId } from '@metamask/snaps-utils';\nimport type { SemVerRange, SemVerVersion } from '@metamask/utils';\n\nexport type SnapsRegistryInfo = { version: SemVerVersion; checksum: string };\nexport type SnapsRegistryRequest = Record<SnapId, SnapsRegistryInfo>;\nexport type SnapsRegistryMetadata =\n  SnapsRegistryDatabase['verifiedSnaps'][ValidatedSnapId]['metadata'];\n\n// TODO: Decide on names for these\nexport enum SnapsRegistryStatus {\n  Unverified = 0,\n  Blocked = 1,\n  Verified = 2,\n}\n\nexport type SnapsRegistryResult = {\n  status: SnapsRegistryStatus;\n  reason?: BlockReason;\n};\n\nexport type SnapsRegistry = {\n  get(\n    snaps: SnapsRegistryRequest,\n  ): Promise<Record<ValidatedSnapId, SnapsRegistryResult>>;\n\n  update(): Promise<void>;\n\n  /**\n   * Find an allowlisted version within a specified version range.\n   *\n   * @param snapId - The ID of the snap we are trying to resolve a version for.\n   * @param versionRange - The version range.\n   * @param refetch - An optional flag used to determine if we are refetching the registry.\n   * @returns An allowlisted version within the specified version range.\n   * @throws If an allowlisted version does not exist within the version range.\n   */\n  resolveVersion(\n    snapId: SnapId,\n    versionRange: SemVerRange,\n  ): Promise<SemVerRange>;\n\n  /**\n   * Get metadata for the given snap ID.\n   *\n   * @param snapId - The ID of the snap to get metadata for.\n   * @returns The metadata for the given snap ID, or `null` if the snap is not\n   * verified.\n   */\n  getMetadata(snapId: SnapId): Promise<SnapsRegistryMetadata | null>;\n};\n"],"names":["SnapsRegistryStatus","Unverified","Blocked","Verified"],"mappings":"WAaO;UAAKA,mBAAmB;IAAnBA,oBAAAA,oBACVC,gBAAa,KAAbA;IADUD,oBAAAA,oBAEVE,aAAU,KAAVA;IAFUF,oBAAAA,oBAGVG,cAAW,KAAXA;GAHUH,wBAAAA"}
+{"version":3,"sources":["../../../../src/snaps/registry/registry.ts"],"sourcesContent":["import type {\n  BlockReason,\n  SnapsRegistryDatabase,\n} from '@metamask/snaps-registry';\nimport type { SnapId } from '@metamask/snaps-sdk';\nimport type { SemVerRange, SemVerVersion } from '@metamask/utils';\n\nexport type SnapsRegistryInfo = { version: SemVerVersion; checksum: string };\nexport type SnapsRegistryRequest = Record<SnapId, SnapsRegistryInfo>;\nexport type SnapsRegistryMetadata =\n  SnapsRegistryDatabase['verifiedSnaps'][SnapId]['metadata'];\n\n// TODO: Decide on names for these\nexport enum SnapsRegistryStatus {\n  Unverified = 0,\n  Blocked = 1,\n  Verified = 2,\n}\n\nexport type SnapsRegistryResult = {\n  status: SnapsRegistryStatus;\n  reason?: BlockReason;\n};\n\nexport type SnapsRegistry = {\n  get(\n    snaps: SnapsRegistryRequest,\n  ): Promise<Record<SnapId, SnapsRegistryResult>>;\n\n  update(): Promise<void>;\n\n  /**\n   * Find an allowlisted version within a specified version range.\n   *\n   * @param snapId - The ID of the snap we are trying to resolve a version for.\n   * @param versionRange - The version range.\n   * @param refetch - An optional flag used to determine if we are refetching the registry.\n   * @returns An allowlisted version within the specified version range.\n   * @throws If an allowlisted version does not exist within the version range.\n   */\n  resolveVersion(\n    snapId: SnapId,\n    versionRange: SemVerRange,\n  ): Promise<SemVerRange>;\n\n  /**\n   * Get metadata for the given snap ID.\n   *\n   * @param snapId - The ID of the snap to get metadata for.\n   * @returns The metadata for the given snap ID, or `null` if the snap is not\n   * verified.\n   */\n  getMetadata(snapId: SnapId): Promise<SnapsRegistryMetadata | null>;\n};\n"],"names":["SnapsRegistryStatus","Unverified","Blocked","Verified"],"mappings":"WAaO;UAAKA,mBAAmB;IAAnBA,oBAAAA,oBACVC,gBAAa,KAAbA;IADUD,oBAAAA,oBAEVE,aAAU,KAAVA;IAFUF,oBAAAA,oBAGVG,cAAW,KAAXA;GAHUH,wBAAAA"}

package/dist/types/cronjob/CronjobController.d.ts

@@ -1,7 +1,8 @@
 import type { RestrictedControllerMessenger } from '@metamask/base-controller';
 import { BaseControllerV2 as BaseController } from '@metamask/base-controller';
 import type { GetPermissions } from '@metamask/permission-controller';
-import type { SnapId, ValidatedSnapId, CronjobSpecification } from '@metamask/snaps-utils';
+import type { SnapId } from '@metamask/snaps-sdk';
+import type { CronjobSpecification } from '@metamask/snaps-utils';
 import type { GetAllSnaps, HandleSnapRequest, SnapDisabled, SnapEnabled, SnapInstalled, SnapRemoved, SnapUpdated } from '..';
 import { Timer } from '../snaps/Timer';
 export declare type CronjobControllerActions = GetAllSnaps | HandleSnapRequest | GetPermissions;
@@ -18,7 +19,7 @@ export declare type CronjobControllerArgs = {
 export declare type Cronjob = {
     timer?: Timer;
     id: string;
-    snapId: ValidatedSnapId;
+    snapId: SnapId;
 } & CronjobSpecification;
 export declare type StoredJobInformation = {
     lastRun: number;
@@ -53,7 +54,7 @@ export declare class CronjobController extends BaseController<typeof controllerN
      *
      * @param snapId - ID of a snap.
      */
-    register(snapId: ValidatedSnapId): void;
+    register(snapId: SnapId): void;
     /**
      * Schedule a new job.
      * This will interpret the cron expression and tell the timer to execute the job
@@ -77,7 +78,7 @@ export declare class CronjobController extends BaseController<typeof controllerN
      *
      * @param snapId - ID of a snap.
      */
-    unregister(snapId: SnapId): void;
+    unregister(snapId: string): void;
     /**
      * Update time of a last run for the Cronjob specified by ID.
      *

package/dist/types/services/AbstractExecutionService.d.ts

@@ -3,7 +3,7 @@ import { JsonRpcEngine } from '@metamask/json-rpc-engine';
 import ObjectMultiplex from '@metamask/object-multiplex';
 import type { BasePostMessageStream } from '@metamask/post-message-stream';
 import type { SnapRpcHookArgs } from '@metamask/snaps-utils';
-import type { Duplex } from 'stream';
+import type { Duplex } from 'readable-stream';
 import type { ExecutionService, ExecutionServiceMessenger, SnapExecutionData } from './ExecutionService';
 export declare type SetupSnapProvider = (snapId: string, stream: Duplex) => void;
 export declare type ExecutionServiceArgs = {

package/dist/types/services/ExecutionService.d.ts

@@ -1,5 +1,5 @@
 import type { RestrictedControllerMessenger } from '@metamask/base-controller';
-import type { SnapId, SnapRpcHookArgs } from '@metamask/snaps-utils';
+import type { SnapRpcHookArgs } from '@metamask/snaps-utils';
 import type { Json } from '@metamask/utils';
 declare type TerminateSnap = (snapId: string) => Promise<void>;
 declare type TerminateAll = () => Promise<void>;
@@ -24,15 +24,15 @@ export declare type SnapErrorJson = {
 declare const controllerName = "ExecutionService";
 export declare type ErrorMessageEvent = {
     type: 'ExecutionService:unhandledError';
-    payload: [SnapId, SnapErrorJson];
+    payload: [string, SnapErrorJson];
 };
 export declare type OutboundRequest = {
     type: 'ExecutionService:outboundRequest';
-    payload: [SnapId];
+    payload: [string];
 };
 export declare type OutboundResponse = {
     type: 'ExecutionService:outboundResponse';
-    payload: [SnapId];
+    payload: [string];
 };
 export declare type ExecutionServiceEvents = ErrorMessageEvent | OutboundRequest | OutboundResponse;
 /**

package/dist/types/snaps/SnapController.d.ts

@@ -4,8 +4,10 @@ import { BaseControllerV2 as BaseController } from '@metamask/base-controller';
 import type { GetEndowments, GetPermissions, GetSubjectMetadata, GetSubjects, GrantPermissions, HasPermission, HasPermissions, RevokeAllPermissions, RevokePermissionForAllSubjects, RevokePermissions, UpdateCaveat } from '@metamask/permission-controller';
 import type { MaybeUpdateState, TestOrigin } from '@metamask/phishing-controller';
 import type { BlockReason } from '@metamask/snaps-registry';
-import type { InstallSnapsResult, PersistedSnap, RequestedSnapPermissions, Snap, SnapId, SnapRpcHook, SnapRpcHookArgs, StatusContext, StatusEvents, StatusStates, TruncatedSnap, ValidatedSnapId } from '@metamask/snaps-utils';
-import { AuxiliaryFileEncoding, SnapStatusEvents } from '@metamask/snaps-utils';
+import type { RequestSnapsParams, RequestSnapsResult, SnapId } from '@metamask/snaps-sdk';
+import { AuxiliaryFileEncoding } from '@metamask/snaps-sdk';
+import type { PersistedSnap, Snap, SnapRpcHook, SnapRpcHookArgs, StatusContext, StatusEvents, StatusStates, TruncatedSnap } from '@metamask/snaps-utils';
+import { SnapStatusEvents } from '@metamask/snaps-utils';
 import type { Json, NonEmptyArray } from '@metamask/utils';
 import type { StateMachine } from '@xstate/fsm';
 import type { Patch } from 'immer';
@@ -67,15 +69,15 @@ export declare type SnapError = {
     data?: Json;
 };
 declare type CloseAllConnectionsFunction = (origin: string) => void;
-declare type StoredSnaps = Record<ValidatedSnapId, Snap>;
+declare type StoredSnaps = Record<SnapId, Snap>;
 export declare type SnapControllerState = {
     snaps: StoredSnaps;
-    snapStates: Record<ValidatedSnapId, string | null>;
-    unencryptedSnapStates: Record<ValidatedSnapId, string | null>;
+    snapStates: Record<SnapId, string | null>;
+    unencryptedSnapStates: Record<SnapId, string | null>;
 };
 export declare type PersistedSnapControllerState = SnapControllerState & {
-    snaps: Record<ValidatedSnapId, PersistedSnap>;
-    snapStates: Record<ValidatedSnapId, string>;
+    snaps: Record<SnapId, PersistedSnap>;
+    snapStates: Record<SnapId, string>;
 };
 /**
  * Gets the specified Snap from state.
@@ -339,30 +341,30 @@ export declare class SnapController extends BaseController<string, SnapControlle
      * for more information.
      */
     updateBlockedSnaps(): Promise<void>;
-    _onUnhandledSnapError(snapId: SnapId, _error: SnapErrorJson): void;
-    _onOutboundRequest(snapId: SnapId): void;
-    _onOutboundResponse(snapId: SnapId): void;
+    _onUnhandledSnapError(snapId: string, _error: SnapErrorJson): void;
+    _onOutboundRequest(snapId: string): void;
+    _onOutboundResponse(snapId: string): void;
     /**
      * Starts the given snap. Throws an error if no such snap exists
      * or if it is already running.
      *
      * @param snapId - The id of the Snap to start.
      */
-    startSnap(snapId: ValidatedSnapId): Promise<void>;
+    startSnap(snapId: SnapId): Promise<void>;
     /**
      * Enables the given snap. A snap can only be started if it is enabled. A snap
      * can only be enabled if it isn't blocked.
      *
      * @param snapId - The id of the Snap to enable.
      */
-    enableSnap(snapId: ValidatedSnapId): void;
+    enableSnap(snapId: SnapId): void;
     /**
      * Disables the given snap. A snap can only be started if it is enabled.
      *
      * @param snapId - The id of the Snap to disable.
      * @returns A promise that resolves once the snap has been disabled.
      */
-    disableSnap(snapId: ValidatedSnapId): Promise<void>;
+    disableSnap(snapId: SnapId): Promise<void>;
     /**
      * Stops the given snap, removes all hooks, closes all connections, and
      * terminates its worker.
@@ -371,7 +373,7 @@ export declare class SnapController extends BaseController<string, SnapControlle
      * @param statusEvent - The Snap status event that caused the snap to be
      * stopped.
      */
-    stopSnap(snapId: ValidatedSnapId, statusEvent?: SnapStatusEvents.Stop | SnapStatusEvents.Crash): Promise<void>;
+    stopSnap(snapId: SnapId, statusEvent?: SnapStatusEvents.Stop | SnapStatusEvents.Crash): Promise<void>;
     /**
      * Returns whether the given snap is running.
      * Throws an error if the snap doesn't exist.
@@ -379,14 +381,14 @@ export declare class SnapController extends BaseController<string, SnapControlle
      * @param snapId - The id of the Snap to check.
      * @returns `true` if the snap is running, otherwise `false`.
      */
-    isRunning(snapId: ValidatedSnapId): boolean;
+    isRunning(snapId: SnapId): boolean;
     /**
      * Returns whether the given snap has been added to state.
      *
      * @param snapId - The id of the Snap to check for.
      * @returns `true` if the snap exists in the controller state, otherwise `false`.
      */
-    has(snapId: ValidatedSnapId): boolean;
+    has(snapId: SnapId): boolean;
     /**
      * Gets the snap with the given id if it exists, including all data.
      * This should not be used if the snap is to be serializable, as e.g.
@@ -395,7 +397,7 @@ export declare class SnapController extends BaseController<string, SnapControlle
      * @param snapId - The id of the Snap to get.
      * @returns The entire snap object from the controller state.
      */
-    get(snapId: SnapId): Snap | undefined;
+    get(snapId: string): Snap | undefined;
     /**
      * Gets the snap with the given id, throws if doesn't.
      * This should not be used if the snap is to be serializable, as e.g.
@@ -406,7 +408,7 @@ export declare class SnapController extends BaseController<string, SnapControlle
      * @param snapId - The id of the snap to get.
      * @returns The entire snap object.
      */
-    getExpect(snapId: ValidatedSnapId): Snap;
+    getExpect(snapId: SnapId): Snap;
     /**
      * Gets the snap with the given id if it exists, excluding any
      * non-serializable or expensive-to-serialize data.
@@ -414,7 +416,7 @@ export declare class SnapController extends BaseController<string, SnapControlle
      * @param snapId - The id of the Snap to get.
      * @returns A truncated version of the snap state, that is less expensive to serialize.
      */
-    getTruncated(snapId: ValidatedSnapId): TruncatedSnap | null;
+    getTruncated(snapId: SnapId): TruncatedSnap | null;
     /**
      * Gets the snap with the given id, throw if it doesn't exist.
      *
@@ -422,7 +424,7 @@ export declare class SnapController extends BaseController<string, SnapControlle
      * @param snapId - The id of the snap to get.
      * @returns A truncated version of the snap state, that is less expensive to serialize.
      */
-    getTruncatedExpect(snapId: ValidatedSnapId): TruncatedSnap;
+    getTruncatedExpect(snapId: SnapId): TruncatedSnap;
     /**
      * Updates the own state of the snap with the given id.
      * This is distinct from the state MetaMask uses to manage snaps.
@@ -431,7 +433,7 @@ export declare class SnapController extends BaseController<string, SnapControlle
      * @param newSnapState - The new state of the snap.
      * @param encrypted - A flag to indicate whether to use encrypted storage or not.
      */
-    updateSnapState(snapId: ValidatedSnapId, newSnapState: string, encrypted: boolean): void;
+    updateSnapState(snapId: SnapId, newSnapState: string, encrypted: boolean): void;
     /**
      * Clears the state of the snap with the given id.
      * This is distinct from the state MetaMask uses to manage snaps.
@@ -439,7 +441,7 @@ export declare class SnapController extends BaseController<string, SnapControlle
      * @param snapId - The id of the Snap whose state should be cleared.
      * @param encrypted - A flag to indicate whether to use encrypted storage or not.
      */
-    clearSnapState(snapId: ValidatedSnapId, encrypted: boolean): void;
+    clearSnapState(snapId: SnapId, encrypted: boolean): void;
     /**
      * Gets the own state of the snap with the given id.
      * This is distinct from the state MetaMask uses to manage snaps.
@@ -448,7 +450,7 @@ export declare class SnapController extends BaseController<string, SnapControlle
      * @param encrypted - A flag to indicate whether to use encrypted storage or not.
      * @returns The requested snap state or null if no state exists.
      */
-    getSnapState(snapId: ValidatedSnapId, encrypted: boolean): Json;
+    getSnapState(snapId: SnapId, encrypted: boolean): Json;
     /**
      * Gets a static auxiliary snap file in a chosen file encoding.
      *
@@ -457,7 +459,7 @@ export declare class SnapController extends BaseController<string, SnapControlle
      * @param encoding - An optional requested file encoding.
      * @returns The file requested in the chosen file encoding or null if the file is not found.
      */
-    getSnapFile(snapId: ValidatedSnapId, path: string, encoding?: AuxiliaryFileEncoding): string | null;
+    getSnapFile(snapId: SnapId, path: string, encoding?: AuxiliaryFileEncoding): string | null;
     /**
      * Completely clear the controller's state: delete all associated data,
      * handlers, event listeners, and permissions; tear down all snap providers.
@@ -470,21 +472,21 @@ export declare class SnapController extends BaseController<string, SnapControlle
      * @param snapId - The id of the Snap.
      * @returns A promise that resolves once the snap has been removed.
      */
-    removeSnap(snapId: ValidatedSnapId): Promise<void>;
+    removeSnap(snapId: SnapId): Promise<void>;
     /**
      * Stops the given snaps, removes them from state, and clears all associated
      * permissions, handlers, and listeners.
      *
      * @param snapIds - The ids of the Snaps.
      */
-    removeSnaps(snapIds: ValidatedSnapId[]): Promise<void>;
+    removeSnaps(snapIds: SnapId[]): Promise<void>;
     /**
      * Removes a snap's permission (caveat) from the specified subject.
      *
      * @param origin - The origin from which to remove the snap.
      * @param snapId - The id of the snap to remove.
      */
-    removeSnapFromSubject(origin: string, snapId: ValidatedSnapId): void;
+    removeSnapFromSubject(origin: string, snapId: SnapId): void;
     /**
      * Checks if a list of permissions are dynamic and allowed to be revoked, if they are they will all be revoked.
      *
@@ -498,13 +500,13 @@ export declare class SnapController extends BaseController<string, SnapControlle
      *
      * @param snapId - The snap id of the snap that was referenced.
      */
-    incrementActiveReferences(snapId: ValidatedSnapId): void;
+    incrementActiveReferences(snapId: SnapId): void;
     /**
      * Handles decrement the activeReferences counter.
      *
      * @param snapId - The snap id of the snap that was referenced..
      */
-    decrementActiveReferences(snapId: ValidatedSnapId): void;
+    decrementActiveReferences(snapId: SnapId): void;
     /**
      * Gets all snaps in their truncated format.
      *
@@ -517,7 +519,7 @@ export declare class SnapController extends BaseController<string, SnapControlle
      * @param origin - The origin whose permitted snaps to retrieve.
      * @returns The serialized permitted snaps for the origin.
      */
-    getPermittedSnaps(origin: string): InstallSnapsResult;
+    getPermittedSnaps(origin: string): RequestSnapsResult;
     /**
      * Installs the snaps requested by the given origin, returning the snap
      * object if the origin is permitted to install it, and an authorization error
@@ -528,7 +530,7 @@ export declare class SnapController extends BaseController<string, SnapControlle
      * @returns An object of snap ids and snap objects, or errors if a
      * snap couldn't be installed.
      */
-    installSnaps(origin: string, requestedSnaps: RequestedSnapPermissions): Promise<InstallSnapsResult>;
+    installSnaps(origin: string, requestedSnaps: RequestSnapsParams): Promise<RequestSnapsResult>;
     /**
      * Adds, authorizes, and runs the given snap with a snap provider.
      * Results from this method should be efficiently serializable.
@@ -559,7 +561,7 @@ export declare class SnapController extends BaseController<string, SnapControlle
      * @param emitEvent - An optional boolean flag to indicate whether this update should emit an event.
      * @returns The snap metadata if updated, `null` otherwise.
      */
-    updateSnap(origin: string, snapId: ValidatedSnapId, location: SnapLocation, newVersionRange?: string, emitEvent?: boolean): Promise<TruncatedSnap>;
+    updateSnap(origin: string, snapId: SnapId, location: SnapLocation, newVersionRange?: string, emitEvent?: boolean): Promise<TruncatedSnap>;
     /**
      * Get metadata for the given snap ID.
      *
@@ -567,7 +569,7 @@ export declare class SnapController extends BaseController<string, SnapControlle
      * @returns The metadata for the given snap ID, or `null` if the snap is not
      * verified.
      */
-    getRegistryMetadata(snapId: ValidatedSnapId): Promise<SnapsRegistryMetadata | null>;
+    getRegistryMetadata(snapId: SnapId): Promise<SnapsRegistryMetadata | null>;
     /**
      * Initiates a request for the given snap's initial permissions.
      * Must be called in order. See processRequestedSnap.
@@ -591,7 +593,7 @@ export declare class SnapController extends BaseController<string, SnapControlle
      * @returns The result of the JSON-RPC request.
      */
     handleRequest({ snapId, origin, handler: handlerType, request: rawRequest, }: SnapRpcHookArgs & {
-        snapId: ValidatedSnapId;
+        snapId: SnapId;
     }): Promise<unknown>;
 }
 export {};

package/dist/types/snaps/registry/registry.d.ts

@@ -1,12 +1,12 @@
 import type { BlockReason, SnapsRegistryDatabase } from '@metamask/snaps-registry';
-import type { SnapId, ValidatedSnapId } from '@metamask/snaps-utils';
+import type { SnapId } from '@metamask/snaps-sdk';
 import type { SemVerRange, SemVerVersion } from '@metamask/utils';
 export declare type SnapsRegistryInfo = {
     version: SemVerVersion;
     checksum: string;
 };
 export declare type SnapsRegistryRequest = Record<SnapId, SnapsRegistryInfo>;
-export declare type SnapsRegistryMetadata = SnapsRegistryDatabase['verifiedSnaps'][ValidatedSnapId]['metadata'];
+export declare type SnapsRegistryMetadata = SnapsRegistryDatabase['verifiedSnaps'][SnapId]['metadata'];
 export declare enum SnapsRegistryStatus {
     Unverified = 0,
     Blocked = 1,
@@ -17,7 +17,7 @@ export declare type SnapsRegistryResult = {
     reason?: BlockReason;
 };
 export declare type SnapsRegistry = {
-    get(snaps: SnapsRegistryRequest): Promise<Record<ValidatedSnapId, SnapsRegistryResult>>;
+    get(snaps: SnapsRegistryRequest): Promise<Record<SnapId, SnapsRegistryResult>>;
     update(): Promise<void>;
     /**
      * Find an allowlisted version within a specified version range.