@metamask/snaps-controllers 4.0.0 → 5.0.0

package/dist/esm/snaps/constants.js

@@ -0,0 +1,16 @@
+import { SnapEndowments } from '@metamask/snaps-rpc-methods';
+// These permissions are allowed without being on the allowlist.
+export const ALLOWED_PERMISSIONS = Object.freeze([
+    'snap_dialog',
+    'snap_manageState',
+    'snap_notify',
+    'snap_getLocale',
+    SnapEndowments.Cronjob,
+    SnapEndowments.HomePage,
+    SnapEndowments.LifecycleHooks,
+    SnapEndowments.EthereumProvider,
+    SnapEndowments.TransactionInsight,
+    SnapEndowments.SignatureInsight
+]);
+
+//# sourceMappingURL=constants.js.map

package/dist/esm/snaps/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/snaps/constants.ts"],"sourcesContent":["import { SnapEndowments } from '@metamask/snaps-rpc-methods';\n\n// These permissions are allowed without being on the allowlist.\nexport const ALLOWED_PERMISSIONS = Object.freeze([\n  'snap_dialog',\n  'snap_manageState',\n  'snap_notify',\n  'snap_getLocale',\n  SnapEndowments.Cronjob,\n  SnapEndowments.HomePage,\n  SnapEndowments.LifecycleHooks,\n  SnapEndowments.EthereumProvider,\n  SnapEndowments.TransactionInsight,\n  SnapEndowments.SignatureInsight,\n]);\n"],"names":["SnapEndowments","ALLOWED_PERMISSIONS","Object","freeze","Cronjob","HomePage","LifecycleHooks","EthereumProvider","TransactionInsight","SignatureInsight"],"mappings":"AAAA,SAASA,cAAc,QAAQ,8BAA8B;AAE7D,gEAAgE;AAChE,OAAO,MAAMC,sBAAsBC,OAAOC,MAAM,CAAC;IAC/C;IACA;IACA;IACA;IACAH,eAAeI,OAAO;IACtBJ,eAAeK,QAAQ;IACvBL,eAAeM,cAAc;IAC7BN,eAAeO,gBAAgB;IAC/BP,eAAeQ,kBAAkB;IACjCR,eAAeS,gBAAgB;CAChC,EAAE"}

package/dist/esm/snaps/index.js

@@ -1,8 +1,6 @@
 export * from './location';
 export * from './SnapController';
-export * from './endowments';
 export * from './selectors';
 export * from './registry';
-export * from './permissions';
 
 //# sourceMappingURL=index.js.map

package/dist/esm/snaps/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/snaps/index.ts"],"sourcesContent":["export * from './location';\nexport * from './SnapController';\nexport * from './endowments';\nexport * from './selectors';\nexport * from './registry';\nexport * from './permissions';\n"],"names":[],"mappings":"AAAA,cAAc,aAAa;AAC3B,cAAc,mBAAmB;AACjC,cAAc,eAAe;AAC7B,cAAc,cAAc;AAC5B,cAAc,aAAa;AAC3B,cAAc,gBAAgB"}
+{"version":3,"sources":["../../../src/snaps/index.ts"],"sourcesContent":["export * from './location';\nexport * from './SnapController';\nexport * from './selectors';\nexport * from './registry';\n"],"names":[],"mappings":"AAAA,cAAc,aAAa;AAC3B,cAAc,mBAAmB;AACjC,cAAc,cAAc;AAC5B,cAAc,aAAa"}

package/dist/esm/snaps/location/npm.js

@@ -192,11 +192,22 @@ export class NpmLocation extends BaseNpmLocation {
         assert(tarballSize <= TARBALL_SIZE_SAFETY_LIMIT, 'Snap tarball exceeds size limit');
         return new Promise((resolve, reject)=>{
             const files = new Map();
+            const tarballStream = createTarballStream(getNpmCanonicalBasePath(this.meta.registry, this.meta.packageName), files);
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+            const body = tarballResponse.body;
             // The "gz" in "tgz" stands for "gzip". The tarball needs to be decompressed
             // before we can actually grab any files from it.
             // To prevent recursion-based zip bombs, we should not allow recursion here.
-            pipeline(// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-            getNodeStream(tarballResponse.body), createGunzip(), createTarballStream(getNpmCanonicalBasePath(this.meta.registry, this.meta.packageName), files), (error)=>{
+            // If native decompression stream is available we use that, otherwise fallback to zlib.
+            if ('pipeThrough' in body && 'DecompressionStream' in globalThis) {
+                const decompressionStream = new DecompressionStream('gzip');
+                const decompressedStream = body.pipeThrough(decompressionStream);
+                pipeline(getNodeStream(decompressedStream), tarballStream, (error)=>{
+                    error ? reject(error) : resolve(files);
+                });
+                return;
+            }
+            pipeline(getNodeStream(body), createGunzip(), tarballStream, (error)=>{
                 error ? reject(error) : resolve(files);
             });
         });

package/dist/esm/snaps/location/npm.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/snaps/location/npm.ts"],"sourcesContent":["import type { SnapManifest } from '@metamask/snaps-utils';\nimport {\n  createSnapManifest,\n  DEFAULT_REQUESTED_SNAP_VERSION,\n  getTargetVersion,\n  isValidUrl,\n  NpmSnapIdStruct,\n  VirtualFile,\n  normalizeRelative,\n  parseJson,\n} from '@metamask/snaps-utils';\nimport type { SemVerRange, SemVerVersion } from '@metamask/utils';\nimport {\n  assert,\n  assertIsSemVerVersion,\n  assertStruct,\n  isObject,\n  isValidSemVerVersion,\n} from '@metamask/utils';\nimport { createGunzip } from 'browserify-zlib';\nimport concat from 'concat-stream';\nimport getNpmTarballUrl from 'get-npm-tarball-url';\nimport { pipeline } from 'readable-stream';\nimport type { Readable, Writable } from 'readable-stream';\nimport { ReadableWebToNodeStream } from 'readable-web-to-node-stream';\nimport { extract as tarExtract } from 'tar-stream';\n\nimport type { DetectSnapLocationOptions, SnapLocation } from './location';\n\nexport const DEFAULT_NPM_REGISTRY = new URL('https://registry.npmjs.org');\n\ninterface NpmMeta {\n  registry: URL;\n  packageName: string;\n  requestedRange: SemVerRange;\n  version?: string;\n  fetch: typeof fetch;\n  resolveVersion: (range: SemVerRange) => Promise<SemVerRange>;\n}\nexport interface NpmOptions {\n  /**\n   * @default DEFAULT_REQUESTED_SNAP_VERSION\n   */\n  versionRange?: SemVerRange;\n  /**\n   * Whether to allow custom NPM registries outside of {@link DEFAULT_NPM_REGISTRY}.\n   *\n   * @default false\n   */\n  allowCustomRegistries?: boolean;\n}\n\n// Base class for NPM implementation, useful for extending with custom NPM fetching logic\nexport abstract class BaseNpmLocation implements SnapLocation {\n  protected readonly meta: NpmMeta;\n\n  #validatedManifest?: VirtualFile<SnapManifest>;\n\n  #files?: Map<string, VirtualFile>;\n\n  constructor(url: URL, opts: DetectSnapLocationOptions = {}) {\n    const allowCustomRegistries = opts.allowCustomRegistries ?? false;\n    const fetchFunction = opts.fetch ?? globalThis.fetch.bind(globalThis);\n    const requestedRange = opts.versionRange ?? DEFAULT_REQUESTED_SNAP_VERSION;\n    const defaultResolve = async (range: SemVerRange) => range;\n    const resolveVersion = opts.resolveVersion ?? defaultResolve;\n\n    assertStruct(url.toString(), NpmSnapIdStruct, 'Invalid Snap Id: ');\n\n    let registry: string | URL;\n    if (\n      url.host === '' &&\n      url.port === '' &&\n      url.username === '' &&\n      url.password === ''\n    ) {\n      registry = DEFAULT_NPM_REGISTRY;\n    } else {\n      registry = 'https://';\n      if (url.username) {\n        registry += url.username;\n        if (url.password) {\n          registry += `:${url.password}`;\n        }\n        registry += '@';\n      }\n      registry += url.host;\n      registry = new URL(registry);\n      assert(\n        allowCustomRegistries,\n        new TypeError(\n          `Custom NPM registries are disabled, tried to use \"${registry.toString()}\".`,\n        ),\n      );\n    }\n\n    assert(\n      registry.pathname === '/' &&\n        registry.search === '' &&\n        registry.hash === '',\n    );\n\n    assert(\n      url.pathname !== '' && url.pathname !== '/',\n      new TypeError('The package name in NPM location is empty.'),\n    );\n    let packageName = url.pathname;\n    if (packageName.startsWith('/')) {\n      packageName = packageName.slice(1);\n    }\n\n    this.meta = {\n      requestedRange,\n      registry,\n      packageName,\n      fetch: fetchFunction,\n      resolveVersion,\n    };\n  }\n\n  async manifest(): Promise<VirtualFile<SnapManifest>> {\n    if (this.#validatedManifest) {\n      return this.#validatedManifest.clone();\n    }\n\n    const vfile = await this.fetch('snap.manifest.json');\n    const result = parseJson(vfile.toString());\n    vfile.result = createSnapManifest(result);\n    this.#validatedManifest = vfile as VirtualFile<SnapManifest>;\n\n    return this.manifest();\n  }\n\n  async fetch(path: string): Promise<VirtualFile> {\n    const relativePath = normalizeRelative(path);\n    if (!this.#files) {\n      await this.#lazyInit();\n      assert(this.#files !== undefined);\n    }\n    const vfile = this.#files.get(relativePath);\n    assert(\n      vfile !== undefined,\n      new TypeError(`File \"${path}\" not found in package.`),\n    );\n    return vfile.clone();\n  }\n\n  get packageName(): string {\n    return this.meta.packageName;\n  }\n\n  get version(): string {\n    assert(\n      this.meta.version !== undefined,\n      'Tried to access version without first fetching NPM package.',\n    );\n    return this.meta.version;\n  }\n\n  get registry(): URL {\n    return this.meta.registry;\n  }\n\n  get versionRange(): SemVerRange {\n    return this.meta.requestedRange;\n  }\n\n  async #lazyInit() {\n    assert(this.#files === undefined);\n    const resolvedVersion = await this.meta.resolveVersion(\n      this.meta.requestedRange,\n    );\n\n    const { tarballURL, targetVersion } = await resolveNpmVersion(\n      this.meta.packageName,\n      resolvedVersion,\n      this.meta.registry,\n      this.meta.fetch,\n    );\n\n    if (!isValidUrl(tarballURL) || !tarballURL.toString().endsWith('.tgz')) {\n      throw new Error(\n        `Failed to find valid tarball URL in NPM metadata for package \"${this.meta.packageName}\".`,\n      );\n    }\n\n    // Override the tarball hostname/protocol with registryUrl hostname/protocol\n    const newTarballUrl = new URL(tarballURL);\n    newTarballUrl.hostname = this.meta.registry.hostname;\n    newTarballUrl.protocol = this.meta.registry.protocol;\n\n    const files = await this.fetchNpmTarball(newTarballUrl);\n\n    this.#files = files;\n    this.meta.version = targetVersion;\n  }\n\n  /**\n   * Fetches and unpacks the tarball (`.tgz` file) from the specified URL.\n   *\n   * @param tarballUrl - The tarball URL to fetch and unpack.\n   * @returns A the files for the package tarball.\n   * @throws If fetching the tarball fails.\n   */\n  abstract fetchNpmTarball(tarballUrl: URL): Promise<Map<string, VirtualFile>>;\n}\n\n// Safety limit for tarballs, 250 MB in bytes\nexport const TARBALL_SIZE_SAFETY_LIMIT = 262144000;\n\n// Main NPM implementation, contains a browser tarball fetching implementation.\nexport class NpmLocation extends BaseNpmLocation {\n  /**\n   * Fetches and unpacks the tarball (`.tgz` file) from the specified URL.\n   *\n   * @param tarballUrl - The tarball URL to fetch and unpack.\n   * @returns A the files for the package tarball.\n   * @throws If fetching the tarball fails.\n   */\n  async fetchNpmTarball(\n    tarballUrl: URL,\n  ): Promise<Map<string, VirtualFile<unknown>>> {\n    // Perform a raw fetch because we want the Response object itself.\n    const tarballResponse = await this.meta.fetch(tarballUrl.toString());\n    if (!tarballResponse.ok || !tarballResponse.body) {\n      throw new Error(\n        `Failed to fetch tarball for package \"${this.meta.packageName}\".`,\n      );\n    }\n\n    // We assume that NPM is a good actor and provides us with a valid `content-length` header.\n    const tarballSizeString = tarballResponse.headers.get('content-length');\n    assert(tarballSizeString, 'Snap tarball has invalid content-length');\n    const tarballSize = parseInt(tarballSizeString, 10);\n    assert(\n      tarballSize <= TARBALL_SIZE_SAFETY_LIMIT,\n      'Snap tarball exceeds size limit',\n    );\n    return new Promise((resolve, reject) => {\n      const files = new Map();\n\n      // The \"gz\" in \"tgz\" stands for \"gzip\". The tarball needs to be decompressed\n      // before we can actually grab any files from it.\n      // To prevent recursion-based zip bombs, we should not allow recursion here.\n      pipeline(\n        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n        getNodeStream(tarballResponse.body!),\n        createGunzip(),\n        createTarballStream(\n          getNpmCanonicalBasePath(this.meta.registry, this.meta.packageName),\n          files,\n        ),\n        (error: unknown) => {\n          error ? reject(error) : resolve(files);\n        },\n      );\n    });\n  }\n}\n\n// Incomplete type\nexport type PartialNpmMetadata = {\n  versions: Record<string, { dist: { tarball: string } }>;\n};\n\n/**\n * Fetches the NPM metadata of the specified package from\n * the public npm registry.\n *\n * @param packageName - The name of the package whose metadata to fetch.\n * @param registryUrl - The URL of the npm registry to fetch the metadata from.\n * @param fetchFunction - The fetch function to use. Defaults to the global\n * {@link fetch}. Useful for Node.js compatibility.\n * @returns The NPM metadata object.\n * @throws If fetching the metadata fails.\n */\nexport async function fetchNpmMetadata(\n  packageName: string,\n  registryUrl: URL,\n  fetchFunction: typeof fetch,\n): Promise<PartialNpmMetadata> {\n  const packageResponse = await fetchFunction(\n    new URL(packageName, registryUrl).toString(),\n    {\n      headers: {\n        // Corgi format is slightly smaller: https://github.com/npm/pacote/blob/main/lib/registry.js#L71\n        accept: isNPM(registryUrl)\n          ? 'application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*'\n          : 'application/json',\n      },\n    },\n  );\n  if (!packageResponse.ok) {\n    throw new Error(\n      `Failed to fetch NPM registry entry. Status code: ${packageResponse.status}.`,\n    );\n  }\n  const packageMetadata = await packageResponse.json();\n\n  if (!isObject(packageMetadata)) {\n    throw new Error(\n      `Failed to fetch package \"${packageName}\" metadata from npm.`,\n    );\n  }\n\n  return packageMetadata as PartialNpmMetadata;\n}\n\n/**\n * Gets the canonical base path for an NPM snap.\n *\n * @param registryUrl - A registry URL.\n * @param packageName - A package name.\n * @returns The canonical base path.\n */\nexport function getNpmCanonicalBasePath(registryUrl: URL, packageName: string) {\n  let canonicalBase = 'npm://';\n  if (registryUrl.username !== '') {\n    canonicalBase += registryUrl.username;\n    if (registryUrl.password !== '') {\n      canonicalBase += `:${registryUrl.password}`;\n    }\n    canonicalBase += '@';\n  }\n  return `${canonicalBase}${registryUrl.host}/${packageName}/`;\n}\n\n/**\n * Determine if a registry URL is NPM.\n *\n * @param registryUrl - A registry url.\n * @returns True if the registry is the NPM registry, otherwise false.\n */\nfunction isNPM(registryUrl: URL) {\n  return registryUrl.toString() === DEFAULT_NPM_REGISTRY.toString();\n}\n\n/**\n * Resolves a version range to a version using the NPM registry.\n *\n * Unless the version range is already a version, then the NPM registry is skipped.\n *\n * @param packageName - The name of the package whose metadata to fetch.\n * @param versionRange - The version range of the package.\n * @param registryUrl - The URL of the npm registry to fetch the metadata from.\n * @param fetchFunction - The fetch function to use. Defaults to the global\n * {@link fetch}. Useful for Node.js compatibility.\n * @returns An object containing the resolved version and a URL for its tarball.\n * @throws If fetching the metadata fails.\n */\nasync function resolveNpmVersion(\n  packageName: string,\n  versionRange: SemVerRange,\n  registryUrl: URL,\n  fetchFunction: typeof fetch,\n): Promise<{ tarballURL: string; targetVersion: SemVerVersion }> {\n  // If the version range is already a static version we don't need to look for the metadata.\n  if (isNPM(registryUrl) && isValidSemVerVersion(versionRange)) {\n    return {\n      tarballURL: getNpmTarballUrl(packageName, versionRange),\n      targetVersion: versionRange,\n    };\n  }\n\n  const packageMetadata = await fetchNpmMetadata(\n    packageName,\n    registryUrl,\n    fetchFunction,\n  );\n\n  const versions = Object.keys(packageMetadata?.versions ?? {}).map(\n    (version) => {\n      assertIsSemVerVersion(version);\n      return version;\n    },\n  );\n\n  const targetVersion = getTargetVersion(versions, versionRange);\n\n  if (targetVersion === null) {\n    throw new Error(\n      `Failed to find a matching version in npm metadata for package \"${packageName}\" and requested semver range \"${versionRange}\".`,\n    );\n  }\n\n  const tarballURL = packageMetadata?.versions?.[targetVersion]?.dist?.tarball;\n\n  return { tarballURL, targetVersion };\n}\n\n/**\n * The paths of files within npm tarballs appear to always be prefixed with\n * \"package/\".\n */\nconst NPM_TARBALL_PATH_PREFIX = /^package\\//u;\n\n/**\n * Converts a {@link ReadableStream} to a Node.js {@link Readable}\n * stream. Returns the stream directly if it is already a Node.js stream.\n * We can't use the native Web {@link ReadableStream} directly because the\n * other stream libraries we use expect Node.js streams.\n *\n * @param stream - The stream to convert.\n * @returns The given stream as a Node.js Readable stream.\n */\nfunction getNodeStream(stream: ReadableStream): Readable {\n  if (typeof stream.getReader !== 'function') {\n    return stream as unknown as Readable;\n  }\n\n  return new ReadableWebToNodeStream(stream);\n}\n\n/**\n * Creates a `tar-stream` that will get the necessary files from an npm Snap\n * package tarball (`.tgz` file).\n *\n * @param canonicalBase - A base URI as specified in {@link https://github.com/MetaMask/SIPs/blob/main/SIPS/sip-8.md SIP-8}. Starting with 'npm:'. Will be used for canonicalPath vfile argument.\n * @param files - An object to write target file contents to.\n * @returns The {@link Writable} tarball extraction stream.\n */\nfunction createTarballStream(\n  canonicalBase: string,\n  files: Map<string, VirtualFile>,\n): Writable {\n  assert(\n    canonicalBase.endsWith('/'),\n    \"Base needs to end with '/' for relative paths to be added as children instead of siblings.\",\n  );\n\n  assert(\n    canonicalBase.startsWith('npm:'),\n    'Protocol mismatch, expected \"npm:\".',\n  );\n  // `tar-stream` is pretty old-school, so we create it first and then\n  // instrument it by adding event listeners.\n  const extractStream = tarExtract();\n\n  let totalSize = 0;\n\n  // \"entry\" is fired for every discreet entity in the tarball. This includes\n  // files and folders.\n  extractStream.on('entry', (header, entryStream, next) => {\n    const { name: headerName, type: headerType } = header;\n    if (headerType === 'file') {\n      // The name is a path if the header type is \"file\".\n      const path = headerName.replace(NPM_TARBALL_PATH_PREFIX, '');\n      return entryStream.pipe(\n        concat({ encoding: 'uint8array' }, (data) => {\n          try {\n            totalSize += data.byteLength;\n            // To prevent zip bombs, we set a safety limit for the total size of tarballs.\n            assert(\n              totalSize < TARBALL_SIZE_SAFETY_LIMIT,\n              `Snap tarball exceeds limit of ${TARBALL_SIZE_SAFETY_LIMIT} bytes.`,\n            );\n            const vfile = new VirtualFile({\n              value: data,\n              path,\n              data: {\n                canonicalPath: new URL(path, canonicalBase).toString(),\n              },\n            });\n            // We disallow files having identical paths as it may confuse our checksum calculations.\n            assert(\n              !files.has(path),\n              'Malformed tarball, multiple files with the same path.',\n            );\n            files.set(path, vfile);\n            return next();\n          } catch (error) {\n            return extractStream.destroy(error);\n          }\n        }),\n      );\n    }\n\n    // If we get here, the entry is not a file, and we want to ignore. The entry\n    // stream must be drained, or the extractStream will stop reading. This is\n    // effectively a no-op for the current entry.\n    entryStream.on('end', () => next());\n    return entryStream.resume();\n  });\n  return extractStream;\n}\n"],"names":["createSnapManifest","DEFAULT_REQUESTED_SNAP_VERSION","getTargetVersion","isValidUrl","NpmSnapIdStruct","VirtualFile","normalizeRelative","parseJson","assert","assertIsSemVerVersion","assertStruct","isObject","isValidSemVerVersion","createGunzip","concat","getNpmTarballUrl","pipeline","ReadableWebToNodeStream","extract","tarExtract","DEFAULT_NPM_REGISTRY","URL","BaseNpmLocation","manifest","validatedManifest","clone","vfile","fetch","result","toString","path","relativePath","files","lazyInit","undefined","get","TypeError","packageName","meta","version","registry","versionRange","requestedRange","constructor","url","opts","allowCustomRegistries","fetchFunction","globalThis","bind","defaultResolve","range","resolveVersion","host","port","username","password","pathname","search","hash","startsWith","slice","resolvedVersion","tarballURL","targetVersion","resolveNpmVersion","endsWith","Error","newTarballUrl","hostname","protocol","fetchNpmTarball","TARBALL_SIZE_SAFETY_LIMIT","NpmLocation","tarballUrl","tarballResponse","ok","body","tarballSizeString","headers","tarballSize","parseInt","Promise","resolve","reject","Map","getNodeStream","createTarballStream","getNpmCanonicalBasePath","error","fetchNpmMetadata","registryUrl","packageResponse","accept","isNPM","status","packageMetadata","json","canonicalBase","versions","Object","keys","map","dist","tarball","NPM_TARBALL_PATH_PREFIX","stream","getReader","extractStream","totalSize","on","header","entryStream","next","name","headerName","type","headerType","replace","pipe","encoding","data","byteLength","value","canonicalPath","has","set","destroy","resume"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,SACEA,kBAAkB,EAClBC,8BAA8B,EAC9BC,gBAAgB,EAChBC,UAAU,EACVC,eAAe,EACfC,WAAW,EACXC,iBAAiB,EACjBC,SAAS,QACJ,wBAAwB;AAE/B,SACEC,MAAM,EACNC,qBAAqB,EACrBC,YAAY,EACZC,QAAQ,EACRC,oBAAoB,QACf,kBAAkB;AACzB,SAASC,YAAY,QAAQ,kBAAkB;AAC/C,OAAOC,YAAY,gBAAgB;AACnC,OAAOC,sBAAsB,sBAAsB;AACnD,SAASC,QAAQ,QAAQ,kBAAkB;AAE3C,SAASC,uBAAuB,QAAQ,8BAA8B;AACtE,SAASC,WAAWC,UAAU,QAAQ,aAAa;AAInD,OAAO,MAAMC,uBAAuB,IAAIC,IAAI,8BAA8B;IA2BxE,kDAEA,sCA6GM;AAnHR,yFAAyF;AACzF,OAAO,MAAeC;IAmEpB,MAAMC,WAA+C;QACnD,6BAAI,IAAI,EAAEC,qBAAmB;YAC3B,OAAO,yBAAA,IAAI,EAAEA,oBAAkBC,KAAK;QACtC;QAEA,MAAMC,QAAQ,MAAM,IAAI,CAACC,KAAK,CAAC;QAC/B,MAAMC,SAASrB,UAAUmB,MAAMG,QAAQ;QACvCH,MAAME,MAAM,GAAG5B,mBAAmB4B;uCAC5BJ,oBAAoBE;QAE1B,OAAO,IAAI,CAACH,QAAQ;IACtB;IAEA,MAAMI,MAAMG,IAAY,EAAwB;QAC9C,MAAMC,eAAezB,kBAAkBwB;QACvC,IAAI,0BAAC,IAAI,EAAEE,SAAO;YAChB,MAAM,0BAAA,IAAI,EAAEC,WAAAA,eAAN,IAAI;YACVzB,OAAO,yBAAA,IAAI,EAAEwB,YAAUE;QACzB;QACA,MAAMR,QAAQ,yBAAA,IAAI,EAAEM,QAAMG,GAAG,CAACJ;QAC9BvB,OACEkB,UAAUQ,WACV,IAAIE,UAAU,CAAC,MAAM,EAAEN,KAAK,uBAAuB,CAAC;QAEtD,OAAOJ,MAAMD,KAAK;IACpB;IAEA,IAAIY,cAAsB;QACxB,OAAO,IAAI,CAACC,IAAI,CAACD,WAAW;IAC9B;IAEA,IAAIE,UAAkB;QACpB/B,OACE,IAAI,CAAC8B,IAAI,CAACC,OAAO,KAAKL,WACtB;QAEF,OAAO,IAAI,CAACI,IAAI,CAACC,OAAO;IAC1B;IAEA,IAAIC,WAAgB;QAClB,OAAO,IAAI,CAACF,IAAI,CAACE,QAAQ;IAC3B;IAEA,IAAIC,eAA4B;QAC9B,OAAO,IAAI,CAACH,IAAI,CAACI,cAAc;IACjC;IAzGAC,YAAYC,GAAQ,EAAEC,OAAkC,CAAC,CAAC,CAAE;QA2G5D,iCAAM;QAjHN,uBAAmBP,QAAnB,KAAA;QAEA,gCAAA;;mBAAA,KAAA;;QAEA,gCAAA;;mBAAA,KAAA;;QAGE,MAAMQ,wBAAwBD,KAAKC,qBAAqB,IAAI;QAC5D,MAAMC,gBAAgBF,KAAKlB,KAAK,IAAIqB,WAAWrB,KAAK,CAACsB,IAAI,CAACD;QAC1D,MAAMN,iBAAiBG,KAAKJ,YAAY,IAAIxC;QAC5C,MAAMiD,iBAAiB,OAAOC,QAAuBA;QACrD,MAAMC,iBAAiBP,KAAKO,cAAc,IAAIF;QAE9CxC,aAAakC,IAAIf,QAAQ,IAAIzB,iBAAiB;QAE9C,IAAIoC;QACJ,IACEI,IAAIS,IAAI,KAAK,MACbT,IAAIU,IAAI,KAAK,MACbV,IAAIW,QAAQ,KAAK,MACjBX,IAAIY,QAAQ,KAAK,IACjB;YACAhB,WAAWpB;QACb,OAAO;YACLoB,WAAW;YACX,IAAII,IAAIW,QAAQ,EAAE;gBAChBf,YAAYI,IAAIW,QAAQ;gBACxB,IAAIX,IAAIY,QAAQ,EAAE;oBAChBhB,YAAY,CAAC,CAAC,EAAEI,IAAIY,QAAQ,CAAC,CAAC;gBAChC;gBACAhB,YAAY;YACd;YACAA,YAAYI,IAAIS,IAAI;YACpBb,WAAW,IAAInB,IAAImB;YACnBhC,OACEsC,uBACA,IAAIV,UACF,CAAC,kDAAkD,EAAEI,SAASX,QAAQ,GAAG,EAAE,CAAC;QAGlF;QAEArB,OACEgC,SAASiB,QAAQ,KAAK,OACpBjB,SAASkB,MAAM,KAAK,MACpBlB,SAASmB,IAAI,KAAK;QAGtBnD,OACEoC,IAAIa,QAAQ,KAAK,MAAMb,IAAIa,QAAQ,KAAK,KACxC,IAAIrB,UAAU;QAEhB,IAAIC,cAAcO,IAAIa,QAAQ;QAC9B,IAAIpB,YAAYuB,UAAU,CAAC,MAAM;YAC/BvB,cAAcA,YAAYwB,KAAK,CAAC;QAClC;QAEA,IAAI,CAACvB,IAAI,GAAG;YACVI;YACAF;YACAH;YACAV,OAAOoB;YACPK;QACF;IACF;AAuFF;AAtCE,eAAA;IACE5C,OAAO,yBAAA,IAAI,EAAEwB,YAAUE;IACvB,MAAM4B,kBAAkB,MAAM,IAAI,CAACxB,IAAI,CAACc,cAAc,CACpD,IAAI,CAACd,IAAI,CAACI,cAAc;IAG1B,MAAM,EAAEqB,UAAU,EAAEC,aAAa,EAAE,GAAG,MAAMC,kBAC1C,IAAI,CAAC3B,IAAI,CAACD,WAAW,EACrByB,iBACA,IAAI,CAACxB,IAAI,CAACE,QAAQ,EAClB,IAAI,CAACF,IAAI,CAACX,KAAK;IAGjB,IAAI,CAACxB,WAAW4D,eAAe,CAACA,WAAWlC,QAAQ,GAAGqC,QAAQ,CAAC,SAAS;QACtE,MAAM,IAAIC,MACR,CAAC,8DAA8D,EAAE,IAAI,CAAC7B,IAAI,CAACD,WAAW,CAAC,EAAE,CAAC;IAE9F;IAEA,4EAA4E;IAC5E,MAAM+B,gBAAgB,IAAI/C,IAAI0C;IAC9BK,cAAcC,QAAQ,GAAG,IAAI,CAAC/B,IAAI,CAACE,QAAQ,CAAC6B,QAAQ;IACpDD,cAAcE,QAAQ,GAAG,IAAI,CAAChC,IAAI,CAACE,QAAQ,CAAC8B,QAAQ;IAEpD,MAAMtC,QAAQ,MAAM,IAAI,CAACuC,eAAe,CAACH;mCAEnCpC,QAAQA;IACd,IAAI,CAACM,IAAI,CAACC,OAAO,GAAGyB;AACtB;AAYF,6CAA6C;AAC7C,OAAO,MAAMQ,4BAA4B,UAAU;AAEnD,+EAA+E;AAC/E,OAAO,MAAMC,oBAAoBnD;IAC/B;;;;;;GAMC,GACD,MAAMiD,gBACJG,UAAe,EAC6B;QAC5C,kEAAkE;QAClE,MAAMC,kBAAkB,MAAM,IAAI,CAACrC,IAAI,CAACX,KAAK,CAAC+C,WAAW7C,QAAQ;QACjE,IAAI,CAAC8C,gBAAgBC,EAAE,IAAI,CAACD,gBAAgBE,IAAI,EAAE;YAChD,MAAM,IAAIV,MACR,CAAC,qCAAqC,EAAE,IAAI,CAAC7B,IAAI,CAACD,WAAW,CAAC,EAAE,CAAC;QAErE;QAEA,2FAA2F;QAC3F,MAAMyC,oBAAoBH,gBAAgBI,OAAO,CAAC5C,GAAG,CAAC;QACtD3B,OAAOsE,mBAAmB;QAC1B,MAAME,cAAcC,SAASH,mBAAmB;QAChDtE,OACEwE,eAAeR,2BACf;QAEF,OAAO,IAAIU,QAAQ,CAACC,SAASC;YAC3B,MAAMpD,QAAQ,IAAIqD;YAElB,4EAA4E;YAC5E,iDAAiD;YACjD,4EAA4E;YAC5ErE,SACE,oEAAoE;YACpEsE,cAAcX,gBAAgBE,IAAI,GAClChE,gBACA0E,oBACEC,wBAAwB,IAAI,CAAClD,IAAI,CAACE,QAAQ,EAAE,IAAI,CAACF,IAAI,CAACD,WAAW,GACjEL,QAEF,CAACyD;gBACCA,QAAQL,OAAOK,SAASN,QAAQnD;YAClC;QAEJ;IACF;AACF;AAOA;;;;;;;;;;CAUC,GACD,OAAO,eAAe0D,iBACpBrD,WAAmB,EACnBsD,WAAgB,EAChB5C,aAA2B;IAE3B,MAAM6C,kBAAkB,MAAM7C,cAC5B,IAAI1B,IAAIgB,aAAasD,aAAa9D,QAAQ,IAC1C;QACEkD,SAAS;YACP,gGAAgG;YAChGc,QAAQC,MAAMH,eACV,6EACA;QACN;IACF;IAEF,IAAI,CAACC,gBAAgBhB,EAAE,EAAE;QACvB,MAAM,IAAIT,MACR,CAAC,iDAAiD,EAAEyB,gBAAgBG,MAAM,CAAC,CAAC,CAAC;IAEjF;IACA,MAAMC,kBAAkB,MAAMJ,gBAAgBK,IAAI;IAElD,IAAI,CAACtF,SAASqF,kBAAkB;QAC9B,MAAM,IAAI7B,MACR,CAAC,yBAAyB,EAAE9B,YAAY,oBAAoB,CAAC;IAEjE;IAEA,OAAO2D;AACT;AAEA;;;;;;CAMC,GACD,OAAO,SAASR,wBAAwBG,WAAgB,EAAEtD,WAAmB;IAC3E,IAAI6D,gBAAgB;IACpB,IAAIP,YAAYpC,QAAQ,KAAK,IAAI;QAC/B2C,iBAAiBP,YAAYpC,QAAQ;QACrC,IAAIoC,YAAYnC,QAAQ,KAAK,IAAI;YAC/B0C,iBAAiB,CAAC,CAAC,EAAEP,YAAYnC,QAAQ,CAAC,CAAC;QAC7C;QACA0C,iBAAiB;IACnB;IACA,OAAO,CAAC,EAAEA,cAAc,EAAEP,YAAYtC,IAAI,CAAC,CAAC,EAAEhB,YAAY,CAAC,CAAC;AAC9D;AAEA;;;;;CAKC,GACD,SAASyD,MAAMH,WAAgB;IAC7B,OAAOA,YAAY9D,QAAQ,OAAOT,qBAAqBS,QAAQ;AACjE;AAEA;;;;;;;;;;;;CAYC,GACD,eAAeoC,kBACb5B,WAAmB,EACnBI,YAAyB,EACzBkD,WAAgB,EAChB5C,aAA2B;IAE3B,2FAA2F;IAC3F,IAAI+C,MAAMH,gBAAgB/E,qBAAqB6B,eAAe;QAC5D,OAAO;YACLsB,YAAYhD,iBAAiBsB,aAAaI;YAC1CuB,eAAevB;QACjB;IACF;IAEA,MAAMuD,kBAAkB,MAAMN,iBAC5BrD,aACAsD,aACA5C;IAGF,MAAMoD,WAAWC,OAAOC,IAAI,CAACL,iBAAiBG,YAAY,CAAC,GAAGG,GAAG,CAC/D,CAAC/D;QACC9B,sBAAsB8B;QACtB,OAAOA;IACT;IAGF,MAAMyB,gBAAgB9D,iBAAiBiG,UAAU1D;IAEjD,IAAIuB,kBAAkB,MAAM;QAC1B,MAAM,IAAIG,MACR,CAAC,+DAA+D,EAAE9B,YAAY,8BAA8B,EAAEI,aAAa,EAAE,CAAC;IAElI;IAEA,MAAMsB,aAAaiC,iBAAiBG,UAAU,CAACnC,cAAc,EAAEuC,MAAMC;IAErE,OAAO;QAAEzC;QAAYC;IAAc;AACrC;AAEA;;;CAGC,GACD,MAAMyC,0BAA0B;AAEhC;;;;;;;;CAQC,GACD,SAASnB,cAAcoB,MAAsB;IAC3C,IAAI,OAAOA,OAAOC,SAAS,KAAK,YAAY;QAC1C,OAAOD;IACT;IAEA,OAAO,IAAIzF,wBAAwByF;AACrC;AAEA;;;;;;;CAOC,GACD,SAASnB,oBACPW,aAAqB,EACrBlE,KAA+B;IAE/BxB,OACE0F,cAAchC,QAAQ,CAAC,MACvB;IAGF1D,OACE0F,cAActC,UAAU,CAAC,SACzB;IAEF,oEAAoE;IACpE,2CAA2C;IAC3C,MAAMgD,gBAAgBzF;IAEtB,IAAI0F,YAAY;IAEhB,2EAA2E;IAC3E,qBAAqB;IACrBD,cAAcE,EAAE,CAAC,SAAS,CAACC,QAAQC,aAAaC;QAC9C,MAAM,EAAEC,MAAMC,UAAU,EAAEC,MAAMC,UAAU,EAAE,GAAGN;QAC/C,IAAIM,eAAe,QAAQ;YACzB,mDAAmD;YACnD,MAAMvF,OAAOqF,WAAWG,OAAO,CAACb,yBAAyB;YACzD,OAAOO,YAAYO,IAAI,CACrBzG,OAAO;gBAAE0G,UAAU;YAAa,GAAG,CAACC;gBAClC,IAAI;oBACFZ,aAAaY,KAAKC,UAAU;oBAC5B,8EAA8E;oBAC9ElH,OACEqG,YAAYrC,2BACZ,CAAC,8BAA8B,EAAEA,0BAA0B,OAAO,CAAC;oBAErE,MAAM9C,QAAQ,IAAIrB,YAAY;wBAC5BsH,OAAOF;wBACP3F;wBACA2F,MAAM;4BACJG,eAAe,IAAIvG,IAAIS,MAAMoE,eAAerE,QAAQ;wBACtD;oBACF;oBACA,wFAAwF;oBACxFrB,OACE,CAACwB,MAAM6F,GAAG,CAAC/F,OACX;oBAEFE,MAAM8F,GAAG,CAAChG,MAAMJ;oBAChB,OAAOuF;gBACT,EAAE,OAAOxB,OAAO;oBACd,OAAOmB,cAAcmB,OAAO,CAACtC;gBAC/B;YACF;QAEJ;QAEA,4EAA4E;QAC5E,0EAA0E;QAC1E,6CAA6C;QAC7CuB,YAAYF,EAAE,CAAC,OAAO,IAAMG;QAC5B,OAAOD,YAAYgB,MAAM;IAC3B;IACA,OAAOpB;AACT"}
+{"version":3,"sources":["../../../../src/snaps/location/npm.ts"],"sourcesContent":["import type { SnapManifest } from '@metamask/snaps-utils';\nimport {\n  createSnapManifest,\n  DEFAULT_REQUESTED_SNAP_VERSION,\n  getTargetVersion,\n  isValidUrl,\n  NpmSnapIdStruct,\n  VirtualFile,\n  normalizeRelative,\n  parseJson,\n} from '@metamask/snaps-utils';\nimport type { SemVerRange, SemVerVersion } from '@metamask/utils';\nimport {\n  assert,\n  assertIsSemVerVersion,\n  assertStruct,\n  isObject,\n  isValidSemVerVersion,\n} from '@metamask/utils';\nimport { createGunzip } from 'browserify-zlib';\nimport concat from 'concat-stream';\nimport getNpmTarballUrl from 'get-npm-tarball-url';\nimport { pipeline } from 'readable-stream';\nimport type { Readable, Writable } from 'readable-stream';\nimport { ReadableWebToNodeStream } from 'readable-web-to-node-stream';\nimport { extract as tarExtract } from 'tar-stream';\n\nimport type { DetectSnapLocationOptions, SnapLocation } from './location';\n\nexport const DEFAULT_NPM_REGISTRY = new URL('https://registry.npmjs.org');\n\ninterface NpmMeta {\n  registry: URL;\n  packageName: string;\n  requestedRange: SemVerRange;\n  version?: string;\n  fetch: typeof fetch;\n  resolveVersion: (range: SemVerRange) => Promise<SemVerRange>;\n}\nexport interface NpmOptions {\n  /**\n   * @default DEFAULT_REQUESTED_SNAP_VERSION\n   */\n  versionRange?: SemVerRange;\n  /**\n   * Whether to allow custom NPM registries outside of {@link DEFAULT_NPM_REGISTRY}.\n   *\n   * @default false\n   */\n  allowCustomRegistries?: boolean;\n}\n\n// Base class for NPM implementation, useful for extending with custom NPM fetching logic\nexport abstract class BaseNpmLocation implements SnapLocation {\n  protected readonly meta: NpmMeta;\n\n  #validatedManifest?: VirtualFile<SnapManifest>;\n\n  #files?: Map<string, VirtualFile>;\n\n  constructor(url: URL, opts: DetectSnapLocationOptions = {}) {\n    const allowCustomRegistries = opts.allowCustomRegistries ?? false;\n    const fetchFunction = opts.fetch ?? globalThis.fetch.bind(globalThis);\n    const requestedRange = opts.versionRange ?? DEFAULT_REQUESTED_SNAP_VERSION;\n    const defaultResolve = async (range: SemVerRange) => range;\n    const resolveVersion = opts.resolveVersion ?? defaultResolve;\n\n    assertStruct(url.toString(), NpmSnapIdStruct, 'Invalid Snap Id: ');\n\n    let registry: string | URL;\n    if (\n      url.host === '' &&\n      url.port === '' &&\n      url.username === '' &&\n      url.password === ''\n    ) {\n      registry = DEFAULT_NPM_REGISTRY;\n    } else {\n      registry = 'https://';\n      if (url.username) {\n        registry += url.username;\n        if (url.password) {\n          registry += `:${url.password}`;\n        }\n        registry += '@';\n      }\n      registry += url.host;\n      registry = new URL(registry);\n      assert(\n        allowCustomRegistries,\n        new TypeError(\n          `Custom NPM registries are disabled, tried to use \"${registry.toString()}\".`,\n        ),\n      );\n    }\n\n    assert(\n      registry.pathname === '/' &&\n        registry.search === '' &&\n        registry.hash === '',\n    );\n\n    assert(\n      url.pathname !== '' && url.pathname !== '/',\n      new TypeError('The package name in NPM location is empty.'),\n    );\n    let packageName = url.pathname;\n    if (packageName.startsWith('/')) {\n      packageName = packageName.slice(1);\n    }\n\n    this.meta = {\n      requestedRange,\n      registry,\n      packageName,\n      fetch: fetchFunction,\n      resolveVersion,\n    };\n  }\n\n  async manifest(): Promise<VirtualFile<SnapManifest>> {\n    if (this.#validatedManifest) {\n      return this.#validatedManifest.clone();\n    }\n\n    const vfile = await this.fetch('snap.manifest.json');\n    const result = parseJson(vfile.toString());\n    vfile.result = createSnapManifest(result);\n    this.#validatedManifest = vfile as VirtualFile<SnapManifest>;\n\n    return this.manifest();\n  }\n\n  async fetch(path: string): Promise<VirtualFile> {\n    const relativePath = normalizeRelative(path);\n    if (!this.#files) {\n      await this.#lazyInit();\n      assert(this.#files !== undefined);\n    }\n    const vfile = this.#files.get(relativePath);\n    assert(\n      vfile !== undefined,\n      new TypeError(`File \"${path}\" not found in package.`),\n    );\n    return vfile.clone();\n  }\n\n  get packageName(): string {\n    return this.meta.packageName;\n  }\n\n  get version(): string {\n    assert(\n      this.meta.version !== undefined,\n      'Tried to access version without first fetching NPM package.',\n    );\n    return this.meta.version;\n  }\n\n  get registry(): URL {\n    return this.meta.registry;\n  }\n\n  get versionRange(): SemVerRange {\n    return this.meta.requestedRange;\n  }\n\n  async #lazyInit() {\n    assert(this.#files === undefined);\n    const resolvedVersion = await this.meta.resolveVersion(\n      this.meta.requestedRange,\n    );\n\n    const { tarballURL, targetVersion } = await resolveNpmVersion(\n      this.meta.packageName,\n      resolvedVersion,\n      this.meta.registry,\n      this.meta.fetch,\n    );\n\n    if (!isValidUrl(tarballURL) || !tarballURL.toString().endsWith('.tgz')) {\n      throw new Error(\n        `Failed to find valid tarball URL in NPM metadata for package \"${this.meta.packageName}\".`,\n      );\n    }\n\n    // Override the tarball hostname/protocol with registryUrl hostname/protocol\n    const newTarballUrl = new URL(tarballURL);\n    newTarballUrl.hostname = this.meta.registry.hostname;\n    newTarballUrl.protocol = this.meta.registry.protocol;\n\n    const files = await this.fetchNpmTarball(newTarballUrl);\n\n    this.#files = files;\n    this.meta.version = targetVersion;\n  }\n\n  /**\n   * Fetches and unpacks the tarball (`.tgz` file) from the specified URL.\n   *\n   * @param tarballUrl - The tarball URL to fetch and unpack.\n   * @returns A the files for the package tarball.\n   * @throws If fetching the tarball fails.\n   */\n  abstract fetchNpmTarball(tarballUrl: URL): Promise<Map<string, VirtualFile>>;\n}\n\n// Safety limit for tarballs, 250 MB in bytes\nexport const TARBALL_SIZE_SAFETY_LIMIT = 262144000;\n\n// Main NPM implementation, contains a browser tarball fetching implementation.\nexport class NpmLocation extends BaseNpmLocation {\n  /**\n   * Fetches and unpacks the tarball (`.tgz` file) from the specified URL.\n   *\n   * @param tarballUrl - The tarball URL to fetch and unpack.\n   * @returns A the files for the package tarball.\n   * @throws If fetching the tarball fails.\n   */\n  async fetchNpmTarball(\n    tarballUrl: URL,\n  ): Promise<Map<string, VirtualFile<unknown>>> {\n    // Perform a raw fetch because we want the Response object itself.\n    const tarballResponse = await this.meta.fetch(tarballUrl.toString());\n    if (!tarballResponse.ok || !tarballResponse.body) {\n      throw new Error(\n        `Failed to fetch tarball for package \"${this.meta.packageName}\".`,\n      );\n    }\n\n    // We assume that NPM is a good actor and provides us with a valid `content-length` header.\n    const tarballSizeString = tarballResponse.headers.get('content-length');\n    assert(tarballSizeString, 'Snap tarball has invalid content-length');\n    const tarballSize = parseInt(tarballSizeString, 10);\n    assert(\n      tarballSize <= TARBALL_SIZE_SAFETY_LIMIT,\n      'Snap tarball exceeds size limit',\n    );\n    return new Promise((resolve, reject) => {\n      const files = new Map();\n\n      const tarballStream = createTarballStream(\n        getNpmCanonicalBasePath(this.meta.registry, this.meta.packageName),\n        files,\n      );\n\n      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n      const body = tarballResponse.body!;\n\n      // The \"gz\" in \"tgz\" stands for \"gzip\". The tarball needs to be decompressed\n      // before we can actually grab any files from it.\n      // To prevent recursion-based zip bombs, we should not allow recursion here.\n\n      // If native decompression stream is available we use that, otherwise fallback to zlib.\n      if ('pipeThrough' in body && 'DecompressionStream' in globalThis) {\n        const decompressionStream = new DecompressionStream('gzip');\n        const decompressedStream = body.pipeThrough(decompressionStream);\n\n        pipeline(\n          getNodeStream(decompressedStream),\n          tarballStream,\n          (error: unknown) => {\n            error ? reject(error) : resolve(files);\n          },\n        );\n        return;\n      }\n\n      pipeline(\n        getNodeStream(body),\n        createGunzip(),\n        tarballStream,\n        (error: unknown) => {\n          error ? reject(error) : resolve(files);\n        },\n      );\n    });\n  }\n}\n\n// Incomplete type\nexport type PartialNpmMetadata = {\n  versions: Record<string, { dist: { tarball: string } }>;\n};\n\n/**\n * Fetches the NPM metadata of the specified package from\n * the public npm registry.\n *\n * @param packageName - The name of the package whose metadata to fetch.\n * @param registryUrl - The URL of the npm registry to fetch the metadata from.\n * @param fetchFunction - The fetch function to use. Defaults to the global\n * {@link fetch}. Useful for Node.js compatibility.\n * @returns The NPM metadata object.\n * @throws If fetching the metadata fails.\n */\nexport async function fetchNpmMetadata(\n  packageName: string,\n  registryUrl: URL,\n  fetchFunction: typeof fetch,\n): Promise<PartialNpmMetadata> {\n  const packageResponse = await fetchFunction(\n    new URL(packageName, registryUrl).toString(),\n    {\n      headers: {\n        // Corgi format is slightly smaller: https://github.com/npm/pacote/blob/main/lib/registry.js#L71\n        accept: isNPM(registryUrl)\n          ? 'application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*'\n          : 'application/json',\n      },\n    },\n  );\n  if (!packageResponse.ok) {\n    throw new Error(\n      `Failed to fetch NPM registry entry. Status code: ${packageResponse.status}.`,\n    );\n  }\n  const packageMetadata = await packageResponse.json();\n\n  if (!isObject(packageMetadata)) {\n    throw new Error(\n      `Failed to fetch package \"${packageName}\" metadata from npm.`,\n    );\n  }\n\n  return packageMetadata as PartialNpmMetadata;\n}\n\n/**\n * Gets the canonical base path for an NPM snap.\n *\n * @param registryUrl - A registry URL.\n * @param packageName - A package name.\n * @returns The canonical base path.\n */\nexport function getNpmCanonicalBasePath(registryUrl: URL, packageName: string) {\n  let canonicalBase = 'npm://';\n  if (registryUrl.username !== '') {\n    canonicalBase += registryUrl.username;\n    if (registryUrl.password !== '') {\n      canonicalBase += `:${registryUrl.password}`;\n    }\n    canonicalBase += '@';\n  }\n  return `${canonicalBase}${registryUrl.host}/${packageName}/`;\n}\n\n/**\n * Determine if a registry URL is NPM.\n *\n * @param registryUrl - A registry url.\n * @returns True if the registry is the NPM registry, otherwise false.\n */\nfunction isNPM(registryUrl: URL) {\n  return registryUrl.toString() === DEFAULT_NPM_REGISTRY.toString();\n}\n\n/**\n * Resolves a version range to a version using the NPM registry.\n *\n * Unless the version range is already a version, then the NPM registry is skipped.\n *\n * @param packageName - The name of the package whose metadata to fetch.\n * @param versionRange - The version range of the package.\n * @param registryUrl - The URL of the npm registry to fetch the metadata from.\n * @param fetchFunction - The fetch function to use. Defaults to the global\n * {@link fetch}. Useful for Node.js compatibility.\n * @returns An object containing the resolved version and a URL for its tarball.\n * @throws If fetching the metadata fails.\n */\nasync function resolveNpmVersion(\n  packageName: string,\n  versionRange: SemVerRange,\n  registryUrl: URL,\n  fetchFunction: typeof fetch,\n): Promise<{ tarballURL: string; targetVersion: SemVerVersion }> {\n  // If the version range is already a static version we don't need to look for the metadata.\n  if (isNPM(registryUrl) && isValidSemVerVersion(versionRange)) {\n    return {\n      tarballURL: getNpmTarballUrl(packageName, versionRange),\n      targetVersion: versionRange,\n    };\n  }\n\n  const packageMetadata = await fetchNpmMetadata(\n    packageName,\n    registryUrl,\n    fetchFunction,\n  );\n\n  const versions = Object.keys(packageMetadata?.versions ?? {}).map(\n    (version) => {\n      assertIsSemVerVersion(version);\n      return version;\n    },\n  );\n\n  const targetVersion = getTargetVersion(versions, versionRange);\n\n  if (targetVersion === null) {\n    throw new Error(\n      `Failed to find a matching version in npm metadata for package \"${packageName}\" and requested semver range \"${versionRange}\".`,\n    );\n  }\n\n  const tarballURL = packageMetadata?.versions?.[targetVersion]?.dist?.tarball;\n\n  return { tarballURL, targetVersion };\n}\n\n/**\n * The paths of files within npm tarballs appear to always be prefixed with\n * \"package/\".\n */\nconst NPM_TARBALL_PATH_PREFIX = /^package\\//u;\n\n/**\n * Converts a {@link ReadableStream} to a Node.js {@link Readable}\n * stream. Returns the stream directly if it is already a Node.js stream.\n * We can't use the native Web {@link ReadableStream} directly because the\n * other stream libraries we use expect Node.js streams.\n *\n * @param stream - The stream to convert.\n * @returns The given stream as a Node.js Readable stream.\n */\nfunction getNodeStream(stream: ReadableStream): Readable {\n  if (typeof stream.getReader !== 'function') {\n    return stream as unknown as Readable;\n  }\n\n  return new ReadableWebToNodeStream(stream);\n}\n\n/**\n * Creates a `tar-stream` that will get the necessary files from an npm Snap\n * package tarball (`.tgz` file).\n *\n * @param canonicalBase - A base URI as specified in {@link https://github.com/MetaMask/SIPs/blob/main/SIPS/sip-8.md SIP-8}. Starting with 'npm:'. Will be used for canonicalPath vfile argument.\n * @param files - An object to write target file contents to.\n * @returns The {@link Writable} tarball extraction stream.\n */\nfunction createTarballStream(\n  canonicalBase: string,\n  files: Map<string, VirtualFile>,\n): Writable {\n  assert(\n    canonicalBase.endsWith('/'),\n    \"Base needs to end with '/' for relative paths to be added as children instead of siblings.\",\n  );\n\n  assert(\n    canonicalBase.startsWith('npm:'),\n    'Protocol mismatch, expected \"npm:\".',\n  );\n  // `tar-stream` is pretty old-school, so we create it first and then\n  // instrument it by adding event listeners.\n  const extractStream = tarExtract();\n\n  let totalSize = 0;\n\n  // \"entry\" is fired for every discreet entity in the tarball. This includes\n  // files and folders.\n  extractStream.on('entry', (header, entryStream, next) => {\n    const { name: headerName, type: headerType } = header;\n    if (headerType === 'file') {\n      // The name is a path if the header type is \"file\".\n      const path = headerName.replace(NPM_TARBALL_PATH_PREFIX, '');\n      return entryStream.pipe(\n        concat({ encoding: 'uint8array' }, (data) => {\n          try {\n            totalSize += data.byteLength;\n            // To prevent zip bombs, we set a safety limit for the total size of tarballs.\n            assert(\n              totalSize < TARBALL_SIZE_SAFETY_LIMIT,\n              `Snap tarball exceeds limit of ${TARBALL_SIZE_SAFETY_LIMIT} bytes.`,\n            );\n            const vfile = new VirtualFile({\n              value: data,\n              path,\n              data: {\n                canonicalPath: new URL(path, canonicalBase).toString(),\n              },\n            });\n            // We disallow files having identical paths as it may confuse our checksum calculations.\n            assert(\n              !files.has(path),\n              'Malformed tarball, multiple files with the same path.',\n            );\n            files.set(path, vfile);\n            return next();\n          } catch (error) {\n            return extractStream.destroy(error);\n          }\n        }),\n      );\n    }\n\n    // If we get here, the entry is not a file, and we want to ignore. The entry\n    // stream must be drained, or the extractStream will stop reading. This is\n    // effectively a no-op for the current entry.\n    entryStream.on('end', () => next());\n    return entryStream.resume();\n  });\n  return extractStream;\n}\n"],"names":["createSnapManifest","DEFAULT_REQUESTED_SNAP_VERSION","getTargetVersion","isValidUrl","NpmSnapIdStruct","VirtualFile","normalizeRelative","parseJson","assert","assertIsSemVerVersion","assertStruct","isObject","isValidSemVerVersion","createGunzip","concat","getNpmTarballUrl","pipeline","ReadableWebToNodeStream","extract","tarExtract","DEFAULT_NPM_REGISTRY","URL","BaseNpmLocation","manifest","validatedManifest","clone","vfile","fetch","result","toString","path","relativePath","files","lazyInit","undefined","get","TypeError","packageName","meta","version","registry","versionRange","requestedRange","constructor","url","opts","allowCustomRegistries","fetchFunction","globalThis","bind","defaultResolve","range","resolveVersion","host","port","username","password","pathname","search","hash","startsWith","slice","resolvedVersion","tarballURL","targetVersion","resolveNpmVersion","endsWith","Error","newTarballUrl","hostname","protocol","fetchNpmTarball","TARBALL_SIZE_SAFETY_LIMIT","NpmLocation","tarballUrl","tarballResponse","ok","body","tarballSizeString","headers","tarballSize","parseInt","Promise","resolve","reject","Map","tarballStream","createTarballStream","getNpmCanonicalBasePath","decompressionStream","DecompressionStream","decompressedStream","pipeThrough","getNodeStream","error","fetchNpmMetadata","registryUrl","packageResponse","accept","isNPM","status","packageMetadata","json","canonicalBase","versions","Object","keys","map","dist","tarball","NPM_TARBALL_PATH_PREFIX","stream","getReader","extractStream","totalSize","on","header","entryStream","next","name","headerName","type","headerType","replace","pipe","encoding","data","byteLength","value","canonicalPath","has","set","destroy","resume"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,SACEA,kBAAkB,EAClBC,8BAA8B,EAC9BC,gBAAgB,EAChBC,UAAU,EACVC,eAAe,EACfC,WAAW,EACXC,iBAAiB,EACjBC,SAAS,QACJ,wBAAwB;AAE/B,SACEC,MAAM,EACNC,qBAAqB,EACrBC,YAAY,EACZC,QAAQ,EACRC,oBAAoB,QACf,kBAAkB;AACzB,SAASC,YAAY,QAAQ,kBAAkB;AAC/C,OAAOC,YAAY,gBAAgB;AACnC,OAAOC,sBAAsB,sBAAsB;AACnD,SAASC,QAAQ,QAAQ,kBAAkB;AAE3C,SAASC,uBAAuB,QAAQ,8BAA8B;AACtE,SAASC,WAAWC,UAAU,QAAQ,aAAa;AAInD,OAAO,MAAMC,uBAAuB,IAAIC,IAAI,8BAA8B;IA2BxE,kDAEA,sCA6GM;AAnHR,yFAAyF;AACzF,OAAO,MAAeC;IAmEpB,MAAMC,WAA+C;QACnD,6BAAI,IAAI,EAAEC,qBAAmB;YAC3B,OAAO,yBAAA,IAAI,EAAEA,oBAAkBC,KAAK;QACtC;QAEA,MAAMC,QAAQ,MAAM,IAAI,CAACC,KAAK,CAAC;QAC/B,MAAMC,SAASrB,UAAUmB,MAAMG,QAAQ;QACvCH,MAAME,MAAM,GAAG5B,mBAAmB4B;uCAC5BJ,oBAAoBE;QAE1B,OAAO,IAAI,CAACH,QAAQ;IACtB;IAEA,MAAMI,MAAMG,IAAY,EAAwB;QAC9C,MAAMC,eAAezB,kBAAkBwB;QACvC,IAAI,0BAAC,IAAI,EAAEE,SAAO;YAChB,MAAM,0BAAA,IAAI,EAAEC,WAAAA,eAAN,IAAI;YACVzB,OAAO,yBAAA,IAAI,EAAEwB,YAAUE;QACzB;QACA,MAAMR,QAAQ,yBAAA,IAAI,EAAEM,QAAMG,GAAG,CAACJ;QAC9BvB,OACEkB,UAAUQ,WACV,IAAIE,UAAU,CAAC,MAAM,EAAEN,KAAK,uBAAuB,CAAC;QAEtD,OAAOJ,MAAMD,KAAK;IACpB;IAEA,IAAIY,cAAsB;QACxB,OAAO,IAAI,CAACC,IAAI,CAACD,WAAW;IAC9B;IAEA,IAAIE,UAAkB;QACpB/B,OACE,IAAI,CAAC8B,IAAI,CAACC,OAAO,KAAKL,WACtB;QAEF,OAAO,IAAI,CAACI,IAAI,CAACC,OAAO;IAC1B;IAEA,IAAIC,WAAgB;QAClB,OAAO,IAAI,CAACF,IAAI,CAACE,QAAQ;IAC3B;IAEA,IAAIC,eAA4B;QAC9B,OAAO,IAAI,CAACH,IAAI,CAACI,cAAc;IACjC;IAzGAC,YAAYC,GAAQ,EAAEC,OAAkC,CAAC,CAAC,CAAE;QA2G5D,iCAAM;QAjHN,uBAAmBP,QAAnB,KAAA;QAEA,gCAAA;;mBAAA,KAAA;;QAEA,gCAAA;;mBAAA,KAAA;;QAGE,MAAMQ,wBAAwBD,KAAKC,qBAAqB,IAAI;QAC5D,MAAMC,gBAAgBF,KAAKlB,KAAK,IAAIqB,WAAWrB,KAAK,CAACsB,IAAI,CAACD;QAC1D,MAAMN,iBAAiBG,KAAKJ,YAAY,IAAIxC;QAC5C,MAAMiD,iBAAiB,OAAOC,QAAuBA;QACrD,MAAMC,iBAAiBP,KAAKO,cAAc,IAAIF;QAE9CxC,aAAakC,IAAIf,QAAQ,IAAIzB,iBAAiB;QAE9C,IAAIoC;QACJ,IACEI,IAAIS,IAAI,KAAK,MACbT,IAAIU,IAAI,KAAK,MACbV,IAAIW,QAAQ,KAAK,MACjBX,IAAIY,QAAQ,KAAK,IACjB;YACAhB,WAAWpB;QACb,OAAO;YACLoB,WAAW;YACX,IAAII,IAAIW,QAAQ,EAAE;gBAChBf,YAAYI,IAAIW,QAAQ;gBACxB,IAAIX,IAAIY,QAAQ,EAAE;oBAChBhB,YAAY,CAAC,CAAC,EAAEI,IAAIY,QAAQ,CAAC,CAAC;gBAChC;gBACAhB,YAAY;YACd;YACAA,YAAYI,IAAIS,IAAI;YACpBb,WAAW,IAAInB,IAAImB;YACnBhC,OACEsC,uBACA,IAAIV,UACF,CAAC,kDAAkD,EAAEI,SAASX,QAAQ,GAAG,EAAE,CAAC;QAGlF;QAEArB,OACEgC,SAASiB,QAAQ,KAAK,OACpBjB,SAASkB,MAAM,KAAK,MACpBlB,SAASmB,IAAI,KAAK;QAGtBnD,OACEoC,IAAIa,QAAQ,KAAK,MAAMb,IAAIa,QAAQ,KAAK,KACxC,IAAIrB,UAAU;QAEhB,IAAIC,cAAcO,IAAIa,QAAQ;QAC9B,IAAIpB,YAAYuB,UAAU,CAAC,MAAM;YAC/BvB,cAAcA,YAAYwB,KAAK,CAAC;QAClC;QAEA,IAAI,CAACvB,IAAI,GAAG;YACVI;YACAF;YACAH;YACAV,OAAOoB;YACPK;QACF;IACF;AAuFF;AAtCE,eAAA;IACE5C,OAAO,yBAAA,IAAI,EAAEwB,YAAUE;IACvB,MAAM4B,kBAAkB,MAAM,IAAI,CAACxB,IAAI,CAACc,cAAc,CACpD,IAAI,CAACd,IAAI,CAACI,cAAc;IAG1B,MAAM,EAAEqB,UAAU,EAAEC,aAAa,EAAE,GAAG,MAAMC,kBAC1C,IAAI,CAAC3B,IAAI,CAACD,WAAW,EACrByB,iBACA,IAAI,CAACxB,IAAI,CAACE,QAAQ,EAClB,IAAI,CAACF,IAAI,CAACX,KAAK;IAGjB,IAAI,CAACxB,WAAW4D,eAAe,CAACA,WAAWlC,QAAQ,GAAGqC,QAAQ,CAAC,SAAS;QACtE,MAAM,IAAIC,MACR,CAAC,8DAA8D,EAAE,IAAI,CAAC7B,IAAI,CAACD,WAAW,CAAC,EAAE,CAAC;IAE9F;IAEA,4EAA4E;IAC5E,MAAM+B,gBAAgB,IAAI/C,IAAI0C;IAC9BK,cAAcC,QAAQ,GAAG,IAAI,CAAC/B,IAAI,CAACE,QAAQ,CAAC6B,QAAQ;IACpDD,cAAcE,QAAQ,GAAG,IAAI,CAAChC,IAAI,CAACE,QAAQ,CAAC8B,QAAQ;IAEpD,MAAMtC,QAAQ,MAAM,IAAI,CAACuC,eAAe,CAACH;mCAEnCpC,QAAQA;IACd,IAAI,CAACM,IAAI,CAACC,OAAO,GAAGyB;AACtB;AAYF,6CAA6C;AAC7C,OAAO,MAAMQ,4BAA4B,UAAU;AAEnD,+EAA+E;AAC/E,OAAO,MAAMC,oBAAoBnD;IAC/B;;;;;;GAMC,GACD,MAAMiD,gBACJG,UAAe,EAC6B;QAC5C,kEAAkE;QAClE,MAAMC,kBAAkB,MAAM,IAAI,CAACrC,IAAI,CAACX,KAAK,CAAC+C,WAAW7C,QAAQ;QACjE,IAAI,CAAC8C,gBAAgBC,EAAE,IAAI,CAACD,gBAAgBE,IAAI,EAAE;YAChD,MAAM,IAAIV,MACR,CAAC,qCAAqC,EAAE,IAAI,CAAC7B,IAAI,CAACD,WAAW,CAAC,EAAE,CAAC;QAErE;QAEA,2FAA2F;QAC3F,MAAMyC,oBAAoBH,gBAAgBI,OAAO,CAAC5C,GAAG,CAAC;QACtD3B,OAAOsE,mBAAmB;QAC1B,MAAME,cAAcC,SAASH,mBAAmB;QAChDtE,OACEwE,eAAeR,2BACf;QAEF,OAAO,IAAIU,QAAQ,CAACC,SAASC;YAC3B,MAAMpD,QAAQ,IAAIqD;YAElB,MAAMC,gBAAgBC,oBACpBC,wBAAwB,IAAI,CAAClD,IAAI,CAACE,QAAQ,EAAE,IAAI,CAACF,IAAI,CAACD,WAAW,GACjEL;YAGF,oEAAoE;YACpE,MAAM6C,OAAOF,gBAAgBE,IAAI;YAEjC,4EAA4E;YAC5E,iDAAiD;YACjD,4EAA4E;YAE5E,uFAAuF;YACvF,IAAI,iBAAiBA,QAAQ,yBAAyB7B,YAAY;gBAChE,MAAMyC,sBAAsB,IAAIC,oBAAoB;gBACpD,MAAMC,qBAAqBd,KAAKe,WAAW,CAACH;gBAE5CzE,SACE6E,cAAcF,qBACdL,eACA,CAACQ;oBACCA,QAAQV,OAAOU,SAASX,QAAQnD;gBAClC;gBAEF;YACF;YAEAhB,SACE6E,cAAchB,OACdhE,gBACAyE,eACA,CAACQ;gBACCA,QAAQV,OAAOU,SAASX,QAAQnD;YAClC;QAEJ;IACF;AACF;AAOA;;;;;;;;;;CAUC,GACD,OAAO,eAAe+D,iBACpB1D,WAAmB,EACnB2D,WAAgB,EAChBjD,aAA2B;IAE3B,MAAMkD,kBAAkB,MAAMlD,cAC5B,IAAI1B,IAAIgB,aAAa2D,aAAanE,QAAQ,IAC1C;QACEkD,SAAS;YACP,gGAAgG;YAChGmB,QAAQC,MAAMH,eACV,6EACA;QACN;IACF;IAEF,IAAI,CAACC,gBAAgBrB,EAAE,EAAE;QACvB,MAAM,IAAIT,MACR,CAAC,iDAAiD,EAAE8B,gBAAgBG,MAAM,CAAC,CAAC,CAAC;IAEjF;IACA,MAAMC,kBAAkB,MAAMJ,gBAAgBK,IAAI;IAElD,IAAI,CAAC3F,SAAS0F,kBAAkB;QAC9B,MAAM,IAAIlC,MACR,CAAC,yBAAyB,EAAE9B,YAAY,oBAAoB,CAAC;IAEjE;IAEA,OAAOgE;AACT;AAEA;;;;;;CAMC,GACD,OAAO,SAASb,wBAAwBQ,WAAgB,EAAE3D,WAAmB;IAC3E,IAAIkE,gBAAgB;IACpB,IAAIP,YAAYzC,QAAQ,KAAK,IAAI;QAC/BgD,iBAAiBP,YAAYzC,QAAQ;QACrC,IAAIyC,YAAYxC,QAAQ,KAAK,IAAI;YAC/B+C,iBAAiB,CAAC,CAAC,EAAEP,YAAYxC,QAAQ,CAAC,CAAC;QAC7C;QACA+C,iBAAiB;IACnB;IACA,OAAO,CAAC,EAAEA,cAAc,EAAEP,YAAY3C,IAAI,CAAC,CAAC,EAAEhB,YAAY,CAAC,CAAC;AAC9D;AAEA;;;;;CAKC,GACD,SAAS8D,MAAMH,WAAgB;IAC7B,OAAOA,YAAYnE,QAAQ,OAAOT,qBAAqBS,QAAQ;AACjE;AAEA;;;;;;;;;;;;CAYC,GACD,eAAeoC,kBACb5B,WAAmB,EACnBI,YAAyB,EACzBuD,WAAgB,EAChBjD,aAA2B;IAE3B,2FAA2F;IAC3F,IAAIoD,MAAMH,gBAAgBpF,qBAAqB6B,eAAe;QAC5D,OAAO;YACLsB,YAAYhD,iBAAiBsB,aAAaI;YAC1CuB,eAAevB;QACjB;IACF;IAEA,MAAM4D,kBAAkB,MAAMN,iBAC5B1D,aACA2D,aACAjD;IAGF,MAAMyD,WAAWC,OAAOC,IAAI,CAACL,iBAAiBG,YAAY,CAAC,GAAGG,GAAG,CAC/D,CAACpE;QACC9B,sBAAsB8B;QACtB,OAAOA;IACT;IAGF,MAAMyB,gBAAgB9D,iBAAiBsG,UAAU/D;IAEjD,IAAIuB,kBAAkB,MAAM;QAC1B,MAAM,IAAIG,MACR,CAAC,+DAA+D,EAAE9B,YAAY,8BAA8B,EAAEI,aAAa,EAAE,CAAC;IAElI;IAEA,MAAMsB,aAAasC,iBAAiBG,UAAU,CAACxC,cAAc,EAAE4C,MAAMC;IAErE,OAAO;QAAE9C;QAAYC;IAAc;AACrC;AAEA;;;CAGC,GACD,MAAM8C,0BAA0B;AAEhC;;;;;;;;CAQC,GACD,SAASjB,cAAckB,MAAsB;IAC3C,IAAI,OAAOA,OAAOC,SAAS,KAAK,YAAY;QAC1C,OAAOD;IACT;IAEA,OAAO,IAAI9F,wBAAwB8F;AACrC;AAEA;;;;;;;CAOC,GACD,SAASxB,oBACPgB,aAAqB,EACrBvE,KAA+B;IAE/BxB,OACE+F,cAAcrC,QAAQ,CAAC,MACvB;IAGF1D,OACE+F,cAAc3C,UAAU,CAAC,SACzB;IAEF,oEAAoE;IACpE,2CAA2C;IAC3C,MAAMqD,gBAAgB9F;IAEtB,IAAI+F,YAAY;IAEhB,2EAA2E;IAC3E,qBAAqB;IACrBD,cAAcE,EAAE,CAAC,SAAS,CAACC,QAAQC,aAAaC;QAC9C,MAAM,EAAEC,MAAMC,UAAU,EAAEC,MAAMC,UAAU,EAAE,GAAGN;QAC/C,IAAIM,eAAe,QAAQ;YACzB,mDAAmD;YACnD,MAAM5F,OAAO0F,WAAWG,OAAO,CAACb,yBAAyB;YACzD,OAAOO,YAAYO,IAAI,CACrB9G,OAAO;gBAAE+G,UAAU;YAAa,GAAG,CAACC;gBAClC,IAAI;oBACFZ,aAAaY,KAAKC,UAAU;oBAC5B,8EAA8E;oBAC9EvH,OACE0G,YAAY1C,2BACZ,CAAC,8BAA8B,EAAEA,0BAA0B,OAAO,CAAC;oBAErE,MAAM9C,QAAQ,IAAIrB,YAAY;wBAC5B2H,OAAOF;wBACPhG;wBACAgG,MAAM;4BACJG,eAAe,IAAI5G,IAAIS,MAAMyE,eAAe1E,QAAQ;wBACtD;oBACF;oBACA,wFAAwF;oBACxFrB,OACE,CAACwB,MAAMkG,GAAG,CAACpG,OACX;oBAEFE,MAAMmG,GAAG,CAACrG,MAAMJ;oBAChB,OAAO4F;gBACT,EAAE,OAAOxB,OAAO;oBACd,OAAOmB,cAAcmB,OAAO,CAACtC;gBAC/B;YACF;QAEJ;QAEA,4EAA4E;QAC5E,0EAA0E;QAC1E,6CAA6C;QAC7CuB,YAAYF,EAAE,CAAC,OAAO,IAAMG;QAC5B,OAAOD,YAAYgB,MAAM;IAC3B;IACA,OAAOpB;AACT"}

package/dist/esm/utils.js

@@ -1,3 +1,5 @@
+import { getErrorMessage } from '@metamask/snaps-sdk';
+import { encodeBase64, getValidatedLocalizationFiles, validateFetchedSnap } from '@metamask/snaps-utils';
 import { Timer } from './snaps/Timer';
 /**
  * Takes two objects and does a Set Difference of them.
@@ -91,5 +93,40 @@ import { Timer } from './snaps/Timer';
     }
     return await Promise.all(files.map(async (filePath)=>location.fetch(filePath)));
 }
+/**
+ * Fetch the Snap manifest, source code, and any other files from the given
+ * location.
+ *
+ * @param snapId - The ID of the Snap to fetch.
+ * @param location - The location of the Snap.
+ * @returns The Snap files and location.
+ * @throws If the Snap files are invalid, or if the Snap could not be fetched.
+ */ export async function fetchSnap(snapId, location) {
+    try {
+        const manifest = await location.manifest();
+        const sourceCode = await location.fetch(manifest.result.source.location.npm.filePath);
+        const { iconPath } = manifest.result.source.location.npm;
+        const svgIcon = iconPath ? await location.fetch(iconPath) : undefined;
+        const auxiliaryFiles = await getSnapFiles(location, manifest.result.source.files);
+        await Promise.all(auxiliaryFiles.map(async (file)=>{
+            // This should still be safe
+            // eslint-disable-next-line require-atomic-updates
+            file.data.base64 = await encodeBase64(file);
+        }));
+        const localizationFiles = await getSnapFiles(location, manifest.result.source.locales);
+        const validatedLocalizationFiles = getValidatedLocalizationFiles(localizationFiles);
+        const files = {
+            manifest,
+            sourceCode,
+            svgIcon,
+            auxiliaryFiles,
+            localizationFiles: validatedLocalizationFiles
+        };
+        await validateFetchedSnap(files);
+        return files;
+    } catch (error) {
+        throw new Error(`Failed to fetch snap "${snapId}": ${getErrorMessage(error)}.`);
+    }
+}
 
 //# sourceMappingURL=utils.js.map

package/dist/esm/utils.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils.ts"],"sourcesContent":["import type { SnapLocation } from './snaps';\nimport { Timer } from './snaps/Timer';\n\n/**\n * Takes two objects and does a Set Difference of them.\n * Set Difference is generally defined as follows:\n * ```\n * 𝑥 ∈ A ∖ B ⟺ 𝑥 ∈ A ∧ 𝑥 ∉ B\n * ```\n * Meaning that the returned object contains all properties of A expect those that also\n * appear in B. Notice that properties that appear in B, but not in A, have no effect.\n *\n * @see [Set Difference]{@link https://proofwiki.org/wiki/Definition:Set_Difference}\n * @param objectA - The object on which the difference is being calculated.\n * @param objectB - The object whose properties will be removed from objectA.\n * @returns The objectA without properties from objectB.\n */\nexport function setDiff<\n  ObjectA extends Record<any, unknown>,\n  ObjectB extends Record<any, unknown>,\n>(objectA: ObjectA, objectB: ObjectB): Diff<ObjectA, ObjectB> {\n  return Object.entries(objectA).reduce<Record<any, unknown>>(\n    (acc, [key, value]) => {\n      if (!(key in objectB)) {\n        acc[key] = value;\n      }\n      return acc;\n    },\n    {},\n  ) as Diff<ObjectA, ObjectB>;\n}\n\n/**\n * A Promise that delays its return for a given amount of milliseconds.\n *\n * @param ms - Milliseconds to delay the execution for.\n * @param result - The result to return from the Promise after delay.\n * @returns A promise that is void if no result provided, result otherwise.\n * @template Result - The `result`.\n */\nexport function delay<Result = void>(\n  ms: number,\n  result?: Result,\n): Promise<Result> & { cancel: () => void } {\n  return delayWithTimer(new Timer(ms), result);\n}\n\n/**\n * A Promise that delays it's return by using a pausable Timer.\n *\n * @param timer - Timer used to control the delay.\n * @param result - The result to return from the Promise after delay.\n * @returns A promise that is void if no result provided, result otherwise.\n * @template Result - The `result`.\n */\nexport function delayWithTimer<Result = void>(\n  timer: Timer,\n  result?: Result,\n): Promise<Result> & { cancel: () => void } {\n  let rejectFunc: (reason: Error) => void;\n  const promise: any = new Promise<Result>((resolve: any, reject) => {\n    timer.start(() => {\n      result === undefined ? resolve() : resolve(result);\n    });\n    rejectFunc = reject;\n  });\n\n  promise.cancel = () => {\n    if (timer.status !== 'finished') {\n      timer.cancel();\n      rejectFunc(new Error('The delay has been canceled.'));\n    }\n  };\n  return promise;\n}\n\n/*\n * We use a Symbol instead of rejecting the promise so that Errors thrown\n * by the main promise will propagate.\n */\nexport const hasTimedOut = Symbol(\n  'Used to check if the requested promise has timeout (see withTimeout)',\n);\n\n/**\n * Executes the given Promise, if the Timer expires before the Promise settles, we return earlier.\n *\n * NOTE:** The given Promise is not cancelled or interrupted, and will continue to execute uninterrupted. We will just discard its result if it does not complete before the timeout.\n *\n * @param promise - The promise that you want to execute.\n * @param timerOrMs - The timer controlling the timeout or a ms value.\n * @returns The resolved `PromiseValue`, or the hasTimedOut symbol if\n * returning early.\n * @template PromiseValue - The value of the Promise.\n */\nexport async function withTimeout<PromiseValue = void>(\n  promise: Promise<PromiseValue>,\n  timerOrMs: Timer | number,\n): Promise<PromiseValue | typeof hasTimedOut> {\n  const timer =\n    typeof timerOrMs === 'number' ? new Timer(timerOrMs) : timerOrMs;\n  const delayPromise = delayWithTimer(timer, hasTimedOut);\n  try {\n    return await Promise.race([promise, delayPromise]);\n  } finally {\n    delayPromise.cancel();\n  }\n}\n\n/**\n * Checks whether the type is composed of literal types\n *\n * @returns @type {true} if whole type is composed of literals, @type {false} if whole type is not literals, @type {boolean} if mixed\n * @example\n * ```\n * type t1 = IsLiteral<1 | 2 | \"asd\" | true>;\n * // t1 = true\n *\n * type t2 = IsLiteral<number | string>;\n * // t2 = false\n *\n * type t3 = IsLiteral<1 | string>;\n * // t3 = boolean\n *\n * const s = Symbol();\n * type t4 = IsLiteral<typeof s>;\n * // t4 = true\n *\n * type t5 = IsLiteral<symbol>\n * // t5 = false;\n * ```\n */\ntype IsLiteral<Type> = Type extends string | number | boolean | symbol\n  ? Extract<string | number | boolean | symbol, Type> extends never\n    ? true\n    : false\n  : false;\n\n/**\n * Returns all keys of an object, that are literal, as an union\n *\n * @example\n * ```\n * type t1 = _LiteralKeys<{a: number, b: 0, c: 'foo', d: string}>\n * // t1 = 'b' | 'c'\n * ```\n * @see [Literal types]{@link https://www.typescriptlang.org/docs/handbook/literal-types.html}\n */\ntype LiteralKeys<Type> = NonNullable<\n  {\n    [Key in keyof Type]: IsLiteral<Key> extends true ? Key : never;\n  }[keyof Type]\n>;\n\n/**\n * Returns all keys of an object, that are not literal, as an union\n *\n * @example\n * ```\n * type t1 = _NonLiteralKeys<{a: number, b: 0, c: 'foo', d: string}>\n * // t1 = 'a' | 'd'\n * ```\n * @see [Literal types]{@link https://www.typescriptlang.org/docs/handbook/literal-types.html}\n */\ntype NonLiteralKeys<Type> = NonNullable<\n  {\n    [Key in keyof Type]: IsLiteral<Key> extends false ? Key : never;\n  }[keyof Type]\n>;\n\n/**\n * A set difference of two objects based on their keys\n *\n * @example\n * ```\n * type t1 = Diff<{a: string, b: string}, {a: number}>\n * // t1 = {b: string};\n * type t2 = Diff<{a: string, 0: string}, Record<string, unknown>>;\n * // t2 = { a?: string, 0: string};\n * type t3 = Diff<{a: string, 0: string, 1: string}, Record<1 | string, unknown>>;\n * // t3 = {a?: string, 0: string}\n * ```\n * @see {@link setDiff} for the main use-case\n */\nexport type Diff<First, Second> = Omit<First, LiteralKeys<Second>> &\n  Partial<Pick<First, Extract<keyof First, NonLiteralKeys<Second>>>>;\n\n/**\n * Makes every specified property of the specified object type mutable.\n *\n * @template Type - The object whose readonly properties to make mutable.\n * @template TargetKey - The property key(s) to make mutable.\n */\nexport type Mutable<\n  Type extends Record<string, unknown>,\n  TargetKey extends string,\n> = {\n  -readonly [Key in keyof Pick<Type, TargetKey>]: Type[Key];\n} & {\n  [Key in keyof Omit<Type, TargetKey>]: Type[Key];\n};\n\n/**\n * Get all files in a Snap from an array of file paths.\n *\n * @param location - The location of the Snap.\n * @param files - The array of file paths.\n * @returns The array of files as {@link VirtualFile}s.\n */\nexport async function getSnapFiles(\n  location: SnapLocation,\n  files?: string[] | undefined,\n) {\n  if (!files || files.length === 0) {\n    return [];\n  }\n\n  return await Promise.all(\n    files.map(async (filePath) => location.fetch(filePath)),\n  );\n}\n"],"names":["Timer","setDiff","objectA","objectB","Object","entries","reduce","acc","key","value","delay","ms","result","delayWithTimer","timer","rejectFunc","promise","Promise","resolve","reject","start","undefined","cancel","status","Error","hasTimedOut","Symbol","withTimeout","timerOrMs","delayPromise","race","getSnapFiles","location","files","length","all","map","filePath","fetch"],"mappings":"AACA,SAASA,KAAK,QAAQ,gBAAgB;AAEtC;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASC,QAGdC,OAAgB,EAAEC,OAAgB;IAClC,OAAOC,OAAOC,OAAO,CAACH,SAASI,MAAM,CACnC,CAACC,KAAK,CAACC,KAAKC,MAAM;QAChB,IAAI,CAAED,CAAAA,OAAOL,OAAM,GAAI;YACrBI,GAAG,CAACC,IAAI,GAAGC;QACb;QACA,OAAOF;IACT,GACA,CAAC;AAEL;AAEA;;;;;;;CAOC,GACD,OAAO,SAASG,MACdC,EAAU,EACVC,MAAe;IAEf,OAAOC,eAAe,IAAIb,MAAMW,KAAKC;AACvC;AAEA;;;;;;;CAOC,GACD,OAAO,SAASC,eACdC,KAAY,EACZF,MAAe;IAEf,IAAIG;IACJ,MAAMC,UAAe,IAAIC,QAAgB,CAACC,SAAcC;QACtDL,MAAMM,KAAK,CAAC;YACVR,WAAWS,YAAYH,YAAYA,QAAQN;QAC7C;QACAG,aAAaI;IACf;IAEAH,QAAQM,MAAM,GAAG;QACf,IAAIR,MAAMS,MAAM,KAAK,YAAY;YAC/BT,MAAMQ,MAAM;YACZP,WAAW,IAAIS,MAAM;QACvB;IACF;IACA,OAAOR;AACT;AAEA;;;CAGC,GACD,OAAO,MAAMS,cAAcC,OACzB,wEACA;AAEF;;;;;;;;;;CAUC,GACD,OAAO,eAAeC,YACpBX,OAA8B,EAC9BY,SAAyB;IAEzB,MAAMd,QACJ,OAAOc,cAAc,WAAW,IAAI5B,MAAM4B,aAAaA;IACzD,MAAMC,eAAehB,eAAeC,OAAOW;IAC3C,IAAI;QACF,OAAO,MAAMR,QAAQa,IAAI,CAAC;YAACd;YAASa;SAAa;IACnD,SAAU;QACRA,aAAaP,MAAM;IACrB;AACF;AA+FA;;;;;;CAMC,GACD,OAAO,eAAeS,aACpBC,QAAsB,EACtBC,KAA4B;IAE5B,IAAI,CAACA,SAASA,MAAMC,MAAM,KAAK,GAAG;QAChC,OAAO,EAAE;IACX;IAEA,OAAO,MAAMjB,QAAQkB,GAAG,CACtBF,MAAMG,GAAG,CAAC,OAAOC,WAAaL,SAASM,KAAK,CAACD;AAEjD"}
+{"version":3,"sources":["../../src/utils.ts"],"sourcesContent":["import type { SnapId } from '@metamask/snaps-sdk';\nimport { getErrorMessage } from '@metamask/snaps-sdk';\nimport {\n  encodeBase64,\n  getValidatedLocalizationFiles,\n  validateFetchedSnap,\n} from '@metamask/snaps-utils';\n\nimport type { SnapLocation } from './snaps';\nimport { Timer } from './snaps/Timer';\n\n/**\n * Takes two objects and does a Set Difference of them.\n * Set Difference is generally defined as follows:\n * ```\n * 𝑥 ∈ A ∖ B ⟺ 𝑥 ∈ A ∧ 𝑥 ∉ B\n * ```\n * Meaning that the returned object contains all properties of A expect those that also\n * appear in B. Notice that properties that appear in B, but not in A, have no effect.\n *\n * @see [Set Difference]{@link https://proofwiki.org/wiki/Definition:Set_Difference}\n * @param objectA - The object on which the difference is being calculated.\n * @param objectB - The object whose properties will be removed from objectA.\n * @returns The objectA without properties from objectB.\n */\nexport function setDiff<\n  ObjectA extends Record<any, unknown>,\n  ObjectB extends Record<any, unknown>,\n>(objectA: ObjectA, objectB: ObjectB): Diff<ObjectA, ObjectB> {\n  return Object.entries(objectA).reduce<Record<any, unknown>>(\n    (acc, [key, value]) => {\n      if (!(key in objectB)) {\n        acc[key] = value;\n      }\n      return acc;\n    },\n    {},\n  ) as Diff<ObjectA, ObjectB>;\n}\n\n/**\n * A Promise that delays its return for a given amount of milliseconds.\n *\n * @param ms - Milliseconds to delay the execution for.\n * @param result - The result to return from the Promise after delay.\n * @returns A promise that is void if no result provided, result otherwise.\n * @template Result - The `result`.\n */\nexport function delay<Result = void>(\n  ms: number,\n  result?: Result,\n): Promise<Result> & { cancel: () => void } {\n  return delayWithTimer(new Timer(ms), result);\n}\n\n/**\n * A Promise that delays it's return by using a pausable Timer.\n *\n * @param timer - Timer used to control the delay.\n * @param result - The result to return from the Promise after delay.\n * @returns A promise that is void if no result provided, result otherwise.\n * @template Result - The `result`.\n */\nexport function delayWithTimer<Result = void>(\n  timer: Timer,\n  result?: Result,\n): Promise<Result> & { cancel: () => void } {\n  let rejectFunc: (reason: Error) => void;\n  const promise: any = new Promise<Result>((resolve: any, reject) => {\n    timer.start(() => {\n      result === undefined ? resolve() : resolve(result);\n    });\n    rejectFunc = reject;\n  });\n\n  promise.cancel = () => {\n    if (timer.status !== 'finished') {\n      timer.cancel();\n      rejectFunc(new Error('The delay has been canceled.'));\n    }\n  };\n  return promise;\n}\n\n/*\n * We use a Symbol instead of rejecting the promise so that Errors thrown\n * by the main promise will propagate.\n */\nexport const hasTimedOut = Symbol(\n  'Used to check if the requested promise has timeout (see withTimeout)',\n);\n\n/**\n * Executes the given Promise, if the Timer expires before the Promise settles, we return earlier.\n *\n * NOTE:** The given Promise is not cancelled or interrupted, and will continue to execute uninterrupted. We will just discard its result if it does not complete before the timeout.\n *\n * @param promise - The promise that you want to execute.\n * @param timerOrMs - The timer controlling the timeout or a ms value.\n * @returns The resolved `PromiseValue`, or the hasTimedOut symbol if\n * returning early.\n * @template PromiseValue - The value of the Promise.\n */\nexport async function withTimeout<PromiseValue = void>(\n  promise: Promise<PromiseValue>,\n  timerOrMs: Timer | number,\n): Promise<PromiseValue | typeof hasTimedOut> {\n  const timer =\n    typeof timerOrMs === 'number' ? new Timer(timerOrMs) : timerOrMs;\n  const delayPromise = delayWithTimer(timer, hasTimedOut);\n  try {\n    return await Promise.race([promise, delayPromise]);\n  } finally {\n    delayPromise.cancel();\n  }\n}\n\n/**\n * Checks whether the type is composed of literal types\n *\n * @returns @type {true} if whole type is composed of literals, @type {false} if whole type is not literals, @type {boolean} if mixed\n * @example\n * ```\n * type t1 = IsLiteral<1 | 2 | \"asd\" | true>;\n * // t1 = true\n *\n * type t2 = IsLiteral<number | string>;\n * // t2 = false\n *\n * type t3 = IsLiteral<1 | string>;\n * // t3 = boolean\n *\n * const s = Symbol();\n * type t4 = IsLiteral<typeof s>;\n * // t4 = true\n *\n * type t5 = IsLiteral<symbol>\n * // t5 = false;\n * ```\n */\ntype IsLiteral<Type> = Type extends string | number | boolean | symbol\n  ? Extract<string | number | boolean | symbol, Type> extends never\n    ? true\n    : false\n  : false;\n\n/**\n * Returns all keys of an object, that are literal, as an union\n *\n * @example\n * ```\n * type t1 = _LiteralKeys<{a: number, b: 0, c: 'foo', d: string}>\n * // t1 = 'b' | 'c'\n * ```\n * @see [Literal types]{@link https://www.typescriptlang.org/docs/handbook/literal-types.html}\n */\ntype LiteralKeys<Type> = NonNullable<\n  {\n    [Key in keyof Type]: IsLiteral<Key> extends true ? Key : never;\n  }[keyof Type]\n>;\n\n/**\n * Returns all keys of an object, that are not literal, as an union\n *\n * @example\n * ```\n * type t1 = _NonLiteralKeys<{a: number, b: 0, c: 'foo', d: string}>\n * // t1 = 'a' | 'd'\n * ```\n * @see [Literal types]{@link https://www.typescriptlang.org/docs/handbook/literal-types.html}\n */\ntype NonLiteralKeys<Type> = NonNullable<\n  {\n    [Key in keyof Type]: IsLiteral<Key> extends false ? Key : never;\n  }[keyof Type]\n>;\n\n/**\n * A set difference of two objects based on their keys\n *\n * @example\n * ```\n * type t1 = Diff<{a: string, b: string}, {a: number}>\n * // t1 = {b: string};\n * type t2 = Diff<{a: string, 0: string}, Record<string, unknown>>;\n * // t2 = { a?: string, 0: string};\n * type t3 = Diff<{a: string, 0: string, 1: string}, Record<1 | string, unknown>>;\n * // t3 = {a?: string, 0: string}\n * ```\n * @see {@link setDiff} for the main use-case\n */\nexport type Diff<First, Second> = Omit<First, LiteralKeys<Second>> &\n  Partial<Pick<First, Extract<keyof First, NonLiteralKeys<Second>>>>;\n\n/**\n * Makes every specified property of the specified object type mutable.\n *\n * @template Type - The object whose readonly properties to make mutable.\n * @template TargetKey - The property key(s) to make mutable.\n */\nexport type Mutable<\n  Type extends Record<string, unknown>,\n  TargetKey extends string,\n> = {\n  -readonly [Key in keyof Pick<Type, TargetKey>]: Type[Key];\n} & {\n  [Key in keyof Omit<Type, TargetKey>]: Type[Key];\n};\n\n/**\n * Get all files in a Snap from an array of file paths.\n *\n * @param location - The location of the Snap.\n * @param files - The array of file paths.\n * @returns The array of files as {@link VirtualFile}s.\n */\nexport async function getSnapFiles(\n  location: SnapLocation,\n  files?: string[] | undefined,\n) {\n  if (!files || files.length === 0) {\n    return [];\n  }\n\n  return await Promise.all(\n    files.map(async (filePath) => location.fetch(filePath)),\n  );\n}\n\n/**\n * Fetch the Snap manifest, source code, and any other files from the given\n * location.\n *\n * @param snapId - The ID of the Snap to fetch.\n * @param location - The location of the Snap.\n * @returns The Snap files and location.\n * @throws If the Snap files are invalid, or if the Snap could not be fetched.\n */\nexport async function fetchSnap(snapId: SnapId, location: SnapLocation) {\n  try {\n    const manifest = await location.manifest();\n    const sourceCode = await location.fetch(\n      manifest.result.source.location.npm.filePath,\n    );\n    const { iconPath } = manifest.result.source.location.npm;\n    const svgIcon = iconPath ? await location.fetch(iconPath) : undefined;\n\n    const auxiliaryFiles = await getSnapFiles(\n      location,\n      manifest.result.source.files,\n    );\n\n    await Promise.all(\n      auxiliaryFiles.map(async (file) => {\n        // This should still be safe\n        // eslint-disable-next-line require-atomic-updates\n        file.data.base64 = await encodeBase64(file);\n      }),\n    );\n\n    const localizationFiles = await getSnapFiles(\n      location,\n      manifest.result.source.locales,\n    );\n\n    const validatedLocalizationFiles =\n      getValidatedLocalizationFiles(localizationFiles);\n\n    const files = {\n      manifest,\n      sourceCode,\n      svgIcon,\n      auxiliaryFiles,\n      localizationFiles: validatedLocalizationFiles,\n    };\n\n    await validateFetchedSnap(files);\n\n    return files;\n  } catch (error) {\n    throw new Error(\n      `Failed to fetch snap \"${snapId}\": ${getErrorMessage(error)}.`,\n    );\n  }\n}\n"],"names":["getErrorMessage","encodeBase64","getValidatedLocalizationFiles","validateFetchedSnap","Timer","setDiff","objectA","objectB","Object","entries","reduce","acc","key","value","delay","ms","result","delayWithTimer","timer","rejectFunc","promise","Promise","resolve","reject","start","undefined","cancel","status","Error","hasTimedOut","Symbol","withTimeout","timerOrMs","delayPromise","race","getSnapFiles","location","files","length","all","map","filePath","fetch","fetchSnap","snapId","manifest","sourceCode","source","npm","iconPath","svgIcon","auxiliaryFiles","file","data","base64","localizationFiles","locales","validatedLocalizationFiles","error"],"mappings":"AACA,SAASA,eAAe,QAAQ,sBAAsB;AACtD,SACEC,YAAY,EACZC,6BAA6B,EAC7BC,mBAAmB,QACd,wBAAwB;AAG/B,SAASC,KAAK,QAAQ,gBAAgB;AAEtC;;;;;;;;;;;;;CAaC,GACD,OAAO,SAASC,QAGdC,OAAgB,EAAEC,OAAgB;IAClC,OAAOC,OAAOC,OAAO,CAACH,SAASI,MAAM,CACnC,CAACC,KAAK,CAACC,KAAKC,MAAM;QAChB,IAAI,CAAED,CAAAA,OAAOL,OAAM,GAAI;YACrBI,GAAG,CAACC,IAAI,GAAGC;QACb;QACA,OAAOF;IACT,GACA,CAAC;AAEL;AAEA;;;;;;;CAOC,GACD,OAAO,SAASG,MACdC,EAAU,EACVC,MAAe;IAEf,OAAOC,eAAe,IAAIb,MAAMW,KAAKC;AACvC;AAEA;;;;;;;CAOC,GACD,OAAO,SAASC,eACdC,KAAY,EACZF,MAAe;IAEf,IAAIG;IACJ,MAAMC,UAAe,IAAIC,QAAgB,CAACC,SAAcC;QACtDL,MAAMM,KAAK,CAAC;YACVR,WAAWS,YAAYH,YAAYA,QAAQN;QAC7C;QACAG,aAAaI;IACf;IAEAH,QAAQM,MAAM,GAAG;QACf,IAAIR,MAAMS,MAAM,KAAK,YAAY;YAC/BT,MAAMQ,MAAM;YACZP,WAAW,IAAIS,MAAM;QACvB;IACF;IACA,OAAOR;AACT;AAEA;;;CAGC,GACD,OAAO,MAAMS,cAAcC,OACzB,wEACA;AAEF;;;;;;;;;;CAUC,GACD,OAAO,eAAeC,YACpBX,OAA8B,EAC9BY,SAAyB;IAEzB,MAAMd,QACJ,OAAOc,cAAc,WAAW,IAAI5B,MAAM4B,aAAaA;IACzD,MAAMC,eAAehB,eAAeC,OAAOW;IAC3C,IAAI;QACF,OAAO,MAAMR,QAAQa,IAAI,CAAC;YAACd;YAASa;SAAa;IACnD,SAAU;QACRA,aAAaP,MAAM;IACrB;AACF;AA+FA;;;;;;CAMC,GACD,OAAO,eAAeS,aACpBC,QAAsB,EACtBC,KAA4B;IAE5B,IAAI,CAACA,SAASA,MAAMC,MAAM,KAAK,GAAG;QAChC,OAAO,EAAE;IACX;IAEA,OAAO,MAAMjB,QAAQkB,GAAG,CACtBF,MAAMG,GAAG,CAAC,OAAOC,WAAaL,SAASM,KAAK,CAACD;AAEjD;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeE,UAAUC,MAAc,EAAER,QAAsB;IACpE,IAAI;QACF,MAAMS,WAAW,MAAMT,SAASS,QAAQ;QACxC,MAAMC,aAAa,MAAMV,SAASM,KAAK,CACrCG,SAAS7B,MAAM,CAAC+B,MAAM,CAACX,QAAQ,CAACY,GAAG,CAACP,QAAQ;QAE9C,MAAM,EAAEQ,QAAQ,EAAE,GAAGJ,SAAS7B,MAAM,CAAC+B,MAAM,CAACX,QAAQ,CAACY,GAAG;QACxD,MAAME,UAAUD,WAAW,MAAMb,SAASM,KAAK,CAACO,YAAYxB;QAE5D,MAAM0B,iBAAiB,MAAMhB,aAC3BC,UACAS,SAAS7B,MAAM,CAAC+B,MAAM,CAACV,KAAK;QAG9B,MAAMhB,QAAQkB,GAAG,CACfY,eAAeX,GAAG,CAAC,OAAOY;YACxB,4BAA4B;YAC5B,kDAAkD;YAClDA,KAAKC,IAAI,CAACC,MAAM,GAAG,MAAMrD,aAAamD;QACxC;QAGF,MAAMG,oBAAoB,MAAMpB,aAC9BC,UACAS,SAAS7B,MAAM,CAAC+B,MAAM,CAACS,OAAO;QAGhC,MAAMC,6BACJvD,8BAA8BqD;QAEhC,MAAMlB,QAAQ;YACZQ;YACAC;YACAI;YACAC;YACAI,mBAAmBE;QACrB;QAEA,MAAMtD,oBAAoBkC;QAE1B,OAAOA;IACT,EAAE,OAAOqB,OAAO;QACd,MAAM,IAAI9B,MACR,CAAC,sBAAsB,EAAEgB,OAAO,GAAG,EAAE5C,gBAAgB0D,OAAO,CAAC,CAAC;IAElE;AACF"}

package/dist/types/index.d.ts

@@ -3,3 +3,4 @@ export * from './services';
 export * from './snaps';
 export * from './utils';
 export * from './cronjob';
+export * from './interface';

package/dist/types/interface/SnapInterfaceController.d.ts

@@ -0,0 +1,85 @@
+import type { RestrictedControllerMessenger } from '@metamask/base-controller';
+import { BaseController } from '@metamask/base-controller';
+import type { MaybeUpdateState, TestOrigin } from '@metamask/phishing-controller';
+import type { Component, InterfaceState, SnapId } from '@metamask/snaps-sdk';
+declare const controllerName = "SnapInterfaceController";
+export declare type CreateInterface = {
+    type: `${typeof controllerName}:createInterface`;
+    handler: SnapInterfaceController['createInterface'];
+};
+export declare type GetInterface = {
+    type: `${typeof controllerName}:getInterface`;
+    handler: SnapInterfaceController['getInterface'];
+};
+export declare type UpdateInterface = {
+    type: `${typeof controllerName}:updateInterface`;
+    handler: SnapInterfaceController['updateInterface'];
+};
+export declare type DeleteInterface = {
+    type: `${typeof controllerName}:deleteInterface`;
+    handler: SnapInterfaceController['deleteInterface'];
+};
+export declare type UpdateInterfaceState = {
+    type: `${typeof controllerName}:updateInterfaceState`;
+    handler: SnapInterfaceController['updateInterfaceState'];
+};
+export declare type SnapInterfaceControllerAllowedActions = TestOrigin | MaybeUpdateState;
+export declare type SnapInterfaceControllerActions = CreateInterface | GetInterface | UpdateInterface | DeleteInterface | UpdateInterfaceState;
+export declare type SnapInterfaceControllerMessenger = RestrictedControllerMessenger<typeof controllerName, SnapInterfaceControllerActions | SnapInterfaceControllerAllowedActions, never, SnapInterfaceControllerAllowedActions['type'], never>;
+export declare type StoredInterface = {
+    snapId: SnapId;
+    content: Component;
+    state: InterfaceState;
+};
+export declare type SnapInterfaceControllerState = {
+    interfaces: Record<string, StoredInterface>;
+};
+export declare type SnapInterfaceControllerArgs = {
+    messenger: SnapInterfaceControllerMessenger;
+    state?: SnapInterfaceControllerState;
+};
+/**
+ * Use this controller to manage snaps UI interfaces using RPC method hooks.
+ */
+export declare class SnapInterfaceController extends BaseController<typeof controllerName, SnapInterfaceControllerState, SnapInterfaceControllerMessenger> {
+    #private;
+    constructor({ messenger, state }: SnapInterfaceControllerArgs);
+    /**
+     * Create an interface in the controller state with the associated data.
+     *
+     * @param snapId - The snap id that created the interface.
+     * @param content - The interface content.
+     * @returns The newly interface id.
+     */
+    createInterface(snapId: SnapId, content: Component): Promise<string>;
+    /**
+     * Get the data of a given interface id.
+     *
+     * @param snapId - The snap id requesting the interface data.
+     * @param id - The interface id.
+     * @returns The interface state.
+     */
+    getInterface(snapId: SnapId, id: string): StoredInterface;
+    /**
+     * Update the interface with the given content.
+     *
+     * @param snapId - The snap id requesting the update.
+     * @param id - The interface id.
+     * @param content - The new content.
+     */
+    updateInterface(snapId: SnapId, id: string, content: Component): Promise<void>;
+    /**
+     * Delete an interface from state.
+     *
+     * @param id - The interface id.
+     */
+    deleteInterface(id: string): void;
+    /**
+     * Update the interface state.
+     *
+     * @param id - The interface id.
+     * @param state - The new state.
+     */
+    updateInterfaceState(id: string, state: InterfaceState): void;
+}
+export {};

package/dist/types/interface/index.d.ts

@@ -0,0 +1 @@
+export * from './SnapInterfaceController';

package/dist/types/interface/utils.d.ts

@@ -0,0 +1,36 @@
+import type { Component, Input, InterfaceState } from '@metamask/snaps-sdk';
+/**
+ * Construct the state for a stray input (not enclosed in a form).
+ *
+ * @param state - The interface state.
+ * @param component - The Input component.
+ * @returns The input state.
+ */
+export declare const constructInputState: (state: InterfaceState, component: Input) => string | Record<string, string | null> | null;
+/**
+ * Construct the state for a form input.
+ *
+ * Sets the state to either the specified component value, the previous value from the old state or null.
+ *
+ * @param state - The interface state.
+ * @param component - The Input component.
+ * @param form - The parent form name of the input.
+ * @returns The input state.
+ */
+export declare const constructFormInputState: (state: InterfaceState, component: Input, form: string) => string | null;
+/**
+ * Assert that the component name is unique in state.
+ *
+ * @param state - The interface state to verify against.
+ * @param name - The component name to verify.
+ */
+export declare const assertNameIsUnique: (state: InterfaceState, name: string) => void;
+/**
+ * Construct the interface state for a given component tree while preserving values for matching stateful components in the old state.
+ *
+ * @param oldState - The previous state.
+ * @param component - The UI component to construct state from.
+ * @param newState - The state that is being constructed.
+ * @returns The interface state of the passed component.
+ */
+export declare const constructState: (oldState: InterfaceState, component: Component, newState?: InterfaceState) => InterfaceState;

package/dist/types/services/ProxyPostMessageStream.d.ts

@@ -22,9 +22,8 @@ export declare class ProxyPostMessageStream extends BasePostMessageStream {
      * @param args - The constructor arguments.
      * @param args.stream - The underlying stream to use for communication.
      * @param args.jobId - The ID of the job this stream is associated with.
-     * @param args.extra - Extra data to include in the post message.
      */
-    constructor({ stream, jobId, extra }: ProxyPostMessageStreamArgs);
+    constructor({ stream, jobId }: ProxyPostMessageStreamArgs);
     /**
      * Write data to the underlying stream. This wraps the data in an object with
      * the job ID.

package/dist/types/services/browser.d.ts

@@ -3,4 +3,5 @@ export * from './ExecutionService';
 export * from './ProxyPostMessageStream';
 export * from './iframe';
 export * from './offscreen';
+export * from './webview';
 export { WebWorkerExecutionService } from './webworker';

package/dist/types/services/index.d.ts

@@ -4,4 +4,5 @@ export * from './ProxyPostMessageStream';
 export * from './iframe';
 export * from './node';
 export * from './offscreen';
+export * from './webview';
 export { WebWorkerExecutionService } from './webworker';

package/dist/types/services/offscreen/OffscreenExecutionService.d.ts

@@ -1,14 +1,11 @@
-import type { ExecutionServiceArgs, Job } from '../AbstractExecutionService';
-import { AbstractExecutionService } from '../AbstractExecutionService';
-import { ProxyPostMessageStream } from '../ProxyPostMessageStream';
+import type { ExecutionServiceArgs } from '../AbstractExecutionService';
+import { ProxyExecutionService } from '../proxy/ProxyExecutionService';
 declare type OffscreenExecutionEnvironmentServiceArgs = {
     documentUrl: URL;
-    frameUrl: URL;
 } & ExecutionServiceArgs;
-export declare class OffscreenExecutionService extends AbstractExecutionService<string> {
+export declare class OffscreenExecutionService extends ProxyExecutionService {
     #private;
     readonly documentUrl: URL;
-    readonly frameUrl: URL;
     /**
      * Create a new offscreen execution service.
      *
@@ -16,20 +13,12 @@ export declare class OffscreenExecutionService extends AbstractExecutionService<
      * @param args.documentUrl - The URL of the offscreen document to use as the
      * execution environment. This must be a URL relative to the location where
      * this is called. This cannot be a public (http(s)) URL.
-     * @param args.frameUrl - The URL of the iframe to load inside the offscreen
-     * document.
      * @param args.messenger - The messenger to use for communication with the
      * `SnapController`.
      * @param args.setupSnapProvider - The function to use to set up the snap
      * provider.
      */
-    constructor({ documentUrl, frameUrl, messenger, setupSnapProvider, }: OffscreenExecutionEnvironmentServiceArgs);
-    /**
-     * Send a termination command to the offscreen document.
-     *
-     * @param job - The job to terminate.
-     */
-    protected terminateJob(job: Job<string>): Promise<void>;
+    constructor({ documentUrl, messenger, setupSnapProvider, }: OffscreenExecutionEnvironmentServiceArgs);
     /**
      * Create a new stream for the specified job. This wraps the runtime stream
      * in a stream specific to the job.
@@ -38,13 +27,7 @@ export declare class OffscreenExecutionService extends AbstractExecutionService<
      */
     protected initEnvStream(jobId: string): Promise<{
         worker: string;
-        stream: ProxyPostMessageStream;
+        stream: import("..").ProxyPostMessageStream;
     }>;
-    /**
-     * Creates the offscreen document to be used as the execution environment.
-     *
-     * If the document already exists, this does nothing.
-     */
-    private createDocument;
 }
 export {};

package/dist/types/services/proxy/ProxyExecutionService.d.ts

@@ -0,0 +1,39 @@
+import type { BasePostMessageStream } from '@metamask/post-message-stream';
+import type { ExecutionServiceArgs, Job } from '../AbstractExecutionService';
+import { AbstractExecutionService } from '../AbstractExecutionService';
+import { ProxyPostMessageStream } from '../ProxyPostMessageStream';
+declare type ProxyExecutionEnvironmentServiceArgs = {
+    stream: BasePostMessageStream;
+} & ExecutionServiceArgs;
+export declare class ProxyExecutionService extends AbstractExecutionService<string> {
+    #private;
+    /**
+     * Create a new proxy execution service.
+     *
+     * @param args - The constructor arguments.
+     * @param args.messenger - The messenger to use for communication with the
+     * `SnapController`.
+     * @param args.setupSnapProvider - The function to use to set up the snap
+     * provider.
+     * @param args.stream - The stream to use for communicating with the proxy
+     * executor.
+     */
+    constructor({ stream, messenger, setupSnapProvider, }: ProxyExecutionEnvironmentServiceArgs);
+    /**
+     * Send a termination command to the proxy stream.
+     *
+     * @param job - The job to terminate.
+     */
+    protected terminateJob(job: Job<string>): Promise<void>;
+    /**
+     * Create a new stream for the specified job. This wraps the root stream
+     * in a stream specific to the job.
+     *
+     * @param jobId - The job ID.
+     */
+    protected initEnvStream(jobId: string): Promise<{
+        worker: string;
+        stream: ProxyPostMessageStream;
+    }>;
+}
+export {};

package/dist/types/services/webview/WebViewExecutionService.d.ts

@@ -0,0 +1,20 @@
+import type { ExecutionServiceArgs } from '../AbstractExecutionService';
+import { ProxyExecutionService } from '../proxy/ProxyExecutionService';
+import type { WebViewInterface } from './WebViewMessageStream';
+export declare type WebViewExecutionServiceArgs = ExecutionServiceArgs & {
+    getWebView: () => Promise<WebViewInterface>;
+};
+export declare class WebViewExecutionService extends ProxyExecutionService {
+    #private;
+    constructor({ messenger, setupSnapProvider, getWebView, }: WebViewExecutionServiceArgs);
+    /**
+     * Create a new stream for the specified job. This wraps the runtime stream
+     * in a stream specific to the job.
+     *
+     * @param jobId - The job ID.
+     */
+    protected initEnvStream(jobId: string): Promise<{
+        worker: string;
+        stream: import("..").ProxyPostMessageStream;
+    }>;
+}

package/dist/types/services/webview/WebViewMessageStream.d.ts

@@ -0,0 +1,32 @@
+import type { PostMessageEvent } from '@metamask/post-message-stream';
+import { BasePostMessageStream } from '@metamask/post-message-stream';
+export declare type WebViewInterface = {
+    injectJavaScript(js: string): void;
+    registerMessageListener(listener: (event: PostMessageEvent) => void): void;
+    unregisterMessageListener(listener: (event: PostMessageEvent) => void): void;
+};
+declare type WebViewStreamArgs = {
+    name: string;
+    target: string;
+    getWebView: () => Promise<WebViewInterface>;
+};
+/**
+ * A special postMessage stream used to interface with a WebView.
+ */
+export declare class WebViewMessageStream extends BasePostMessageStream {
+    #private;
+    /**
+     * Creates a stream for communicating with other streams inside a WebView.
+     *
+     * @param args - Options bag.
+     * @param args.name - The name of the stream. Used to differentiate between
+     * multiple streams sharing the same window object.
+     * @param args.target - The name of the stream to exchange messages with.
+     * @param args.getWebView - A asynchronous getter for the webview.
+     */
+    constructor({ name, target, getWebView }: WebViewStreamArgs);
+    protected _postMessage(data: unknown): void;
+    private _onMessage;
+    _destroy(): void;
+}
+export {};

package/dist/types/services/webview/index.d.ts

@@ -0,0 +1 @@
+export * from './WebViewExecutionService';