@metamask/snaps-controllers 6.0.3 → 7.0.0

package/CHANGELOG.md

@@ -6,6 +6,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [7.0.0]
+### Changed
+- **BREAKING:** Refactor encryption to enable caching ([#2316](https://github.com/MetaMask/snaps/pull/2316))
+  - New required constructor arguments `encryptor` and `getMnemonic` have been added.
+- Include `initialConnections` in approval `requestState` ([#2322](https://github.com/MetaMask/snaps/pull/2322))
+
+### Fixed
+- Delete unencrypted state when uninstalling a Snap ([#2311](https://github.com/MetaMask/snaps/pull/2311))
+
+## [6.0.4]
+### Changed
+- Bump MetaMask dependencies ([#2270](https://github.com/MetaMask/snaps/pull/2270))
+
 ## [6.0.3]
 ### Changed
 - Handle unavailable registry more gracefully ([#2256](https://github.com/MetaMask/snaps/pull/2256))
@@ -217,7 +230,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - The version of the package no longer needs to match the version of all other
     MetaMask Snaps packages.
 
-[Unreleased]: https://github.com/MetaMask/snaps/compare/@metamask/snaps-controllers@6.0.3...HEAD
+[Unreleased]: https://github.com/MetaMask/snaps/compare/@metamask/snaps-controllers@7.0.0...HEAD
+[7.0.0]: https://github.com/MetaMask/snaps/compare/@metamask/snaps-controllers@6.0.4...@metamask/snaps-controllers@7.0.0
+[6.0.4]: https://github.com/MetaMask/snaps/compare/@metamask/snaps-controllers@6.0.3...@metamask/snaps-controllers@6.0.4
 [6.0.3]: https://github.com/MetaMask/snaps/compare/@metamask/snaps-controllers@6.0.2...@metamask/snaps-controllers@6.0.3
 [6.0.2]: https://github.com/MetaMask/snaps/compare/@metamask/snaps-controllers@6.0.1...@metamask/snaps-controllers@6.0.2
 [6.0.1]: https://github.com/MetaMask/snaps/compare/@metamask/snaps-controllers@6.0.0...@metamask/snaps-controllers@6.0.1

package/dist/{chunk-SXF7KAMU.mjs → chunk-25LS4KZK.mjs}

@@ -1,6 +1,6 @@
 import {
   AbstractExecutionService
-} from "./chunk-XBGQ5PKQ.mjs";
+} from "./chunk-WVGK5B5P.mjs";
 import {
   __require
 } from "./chunk-YRZVIDCF.mjs";
@@ -35,4 +35,4 @@ var NodeProcessExecutionService = class extends AbstractExecutionService {
 export {
   NodeProcessExecutionService
 };
-//# sourceMappingURL=chunk-SXF7KAMU.mjs.map
+//# sourceMappingURL=chunk-25LS4KZK.mjs.map

package/dist/{chunk-YDVUJQ2S.mjs → chunk-2KCUVQFS.mjs}

@@ -1,6 +1,6 @@
 import {
   ProxyExecutionService
-} from "./chunk-KEEKVE7E.mjs";
+} from "./chunk-Q4I5QTVC.mjs";
 import {
   __privateAdd,
   __privateMethod
@@ -69,4 +69,4 @@ createDocument_fn = async function() {
 export {
   OffscreenExecutionService
 };
-//# sourceMappingURL=chunk-YDVUJQ2S.mjs.map
+//# sourceMappingURL=chunk-2KCUVQFS.mjs.map

package/dist/{chunk-VOAJRWUB.js → chunk-3ZC4LB7T.js}

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkVJZI4VSJjs = require('./chunk-VJZI4VSJ.js');
+var _chunk54TYYPANjs = require('./chunk-54TYYPAN.js');
 
 
 var _chunk7Y6P5FRNjs = require('./chunk-7Y6P5FRN.js');
@@ -17,7 +17,7 @@ var _utils = require('@metamask/utils');
 var _nanoid = require('nanoid');
 var WORKER_POOL_ID = "snaps-worker-pool";
 var _documentUrl, _runtimeStream;
-var WebWorkerExecutionService = class extends _chunkVJZI4VSJjs.AbstractExecutionService {
+var WebWorkerExecutionService = class extends _chunk54TYYPANjs.AbstractExecutionService {
   /**
    * Create a new webworker execution service.
    *
@@ -102,4 +102,4 @@ _runtimeStream = new WeakMap();
 
 
 exports.WORKER_POOL_ID = WORKER_POOL_ID; exports.WebWorkerExecutionService = WebWorkerExecutionService;
-//# sourceMappingURL=chunk-VOAJRWUB.js.map
+//# sourceMappingURL=chunk-3ZC4LB7T.js.map

package/dist/{chunk-B67RDBZ4.mjs → chunk-42ODFZSH.mjs}

@@ -1,9 +1,9 @@
-import {
-  NpmLocation
-} from "./chunk-WKQRCGUW.mjs";
 import {
   LocalLocation
 } from "./chunk-B3UTLNYS.mjs";
+import {
+  NpmLocation
+} from "./chunk-WKQRCGUW.mjs";
 import {
   HttpLocation
 } from "./chunk-6GMWL4JR.mjs";
@@ -37,4 +37,4 @@ function detectSnapLocation(location, opts) {
 export {
   detectSnapLocation
 };
-//# sourceMappingURL=chunk-B67RDBZ4.mjs.map
+//# sourceMappingURL=chunk-42ODFZSH.mjs.map

package/dist/{chunk-VJZI4VSJ.js → chunk-54TYYPAN.js}

@@ -14,6 +14,7 @@ var _chunkEXN2TFDJjs = require('./chunk-EXN2TFDJ.js');
 
 // src/services/AbstractExecutionService.ts
 var _jsonrpcengine = require('@metamask/json-rpc-engine');
+var _jsonrpcmiddlewarestream = require('@metamask/json-rpc-middleware-stream');
 var _objectmultiplex = require('@metamask/object-multiplex'); var _objectmultiplex2 = _interopRequireDefault(_objectmultiplex);
 var _rpcerrors = require('@metamask/rpc-errors');
 var _snapsutils = require('@metamask/snaps-utils');
@@ -24,7 +25,6 @@ var _snapsutils = require('@metamask/snaps-utils');
 
 
 var _utils = require('@metamask/utils');
-var _jsonrpcmiddlewarestream = require('json-rpc-middleware-stream');
 var _nanoid = require('nanoid');
 var _readablestream = require('readable-stream');
 var controllerName = "ExecutionService";
@@ -362,4 +362,4 @@ function setupMultiplex(connectionStream, streamName) {
 
 
 exports.AbstractExecutionService = AbstractExecutionService; exports.setupMultiplex = setupMultiplex;
-//# sourceMappingURL=chunk-VJZI4VSJ.js.map
+//# sourceMappingURL=chunk-54TYYPAN.js.map

package/dist/chunk-54TYYPAN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/AbstractExecutionService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,SAAS,qBAAqB;AAC9B,SAAS,8BAA8B;AACvC,OAAO,qBAAqB;AAE5B,SAAS,oBAAoB;AAE7B,SAAS,mBAAmB,gBAAgB;AAO5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,cAAc;AACvB,SAAS,gBAAgB;AAYzB,IAAM,iBAAiB;AAjCvB;AAyDO,IAAe,2BAAf,MAEP;AAAA,EAmBE,YAAY;AAAA,IACV;AAAA,IACA;AAAA,IACA,cAAc,eAAe,GAAG,SAAS,MAAM;AAAA,IAC/C,qBAAqB,eAAe,GAAG,SAAS,MAAM;AAAA,EACxD,GAAyB;AAmUzB;AAIA;AAkBA;AAKA;AArXA;AAQA;AAEA;AAEA;AAEA;AAEA;AAQE,uBAAK,eAAgB,oBAAI,IAAI;AAC7B,SAAK,OAAO,oBAAI,IAAI;AACpB,SAAK,oBAAoB;AACzB,uBAAK,eAAgB,oBAAI,IAAI;AAC7B,uBAAK,eAAgB,oBAAI,IAAI;AAC7B,uBAAK,YAAa;AAClB,uBAAK,cAAe;AACpB,uBAAK,qBAAsB;AAE3B,SAAK,wBAAwB;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,0BAAgC;AACtC,uBAAK,YAAW;AAAA,MACd,GAAG,cAAc;AAAA,MACjB,OAAO,QAAgB,YACrB,KAAK,iBAAiB,QAAQ,OAAO;AAAA,IACzC;AAEA,uBAAK,YAAW;AAAA,MACd,GAAG,cAAc;AAAA,MACjB,OAAO,aAAgC,KAAK,YAAY,QAAQ;AAAA,IAClE;AAEA,uBAAK,YAAW;AAAA,MACd,GAAG,cAAc;AAAA,MACjB,OAAO,WAAmB,KAAK,cAAc,MAAM;AAAA,IACrD;AAEA,uBAAK,YAAW;AAAA,MACd,GAAG,cAAc;AAAA,MACjB,YAAY,KAAK,kBAAkB;AAAA,IACrC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAa,UAAU,OAA8B;AACnD,UAAM,aAAa,KAAK,KAAK,IAAI,KAAK;AACtC,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,MAAM,gBAAgB,KAAK,cAAc;AAAA,IACrD;AAGA,UAAM,SAAS,MAAM;AAAA,MACnB,KAAK,QAAQ,OAAO;AAAA,QAClB,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,QAAQ,CAAC;AAAA,QACT,IAAI,OAAO;AAAA,MACb,CAAC;AAAA,MACD,mBAAK;AAAA,IACP;AAEA,QAAI,WAAW,eAAe,WAAW,MAAM;AAM7C,eAAS,QAAQ,KAAK,qCAAqC,MAAM;AAAA,IACnE;AAEA,WAAO,OAAO,WAAW,OAAO,EAAE,QAAQ,CAAC,WAAW;AACpD,UAAI;AACF,SAAC,OAAO,aAAa,OAAO,QAAQ;AACpC,eAAO,mBAAmB;AAAA,MAC5B,SAAS,OAAO;AACd,iBAAS,iCAAiC,KAAK;AAAA,MACjD;AAAA,IACF,CAAC;AAED,SAAK,aAAa,UAAU;AAE5B,0BAAK,sDAAL,WAA8B;AAC9B,SAAK,KAAK,OAAO,KAAK;AACtB,QAAI,QAAQ,KAAK,eAAe;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAgB,UAAoC;AAClD,UAAM,QAAQ,OAAO;AACrB,UAAM,EAAE,SAAS,OAAO,IAAI,MAAM,KAAK,YAAY,KAAK;AACxD,UAAM,YAAY,IAAI,cAAc;AAEpC,UAAM,oBAAoB,uBAAuB;AAEjD;AAAA,MACE,kBAAkB;AAAA,MAClB,QAAQ;AAAA,MACR,kBAAkB;AAAA,MAClB,CAAC,UAAU;AACT,YAAI,OAAO;AACT,mBAAS,2BAA2B,KAAK;AAAA,QAC3C;AAAA,MACF;AAAA,IACF;AAEA,cAAU,KAAK,kBAAkB,UAAU;AAE3C,UAAM,cAAc;AAAA,MAClB,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,SAAK,KAAK,IAAI,OAAO,WAAW;AAEhC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAgB,YACd,OACsD;AACtD,UAAM,EAAE,QAAQ,QAAQ,UAAU,IAAI,MAAM,KAAK,cAAc,KAAK;AACpE,UAAM,MAAM,eAAe,WAAW,SAAS,KAAK,GAAG;AACvD,UAAM,gBAAgB,IAAI,aAAa,kBAAkB,OAAO;AAIhE,UAAM,sBAAsB,CAC1B,YAGG;AACH,UAAI,CAAC,sBAAsB,OAAO,GAAG;AACnC;AAAA,MACF;AAGA,YAAM,SAAS,mBAAK,eAAc,IAAI,KAAK;AAC3C,UAAI,QAAQ,WAAW,mBAAmB;AACxC,2BAAK,YAAW,QAAQ,oCAAoC,MAAM;AAAA,MACpE,WAAW,QAAQ,WAAW,oBAAoB;AAChD,2BAAK,YAAW,QAAQ,qCAAqC,MAAM;AAAA,MACrE,WAAW,QAAQ,WAAW,kBAAkB;AAC9C,YAAI,SAAS,QAAQ,MAAM,KAAK,QAAQ,OAAO,OAAO;AACpD,6BAAK,YAAW;AAAA,YACd;AAAA,YACA;AAAA,YACA,QAAQ,OAAO;AAAA,UACjB;AACA,wBAAc,eAAe,QAAQ,mBAAmB;AAAA,QAC1D,OAAO;AACL;AAAA,YACE,IAAI;AAAA,cACF,uBAAuB,QAAQ,MAAM;AAAA,YACvC;AAAA,UACF;AAAA,QACF;AAAA,MACF,OAAO;AACL;AAAA,UACE,IAAI;AAAA,YACF,oDAAoD,QAAQ,MAAM;AAAA,UACpE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,kBAAc,GAAG,QAAQ,mBAAmB;AAC5C,UAAM,YAAY,IAAI,aAAa,kBAAkB,QAAQ;AAG7D,WAAO;AAAA,MACL,SAAS;AAAA,QACP,SAAS;AAAA,QACT,KAAK;AAAA;AAAA,QAEL,aAAa;AAAA,MACf;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,cAAc,QAAgB;AAClC,UAAM,QAAQ,mBAAK,eAAc,IAAI,MAAM;AAC3C,QAAI,OAAO;AACT,YAAM,KAAK,UAAU,KAAK;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB;AACxB,UAAM,QAAQ;AAAA,MACZ,CAAC,GAAG,KAAK,KAAK,KAAK,CAAC,EAAE,IAAI,OAAO,UAAU,KAAK,UAAU,KAAK,CAAC;AAAA,IAClE;AACA,uBAAK,eAAc,MAAM;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,qBAAqB,QAAgB;AAC3C,WAAO,mBAAK,eAAc,IAAI,MAAM;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,YAAY,UAA8C;AAC9D,QAAI,mBAAK,eAAc,IAAI,SAAS,MAAM,GAAG;AAC3C,YAAM,IAAI,MAAM,SAAS,SAAS,MAAM,8BAA8B;AAAA,IACxE;AAGA,UAAM,MAAM,MAAM,KAAK,QAAQ;AAC/B,0BAAK,kCAAL,WAAoB,SAAS,QAAQ,IAAI;AAGzC,UAAM,aAAa,MAAM;AAAA,MACvB,KAAK,QAAQ,IAAI,IAAI;AAAA,QACnB,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,IAAI,OAAO;AAAA,MACb,CAAC;AAAA,MACD,mBAAK;AAAA,IACP;AAEA,QAAI,eAAe,aAAa;AAC9B,YAAM,IAAI,MAAM,kDAAkD;AAAA,IACpE;AAEA,UAAM,YAAY,IAAI,QAAQ;AAE9B,SAAK,kBAAkB,SAAS,QAAQ,SAAS;AAEjD,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,IAAI;AAAA,MACxC,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,IAAI,OAAO;AAAA,IACb,CAAC;AACD,0BAAK,sCAAL,WAAsB,SAAS,QAAQ,IAAI;AAC3C,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAc,QACZ,OACA,SAC2B;AAC3B,2BAAuB,OAAO;AAE9B,UAAM,MAAM,KAAK,KAAK,IAAI,KAAK;AAC/B,QAAI,CAAC,KAAK;AACR,YAAM,IAAI,MAAM,gBAAgB,KAAK,cAAc;AAAA,IACrD;AAEA,QAAI,2BAA2B,OAAO;AACtC,UAAM,WAAyC,MAAM,IAAI,UAAU;AAAA,MACjE;AAAA,IACF;AAEA,QAAI,SAAS,OAAO;AAClB,YAAM,IAAI;AAAA,QACR,SAAS,MAAM;AAAA,QACf,SAAS,MAAM;AAAA,QACf,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAEA,WAAO,SAAS;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA+CA,MAAa,iBACX,QACA,SACkB;AAClB,UAAM,oBAAoB,KAAK,qBAAqB,MAAM;AAE1D,QAAI,CAAC,mBAAmB;AACtB,YAAM,IAAI;AAAA,QACR,oEAAoE,MAAM;AAAA,MAC5E;AAAA,IACF;AAEA,WAAO,kBAAkB,OAAO;AAAA,EAClC;AACF;AArZE;AAQA;AAEA;AAEA;AAEA;AAEA;AA0UA;AAAA,qBAAgB,SAAC,QAAgB;AAC/B,qBAAK,eAAc,OAAO,MAAM;AAClC;AAEA;AAAA,qBAAgB,SAAC,QAAgB,UAAkB;AACjD,QAAM,UAAU,OAAO,EAAE,QAAQ,SAAS,QAAQ,MAAuB;AACvE,WAAO,MAAM,KAAK,QAAQ,UAAU;AAAA,MAClC,IAAI,OAAO;AAAA,MACX,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH;AAEA,qBAAK,eAAc,IAAI,QAAQ,OAAO;AACxC;AAEA;AAAA,mBAAc,SAAC,QAAgB,OAAqB;AAClD,qBAAK,eAAc,IAAI,QAAQ,KAAK;AACpC,qBAAK,eAAc,IAAI,OAAO,MAAM;AACtC;AAEA;AAAA,6BAAwB,SAAC,OAAqB;AAC5C,QAAM,SAAS,mBAAK,eAAc,IAAI,KAAK;AAC3C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,SAAS,KAAK,uBAAuB;AAAA,EACvD;AAEA,qBAAK,eAAc,OAAO,KAAK;AAC/B,qBAAK,eAAc,OAAO,MAAM;AAChC,wBAAK,sCAAL,WAAsB;AACxB;AAgCK,SAAS,eACd,kBACA,YACiB;AACjB,QAAM,MAAM,IAAI,gBAAgB;AAChC,WAAS,kBAAkB,KAAK,kBAAkB,CAAC,UAAU;AAC3D,QAAI,OAAO;AACT,mBACI,SAAS,IAAI,UAAU,qBAAqB,KAAK,IACjD,SAAS,KAAK;AAAA,IACpB;AAAA,EACF,CAAC;AACD,SAAO;AACT","sourcesContent":["import { JsonRpcEngine } from '@metamask/json-rpc-engine';\nimport { createStreamMiddleware } from '@metamask/json-rpc-middleware-stream';\nimport ObjectMultiplex from '@metamask/object-multiplex';\nimport type { BasePostMessageStream } from '@metamask/post-message-stream';\nimport { JsonRpcError } from '@metamask/rpc-errors';\nimport type { SnapRpcHook, SnapRpcHookArgs } from '@metamask/snaps-utils';\nimport { SNAP_STREAM_NAMES, logError } from '@metamask/snaps-utils';\nimport type {\n  Json,\n  JsonRpcNotification,\n  JsonRpcRequest,\n  PendingJsonRpcResponse,\n} from '@metamask/utils';\nimport {\n  Duration,\n  assertIsJsonRpcRequest,\n  inMilliseconds,\n  isJsonRpcNotification,\n  isObject,\n} from '@metamask/utils';\nimport { nanoid } from 'nanoid';\nimport { pipeline } from 'readable-stream';\nimport type { Duplex } from 'readable-stream';\n\nimport { log } from '../logging';\nimport { hasTimedOut, withTimeout } from '../utils';\nimport type {\n  ExecutionService,\n  ExecutionServiceMessenger,\n  SnapErrorJson,\n  SnapExecutionData,\n} from './ExecutionService';\n\nconst controllerName = 'ExecutionService';\n\nexport type SetupSnapProvider = (snapId: string, stream: Duplex) => void;\n\nexport type ExecutionServiceArgs = {\n  setupSnapProvider: SetupSnapProvider;\n  messenger: ExecutionServiceMessenger;\n  pingTimeout?: number;\n  terminationTimeout?: number;\n};\n\nexport type JobStreams = {\n  command: Duplex;\n  rpc: Duplex;\n  _connection: BasePostMessageStream;\n};\n\nexport type Job<WorkerType> = {\n  id: string;\n  streams: JobStreams;\n  rpcEngine: JsonRpcEngine;\n  worker: WorkerType;\n};\n\nexport abstract class AbstractExecutionService<WorkerType>\n  implements ExecutionService\n{\n  #snapRpcHooks: Map<string, SnapRpcHook>;\n\n  // Cannot be hash private yet because of tests.\n  protected jobs: Map<string, Job<WorkerType>>;\n\n  // Cannot be hash private yet because of tests.\n  private readonly setupSnapProvider: SetupSnapProvider;\n\n  #snapToJobMap: Map<string, string>;\n\n  #jobToSnapMap: Map<string, string>;\n\n  #messenger: ExecutionServiceMessenger;\n\n  #pingTimeout: number;\n\n  #terminationTimeout: number;\n\n  constructor({\n    setupSnapProvider,\n    messenger,\n    pingTimeout = inMilliseconds(2, Duration.Second),\n    terminationTimeout = inMilliseconds(1, Duration.Second),\n  }: ExecutionServiceArgs) {\n    this.#snapRpcHooks = new Map();\n    this.jobs = new Map();\n    this.setupSnapProvider = setupSnapProvider;\n    this.#snapToJobMap = new Map();\n    this.#jobToSnapMap = new Map();\n    this.#messenger = messenger;\n    this.#pingTimeout = pingTimeout;\n    this.#terminationTimeout = terminationTimeout;\n\n    this.registerMessageHandlers();\n  }\n\n  /**\n   * Constructor helper for registering the controller's messaging system\n   * actions.\n   */\n  private registerMessageHandlers(): void {\n    this.#messenger.registerActionHandler(\n      `${controllerName}:handleRpcRequest`,\n      async (snapId: string, options: SnapRpcHookArgs) =>\n        this.handleRpcRequest(snapId, options),\n    );\n\n    this.#messenger.registerActionHandler(\n      `${controllerName}:executeSnap`,\n      async (snapData: SnapExecutionData) => this.executeSnap(snapData),\n    );\n\n    this.#messenger.registerActionHandler(\n      `${controllerName}:terminateSnap`,\n      async (snapId: string) => this.terminateSnap(snapId),\n    );\n\n    this.#messenger.registerActionHandler(\n      `${controllerName}:terminateAllSnaps`,\n      async () => this.terminateAllSnaps(),\n    );\n  }\n\n  /**\n   * Performs additional necessary work during job termination. **MUST** be\n   * implemented by concrete implementations. See\n   * {@link AbstractExecutionService.terminate} for details.\n   *\n   * @param job - The object corresponding to the job to be terminated.\n   */\n  protected abstract terminateJob(job: Job<WorkerType>): void;\n\n  /**\n   * Terminates the job with the specified ID and deletes all its associated\n   * data. Any subsequent messages targeting the job will fail with an error.\n   * Throws an error if the specified job does not exist, or if termination\n   * fails unexpectedly.\n   *\n   * @param jobId - The id of the job to be terminated.\n   */\n  public async terminate(jobId: string): Promise<void> {\n    const jobWrapper = this.jobs.get(jobId);\n    if (!jobWrapper) {\n      throw new Error(`Job with id \"${jobId}\" not found.`);\n    }\n\n    // Ping worker and tell it to run teardown, continue with termination if it takes too long\n    const result = await withTimeout(\n      this.command(jobId, {\n        jsonrpc: '2.0',\n        method: 'terminate',\n        params: [],\n        id: nanoid(),\n      }),\n      this.#terminationTimeout,\n    );\n\n    if (result === hasTimedOut || result !== 'OK') {\n      // We tried to shutdown gracefully but failed. This probably means the Snap is in infinite loop and\n      // hogging down the whole JS process.\n      // TODO(ritave): It might be doing weird things such as posting a lot of setTimeouts. Add a test to ensure that this behaviour\n      //               doesn't leak into other workers. Especially important in IframeExecutionEnvironment since they all share the same\n      //               JS process.\n      logError(`Job \"${jobId}\" failed to terminate gracefully.`, result);\n    }\n\n    Object.values(jobWrapper.streams).forEach((stream) => {\n      try {\n        !stream.destroyed && stream.destroy();\n        stream.removeAllListeners();\n      } catch (error) {\n        logError('Error while destroying stream', error);\n      }\n    });\n\n    this.terminateJob(jobWrapper);\n\n    this.#removeSnapAndJobMapping(jobId);\n    this.jobs.delete(jobId);\n    log(`Job \"${jobId}\" terminated.`);\n  }\n\n  /**\n   * Initiates a job for a snap.\n   *\n   * Depending on the execution environment, this may run forever if the Snap fails to start up properly, therefore any call to this function should be wrapped in a timeout.\n   *\n   * @returns Information regarding the created job.\n   */\n  protected async initJob(): Promise<Job<WorkerType>> {\n    const jobId = nanoid();\n    const { streams, worker } = await this.initStreams(jobId);\n    const rpcEngine = new JsonRpcEngine();\n\n    const jsonRpcConnection = createStreamMiddleware();\n\n    pipeline(\n      jsonRpcConnection.stream,\n      streams.command,\n      jsonRpcConnection.stream,\n      (error) => {\n        if (error) {\n          logError(`Command stream failure.`, error);\n        }\n      },\n    );\n\n    rpcEngine.push(jsonRpcConnection.middleware);\n\n    const envMetadata = {\n      id: jobId,\n      streams,\n      rpcEngine,\n      worker,\n    };\n    this.jobs.set(jobId, envMetadata);\n\n    return envMetadata;\n  }\n\n  /**\n   * Sets up the streams for an initiated job.\n   *\n   * Depending on the execution environment, this may run forever if the Snap fails to start up properly, therefore any call to this function should be wrapped in a timeout.\n   *\n   * @param jobId - The id of the job.\n   * @returns The streams to communicate with the worker and the worker itself.\n   */\n  protected async initStreams(\n    jobId: string,\n  ): Promise<{ streams: JobStreams; worker: WorkerType }> {\n    const { worker, stream: envStream } = await this.initEnvStream(jobId);\n    const mux = setupMultiplex(envStream, `Job: \"${jobId}\"`);\n    const commandStream = mux.createStream(SNAP_STREAM_NAMES.COMMAND);\n\n    // Handle out-of-band errors, i.e. errors thrown from the snap outside of the req/res cycle.\n    // Also keep track of outbound request/responses\n    const notificationHandler = (\n      message:\n        | JsonRpcRequest\n        | JsonRpcNotification<Json[] | Record<string, Json>>,\n    ) => {\n      if (!isJsonRpcNotification(message)) {\n        return;\n      }\n\n      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n      const snapId = this.#jobToSnapMap.get(jobId)!;\n      if (message.method === 'OutboundRequest') {\n        this.#messenger.publish('ExecutionService:outboundRequest', snapId);\n      } else if (message.method === 'OutboundResponse') {\n        this.#messenger.publish('ExecutionService:outboundResponse', snapId);\n      } else if (message.method === 'UnhandledError') {\n        if (isObject(message.params) && message.params.error) {\n          this.#messenger.publish(\n            'ExecutionService:unhandledError',\n            snapId,\n            message.params.error as SnapErrorJson,\n          );\n          commandStream.removeListener('data', notificationHandler);\n        } else {\n          logError(\n            new Error(\n              `Received malformed \"${message.method}\" command stream notification.`,\n            ),\n          );\n        }\n      } else {\n        logError(\n          new Error(\n            `Received unexpected command stream notification \"${message.method}\".`,\n          ),\n        );\n      }\n    };\n\n    commandStream.on('data', notificationHandler);\n    const rpcStream = mux.createStream(SNAP_STREAM_NAMES.JSON_RPC);\n\n    // Typecast: stream type mismatch\n    return {\n      streams: {\n        command: commandStream,\n        rpc: rpcStream,\n        // eslint-disable-next-line @typescript-eslint/naming-convention\n        _connection: envStream,\n      },\n      worker,\n    };\n  }\n\n  /**\n   * Abstract function implemented by implementing class that spins up a new worker for a job.\n   *\n   * Depending on the execution environment, this may run forever if the Snap fails to start up properly, therefore any call to this function should be wrapped in a timeout.\n   */\n  protected abstract initEnvStream(jobId: string): Promise<{\n    worker: WorkerType;\n    stream: BasePostMessageStream;\n  }>;\n\n  /**\n   * Terminates the Snap with the specified ID. May throw an error if\n   * termination unexpectedly fails, but will not fail if no job for the snap\n   * with the specified ID is found.\n   *\n   * @param snapId - The ID of the snap to terminate.\n   */\n  async terminateSnap(snapId: string) {\n    const jobId = this.#snapToJobMap.get(snapId);\n    if (jobId) {\n      await this.terminate(jobId);\n    }\n  }\n\n  async terminateAllSnaps() {\n    await Promise.all(\n      [...this.jobs.keys()].map(async (jobId) => this.terminate(jobId)),\n    );\n    this.#snapRpcHooks.clear();\n  }\n\n  /**\n   * Gets the RPC request handler for the given snap.\n   *\n   * @param snapId - The id of the Snap whose message handler to get.\n   * @returns The RPC request handler for the snap.\n   */\n  private getRpcRequestHandler(snapId: string) {\n    return this.#snapRpcHooks.get(snapId);\n  }\n\n  /**\n   * Initializes and executes a snap, setting up the communication channels to the snap etc.\n   *\n   * Depending on the execution environment, this may run forever if the Snap fails to start up properly, therefore any call to this function should be wrapped in a timeout.\n   *\n   * @param snapData - Data needed for Snap execution.\n   * @returns A string `OK` if execution succeeded.\n   * @throws If the execution service returns an error.\n   */\n  async executeSnap(snapData: SnapExecutionData): Promise<string> {\n    if (this.#snapToJobMap.has(snapData.snapId)) {\n      throw new Error(`Snap \"${snapData.snapId}\" is already being executed.`);\n    }\n\n    // This may resolve even if the environment has failed to start up fully\n    const job = await this.initJob();\n    this.#mapSnapAndJob(snapData.snapId, job.id);\n\n    // Ping the worker to ensure that it started up\n    const pingResult = await withTimeout(\n      this.command(job.id, {\n        jsonrpc: '2.0',\n        method: 'ping',\n        id: nanoid(),\n      }),\n      this.#pingTimeout,\n    );\n\n    if (pingResult === hasTimedOut) {\n      throw new Error('The Snaps execution environment failed to start.');\n    }\n\n    const rpcStream = job.streams.rpc;\n\n    this.setupSnapProvider(snapData.snapId, rpcStream);\n\n    const result = await this.command(job.id, {\n      jsonrpc: '2.0',\n      method: 'executeSnap',\n      params: snapData,\n      id: nanoid(),\n    });\n    this.#createSnapHooks(snapData.snapId, job.id);\n    return result as string;\n  }\n\n  // Cannot be hash private yet because of tests.\n  private async command(\n    jobId: string,\n    message: JsonRpcRequest,\n  ): Promise<Json | undefined> {\n    assertIsJsonRpcRequest(message);\n\n    const job = this.jobs.get(jobId);\n    if (!job) {\n      throw new Error(`Job with id \"${jobId}\" not found.`);\n    }\n\n    log('Parent: Sending Command', message);\n    const response: PendingJsonRpcResponse<Json> = await job.rpcEngine.handle(\n      message,\n    );\n\n    if (response.error) {\n      throw new JsonRpcError(\n        response.error.code,\n        response.error.message,\n        response.error.data,\n      );\n    }\n\n    return response.result;\n  }\n\n  #removeSnapHooks(snapId: string) {\n    this.#snapRpcHooks.delete(snapId);\n  }\n\n  #createSnapHooks(snapId: string, workerId: string) {\n    const rpcHook = async ({ origin, handler, request }: SnapRpcHookArgs) => {\n      return await this.command(workerId, {\n        id: nanoid(),\n        jsonrpc: '2.0',\n        method: 'snapRpc',\n        params: {\n          origin,\n          handler,\n          request: request as JsonRpcRequest,\n          target: snapId,\n        },\n      });\n    };\n\n    this.#snapRpcHooks.set(snapId, rpcHook);\n  }\n\n  #mapSnapAndJob(snapId: string, jobId: string): void {\n    this.#snapToJobMap.set(snapId, jobId);\n    this.#jobToSnapMap.set(jobId, snapId);\n  }\n\n  #removeSnapAndJobMapping(jobId: string): void {\n    const snapId = this.#jobToSnapMap.get(jobId);\n    if (!snapId) {\n      throw new Error(`job: \"${jobId}\" has no mapped snap.`);\n    }\n\n    this.#jobToSnapMap.delete(jobId);\n    this.#snapToJobMap.delete(snapId);\n    this.#removeSnapHooks(snapId);\n  }\n\n  /**\n   * Handle RPC request.\n   *\n   * @param snapId - The ID of the recipient snap.\n   * @param options - Bag of options to pass to the RPC handler.\n   * @returns Promise that can handle the request.\n   */\n  public async handleRpcRequest(\n    snapId: string,\n    options: SnapRpcHookArgs,\n  ): Promise<unknown> {\n    const rpcRequestHandler = this.getRpcRequestHandler(snapId);\n\n    if (!rpcRequestHandler) {\n      throw new Error(\n        `Snap execution service returned no RPC handler for running snap \"${snapId}\".`,\n      );\n    }\n\n    return rpcRequestHandler(options);\n  }\n}\n\n/**\n * Sets up stream multiplexing for the given stream.\n *\n * @param connectionStream - The stream to mux.\n * @param streamName - The name of the stream, for identification in errors.\n * @returns The multiplexed stream.\n */\nexport function setupMultiplex(\n  connectionStream: Duplex,\n  streamName: string,\n): ObjectMultiplex {\n  const mux = new ObjectMultiplex();\n  pipeline(connectionStream, mux, connectionStream, (error) => {\n    if (error) {\n      streamName\n        ? logError(`\"${streamName}\" stream failure.`, error)\n        : logError(error);\n    }\n  });\n  return mux;\n}\n"]}

package/dist/{chunk-TXR2WWIP.js → chunk-63GNCRER.js}

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkVJZI4VSJjs = require('./chunk-VJZI4VSJ.js');
+var _chunk54TYYPANjs = require('./chunk-54TYYPAN.js');
 
 
 var _chunkEXN2TFDJjs = require('./chunk-EXN2TFDJ.js');
@@ -8,7 +8,7 @@ var _chunkEXN2TFDJjs = require('./chunk-EXN2TFDJ.js');
 // src/services/node-js/NodeThreadExecutionService.ts
 var _postmessagestream = require('@metamask/post-message-stream');
 var _worker_threads = require('worker_threads');
-var NodeThreadExecutionService = class extends _chunkVJZI4VSJjs.AbstractExecutionService {
+var NodeThreadExecutionService = class extends _chunk54TYYPANjs.AbstractExecutionService {
   async initEnvStream() {
     const worker = new (0, _worker_threads.Worker)(
       _chunkEXN2TFDJjs.__require.resolve(
@@ -36,4 +36,4 @@ var NodeThreadExecutionService = class extends _chunkVJZI4VSJjs.AbstractExecutio
 
 
 exports.NodeThreadExecutionService = NodeThreadExecutionService;
-//# sourceMappingURL=chunk-TXR2WWIP.js.map
+//# sourceMappingURL=chunk-63GNCRER.js.map

package/dist/{chunk-E7627MMH.mjs → chunk-75VM3O4K.mjs}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-IGC4E7PI.mjs";
 import {
   ProxyExecutionService
-} from "./chunk-KEEKVE7E.mjs";
+} from "./chunk-Q4I5QTVC.mjs";
 import {
   __privateAdd,
   __privateGet,
@@ -55,4 +55,4 @@ ensureWebViewLoaded_fn = async function() {
 export {
   WebViewExecutionService
 };
-//# sourceMappingURL=chunk-E7627MMH.mjs.map
+//# sourceMappingURL=chunk-75VM3O4K.mjs.map

package/dist/{chunk-AELC3WCV.mjs → chunk-BJOQRBH2.mjs}

@@ -1,6 +1,6 @@
 import {
   AbstractExecutionService
-} from "./chunk-XBGQ5PKQ.mjs";
+} from "./chunk-WVGK5B5P.mjs";
 
 // src/services/iframe/IframeExecutionService.ts
 import { WindowPostMessageStream } from "@metamask/post-message-stream";
@@ -35,4 +35,4 @@ var IframeExecutionService = class extends AbstractExecutionService {
 export {
   IframeExecutionService
 };
-//# sourceMappingURL=chunk-AELC3WCV.mjs.map
+//# sourceMappingURL=chunk-BJOQRBH2.mjs.map

package/dist/chunk-HP6S5IOB.js

@@ -0,0 +1 @@
+"use strict";//# sourceMappingURL=chunk-HP6S5IOB.js.map

package/dist/chunk-HP6S5IOB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":""}

package/dist/{chunk-APQVOL5T.js → chunk-MIYZN7HG.js}

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunk7WOG63YYjs = require('./chunk-7WOG63YY.js');
+var _chunkPT22IXNSjs = require('./chunk-PT22IXNS.js');
 
 
 var _chunkAP7CJ6DAjs = require('./chunk-AP7CJ6DA.js');
@@ -42,6 +42,7 @@ var _rpcerrors = require('@metamask/rpc-errors');
 
 
 
+
 var _snapsrpcmethods = require('@metamask/snaps-rpc-methods');
 var _snapssdk = require('@metamask/snaps-sdk');
 
@@ -65,6 +66,7 @@ var _snapssdk = require('@metamask/snaps-sdk');
 
 
 
+
 
 
 var _snapsutils = require('@metamask/snaps-utils');
@@ -81,6 +83,7 @@ var _snapsutils = require('@metamask/snaps-utils');
 
 
 
+
 var _utils = require('@metamask/utils');
 var _fsm = require('@xstate/fsm');
 var _nanoid = require('nanoid');
@@ -113,7 +116,7 @@ function truncateSnap(snap) {
   return truncatedSnap;
 }
 var name = "SnapController";
-var _closeAllConnections, _dynamicPermissions, _environmentEndowmentPermissions, _excludedPermissions, _featureFlags, _fetchFunction, _idleTimeCheckInterval, _maxIdleTime, _maxInitTime, _detectSnapLocation, _snapsRuntimeData, _rollbackSnapshots, _timeoutForLastRequestStatus, _statusMachine, _initializeStateMachine, initializeStateMachine_fn, _registerMessageHandlers, registerMessageHandlers_fn, _handlePreinstalledSnaps, handlePreinstalledSnaps_fn, _pollForLastRequestStatus, pollForLastRequestStatus_fn, _blockSnap, blockSnap_fn, _unblockSnap, unblockSnap_fn, _assertIsInstallAllowed, assertIsInstallAllowed_fn, _stopSnapsLastRequestPastMax, stopSnapsLastRequestPastMax_fn, _transition, transition_fn, _terminateSnap, terminateSnap_fn, _handleInitialConnections, handleInitialConnections_fn, _addSnapToSubject, addSnapToSubject_fn, _removeSnapFromSubjects, removeSnapFromSubjects_fn, _revokeAllSnapPermissions, revokeAllSnapPermissions_fn, _createApproval, createApproval_fn, _updateApproval, updateApproval_fn, _resolveAllowlistVersion, resolveAllowlistVersion_fn, _add, add_fn, _startSnap, startSnap_fn, _getEndowments, getEndowments_fn, _set, set_fn, _validateSnapPermissions, validateSnapPermissions_fn, _getExecutionTimeout, getExecutionTimeout_fn, _getRpcRequestHandler, getRpcRequestHandler_fn, _createInterface, createInterface_fn, _assertInterfaceExists, assertInterfaceExists_fn, _transformSnapRpcRequestResult, transformSnapRpcRequestResult_fn, _assertSnapRpcRequestResult, assertSnapRpcRequestResult_fn, _recordSnapRpcRequestStart, recordSnapRpcRequestStart_fn, _recordSnapRpcRequestFinish, recordSnapRpcRequestFinish_fn, _getRollbackSnapshot, getRollbackSnapshot_fn, _createRollbackSnapshot, createRollbackSnapshot_fn, _rollbackSnap, rollbackSnap_fn, _rollbackSnaps, rollbackSnaps_fn, _getRuntime, getRuntime_fn, _getRuntimeExpect, getRuntimeExpect_fn, _setupRuntime, setupRuntime_fn, _calculatePermissionsChange, calculatePermissionsChange_fn, _updatePermissions, updatePermissions_fn, _isValidUpdate, isValidUpdate_fn, _callLifecycleHook, callLifecycleHook_fn;
+var _closeAllConnections, _dynamicPermissions, _environmentEndowmentPermissions, _excludedPermissions, _featureFlags, _fetchFunction, _idleTimeCheckInterval, _maxIdleTime, _maxInitTime, _encryptor, _getMnemonic, _detectSnapLocation, _snapsRuntimeData, _rollbackSnapshots, _timeoutForLastRequestStatus, _statusMachine, _initializeStateMachine, initializeStateMachine_fn, _registerMessageHandlers, registerMessageHandlers_fn, _handlePreinstalledSnaps, handlePreinstalledSnaps_fn, _pollForLastRequestStatus, pollForLastRequestStatus_fn, _blockSnap, blockSnap_fn, _unblockSnap, unblockSnap_fn, _assertIsInstallAllowed, assertIsInstallAllowed_fn, _stopSnapsLastRequestPastMax, stopSnapsLastRequestPastMax_fn, _transition, transition_fn, _terminateSnap, terminateSnap_fn, _getSnapEncryptionKey, getSnapEncryptionKey_fn, _decryptSnapState, decryptSnapState_fn, _encryptSnapState, encryptSnapState_fn, _handleInitialConnections, handleInitialConnections_fn, _addSnapToSubject, addSnapToSubject_fn, _removeSnapFromSubjects, removeSnapFromSubjects_fn, _revokeAllSnapPermissions, revokeAllSnapPermissions_fn, _createApproval, createApproval_fn, _updateApproval, updateApproval_fn, _resolveAllowlistVersion, resolveAllowlistVersion_fn, _add, add_fn, _startSnap, startSnap_fn, _getEndowments, getEndowments_fn, _set, set_fn, _validateSnapPermissions, validateSnapPermissions_fn, _getExecutionTimeout, getExecutionTimeout_fn, _getRpcRequestHandler, getRpcRequestHandler_fn, _createInterface, createInterface_fn, _assertInterfaceExists, assertInterfaceExists_fn, _transformSnapRpcRequestResult, transformSnapRpcRequestResult_fn, _assertSnapRpcRequestResult, assertSnapRpcRequestResult_fn, _recordSnapRpcRequestStart, recordSnapRpcRequestStart_fn, _recordSnapRpcRequestFinish, recordSnapRpcRequestFinish_fn, _getRollbackSnapshot, getRollbackSnapshot_fn, _createRollbackSnapshot, createRollbackSnapshot_fn, _rollbackSnap, rollbackSnap_fn, _rollbackSnaps, rollbackSnaps_fn, _getRuntime, getRuntime_fn, _getRuntimeExpect, getRuntimeExpect_fn, _setupRuntime, setupRuntime_fn, _calculatePermissionsChange, calculatePermissionsChange_fn, _updatePermissions, updatePermissions_fn, _isValidUpdate, isValidUpdate_fn, _callLifecycleHook, callLifecycleHook_fn;
 var SnapController = class extends _basecontroller.BaseController {
   constructor({
     closeAllConnections,
@@ -128,8 +131,10 @@ var SnapController = class extends _basecontroller.BaseController {
     maxInitTime = _utils.inMilliseconds.call(void 0, 60, _utils.Duration.Second),
     fetchFunction = globalThis.fetch.bind(globalThis),
     featureFlags = {},
-    detectSnapLocation: detectSnapLocationFunction = _chunk7WOG63YYjs.detectSnapLocation,
-    preinstalledSnaps
+    detectSnapLocation: detectSnapLocationFunction = _chunkPT22IXNSjs.detectSnapLocation,
+    preinstalledSnaps,
+    encryptor,
+    getMnemonic
   }) {
     super({
       messenger,
@@ -218,6 +223,37 @@ var SnapController = class extends _basecontroller.BaseController {
      * @param snapId - The snap to terminate.
      */
     _chunkEXN2TFDJjs.__privateAdd.call(void 0, this, _terminateSnap);
+    /**
+     * Generate an encryption key to be used for state encryption for a given Snap.
+     *
+     * @param options - An options bag.
+     * @param options.snapId - The Snap ID.
+     * @param options.salt - A salt to be used for the encryption key.
+     * @param options.useCache - Whether to use caching or not.
+     * @param options.keyMetadata - Optional metadata about how to derive the encryption key.
+     * @returns An encryption key.
+     */
+    _chunkEXN2TFDJjs.__privateAdd.call(void 0, this, _getSnapEncryptionKey);
+    /**
+     * Decrypt the encrypted state for a given Snap.
+     *
+     * @param snapId - The Snap ID.
+     * @param state - The encrypted state as a string.
+     * @returns A valid JSON object derived from the encrypted state.
+     * @throws If the decryption fails or the decrypted state is not valid JSON.
+     */
+    _chunkEXN2TFDJjs.__privateAdd.call(void 0, this, _decryptSnapState);
+    /**
+     * Encrypt a JSON state object for a given Snap.
+     *
+     * Note: This function does not assert the validity of the object,
+     * please ensure only valid JSON is passed to it.
+     *
+     * @param snapId - The Snap ID.
+     * @param state - The state object.
+     * @returns A string containing the encrypted JSON object.
+     */
+    _chunkEXN2TFDJjs.__privateAdd.call(void 0, this, _encryptSnapState);
     _chunkEXN2TFDJjs.__privateAdd.call(void 0, this, _handleInitialConnections);
     _chunkEXN2TFDJjs.__privateAdd.call(void 0, this, _addSnapToSubject);
     /**
@@ -406,6 +442,8 @@ var SnapController = class extends _basecontroller.BaseController {
     _chunkEXN2TFDJjs.__privateAdd.call(void 0, this, _idleTimeCheckInterval, void 0);
     _chunkEXN2TFDJjs.__privateAdd.call(void 0, this, _maxIdleTime, void 0);
     _chunkEXN2TFDJjs.__privateAdd.call(void 0, this, _maxInitTime, void 0);
+    _chunkEXN2TFDJjs.__privateAdd.call(void 0, this, _encryptor, void 0);
+    _chunkEXN2TFDJjs.__privateAdd.call(void 0, this, _getMnemonic, void 0);
     _chunkEXN2TFDJjs.__privateAdd.call(void 0, this, _detectSnapLocation, void 0);
     _chunkEXN2TFDJjs.__privateAdd.call(void 0, this, _snapsRuntimeData, void 0);
     _chunkEXN2TFDJjs.__privateAdd.call(void 0, this, _rollbackSnapshots, void 0);
@@ -422,6 +460,8 @@ var SnapController = class extends _basecontroller.BaseController {
     this.maxRequestTime = maxRequestTime;
     _chunkEXN2TFDJjs.__privateSet.call(void 0, this, _maxInitTime, maxInitTime);
     _chunkEXN2TFDJjs.__privateSet.call(void 0, this, _detectSnapLocation, detectSnapLocationFunction);
+    _chunkEXN2TFDJjs.__privateSet.call(void 0, this, _encryptor, encryptor);
+    _chunkEXN2TFDJjs.__privateSet.call(void 0, this, _getMnemonic, getMnemonic);
     this._onUnhandledSnapError = this._onUnhandledSnapError.bind(this);
     this._onOutboundRequest = this._onOutboundRequest.bind(this);
     this._onOutboundResponse = this._onOutboundResponse.bind(this);
@@ -674,14 +714,17 @@ var SnapController = class extends _basecontroller.BaseController {
    * @param newSnapState - The new state of the snap.
    * @param encrypted - A flag to indicate whether to use encrypted storage or not.
    */
-  updateSnapState(snapId, newSnapState, encrypted) {
-    this.update((state) => {
-      if (encrypted) {
-        state.snapStates[snapId] = newSnapState;
-      } else {
-        state.unencryptedSnapStates[snapId] = newSnapState;
-      }
-    });
+  async updateSnapState(snapId, newSnapState, encrypted) {
+    if (encrypted) {
+      const encryptedState = await _chunkEXN2TFDJjs.__privateMethod.call(void 0, this, _encryptSnapState, encryptSnapState_fn).call(this, snapId, newSnapState);
+      this.update((state) => {
+        state.snapStates[snapId] = encryptedState;
+      });
+    } else {
+      this.update((state) => {
+        state.unencryptedSnapStates[snapId] = JSON.stringify(newSnapState);
+      });
+    }
   }
   /**
    * Clears the state of the snap with the given id.
@@ -707,9 +750,16 @@ var SnapController = class extends _basecontroller.BaseController {
    * @param encrypted - A flag to indicate whether to use encrypted storage or not.
    * @returns The requested snap state or null if no state exists.
    */
-  getSnapState(snapId, encrypted) {
+  async getSnapState(snapId, encrypted) {
     const state = encrypted ? this.state.snapStates[snapId] : this.state.unencryptedSnapStates[snapId];
-    return state ?? null;
+    if (state === null) {
+      return state;
+    }
+    if (!encrypted) {
+      return _snapsutils.parseJson.call(void 0, state);
+    }
+    const decrypted = await _chunkEXN2TFDJjs.__privateMethod.call(void 0, this, _decryptSnapState, decryptSnapState_fn).call(this, snapId, state);
+    return decrypted;
   }
   /**
    * Gets a static auxiliary snap file in a chosen file encoding.
@@ -784,6 +834,7 @@ var SnapController = class extends _basecontroller.BaseController {
         this.update((state) => {
           delete state.snaps[snapId];
           delete state.snapStates[snapId];
+          delete state.unencryptedSnapStates[snapId];
         });
         if (snap.status !== _snapsutils.SnapStatus.Installing) {
           this.messagingSystem.publish(
@@ -1136,6 +1187,7 @@ var SnapController = class extends _basecontroller.BaseController {
       _chunkEXN2TFDJjs.__privateMethod.call(void 0, this, _validateSnapPermissions, validateSnapPermissions_fn).call(this, processedPermissions);
       const { newPermissions, unusedPermissions, approvedPermissions } = _chunkEXN2TFDJjs.__privateMethod.call(void 0, this, _calculatePermissionsChange, calculatePermissionsChange_fn).call(this, snapId, processedPermissions);
       _chunkEXN2TFDJjs.__privateMethod.call(void 0, this, _updateApproval, updateApproval_fn).call(this, pendingApproval.id, {
+        connections: manifest.initialConnections ?? {},
         permissions: newPermissions,
         newVersion: manifest.version,
         newPermissions,
@@ -1240,12 +1292,13 @@ var SnapController = class extends _basecontroller.BaseController {
     _chunkNXZVKBSVjs.log.call(void 0, `Authorizing snap: ${snapId}`);
     const snapsState = this.state.snaps;
     const snap = snapsState[snapId];
-    const { initialPermissions } = snap;
+    const { initialPermissions, initialConnections } = snap;
     try {
       const processedPermissions = _snapsrpcmethods.processSnapPermissions.call(void 0, initialPermissions);
       _chunkEXN2TFDJjs.__privateMethod.call(void 0, this, _validateSnapPermissions, validateSnapPermissions_fn).call(this, processedPermissions);
       _chunkEXN2TFDJjs.__privateMethod.call(void 0, this, _updateApproval, updateApproval_fn).call(this, pendingApproval.id, {
         loading: false,
+        connections: initialConnections ?? {},
         permissions: processedPermissions
       });
       const { permissions: approvedPermissions, ...requestData } = await pendingApproval.promise;
@@ -1358,6 +1411,8 @@ _fetchFunction = new WeakMap();
 _idleTimeCheckInterval = new WeakMap();
 _maxIdleTime = new WeakMap();
 _maxInitTime = new WeakMap();
+_encryptor = new WeakMap();
+_getMnemonic = new WeakMap();
 _detectSnapLocation = new WeakMap();
 _snapsRuntimeData = new WeakMap();
 _rollbackSnapshots = new WeakMap();
@@ -1429,7 +1484,7 @@ registerMessageHandlers_fn = function() {
   );
   this.messagingSystem.registerActionHandler(
     `${controllerName}:getSnapState`,
-    (...args) => this.getSnapState(...args)
+    async (...args) => this.getSnapState(...args)
   );
   this.messagingSystem.registerActionHandler(
     `${controllerName}:handleRequest`,
@@ -1445,7 +1500,7 @@ registerMessageHandlers_fn = function() {
   );
   this.messagingSystem.registerActionHandler(
     `${controllerName}:updateSnapState`,
-    (...args) => this.updateSnapState(...args)
+    async (...args) => this.updateSnapState(...args)
   );
   this.messagingSystem.registerActionHandler(
     `${controllerName}:enable`,
@@ -1648,6 +1703,70 @@ terminateSnap_fn = async function(snapId) {
     this.getTruncatedExpect(snapId)
   );
 };
+_getSnapEncryptionKey = new WeakSet();
+getSnapEncryptionKey_fn = async function({
+  snapId,
+  salt,
+  useCache,
+  keyMetadata
+}) {
+  const runtime = _chunkEXN2TFDJjs.__privateMethod.call(void 0, this, _getRuntimeExpect, getRuntimeExpect_fn).call(this, snapId);
+  if (runtime.encryptionKey && useCache) {
+    return _chunkEXN2TFDJjs.__privateGet.call(void 0, this, _encryptor).importKey(runtime.encryptionKey);
+  }
+  const mnemonicPhrase = await _chunkEXN2TFDJjs.__privateGet.call(void 0, this, _getMnemonic).call(this);
+  const entropy = await _snapsrpcmethods.getEncryptionEntropy.call(void 0, { snapId, mnemonicPhrase });
+  const encryptionKey = await _chunkEXN2TFDJjs.__privateGet.call(void 0, this, _encryptor).keyFromPassword(
+    entropy,
+    salt,
+    true,
+    keyMetadata
+  );
+  const exportedKey = await _chunkEXN2TFDJjs.__privateGet.call(void 0, this, _encryptor).exportKey(encryptionKey);
+  if (useCache) {
+    runtime.encryptionKey = exportedKey;
+  }
+  return encryptionKey;
+};
+_decryptSnapState = new WeakSet();
+decryptSnapState_fn = async function(snapId, state) {
+  try {
+    const parsed = _snapsutils.parseJson.call(void 0, state);
+    const { salt, keyMetadata } = parsed;
+    const useCache = _chunkEXN2TFDJjs.__privateGet.call(void 0, this, _encryptor).isVaultUpdated(state);
+    const encryptionKey = await _chunkEXN2TFDJjs.__privateMethod.call(void 0, this, _getSnapEncryptionKey, getSnapEncryptionKey_fn).call(this, {
+      snapId,
+      salt,
+      useCache,
+      keyMetadata
+    });
+    const decryptedState = await _chunkEXN2TFDJjs.__privateGet.call(void 0, this, _encryptor).decryptWithKey(
+      encryptionKey,
+      parsed
+    );
+    _utils.assert.call(void 0, _utils.isValidJson.call(void 0, decryptedState));
+    return decryptedState;
+  } catch {
+    throw _rpcerrors.rpcErrors.internal({
+      message: "Failed to decrypt snap state, the state must be corrupted."
+    });
+  }
+};
+_encryptSnapState = new WeakSet();
+encryptSnapState_fn = async function(snapId, state) {
+  const salt = _chunkEXN2TFDJjs.__privateGet.call(void 0, this, _encryptor).generateSalt();
+  const encryptionKey = await _chunkEXN2TFDJjs.__privateMethod.call(void 0, this, _getSnapEncryptionKey, getSnapEncryptionKey_fn).call(this, {
+    snapId,
+    salt,
+    useCache: true
+  });
+  const encryptedState = await _chunkEXN2TFDJjs.__privateGet.call(void 0, this, _encryptor).encryptWithKey(
+    encryptionKey,
+    state
+  );
+  encryptedState.salt = salt;
+  return JSON.stringify(encryptedState);
+};
 _handleInitialConnections = new WeakSet();
 handleInitialConnections_fn = function(snapId, previousInitialConnections, initialConnections) {
   if (previousInitialConnections) {
@@ -1913,6 +2032,7 @@ set_fn = function(args) {
     removable,
     preinstalled,
     id: snapId,
+    initialConnections: manifest.result.initialConnections,
     initialPermissions: manifest.result.initialPermissions,
     manifest: manifest.result,
     status: _chunkEXN2TFDJjs.__privateGet.call(void 0, this, _statusMachine).config.initial,
@@ -2222,6 +2342,7 @@ setupRuntime_fn = function(snapId) {
     lastRequest: null,
     rpcHandler: null,
     installPromise: null,
+    encryptionKey: null,
     activeReferences: 0,
     pendingInboundRequests: [],
     pendingOutboundRequests: 0,
@@ -2301,4 +2422,4 @@ callLifecycleHook_fn = async function(snapId, handler) {
 
 
 exports.controllerName = controllerName; exports.SNAP_APPROVAL_INSTALL = SNAP_APPROVAL_INSTALL; exports.SNAP_APPROVAL_UPDATE = SNAP_APPROVAL_UPDATE; exports.SNAP_APPROVAL_RESULT = SNAP_APPROVAL_RESULT; exports.SnapController = SnapController;
-//# sourceMappingURL=chunk-APQVOL5T.js.map
+//# sourceMappingURL=chunk-MIYZN7HG.js.map