@metamask/snaps-controllers 9.5.0 → 9.6.0

package/dist/snaps/location/npm.cjs

@@ -0,0 +1,335 @@
+"use strict";
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+var _BaseNpmLocation_instances, _BaseNpmLocation_validatedManifest, _BaseNpmLocation_files, _BaseNpmLocation_lazyInit;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getNpmCanonicalBasePath = exports.fetchNpmMetadata = exports.NpmLocation = exports.TARBALL_SIZE_SAFETY_LIMIT = exports.BaseNpmLocation = exports.DEFAULT_NPM_REGISTRY = void 0;
+const snaps_utils_1 = require("@metamask/snaps-utils");
+const utils_1 = require("@metamask/utils");
+const browserify_zlib_1 = require("browserify-zlib");
+const concat_stream_1 = __importDefault(require("concat-stream"));
+const get_npm_tarball_url_1 = __importDefault(require("get-npm-tarball-url"));
+const readable_stream_1 = require("readable-stream");
+const readable_web_to_node_stream_1 = require("readable-web-to-node-stream");
+const tar_stream_1 = require("tar-stream");
+exports.DEFAULT_NPM_REGISTRY = new URL('https://registry.npmjs.org');
+// Base class for NPM implementation, useful for extending with custom NPM fetching logic
+class BaseNpmLocation {
+    constructor(url, opts = {}) {
+        _BaseNpmLocation_instances.add(this);
+        _BaseNpmLocation_validatedManifest.set(this, void 0);
+        _BaseNpmLocation_files.set(this, void 0);
+        const allowCustomRegistries = opts.allowCustomRegistries ?? false;
+        const fetchFunction = opts.fetch ?? globalThis.fetch.bind(undefined);
+        const requestedRange = opts.versionRange ?? snaps_utils_1.DEFAULT_REQUESTED_SNAP_VERSION;
+        const defaultResolve = async (range) => range;
+        const resolveVersion = opts.resolveVersion ?? defaultResolve;
+        (0, utils_1.assertStruct)(url.toString(), snaps_utils_1.NpmSnapIdStruct, 'Invalid Snap Id: ');
+        let registry;
+        if (url.host === '' &&
+            url.port === '' &&
+            url.username === '' &&
+            url.password === '') {
+            registry = exports.DEFAULT_NPM_REGISTRY;
+        }
+        else {
+            registry = 'https://';
+            if (url.username) {
+                registry += url.username;
+                if (url.password) {
+                    registry += `:${url.password}`;
+                }
+                registry += '@';
+            }
+            registry += url.host;
+            registry = new URL(registry);
+            (0, utils_1.assert)(allowCustomRegistries, new TypeError(`Custom NPM registries are disabled, tried to use "${registry.toString()}".`));
+        }
+        (0, utils_1.assert)(registry.pathname === '/' &&
+            registry.search === '' &&
+            registry.hash === '');
+        (0, utils_1.assert)(url.pathname !== '' && url.pathname !== '/', new TypeError('The package name in NPM location is empty.'));
+        let packageName = url.pathname;
+        if (packageName.startsWith('/')) {
+            packageName = packageName.slice(1);
+        }
+        this.meta = {
+            requestedRange,
+            registry,
+            packageName,
+            fetch: fetchFunction,
+            resolveVersion,
+        };
+    }
+    async manifest() {
+        if (__classPrivateFieldGet(this, _BaseNpmLocation_validatedManifest, "f")) {
+            return __classPrivateFieldGet(this, _BaseNpmLocation_validatedManifest, "f").clone();
+        }
+        const vfile = await this.fetch('snap.manifest.json');
+        const result = (0, snaps_utils_1.parseJson)(vfile.toString());
+        vfile.result = (0, snaps_utils_1.createSnapManifest)(result);
+        __classPrivateFieldSet(this, _BaseNpmLocation_validatedManifest, vfile, "f");
+        return this.manifest();
+    }
+    async fetch(path) {
+        const relativePath = (0, snaps_utils_1.normalizeRelative)(path);
+        if (!__classPrivateFieldGet(this, _BaseNpmLocation_files, "f")) {
+            await __classPrivateFieldGet(this, _BaseNpmLocation_instances, "m", _BaseNpmLocation_lazyInit).call(this);
+            (0, utils_1.assert)(__classPrivateFieldGet(this, _BaseNpmLocation_files, "f") !== undefined);
+        }
+        const vfile = __classPrivateFieldGet(this, _BaseNpmLocation_files, "f").get(relativePath);
+        (0, utils_1.assert)(vfile !== undefined, new TypeError(`File "${path}" not found in package.`));
+        return vfile.clone();
+    }
+    get packageName() {
+        return this.meta.packageName;
+    }
+    get version() {
+        (0, utils_1.assert)(this.meta.version !== undefined, 'Tried to access version without first fetching NPM package.');
+        return this.meta.version;
+    }
+    get registry() {
+        return this.meta.registry;
+    }
+    get versionRange() {
+        return this.meta.requestedRange;
+    }
+}
+exports.BaseNpmLocation = BaseNpmLocation;
+_BaseNpmLocation_validatedManifest = new WeakMap(), _BaseNpmLocation_files = new WeakMap(), _BaseNpmLocation_instances = new WeakSet(), _BaseNpmLocation_lazyInit = async function _BaseNpmLocation_lazyInit() {
+    (0, utils_1.assert)(__classPrivateFieldGet(this, _BaseNpmLocation_files, "f") === undefined);
+    const resolvedVersion = await this.meta.resolveVersion(this.meta.requestedRange);
+    const { tarballURL, targetVersion } = await resolveNpmVersion(this.meta.packageName, resolvedVersion, this.meta.registry, this.meta.fetch);
+    if (!(0, snaps_utils_1.isValidUrl)(tarballURL) || !tarballURL.toString().endsWith('.tgz')) {
+        throw new Error(`Failed to find valid tarball URL in NPM metadata for package "${this.meta.packageName}".`);
+    }
+    // Override the tarball hostname/protocol with registryUrl hostname/protocol
+    const newTarballUrl = new URL(tarballURL);
+    newTarballUrl.hostname = this.meta.registry.hostname;
+    newTarballUrl.protocol = this.meta.registry.protocol;
+    const files = await this.fetchNpmTarball(newTarballUrl);
+    __classPrivateFieldSet(this, _BaseNpmLocation_files, files, "f");
+    this.meta.version = targetVersion;
+};
+// Safety limit for tarballs, 250 MB in bytes
+exports.TARBALL_SIZE_SAFETY_LIMIT = 262144000;
+// Main NPM implementation, contains a browser tarball fetching implementation.
+class NpmLocation extends BaseNpmLocation {
+    /**
+     * Fetches and unpacks the tarball (`.tgz` file) from the specified URL.
+     *
+     * @param tarballUrl - The tarball URL to fetch and unpack.
+     * @returns A the files for the package tarball.
+     * @throws If fetching the tarball fails.
+     */
+    async fetchNpmTarball(tarballUrl) {
+        // Perform a raw fetch because we want the Response object itself.
+        const tarballResponse = await this.meta.fetch(tarballUrl.toString());
+        if (!tarballResponse.ok || !tarballResponse.body) {
+            throw new Error(`Failed to fetch tarball for package "${this.meta.packageName}".`);
+        }
+        // We assume that NPM is a good actor and provides us with a valid `content-length` header.
+        const tarballSizeString = tarballResponse.headers.get('content-length');
+        (0, utils_1.assert)(tarballSizeString, 'Snap tarball has invalid content-length');
+        const tarballSize = parseInt(tarballSizeString, 10);
+        (0, utils_1.assert)(tarballSize <= exports.TARBALL_SIZE_SAFETY_LIMIT, 'Snap tarball exceeds size limit');
+        return new Promise((resolve, reject) => {
+            const files = new Map();
+            const tarballStream = createTarballStream(getNpmCanonicalBasePath(this.meta.registry, this.meta.packageName), files);
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+            const body = tarballResponse.body;
+            // The "gz" in "tgz" stands for "gzip". The tarball needs to be decompressed
+            // before we can actually grab any files from it.
+            // To prevent recursion-based zip bombs, we should not allow recursion here.
+            // If native decompression stream is available we use that, otherwise fallback to zlib.
+            if ('pipeThrough' in body && 'DecompressionStream' in globalThis) {
+                const decompressionStream = new DecompressionStream('gzip');
+                const decompressedStream = body.pipeThrough(decompressionStream);
+                (0, readable_stream_1.pipeline)(getNodeStream(decompressedStream), tarballStream, (error) => {
+                    error ? reject(error) : resolve(files);
+                });
+                return;
+            }
+            (0, readable_stream_1.pipeline)(getNodeStream(body), (0, browserify_zlib_1.createGunzip)(), tarballStream, (error) => {
+                error ? reject(error) : resolve(files);
+            });
+        });
+    }
+}
+exports.NpmLocation = NpmLocation;
+/**
+ * Fetches the NPM metadata of the specified package from
+ * the public npm registry.
+ *
+ * @param packageName - The name of the package whose metadata to fetch.
+ * @param registryUrl - The URL of the npm registry to fetch the metadata from.
+ * @param fetchFunction - The fetch function to use. Defaults to the global
+ * {@link fetch}. Useful for Node.js compatibility.
+ * @returns The NPM metadata object.
+ * @throws If fetching the metadata fails.
+ */
+async function fetchNpmMetadata(packageName, registryUrl, fetchFunction) {
+    const packageResponse = await fetchFunction(new URL(packageName, registryUrl).toString(), {
+        headers: {
+            // Corgi format is slightly smaller: https://github.com/npm/pacote/blob/main/lib/registry.js#L71
+            accept: isNPM(registryUrl)
+                ? 'application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*'
+                : 'application/json',
+        },
+    });
+    if (!packageResponse.ok) {
+        throw new Error(`Failed to fetch NPM registry entry. Status code: ${packageResponse.status}.`);
+    }
+    const packageMetadata = await packageResponse.json();
+    if (!(0, utils_1.isObject)(packageMetadata)) {
+        throw new Error(`Failed to fetch package "${packageName}" metadata from npm.`);
+    }
+    return packageMetadata;
+}
+exports.fetchNpmMetadata = fetchNpmMetadata;
+/**
+ * Gets the canonical base path for an NPM snap.
+ *
+ * @param registryUrl - A registry URL.
+ * @param packageName - A package name.
+ * @returns The canonical base path.
+ */
+function getNpmCanonicalBasePath(registryUrl, packageName) {
+    let canonicalBase = 'npm://';
+    if (registryUrl.username !== '') {
+        canonicalBase += registryUrl.username;
+        if (registryUrl.password !== '') {
+            canonicalBase += `:${registryUrl.password}`;
+        }
+        canonicalBase += '@';
+    }
+    return `${canonicalBase}${registryUrl.host}/${packageName}/`;
+}
+exports.getNpmCanonicalBasePath = getNpmCanonicalBasePath;
+/**
+ * Determine if a registry URL is NPM.
+ *
+ * @param registryUrl - A registry url.
+ * @returns True if the registry is the NPM registry, otherwise false.
+ */
+function isNPM(registryUrl) {
+    return registryUrl.toString() === exports.DEFAULT_NPM_REGISTRY.toString();
+}
+/**
+ * Resolves a version range to a version using the NPM registry.
+ *
+ * Unless the version range is already a version, then the NPM registry is skipped.
+ *
+ * @param packageName - The name of the package whose metadata to fetch.
+ * @param versionRange - The version range of the package.
+ * @param registryUrl - The URL of the npm registry to fetch the metadata from.
+ * @param fetchFunction - The fetch function to use. Defaults to the global
+ * {@link fetch}. Useful for Node.js compatibility.
+ * @returns An object containing the resolved version and a URL for its tarball.
+ * @throws If fetching the metadata fails.
+ */
+async function resolveNpmVersion(packageName, versionRange, registryUrl, fetchFunction) {
+    // If the version range is already a static version we don't need to look for the metadata.
+    if (isNPM(registryUrl) && (0, utils_1.isValidSemVerVersion)(versionRange)) {
+        return {
+            tarballURL: (0, get_npm_tarball_url_1.default)(packageName, versionRange),
+            targetVersion: versionRange,
+        };
+    }
+    const packageMetadata = await fetchNpmMetadata(packageName, registryUrl, fetchFunction);
+    const versions = Object.keys(packageMetadata?.versions ?? {}).map((version) => {
+        (0, utils_1.assertIsSemVerVersion)(version);
+        return version;
+    });
+    const targetVersion = (0, snaps_utils_1.getTargetVersion)(versions, versionRange);
+    if (targetVersion === null) {
+        throw new Error(`Failed to find a matching version in npm metadata for package "${packageName}" and requested semver range "${versionRange}".`);
+    }
+    const tarballURL = packageMetadata?.versions?.[targetVersion]?.dist?.tarball;
+    return { tarballURL, targetVersion };
+}
+/**
+ * The paths of files within npm tarballs appear to always be prefixed with
+ * "package/".
+ */
+const NPM_TARBALL_PATH_PREFIX = /^package\//u;
+/**
+ * Converts a {@link ReadableStream} to a Node.js {@link Readable}
+ * stream. Returns the stream directly if it is already a Node.js stream.
+ * We can't use the native Web {@link ReadableStream} directly because the
+ * other stream libraries we use expect Node.js streams.
+ *
+ * @param stream - The stream to convert.
+ * @returns The given stream as a Node.js Readable stream.
+ */
+function getNodeStream(stream) {
+    if (typeof stream.getReader !== 'function') {
+        return stream;
+    }
+    return new readable_web_to_node_stream_1.ReadableWebToNodeStream(stream);
+}
+/**
+ * Creates a `tar-stream` that will get the necessary files from an npm Snap
+ * package tarball (`.tgz` file).
+ *
+ * @param canonicalBase - A base URI as specified in {@link https://github.com/MetaMask/SIPs/blob/main/SIPS/sip-8.md SIP-8}. Starting with 'npm:'. Will be used for canonicalPath vfile argument.
+ * @param files - An object to write target file contents to.
+ * @returns The {@link Writable} tarball extraction stream.
+ */
+function createTarballStream(canonicalBase, files) {
+    (0, utils_1.assert)(canonicalBase.endsWith('/'), "Base needs to end with '/' for relative paths to be added as children instead of siblings.");
+    (0, utils_1.assert)(canonicalBase.startsWith('npm:'), 'Protocol mismatch, expected "npm:".');
+    // `tar-stream` is pretty old-school, so we create it first and then
+    // instrument it by adding event listeners.
+    const extractStream = (0, tar_stream_1.extract)();
+    let totalSize = 0;
+    // "entry" is fired for every discreet entity in the tarball. This includes
+    // files and folders.
+    extractStream.on('entry', (header, entryStream, next) => {
+        const { name: headerName, type: headerType } = header;
+        if (headerType === 'file') {
+            // The name is a path if the header type is "file".
+            const path = headerName.replace(NPM_TARBALL_PATH_PREFIX, '');
+            return entryStream.pipe((0, concat_stream_1.default)({ encoding: 'uint8array' }, (data) => {
+                try {
+                    totalSize += data.byteLength;
+                    // To prevent zip bombs, we set a safety limit for the total size of tarballs.
+                    (0, utils_1.assert)(totalSize < exports.TARBALL_SIZE_SAFETY_LIMIT, `Snap tarball exceeds limit of ${exports.TARBALL_SIZE_SAFETY_LIMIT} bytes.`);
+                    const vfile = new snaps_utils_1.VirtualFile({
+                        value: data,
+                        path,
+                        data: {
+                            canonicalPath: new URL(path, canonicalBase).toString(),
+                        },
+                    });
+                    // We disallow files having identical paths as it may confuse our checksum calculations.
+                    (0, utils_1.assert)(!files.has(path), 'Malformed tarball, multiple files with the same path.');
+                    files.set(path, vfile);
+                    return next();
+                }
+                catch (error) {
+                    return extractStream.destroy(error);
+                }
+            }));
+        }
+        // If we get here, the entry is not a file, and we want to ignore. The entry
+        // stream must be drained, or the extractStream will stop reading. This is
+        // effectively a no-op for the current entry.
+        entryStream.on('end', () => next());
+        return entryStream.resume();
+    });
+    return extractStream;
+}
+//# sourceMappingURL=npm.cjs.map

package/dist/snaps/location/npm.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.cjs","sourceRoot":"","sources":["../../../src/snaps/location/npm.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AACA,uDAS+B;AAE/B,2CAMyB;AACzB,qDAA+C;AAC/C,kEAAmC;AACnC,8EAAmD;AACnD,qDAA2C;AAE3C,6EAAsE;AACtE,2CAAmD;AAItC,QAAA,oBAAoB,GAAG,IAAI,GAAG,CAAC,4BAA4B,CAAC,CAAC;AAuB1E,yFAAyF;AACzF,MAAsB,eAAe;IAOnC,YAAY,GAAQ,EAAE,OAAkC,EAAE;;QAJ1D,qDAA+C;QAE/C,yCAAkC;QAGhC,MAAM,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,IAAI,KAAK,CAAC;QAClE,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,IAAI,4CAA8B,CAAC;QAC3E,MAAM,cAAc,GAAG,KAAK,EAAE,KAAkB,EAAE,EAAE,CAAC,KAAK,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC;QAE7D,IAAA,oBAAY,EAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,6BAAe,EAAE,mBAAmB,CAAC,CAAC;QAEnE,IAAI,QAAsB,CAAC;QAC3B,IACE,GAAG,CAAC,IAAI,KAAK,EAAE;YACf,GAAG,CAAC,IAAI,KAAK,EAAE;YACf,GAAG,CAAC,QAAQ,KAAK,EAAE;YACnB,GAAG,CAAC,QAAQ,KAAK,EAAE,EACnB,CAAC;YACD,QAAQ,GAAG,4BAAoB,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,UAAU,CAAC;YACtB,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjB,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC;gBACzB,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;oBACjB,QAAQ,IAAI,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjC,CAAC;gBACD,QAAQ,IAAI,GAAG,CAAC;YAClB,CAAC;YACD,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC;YACrB,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,IAAA,cAAM,EACJ,qBAAqB,EACrB,IAAI,SAAS,CACX,qDAAqD,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAC7E,CACF,CAAC;QACJ,CAAC;QAED,IAAA,cAAM,EACJ,QAAQ,CAAC,QAAQ,KAAK,GAAG;YACvB,QAAQ,CAAC,MAAM,KAAK,EAAE;YACtB,QAAQ,CAAC,IAAI,KAAK,EAAE,CACvB,CAAC;QAEF,IAAA,cAAM,EACJ,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAC3C,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAC5D,CAAC;QACF,IAAI,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC/B,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,IAAI,GAAG;YACV,cAAc;YACd,QAAQ;YACR,WAAW;YACX,KAAK,EAAE,aAAa;YACpB,cAAc;SACf,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,uBAAA,IAAI,0CAAmB,EAAE,CAAC;YAC5B,OAAO,uBAAA,IAAI,0CAAmB,CAAC,KAAK,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAA,uBAAS,EAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3C,KAAK,CAAC,MAAM,GAAG,IAAA,gCAAkB,EAAC,MAAM,CAAC,CAAC;QAC1C,uBAAA,IAAI,sCAAsB,KAAkC,MAAA,CAAC;QAE7D,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY;QACtB,MAAM,YAAY,GAAG,IAAA,+BAAiB,EAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,uBAAA,IAAI,8BAAO,EAAE,CAAC;YACjB,MAAM,uBAAA,IAAI,6DAAU,MAAd,IAAI,CAAY,CAAC;YACvB,IAAA,cAAM,EAAC,uBAAA,IAAI,8BAAO,KAAK,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,KAAK,GAAG,uBAAA,IAAI,8BAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAA,cAAM,EACJ,KAAK,KAAK,SAAS,EACnB,IAAI,SAAS,CAAC,SAAS,IAAI,yBAAyB,CAAC,CACtD,CAAC;QACF,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;IAC/B,CAAC;IAED,IAAI,OAAO;QACT,IAAA,cAAM,EACJ,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,EAC/B,6DAA6D,CAC9D,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;IAC3B,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC5B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;IAClC,CAAC;CAwCF;AAxJD,0CAwJC;oKAtCC,KAAK;IACH,IAAA,cAAM,EAAC,uBAAA,IAAI,8BAAO,KAAK,SAAS,CAAC,CAAC;IAClC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CACpD,IAAI,CAAC,IAAI,CAAC,cAAc,CACzB,CAAC;IAEF,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,iBAAiB,CAC3D,IAAI,CAAC,IAAI,CAAC,WAAW,EACrB,eAAe,EACf,IAAI,CAAC,IAAI,CAAC,QAAQ,EAClB,IAAI,CAAC,IAAI,CAAC,KAAK,CAChB,CAAC;IAEF,IAAI,CAAC,IAAA,wBAAU,EAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,iEAAiE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAC3F,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1C,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACrD,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAErD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;IAExD,uBAAA,IAAI,0BAAU,KAAK,MAAA,CAAC;IACpB,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC;AACpC,CAAC;AAYH,6CAA6C;AAChC,QAAA,yBAAyB,GAAG,SAAS,CAAC;AAEnD,+EAA+E;AAC/E,MAAa,WAAY,SAAQ,eAAe;IAC9C;;;;;;OAMG;IACH,KAAK,CAAC,eAAe,CACnB,UAAe;QAEf,kEAAkE;QAClE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,wCAAwC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAClE,CAAC;QACJ,CAAC;QAED,2FAA2F;QAC3F,MAAM,iBAAiB,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACxE,IAAA,cAAM,EAAC,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,QAAQ,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACpD,IAAA,cAAM,EACJ,WAAW,IAAI,iCAAyB,EACxC,iCAAiC,CAClC,CAAC;QACF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAExB,MAAM,aAAa,GAAG,mBAAmB,CACvC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAClE,KAAK,CACN,CAAC;YAEF,oEAAoE;YACpE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAK,CAAC;YAEnC,4EAA4E;YAC5E,iDAAiD;YACjD,4EAA4E;YAE5E,uFAAuF;YACvF,IAAI,aAAa,IAAI,IAAI,IAAI,qBAAqB,IAAI,UAAU,EAAE,CAAC;gBACjE,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;gBAC5D,MAAM,kBAAkB,GAAG,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;gBAEjE,IAAA,0BAAQ,EACN,aAAa,CAAC,kBAAkB,CAAC,EACjC,aAAa,EACb,CAAC,KAAc,EAAE,EAAE;oBACjB,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACzC,CAAC,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAA,0BAAQ,EACN,aAAa,CAAC,IAAI,CAAC,EACnB,IAAA,8BAAY,GAAE,EACd,aAAa,EACb,CAAC,KAAc,EAAE,EAAE;gBACjB,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAnED,kCAmEC;AAOD;;;;;;;;;;GAUG;AACI,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,WAAgB,EAChB,aAA2B;IAE3B,MAAM,eAAe,GAAG,MAAM,aAAa,CACzC,IAAI,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,EAC5C;QACE,OAAO,EAAE;YACP,gGAAgG;YAChG,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC;gBACxB,CAAC,CAAC,0EAA0E;gBAC5E,CAAC,CAAC,kBAAkB;SACvB;KACF,CACF,CAAC;IACF,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,oDAAoD,eAAe,CAAC,MAAM,GAAG,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,CAAC;IAErD,IAAI,CAAC,IAAA,gBAAQ,EAAC,eAAe,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,4BAA4B,WAAW,sBAAsB,CAC9D,CAAC;IACJ,CAAC;IAED,OAAO,eAAqC,CAAC;AAC/C,CAAC;AA9BD,4CA8BC;AAED;;;;;;GAMG;AACH,SAAgB,uBAAuB,CAAC,WAAgB,EAAE,WAAmB;IAC3E,IAAI,aAAa,GAAG,QAAQ,CAAC;IAC7B,IAAI,WAAW,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAChC,aAAa,IAAI,WAAW,CAAC,QAAQ,CAAC;QACtC,IAAI,WAAW,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAChC,aAAa,IAAI,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC9C,CAAC;QACD,aAAa,IAAI,GAAG,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,aAAa,GAAG,WAAW,CAAC,IAAI,IAAI,WAAW,GAAG,CAAC;AAC/D,CAAC;AAVD,0DAUC;AAED;;;;;GAKG;AACH,SAAS,KAAK,CAAC,WAAgB;IAC7B,OAAO,WAAW,CAAC,QAAQ,EAAE,KAAK,4BAAoB,CAAC,QAAQ,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,iBAAiB,CAC9B,WAAmB,EACnB,YAAyB,EACzB,WAAgB,EAChB,aAA2B;IAE3B,2FAA2F;IAC3F,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,IAAA,4BAAoB,EAAC,YAAY,CAAC,EAAE,CAAC;QAC7D,OAAO;YACL,UAAU,EAAE,IAAA,6BAAgB,EAAC,WAAW,EAAE,YAAY,CAAC;YACvD,aAAa,EAAE,YAAY;SAC5B,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAC5C,WAAW,EACX,WAAW,EACX,aAAa,CACd,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAC/D,CAAC,OAAO,EAAE,EAAE;QACV,IAAA,6BAAqB,EAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;IAEF,MAAM,aAAa,GAAG,IAAA,8BAAgB,EAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAE/D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,kEAAkE,WAAW,iCAAiC,YAAY,IAAI,CAC/H,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC;IAE7E,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAE9C;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,MAAsB;IAC3C,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QAC3C,OAAO,MAA6B,CAAC;IACvC,CAAC;IAED,OAAO,IAAI,qDAAuB,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,aAAqB,EACrB,KAA+B;IAE/B,IAAA,cAAM,EACJ,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC3B,4FAA4F,CAC7F,CAAC;IAEF,IAAA,cAAM,EACJ,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,EAChC,qCAAqC,CACtC,CAAC;IACF,oEAAoE;IACpE,2CAA2C;IAC3C,MAAM,aAAa,GAAG,IAAA,oBAAU,GAAE,CAAC;IAEnC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,2EAA2E;IAC3E,qBAAqB;IACrB,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;QACtD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;QACtD,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,mDAAmD;YACnD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;YAC7D,OAAO,WAAW,CAAC,IAAI,CACrB,IAAA,uBAAM,EAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC1C,IAAI,CAAC;oBACH,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC;oBAC7B,8EAA8E;oBAC9E,IAAA,cAAM,EACJ,SAAS,GAAG,iCAAyB,EACrC,iCAAiC,iCAAyB,SAAS,CACpE,CAAC;oBACF,MAAM,KAAK,GAAG,IAAI,yBAAW,CAAC;wBAC5B,KAAK,EAAE,IAAI;wBACX,IAAI;wBACJ,IAAI,EAAE;4BACJ,aAAa,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE;yBACvD;qBACF,CAAC,CAAC;oBACH,wFAAwF;oBACxF,IAAA,cAAM,EACJ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAChB,uDAAuD,CACxD,CAAC;oBACF,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBACvB,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC,CAAC,CACH,CAAC;QACJ,CAAC;QAED,4EAA4E;QAC5E,0EAA0E;QAC1E,6CAA6C;QAC7C,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACpC,OAAO,WAAW,CAAC,MAAM,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,OAAO,aAAyB,CAAC;AACnC,CAAC","sourcesContent":["import type { SnapManifest } from '@metamask/snaps-utils';\nimport {\n  createSnapManifest,\n  DEFAULT_REQUESTED_SNAP_VERSION,\n  getTargetVersion,\n  isValidUrl,\n  NpmSnapIdStruct,\n  VirtualFile,\n  normalizeRelative,\n  parseJson,\n} from '@metamask/snaps-utils';\nimport type { SemVerRange, SemVerVersion } from '@metamask/utils';\nimport {\n  assert,\n  assertIsSemVerVersion,\n  assertStruct,\n  isObject,\n  isValidSemVerVersion,\n} from '@metamask/utils';\nimport { createGunzip } from 'browserify-zlib';\nimport concat from 'concat-stream';\nimport getNpmTarballUrl from 'get-npm-tarball-url';\nimport { pipeline } from 'readable-stream';\nimport type { Readable, Writable } from 'readable-stream';\nimport { ReadableWebToNodeStream } from 'readable-web-to-node-stream';\nimport { extract as tarExtract } from 'tar-stream';\n\nimport type { DetectSnapLocationOptions, SnapLocation } from './location';\n\nexport const DEFAULT_NPM_REGISTRY = new URL('https://registry.npmjs.org');\n\ninterface NpmMeta {\n  registry: URL;\n  packageName: string;\n  requestedRange: SemVerRange;\n  version?: string;\n  fetch: typeof fetch;\n  resolveVersion: (range: SemVerRange) => Promise<SemVerRange>;\n}\nexport interface NpmOptions {\n  /**\n   * @default DEFAULT_REQUESTED_SNAP_VERSION\n   */\n  versionRange?: SemVerRange;\n  /**\n   * Whether to allow custom NPM registries outside of {@link DEFAULT_NPM_REGISTRY}.\n   *\n   * @default false\n   */\n  allowCustomRegistries?: boolean;\n}\n\n// Base class for NPM implementation, useful for extending with custom NPM fetching logic\nexport abstract class BaseNpmLocation implements SnapLocation {\n  protected readonly meta: NpmMeta;\n\n  #validatedManifest?: VirtualFile<SnapManifest>;\n\n  #files?: Map<string, VirtualFile>;\n\n  constructor(url: URL, opts: DetectSnapLocationOptions = {}) {\n    const allowCustomRegistries = opts.allowCustomRegistries ?? false;\n    const fetchFunction = opts.fetch ?? globalThis.fetch.bind(undefined);\n    const requestedRange = opts.versionRange ?? DEFAULT_REQUESTED_SNAP_VERSION;\n    const defaultResolve = async (range: SemVerRange) => range;\n    const resolveVersion = opts.resolveVersion ?? defaultResolve;\n\n    assertStruct(url.toString(), NpmSnapIdStruct, 'Invalid Snap Id: ');\n\n    let registry: string | URL;\n    if (\n      url.host === '' &&\n      url.port === '' &&\n      url.username === '' &&\n      url.password === ''\n    ) {\n      registry = DEFAULT_NPM_REGISTRY;\n    } else {\n      registry = 'https://';\n      if (url.username) {\n        registry += url.username;\n        if (url.password) {\n          registry += `:${url.password}`;\n        }\n        registry += '@';\n      }\n      registry += url.host;\n      registry = new URL(registry);\n      assert(\n        allowCustomRegistries,\n        new TypeError(\n          `Custom NPM registries are disabled, tried to use \"${registry.toString()}\".`,\n        ),\n      );\n    }\n\n    assert(\n      registry.pathname === '/' &&\n        registry.search === '' &&\n        registry.hash === '',\n    );\n\n    assert(\n      url.pathname !== '' && url.pathname !== '/',\n      new TypeError('The package name in NPM location is empty.'),\n    );\n    let packageName = url.pathname;\n    if (packageName.startsWith('/')) {\n      packageName = packageName.slice(1);\n    }\n\n    this.meta = {\n      requestedRange,\n      registry,\n      packageName,\n      fetch: fetchFunction,\n      resolveVersion,\n    };\n  }\n\n  async manifest(): Promise<VirtualFile<SnapManifest>> {\n    if (this.#validatedManifest) {\n      return this.#validatedManifest.clone();\n    }\n\n    const vfile = await this.fetch('snap.manifest.json');\n    const result = parseJson(vfile.toString());\n    vfile.result = createSnapManifest(result);\n    this.#validatedManifest = vfile as VirtualFile<SnapManifest>;\n\n    return this.manifest();\n  }\n\n  async fetch(path: string): Promise<VirtualFile> {\n    const relativePath = normalizeRelative(path);\n    if (!this.#files) {\n      await this.#lazyInit();\n      assert(this.#files !== undefined);\n    }\n    const vfile = this.#files.get(relativePath);\n    assert(\n      vfile !== undefined,\n      new TypeError(`File \"${path}\" not found in package.`),\n    );\n    return vfile.clone();\n  }\n\n  get packageName(): string {\n    return this.meta.packageName;\n  }\n\n  get version(): string {\n    assert(\n      this.meta.version !== undefined,\n      'Tried to access version without first fetching NPM package.',\n    );\n    return this.meta.version;\n  }\n\n  get registry(): URL {\n    return this.meta.registry;\n  }\n\n  get versionRange(): SemVerRange {\n    return this.meta.requestedRange;\n  }\n\n  async #lazyInit() {\n    assert(this.#files === undefined);\n    const resolvedVersion = await this.meta.resolveVersion(\n      this.meta.requestedRange,\n    );\n\n    const { tarballURL, targetVersion } = await resolveNpmVersion(\n      this.meta.packageName,\n      resolvedVersion,\n      this.meta.registry,\n      this.meta.fetch,\n    );\n\n    if (!isValidUrl(tarballURL) || !tarballURL.toString().endsWith('.tgz')) {\n      throw new Error(\n        `Failed to find valid tarball URL in NPM metadata for package \"${this.meta.packageName}\".`,\n      );\n    }\n\n    // Override the tarball hostname/protocol with registryUrl hostname/protocol\n    const newTarballUrl = new URL(tarballURL);\n    newTarballUrl.hostname = this.meta.registry.hostname;\n    newTarballUrl.protocol = this.meta.registry.protocol;\n\n    const files = await this.fetchNpmTarball(newTarballUrl);\n\n    this.#files = files;\n    this.meta.version = targetVersion;\n  }\n\n  /**\n   * Fetches and unpacks the tarball (`.tgz` file) from the specified URL.\n   *\n   * @param tarballUrl - The tarball URL to fetch and unpack.\n   * @returns A the files for the package tarball.\n   * @throws If fetching the tarball fails.\n   */\n  abstract fetchNpmTarball(tarballUrl: URL): Promise<Map<string, VirtualFile>>;\n}\n\n// Safety limit for tarballs, 250 MB in bytes\nexport const TARBALL_SIZE_SAFETY_LIMIT = 262144000;\n\n// Main NPM implementation, contains a browser tarball fetching implementation.\nexport class NpmLocation extends BaseNpmLocation {\n  /**\n   * Fetches and unpacks the tarball (`.tgz` file) from the specified URL.\n   *\n   * @param tarballUrl - The tarball URL to fetch and unpack.\n   * @returns A the files for the package tarball.\n   * @throws If fetching the tarball fails.\n   */\n  async fetchNpmTarball(\n    tarballUrl: URL,\n  ): Promise<Map<string, VirtualFile<unknown>>> {\n    // Perform a raw fetch because we want the Response object itself.\n    const tarballResponse = await this.meta.fetch(tarballUrl.toString());\n    if (!tarballResponse.ok || !tarballResponse.body) {\n      throw new Error(\n        `Failed to fetch tarball for package \"${this.meta.packageName}\".`,\n      );\n    }\n\n    // We assume that NPM is a good actor and provides us with a valid `content-length` header.\n    const tarballSizeString = tarballResponse.headers.get('content-length');\n    assert(tarballSizeString, 'Snap tarball has invalid content-length');\n    const tarballSize = parseInt(tarballSizeString, 10);\n    assert(\n      tarballSize <= TARBALL_SIZE_SAFETY_LIMIT,\n      'Snap tarball exceeds size limit',\n    );\n    return new Promise((resolve, reject) => {\n      const files = new Map();\n\n      const tarballStream = createTarballStream(\n        getNpmCanonicalBasePath(this.meta.registry, this.meta.packageName),\n        files,\n      );\n\n      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n      const body = tarballResponse.body!;\n\n      // The \"gz\" in \"tgz\" stands for \"gzip\". The tarball needs to be decompressed\n      // before we can actually grab any files from it.\n      // To prevent recursion-based zip bombs, we should not allow recursion here.\n\n      // If native decompression stream is available we use that, otherwise fallback to zlib.\n      if ('pipeThrough' in body && 'DecompressionStream' in globalThis) {\n        const decompressionStream = new DecompressionStream('gzip');\n        const decompressedStream = body.pipeThrough(decompressionStream);\n\n        pipeline(\n          getNodeStream(decompressedStream),\n          tarballStream,\n          (error: unknown) => {\n            error ? reject(error) : resolve(files);\n          },\n        );\n        return;\n      }\n\n      pipeline(\n        getNodeStream(body),\n        createGunzip(),\n        tarballStream,\n        (error: unknown) => {\n          error ? reject(error) : resolve(files);\n        },\n      );\n    });\n  }\n}\n\n// Incomplete type\nexport type PartialNpmMetadata = {\n  versions: Record<string, { dist: { tarball: string } }>;\n};\n\n/**\n * Fetches the NPM metadata of the specified package from\n * the public npm registry.\n *\n * @param packageName - The name of the package whose metadata to fetch.\n * @param registryUrl - The URL of the npm registry to fetch the metadata from.\n * @param fetchFunction - The fetch function to use. Defaults to the global\n * {@link fetch}. Useful for Node.js compatibility.\n * @returns The NPM metadata object.\n * @throws If fetching the metadata fails.\n */\nexport async function fetchNpmMetadata(\n  packageName: string,\n  registryUrl: URL,\n  fetchFunction: typeof fetch,\n): Promise<PartialNpmMetadata> {\n  const packageResponse = await fetchFunction(\n    new URL(packageName, registryUrl).toString(),\n    {\n      headers: {\n        // Corgi format is slightly smaller: https://github.com/npm/pacote/blob/main/lib/registry.js#L71\n        accept: isNPM(registryUrl)\n          ? 'application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*'\n          : 'application/json',\n      },\n    },\n  );\n  if (!packageResponse.ok) {\n    throw new Error(\n      `Failed to fetch NPM registry entry. Status code: ${packageResponse.status}.`,\n    );\n  }\n  const packageMetadata = await packageResponse.json();\n\n  if (!isObject(packageMetadata)) {\n    throw new Error(\n      `Failed to fetch package \"${packageName}\" metadata from npm.`,\n    );\n  }\n\n  return packageMetadata as PartialNpmMetadata;\n}\n\n/**\n * Gets the canonical base path for an NPM snap.\n *\n * @param registryUrl - A registry URL.\n * @param packageName - A package name.\n * @returns The canonical base path.\n */\nexport function getNpmCanonicalBasePath(registryUrl: URL, packageName: string) {\n  let canonicalBase = 'npm://';\n  if (registryUrl.username !== '') {\n    canonicalBase += registryUrl.username;\n    if (registryUrl.password !== '') {\n      canonicalBase += `:${registryUrl.password}`;\n    }\n    canonicalBase += '@';\n  }\n  return `${canonicalBase}${registryUrl.host}/${packageName}/`;\n}\n\n/**\n * Determine if a registry URL is NPM.\n *\n * @param registryUrl - A registry url.\n * @returns True if the registry is the NPM registry, otherwise false.\n */\nfunction isNPM(registryUrl: URL) {\n  return registryUrl.toString() === DEFAULT_NPM_REGISTRY.toString();\n}\n\n/**\n * Resolves a version range to a version using the NPM registry.\n *\n * Unless the version range is already a version, then the NPM registry is skipped.\n *\n * @param packageName - The name of the package whose metadata to fetch.\n * @param versionRange - The version range of the package.\n * @param registryUrl - The URL of the npm registry to fetch the metadata from.\n * @param fetchFunction - The fetch function to use. Defaults to the global\n * {@link fetch}. Useful for Node.js compatibility.\n * @returns An object containing the resolved version and a URL for its tarball.\n * @throws If fetching the metadata fails.\n */\nasync function resolveNpmVersion(\n  packageName: string,\n  versionRange: SemVerRange,\n  registryUrl: URL,\n  fetchFunction: typeof fetch,\n): Promise<{ tarballURL: string; targetVersion: SemVerVersion }> {\n  // If the version range is already a static version we don't need to look for the metadata.\n  if (isNPM(registryUrl) && isValidSemVerVersion(versionRange)) {\n    return {\n      tarballURL: getNpmTarballUrl(packageName, versionRange),\n      targetVersion: versionRange,\n    };\n  }\n\n  const packageMetadata = await fetchNpmMetadata(\n    packageName,\n    registryUrl,\n    fetchFunction,\n  );\n\n  const versions = Object.keys(packageMetadata?.versions ?? {}).map(\n    (version) => {\n      assertIsSemVerVersion(version);\n      return version;\n    },\n  );\n\n  const targetVersion = getTargetVersion(versions, versionRange);\n\n  if (targetVersion === null) {\n    throw new Error(\n      `Failed to find a matching version in npm metadata for package \"${packageName}\" and requested semver range \"${versionRange}\".`,\n    );\n  }\n\n  const tarballURL = packageMetadata?.versions?.[targetVersion]?.dist?.tarball;\n\n  return { tarballURL, targetVersion };\n}\n\n/**\n * The paths of files within npm tarballs appear to always be prefixed with\n * \"package/\".\n */\nconst NPM_TARBALL_PATH_PREFIX = /^package\\//u;\n\n/**\n * Converts a {@link ReadableStream} to a Node.js {@link Readable}\n * stream. Returns the stream directly if it is already a Node.js stream.\n * We can't use the native Web {@link ReadableStream} directly because the\n * other stream libraries we use expect Node.js streams.\n *\n * @param stream - The stream to convert.\n * @returns The given stream as a Node.js Readable stream.\n */\nfunction getNodeStream(stream: ReadableStream): Readable {\n  if (typeof stream.getReader !== 'function') {\n    return stream as unknown as Readable;\n  }\n\n  return new ReadableWebToNodeStream(stream);\n}\n\n/**\n * Creates a `tar-stream` that will get the necessary files from an npm Snap\n * package tarball (`.tgz` file).\n *\n * @param canonicalBase - A base URI as specified in {@link https://github.com/MetaMask/SIPs/blob/main/SIPS/sip-8.md SIP-8}. Starting with 'npm:'. Will be used for canonicalPath vfile argument.\n * @param files - An object to write target file contents to.\n * @returns The {@link Writable} tarball extraction stream.\n */\nfunction createTarballStream(\n  canonicalBase: string,\n  files: Map<string, VirtualFile>,\n): Writable {\n  assert(\n    canonicalBase.endsWith('/'),\n    \"Base needs to end with '/' for relative paths to be added as children instead of siblings.\",\n  );\n\n  assert(\n    canonicalBase.startsWith('npm:'),\n    'Protocol mismatch, expected \"npm:\".',\n  );\n  // `tar-stream` is pretty old-school, so we create it first and then\n  // instrument it by adding event listeners.\n  const extractStream = tarExtract();\n\n  let totalSize = 0;\n\n  // \"entry\" is fired for every discreet entity in the tarball. This includes\n  // files and folders.\n  extractStream.on('entry', (header, entryStream, next) => {\n    const { name: headerName, type: headerType } = header;\n    if (headerType === 'file') {\n      // The name is a path if the header type is \"file\".\n      const path = headerName.replace(NPM_TARBALL_PATH_PREFIX, '');\n      return entryStream.pipe(\n        concat({ encoding: 'uint8array' }, (data) => {\n          try {\n            totalSize += data.byteLength;\n            // To prevent zip bombs, we set a safety limit for the total size of tarballs.\n            assert(\n              totalSize < TARBALL_SIZE_SAFETY_LIMIT,\n              `Snap tarball exceeds limit of ${TARBALL_SIZE_SAFETY_LIMIT} bytes.`,\n            );\n            const vfile = new VirtualFile({\n              value: data,\n              path,\n              data: {\n                canonicalPath: new URL(path, canonicalBase).toString(),\n              },\n            });\n            // We disallow files having identical paths as it may confuse our checksum calculations.\n            assert(\n              !files.has(path),\n              'Malformed tarball, multiple files with the same path.',\n            );\n            files.set(path, vfile);\n            return next();\n          } catch (error) {\n            return extractStream.destroy(error);\n          }\n        }),\n      );\n    }\n\n    // If we get here, the entry is not a file, and we want to ignore. The entry\n    // stream must be drained, or the extractStream will stop reading. This is\n    // effectively a no-op for the current entry.\n    entryStream.on('end', () => next());\n    return entryStream.resume();\n  });\n  return extractStream as Writable;\n}\n"]}

package/dist/{types/snaps/location/npm.d.ts → snaps/location/npm.d.cts}

@@ -1,7 +1,7 @@
-import type { SnapManifest } from '@metamask/snaps-utils';
-import { VirtualFile } from '@metamask/snaps-utils';
-import type { SemVerRange } from '@metamask/utils';
-import type { DetectSnapLocationOptions, SnapLocation } from './location';
+import type { SnapManifest } from "@metamask/snaps-utils";
+import { VirtualFile } from "@metamask/snaps-utils";
+import type { SemVerRange } from "@metamask/utils";
+import type { DetectSnapLocationOptions, SnapLocation } from "./location.cjs";
 export declare const DEFAULT_NPM_REGISTRY: URL;
 interface NpmMeta {
     registry: URL;
@@ -81,3 +81,4 @@ export declare function fetchNpmMetadata(packageName: string, registryUrl: URL,
  */
 export declare function getNpmCanonicalBasePath(registryUrl: URL, packageName: string): string;
 export {};
+//# sourceMappingURL=npm.d.cts.map

package/dist/snaps/location/npm.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.d.cts","sourceRoot":"","sources":["../../../src/snaps/location/npm.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B;AAC1D,OAAO,EAML,WAAW,EAGZ,8BAA8B;AAC/B,OAAO,KAAK,EAAE,WAAW,EAAiB,wBAAwB;AAgBlE,OAAO,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,uBAAmB;AAE1E,eAAO,MAAM,oBAAoB,KAAwC,CAAC;AAE1E,UAAU,OAAO;IACf,QAAQ,EAAE,GAAG,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,WAAW,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,cAAc,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CAC9D;AACD,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAGD,8BAAsB,eAAgB,YAAW,YAAY;;IAC3D,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;gBAMrB,GAAG,EAAE,GAAG,EAAE,IAAI,GAAE,yBAA8B;IA4DpD,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAa9C,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAc/C,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,OAAO,IAAI,MAAM,CAMpB;IAED,IAAI,QAAQ,IAAI,GAAG,CAElB;IAED,IAAI,YAAY,IAAI,WAAW,CAE9B;IAgCD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,UAAU,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC7E;AAGD,eAAO,MAAM,yBAAyB,YAAY,CAAC;AAGnD,qBAAa,WAAY,SAAQ,eAAe;IAC9C;;;;;;OAMG;IACG,eAAe,CACnB,UAAU,EAAE,GAAG,GACd,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;CAyD9C;AAGD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,GAAG,EAChB,aAAa,EAAE,OAAO,KAAK,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,UAU5E"}

package/dist/snaps/location/npm.d.mts

@@ -0,0 +1,84 @@
+import type { SnapManifest } from "@metamask/snaps-utils";
+import { VirtualFile } from "@metamask/snaps-utils";
+import type { SemVerRange } from "@metamask/utils";
+import type { DetectSnapLocationOptions, SnapLocation } from "./location.mjs";
+export declare const DEFAULT_NPM_REGISTRY: URL;
+interface NpmMeta {
+    registry: URL;
+    packageName: string;
+    requestedRange: SemVerRange;
+    version?: string;
+    fetch: typeof fetch;
+    resolveVersion: (range: SemVerRange) => Promise<SemVerRange>;
+}
+export interface NpmOptions {
+    /**
+     * @default DEFAULT_REQUESTED_SNAP_VERSION
+     */
+    versionRange?: SemVerRange;
+    /**
+     * Whether to allow custom NPM registries outside of {@link DEFAULT_NPM_REGISTRY}.
+     *
+     * @default false
+     */
+    allowCustomRegistries?: boolean;
+}
+export declare abstract class BaseNpmLocation implements SnapLocation {
+    #private;
+    protected readonly meta: NpmMeta;
+    constructor(url: URL, opts?: DetectSnapLocationOptions);
+    manifest(): Promise<VirtualFile<SnapManifest>>;
+    fetch(path: string): Promise<VirtualFile>;
+    get packageName(): string;
+    get version(): string;
+    get registry(): URL;
+    get versionRange(): SemVerRange;
+    /**
+     * Fetches and unpacks the tarball (`.tgz` file) from the specified URL.
+     *
+     * @param tarballUrl - The tarball URL to fetch and unpack.
+     * @returns A the files for the package tarball.
+     * @throws If fetching the tarball fails.
+     */
+    abstract fetchNpmTarball(tarballUrl: URL): Promise<Map<string, VirtualFile>>;
+}
+export declare const TARBALL_SIZE_SAFETY_LIMIT = 262144000;
+export declare class NpmLocation extends BaseNpmLocation {
+    /**
+     * Fetches and unpacks the tarball (`.tgz` file) from the specified URL.
+     *
+     * @param tarballUrl - The tarball URL to fetch and unpack.
+     * @returns A the files for the package tarball.
+     * @throws If fetching the tarball fails.
+     */
+    fetchNpmTarball(tarballUrl: URL): Promise<Map<string, VirtualFile<unknown>>>;
+}
+export type PartialNpmMetadata = {
+    versions: Record<string, {
+        dist: {
+            tarball: string;
+        };
+    }>;
+};
+/**
+ * Fetches the NPM metadata of the specified package from
+ * the public npm registry.
+ *
+ * @param packageName - The name of the package whose metadata to fetch.
+ * @param registryUrl - The URL of the npm registry to fetch the metadata from.
+ * @param fetchFunction - The fetch function to use. Defaults to the global
+ * {@link fetch}. Useful for Node.js compatibility.
+ * @returns The NPM metadata object.
+ * @throws If fetching the metadata fails.
+ */
+export declare function fetchNpmMetadata(packageName: string, registryUrl: URL, fetchFunction: typeof fetch): Promise<PartialNpmMetadata>;
+/**
+ * Gets the canonical base path for an NPM snap.
+ *
+ * @param registryUrl - A registry URL.
+ * @param packageName - A package name.
+ * @returns The canonical base path.
+ */
+export declare function getNpmCanonicalBasePath(registryUrl: URL, packageName: string): string;
+export {};
+//# sourceMappingURL=npm.d.mts.map

package/dist/snaps/location/npm.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.d.mts","sourceRoot":"","sources":["../../../src/snaps/location/npm.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B;AAC1D,OAAO,EAML,WAAW,EAGZ,8BAA8B;AAC/B,OAAO,KAAK,EAAE,WAAW,EAAiB,wBAAwB;AAgBlE,OAAO,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,uBAAmB;AAE1E,eAAO,MAAM,oBAAoB,KAAwC,CAAC;AAE1E,UAAU,OAAO;IACf,QAAQ,EAAE,GAAG,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,WAAW,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,cAAc,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CAC9D;AACD,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAGD,8BAAsB,eAAgB,YAAW,YAAY;;IAC3D,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;gBAMrB,GAAG,EAAE,GAAG,EAAE,IAAI,GAAE,yBAA8B;IA4DpD,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAa9C,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAc/C,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,OAAO,IAAI,MAAM,CAMpB;IAED,IAAI,QAAQ,IAAI,GAAG,CAElB;IAED,IAAI,YAAY,IAAI,WAAW,CAE9B;IAgCD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,UAAU,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC7E;AAGD,eAAO,MAAM,yBAAyB,YAAY,CAAC;AAGnD,qBAAa,WAAY,SAAQ,eAAe;IAC9C;;;;;;OAMG;IACG,eAAe,CACnB,UAAU,EAAE,GAAG,GACd,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;CAyD9C;AAGD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;CACzD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,GAAG,EAChB,aAAa,EAAE,OAAO,KAAK,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,UAU5E"}