@metamask/snaps-rpc-methods 11.0.0 → 11.1.0

package/dist/restricted/caveats/permittedCoinTypes.cjs

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermittedCoinTypesCaveatSpecification = exports.validateBIP44Caveat = exports.validateBIP44Params = exports.permittedCoinTypesCaveatMapper = void 0;
+const rpc_errors_1 = require("@metamask/rpc-errors");
+const snaps_utils_1 = require("@metamask/snaps-utils");
+const utils_1 = require("@metamask/utils");
+/**
+ * Map a raw value from the `initialPermissions` to a caveat specification.
+ * Note that this function does not do any validation, that's handled by the
+ * PermissionsController when the permission is requested.
+ *
+ * @param value - The raw value from the `initialPermissions`.
+ * @returns The caveat specification.
+ */
+function permittedCoinTypesCaveatMapper(value) {
+    return {
+        caveats: [
+            {
+                type: snaps_utils_1.SnapCaveatType.PermittedCoinTypes,
+                value,
+            },
+        ],
+    };
+}
+exports.permittedCoinTypesCaveatMapper = permittedCoinTypesCaveatMapper;
+/**
+ * Validate the params for `snap_getBip44Entropy`.
+ *
+ * @param value - The params to validate.
+ * @throws If the params are invalid.
+ */
+function validateBIP44Params(value) {
+    if (!(0, utils_1.isPlainObject)(value) || !(0, utils_1.hasProperty)(value, 'coinType')) {
+        throw rpc_errors_1.rpcErrors.invalidParams({
+            message: 'Expected a plain object containing a coin type.',
+        });
+    }
+    if (typeof value.coinType !== 'number' ||
+        !Number.isInteger(value.coinType) ||
+        value.coinType < 0 ||
+        value.coinType > 0x7fffffff) {
+        throw rpc_errors_1.rpcErrors.invalidParams({
+            message: 'Invalid "coinType" parameter. Coin type must be a non-negative integer.',
+        });
+    }
+    if (snaps_utils_1.FORBIDDEN_COIN_TYPES.includes(value.coinType)) {
+        throw rpc_errors_1.rpcErrors.invalidParams({
+            message: `Coin type ${value.coinType} is forbidden.`,
+        });
+    }
+}
+exports.validateBIP44Params = validateBIP44Params;
+/**
+ * Validate the coin types values associated with a caveat. This checks if the
+ * values are non-negative integers (>= 0).
+ *
+ * @param caveat - The caveat to validate.
+ * @throws If the caveat is invalid.
+ */
+function validateBIP44Caveat(caveat) {
+    if (!(0, utils_1.hasProperty)(caveat, 'value') ||
+        !Array.isArray(caveat.value) ||
+        caveat.value.length === 0) {
+        throw rpc_errors_1.rpcErrors.invalidParams({
+            message: 'Expected non-empty array of coin types.',
+        });
+    }
+    caveat.value.forEach(validateBIP44Params);
+}
+exports.validateBIP44Caveat = validateBIP44Caveat;
+exports.PermittedCoinTypesCaveatSpecification = {
+    [snaps_utils_1.SnapCaveatType.PermittedCoinTypes]: Object.freeze({
+        type: snaps_utils_1.SnapCaveatType.PermittedCoinTypes,
+        decorator: (method, caveat) => {
+            return async (args) => {
+                const { params } = args;
+                validateBIP44Params(params);
+                const coinType = caveat.value.find((caveatValue) => caveatValue.coinType === params.coinType);
+                if (!coinType) {
+                    throw rpc_errors_1.providerErrors.unauthorized({
+                        message: 'The requested coin type is not permitted. Allowed coin types must be specified in the snap manifest.',
+                    });
+                }
+                return await method(args);
+            };
+        },
+        validator: (caveat) => validateBIP44Caveat(caveat),
+    }),
+};
+//# sourceMappingURL=permittedCoinTypes.cjs.map

package/dist/restricted/caveats/permittedCoinTypes.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"permittedCoinTypes.cjs","sourceRoot":"","sources":["../../../src/restricted/caveats/permittedCoinTypes.ts"],"names":[],"mappings":";;;AAKA,qDAAiE;AAEjE,uDAA6E;AAE7E,2CAA6D;AAE7D;;;;;;;GAOG;AACH,SAAgB,8BAA8B,CAC5C,KAAW;IAEX,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,4BAAc,CAAC,kBAAkB;gBACvC,KAAK;aACN;SACF;KACF,CAAC;AACJ,CAAC;AAXD,wEAWC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,KAAc;IAEd,IAAI,CAAC,IAAA,qBAAa,EAAC,KAAK,CAAC,IAAI,CAAC,IAAA,mBAAW,EAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,MAAM,sBAAS,CAAC,aAAa,CAAC;YAC5B,OAAO,EAAE,iDAAiD;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,IACE,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;QACjC,KAAK,CAAC,QAAQ,GAAG,CAAC;QAClB,KAAK,CAAC,QAAQ,GAAG,UAAU,EAC3B,CAAC;QACD,MAAM,sBAAS,CAAC,aAAa,CAAC;YAC5B,OAAO,EACL,yEAAyE;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,kCAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,MAAM,sBAAS,CAAC,aAAa,CAAC;YAC5B,OAAO,EAAE,aAAa,KAAK,CAAC,QAAQ,gBAAgB;SACrD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AA1BD,kDA0BC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,MAA2B;IAC7D,IACE,CAAC,IAAA,mBAAW,EAAC,MAAM,EAAE,OAAO,CAAC;QAC7B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EACzB,CAAC;QACD,MAAM,sBAAS,CAAC,aAAa,CAAC;YAC5B,OAAO,EAAE,yCAAyC;SACnD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC5C,CAAC;AAZD,kDAYC;AAEY,QAAA,qCAAqC,GAG9C;IACF,CAAC,4BAAc,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,IAAI,EAAE,4BAAc,CAAC,kBAAkB;QACvC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YAC5B,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;gBACxB,mBAAmB,CAAC,MAAM,CAAC,CAAC;gBAE5B,MAAM,QAAQ,GAAI,MAAM,CAAC,KAAiC,CAAC,IAAI,CAC7D,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAC1D,CAAC;gBAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,2BAAc,CAAC,YAAY,CAAC;wBAChC,OAAO,EACL,sGAAsG;qBACzG,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC,CAAC;QACJ,CAAC;QACD,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;KACnD,CAAC;CACH,CAAC","sourcesContent":["import type {\n  PermissionConstraint,\n  RestrictedMethodCaveatSpecificationConstraint,\n  Caveat,\n} from '@metamask/permission-controller';\nimport { providerErrors, rpcErrors } from '@metamask/rpc-errors';\nimport type { GetBip44EntropyParams } from '@metamask/snaps-sdk';\nimport { FORBIDDEN_COIN_TYPES, SnapCaveatType } from '@metamask/snaps-utils';\nimport type { Json } from '@metamask/utils';\nimport { hasProperty, isPlainObject } from '@metamask/utils';\n\n/**\n * Map a raw value from the `initialPermissions` to a caveat specification.\n * Note that this function does not do any validation, that's handled by the\n * PermissionsController when the permission is requested.\n *\n * @param value - The raw value from the `initialPermissions`.\n * @returns The caveat specification.\n */\nexport function permittedCoinTypesCaveatMapper(\n  value: Json,\n): Pick<PermissionConstraint, 'caveats'> {\n  return {\n    caveats: [\n      {\n        type: SnapCaveatType.PermittedCoinTypes,\n        value,\n      },\n    ],\n  };\n}\n\n/**\n * Validate the params for `snap_getBip44Entropy`.\n *\n * @param value - The params to validate.\n * @throws If the params are invalid.\n */\nexport function validateBIP44Params(\n  value: unknown,\n): asserts value is GetBip44EntropyParams {\n  if (!isPlainObject(value) || !hasProperty(value, 'coinType')) {\n    throw rpcErrors.invalidParams({\n      message: 'Expected a plain object containing a coin type.',\n    });\n  }\n\n  if (\n    typeof value.coinType !== 'number' ||\n    !Number.isInteger(value.coinType) ||\n    value.coinType < 0 ||\n    value.coinType > 0x7fffffff\n  ) {\n    throw rpcErrors.invalidParams({\n      message:\n        'Invalid \"coinType\" parameter. Coin type must be a non-negative integer.',\n    });\n  }\n\n  if (FORBIDDEN_COIN_TYPES.includes(value.coinType)) {\n    throw rpcErrors.invalidParams({\n      message: `Coin type ${value.coinType} is forbidden.`,\n    });\n  }\n}\n\n/**\n * Validate the coin types values associated with a caveat. This checks if the\n * values are non-negative integers (>= 0).\n *\n * @param caveat - The caveat to validate.\n * @throws If the caveat is invalid.\n */\nexport function validateBIP44Caveat(caveat: Caveat<string, any>) {\n  if (\n    !hasProperty(caveat, 'value') ||\n    !Array.isArray(caveat.value) ||\n    caveat.value.length === 0\n  ) {\n    throw rpcErrors.invalidParams({\n      message: 'Expected non-empty array of coin types.',\n    });\n  }\n\n  caveat.value.forEach(validateBIP44Params);\n}\n\nexport const PermittedCoinTypesCaveatSpecification: Record<\n  SnapCaveatType.PermittedCoinTypes,\n  RestrictedMethodCaveatSpecificationConstraint\n> = {\n  [SnapCaveatType.PermittedCoinTypes]: Object.freeze({\n    type: SnapCaveatType.PermittedCoinTypes,\n    decorator: (method, caveat) => {\n      return async (args) => {\n        const { params } = args;\n        validateBIP44Params(params);\n\n        const coinType = (caveat.value as GetBip44EntropyParams[]).find(\n          (caveatValue) => caveatValue.coinType === params.coinType,\n        );\n\n        if (!coinType) {\n          throw providerErrors.unauthorized({\n            message:\n              'The requested coin type is not permitted. Allowed coin types must be specified in the snap manifest.',\n          });\n        }\n\n        return await method(args);\n      };\n    },\n    validator: (caveat) => validateBIP44Caveat(caveat),\n  }),\n};\n"]}

package/dist/{types/restricted/caveats/permittedCoinTypes.d.ts → restricted/caveats/permittedCoinTypes.d.cts}

@@ -1,7 +1,7 @@
-import type { PermissionConstraint, RestrictedMethodCaveatSpecificationConstraint, Caveat } from '@metamask/permission-controller';
-import type { GetBip44EntropyParams } from '@metamask/snaps-sdk';
-import { SnapCaveatType } from '@metamask/snaps-utils';
-import type { Json } from '@metamask/utils';
+import type { PermissionConstraint, RestrictedMethodCaveatSpecificationConstraint, Caveat } from "@metamask/permission-controller";
+import type { GetBip44EntropyParams } from "@metamask/snaps-sdk";
+import { SnapCaveatType } from "@metamask/snaps-utils";
+import type { Json } from "@metamask/utils";
 /**
  * Map a raw value from the `initialPermissions` to a caveat specification.
  * Note that this function does not do any validation, that's handled by the
@@ -27,3 +27,4 @@ export declare function validateBIP44Params(value: unknown): asserts value is Ge
  */
 export declare function validateBIP44Caveat(caveat: Caveat<string, any>): void;
 export declare const PermittedCoinTypesCaveatSpecification: Record<SnapCaveatType.PermittedCoinTypes, RestrictedMethodCaveatSpecificationConstraint>;
+//# sourceMappingURL=permittedCoinTypes.d.cts.map

package/dist/restricted/caveats/permittedCoinTypes.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permittedCoinTypes.d.cts","sourceRoot":"","sources":["../../../src/restricted/caveats/permittedCoinTypes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,6CAA6C,EAC7C,MAAM,EACP,wCAAwC;AAEzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,4BAA4B;AACjE,OAAO,EAAwB,cAAc,EAAE,8BAA8B;AAC7E,OAAO,KAAK,EAAE,IAAI,EAAE,wBAAwB;AAG5C;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,IAAI,GACV,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,CASvC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,KAAK,IAAI,qBAAqB,CAwBxC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAY9D;AAED,eAAO,MAAM,qCAAqC,EAAE,MAAM,CACxD,cAAc,CAAC,kBAAkB,EACjC,6CAA6C,CAyB9C,CAAC"}

package/dist/restricted/caveats/permittedCoinTypes.d.mts

@@ -0,0 +1,30 @@
+import type { PermissionConstraint, RestrictedMethodCaveatSpecificationConstraint, Caveat } from "@metamask/permission-controller";
+import type { GetBip44EntropyParams } from "@metamask/snaps-sdk";
+import { SnapCaveatType } from "@metamask/snaps-utils";
+import type { Json } from "@metamask/utils";
+/**
+ * Map a raw value from the `initialPermissions` to a caveat specification.
+ * Note that this function does not do any validation, that's handled by the
+ * PermissionsController when the permission is requested.
+ *
+ * @param value - The raw value from the `initialPermissions`.
+ * @returns The caveat specification.
+ */
+export declare function permittedCoinTypesCaveatMapper(value: Json): Pick<PermissionConstraint, 'caveats'>;
+/**
+ * Validate the params for `snap_getBip44Entropy`.
+ *
+ * @param value - The params to validate.
+ * @throws If the params are invalid.
+ */
+export declare function validateBIP44Params(value: unknown): asserts value is GetBip44EntropyParams;
+/**
+ * Validate the coin types values associated with a caveat. This checks if the
+ * values are non-negative integers (>= 0).
+ *
+ * @param caveat - The caveat to validate.
+ * @throws If the caveat is invalid.
+ */
+export declare function validateBIP44Caveat(caveat: Caveat<string, any>): void;
+export declare const PermittedCoinTypesCaveatSpecification: Record<SnapCaveatType.PermittedCoinTypes, RestrictedMethodCaveatSpecificationConstraint>;
+//# sourceMappingURL=permittedCoinTypes.d.mts.map

package/dist/restricted/caveats/permittedCoinTypes.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permittedCoinTypes.d.mts","sourceRoot":"","sources":["../../../src/restricted/caveats/permittedCoinTypes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,6CAA6C,EAC7C,MAAM,EACP,wCAAwC;AAEzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,4BAA4B;AACjE,OAAO,EAAwB,cAAc,EAAE,8BAA8B;AAC7E,OAAO,KAAK,EAAE,IAAI,EAAE,wBAAwB;AAG5C;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,IAAI,GACV,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,CASvC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,KAAK,IAAI,qBAAqB,CAwBxC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAY9D;AAED,eAAO,MAAM,qCAAqC,EAAE,MAAM,CACxD,cAAc,CAAC,kBAAkB,EACjC,6CAA6C,CAyB9C,CAAC"}

package/dist/restricted/caveats/permittedCoinTypes.mjs

@@ -1,13 +1,84 @@
-import {
-  PermittedCoinTypesCaveatSpecification,
-  permittedCoinTypesCaveatMapper,
-  validateBIP44Caveat,
-  validateBIP44Params
-} from "../../chunk-PIAWDTWO.mjs";
-export {
-  PermittedCoinTypesCaveatSpecification,
-  permittedCoinTypesCaveatMapper,
-  validateBIP44Caveat,
-  validateBIP44Params
+import { providerErrors, rpcErrors } from "@metamask/rpc-errors";
+import { FORBIDDEN_COIN_TYPES, SnapCaveatType } from "@metamask/snaps-utils";
+import { hasProperty, isPlainObject } from "@metamask/utils";
+/**
+ * Map a raw value from the `initialPermissions` to a caveat specification.
+ * Note that this function does not do any validation, that's handled by the
+ * PermissionsController when the permission is requested.
+ *
+ * @param value - The raw value from the `initialPermissions`.
+ * @returns The caveat specification.
+ */
+export function permittedCoinTypesCaveatMapper(value) {
+    return {
+        caveats: [
+            {
+                type: SnapCaveatType.PermittedCoinTypes,
+                value,
+            },
+        ],
+    };
+}
+/**
+ * Validate the params for `snap_getBip44Entropy`.
+ *
+ * @param value - The params to validate.
+ * @throws If the params are invalid.
+ */
+export function validateBIP44Params(value) {
+    if (!isPlainObject(value) || !hasProperty(value, 'coinType')) {
+        throw rpcErrors.invalidParams({
+            message: 'Expected a plain object containing a coin type.',
+        });
+    }
+    if (typeof value.coinType !== 'number' ||
+        !Number.isInteger(value.coinType) ||
+        value.coinType < 0 ||
+        value.coinType > 0x7fffffff) {
+        throw rpcErrors.invalidParams({
+            message: 'Invalid "coinType" parameter. Coin type must be a non-negative integer.',
+        });
+    }
+    if (FORBIDDEN_COIN_TYPES.includes(value.coinType)) {
+        throw rpcErrors.invalidParams({
+            message: `Coin type ${value.coinType} is forbidden.`,
+        });
+    }
+}
+/**
+ * Validate the coin types values associated with a caveat. This checks if the
+ * values are non-negative integers (>= 0).
+ *
+ * @param caveat - The caveat to validate.
+ * @throws If the caveat is invalid.
+ */
+export function validateBIP44Caveat(caveat) {
+    if (!hasProperty(caveat, 'value') ||
+        !Array.isArray(caveat.value) ||
+        caveat.value.length === 0) {
+        throw rpcErrors.invalidParams({
+            message: 'Expected non-empty array of coin types.',
+        });
+    }
+    caveat.value.forEach(validateBIP44Params);
+}
+export const PermittedCoinTypesCaveatSpecification = {
+    [SnapCaveatType.PermittedCoinTypes]: Object.freeze({
+        type: SnapCaveatType.PermittedCoinTypes,
+        decorator: (method, caveat) => {
+            return async (args) => {
+                const { params } = args;
+                validateBIP44Params(params);
+                const coinType = caveat.value.find((caveatValue) => caveatValue.coinType === params.coinType);
+                if (!coinType) {
+                    throw providerErrors.unauthorized({
+                        message: 'The requested coin type is not permitted. Allowed coin types must be specified in the snap manifest.',
+                    });
+                }
+                return await method(args);
+            };
+        },
+        validator: (caveat) => validateBIP44Caveat(caveat),
+    }),
 };
 //# sourceMappingURL=permittedCoinTypes.mjs.map

package/dist/restricted/caveats/permittedCoinTypes.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"file":"permittedCoinTypes.mjs","sourceRoot":"","sources":["../../../src/restricted/caveats/permittedCoinTypes.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,6BAA6B;AAEjE,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,8BAA8B;AAE7E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,wBAAwB;AAE7D;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAAW;IAEX,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,cAAc,CAAC,kBAAkB;gBACvC,KAAK;aACN;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAc;IAEd,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7D,MAAM,SAAS,CAAC,aAAa,CAAC;YAC5B,OAAO,EAAE,iDAAiD;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,IACE,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;QACjC,KAAK,CAAC,QAAQ,GAAG,CAAC;QAClB,KAAK,CAAC,QAAQ,GAAG,UAAU,EAC3B,CAAC;QACD,MAAM,SAAS,CAAC,aAAa,CAAC;YAC5B,OAAO,EACL,yEAAyE;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,MAAM,SAAS,CAAC,aAAa,CAAC;YAC5B,OAAO,EAAE,aAAa,KAAK,CAAC,QAAQ,gBAAgB;SACrD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA2B;IAC7D,IACE,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC;QAC7B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EACzB,CAAC;QACD,MAAM,SAAS,CAAC,aAAa,CAAC;YAC5B,OAAO,EAAE,yCAAyC;SACnD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,MAAM,qCAAqC,GAG9C;IACF,CAAC,cAAc,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,IAAI,EAAE,cAAc,CAAC,kBAAkB;QACvC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YAC5B,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;gBACxB,mBAAmB,CAAC,MAAM,CAAC,CAAC;gBAE5B,MAAM,QAAQ,GAAI,MAAM,CAAC,KAAiC,CAAC,IAAI,CAC7D,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAC1D,CAAC;gBAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,cAAc,CAAC,YAAY,CAAC;wBAChC,OAAO,EACL,sGAAsG;qBACzG,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC,CAAC;QACJ,CAAC;QACD,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;KACnD,CAAC;CACH,CAAC","sourcesContent":["import type {\n  PermissionConstraint,\n  RestrictedMethodCaveatSpecificationConstraint,\n  Caveat,\n} from '@metamask/permission-controller';\nimport { providerErrors, rpcErrors } from '@metamask/rpc-errors';\nimport type { GetBip44EntropyParams } from '@metamask/snaps-sdk';\nimport { FORBIDDEN_COIN_TYPES, SnapCaveatType } from '@metamask/snaps-utils';\nimport type { Json } from '@metamask/utils';\nimport { hasProperty, isPlainObject } from '@metamask/utils';\n\n/**\n * Map a raw value from the `initialPermissions` to a caveat specification.\n * Note that this function does not do any validation, that's handled by the\n * PermissionsController when the permission is requested.\n *\n * @param value - The raw value from the `initialPermissions`.\n * @returns The caveat specification.\n */\nexport function permittedCoinTypesCaveatMapper(\n  value: Json,\n): Pick<PermissionConstraint, 'caveats'> {\n  return {\n    caveats: [\n      {\n        type: SnapCaveatType.PermittedCoinTypes,\n        value,\n      },\n    ],\n  };\n}\n\n/**\n * Validate the params for `snap_getBip44Entropy`.\n *\n * @param value - The params to validate.\n * @throws If the params are invalid.\n */\nexport function validateBIP44Params(\n  value: unknown,\n): asserts value is GetBip44EntropyParams {\n  if (!isPlainObject(value) || !hasProperty(value, 'coinType')) {\n    throw rpcErrors.invalidParams({\n      message: 'Expected a plain object containing a coin type.',\n    });\n  }\n\n  if (\n    typeof value.coinType !== 'number' ||\n    !Number.isInteger(value.coinType) ||\n    value.coinType < 0 ||\n    value.coinType > 0x7fffffff\n  ) {\n    throw rpcErrors.invalidParams({\n      message:\n        'Invalid \"coinType\" parameter. Coin type must be a non-negative integer.',\n    });\n  }\n\n  if (FORBIDDEN_COIN_TYPES.includes(value.coinType)) {\n    throw rpcErrors.invalidParams({\n      message: `Coin type ${value.coinType} is forbidden.`,\n    });\n  }\n}\n\n/**\n * Validate the coin types values associated with a caveat. This checks if the\n * values are non-negative integers (>= 0).\n *\n * @param caveat - The caveat to validate.\n * @throws If the caveat is invalid.\n */\nexport function validateBIP44Caveat(caveat: Caveat<string, any>) {\n  if (\n    !hasProperty(caveat, 'value') ||\n    !Array.isArray(caveat.value) ||\n    caveat.value.length === 0\n  ) {\n    throw rpcErrors.invalidParams({\n      message: 'Expected non-empty array of coin types.',\n    });\n  }\n\n  caveat.value.forEach(validateBIP44Params);\n}\n\nexport const PermittedCoinTypesCaveatSpecification: Record<\n  SnapCaveatType.PermittedCoinTypes,\n  RestrictedMethodCaveatSpecificationConstraint\n> = {\n  [SnapCaveatType.PermittedCoinTypes]: Object.freeze({\n    type: SnapCaveatType.PermittedCoinTypes,\n    decorator: (method, caveat) => {\n      return async (args) => {\n        const { params } = args;\n        validateBIP44Params(params);\n\n        const coinType = (caveat.value as GetBip44EntropyParams[]).find(\n          (caveatValue) => caveatValue.coinType === params.coinType,\n        );\n\n        if (!coinType) {\n          throw providerErrors.unauthorized({\n            message:\n              'The requested coin type is not permitted. Allowed coin types must be specified in the snap manifest.',\n          });\n        }\n\n        return await method(args);\n      };\n    },\n    validator: (caveat) => validateBIP44Caveat(caveat),\n  }),\n};\n"]}

package/dist/restricted/caveats/permittedDerivationPaths.cjs

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermittedDerivationPathsCaveatSpecification = exports.validateBIP32CaveatPaths = exports.validateBIP32Path = exports.permittedDerivationPathsCaveatMapper = void 0;
+const rpc_errors_1 = require("@metamask/rpc-errors");
+const snaps_utils_1 = require("@metamask/snaps-utils");
+const superstruct_1 = require("@metamask/superstruct");
+const utils_1 = require("@metamask/utils");
+/**
+ * Map a raw value from the `initialPermissions` to a caveat specification.
+ * Note that this function does not do any validation, that's handled by the
+ * PermissionsController when the permission is requested.
+ *
+ * @param value - The raw value from the `initialPermissions`.
+ * @returns The caveat specification.
+ */
+function permittedDerivationPathsCaveatMapper(value) {
+    return {
+        caveats: [
+            {
+                type: snaps_utils_1.SnapCaveatType.PermittedDerivationPaths,
+                value,
+            },
+        ],
+    };
+}
+exports.permittedDerivationPathsCaveatMapper = permittedDerivationPathsCaveatMapper;
+/**
+ * Validate a caveat path object. The object must consist of a `path` array and
+ * a `curve` string. Paths must start with `m`, and must contain at
+ * least two indices. If `ed25519` is used, this checks if all the path indices
+ * are hardened.
+ *
+ * @param value - The value to validate.
+ * @throws If the value is invalid.
+ */
+function validateBIP32Path(value) {
+    (0, utils_1.assertStruct)(value, snaps_utils_1.Bip32EntropyStruct, 'Invalid BIP-32 entropy path definition', rpc_errors_1.rpcErrors.invalidParams);
+}
+exports.validateBIP32Path = validateBIP32Path;
+/**
+ * Validate the path values associated with a caveat. This validates that the
+ * value is a non-empty array with valid derivation paths and curves.
+ *
+ * @param caveat - The caveat to validate.
+ * @throws If the value is invalid.
+ */
+function validateBIP32CaveatPaths(caveat) {
+    (0, utils_1.assertStruct)(caveat, (0, superstruct_1.type)({ value: (0, superstruct_1.size)((0, superstruct_1.array)(snaps_utils_1.Bip32EntropyStruct), 1, Infinity) }), 'Invalid BIP-32 entropy caveat', rpc_errors_1.rpcErrors.internal);
+}
+exports.validateBIP32CaveatPaths = validateBIP32CaveatPaths;
+exports.PermittedDerivationPathsCaveatSpecification = {
+    [snaps_utils_1.SnapCaveatType.PermittedDerivationPaths]: Object.freeze({
+        type: snaps_utils_1.SnapCaveatType.PermittedDerivationPaths,
+        decorator: (method, caveat) => {
+            return async (args) => {
+                const { params } = args;
+                validateBIP32Path(params);
+                const path = caveat.value.find((caveatPath) => (0, snaps_utils_1.isEqual)(params.path.slice(0, caveatPath.path.length), caveatPath.path) && caveatPath.curve === params.curve);
+                if (!path) {
+                    throw rpc_errors_1.providerErrors.unauthorized({
+                        message: 'The requested path is not permitted. Allowed paths must be specified in the snap manifest.',
+                    });
+                }
+                return await method(args);
+            };
+        },
+        validator: (caveat) => validateBIP32CaveatPaths(caveat),
+    }),
+};
+//# sourceMappingURL=permittedDerivationPaths.cjs.map

package/dist/restricted/caveats/permittedDerivationPaths.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"permittedDerivationPaths.cjs","sourceRoot":"","sources":["../../../src/restricted/caveats/permittedDerivationPaths.ts"],"names":[],"mappings":";;;AAKA,qDAAiE;AAEjE,uDAI+B;AAC/B,uDAA0D;AAE1D,2CAA+C;AAE/C;;;;;;;GAOG;AACH,SAAgB,oCAAoC,CAClD,KAAW;IAEX,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,4BAAc,CAAC,wBAAwB;gBAC7C,KAAK;aACN;SACF;KACF,CAAC;AACJ,CAAC;AAXD,oFAWC;AAED;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAC/B,KAAc;IAEd,IAAA,oBAAY,EACV,KAAK,EACL,gCAAkB,EAClB,wCAAwC,EACxC,sBAAS,CAAC,aAAa,CACxB,CAAC;AACJ,CAAC;AATD,8CASC;AAED;;;;;;GAMG;AACH,SAAgB,wBAAwB,CACtC,MAA2B;IAE3B,IAAA,oBAAY,EACV,MAAM,EACN,IAAA,kBAAI,EAAC,EAAE,KAAK,EAAE,IAAA,kBAAI,EAAC,IAAA,mBAAK,EAAC,gCAAkB,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,EAC7D,+BAA+B,EAC/B,sBAAS,CAAC,QAAQ,CACnB,CAAC;AACJ,CAAC;AATD,4DASC;AAEY,QAAA,2CAA2C,GAGpD;IACF,CAAC,4BAAc,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QACvD,IAAI,EAAE,4BAAc,CAAC,wBAAwB;QAC7C,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YAC5B,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;gBACxB,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBAE1B,MAAM,IAAI,GAAI,MAAM,CAAC,KAAwB,CAAC,IAAI,CAChD,CAAC,UAAU,EAAE,EAAE,CACb,IAAA,qBAAO,EACL,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAC5C,UAAU,CAAC,IAAI,CAChB,IAAI,UAAU,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CACzC,CAAC;gBAEF,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,MAAM,2BAAc,CAAC,YAAY,CAAC;wBAChC,OAAO,EACL,4FAA4F;qBAC/F,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC,CAAC;QACJ,CAAC;QACD,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC;KACxD,CAAC;CACH,CAAC","sourcesContent":["import type {\n  Caveat,\n  PermissionConstraint,\n  RestrictedMethodCaveatSpecificationConstraint,\n} from '@metamask/permission-controller';\nimport { providerErrors, rpcErrors } from '@metamask/rpc-errors';\nimport type { Bip32Entropy } from '@metamask/snaps-utils';\nimport {\n  SnapCaveatType,\n  Bip32EntropyStruct,\n  isEqual,\n} from '@metamask/snaps-utils';\nimport { array, size, type } from '@metamask/superstruct';\nimport type { Json } from '@metamask/utils';\nimport { assertStruct } from '@metamask/utils';\n\n/**\n * Map a raw value from the `initialPermissions` to a caveat specification.\n * Note that this function does not do any validation, that's handled by the\n * PermissionsController when the permission is requested.\n *\n * @param value - The raw value from the `initialPermissions`.\n * @returns The caveat specification.\n */\nexport function permittedDerivationPathsCaveatMapper(\n  value: Json,\n): Pick<PermissionConstraint, 'caveats'> {\n  return {\n    caveats: [\n      {\n        type: SnapCaveatType.PermittedDerivationPaths,\n        value,\n      },\n    ],\n  };\n}\n\n/**\n * Validate a caveat path object. The object must consist of a `path` array and\n * a `curve` string. Paths must start with `m`, and must contain at\n * least two indices. If `ed25519` is used, this checks if all the path indices\n * are hardened.\n *\n * @param value - The value to validate.\n * @throws If the value is invalid.\n */\nexport function validateBIP32Path(\n  value: unknown,\n): asserts value is Bip32Entropy {\n  assertStruct(\n    value,\n    Bip32EntropyStruct,\n    'Invalid BIP-32 entropy path definition',\n    rpcErrors.invalidParams,\n  );\n}\n\n/**\n * Validate the path values associated with a caveat. This validates that the\n * value is a non-empty array with valid derivation paths and curves.\n *\n * @param caveat - The caveat to validate.\n * @throws If the value is invalid.\n */\nexport function validateBIP32CaveatPaths(\n  caveat: Caveat<string, any>,\n): asserts caveat is Caveat<string, Bip32Entropy[]> {\n  assertStruct(\n    caveat,\n    type({ value: size(array(Bip32EntropyStruct), 1, Infinity) }),\n    'Invalid BIP-32 entropy caveat',\n    rpcErrors.internal,\n  );\n}\n\nexport const PermittedDerivationPathsCaveatSpecification: Record<\n  SnapCaveatType.PermittedDerivationPaths,\n  RestrictedMethodCaveatSpecificationConstraint\n> = {\n  [SnapCaveatType.PermittedDerivationPaths]: Object.freeze({\n    type: SnapCaveatType.PermittedDerivationPaths,\n    decorator: (method, caveat) => {\n      return async (args) => {\n        const { params } = args;\n        validateBIP32Path(params);\n\n        const path = (caveat.value as Bip32Entropy[]).find(\n          (caveatPath) =>\n            isEqual(\n              params.path.slice(0, caveatPath.path.length),\n              caveatPath.path,\n            ) && caveatPath.curve === params.curve,\n        );\n\n        if (!path) {\n          throw providerErrors.unauthorized({\n            message:\n              'The requested path is not permitted. Allowed paths must be specified in the snap manifest.',\n          });\n        }\n\n        return await method(args);\n      };\n    },\n    validator: (caveat) => validateBIP32CaveatPaths(caveat),\n  }),\n};\n"]}

package/dist/{types/restricted/caveats/permittedDerivationPaths.d.ts → restricted/caveats/permittedDerivationPaths.d.cts}

@@ -1,7 +1,7 @@
-import type { Caveat, PermissionConstraint, RestrictedMethodCaveatSpecificationConstraint } from '@metamask/permission-controller';
-import type { Bip32Entropy } from '@metamask/snaps-utils';
-import { SnapCaveatType } from '@metamask/snaps-utils';
-import type { Json } from '@metamask/utils';
+import type { Caveat, PermissionConstraint, RestrictedMethodCaveatSpecificationConstraint } from "@metamask/permission-controller";
+import type { Bip32Entropy } from "@metamask/snaps-utils";
+import { SnapCaveatType } from "@metamask/snaps-utils";
+import type { Json } from "@metamask/utils";
 /**
  * Map a raw value from the `initialPermissions` to a caveat specification.
  * Note that this function does not do any validation, that's handled by the
@@ -30,3 +30,4 @@ export declare function validateBIP32Path(value: unknown): asserts value is Bip3
  */
 export declare function validateBIP32CaveatPaths(caveat: Caveat<string, any>): asserts caveat is Caveat<string, Bip32Entropy[]>;
 export declare const PermittedDerivationPathsCaveatSpecification: Record<SnapCaveatType.PermittedDerivationPaths, RestrictedMethodCaveatSpecificationConstraint>;
+//# sourceMappingURL=permittedDerivationPaths.d.cts.map

package/dist/restricted/caveats/permittedDerivationPaths.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permittedDerivationPaths.d.cts","sourceRoot":"","sources":["../../../src/restricted/caveats/permittedDerivationPaths.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EACN,oBAAoB,EACpB,6CAA6C,EAC9C,wCAAwC;AAEzC,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B;AAC1D,OAAO,EACL,cAAc,EAGf,8BAA8B;AAE/B,OAAO,KAAK,EAAE,IAAI,EAAE,wBAAwB;AAG5C;;;;;;;GAOG;AACH,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,IAAI,GACV,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,CASvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,KAAK,IAAI,YAAY,CAO/B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAOlD;AAED,eAAO,MAAM,2CAA2C,EAAE,MAAM,CAC9D,cAAc,CAAC,wBAAwB,EACvC,6CAA6C,CA6B9C,CAAC"}

package/dist/restricted/caveats/permittedDerivationPaths.d.mts

@@ -0,0 +1,33 @@
+import type { Caveat, PermissionConstraint, RestrictedMethodCaveatSpecificationConstraint } from "@metamask/permission-controller";
+import type { Bip32Entropy } from "@metamask/snaps-utils";
+import { SnapCaveatType } from "@metamask/snaps-utils";
+import type { Json } from "@metamask/utils";
+/**
+ * Map a raw value from the `initialPermissions` to a caveat specification.
+ * Note that this function does not do any validation, that's handled by the
+ * PermissionsController when the permission is requested.
+ *
+ * @param value - The raw value from the `initialPermissions`.
+ * @returns The caveat specification.
+ */
+export declare function permittedDerivationPathsCaveatMapper(value: Json): Pick<PermissionConstraint, 'caveats'>;
+/**
+ * Validate a caveat path object. The object must consist of a `path` array and
+ * a `curve` string. Paths must start with `m`, and must contain at
+ * least two indices. If `ed25519` is used, this checks if all the path indices
+ * are hardened.
+ *
+ * @param value - The value to validate.
+ * @throws If the value is invalid.
+ */
+export declare function validateBIP32Path(value: unknown): asserts value is Bip32Entropy;
+/**
+ * Validate the path values associated with a caveat. This validates that the
+ * value is a non-empty array with valid derivation paths and curves.
+ *
+ * @param caveat - The caveat to validate.
+ * @throws If the value is invalid.
+ */
+export declare function validateBIP32CaveatPaths(caveat: Caveat<string, any>): asserts caveat is Caveat<string, Bip32Entropy[]>;
+export declare const PermittedDerivationPathsCaveatSpecification: Record<SnapCaveatType.PermittedDerivationPaths, RestrictedMethodCaveatSpecificationConstraint>;
+//# sourceMappingURL=permittedDerivationPaths.d.mts.map

package/dist/restricted/caveats/permittedDerivationPaths.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permittedDerivationPaths.d.mts","sourceRoot":"","sources":["../../../src/restricted/caveats/permittedDerivationPaths.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EACN,oBAAoB,EACpB,6CAA6C,EAC9C,wCAAwC;AAEzC,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B;AAC1D,OAAO,EACL,cAAc,EAGf,8BAA8B;AAE/B,OAAO,KAAK,EAAE,IAAI,EAAE,wBAAwB;AAG5C;;;;;;;GAOG;AACH,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,IAAI,GACV,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,CASvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,KAAK,IAAI,YAAY,CAO/B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAOlD;AAED,eAAO,MAAM,2CAA2C,EAAE,MAAM,CAC9D,cAAc,CAAC,wBAAwB,EACvC,6CAA6C,CA6B9C,CAAC"}

package/dist/restricted/caveats/permittedDerivationPaths.mjs

@@ -1,13 +1,64 @@
-import {
-  PermittedDerivationPathsCaveatSpecification,
-  permittedDerivationPathsCaveatMapper,
-  validateBIP32CaveatPaths,
-  validateBIP32Path
-} from "../../chunk-I2P65KBQ.mjs";
-export {
-  PermittedDerivationPathsCaveatSpecification,
-  permittedDerivationPathsCaveatMapper,
-  validateBIP32CaveatPaths,
-  validateBIP32Path
+import { providerErrors, rpcErrors } from "@metamask/rpc-errors";
+import { SnapCaveatType, Bip32EntropyStruct, isEqual } from "@metamask/snaps-utils";
+import { array, size, type } from "@metamask/superstruct";
+import { assertStruct } from "@metamask/utils";
+/**
+ * Map a raw value from the `initialPermissions` to a caveat specification.
+ * Note that this function does not do any validation, that's handled by the
+ * PermissionsController when the permission is requested.
+ *
+ * @param value - The raw value from the `initialPermissions`.
+ * @returns The caveat specification.
+ */
+export function permittedDerivationPathsCaveatMapper(value) {
+    return {
+        caveats: [
+            {
+                type: SnapCaveatType.PermittedDerivationPaths,
+                value,
+            },
+        ],
+    };
+}
+/**
+ * Validate a caveat path object. The object must consist of a `path` array and
+ * a `curve` string. Paths must start with `m`, and must contain at
+ * least two indices. If `ed25519` is used, this checks if all the path indices
+ * are hardened.
+ *
+ * @param value - The value to validate.
+ * @throws If the value is invalid.
+ */
+export function validateBIP32Path(value) {
+    assertStruct(value, Bip32EntropyStruct, 'Invalid BIP-32 entropy path definition', rpcErrors.invalidParams);
+}
+/**
+ * Validate the path values associated with a caveat. This validates that the
+ * value is a non-empty array with valid derivation paths and curves.
+ *
+ * @param caveat - The caveat to validate.
+ * @throws If the value is invalid.
+ */
+export function validateBIP32CaveatPaths(caveat) {
+    assertStruct(caveat, type({ value: size(array(Bip32EntropyStruct), 1, Infinity) }), 'Invalid BIP-32 entropy caveat', rpcErrors.internal);
+}
+export const PermittedDerivationPathsCaveatSpecification = {
+    [SnapCaveatType.PermittedDerivationPaths]: Object.freeze({
+        type: SnapCaveatType.PermittedDerivationPaths,
+        decorator: (method, caveat) => {
+            return async (args) => {
+                const { params } = args;
+                validateBIP32Path(params);
+                const path = caveat.value.find((caveatPath) => isEqual(params.path.slice(0, caveatPath.path.length), caveatPath.path) && caveatPath.curve === params.curve);
+                if (!path) {
+                    throw providerErrors.unauthorized({
+                        message: 'The requested path is not permitted. Allowed paths must be specified in the snap manifest.',
+                    });
+                }
+                return await method(args);
+            };
+        },
+        validator: (caveat) => validateBIP32CaveatPaths(caveat),
+    }),
 };
 //# sourceMappingURL=permittedDerivationPaths.mjs.map

package/dist/restricted/caveats/permittedDerivationPaths.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"file":"permittedDerivationPaths.mjs","sourceRoot":"","sources":["../../../src/restricted/caveats/permittedDerivationPaths.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,6BAA6B;AAEjE,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,OAAO,EACR,8BAA8B;AAC/B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,8BAA8B;AAE1D,OAAO,EAAE,YAAY,EAAE,wBAAwB;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,oCAAoC,CAClD,KAAW;IAEX,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,cAAc,CAAC,wBAAwB;gBAC7C,KAAK;aACN;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAc;IAEd,YAAY,CACV,KAAK,EACL,kBAAkB,EAClB,wCAAwC,EACxC,SAAS,CAAC,aAAa,CACxB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAA2B;IAE3B,YAAY,CACV,MAAM,EACN,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,EAC7D,+BAA+B,EAC/B,SAAS,CAAC,QAAQ,CACnB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,2CAA2C,GAGpD;IACF,CAAC,cAAc,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QACvD,IAAI,EAAE,cAAc,CAAC,wBAAwB;QAC7C,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YAC5B,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;gBACxB,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBAE1B,MAAM,IAAI,GAAI,MAAM,CAAC,KAAwB,CAAC,IAAI,CAChD,CAAC,UAAU,EAAE,EAAE,CACb,OAAO,CACL,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAC5C,UAAU,CAAC,IAAI,CAChB,IAAI,UAAU,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CACzC,CAAC;gBAEF,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,MAAM,cAAc,CAAC,YAAY,CAAC;wBAChC,OAAO,EACL,4FAA4F;qBAC/F,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC,CAAC;QACJ,CAAC;QACD,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC;KACxD,CAAC;CACH,CAAC","sourcesContent":["import type {\n  Caveat,\n  PermissionConstraint,\n  RestrictedMethodCaveatSpecificationConstraint,\n} from '@metamask/permission-controller';\nimport { providerErrors, rpcErrors } from '@metamask/rpc-errors';\nimport type { Bip32Entropy } from '@metamask/snaps-utils';\nimport {\n  SnapCaveatType,\n  Bip32EntropyStruct,\n  isEqual,\n} from '@metamask/snaps-utils';\nimport { array, size, type } from '@metamask/superstruct';\nimport type { Json } from '@metamask/utils';\nimport { assertStruct } from '@metamask/utils';\n\n/**\n * Map a raw value from the `initialPermissions` to a caveat specification.\n * Note that this function does not do any validation, that's handled by the\n * PermissionsController when the permission is requested.\n *\n * @param value - The raw value from the `initialPermissions`.\n * @returns The caveat specification.\n */\nexport function permittedDerivationPathsCaveatMapper(\n  value: Json,\n): Pick<PermissionConstraint, 'caveats'> {\n  return {\n    caveats: [\n      {\n        type: SnapCaveatType.PermittedDerivationPaths,\n        value,\n      },\n    ],\n  };\n}\n\n/**\n * Validate a caveat path object. The object must consist of a `path` array and\n * a `curve` string. Paths must start with `m`, and must contain at\n * least two indices. If `ed25519` is used, this checks if all the path indices\n * are hardened.\n *\n * @param value - The value to validate.\n * @throws If the value is invalid.\n */\nexport function validateBIP32Path(\n  value: unknown,\n): asserts value is Bip32Entropy {\n  assertStruct(\n    value,\n    Bip32EntropyStruct,\n    'Invalid BIP-32 entropy path definition',\n    rpcErrors.invalidParams,\n  );\n}\n\n/**\n * Validate the path values associated with a caveat. This validates that the\n * value is a non-empty array with valid derivation paths and curves.\n *\n * @param caveat - The caveat to validate.\n * @throws If the value is invalid.\n */\nexport function validateBIP32CaveatPaths(\n  caveat: Caveat<string, any>,\n): asserts caveat is Caveat<string, Bip32Entropy[]> {\n  assertStruct(\n    caveat,\n    type({ value: size(array(Bip32EntropyStruct), 1, Infinity) }),\n    'Invalid BIP-32 entropy caveat',\n    rpcErrors.internal,\n  );\n}\n\nexport const PermittedDerivationPathsCaveatSpecification: Record<\n  SnapCaveatType.PermittedDerivationPaths,\n  RestrictedMethodCaveatSpecificationConstraint\n> = {\n  [SnapCaveatType.PermittedDerivationPaths]: Object.freeze({\n    type: SnapCaveatType.PermittedDerivationPaths,\n    decorator: (method, caveat) => {\n      return async (args) => {\n        const { params } = args;\n        validateBIP32Path(params);\n\n        const path = (caveat.value as Bip32Entropy[]).find(\n          (caveatPath) =>\n            isEqual(\n              params.path.slice(0, caveatPath.path.length),\n              caveatPath.path,\n            ) && caveatPath.curve === params.curve,\n        );\n\n        if (!path) {\n          throw providerErrors.unauthorized({\n            message:\n              'The requested path is not permitted. Allowed paths must be specified in the snap manifest.',\n          });\n        }\n\n        return await method(args);\n      };\n    },\n    validator: (caveat) => validateBIP32CaveatPaths(caveat),\n  }),\n};\n"]}

package/dist/restricted/caveats/snapIds.cjs

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SnapIdsCaveatSpecification = exports.validateSnapIdsCaveat = exports.snapIdsCaveatMapper = void 0;
+const rpc_errors_1 = require("@metamask/rpc-errors");
+const snaps_utils_1 = require("@metamask/snaps-utils");
+const superstruct_1 = require("@metamask/superstruct");
+const utils_1 = require("@metamask/utils");
+/**
+ * Map a raw value from the `initialPermissions` to a caveat specification.
+ * Note that this function does not do any validation, that's handled by the
+ * PermissionsController when the permission is requested.
+ *
+ * @param value - The raw value from the `initialPermissions`.
+ * @returns The caveat specification.
+ */
+function snapIdsCaveatMapper(value) {
+    return {
+        caveats: [
+            {
+                type: snaps_utils_1.SnapCaveatType.SnapIds,
+                value,
+            },
+        ],
+    };
+}
+exports.snapIdsCaveatMapper = snapIdsCaveatMapper;
+/**
+ * Validates that the caveat value exists and is a non-empty object.
+ *
+ * @param caveat - The caveat to validate.
+ * @throws If the caveat is invalid.
+ */
+function validateSnapIdsCaveat(caveat) {
+    (0, utils_1.assertStruct)(caveat, (0, superstruct_1.type)({
+        value: snaps_utils_1.SnapIdsStruct,
+    }), 'Expected caveat to have a value property of a non-empty object of snap IDs.', rpc_errors_1.rpcErrors.invalidParams);
+}
+exports.validateSnapIdsCaveat = validateSnapIdsCaveat;
+exports.SnapIdsCaveatSpecification = {
+    [snaps_utils_1.SnapCaveatType.SnapIds]: Object.freeze({
+        type: snaps_utils_1.SnapCaveatType.SnapIds,
+        validator: (caveat) => validateSnapIdsCaveat(caveat),
+        decorator: (method, caveat) => {
+            return async (args) => {
+                const { params, context: { origin }, } = args;
+                const snapIds = caveat.value;
+                const { snapId } = params;
+                if (!(0, utils_1.hasProperty)(snapIds, snapId)) {
+                    throw new Error(`${origin} does not have permission to invoke ${snapId} snap.`);
+                }
+                return await method(args);
+            };
+        },
+    }),
+};
+//# sourceMappingURL=snapIds.cjs.map

package/dist/restricted/caveats/snapIds.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapIds.cjs","sourceRoot":"","sources":["../../../src/restricted/caveats/snapIds.ts"],"names":[],"mappings":";;;AAOA,qDAAiD;AAEjD,uDAAsE;AACtE,uDAA6C;AAE7C,2CAA4D;AAI5D;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CACjC,KAAW;IAEX,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,4BAAc,CAAC,OAAO;gBAC5B,KAAK;aACN;SACF;KACF,CAAC;AACJ,CAAC;AAXD,kDAWC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CACnC,MAA2B;IAE3B,IAAA,oBAAY,EACV,MAAM,EACN,IAAA,kBAAI,EAAC;QACH,KAAK,EAAE,2BAAa;KACrB,CAAC,EACF,6EAA6E,EAC7E,sBAAS,CAAC,aAAa,CACxB,CAAC;AACJ,CAAC;AAXD,sDAWC;AAEY,QAAA,0BAA0B,GAGnC;IACF,CAAC,4BAAc,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QACtC,IAAI,EAAE,4BAAc,CAAC,OAAO;QAC5B,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC;QACpD,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YAC5B,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;gBACpB,MAAM,EACJ,MAAM,EACN,OAAO,EAAE,EAAE,MAAM,EAAE,GACpB,GAAwD,IAAI,CAAC;gBAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAgB,CAAC;gBACxC,MAAM,EAAE,MAAM,EAAE,GAAG,MAA0B,CAAC;gBAC9C,IAAI,CAAC,IAAA,mBAAW,EAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;oBAClC,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,uCAAuC,MAAM,QAAQ,CAC/D,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC,CAAC;QACJ,CAAC;KACF,CAAC;CACH,CAAC","sourcesContent":["import type {\n  Caveat,\n  RestrictedMethodOptions,\n  RestrictedMethodParameters,\n  RestrictedMethodCaveatSpecificationConstraint,\n  PermissionConstraint,\n} from '@metamask/permission-controller';\nimport { rpcErrors } from '@metamask/rpc-errors';\nimport type { SnapIds } from '@metamask/snaps-utils';\nimport { SnapCaveatType, SnapIdsStruct } from '@metamask/snaps-utils';\nimport { type } from '@metamask/superstruct';\nimport type { Json } from '@metamask/utils';\nimport { hasProperty, assertStruct } from '@metamask/utils';\n\nimport type { InvokeSnapParams } from '../invokeSnap';\n\n/**\n * Map a raw value from the `initialPermissions` to a caveat specification.\n * Note that this function does not do any validation, that's handled by the\n * PermissionsController when the permission is requested.\n *\n * @param value - The raw value from the `initialPermissions`.\n * @returns The caveat specification.\n */\nexport function snapIdsCaveatMapper(\n  value: Json,\n): Pick<PermissionConstraint, 'caveats'> {\n  return {\n    caveats: [\n      {\n        type: SnapCaveatType.SnapIds,\n        value,\n      },\n    ],\n  };\n}\n\n/**\n * Validates that the caveat value exists and is a non-empty object.\n *\n * @param caveat - The caveat to validate.\n * @throws If the caveat is invalid.\n */\nexport function validateSnapIdsCaveat(\n  caveat: Caveat<string, any>,\n): asserts caveat is Caveat<string, SnapIds> {\n  assertStruct(\n    caveat,\n    type({\n      value: SnapIdsStruct,\n    }),\n    'Expected caveat to have a value property of a non-empty object of snap IDs.',\n    rpcErrors.invalidParams,\n  );\n}\n\nexport const SnapIdsCaveatSpecification: Record<\n  SnapCaveatType.SnapIds,\n  RestrictedMethodCaveatSpecificationConstraint\n> = {\n  [SnapCaveatType.SnapIds]: Object.freeze({\n    type: SnapCaveatType.SnapIds,\n    validator: (caveat) => validateSnapIdsCaveat(caveat),\n    decorator: (method, caveat) => {\n      return async (args) => {\n        const {\n          params,\n          context: { origin },\n        }: RestrictedMethodOptions<RestrictedMethodParameters> = args;\n        const snapIds = caveat.value as SnapIds;\n        const { snapId } = params as InvokeSnapParams;\n        if (!hasProperty(snapIds, snapId)) {\n          throw new Error(\n            `${origin} does not have permission to invoke ${snapId} snap.`,\n          );\n        }\n        return await method(args);\n      };\n    },\n  }),\n};\n"]}

package/dist/{types/restricted/caveats/snapIds.d.ts → restricted/caveats/snapIds.d.cts}

@@ -1,7 +1,7 @@
-import type { Caveat, RestrictedMethodCaveatSpecificationConstraint, PermissionConstraint } from '@metamask/permission-controller';
-import type { SnapIds } from '@metamask/snaps-utils';
-import { SnapCaveatType } from '@metamask/snaps-utils';
-import type { Json } from '@metamask/utils';
+import type { Caveat, RestrictedMethodCaveatSpecificationConstraint, PermissionConstraint } from "@metamask/permission-controller";
+import type { SnapIds } from "@metamask/snaps-utils";
+import { SnapCaveatType } from "@metamask/snaps-utils";
+import type { Json } from "@metamask/utils";
 /**
  * Map a raw value from the `initialPermissions` to a caveat specification.
  * Note that this function does not do any validation, that's handled by the
@@ -19,3 +19,4 @@ export declare function snapIdsCaveatMapper(value: Json): Pick<PermissionConstra
  */
 export declare function validateSnapIdsCaveat(caveat: Caveat<string, any>): asserts caveat is Caveat<string, SnapIds>;
 export declare const SnapIdsCaveatSpecification: Record<SnapCaveatType.SnapIds, RestrictedMethodCaveatSpecificationConstraint>;
+//# sourceMappingURL=snapIds.d.cts.map

package/dist/restricted/caveats/snapIds.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapIds.d.cts","sourceRoot":"","sources":["../../../src/restricted/caveats/snapIds.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EAGN,6CAA6C,EAC7C,oBAAoB,EACrB,wCAAwC;AAEzC,OAAO,KAAK,EAAE,OAAO,EAAE,8BAA8B;AACrD,OAAO,EAAE,cAAc,EAAiB,8BAA8B;AAEtE,OAAO,KAAK,EAAE,IAAI,EAAE,wBAAwB;AAK5C;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,IAAI,GACV,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,CASvC;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAS3C;AAED,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAC7C,cAAc,CAAC,OAAO,EACtB,6CAA6C,CAsB9C,CAAC"}

package/dist/restricted/caveats/snapIds.d.mts

@@ -0,0 +1,22 @@
+import type { Caveat, RestrictedMethodCaveatSpecificationConstraint, PermissionConstraint } from "@metamask/permission-controller";
+import type { SnapIds } from "@metamask/snaps-utils";
+import { SnapCaveatType } from "@metamask/snaps-utils";
+import type { Json } from "@metamask/utils";
+/**
+ * Map a raw value from the `initialPermissions` to a caveat specification.
+ * Note that this function does not do any validation, that's handled by the
+ * PermissionsController when the permission is requested.
+ *
+ * @param value - The raw value from the `initialPermissions`.
+ * @returns The caveat specification.
+ */
+export declare function snapIdsCaveatMapper(value: Json): Pick<PermissionConstraint, 'caveats'>;
+/**
+ * Validates that the caveat value exists and is a non-empty object.
+ *
+ * @param caveat - The caveat to validate.
+ * @throws If the caveat is invalid.
+ */
+export declare function validateSnapIdsCaveat(caveat: Caveat<string, any>): asserts caveat is Caveat<string, SnapIds>;
+export declare const SnapIdsCaveatSpecification: Record<SnapCaveatType.SnapIds, RestrictedMethodCaveatSpecificationConstraint>;
+//# sourceMappingURL=snapIds.d.mts.map

package/dist/restricted/caveats/snapIds.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapIds.d.mts","sourceRoot":"","sources":["../../../src/restricted/caveats/snapIds.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EAGN,6CAA6C,EAC7C,oBAAoB,EACrB,wCAAwC;AAEzC,OAAO,KAAK,EAAE,OAAO,EAAE,8BAA8B;AACrD,OAAO,EAAE,cAAc,EAAiB,8BAA8B;AAEtE,OAAO,KAAK,EAAE,IAAI,EAAE,wBAAwB;AAK5C;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,IAAI,GACV,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,CASvC;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAS3C;AAED,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAC7C,cAAc,CAAC,OAAO,EACtB,6CAA6C,CAsB9C,CAAC"}