@metamask/snaps-utils 6.1.0 → 7.0.0

package/dist/chunk-O3XKEEJV.mjs

@@ -0,0 +1,249 @@
+// src/post-process.ts
+import { transformSync, template } from "@babel/core";
+import {
+  binaryExpression,
+  isUnaryExpression,
+  isUpdateExpression,
+  stringLiteral,
+  templateElement,
+  templateLiteral
+} from "@babel/types";
+var PostProcessWarning = /* @__PURE__ */ ((PostProcessWarning2) => {
+  PostProcessWarning2["UnsafeMathRandom"] = "`Math.random` was detected in the Snap bundle. This is not a secure source of randomness, and should not be used in a secure context. Use `crypto.getRandomValues` instead.";
+  return PostProcessWarning2;
+})(PostProcessWarning || {});
+var TOKEN_REGEX = /(<!)(--)|(--)(>)|(import)(\(.*?\))/gu;
+var EMPTY_TEMPLATE_ELEMENT = templateElement({ raw: "", cooked: "" });
+var evalWrapper = template.statement(`
+  (1, REF)(ARGS)
+`);
+var objectEvalWrapper = template.statement(`
+  (1, OBJECT.REF)
+`);
+var regeneratorRuntimeWrapper = template.statement(`
+  var regeneratorRuntime;
+`);
+function breakTokens(value) {
+  const tokens = value.split(TOKEN_REGEX);
+  return tokens.filter((token) => token !== "" && token !== void 0);
+}
+function breakTokensTemplateLiteral(value) {
+  const matches = Array.from(value.matchAll(TOKEN_REGEX));
+  if (matches.length > 0) {
+    const output = matches.reduce(
+      ([elements, expressions], rawMatch, index, values) => {
+        const [, first, last] = rawMatch.filter((raw) => raw !== void 0);
+        const prefix = value.slice(
+          index === 0 ? 0 : values[index - 1].index + values[index - 1][0].length,
+          rawMatch.index
+        );
+        return [
+          [
+            ...elements,
+            templateElement({
+              raw: getRawTemplateValue(prefix),
+              cooked: prefix
+            }),
+            EMPTY_TEMPLATE_ELEMENT
+          ],
+          [...expressions, stringLiteral(first), stringLiteral(last)]
+        ];
+      },
+      [[], []]
+    );
+    const lastMatch = matches[matches.length - 1];
+    const suffix = value.slice(
+      lastMatch.index + lastMatch[0].length
+    );
+    return [
+      [
+        ...output[0],
+        templateElement({ raw: getRawTemplateValue(suffix), cooked: suffix })
+      ],
+      output[1]
+    ];
+  }
+  return [
+    [templateElement({ raw: getRawTemplateValue(value), cooked: value })],
+    []
+  ];
+}
+function getRawTemplateValue(value) {
+  return value.replace(/\\|`|\$\{/gu, "\\$&");
+}
+function postProcessBundle(code, {
+  stripComments = true,
+  sourceMap: sourceMaps,
+  inputSourceMap
+} = {}) {
+  const warnings = /* @__PURE__ */ new Set();
+  const pre = ({ ast }) => {
+    ast.comments?.forEach((comment) => {
+      comment.value = comment.value.replace(new RegExp(`<!${"--"}`, "gu"), "< !--").replace(new RegExp(`${"--"}>`, "gu"), "-- >").replace(/import(\(.*\))/gu, "import\\$1");
+    });
+  };
+  const visitor = {
+    FunctionExpression(path) {
+      const { node } = path;
+      if (node.type === "FunctionExpression" && node.extra?.parenthesized) {
+        node.params = node.params.filter(
+          (param) => !(param.type === "Identifier" && param.name === "Buffer")
+        );
+      }
+    },
+    CallExpression(path) {
+      const { node } = path;
+      if (node.callee.type === "Identifier" && node.callee.name === "eval") {
+        path.replaceWith(
+          evalWrapper({
+            REF: node.callee,
+            ARGS: node.arguments
+          })
+        );
+      }
+      if (node.callee.type === "MemberExpression" && node.callee.object.type === "Identifier" && node.callee.object.name === "Math" && node.callee.property.type === "Identifier" && node.callee.property.name === "random") {
+        warnings.add("`Math.random` was detected in the Snap bundle. This is not a secure source of randomness, and should not be used in a secure context. Use `crypto.getRandomValues` instead." /* UnsafeMathRandom */);
+      }
+    },
+    MemberExpression(path) {
+      const { node } = path;
+      if (node.property.type === "Identifier" && node.property.name === "eval" && // We only apply this to MemberExpressions that are the callee of CallExpression
+      path.parent.type === "CallExpression" && path.parent.callee === node) {
+        path.replaceWith(
+          objectEvalWrapper({
+            OBJECT: node.object,
+            REF: node.property
+          })
+        );
+      }
+    },
+    Identifier(path) {
+      const { node } = path;
+      if (node.name === "regeneratorRuntime") {
+        const program = path.findParent(
+          (parent) => parent.node.type === "Program"
+        );
+        if (program?.node.type === "Program") {
+          const body = program.node.body[0];
+          if (body.type === "VariableDeclaration" && body.declarations[0].id.name === "regeneratorRuntime") {
+            return;
+          }
+          program?.node.body.unshift(regeneratorRuntimeWrapper());
+        }
+      }
+    },
+    TemplateLiteral(path) {
+      const { node } = path;
+      if (path.getData("visited")) {
+        return;
+      }
+      const [replacementQuasis, replacementExpressions] = node.quasis.reduce(
+        ([elements, expressions], quasi, index) => {
+          const tokens = breakTokensTemplateLiteral(
+            quasi.value.cooked
+          );
+          if (tokens[0].length <= 1) {
+            return [
+              [...elements, quasi],
+              [...expressions, node.expressions[index]]
+            ];
+          }
+          return [
+            [...elements, ...tokens[0]],
+            [
+              ...expressions,
+              ...tokens[1],
+              node.expressions[index]
+            ]
+          ];
+        },
+        [[], []]
+      );
+      path.replaceWith(
+        templateLiteral(
+          replacementQuasis,
+          replacementExpressions.filter(
+            (expression) => expression !== void 0
+          )
+        )
+      );
+      path.setData("visited", true);
+    },
+    StringLiteral(path) {
+      const { node } = path;
+      const tokens = breakTokens(node.value);
+      if (tokens.length <= 1) {
+        return;
+      }
+      const replacement = tokens.slice(1).reduce(
+        (acc, value) => binaryExpression("+", acc, stringLiteral(value)),
+        stringLiteral(tokens[0])
+      );
+      path.replaceWith(replacement);
+      path.skip();
+    },
+    BinaryExpression(path) {
+      const { node } = path;
+      const errorMessage = "Using HTML comments (`<!--` and `-->`) as operators is not allowed. The behaviour of these comments is ambiguous, and differs per browser and environment. If you want to use them as operators, break them up into separate characters, i.e., `a-- > b` and `a < ! --b`.";
+      if (node.operator === "<" && isUnaryExpression(node.right) && isUpdateExpression(node.right.argument) && node.right.argument.operator === "--" && node.left.end && node.right.argument.argument.start) {
+        const expression = code.slice(
+          node.left.end,
+          node.right.argument.argument.start
+        );
+        if (expression.includes("<!--")) {
+          throw new Error(errorMessage);
+        }
+      }
+      if (node.operator === ">" && isUpdateExpression(node.left) && node.left.operator === "--" && node.left.argument.end && node.right.start) {
+        const expression = code.slice(node.left.argument.end, node.right.start);
+        if (expression.includes("-->")) {
+          throw new Error(errorMessage);
+        }
+      }
+    }
+  };
+  try {
+    const file = transformSync(code, {
+      // Prevent Babel from searching for a config file.
+      configFile: false,
+      parserOpts: {
+        // Strict mode isn't enabled by default, so we need to enable it here.
+        strictMode: true,
+        // If this is disabled, the AST does not include any comments. This is
+        // useful for performance reasons, and we use it for stripping comments.
+        attachComment: !stripComments
+      },
+      // By default, Babel optimises bundles that exceed 500 KB, but that
+      // results in characters which look like HTML comments, which breaks SES.
+      compact: false,
+      // This configures Babel to generate a new source map from the existing
+      // source map if specified. If `sourceMap` is `true` but an input source
+      // map is not provided, a new source map will be generated instead.
+      inputSourceMap,
+      sourceMaps,
+      plugins: [
+        () => ({
+          pre,
+          visitor
+        })
+      ]
+    });
+    if (!file?.code) {
+      throw new Error("Bundled code is empty.");
+    }
+    return {
+      code: file.code,
+      sourceMap: file.map,
+      warnings: Array.from(warnings)
+    };
+  } catch (error) {
+    throw new Error(`Failed to post process code:
+${error.message}`);
+  }
+}
+
+export {
+  PostProcessWarning,
+  postProcessBundle
+};
+//# sourceMappingURL=chunk-O3XKEEJV.mjs.map

package/dist/chunk-O3XKEEJV.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/post-process.ts"],"sourcesContent":["// eslint-disable-next-line @typescript-eslint/no-shadow\nimport type { Node, Visitor, PluginObj } from '@babel/core';\nimport { transformSync, template } from '@babel/core';\nimport type { Expression, Identifier, TemplateElement } from '@babel/types';\nimport {\n  binaryExpression,\n  isUnaryExpression,\n  isUpdateExpression,\n  stringLiteral,\n  templateElement,\n  templateLiteral,\n} from '@babel/types';\n\n/**\n * Source map declaration taken from `@babel/core`. Babel doesn't export the\n * type for this, so it's copied from the source code instead here.\n */\nexport type SourceMap = {\n  version: number;\n  sources: string[];\n  names: string[];\n  sourceRoot?: string | undefined;\n  sourcesContent?: string[] | undefined;\n  mappings: string;\n  file: string;\n};\n\n/**\n * The post process options.\n *\n * @property stripComments - Whether to strip comments. Defaults to `true`.\n * @property sourceMap - Whether to generate a source map for the modified code.\n * See also `inputSourceMap`.\n * @property inputSourceMap - The source map for the input code. When provided,\n * the source map will be used to generate a source map for the modified code.\n * This ensures that the source map is correct for the modified code, and still\n * points to the original source. If not provided, a new source map will be\n * generated instead.\n */\nexport type PostProcessOptions = {\n  stripComments?: boolean;\n  sourceMap?: boolean | 'inline';\n  inputSourceMap?: SourceMap;\n};\n\n/**\n * The post processed bundle output.\n *\n * @property code - The modified code.\n * @property sourceMap - The source map for the modified code, if the source map\n * option was enabled.\n * @property warnings - Any warnings that occurred during the post-processing.\n */\nexport type PostProcessedBundle = {\n  code: string;\n  sourceMap?: SourceMap | null;\n  warnings: PostProcessWarning[];\n};\n\nexport enum PostProcessWarning {\n  UnsafeMathRandom = '`Math.random` was detected in the Snap bundle. This is not a secure source of randomness, and should not be used in a secure context. Use `crypto.getRandomValues` instead.',\n}\n\n// The RegEx below consists of multiple groups joined by a boolean OR.\n// Each part consists of two groups which capture a part of each string\n// which needs to be split up, e.g., `<!--` is split into `<!` and `--`.\nconst TOKEN_REGEX = /(<!)(--)|(--)(>)|(import)(\\(.*?\\))/gu;\n\n// An empty template element, i.e., a part of a template literal without any\n// value (\"\").\nconst EMPTY_TEMPLATE_ELEMENT = templateElement({ raw: '', cooked: '' });\n\nconst evalWrapper = template.statement(`\n  (1, REF)(ARGS)\n`);\n\nconst objectEvalWrapper = template.statement(`\n  (1, OBJECT.REF)\n`);\n\nconst regeneratorRuntimeWrapper = template.statement(`\n  var regeneratorRuntime;\n`);\n\n/**\n * Breaks up tokens that would otherwise result in SES errors. The tokens are\n * broken up in a non-destructive way where possible. Currently works with:\n * - HTML comment tags `<!--` and `-->`, broken up into `<!`, `--`, and `--`,\n * `>`.\n * - `import(n)` statements, broken up into `import`, `(n)`.\n *\n * @param value - The string value to break up.\n * @returns The string split into an array, in a way that it can be joined\n * together to form the same string, but with the tokens separated into single\n * array elements.\n */\nfunction breakTokens(value: string): string[] {\n  const tokens = value.split(TOKEN_REGEX);\n  return (\n    tokens\n      // TODO: The `split` above results in some values being `undefined`.\n      // There may be a better solution to avoid having to filter those out.\n      .filter((token) => token !== '' && token !== undefined)\n  );\n}\n\n/**\n * Breaks up tokens that would otherwise result in SES errors. The tokens are\n * broken up in a non-destructive way where possible. Currently works with:\n * - HTML comment tags `<!--` and `-->`, broken up into `<!`, `--`, and `--`,\n * `>`.\n * - `import(n)` statements, broken up into `import`, `(n)`.\n *\n * @param value - The string value to break up.\n * @returns The string split into a tuple consisting of the new template\n * elements and string literal expressions.\n */\nfunction breakTokensTemplateLiteral(\n  value: string,\n): [TemplateElement[], Expression[]] {\n  // eslint-disable-next-line @typescript-eslint/ban-ts-comment\n  // @ts-ignore `matchAll` is not available in ES2017, but this code\n  // should only be used in environments where the function is supported.\n  const matches: RegExpMatchArray[] = Array.from(value.matchAll(TOKEN_REGEX));\n\n  if (matches.length > 0) {\n    const output = matches.reduce<[TemplateElement[], Expression[]]>(\n      ([elements, expressions], rawMatch, index, values) => {\n        const [, first, last] = rawMatch.filter((raw) => raw !== undefined);\n\n        // Slice the text in front of the match, which does not need to be\n        // broken up.\n        const prefix = value.slice(\n          index === 0\n            ? 0\n            : (values[index - 1].index as number) + values[index - 1][0].length,\n          rawMatch.index,\n        );\n\n        return [\n          [\n            ...elements,\n            templateElement({\n              raw: getRawTemplateValue(prefix),\n              cooked: prefix,\n            }),\n            EMPTY_TEMPLATE_ELEMENT,\n          ],\n          [...expressions, stringLiteral(first), stringLiteral(last)],\n        ];\n      },\n      [[], []],\n    );\n\n    // Add the text after the last match to the output.\n    const lastMatch = matches[matches.length - 1];\n    const suffix = value.slice(\n      (lastMatch.index as number) + lastMatch[0].length,\n    );\n\n    return [\n      [\n        ...output[0],\n        templateElement({ raw: getRawTemplateValue(suffix), cooked: suffix }),\n      ],\n      output[1],\n    ];\n  }\n\n  // If there are no matches, simply return the original value.\n  return [\n    [templateElement({ raw: getRawTemplateValue(value), cooked: value })],\n    [],\n  ];\n}\n\n/**\n * Get a raw template literal value from a cooked value. This adds a backslash\n * before every '`', '\\' and '${' characters.\n *\n * @see https://github.com/babel/babel/issues/9242#issuecomment-532529613\n * @param value - The cooked string to get the raw string for.\n * @returns The value as raw value.\n */\nfunction getRawTemplateValue(value: string) {\n  return value.replace(/\\\\|`|\\$\\{/gu, '\\\\$&');\n}\n\n/**\n * Post process code with AST such that it can be evaluated in SES.\n *\n * Currently:\n * - Makes all direct calls to eval indirect.\n * - Handles certain Babel-related edge cases.\n * - Removes the `Buffer` provided by Browserify.\n * - Optionally removes comments.\n * - Breaks up tokens that would otherwise result in SES errors, such as HTML\n * comment tags `<!--` and `-->` and `import(n)` statements.\n *\n * @param code - The code to post process.\n * @param options - The post-process options.\n * @param options.stripComments - Whether to strip comments. Defaults to `true`.\n * @param options.sourceMap - Whether to generate a source map for the modified\n * code. See also `inputSourceMap`.\n * @param options.inputSourceMap - The source map for the input code. When\n * provided, the source map will be used to generate a source map for the\n * modified code. This ensures that the source map is correct for the modified\n * code, and still points to the original source. If not provided, a new source\n * map will be generated instead.\n * @returns An object containing the modified code, and source map, or null if\n * the provided code is null.\n */\nexport function postProcessBundle(\n  code: string,\n  {\n    stripComments = true,\n    sourceMap: sourceMaps,\n    inputSourceMap,\n  }: Partial<PostProcessOptions> = {},\n): PostProcessedBundle {\n  const warnings = new Set<PostProcessWarning>();\n\n  const pre: PluginObj['pre'] = ({ ast }) => {\n    ast.comments?.forEach((comment) => {\n      // Break up tokens that could be parsed as HTML comment terminators. The\n      // regular expressions below are written strangely so as to avoid the\n      // appearance of such tokens in our source code. For reference:\n      // https://github.com/endojs/endo/blob/70cc86eb400655e922413b99c38818d7b2e79da0/packages/ses/error-codes/SES_HTML_COMMENT_REJECTED.md\n      comment.value = comment.value\n        .replace(new RegExp(`<!${'--'}`, 'gu'), '< !--')\n        .replace(new RegExp(`${'--'}>`, 'gu'), '-- >')\n        .replace(/import(\\(.*\\))/gu, 'import\\\\$1');\n    });\n  };\n\n  const visitor: Visitor<Node> = {\n    FunctionExpression(path) {\n      const { node } = path;\n\n      // Browserify provides the `Buffer` global as an argument to modules that\n      // use it, but this does not work in SES. Since we pass in `Buffer` as an\n      // endowment, we can simply remove the argument.\n      //\n      // Note that this only removes `Buffer` from a wrapped function\n      // expression, e.g., `(function (Buffer) { ... })`. Regular functions\n      // are not affected.\n      //\n      // TODO: Since we're working on the AST level, we could check the scope\n      // of the function expression, and possibly prevent false positives?\n      if (node.type === 'FunctionExpression' && node.extra?.parenthesized) {\n        node.params = node.params.filter(\n          (param) => !(param.type === 'Identifier' && param.name === 'Buffer'),\n        );\n      }\n    },\n\n    CallExpression(path) {\n      const { node } = path;\n\n      // Replace `eval(foo)` with `(1, eval)(foo)`.\n      if (node.callee.type === 'Identifier' && node.callee.name === 'eval') {\n        path.replaceWith(\n          evalWrapper({\n            REF: node.callee,\n            ARGS: node.arguments,\n          }),\n        );\n      }\n\n      // Detect the use of `Math.random()` and add a warning.\n      if (\n        node.callee.type === 'MemberExpression' &&\n        node.callee.object.type === 'Identifier' &&\n        node.callee.object.name === 'Math' &&\n        node.callee.property.type === 'Identifier' &&\n        node.callee.property.name === 'random'\n      ) {\n        warnings.add(PostProcessWarning.UnsafeMathRandom);\n      }\n    },\n\n    MemberExpression(path) {\n      const { node } = path;\n\n      // Replace `object.eval(foo)` with `(1, object.eval)(foo)`.\n      if (\n        node.property.type === 'Identifier' &&\n        node.property.name === 'eval' &&\n        // We only apply this to MemberExpressions that are the callee of CallExpression\n        path.parent.type === 'CallExpression' &&\n        path.parent.callee === node\n      ) {\n        path.replaceWith(\n          objectEvalWrapper({\n            OBJECT: node.object,\n            REF: node.property,\n          }),\n        );\n      }\n    },\n\n    Identifier(path) {\n      const { node } = path;\n\n      // Insert `regeneratorRuntime` global if it's used in the code.\n      if (node.name === 'regeneratorRuntime') {\n        const program = path.findParent(\n          (parent) => parent.node.type === 'Program',\n        );\n\n        // We know that `program` is a Program node here, but this keeps\n        // TypeScript happy.\n        if (program?.node.type === 'Program') {\n          const body = program.node.body[0];\n\n          // This stops it from inserting `regeneratorRuntime` multiple times.\n          if (\n            body.type === 'VariableDeclaration' &&\n            (body.declarations[0].id as Identifier).name ===\n              'regeneratorRuntime'\n          ) {\n            return;\n          }\n\n          program?.node.body.unshift(regeneratorRuntimeWrapper());\n        }\n      }\n    },\n\n    TemplateLiteral(path) {\n      const { node } = path;\n\n      // This checks if the template literal was visited before. Without this,\n      // it would cause an infinite loop resulting in a stack overflow. We can't\n      // skip the path here, because we need to visit the children of the node.\n      if (path.getData('visited')) {\n        return;\n      }\n\n      // Break up tokens that could be parsed as HTML comment terminators, or\n      // `import()` statements.\n      // For reference:\n      // - https://github.com/endojs/endo/blob/70cc86eb400655e922413b99c38818d7b2e79da0/packages/ses/error-codes/SES_HTML_COMMENT_REJECTED.md\n      // - https://github.com/MetaMask/snaps-monorepo/issues/505\n      const [replacementQuasis, replacementExpressions] = node.quasis.reduce<\n        [TemplateElement[], Expression[]]\n      >(\n        ([elements, expressions], quasi, index) => {\n          // Note: Template literals have two variants, \"cooked\" and \"raw\". Here\n          // we use the cooked version.\n          // https://exploringjs.com/impatient-js/ch_template-literals.html#template-strings-cooked-vs-raw\n          const tokens = breakTokensTemplateLiteral(\n            quasi.value.cooked as string,\n          );\n\n          // Only update the node if something changed.\n          if (tokens[0].length <= 1) {\n            return [\n              [...elements, quasi],\n              [...expressions, node.expressions[index] as Expression],\n            ];\n          }\n\n          return [\n            [...elements, ...tokens[0]],\n            [\n              ...expressions,\n              ...tokens[1],\n              node.expressions[index] as Expression,\n            ],\n          ];\n        },\n        [[], []],\n      );\n\n      path.replaceWith(\n        templateLiteral(\n          replacementQuasis,\n          replacementExpressions.filter(\n            (expression) => expression !== undefined,\n          ),\n        ) as Node,\n      );\n\n      path.setData('visited', true);\n    },\n\n    StringLiteral(path) {\n      const { node } = path;\n\n      // Break up tokens that could be parsed as HTML comment terminators, or\n      // `import()` statements.\n      // For reference:\n      // - https://github.com/endojs/endo/blob/70cc86eb400655e922413b99c38818d7b2e79da0/packages/ses/error-codes/SES_HTML_COMMENT_REJECTED.md\n      // - https://github.com/MetaMask/snaps-monorepo/issues/505\n      const tokens = breakTokens(node.value);\n\n      // Only update the node if the string literal was broken up.\n      if (tokens.length <= 1) {\n        return;\n      }\n\n      const replacement = tokens\n        .slice(1)\n        .reduce<Expression>(\n          (acc, value) => binaryExpression('+', acc, stringLiteral(value)),\n          stringLiteral(tokens[0]),\n        );\n\n      path.replaceWith(replacement as Node);\n      path.skip();\n    },\n\n    BinaryExpression(path) {\n      const { node } = path;\n\n      const errorMessage =\n        'Using HTML comments (`<!--` and `-->`) as operators is not allowed. The behaviour of ' +\n        'these comments is ambiguous, and differs per browser and environment. If you want ' +\n        'to use them as operators, break them up into separate characters, i.e., `a-- > b` ' +\n        'and `a < ! --b`.';\n\n      if (\n        node.operator === '<' &&\n        isUnaryExpression(node.right) &&\n        isUpdateExpression(node.right.argument) &&\n        node.right.argument.operator === '--' &&\n        node.left.end &&\n        node.right.argument.argument.start\n      ) {\n        const expression = code.slice(\n          node.left.end,\n          node.right.argument.argument.start,\n        );\n\n        if (expression.includes('<!--')) {\n          throw new Error(errorMessage);\n        }\n      }\n\n      if (\n        node.operator === '>' &&\n        isUpdateExpression(node.left) &&\n        node.left.operator === '--' &&\n        node.left.argument.end &&\n        node.right.start\n      ) {\n        const expression = code.slice(node.left.argument.end, node.right.start);\n\n        if (expression.includes('-->')) {\n          throw new Error(errorMessage);\n        }\n      }\n    },\n  };\n\n  try {\n    const file = transformSync(code, {\n      // Prevent Babel from searching for a config file.\n      configFile: false,\n\n      parserOpts: {\n        // Strict mode isn't enabled by default, so we need to enable it here.\n        strictMode: true,\n\n        // If this is disabled, the AST does not include any comments. This is\n        // useful for performance reasons, and we use it for stripping comments.\n        attachComment: !stripComments,\n      },\n\n      // By default, Babel optimises bundles that exceed 500 KB, but that\n      // results in characters which look like HTML comments, which breaks SES.\n      compact: false,\n\n      // This configures Babel to generate a new source map from the existing\n      // source map if specified. If `sourceMap` is `true` but an input source\n      // map is not provided, a new source map will be generated instead.\n      inputSourceMap,\n      sourceMaps,\n\n      plugins: [\n        () => ({\n          pre,\n          visitor,\n        }),\n      ],\n    });\n\n    if (!file?.code) {\n      throw new Error('Bundled code is empty.');\n    }\n\n    return {\n      code: file.code,\n      sourceMap: file.map,\n      warnings: Array.from(warnings),\n    };\n  } catch (error) {\n    throw new Error(`Failed to post process code:\\n${error.message}`);\n  }\n}\n"],"mappings":";AAEA,SAAS,eAAe,gBAAgB;AAExC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAgDA,IAAK,qBAAL,kBAAKA,wBAAL;AACL,EAAAA,oBAAA,sBAAmB;AADT,SAAAA;AAAA,GAAA;AAOZ,IAAM,cAAc;AAIpB,IAAM,yBAAyB,gBAAgB,EAAE,KAAK,IAAI,QAAQ,GAAG,CAAC;AAEtE,IAAM,cAAc,SAAS,UAAU;AAAA;AAAA,CAEtC;AAED,IAAM,oBAAoB,SAAS,UAAU;AAAA;AAAA,CAE5C;AAED,IAAM,4BAA4B,SAAS,UAAU;AAAA;AAAA,CAEpD;AAcD,SAAS,YAAY,OAAyB;AAC5C,QAAM,SAAS,MAAM,MAAM,WAAW;AACtC,SACE,OAGG,OAAO,CAAC,UAAU,UAAU,MAAM,UAAU,MAAS;AAE5D;AAaA,SAAS,2BACP,OACmC;AAInC,QAAM,UAA8B,MAAM,KAAK,MAAM,SAAS,WAAW,CAAC;AAE1E,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,SAAS,QAAQ;AAAA,MACrB,CAAC,CAAC,UAAU,WAAW,GAAG,UAAU,OAAO,WAAW;AACpD,cAAM,CAAC,EAAE,OAAO,IAAI,IAAI,SAAS,OAAO,CAAC,QAAQ,QAAQ,MAAS;AAIlE,cAAM,SAAS,MAAM;AAAA,UACnB,UAAU,IACN,IACC,OAAO,QAAQ,CAAC,EAAE,QAAmB,OAAO,QAAQ,CAAC,EAAE,CAAC,EAAE;AAAA,UAC/D,SAAS;AAAA,QACX;AAEA,eAAO;AAAA,UACL;AAAA,YACE,GAAG;AAAA,YACH,gBAAgB;AAAA,cACd,KAAK,oBAAoB,MAAM;AAAA,cAC/B,QAAQ;AAAA,YACV,CAAC;AAAA,YACD;AAAA,UACF;AAAA,UACA,CAAC,GAAG,aAAa,cAAc,KAAK,GAAG,cAAc,IAAI,CAAC;AAAA,QAC5D;AAAA,MACF;AAAA,MACA,CAAC,CAAC,GAAG,CAAC,CAAC;AAAA,IACT;AAGA,UAAM,YAAY,QAAQ,QAAQ,SAAS,CAAC;AAC5C,UAAM,SAAS,MAAM;AAAA,MAClB,UAAU,QAAmB,UAAU,CAAC,EAAE;AAAA,IAC7C;AAEA,WAAO;AAAA,MACL;AAAA,QACE,GAAG,OAAO,CAAC;AAAA,QACX,gBAAgB,EAAE,KAAK,oBAAoB,MAAM,GAAG,QAAQ,OAAO,CAAC;AAAA,MACtE;AAAA,MACA,OAAO,CAAC;AAAA,IACV;AAAA,EACF;AAGA,SAAO;AAAA,IACL,CAAC,gBAAgB,EAAE,KAAK,oBAAoB,KAAK,GAAG,QAAQ,MAAM,CAAC,CAAC;AAAA,IACpE,CAAC;AAAA,EACH;AACF;AAUA,SAAS,oBAAoB,OAAe;AAC1C,SAAO,MAAM,QAAQ,eAAe,MAAM;AAC5C;AA0BO,SAAS,kBACd,MACA;AAAA,EACE,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX;AACF,IAAiC,CAAC,GACb;AACrB,QAAM,WAAW,oBAAI,IAAwB;AAE7C,QAAM,MAAwB,CAAC,EAAE,IAAI,MAAM;AACzC,QAAI,UAAU,QAAQ,CAAC,YAAY;AAKjC,cAAQ,QAAQ,QAAQ,MACrB,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,IAAI,GAAG,OAAO,EAC9C,QAAQ,IAAI,OAAO,GAAG,IAAI,KAAK,IAAI,GAAG,MAAM,EAC5C,QAAQ,oBAAoB,YAAY;AAAA,IAC7C,CAAC;AAAA,EACH;AAEA,QAAM,UAAyB;AAAA,IAC7B,mBAAmB,MAAM;AACvB,YAAM,EAAE,KAAK,IAAI;AAYjB,UAAI,KAAK,SAAS,wBAAwB,KAAK,OAAO,eAAe;AACnE,aAAK,SAAS,KAAK,OAAO;AAAA,UACxB,CAAC,UAAU,EAAE,MAAM,SAAS,gBAAgB,MAAM,SAAS;AAAA,QAC7D;AAAA,MACF;AAAA,IACF;AAAA,IAEA,eAAe,MAAM;AACnB,YAAM,EAAE,KAAK,IAAI;AAGjB,UAAI,KAAK,OAAO,SAAS,gBAAgB,KAAK,OAAO,SAAS,QAAQ;AACpE,aAAK;AAAA,UACH,YAAY;AAAA,YACV,KAAK,KAAK;AAAA,YACV,MAAM,KAAK;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AAGA,UACE,KAAK,OAAO,SAAS,sBACrB,KAAK,OAAO,OAAO,SAAS,gBAC5B,KAAK,OAAO,OAAO,SAAS,UAC5B,KAAK,OAAO,SAAS,SAAS,gBAC9B,KAAK,OAAO,SAAS,SAAS,UAC9B;AACA,iBAAS,IAAI,oMAAmC;AAAA,MAClD;AAAA,IACF;AAAA,IAEA,iBAAiB,MAAM;AACrB,YAAM,EAAE,KAAK,IAAI;AAGjB,UACE,KAAK,SAAS,SAAS,gBACvB,KAAK,SAAS,SAAS;AAAA,MAEvB,KAAK,OAAO,SAAS,oBACrB,KAAK,OAAO,WAAW,MACvB;AACA,aAAK;AAAA,UACH,kBAAkB;AAAA,YAChB,QAAQ,KAAK;AAAA,YACb,KAAK,KAAK;AAAA,UACZ,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,MAAM;AACf,YAAM,EAAE,KAAK,IAAI;AAGjB,UAAI,KAAK,SAAS,sBAAsB;AACtC,cAAM,UAAU,KAAK;AAAA,UACnB,CAAC,WAAW,OAAO,KAAK,SAAS;AAAA,QACnC;AAIA,YAAI,SAAS,KAAK,SAAS,WAAW;AACpC,gBAAM,OAAO,QAAQ,KAAK,KAAK,CAAC;AAGhC,cACE,KAAK,SAAS,yBACb,KAAK,aAAa,CAAC,EAAE,GAAkB,SACtC,sBACF;AACA;AAAA,UACF;AAEA,mBAAS,KAAK,KAAK,QAAQ,0BAA0B,CAAC;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AAAA,IAEA,gBAAgB,MAAM;AACpB,YAAM,EAAE,KAAK,IAAI;AAKjB,UAAI,KAAK,QAAQ,SAAS,GAAG;AAC3B;AAAA,MACF;AAOA,YAAM,CAAC,mBAAmB,sBAAsB,IAAI,KAAK,OAAO;AAAA,QAG9D,CAAC,CAAC,UAAU,WAAW,GAAG,OAAO,UAAU;AAIzC,gBAAM,SAAS;AAAA,YACb,MAAM,MAAM;AAAA,UACd;AAGA,cAAI,OAAO,CAAC,EAAE,UAAU,GAAG;AACzB,mBAAO;AAAA,cACL,CAAC,GAAG,UAAU,KAAK;AAAA,cACnB,CAAC,GAAG,aAAa,KAAK,YAAY,KAAK,CAAe;AAAA,YACxD;AAAA,UACF;AAEA,iBAAO;AAAA,YACL,CAAC,GAAG,UAAU,GAAG,OAAO,CAAC,CAAC;AAAA,YAC1B;AAAA,cACE,GAAG;AAAA,cACH,GAAG,OAAO,CAAC;AAAA,cACX,KAAK,YAAY,KAAK;AAAA,YACxB;AAAA,UACF;AAAA,QACF;AAAA,QACA,CAAC,CAAC,GAAG,CAAC,CAAC;AAAA,MACT;AAEA,WAAK;AAAA,QACH;AAAA,UACE;AAAA,UACA,uBAAuB;AAAA,YACrB,CAAC,eAAe,eAAe;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAEA,WAAK,QAAQ,WAAW,IAAI;AAAA,IAC9B;AAAA,IAEA,cAAc,MAAM;AAClB,YAAM,EAAE,KAAK,IAAI;AAOjB,YAAM,SAAS,YAAY,KAAK,KAAK;AAGrC,UAAI,OAAO,UAAU,GAAG;AACtB;AAAA,MACF;AAEA,YAAM,cAAc,OACjB,MAAM,CAAC,EACP;AAAA,QACC,CAAC,KAAK,UAAU,iBAAiB,KAAK,KAAK,cAAc,KAAK,CAAC;AAAA,QAC/D,cAAc,OAAO,CAAC,CAAC;AAAA,MACzB;AAEF,WAAK,YAAY,WAAmB;AACpC,WAAK,KAAK;AAAA,IACZ;AAAA,IAEA,iBAAiB,MAAM;AACrB,YAAM,EAAE,KAAK,IAAI;AAEjB,YAAM,eACJ;AAKF,UACE,KAAK,aAAa,OAClB,kBAAkB,KAAK,KAAK,KAC5B,mBAAmB,KAAK,MAAM,QAAQ,KACtC,KAAK,MAAM,SAAS,aAAa,QACjC,KAAK,KAAK,OACV,KAAK,MAAM,SAAS,SAAS,OAC7B;AACA,cAAM,aAAa,KAAK;AAAA,UACtB,KAAK,KAAK;AAAA,UACV,KAAK,MAAM,SAAS,SAAS;AAAA,QAC/B;AAEA,YAAI,WAAW,SAAS,MAAM,GAAG;AAC/B,gBAAM,IAAI,MAAM,YAAY;AAAA,QAC9B;AAAA,MACF;AAEA,UACE,KAAK,aAAa,OAClB,mBAAmB,KAAK,IAAI,KAC5B,KAAK,KAAK,aAAa,QACvB,KAAK,KAAK,SAAS,OACnB,KAAK,MAAM,OACX;AACA,cAAM,aAAa,KAAK,MAAM,KAAK,KAAK,SAAS,KAAK,KAAK,MAAM,KAAK;AAEtE,YAAI,WAAW,SAAS,KAAK,GAAG;AAC9B,gBAAM,IAAI,MAAM,YAAY;AAAA,QAC9B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,OAAO,cAAc,MAAM;AAAA;AAAA,MAE/B,YAAY;AAAA,MAEZ,YAAY;AAAA;AAAA,QAEV,YAAY;AAAA;AAAA;AAAA,QAIZ,eAAe,CAAC;AAAA,MAClB;AAAA;AAAA;AAAA,MAIA,SAAS;AAAA;AAAA;AAAA;AAAA,MAKT;AAAA,MACA;AAAA,MAEA,SAAS;AAAA,QACP,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,QAAI,CAAC,MAAM,MAAM;AACf,YAAM,IAAI,MAAM,wBAAwB;AAAA,IAC1C;AAEA,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,WAAW,KAAK;AAAA,MAChB,UAAU,MAAM,KAAK,QAAQ;AAAA,IAC/B;AAAA,EACF,SAAS,OAAO;AACd,UAAM,IAAI,MAAM;AAAA,EAAiC,MAAM,OAAO,EAAE;AAAA,EAClE;AACF;","names":["PostProcessWarning"]}

package/dist/chunk-O4PW77JW.mjs

@@ -0,0 +1 @@
+//# sourceMappingURL=chunk-O4PW77JW.mjs.map

package/dist/chunk-O4PW77JW.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/chunk-OQSLMZJN.js

@@ -0,0 +1,281 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkH636DAOGjs = require('./chunk-H636DAOG.js');
+
+
+var _chunkB3YQVRPEjs = require('./chunk-B3YQVRPE.js');
+
+
+
+var _chunk4UMDRHDRjs = require('./chunk-4UMDRHDR.js');
+
+
+
+var _chunkZRVOIW3Hjs = require('./chunk-ZRVOIW3H.js');
+
+
+
+var _chunkMSUZTHYTjs = require('./chunk-MSUZTHYT.js');
+
+
+var _chunkFTY3BOF7js = require('./chunk-FTY3BOF7.js');
+
+
+var _chunk2QS3W66Jjs = require('./chunk-2QS3W66J.js');
+
+// src/manifest/validation.ts
+var _keytree = require('@metamask/key-tree');
+
+
+
+
+
+
+
+var _utils = require('@metamask/utils');
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+var _superstruct = require('superstruct');
+var FORBIDDEN_PURPOSES = [
+  _chunkMSUZTHYTjs.SIP_6_MAGIC_VALUE,
+  _chunkMSUZTHYTjs.STATE_ENCRYPTION_MAGIC_VALUE
+];
+var FORBIDDEN_COIN_TYPES = [60];
+var FORBIDDEN_PATHS = FORBIDDEN_COIN_TYPES.map((coinType) => [
+  "m",
+  "44'",
+  `${coinType}'`
+]);
+var Bip32PathStruct = _superstruct.refine.call(void 0, 
+  _superstruct.array.call(void 0, _superstruct.string.call(void 0, )),
+  "BIP-32 path",
+  (path) => {
+    if (path.length === 0) {
+      return "Path must be a non-empty BIP-32 derivation path array";
+    }
+    if (path[0] !== "m") {
+      return 'Path must start with "m".';
+    }
+    if (path.length < 3) {
+      return "Paths must have a length of at least three.";
+    }
+    if (path.slice(1).some((part) => !_keytree.isValidBIP32PathSegment.call(void 0, part))) {
+      return "Path must be a valid BIP-32 derivation path array.";
+    }
+    if (FORBIDDEN_PURPOSES.includes(path[1])) {
+      return `The purpose "${path[1]}" is not allowed for entropy derivation.`;
+    }
+    if (FORBIDDEN_PATHS.some(
+      (forbiddenPath) => _chunkFTY3BOF7js.isEqual.call(void 0, path.slice(0, forbiddenPath.length), forbiddenPath)
+    )) {
+      return `The path "${path.join(
+        "/"
+      )}" is not allowed for entropy derivation.`;
+    }
+    return true;
+  }
+);
+var bip32entropy = (struct) => _superstruct.refine.call(void 0, struct, "BIP-32 entropy", (value) => {
+  if (value.curve === "ed25519" && value.path.slice(1).some((part) => !part.endsWith("'"))) {
+    return "Ed25519 does not support unhardened paths.";
+  }
+  return true;
+});
+var Bip32EntropyStruct = bip32entropy(
+  _superstruct.type.call(void 0, {
+    path: Bip32PathStruct,
+    curve: _superstruct.enums.call(void 0, ["ed25519", "secp256k1"])
+  })
+);
+var SnapGetBip32EntropyPermissionsStruct = _superstruct.size.call(void 0, 
+  _superstruct.array.call(void 0, Bip32EntropyStruct),
+  1,
+  Infinity
+);
+var SemVerRangeStruct = _superstruct.refine.call(void 0, _superstruct.string.call(void 0, ), "SemVer range", (value) => {
+  if (_utils.isValidSemVerRange.call(void 0, value)) {
+    return true;
+  }
+  return "Expected a valid SemVer range.";
+});
+var SnapIdsStruct = _superstruct.refine.call(void 0, 
+  _superstruct.record.call(void 0, _chunkH636DAOGjs.SnapIdStruct, _superstruct.object.call(void 0, { version: _superstruct.optional.call(void 0, SemVerRangeStruct) })),
+  "SnapIds",
+  (value) => {
+    if (Object.keys(value).length === 0) {
+      return false;
+    }
+    return true;
+  }
+);
+var ChainIdsStruct = _superstruct.size.call(void 0, _superstruct.array.call(void 0, _chunkB3YQVRPEjs.ChainIdStruct), 1, Infinity);
+var LookupMatchersStruct = _superstruct.union.call(void 0, [
+  _superstruct.object.call(void 0, {
+    tlds: _superstruct.size.call(void 0, _superstruct.array.call(void 0, _superstruct.string.call(void 0, )), 1, Infinity)
+  }),
+  _superstruct.object.call(void 0, {
+    schemes: _superstruct.size.call(void 0, _superstruct.array.call(void 0, _superstruct.string.call(void 0, )), 1, Infinity)
+  }),
+  _superstruct.object.call(void 0, {
+    tlds: _superstruct.size.call(void 0, _superstruct.array.call(void 0, _superstruct.string.call(void 0, )), 1, Infinity),
+    schemes: _superstruct.size.call(void 0, _superstruct.array.call(void 0, _superstruct.string.call(void 0, )), 1, Infinity)
+  })
+]);
+var MINIMUM_REQUEST_TIMEOUT = _utils.inMilliseconds.call(void 0, 5, _utils.Duration.Second);
+var MAXIMUM_REQUEST_TIMEOUT = _utils.inMilliseconds.call(void 0, 3, _utils.Duration.Minute);
+var MaxRequestTimeStruct = _superstruct.size.call(void 0, 
+  _superstruct.integer.call(void 0, ),
+  MINIMUM_REQUEST_TIMEOUT,
+  MAXIMUM_REQUEST_TIMEOUT
+);
+var HandlerCaveatsStruct = _superstruct.object.call(void 0, {
+  maxRequestTime: _superstruct.optional.call(void 0, MaxRequestTimeStruct)
+});
+var PermissionsStruct = _superstruct.type.call(void 0, {
+  "endowment:cronjob": _superstruct.optional.call(void 0, 
+    _superstruct.assign.call(void 0, 
+      HandlerCaveatsStruct,
+      _superstruct.object.call(void 0, { jobs: _chunk2QS3W66Jjs.CronjobSpecificationArrayStruct })
+    )
+  ),
+  "endowment:ethereum-provider": _superstruct.optional.call(void 0, _superstruct.object.call(void 0, {})),
+  "endowment:keyring": _superstruct.optional.call(void 0, 
+    _superstruct.assign.call(void 0, HandlerCaveatsStruct, _chunkZRVOIW3Hjs.KeyringOriginsStruct)
+  ),
+  "endowment:lifecycle-hooks": _superstruct.optional.call(void 0, HandlerCaveatsStruct),
+  "endowment:name-lookup": _superstruct.optional.call(void 0, 
+    _superstruct.assign.call(void 0, 
+      HandlerCaveatsStruct,
+      _superstruct.object.call(void 0, {
+        chains: _superstruct.optional.call(void 0, ChainIdsStruct),
+        matchers: _superstruct.optional.call(void 0, LookupMatchersStruct)
+      })
+    )
+  ),
+  "endowment:network-access": _superstruct.optional.call(void 0, _superstruct.object.call(void 0, {})),
+  "endowment:page-home": _superstruct.optional.call(void 0, HandlerCaveatsStruct),
+  "endowment:rpc": _superstruct.optional.call(void 0, _chunkZRVOIW3Hjs.RpcOriginsStruct),
+  "endowment:signature-insight": _superstruct.optional.call(void 0, 
+    _superstruct.assign.call(void 0, 
+      HandlerCaveatsStruct,
+      _superstruct.object.call(void 0, {
+        allowSignatureOrigin: _superstruct.optional.call(void 0, _superstruct.boolean.call(void 0, ))
+      })
+    )
+  ),
+  "endowment:transaction-insight": _superstruct.optional.call(void 0, 
+    _superstruct.assign.call(void 0, 
+      HandlerCaveatsStruct,
+      _superstruct.object.call(void 0, {
+        allowTransactionOrigin: _superstruct.optional.call(void 0, _superstruct.boolean.call(void 0, ))
+      })
+    )
+  ),
+  "endowment:webassembly": _superstruct.optional.call(void 0, _superstruct.object.call(void 0, {})),
+  snap_dialog: _superstruct.optional.call(void 0, _superstruct.object.call(void 0, {})),
+  snap_manageState: _superstruct.optional.call(void 0, _superstruct.object.call(void 0, {})),
+  snap_manageAccounts: _superstruct.optional.call(void 0, _superstruct.object.call(void 0, {})),
+  snap_notify: _superstruct.optional.call(void 0, _superstruct.object.call(void 0, {})),
+  snap_getBip32Entropy: _superstruct.optional.call(void 0, SnapGetBip32EntropyPermissionsStruct),
+  snap_getBip32PublicKey: _superstruct.optional.call(void 0, SnapGetBip32EntropyPermissionsStruct),
+  snap_getBip44Entropy: _superstruct.optional.call(void 0, 
+    _superstruct.size.call(void 0, 
+      _superstruct.array.call(void 0, _superstruct.object.call(void 0, { coinType: _superstruct.size.call(void 0, _superstruct.integer.call(void 0, ), 0, 2 ** 32 - 1) })),
+      1,
+      Infinity
+    )
+  ),
+  snap_getEntropy: _superstruct.optional.call(void 0, _superstruct.object.call(void 0, {})),
+  snap_getLocale: _superstruct.optional.call(void 0, _superstruct.object.call(void 0, {})),
+  wallet_snap: _superstruct.optional.call(void 0, SnapIdsStruct)
+});
+var SnapAuxilaryFilesStruct = _superstruct.array.call(void 0, _superstruct.string.call(void 0, ));
+var InitialConnectionsStruct = _superstruct.record.call(void 0, 
+  _superstruct.intersection.call(void 0, [_superstruct.string.call(void 0, ), _chunk4UMDRHDRjs.uri.call(void 0, )]),
+  _superstruct.object.call(void 0, {})
+);
+var SnapManifestStruct = _superstruct.object.call(void 0, {
+  version: _utils.VersionStruct,
+  description: _superstruct.size.call(void 0, _superstruct.string.call(void 0, ), 1, 280),
+  proposedName: _superstruct.size.call(void 0, _superstruct.string.call(void 0, ), 1, 214),
+  repository: _superstruct.optional.call(void 0, 
+    _superstruct.object.call(void 0, {
+      type: _superstruct.size.call(void 0, _superstruct.string.call(void 0, ), 1, Infinity),
+      url: _superstruct.size.call(void 0, _superstruct.string.call(void 0, ), 1, Infinity)
+    })
+  ),
+  source: _superstruct.object.call(void 0, {
+    shasum: _utils.ChecksumStruct,
+    location: _superstruct.object.call(void 0, {
+      npm: _superstruct.object.call(void 0, {
+        filePath: _superstruct.size.call(void 0, _superstruct.string.call(void 0, ), 1, Infinity),
+        iconPath: _superstruct.optional.call(void 0, _superstruct.size.call(void 0, _superstruct.string.call(void 0, ), 1, Infinity)),
+        packageName: _chunk4UMDRHDRjs.NameStruct,
+        registry: _superstruct.union.call(void 0, [
+          _superstruct.literal.call(void 0, "https://registry.npmjs.org"),
+          _superstruct.literal.call(void 0, "https://registry.npmjs.org/")
+        ])
+      })
+    }),
+    files: _superstruct.optional.call(void 0, SnapAuxilaryFilesStruct),
+    locales: _superstruct.optional.call(void 0, SnapAuxilaryFilesStruct)
+  }),
+  initialConnections: _superstruct.optional.call(void 0, InitialConnectionsStruct),
+  initialPermissions: PermissionsStruct,
+  manifestVersion: _superstruct.literal.call(void 0, "0.1"),
+  $schema: _superstruct.optional.call(void 0, _superstruct.string.call(void 0, ))
+  // enables JSON-Schema linting in VSC and other IDEs
+});
+function isSnapManifest(value) {
+  return _superstruct.is.call(void 0, value, SnapManifestStruct);
+}
+function assertIsSnapManifest(value) {
+  _utils.assertStruct.call(void 0, 
+    value,
+    SnapManifestStruct,
+    `"${"snap.manifest.json" /* Manifest */}" is invalid`
+  );
+}
+function createSnapManifest(value) {
+  return _superstruct.create.call(void 0, value, SnapManifestStruct);
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.FORBIDDEN_COIN_TYPES = FORBIDDEN_COIN_TYPES; exports.Bip32PathStruct = Bip32PathStruct; exports.bip32entropy = bip32entropy; exports.Bip32EntropyStruct = Bip32EntropyStruct; exports.SnapGetBip32EntropyPermissionsStruct = SnapGetBip32EntropyPermissionsStruct; exports.SemVerRangeStruct = SemVerRangeStruct; exports.SnapIdsStruct = SnapIdsStruct; exports.ChainIdsStruct = ChainIdsStruct; exports.LookupMatchersStruct = LookupMatchersStruct; exports.MINIMUM_REQUEST_TIMEOUT = MINIMUM_REQUEST_TIMEOUT; exports.MAXIMUM_REQUEST_TIMEOUT = MAXIMUM_REQUEST_TIMEOUT; exports.MaxRequestTimeStruct = MaxRequestTimeStruct; exports.HandlerCaveatsStruct = HandlerCaveatsStruct; exports.PermissionsStruct = PermissionsStruct; exports.SnapAuxilaryFilesStruct = SnapAuxilaryFilesStruct; exports.InitialConnectionsStruct = InitialConnectionsStruct; exports.SnapManifestStruct = SnapManifestStruct; exports.isSnapManifest = isSnapManifest; exports.assertIsSnapManifest = assertIsSnapManifest; exports.createSnapManifest = createSnapManifest;
+//# sourceMappingURL=chunk-OQSLMZJN.js.map

package/dist/chunk-OQSLMZJN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/manifest/validation.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,+BAA+B;AAExC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAaP,IAAM,qBAA+B;AAAA,EACnC;AAAA,EACA;AACF;AAEO,IAAM,uBAAiC,CAAC,EAAE;AACjD,IAAM,kBAA8B,qBAAqB,IAAI,CAAC,aAAa;AAAA,EACzE;AAAA,EACA;AAAA,EACA,GAAG,QAAQ;AACb,CAAC;AAEM,IAAM,kBAAkB;AAAA,EAC7B,MAAM,OAAO,CAAC;AAAA,EACd;AAAA,EACA,CAAC,SAAmB;AAClB,QAAI,KAAK,WAAW,GAAG;AACrB,aAAO;AAAA,IACT;AAEA,QAAI,KAAK,CAAC,MAAM,KAAK;AACnB,aAAO;AAAA,IACT;AAEA,QAAI,KAAK,SAAS,GAAG;AACnB,aAAO;AAAA,IACT;AAEA,QAAI,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,wBAAwB,IAAI,CAAC,GAAG;AAChE,aAAO;AAAA,IACT;AAEA,QAAI,mBAAmB,SAAS,KAAK,CAAC,CAAC,GAAG;AACxC,aAAO,gBAAgB,KAAK,CAAC,CAAC;AAAA,IAChC;AAEA,QACE,gBAAgB;AAAA,MAAK,CAAC,kBACpB,QAAQ,KAAK,MAAM,GAAG,cAAc,MAAM,GAAG,aAAa;AAAA,IAC5D,GACA;AACA,aAAO,aAAa,KAAK;AAAA,QACvB;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT;AACF;AAEO,IAAM,eAAe,CAI1B,WAEA,OAAO,QAAQ,kBAAkB,CAAC,UAAU;AAC1C,MACE,MAAM,UAAU,aAChB,MAAM,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,GAAG,CAAC,GACtD;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT,CAAC;AAGI,IAAM,qBAAqB;AAAA,EAChC,KAAK;AAAA,IACH,MAAM;AAAA,IACN,OAAO,MAAM,CAAC,WAAW,WAAW,CAAC;AAAA,EACvC,CAAC;AACH;AAIO,IAAM,uCAAuC;AAAA,EAClD,MAAM,kBAAkB;AAAA,EACxB;AAAA,EACA;AACF;AAEO,IAAM,oBAAoB,OAAO,OAAO,GAAG,gBAAgB,CAAC,UAAU;AAC3E,MAAI,mBAAmB,KAAK,GAAG;AAC7B,WAAO;AAAA,EACT;AACA,SAAO;AACT,CAAC;AAEM,IAAM,gBAAgB;AAAA,EAC3B,OAAO,cAAc,OAAO,EAAE,SAAS,SAAS,iBAAiB,EAAE,CAAC,CAAC;AAAA,EACrE;AAAA,EACA,CAAC,UAAU;AACT,QAAI,OAAO,KAAK,KAAK,EAAE,WAAW,GAAG;AACnC,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AACF;AAIO,IAAM,iBAAiB,KAAK,MAAM,aAAa,GAAG,GAAG,QAAQ;AAE7D,IAAM,uBAAuB,MAAM;AAAA,EACxC,OAAO;AAAA,IACL,MAAM,KAAK,MAAM,OAAO,CAAC,GAAG,GAAG,QAAQ;AAAA,EACzC,CAAC;AAAA,EACD,OAAO;AAAA,IACL,SAAS,KAAK,MAAM,OAAO,CAAC,GAAG,GAAG,QAAQ;AAAA,EAC5C,CAAC;AAAA,EACD,OAAO;AAAA,IACL,MAAM,KAAK,MAAM,OAAO,CAAC,GAAG,GAAG,QAAQ;AAAA,IACvC,SAAS,KAAK,MAAM,OAAO,CAAC,GAAG,GAAG,QAAQ;AAAA,EAC5C,CAAC;AACH,CAAC;AAEM,IAAM,0BAA0B,eAAe,GAAG,SAAS,MAAM;AACjE,IAAM,0BAA0B,eAAe,GAAG,SAAS,MAAM;AAEjE,IAAM,uBAAuB;AAAA,EAClC,QAAQ;AAAA,EACR;AAAA,EACA;AACF;AAGO,IAAM,uBAAuB,OAAO;AAAA,EACzC,gBAAgB,SAAS,oBAAoB;AAC/C,CAAC;AAKM,IAAM,oBAAoB,KAAK;AAAA,EACpC,qBAAqB;AAAA,IACnB;AAAA,MACE;AAAA,MACA,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAAA,IAClD;AAAA,EACF;AAAA,EACA,+BAA+B,SAAS,OAAO,CAAC,CAAC,CAAC;AAAA,EAClD,qBAAqB;AAAA,IACnB,OAAO,sBAAsB,oBAAoB;AAAA,EACnD;AAAA,EACA,6BAA6B,SAAS,oBAAoB;AAAA,EAC1D,yBAAyB;AAAA,IACvB;AAAA,MACE;AAAA,MACA,OAAO;AAAA,QACL,QAAQ,SAAS,cAAc;AAAA,QAC/B,UAAU,SAAS,oBAAoB;AAAA,MACzC,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA,4BAA4B,SAAS,OAAO,CAAC,CAAC,CAAC;AAAA,EAC/C,uBAAuB,SAAS,oBAAoB;AAAA,EACpD,iBAAiB,SAAS,gBAAgB;AAAA,EAC1C,+BAA+B;AAAA,IAC7B;AAAA,MACE;AAAA,MACA,OAAO;AAAA,QACL,sBAAsB,SAAS,QAAQ,CAAC;AAAA,MAC1C,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA,iCAAiC;AAAA,IAC/B;AAAA,MACE;AAAA,MACA,OAAO;AAAA,QACL,wBAAwB,SAAS,QAAQ,CAAC;AAAA,MAC5C,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA,yBAAyB,SAAS,OAAO,CAAC,CAAC,CAAC;AAAA,EAC5C,aAAa,SAAS,OAAO,CAAC,CAAC,CAAC;AAAA,EAChC,kBAAkB,SAAS,OAAO,CAAC,CAAC,CAAC;AAAA,EACrC,qBAAqB,SAAS,OAAO,CAAC,CAAC,CAAC;AAAA,EACxC,aAAa,SAAS,OAAO,CAAC,CAAC,CAAC;AAAA,EAChC,sBAAsB,SAAS,oCAAoC;AAAA,EACnE,wBAAwB,SAAS,oCAAoC;AAAA,EACrE,sBAAsB;AAAA,IACpB;AAAA,MACE,MAAM,OAAO,EAAE,UAAU,KAAK,QAAQ,GAAG,GAAG,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA,iBAAiB,SAAS,OAAO,CAAC,CAAC,CAAC;AAAA,EACpC,gBAAgB,SAAS,OAAO,CAAC,CAAC,CAAC;AAAA,EACnC,aAAa,SAAS,aAAa;AACrC,CAAC;AAQM,IAAM,0BAA0B,MAAM,OAAO,CAAC;AAE9C,IAAM,2BAA2B;AAAA,EACtC,aAAa,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAAA,EAC9B,OAAO,CAAC,CAAC;AACX;AAIO,IAAM,qBAAqB,OAAO;AAAA,EACvC,SAAS;AAAA,EACT,aAAa,KAAK,OAAO,GAAG,GAAG,GAAG;AAAA,EAClC,cAAc,KAAK,OAAO,GAAG,GAAG,GAAG;AAAA,EACnC,YAAY;AAAA,IACV,OAAO;AAAA,MACL,MAAM,KAAK,OAAO,GAAG,GAAG,QAAQ;AAAA,MAChC,KAAK,KAAK,OAAO,GAAG,GAAG,QAAQ;AAAA,IACjC,CAAC;AAAA,EACH;AAAA,EACA,QAAQ,OAAO;AAAA,IACb,QAAQ;AAAA,IACR,UAAU,OAAO;AAAA,MACf,KAAK,OAAO;AAAA,QACV,UAAU,KAAK,OAAO,GAAG,GAAG,QAAQ;AAAA,QACpC,UAAU,SAAS,KAAK,OAAO,GAAG,GAAG,QAAQ,CAAC;AAAA,QAC9C,aAAa;AAAA,QACb,UAAU,MAAM;AAAA,UACd,QAAQ,4BAA4B;AAAA,UACpC,QAAQ,6BAA6B;AAAA,QACvC,CAAC;AAAA,MACH,CAAC;AAAA,IACH,CAAC;AAAA,IACD,OAAO,SAAS,uBAAuB;AAAA,IACvC,SAAS,SAAS,uBAAuB;AAAA,EAC3C,CAAC;AAAA,EACD,oBAAoB,SAAS,wBAAwB;AAAA,EACrD,oBAAoB;AAAA,EACpB,iBAAiB,QAAQ,KAAK;AAAA,EAC9B,SAAS,SAAS,OAAO,CAAC;AAAA;AAC5B,CAAC;AAUM,SAAS,eAAe,OAAuC;AACpE,SAAO,GAAG,OAAO,kBAAkB;AACrC;AAQO,SAAS,qBACd,OAC+B;AAC/B;AAAA,IACE;AAAA,IACA;AAAA,IACA,uCAA6B;AAAA,EAC/B;AACF;AASO,SAAS,mBAAmB,OAA8B;AAE/D,SAAO,OAAO,OAAO,kBAAkB;AACzC","sourcesContent":["import { isValidBIP32PathSegment } from '@metamask/key-tree';\nimport type { InitialPermissions } from '@metamask/snaps-sdk';\nimport {\n  assertStruct,\n  ChecksumStruct,\n  VersionStruct,\n  isValidSemVerRange,\n  inMilliseconds,\n  Duration,\n} from '@metamask/utils';\nimport type { Infer, Struct } from 'superstruct';\nimport {\n  array,\n  boolean,\n  create,\n  enums,\n  integer,\n  is,\n  literal,\n  object,\n  optional,\n  refine,\n  record,\n  size,\n  string,\n  type,\n  union,\n  intersection,\n  assign,\n} from 'superstruct';\n\nimport { isEqual } from '../array';\nimport { CronjobSpecificationArrayStruct } from '../cronjob';\nimport { SIP_6_MAGIC_VALUE, STATE_ENCRYPTION_MAGIC_VALUE } from '../entropy';\nimport { KeyringOriginsStruct, RpcOriginsStruct } from '../json-rpc';\nimport { ChainIdStruct } from '../namespace';\nimport { SnapIdStruct } from '../snaps';\nimport type { InferMatching } from '../structs';\nimport { NameStruct, NpmSnapFileNames, uri } from '../types';\n\n// BIP-43 purposes that cannot be used for entropy derivation. These are in the\n// string form, ending with `'`.\nconst FORBIDDEN_PURPOSES: string[] = [\n  SIP_6_MAGIC_VALUE,\n  STATE_ENCRYPTION_MAGIC_VALUE,\n];\n\nexport const FORBIDDEN_COIN_TYPES: number[] = [60];\nconst FORBIDDEN_PATHS: string[][] = FORBIDDEN_COIN_TYPES.map((coinType) => [\n  'm',\n  \"44'\",\n  `${coinType}'`,\n]);\n\nexport const Bip32PathStruct = refine(\n  array(string()),\n  'BIP-32 path',\n  (path: string[]) => {\n    if (path.length === 0) {\n      return 'Path must be a non-empty BIP-32 derivation path array';\n    }\n\n    if (path[0] !== 'm') {\n      return 'Path must start with \"m\".';\n    }\n\n    if (path.length < 3) {\n      return 'Paths must have a length of at least three.';\n    }\n\n    if (path.slice(1).some((part) => !isValidBIP32PathSegment(part))) {\n      return 'Path must be a valid BIP-32 derivation path array.';\n    }\n\n    if (FORBIDDEN_PURPOSES.includes(path[1])) {\n      return `The purpose \"${path[1]}\" is not allowed for entropy derivation.`;\n    }\n\n    if (\n      FORBIDDEN_PATHS.some((forbiddenPath) =>\n        isEqual(path.slice(0, forbiddenPath.length), forbiddenPath),\n      )\n    ) {\n      return `The path \"${path.join(\n        '/',\n      )}\" is not allowed for entropy derivation.`;\n    }\n\n    return true;\n  },\n);\n\nexport const bip32entropy = <\n  Type extends { path: string[]; curve: string },\n  Schema,\n>(\n  struct: Struct<Type, Schema>,\n) =>\n  refine(struct, 'BIP-32 entropy', (value) => {\n    if (\n      value.curve === 'ed25519' &&\n      value.path.slice(1).some((part) => !part.endsWith(\"'\"))\n    ) {\n      return 'Ed25519 does not support unhardened paths.';\n    }\n\n    return true;\n  });\n\n// Used outside @metamask/snap-utils\nexport const Bip32EntropyStruct = bip32entropy(\n  type({\n    path: Bip32PathStruct,\n    curve: enums(['ed25519', 'secp256k1']),\n  }),\n);\n\nexport type Bip32Entropy = Infer<typeof Bip32EntropyStruct>;\n\nexport const SnapGetBip32EntropyPermissionsStruct = size(\n  array(Bip32EntropyStruct),\n  1,\n  Infinity,\n);\n\nexport const SemVerRangeStruct = refine(string(), 'SemVer range', (value) => {\n  if (isValidSemVerRange(value)) {\n    return true;\n  }\n  return 'Expected a valid SemVer range.';\n});\n\nexport const SnapIdsStruct = refine(\n  record(SnapIdStruct, object({ version: optional(SemVerRangeStruct) })),\n  'SnapIds',\n  (value) => {\n    if (Object.keys(value).length === 0) {\n      return false;\n    }\n\n    return true;\n  },\n);\n\nexport type SnapIds = Infer<typeof SnapIdsStruct>;\n\nexport const ChainIdsStruct = size(array(ChainIdStruct), 1, Infinity);\n\nexport const LookupMatchersStruct = union([\n  object({\n    tlds: size(array(string()), 1, Infinity),\n  }),\n  object({\n    schemes: size(array(string()), 1, Infinity),\n  }),\n  object({\n    tlds: size(array(string()), 1, Infinity),\n    schemes: size(array(string()), 1, Infinity),\n  }),\n]);\n\nexport const MINIMUM_REQUEST_TIMEOUT = inMilliseconds(5, Duration.Second);\nexport const MAXIMUM_REQUEST_TIMEOUT = inMilliseconds(3, Duration.Minute);\n\nexport const MaxRequestTimeStruct = size(\n  integer(),\n  MINIMUM_REQUEST_TIMEOUT,\n  MAXIMUM_REQUEST_TIMEOUT,\n);\n\n// Utility type to union with for all handler structs\nexport const HandlerCaveatsStruct = object({\n  maxRequestTime: optional(MaxRequestTimeStruct),\n});\n\nexport type HandlerCaveats = Infer<typeof HandlerCaveatsStruct>;\n\n/* eslint-disable @typescript-eslint/naming-convention */\nexport const PermissionsStruct = type({\n  'endowment:cronjob': optional(\n    assign(\n      HandlerCaveatsStruct,\n      object({ jobs: CronjobSpecificationArrayStruct }),\n    ),\n  ),\n  'endowment:ethereum-provider': optional(object({})),\n  'endowment:keyring': optional(\n    assign(HandlerCaveatsStruct, KeyringOriginsStruct),\n  ),\n  'endowment:lifecycle-hooks': optional(HandlerCaveatsStruct),\n  'endowment:name-lookup': optional(\n    assign(\n      HandlerCaveatsStruct,\n      object({\n        chains: optional(ChainIdsStruct),\n        matchers: optional(LookupMatchersStruct),\n      }),\n    ),\n  ),\n  'endowment:network-access': optional(object({})),\n  'endowment:page-home': optional(HandlerCaveatsStruct),\n  'endowment:rpc': optional(RpcOriginsStruct),\n  'endowment:signature-insight': optional(\n    assign(\n      HandlerCaveatsStruct,\n      object({\n        allowSignatureOrigin: optional(boolean()),\n      }),\n    ),\n  ),\n  'endowment:transaction-insight': optional(\n    assign(\n      HandlerCaveatsStruct,\n      object({\n        allowTransactionOrigin: optional(boolean()),\n      }),\n    ),\n  ),\n  'endowment:webassembly': optional(object({})),\n  snap_dialog: optional(object({})),\n  snap_manageState: optional(object({})),\n  snap_manageAccounts: optional(object({})),\n  snap_notify: optional(object({})),\n  snap_getBip32Entropy: optional(SnapGetBip32EntropyPermissionsStruct),\n  snap_getBip32PublicKey: optional(SnapGetBip32EntropyPermissionsStruct),\n  snap_getBip44Entropy: optional(\n    size(\n      array(object({ coinType: size(integer(), 0, 2 ** 32 - 1) })),\n      1,\n      Infinity,\n    ),\n  ),\n  snap_getEntropy: optional(object({})),\n  snap_getLocale: optional(object({})),\n  wallet_snap: optional(SnapIdsStruct),\n});\n/* eslint-enable @typescript-eslint/naming-convention */\n\nexport type SnapPermissions = InferMatching<\n  typeof PermissionsStruct,\n  InitialPermissions\n>;\n\nexport const SnapAuxilaryFilesStruct = array(string());\n\nexport const InitialConnectionsStruct = record(\n  intersection([string(), uri()]),\n  object({}),\n);\n\nexport type InitialConnections = Infer<typeof InitialConnectionsStruct>;\n\nexport const SnapManifestStruct = object({\n  version: VersionStruct,\n  description: size(string(), 1, 280),\n  proposedName: size(string(), 1, 214),\n  repository: optional(\n    object({\n      type: size(string(), 1, Infinity),\n      url: size(string(), 1, Infinity),\n    }),\n  ),\n  source: object({\n    shasum: ChecksumStruct,\n    location: object({\n      npm: object({\n        filePath: size(string(), 1, Infinity),\n        iconPath: optional(size(string(), 1, Infinity)),\n        packageName: NameStruct,\n        registry: union([\n          literal('https://registry.npmjs.org'),\n          literal('https://registry.npmjs.org/'),\n        ]),\n      }),\n    }),\n    files: optional(SnapAuxilaryFilesStruct),\n    locales: optional(SnapAuxilaryFilesStruct),\n  }),\n  initialConnections: optional(InitialConnectionsStruct),\n  initialPermissions: PermissionsStruct,\n  manifestVersion: literal('0.1'),\n  $schema: optional(string()), // enables JSON-Schema linting in VSC and other IDEs\n});\n\nexport type SnapManifest = Infer<typeof SnapManifestStruct>;\n\n/**\n * Check if the given value is a valid {@link SnapManifest} object.\n *\n * @param value - The value to check.\n * @returns Whether the value is a valid {@link SnapManifest} object.\n */\nexport function isSnapManifest(value: unknown): value is SnapManifest {\n  return is(value, SnapManifestStruct);\n}\n\n/**\n * Assert that the given value is a valid {@link SnapManifest} object.\n *\n * @param value - The value to check.\n * @throws If the value is not a valid {@link SnapManifest} object.\n */\nexport function assertIsSnapManifest(\n  value: unknown,\n): asserts value is SnapManifest {\n  assertStruct(\n    value,\n    SnapManifestStruct,\n    `\"${NpmSnapFileNames.Manifest}\" is invalid`,\n  );\n}\n\n/**\n * Creates a {@link SnapManifest} object from JSON.\n *\n * @param value - The value to check.\n * @throws If the value cannot be coerced to a {@link SnapManifest} object.\n * @returns The created {@link SnapManifest} object.\n */\nexport function createSnapManifest(value: unknown): SnapManifest {\n  // TODO: Add a utility to prefix these errors similar to assertStruct\n  return create(value, SnapManifestStruct);\n}\n"]}