@metamask/snaps-utils 8.0.1 → 8.1.0

package/dist/post-process.mjs

@@ -1,10 +1,336 @@
-import {
-  PostProcessWarning,
-  postProcessBundle
-} from "./chunk-QYPLUMB7.mjs";
-import "./chunk-3RUWAMJT.mjs";
-export {
-  PostProcessWarning,
-  postProcessBundle
-};
+import { transformSync, template } from "@babel/core";
+import $babeltypes from "@babel/types";
+const { binaryExpression, isUnaryExpression, isUpdateExpression, stringLiteral, templateElement, templateLiteral } = $babeltypes;
+export var PostProcessWarning;
+(function (PostProcessWarning) {
+    PostProcessWarning["UnsafeMathRandom"] = "`Math.random` was detected in the Snap bundle. This is not a secure source of randomness, and should not be used in a secure context. Use `crypto.getRandomValues` instead.";
+})(PostProcessWarning || (PostProcessWarning = {}));
+// The RegEx below consists of multiple groups joined by a boolean OR.
+// Each part consists of two groups which capture a part of each string
+// which needs to be split up, e.g., `<!--` is split into `<!` and `--`.
+const TOKEN_REGEX = /(<!)(--)|(--)(>)|(--)(!)(>)|(import)(\(.*?\))/gu;
+// An empty template element, i.e., a part of a template literal without any
+// value ("").
+const EMPTY_TEMPLATE_ELEMENT = templateElement({ raw: '', cooked: '' });
+const evalWrapper = template.statement(`
+  (1, REF)(ARGS)
+`);
+const objectEvalWrapper = template.statement(`
+  (1, OBJECT.REF)
+`);
+const regeneratorRuntimeWrapper = template.statement(`
+  var regeneratorRuntime;
+`);
+/**
+ * Breaks up tokens that would otherwise result in SES errors. The tokens are
+ * broken up in a non-destructive way where possible. Currently works with:
+ * - HTML comment tags `<!--` and `-->`, broken up into `<!`, `--`, and `--`,
+ * `>`.
+ * - `import(n)` statements, broken up into `import`, `(n)`.
+ *
+ * @param value - The string value to break up.
+ * @returns The string split into an array, in a way that it can be joined
+ * together to form the same string, but with the tokens separated into single
+ * array elements.
+ */
+function breakTokens(value) {
+    const tokens = value.split(TOKEN_REGEX);
+    return (tokens
+        // TODO: The `split` above results in some values being `undefined`.
+        // There may be a better solution to avoid having to filter those out.
+        .filter((token) => token !== '' && token !== undefined));
+}
+/**
+ * Breaks up tokens that would otherwise result in SES errors. The tokens are
+ * broken up in a non-destructive way where possible. Currently works with:
+ * - HTML comment tags `<!--` and `-->`, broken up into `<!`, `--`, and `--`,
+ * `>`.
+ * - `import(n)` statements, broken up into `import`, `(n)`.
+ *
+ * @param value - The string value to break up.
+ * @returns The string split into a tuple consisting of the new template
+ * elements and string literal expressions.
+ */
+function breakTokensTemplateLiteral(value) {
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-ignore `matchAll` is not available in ES2017, but this code
+    // should only be used in environments where the function is supported.
+    const matches = Array.from(value.matchAll(TOKEN_REGEX));
+    if (matches.length > 0) {
+        const output = matches.reduce(([elements, expressions], rawMatch, index, values) => {
+            const [, first, last] = rawMatch.filter((raw) => raw !== undefined);
+            // Slice the text in front of the match, which does not need to be
+            // broken up.
+            const prefix = value.slice(index === 0
+                ? 0
+                : values[index - 1].index + values[index - 1][0].length, rawMatch.index);
+            return [
+                [
+                    ...elements,
+                    templateElement({
+                        raw: getRawTemplateValue(prefix),
+                        cooked: prefix,
+                    }),
+                    EMPTY_TEMPLATE_ELEMENT,
+                ],
+                [...expressions, stringLiteral(first), stringLiteral(last)],
+            ];
+        }, [[], []]);
+        // Add the text after the last match to the output.
+        const lastMatch = matches[matches.length - 1];
+        const suffix = value.slice(lastMatch.index + lastMatch[0].length);
+        return [
+            [
+                ...output[0],
+                templateElement({ raw: getRawTemplateValue(suffix), cooked: suffix }),
+            ],
+            output[1],
+        ];
+    }
+    // If there are no matches, simply return the original value.
+    return [
+        [templateElement({ raw: getRawTemplateValue(value), cooked: value })],
+        [],
+    ];
+}
+/**
+ * Get a raw template literal value from a cooked value. This adds a backslash
+ * before every '`', '\' and '${' characters.
+ *
+ * @see https://github.com/babel/babel/issues/9242#issuecomment-532529613
+ * @param value - The cooked string to get the raw string for.
+ * @returns The value as raw value.
+ */
+function getRawTemplateValue(value) {
+    return value.replace(/\\|`|\$\{/gu, '\\$&');
+}
+/**
+ * Post process code with AST such that it can be evaluated in SES.
+ *
+ * Currently:
+ * - Makes all direct calls to eval indirect.
+ * - Handles certain Babel-related edge cases.
+ * - Removes the `Buffer` provided by Browserify.
+ * - Optionally removes comments.
+ * - Breaks up tokens that would otherwise result in SES errors, such as HTML
+ * comment tags `<!--` and `-->` and `import(n)` statements.
+ *
+ * @param code - The code to post process.
+ * @param options - The post-process options.
+ * @param options.stripComments - Whether to strip comments. Defaults to `true`.
+ * @param options.sourceMap - Whether to generate a source map for the modified
+ * code. See also `inputSourceMap`.
+ * @param options.inputSourceMap - The source map for the input code. When
+ * provided, the source map will be used to generate a source map for the
+ * modified code. This ensures that the source map is correct for the modified
+ * code, and still points to the original source. If not provided, a new source
+ * map will be generated instead.
+ * @returns An object containing the modified code, and source map, or null if
+ * the provided code is null.
+ */
+export function postProcessBundle(code, { stripComments = true, sourceMap: sourceMaps, inputSourceMap, } = {}) {
+    const warnings = new Set();
+    const pre = ({ ast }) => {
+        ast.comments?.forEach((comment) => {
+            // Break up tokens that could be parsed as HTML comment terminators. The
+            // regular expressions below are written strangely so as to avoid the
+            // appearance of such tokens in our source code. For reference:
+            // https://github.com/endojs/endo/blob/70cc86eb400655e922413b99c38818d7b2e79da0/packages/ses/error-codes/SES_HTML_COMMENT_REJECTED.md
+            comment.value = comment.value
+                .replace(new RegExp(`<!${'--'}`, 'gu'), '< !--')
+                .replace(new RegExp(`${'--'}>`, 'gu'), '-- >')
+                .replace(/import(\(.*\))/gu, 'import\\$1');
+        });
+    };
+    const visitor = {
+        FunctionExpression(path) {
+            const { node } = path;
+            // Browserify provides the `Buffer` global as an argument to modules that
+            // use it, but this does not work in SES. Since we pass in `Buffer` as an
+            // endowment, we can simply remove the argument.
+            //
+            // Note that this only removes `Buffer` from a wrapped function
+            // expression, e.g., `(function (Buffer) { ... })`. Regular functions
+            // are not affected.
+            //
+            // TODO: Since we're working on the AST level, we could check the scope
+            // of the function expression, and possibly prevent false positives?
+            if (node.type === 'FunctionExpression' && node.extra?.parenthesized) {
+                node.params = node.params.filter((param) => !(param.type === 'Identifier' && param.name === 'Buffer'));
+            }
+        },
+        CallExpression(path) {
+            const { node } = path;
+            // Replace `eval(foo)` with `(1, eval)(foo)`.
+            if (node.callee.type === 'Identifier' && node.callee.name === 'eval') {
+                path.replaceWith(evalWrapper({
+                    REF: node.callee,
+                    ARGS: node.arguments,
+                }));
+            }
+            // Detect the use of `Math.random()` and add a warning.
+            if (node.callee.type === 'MemberExpression' &&
+                node.callee.object.type === 'Identifier' &&
+                node.callee.object.name === 'Math' &&
+                node.callee.property.type === 'Identifier' &&
+                node.callee.property.name === 'random') {
+                warnings.add(PostProcessWarning.UnsafeMathRandom);
+            }
+        },
+        MemberExpression(path) {
+            const { node } = path;
+            // Replace `object.eval(foo)` with `(1, object.eval)(foo)`.
+            if (node.property.type === 'Identifier' &&
+                node.property.name === 'eval' &&
+                // We only apply this to MemberExpressions that are the callee of CallExpression
+                path.parent.type === 'CallExpression' &&
+                path.parent.callee === node) {
+                path.replaceWith(objectEvalWrapper({
+                    OBJECT: node.object,
+                    REF: node.property,
+                }));
+            }
+        },
+        Identifier(path) {
+            const { node } = path;
+            // Insert `regeneratorRuntime` global if it's used in the code.
+            if (node.name === 'regeneratorRuntime') {
+                const program = path.findParent((parent) => parent.node.type === 'Program');
+                // We know that `program` is a Program node here, but this keeps
+                // TypeScript happy.
+                if (program?.node.type === 'Program') {
+                    const body = program.node.body[0];
+                    // This stops it from inserting `regeneratorRuntime` multiple times.
+                    if (body.type === 'VariableDeclaration' &&
+                        body.declarations[0].id.name ===
+                            'regeneratorRuntime') {
+                        return;
+                    }
+                    program?.node.body.unshift(regeneratorRuntimeWrapper());
+                }
+            }
+        },
+        TemplateLiteral(path) {
+            const { node } = path;
+            // This checks if the template literal was visited before. Without this,
+            // it would cause an infinite loop resulting in a stack overflow. We can't
+            // skip the path here, because we need to visit the children of the node.
+            if (path.getData('visited')) {
+                return;
+            }
+            // Break up tokens that could be parsed as HTML comment terminators, or
+            // `import()` statements.
+            // For reference:
+            // - https://github.com/endojs/endo/blob/70cc86eb400655e922413b99c38818d7b2e79da0/packages/ses/error-codes/SES_HTML_COMMENT_REJECTED.md
+            // - https://github.com/MetaMask/snaps-monorepo/issues/505
+            const [replacementQuasis, replacementExpressions] = node.quasis.reduce(([elements, expressions], quasi, index) => {
+                // Note: Template literals have two variants, "cooked" and "raw". Here
+                // we use the cooked version.
+                // https://exploringjs.com/impatient-js/ch_template-literals.html#template-strings-cooked-vs-raw
+                const tokens = breakTokensTemplateLiteral(quasi.value.cooked);
+                // Only update the node if something changed.
+                if (tokens[0].length <= 1) {
+                    return [
+                        [...elements, quasi],
+                        [...expressions, node.expressions[index]],
+                    ];
+                }
+                return [
+                    [...elements, ...tokens[0]],
+                    [
+                        ...expressions,
+                        ...tokens[1],
+                        node.expressions[index],
+                    ],
+                ];
+            }, [[], []]);
+            path.replaceWith(templateLiteral(replacementQuasis, replacementExpressions.filter((expression) => expression !== undefined)));
+            path.setData('visited', true);
+        },
+        StringLiteral(path) {
+            const { node } = path;
+            // Break up tokens that could be parsed as HTML comment terminators, or
+            // `import()` statements.
+            // For reference:
+            // - https://github.com/endojs/endo/blob/70cc86eb400655e922413b99c38818d7b2e79da0/packages/ses/error-codes/SES_HTML_COMMENT_REJECTED.md
+            // - https://github.com/MetaMask/snaps-monorepo/issues/505
+            const tokens = breakTokens(node.value);
+            // Only update the node if the string literal was broken up.
+            if (tokens.length <= 1) {
+                return;
+            }
+            const replacement = tokens
+                .slice(1)
+                .reduce((acc, value) => binaryExpression('+', acc, stringLiteral(value)), stringLiteral(tokens[0]));
+            path.replaceWith(replacement);
+            path.skip();
+        },
+        BinaryExpression(path) {
+            const { node } = path;
+            const errorMessage = 'Using HTML comments (`<!--` and `-->`) as operators is not allowed. The behaviour of ' +
+                'these comments is ambiguous, and differs per browser and environment. If you want ' +
+                'to use them as operators, break them up into separate characters, i.e., `a-- > b` ' +
+                'and `a < ! --b`.';
+            if (node.operator === '<' &&
+                isUnaryExpression(node.right) &&
+                isUpdateExpression(node.right.argument) &&
+                node.right.argument.operator === '--' &&
+                node.left.end &&
+                node.right.argument.argument.start) {
+                const expression = code.slice(node.left.end, node.right.argument.argument.start);
+                if (expression.includes('<!--')) {
+                    throw new Error(errorMessage);
+                }
+            }
+            if (node.operator === '>' &&
+                isUpdateExpression(node.left) &&
+                node.left.operator === '--' &&
+                node.left.argument.end &&
+                node.right.start) {
+                const expression = code.slice(node.left.argument.end, node.right.start);
+                if (expression.includes('-->')) {
+                    throw new Error(errorMessage);
+                }
+            }
+        },
+    };
+    try {
+        const file = transformSync(code, {
+            // Prevent Babel from searching for a config file.
+            configFile: false,
+            parserOpts: {
+                // Strict mode isn't enabled by default, so we need to enable it here.
+                strictMode: true,
+                // If this is disabled, the AST does not include any comments. This is
+                // useful for performance reasons, and we use it for stripping comments.
+                attachComment: !stripComments,
+            },
+            // By default, Babel optimises bundles that exceed 500 KB, but that
+            // results in characters which look like HTML comments, which breaks SES.
+            compact: false,
+            // This configures Babel to generate a new source map from the existing
+            // source map if specified. If `sourceMap` is `true` but an input source
+            // map is not provided, a new source map will be generated instead.
+            inputSourceMap,
+            sourceMaps,
+            plugins: [
+                () => ({
+                    pre,
+                    visitor,
+                }),
+            ],
+        });
+        if (!file?.code) {
+            throw new Error('Bundled code is empty.');
+        }
+        return {
+            code: file.code,
+            sourceMap: file.map,
+            warnings: Array.from(warnings),
+        };
+    }
+    catch (error) {
+        throw new Error(`Failed to post process code:\n${error.message}`);
+    }
+}
 //# sourceMappingURL=post-process.mjs.map

package/dist/post-process.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"file":"post-process.mjs","sourceRoot":"","sources":["../src/post-process.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,oBAAoB;;;AAyDtD,MAAM,CAAN,IAAY,kBAEX;AAFD,WAAY,kBAAkB;IAC5B,sNAAgM,CAAA;AAClM,CAAC,EAFW,kBAAkB,KAAlB,kBAAkB,QAE7B;AAED,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,WAAW,GAAG,iDAAiD,CAAC;AAEtE,4EAA4E;AAC5E,cAAc;AACd,MAAM,sBAAsB,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;AAExE,MAAM,WAAW,GAAG,QAAQ,CAAC,SAAS,CAAC;;CAEtC,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,QAAQ,CAAC,SAAS,CAAC;;CAE5C,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,QAAQ,CAAC,SAAS,CAAC;;CAEpD,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACxC,OAAO,CACL,MAAM;QACJ,oEAAoE;QACpE,sEAAsE;SACrE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,SAAS,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,0BAA0B,CACjC,KAAa;IAEb,6DAA6D;IAC7D,kEAAkE;IAClE,uEAAuE;IACvE,MAAM,OAAO,GAAuB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAE5E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAC3B,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACnD,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;YAEpE,kEAAkE;YAClE,aAAa;YACb,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CACxB,KAAK,KAAK,CAAC;gBACT,CAAC,CAAC,CAAC;gBACH,CAAC,CAAE,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAgB,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EACrE,QAAQ,CAAC,KAAK,CACf,CAAC;YAEF,OAAO;gBACL;oBACE,GAAG,QAAQ;oBACX,eAAe,CAAC;wBACd,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC;wBAChC,MAAM,EAAE,MAAM;qBACf,CAAC;oBACF,sBAAsB;iBACvB;gBACD,CAAC,GAAG,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;aAC5D,CAAC;QACJ,CAAC,EACD,CAAC,EAAE,EAAE,EAAE,CAAC,CACT,CAAC;QAEF,mDAAmD;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CACvB,SAAS,CAAC,KAAgB,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAClD,CAAC;QAEF,OAAO;YACL;gBACE,GAAG,MAAM,CAAC,CAAC,CAAC;gBACZ,eAAe,CAAC,EAAE,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;aACtE;YACD,MAAM,CAAC,CAAC,CAAC;SACV,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,OAAO;QACL,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,EAAE;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,EACE,aAAa,GAAG,IAAI,EACpB,SAAS,EAAE,UAAU,EACrB,cAAc,MACiB,EAAE;IAEnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE/C,MAAM,GAAG,GAAqB,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;QACxC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAChC,wEAAwE;YACxE,qEAAqE;YACrE,+DAA+D;YAC/D,qIAAqI;YACrI,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK;iBAC1B,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC;iBAC/C,OAAO,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;iBAC7C,OAAO,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,OAAO,GAAkB;QAC7B,kBAAkB,CAAC,IAAI;YACrB,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;YAEtB,yEAAyE;YACzE,yEAAyE;YACzE,gDAAgD;YAChD,EAAE;YACF,+DAA+D;YAC/D,qEAAqE;YACrE,oBAAoB;YACpB,EAAE;YACF,uEAAuE;YACvE,oEAAoE;YACpE,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,IAAI,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC;gBACpE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAC9B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,cAAc,CAAC,IAAI;YACjB,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;YAEtB,6CAA6C;YAC7C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrE,IAAI,CAAC,WAAW,CACd,WAAW,CAAC;oBACV,GAAG,EAAE,IAAI,CAAC,MAAM;oBAChB,IAAI,EAAE,IAAI,CAAC,SAAS;iBACrB,CAAC,CACH,CAAC;YACJ,CAAC;YAED,uDAAuD;YACvD,IACE,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;gBACvC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;gBAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;gBAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,EACtC,CAAC;gBACD,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,gBAAgB,CAAC,IAAI;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;YAEtB,2DAA2D;YAC3D,IACE,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;gBACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM;gBAC7B,gFAAgF;gBAChF,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB;gBACrC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,EAC3B,CAAC;gBACD,IAAI,CAAC,WAAW,CACd,iBAAiB,CAAC;oBAChB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,GAAG,EAAE,IAAI,CAAC,QAAQ;iBACnB,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,UAAU,CAAC,IAAI;YACb,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;YAEtB,+DAA+D;YAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBACvC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAC7B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAC3C,CAAC;gBAEF,gEAAgE;gBAChE,oBAAoB;gBACpB,IAAI,OAAO,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAElC,oEAAoE;oBACpE,IACE,IAAI,CAAC,IAAI,KAAK,qBAAqB;wBAClC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAiB,CAAC,IAAI;4BAC1C,oBAAoB,EACtB,CAAC;wBACD,OAAO;oBACT,CAAC;oBAED,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;QAED,eAAe,CAAC,IAAI;YAClB,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;YAEtB,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5B,OAAO;YACT,CAAC;YAED,uEAAuE;YACvE,yBAAyB;YACzB,iBAAiB;YACjB,uIAAuI;YACvI,0DAA0D;YAC1D,MAAM,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAGpE,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACxC,sEAAsE;gBACtE,6BAA6B;gBAC7B,gGAAgG;gBAChG,MAAM,MAAM,GAAG,0BAA0B,CACvC,KAAK,CAAC,KAAK,CAAC,MAAgB,CAC7B,CAAC;gBAEF,6CAA6C;gBAC7C,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBAC1B,OAAO;wBACL,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC;wBACpB,CAAC,GAAG,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAe,CAAC;qBACxD,CAAC;gBACJ,CAAC;gBAED,OAAO;oBACL,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;oBAC3B;wBACE,GAAG,WAAW;wBACd,GAAG,MAAM,CAAC,CAAC,CAAC;wBACZ,IAAI,CAAC,WAAW,CAAC,KAAK,CAAe;qBACtC;iBACF,CAAC;YACJ,CAAC,EACD,CAAC,EAAE,EAAE,EAAE,CAAC,CACT,CAAC;YAEF,IAAI,CAAC,WAAW,CACd,eAAe,CACb,iBAAiB,EACjB,sBAAsB,CAAC,MAAM,CAC3B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,SAAS,CACzC,CACM,CACV,CAAC;YAEF,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;QAED,aAAa,CAAC,IAAI;YAChB,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;YAEtB,uEAAuE;YACvE,yBAAyB;YACzB,iBAAiB;YACjB,uIAAuI;YACvI,0DAA0D;YAC1D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEvC,4DAA4D;YAC5D,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,MAAM,WAAW,GAAG,MAAM;iBACvB,KAAK,CAAC,CAAC,CAAC;iBACR,MAAM,CACL,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,EAChE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CACzB,CAAC;YAEJ,IAAI,CAAC,WAAW,CAAC,WAAmB,CAAC,CAAC;YACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC;QAED,gBAAgB,CAAC,IAAI;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;YAEtB,MAAM,YAAY,GAChB,uFAAuF;gBACvF,oFAAoF;gBACpF,oFAAoF;gBACpF,kBAAkB,CAAC;YAErB,IACE,IAAI,CAAC,QAAQ,KAAK,GAAG;gBACrB,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC7B,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACvC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI;gBACrC,IAAI,CAAC,IAAI,CAAC,GAAG;gBACb,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAClC,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,EACb,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CACnC,CAAC;gBAEF,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChC,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;YAED,IACE,IAAI,CAAC,QAAQ,KAAK,GAAG;gBACrB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI;gBAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG;gBACtB,IAAI,CAAC,KAAK,CAAC,KAAK,EAChB,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAExE,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE;YAC/B,kDAAkD;YAClD,UAAU,EAAE,KAAK;YAEjB,UAAU,EAAE;gBACV,sEAAsE;gBACtE,UAAU,EAAE,IAAI;gBAEhB,sEAAsE;gBACtE,wEAAwE;gBACxE,aAAa,EAAE,CAAC,aAAa;aAC9B;YAED,mEAAmE;YACnE,yEAAyE;YACzE,OAAO,EAAE,KAAK;YAEd,uEAAuE;YACvE,wEAAwE;YACxE,mEAAmE;YACnE,cAAc;YACd,UAAU;YAEV,OAAO,EAAE;gBACP,GAAG,EAAE,CAAC,CAAC;oBACL,GAAG;oBACH,OAAO;iBACR,CAAC;aACH;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,GAAG;YACnB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;SAC/B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC","sourcesContent":["// eslint-disable-next-line @typescript-eslint/no-shadow\nimport type { Node, Visitor, PluginObj } from '@babel/core';\nimport { transformSync, template } from '@babel/core';\nimport type { Expression, Identifier, TemplateElement } from '@babel/types';\nimport {\n  binaryExpression,\n  isUnaryExpression,\n  isUpdateExpression,\n  stringLiteral,\n  templateElement,\n  templateLiteral,\n} from '@babel/types';\n\n/**\n * Source map declaration taken from `@babel/core`. Babel doesn't export the\n * type for this, so it's copied from the source code instead here.\n */\nexport type SourceMap = {\n  version: number;\n  sources: string[];\n  names: string[];\n  sourceRoot?: string | undefined;\n  sourcesContent?: string[] | undefined;\n  mappings: string;\n  file: string;\n};\n\n/**\n * The post process options.\n *\n * @property stripComments - Whether to strip comments. Defaults to `true`.\n * @property sourceMap - Whether to generate a source map for the modified code.\n * See also `inputSourceMap`.\n * @property inputSourceMap - The source map for the input code. When provided,\n * the source map will be used to generate a source map for the modified code.\n * This ensures that the source map is correct for the modified code, and still\n * points to the original source. If not provided, a new source map will be\n * generated instead.\n */\nexport type PostProcessOptions = {\n  stripComments?: boolean;\n  sourceMap?: boolean | 'inline';\n  inputSourceMap?: SourceMap;\n};\n\n/**\n * The post processed bundle output.\n *\n * @property code - The modified code.\n * @property sourceMap - The source map for the modified code, if the source map\n * option was enabled.\n * @property warnings - Any warnings that occurred during the post-processing.\n */\nexport type PostProcessedBundle = {\n  code: string;\n  sourceMap?: SourceMap | null;\n  warnings: PostProcessWarning[];\n};\n\nexport enum PostProcessWarning {\n  UnsafeMathRandom = '`Math.random` was detected in the Snap bundle. This is not a secure source of randomness, and should not be used in a secure context. Use `crypto.getRandomValues` instead.',\n}\n\n// The RegEx below consists of multiple groups joined by a boolean OR.\n// Each part consists of two groups which capture a part of each string\n// which needs to be split up, e.g., `<!--` is split into `<!` and `--`.\nconst TOKEN_REGEX = /(<!)(--)|(--)(>)|(--)(!)(>)|(import)(\\(.*?\\))/gu;\n\n// An empty template element, i.e., a part of a template literal without any\n// value (\"\").\nconst EMPTY_TEMPLATE_ELEMENT = templateElement({ raw: '', cooked: '' });\n\nconst evalWrapper = template.statement(`\n  (1, REF)(ARGS)\n`);\n\nconst objectEvalWrapper = template.statement(`\n  (1, OBJECT.REF)\n`);\n\nconst regeneratorRuntimeWrapper = template.statement(`\n  var regeneratorRuntime;\n`);\n\n/**\n * Breaks up tokens that would otherwise result in SES errors. The tokens are\n * broken up in a non-destructive way where possible. Currently works with:\n * - HTML comment tags `<!--` and `-->`, broken up into `<!`, `--`, and `--`,\n * `>`.\n * - `import(n)` statements, broken up into `import`, `(n)`.\n *\n * @param value - The string value to break up.\n * @returns The string split into an array, in a way that it can be joined\n * together to form the same string, but with the tokens separated into single\n * array elements.\n */\nfunction breakTokens(value: string): string[] {\n  const tokens = value.split(TOKEN_REGEX);\n  return (\n    tokens\n      // TODO: The `split` above results in some values being `undefined`.\n      // There may be a better solution to avoid having to filter those out.\n      .filter((token) => token !== '' && token !== undefined)\n  );\n}\n\n/**\n * Breaks up tokens that would otherwise result in SES errors. The tokens are\n * broken up in a non-destructive way where possible. Currently works with:\n * - HTML comment tags `<!--` and `-->`, broken up into `<!`, `--`, and `--`,\n * `>`.\n * - `import(n)` statements, broken up into `import`, `(n)`.\n *\n * @param value - The string value to break up.\n * @returns The string split into a tuple consisting of the new template\n * elements and string literal expressions.\n */\nfunction breakTokensTemplateLiteral(\n  value: string,\n): [TemplateElement[], Expression[]] {\n  // eslint-disable-next-line @typescript-eslint/ban-ts-comment\n  // @ts-ignore `matchAll` is not available in ES2017, but this code\n  // should only be used in environments where the function is supported.\n  const matches: RegExpMatchArray[] = Array.from(value.matchAll(TOKEN_REGEX));\n\n  if (matches.length > 0) {\n    const output = matches.reduce<[TemplateElement[], Expression[]]>(\n      ([elements, expressions], rawMatch, index, values) => {\n        const [, first, last] = rawMatch.filter((raw) => raw !== undefined);\n\n        // Slice the text in front of the match, which does not need to be\n        // broken up.\n        const prefix = value.slice(\n          index === 0\n            ? 0\n            : (values[index - 1].index as number) + values[index - 1][0].length,\n          rawMatch.index,\n        );\n\n        return [\n          [\n            ...elements,\n            templateElement({\n              raw: getRawTemplateValue(prefix),\n              cooked: prefix,\n            }),\n            EMPTY_TEMPLATE_ELEMENT,\n          ],\n          [...expressions, stringLiteral(first), stringLiteral(last)],\n        ];\n      },\n      [[], []],\n    );\n\n    // Add the text after the last match to the output.\n    const lastMatch = matches[matches.length - 1];\n    const suffix = value.slice(\n      (lastMatch.index as number) + lastMatch[0].length,\n    );\n\n    return [\n      [\n        ...output[0],\n        templateElement({ raw: getRawTemplateValue(suffix), cooked: suffix }),\n      ],\n      output[1],\n    ];\n  }\n\n  // If there are no matches, simply return the original value.\n  return [\n    [templateElement({ raw: getRawTemplateValue(value), cooked: value })],\n    [],\n  ];\n}\n\n/**\n * Get a raw template literal value from a cooked value. This adds a backslash\n * before every '`', '\\' and '${' characters.\n *\n * @see https://github.com/babel/babel/issues/9242#issuecomment-532529613\n * @param value - The cooked string to get the raw string for.\n * @returns The value as raw value.\n */\nfunction getRawTemplateValue(value: string) {\n  return value.replace(/\\\\|`|\\$\\{/gu, '\\\\$&');\n}\n\n/**\n * Post process code with AST such that it can be evaluated in SES.\n *\n * Currently:\n * - Makes all direct calls to eval indirect.\n * - Handles certain Babel-related edge cases.\n * - Removes the `Buffer` provided by Browserify.\n * - Optionally removes comments.\n * - Breaks up tokens that would otherwise result in SES errors, such as HTML\n * comment tags `<!--` and `-->` and `import(n)` statements.\n *\n * @param code - The code to post process.\n * @param options - The post-process options.\n * @param options.stripComments - Whether to strip comments. Defaults to `true`.\n * @param options.sourceMap - Whether to generate a source map for the modified\n * code. See also `inputSourceMap`.\n * @param options.inputSourceMap - The source map for the input code. When\n * provided, the source map will be used to generate a source map for the\n * modified code. This ensures that the source map is correct for the modified\n * code, and still points to the original source. If not provided, a new source\n * map will be generated instead.\n * @returns An object containing the modified code, and source map, or null if\n * the provided code is null.\n */\nexport function postProcessBundle(\n  code: string,\n  {\n    stripComments = true,\n    sourceMap: sourceMaps,\n    inputSourceMap,\n  }: Partial<PostProcessOptions> = {},\n): PostProcessedBundle {\n  const warnings = new Set<PostProcessWarning>();\n\n  const pre: PluginObj['pre'] = ({ ast }) => {\n    ast.comments?.forEach((comment) => {\n      // Break up tokens that could be parsed as HTML comment terminators. The\n      // regular expressions below are written strangely so as to avoid the\n      // appearance of such tokens in our source code. For reference:\n      // https://github.com/endojs/endo/blob/70cc86eb400655e922413b99c38818d7b2e79da0/packages/ses/error-codes/SES_HTML_COMMENT_REJECTED.md\n      comment.value = comment.value\n        .replace(new RegExp(`<!${'--'}`, 'gu'), '< !--')\n        .replace(new RegExp(`${'--'}>`, 'gu'), '-- >')\n        .replace(/import(\\(.*\\))/gu, 'import\\\\$1');\n    });\n  };\n\n  const visitor: Visitor<Node> = {\n    FunctionExpression(path) {\n      const { node } = path;\n\n      // Browserify provides the `Buffer` global as an argument to modules that\n      // use it, but this does not work in SES. Since we pass in `Buffer` as an\n      // endowment, we can simply remove the argument.\n      //\n      // Note that this only removes `Buffer` from a wrapped function\n      // expression, e.g., `(function (Buffer) { ... })`. Regular functions\n      // are not affected.\n      //\n      // TODO: Since we're working on the AST level, we could check the scope\n      // of the function expression, and possibly prevent false positives?\n      if (node.type === 'FunctionExpression' && node.extra?.parenthesized) {\n        node.params = node.params.filter(\n          (param) => !(param.type === 'Identifier' && param.name === 'Buffer'),\n        );\n      }\n    },\n\n    CallExpression(path) {\n      const { node } = path;\n\n      // Replace `eval(foo)` with `(1, eval)(foo)`.\n      if (node.callee.type === 'Identifier' && node.callee.name === 'eval') {\n        path.replaceWith(\n          evalWrapper({\n            REF: node.callee,\n            ARGS: node.arguments,\n          }),\n        );\n      }\n\n      // Detect the use of `Math.random()` and add a warning.\n      if (\n        node.callee.type === 'MemberExpression' &&\n        node.callee.object.type === 'Identifier' &&\n        node.callee.object.name === 'Math' &&\n        node.callee.property.type === 'Identifier' &&\n        node.callee.property.name === 'random'\n      ) {\n        warnings.add(PostProcessWarning.UnsafeMathRandom);\n      }\n    },\n\n    MemberExpression(path) {\n      const { node } = path;\n\n      // Replace `object.eval(foo)` with `(1, object.eval)(foo)`.\n      if (\n        node.property.type === 'Identifier' &&\n        node.property.name === 'eval' &&\n        // We only apply this to MemberExpressions that are the callee of CallExpression\n        path.parent.type === 'CallExpression' &&\n        path.parent.callee === node\n      ) {\n        path.replaceWith(\n          objectEvalWrapper({\n            OBJECT: node.object,\n            REF: node.property,\n          }),\n        );\n      }\n    },\n\n    Identifier(path) {\n      const { node } = path;\n\n      // Insert `regeneratorRuntime` global if it's used in the code.\n      if (node.name === 'regeneratorRuntime') {\n        const program = path.findParent(\n          (parent) => parent.node.type === 'Program',\n        );\n\n        // We know that `program` is a Program node here, but this keeps\n        // TypeScript happy.\n        if (program?.node.type === 'Program') {\n          const body = program.node.body[0];\n\n          // This stops it from inserting `regeneratorRuntime` multiple times.\n          if (\n            body.type === 'VariableDeclaration' &&\n            (body.declarations[0].id as Identifier).name ===\n              'regeneratorRuntime'\n          ) {\n            return;\n          }\n\n          program?.node.body.unshift(regeneratorRuntimeWrapper());\n        }\n      }\n    },\n\n    TemplateLiteral(path) {\n      const { node } = path;\n\n      // This checks if the template literal was visited before. Without this,\n      // it would cause an infinite loop resulting in a stack overflow. We can't\n      // skip the path here, because we need to visit the children of the node.\n      if (path.getData('visited')) {\n        return;\n      }\n\n      // Break up tokens that could be parsed as HTML comment terminators, or\n      // `import()` statements.\n      // For reference:\n      // - https://github.com/endojs/endo/blob/70cc86eb400655e922413b99c38818d7b2e79da0/packages/ses/error-codes/SES_HTML_COMMENT_REJECTED.md\n      // - https://github.com/MetaMask/snaps-monorepo/issues/505\n      const [replacementQuasis, replacementExpressions] = node.quasis.reduce<\n        [TemplateElement[], Expression[]]\n      >(\n        ([elements, expressions], quasi, index) => {\n          // Note: Template literals have two variants, \"cooked\" and \"raw\". Here\n          // we use the cooked version.\n          // https://exploringjs.com/impatient-js/ch_template-literals.html#template-strings-cooked-vs-raw\n          const tokens = breakTokensTemplateLiteral(\n            quasi.value.cooked as string,\n          );\n\n          // Only update the node if something changed.\n          if (tokens[0].length <= 1) {\n            return [\n              [...elements, quasi],\n              [...expressions, node.expressions[index] as Expression],\n            ];\n          }\n\n          return [\n            [...elements, ...tokens[0]],\n            [\n              ...expressions,\n              ...tokens[1],\n              node.expressions[index] as Expression,\n            ],\n          ];\n        },\n        [[], []],\n      );\n\n      path.replaceWith(\n        templateLiteral(\n          replacementQuasis,\n          replacementExpressions.filter(\n            (expression) => expression !== undefined,\n          ),\n        ) as Node,\n      );\n\n      path.setData('visited', true);\n    },\n\n    StringLiteral(path) {\n      const { node } = path;\n\n      // Break up tokens that could be parsed as HTML comment terminators, or\n      // `import()` statements.\n      // For reference:\n      // - https://github.com/endojs/endo/blob/70cc86eb400655e922413b99c38818d7b2e79da0/packages/ses/error-codes/SES_HTML_COMMENT_REJECTED.md\n      // - https://github.com/MetaMask/snaps-monorepo/issues/505\n      const tokens = breakTokens(node.value);\n\n      // Only update the node if the string literal was broken up.\n      if (tokens.length <= 1) {\n        return;\n      }\n\n      const replacement = tokens\n        .slice(1)\n        .reduce<Expression>(\n          (acc, value) => binaryExpression('+', acc, stringLiteral(value)),\n          stringLiteral(tokens[0]),\n        );\n\n      path.replaceWith(replacement as Node);\n      path.skip();\n    },\n\n    BinaryExpression(path) {\n      const { node } = path;\n\n      const errorMessage =\n        'Using HTML comments (`<!--` and `-->`) as operators is not allowed. The behaviour of ' +\n        'these comments is ambiguous, and differs per browser and environment. If you want ' +\n        'to use them as operators, break them up into separate characters, i.e., `a-- > b` ' +\n        'and `a < ! --b`.';\n\n      if (\n        node.operator === '<' &&\n        isUnaryExpression(node.right) &&\n        isUpdateExpression(node.right.argument) &&\n        node.right.argument.operator === '--' &&\n        node.left.end &&\n        node.right.argument.argument.start\n      ) {\n        const expression = code.slice(\n          node.left.end,\n          node.right.argument.argument.start,\n        );\n\n        if (expression.includes('<!--')) {\n          throw new Error(errorMessage);\n        }\n      }\n\n      if (\n        node.operator === '>' &&\n        isUpdateExpression(node.left) &&\n        node.left.operator === '--' &&\n        node.left.argument.end &&\n        node.right.start\n      ) {\n        const expression = code.slice(node.left.argument.end, node.right.start);\n\n        if (expression.includes('-->')) {\n          throw new Error(errorMessage);\n        }\n      }\n    },\n  };\n\n  try {\n    const file = transformSync(code, {\n      // Prevent Babel from searching for a config file.\n      configFile: false,\n\n      parserOpts: {\n        // Strict mode isn't enabled by default, so we need to enable it here.\n        strictMode: true,\n\n        // If this is disabled, the AST does not include any comments. This is\n        // useful for performance reasons, and we use it for stripping comments.\n        attachComment: !stripComments,\n      },\n\n      // By default, Babel optimises bundles that exceed 500 KB, but that\n      // results in characters which look like HTML comments, which breaks SES.\n      compact: false,\n\n      // This configures Babel to generate a new source map from the existing\n      // source map if specified. If `sourceMap` is `true` but an input source\n      // map is not provided, a new source map will be generated instead.\n      inputSourceMap,\n      sourceMaps,\n\n      plugins: [\n        () => ({\n          pre,\n          visitor,\n        }),\n      ],\n    });\n\n    if (!file?.code) {\n      throw new Error('Bundled code is empty.');\n    }\n\n    return {\n      code: file.code,\n      sourceMap: file.map,\n      warnings: Array.from(warnings),\n    };\n  } catch (error) {\n    throw new Error(`Failed to post process code:\\n${error.message}`);\n  }\n}\n"]}

package/dist/promise.cjs

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=promise.cjs.map

package/dist/promise.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"promise.cjs","sourceRoot":"","sources":["../src/promise.ts"],"names":[],"mappings":"","sourcesContent":["export type Promisable<Type> = Type | Promise<Type>;\n"]}

package/dist/promise.d.cts

@@ -0,0 +1,2 @@
+export type Promisable<Type> = Type | Promise<Type>;
+//# sourceMappingURL=promise.d.cts.map

package/dist/promise.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"promise.d.cts","sourceRoot":"","sources":["../src/promise.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,CAAC,IAAI,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/promise.d.mts

@@ -0,0 +1,2 @@
+export type Promisable<Type> = Type | Promise<Type>;
+//# sourceMappingURL=promise.d.mts.map

package/dist/promise.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"promise.d.mts","sourceRoot":"","sources":["../src/promise.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,CAAC,IAAI,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/promise.mjs

@@ -1,2 +1,2 @@
-import "./chunk-NNYGTNHP.mjs";
+export {};
 //# sourceMappingURL=promise.mjs.map

package/dist/promise.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}
+{"version":3,"file":"promise.mjs","sourceRoot":"","sources":["../src/promise.ts"],"names":[],"mappings":"","sourcesContent":["export type Promisable<Type> = Type | Promise<Type>;\n"]}

package/dist/snaps.cjs

@@ -0,0 +1,207 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyRequestedSnapPermissions = exports.isSnapPermitted = exports.isCaipChainId = exports.assertIsValidSnapId = exports.stripSnapPrefix = exports.getSnapPrefix = exports.SnapIdStruct = exports.HttpSnapIdStruct = exports.NpmSnapIdStruct = exports.LocalSnapIdStruct = exports.BaseSnapIdStruct = exports.LOCALHOST_HOSTNAMES = exports.validateSnapShasum = exports.getSnapChecksum = exports.SnapStatusEvents = exports.SnapStatus = exports.PROPOSED_NAME_REGEX = void 0;
+const superstruct_1 = require("@metamask/superstruct");
+const utils_1 = require("@metamask/utils");
+const base_1 = require("@scure/base");
+const fast_json_stable_stringify_1 = __importDefault(require("fast-json-stable-stringify"));
+const validate_npm_package_name_1 = __importDefault(require("validate-npm-package-name"));
+const caveats_1 = require("./caveats.cjs");
+const checksum_1 = require("./checksum.cjs");
+const types_1 = require("./types.cjs");
+// This RegEx matches valid npm package names (with some exceptions) and space-
+// separated alphanumerical words, optionally with dashes and underscores.
+// The RegEx consists of two parts. The first part matches space-separated
+// words. It is based on the following Stackoverflow answer:
+// https://stackoverflow.com/a/34974982
+// The second part, after the pipe operator, is the same RegEx used for the
+// `name` field of the official package.json JSON Schema, except that we allow
+// mixed-case letters. It was originally copied from:
+// https://github.com/SchemaStore/schemastore/blob/81a16897c1dabfd98c72242a5fd62eb080ff76d8/src/schemas/json/package.json#L132-L138
+exports.PROPOSED_NAME_REGEX = /^(?:[A-Za-z0-9-_]+( [A-Za-z0-9-_]+)*)|(?:(?:@[A-Za-z0-9-*~][A-Za-z0-9-*._~]*\/)?[A-Za-z0-9-~][A-Za-z0-9-._~]*)$/u;
+var SnapStatus;
+(function (SnapStatus) {
+    SnapStatus["Installing"] = "installing";
+    SnapStatus["Updating"] = "updating";
+    SnapStatus["Running"] = "running";
+    SnapStatus["Stopped"] = "stopped";
+    SnapStatus["Crashed"] = "crashed";
+})(SnapStatus || (exports.SnapStatus = SnapStatus = {}));
+var SnapStatusEvents;
+(function (SnapStatusEvents) {
+    SnapStatusEvents["Start"] = "START";
+    SnapStatusEvents["Stop"] = "STOP";
+    SnapStatusEvents["Crash"] = "CRASH";
+    SnapStatusEvents["Update"] = "UPDATE";
+})(SnapStatusEvents || (exports.SnapStatusEvents = SnapStatusEvents = {}));
+/**
+ * Gets a checksummable manifest by removing the shasum property and reserializing the JSON using a deterministic algorithm.
+ *
+ * @param manifest - The manifest itself.
+ * @returns A virtual file containing the checksummable manifest.
+ */
+function getChecksummableManifest(manifest) {
+    const manifestCopy = manifest.clone();
+    delete manifestCopy.result.source.shasum;
+    // We use fast-json-stable-stringify to deterministically serialize the JSON
+    // This is required before checksumming so we get reproducible checksums across platforms etc
+    manifestCopy.value = (0, fast_json_stable_stringify_1.default)(manifestCopy.result);
+    return manifestCopy;
+}
+/**
+ * Calculates the Base64-encoded SHA-256 digest of all required Snap files.
+ *
+ * @param files - All required Snap files to be included in the checksum.
+ * @returns The Base64-encoded SHA-256 digest of the source code.
+ */
+async function getSnapChecksum(files) {
+    const { manifest, sourceCode, svgIcon, auxiliaryFiles, localizationFiles } = files;
+    const all = [
+        getChecksummableManifest(manifest),
+        sourceCode,
+        svgIcon,
+        ...auxiliaryFiles,
+        ...localizationFiles,
+    ].filter((file) => file !== undefined);
+    return base_1.base64.encode(await (0, checksum_1.checksumFiles)(all));
+}
+exports.getSnapChecksum = getSnapChecksum;
+/**
+ * Checks whether the `source.shasum` property of a Snap manifest matches the
+ * shasum of the snap.
+ *
+ * @param files - All required Snap files to be included in the checksum.
+ * @param errorMessage - The error message to throw if validation fails.
+ */
+async function validateSnapShasum(files, errorMessage = 'Invalid Snap manifest: manifest shasum does not match computed shasum.') {
+    if (files.manifest.result.source.shasum !== (await getSnapChecksum(files))) {
+        throw new Error(errorMessage);
+    }
+}
+exports.validateSnapShasum = validateSnapShasum;
+exports.LOCALHOST_HOSTNAMES = ['localhost', '127.0.0.1', '[::1]'];
+// Require snap ids to only consist of printable ASCII characters
+exports.BaseSnapIdStruct = (0, superstruct_1.pattern)((0, superstruct_1.string)(), /^[\x21-\x7E]*$/u);
+const LocalSnapIdSubUrlStruct = (0, types_1.uri)({
+    protocol: (0, superstruct_1.enums)(['http:', 'https:']),
+    hostname: (0, superstruct_1.enums)(exports.LOCALHOST_HOSTNAMES),
+    hash: (0, superstruct_1.empty)((0, superstruct_1.string)()),
+    search: (0, superstruct_1.empty)((0, superstruct_1.string)()),
+});
+exports.LocalSnapIdStruct = (0, superstruct_1.refine)(exports.BaseSnapIdStruct, 'local Snap Id', (value) => {
+    if (!value.startsWith(types_1.SnapIdPrefixes.local)) {
+        return `Expected local snap ID, got "${value}".`;
+    }
+    const [error] = (0, superstruct_1.validate)(value.slice(types_1.SnapIdPrefixes.local.length), LocalSnapIdSubUrlStruct);
+    return error ?? true;
+});
+exports.NpmSnapIdStruct = (0, superstruct_1.intersection)([
+    exports.BaseSnapIdStruct,
+    (0, types_1.uri)({
+        protocol: (0, superstruct_1.literal)(types_1.SnapIdPrefixes.npm),
+        pathname: (0, superstruct_1.refine)((0, superstruct_1.string)(), 'package name', function* (value) {
+            const normalized = value.startsWith('/') ? value.slice(1) : value;
+            const { errors, validForNewPackages, warnings } = (0, validate_npm_package_name_1.default)(normalized);
+            if (!validForNewPackages) {
+                if (errors === undefined) {
+                    (0, utils_1.assert)(warnings !== undefined);
+                    yield* warnings;
+                }
+                else {
+                    yield* errors;
+                }
+            }
+            return true;
+        }),
+        search: (0, superstruct_1.empty)((0, superstruct_1.string)()),
+        hash: (0, superstruct_1.empty)((0, superstruct_1.string)()),
+    }),
+]);
+exports.HttpSnapIdStruct = (0, superstruct_1.intersection)([
+    exports.BaseSnapIdStruct,
+    (0, types_1.uri)({
+        protocol: (0, superstruct_1.enums)(['http:', 'https:']),
+        search: (0, superstruct_1.empty)((0, superstruct_1.string)()),
+        hash: (0, superstruct_1.empty)((0, superstruct_1.string)()),
+    }),
+]);
+exports.SnapIdStruct = (0, superstruct_1.union)([exports.NpmSnapIdStruct, exports.LocalSnapIdStruct]);
+/**
+ * Extracts the snap prefix from a snap ID.
+ *
+ * @param snapId - The snap ID to extract the prefix from.
+ * @returns The snap prefix from a snap id, e.g. `npm:`.
+ */
+function getSnapPrefix(snapId) {
+    const prefix = Object.values(types_1.SnapIdPrefixes).find((possiblePrefix) => snapId.startsWith(possiblePrefix));
+    if (prefix !== undefined) {
+        return prefix;
+    }
+    throw new Error(`Invalid or no prefix found for "${snapId}"`);
+}
+exports.getSnapPrefix = getSnapPrefix;
+/**
+ * Strips snap prefix from a full snap ID.
+ *
+ * @param snapId - The snap ID to strip.
+ * @returns The stripped snap ID.
+ */
+function stripSnapPrefix(snapId) {
+    return snapId.replace(getSnapPrefix(snapId), '');
+}
+exports.stripSnapPrefix = stripSnapPrefix;
+/**
+ * Assert that the given value is a valid snap ID.
+ *
+ * @param value - The value to check.
+ * @throws If the value is not a valid snap ID.
+ */
+function assertIsValidSnapId(value) {
+    (0, utils_1.assertStruct)(value, exports.SnapIdStruct, 'Invalid snap ID');
+}
+exports.assertIsValidSnapId = assertIsValidSnapId;
+/**
+ * Typeguard to ensure a chainId follows the CAIP-2 standard.
+ *
+ * @param chainId - The chainId being tested.
+ * @returns `true` if the value is a valid CAIP chain id, and `false` otherwise.
+ */
+function isCaipChainId(chainId) {
+    return (typeof chainId === 'string' &&
+        /^(?<namespace>[-a-z0-9]{3,8}):(?<reference>[-a-zA-Z0-9]{1,32})$/u.test(chainId));
+}
+exports.isCaipChainId = isCaipChainId;
+/**
+ * Utility function to check if an origin has permission (and caveat) for a particular snap.
+ *
+ * @param permissions - An origin's permissions object.
+ * @param snapId - The id of the snap.
+ * @returns A boolean based on if an origin has the specified snap.
+ */
+function isSnapPermitted(permissions, snapId) {
+    return Boolean((permissions?.wallet_snap?.caveats?.find((caveat) => caveat.type === caveats_1.SnapCaveatType.SnapIds) ?? {}).value?.[snapId]);
+}
+exports.isSnapPermitted = isSnapPermitted;
+/**
+ * Checks whether the passed in requestedPermissions is a valid
+ * permission request for a `wallet_snap` permission.
+ *
+ * @param requestedPermissions - The requested permissions.
+ * @throws If the criteria is not met.
+ */
+function verifyRequestedSnapPermissions(requestedPermissions) {
+    (0, utils_1.assert)((0, utils_1.isObject)(requestedPermissions), 'Requested permissions must be an object.');
+    const { wallet_snap: walletSnapPermission } = requestedPermissions;
+    (0, utils_1.assert)((0, utils_1.isObject)(walletSnapPermission), 'wallet_snap is missing from the requested permissions.');
+    const { caveats } = walletSnapPermission;
+    (0, utils_1.assert)(Array.isArray(caveats) && caveats.length === 1, 'wallet_snap must have a caveat property with a single-item array value.');
+    const [caveat] = caveats;
+    (0, utils_1.assert)((0, utils_1.isObject)(caveat) &&
+        caveat.type === caveats_1.SnapCaveatType.SnapIds &&
+        (0, utils_1.isObject)(caveat.value), `The requested permissions do not have a valid ${caveats_1.SnapCaveatType.SnapIds} caveat.`);
+}
+exports.verifyRequestedSnapPermissions = verifyRequestedSnapPermissions;
+//# sourceMappingURL=snaps.cjs.map