Skip to content

feat: add @metamask/platform-api-docs package#8012

Open
cryptodev-2s wants to merge 134 commits into
mainfrom
feat/messenger-docs-site
Open

feat: add @metamask/platform-api-docs package#8012
cryptodev-2s wants to merge 134 commits into
mainfrom
feat/messenger-docs-site

Conversation

@cryptodev-2s
Copy link
Copy Markdown
Contributor

@cryptodev-2s cryptodev-2s commented Feb 22, 2026

Explanation

Adds @metamask/platform-api-docs, a publishable package that generates and serves a searchable site documenting the Platform API — the catalog of actions and events available to clients through the message bus.

The package scans TypeScript source and .d.cts declaration files, finds every *Messenger type declaration, walks its Actions and Events type arguments to discover the capability types they reference, extracts JSDoc/handler/payload information for each, and renders the result as a Docusaurus site with per-namespace pages and local search.

Features

  • Anchored on Messenger declarations. Extraction discovers *Messenger type aliases and walks Messenger<Namespace, Actions, Events> to find the capability types — eliminating false positives from unrelated types that happen to share an action/event-like shape.
  • Two capability-type patterns supported. Inline (type FooAction = { type: '...'; handler: ... }) and capability-type constructors (type FooGetStateAction = ControllerGetStateAction<typeof name, State>), including their interface variants.
  • Union expansion. When a Messenger references an umbrella union like FooActions = FooGetAction | FooSetAction, the walker descends through it without documenting the intermediate alias.
  • Scans three layouts. Configured --scan-dirs, packages/*/src/ (.ts), and node_modules/@metamask/*/dist/ (.d.cts).
  • Source links resolve automatically. Reads git remote get-url origin and git symbolic-ref refs/remotes/origin/HEAD to build https://github.com/<owner>/<repo>/blob/<branch>/<path>#L<line> URLs; falls back to main for shallow clones.
  • Project label and commit SHA stamped on the site. --project-label Core / --project-label Extension produces titles like Platform API (Core), and the short Git commit is shown in the intro and navbar so engineers can tell how current the docs are.
  • Dedup across packages. When a capability is declared in two places (e.g. once as the home definition and once as a re-export), the version with JSDoc and from the matching namespace's package wins.
  • Docusaurus site with dark/light mode, offline search (no Algolia), and MDX-safe rendering of JSDoc.

Usage

From the core monorepo:

yarn docs:platform-api:build   # Generate docs and build static site
yarn docs:platform-api:dev     # Dev server with hot reload
yarn docs:platform-api:serve   # Build and serve

From client projects (Extension, Mobile), install @metamask/platform-api-docs as a devDependency and add a script:

{
  "scripts": {
    "docs:platform-api:build": "platform-api-docs --build --project-label MyProject"
  }
}

Implementation

  • packages/platform-api-docs/ — separate workspace from @metamask/messenger-cli (different deps and release cadence).
  • CLI built with yargs; runs Docusaurus through execa. Flags: --build, --serve, --dev, --scan-dir (additive, repeatable), --output, --project-label. Configuration is CLI-only — no package.json config block.
  • AST parsing via ts-morph instead of the raw TypeScript compiler API. Standard JSDoc extraction (jsDoc.getDescription() + getTags()) replaces the previous hand-rolled comment parser.
  • Single-pass extraction. The Messenger walk returns TypeAliasDeclaration/InterfaceDeclaration nodes directly tagged with 'action'/'event' kind, so the main loop doesn't re-walk the source file looking up names.
  • File discovery via the glob package, with results sorted for deterministic output across filesystems.
  • Test coverage: 100% lines / ~93% branches. Defensive guards against AST shapes that don't appear in real messenger types are explicitly marked with // istanbul ignore comments.
  • GitHub Actions workflow (deploy-platform-api-docs.yml) builds docs on PRs (uploads the build as an artifact) and deploys to GitHub Pages on main.

References

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've communicated my changes to consumers by updating changelogs for packages I've changed
  • I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Note

Low Risk
New tooling and CI publishing static docs; no runtime changes to controllers or messenger behavior in client apps.

Overview
Introduces @metamask/platform-api-docs, a CLI that scans TypeScript (monorepo packages/*/src, optional scan dirs, and node_modules/@metamask/*/dist .d.cts) for *Messenger types, walks Actions/Events unions to extract JSDoc and handler/payload signatures, and emits a Docusaurus site with per-namespace pages and local search.

Monorepo wiring: root scripts docs:platform-api:{build,dev,serve}, README/CODEOWNERS, ESLint ignores and Node rules for the package, .gitignore for .platform-api-docs/, and a deploy-platform-api-docs reusable workflow (artifact on PRs; on main, deploy to gh-pages under platform-api/ with keep_files and a PAT via token exchange). main.yml runs that job after lint/build/test and gates all-jobs-complete on it. ESLint heap for the repo is bumped to 8GB.

The package is publishable (platform-api-docs bin), heavily tested (CLI, discovery, extraction, generate), and themed for MetaMask docs; consumers can pass --project-label, commit SHA, and site URL/base for hosted docs.

Reviewed by Cursor Bugbot for commit a3545ae. Bugbot is set up for automated code reviews on this repo. Configure here.

@cryptodev-2s cryptodev-2s self-assigned this Feb 22, 2026
@cryptodev-2s cryptodev-2s force-pushed the feat/messenger-docs-site branch 4 times, most recently from 63f3188 to 7c63a0d Compare February 22, 2026 22:26
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Feb 22, 2026

Caution

MetaMask internal reviewing guidelines:

  • Do not ignore-all
  • Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
  • Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
    @SocketSecurity ignore npm/PACKAGE@VERSION
Action Severity Alert  (click "▶" to expand/collapse)
Block High
Obfuscated code: npm lunr-languages is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/lunr-languages@1.20.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lunr-languages@1.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
Obfuscated code: npm lunr-languages is 95.0% likely obfuscated

Confidence: 0.95

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/lunr-languages@1.20.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lunr-languages@1.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
Obfuscated code: npm svgo is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/@docusaurus/preset-classic@3.10.1npm/svgo@3.3.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/svgo@3.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @algolia/requester-fetch in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/preset-classic@3.10.1npm/@algolia/requester-fetch@5.53.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@algolia/requester-fetch@5.53.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @algolia/requester-node-http in module http

Module: http

Location: Package overview

From: ?npm/@docusaurus/preset-classic@3.10.1npm/@algolia/requester-node-http@5.53.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@algolia/requester-node-http@5.53.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @algolia/requester-node-http in module https

Module: https

Location: Package overview

From: ?npm/@docusaurus/preset-classic@3.10.1npm/@algolia/requester-node-http@5.53.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@algolia/requester-node-http@5.53.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @docsearch/react in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/preset-classic@3.10.1npm/@docsearch/react@4.6.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@docsearch/react@4.6.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @emnapi/core in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/@emnapi/core@1.10.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: npm @node-rs/jieba in module child_process

Module: child_process

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/@node-rs/jieba@1.10.4

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@node-rs/jieba@1.10.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @tybys/wasm-util in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/@tybys/wasm-util@0.10.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tybys/wasm-util@0.10.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: npm address in module child_process

Module: child_process

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/address@1.2.2

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/address@1.2.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm babel-plugin-polyfill-corejs3 in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/babel-plugin-polyfill-corejs3@0.13.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/babel-plugin-polyfill-corejs3@0.13.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm babel-plugin-polyfill-corejs3 in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/@docusaurus/preset-classic@3.10.1npm/babel-plugin-polyfill-corejs3@0.14.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/babel-plugin-polyfill-corejs3@0.14.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm clean-css in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/clean-css@5.3.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/clean-css@5.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm clean-css in module http

Module: http

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/clean-css@5.3.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/clean-css@5.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm clean-css in module https

Module: https

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/clean-css@5.3.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/clean-css@5.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm config-chain in module http

Module: http

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/config-chain@1.1.13

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/config-chain@1.1.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm core-js in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/core-js@3.49.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/core-js@3.49.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm detect-port in module net

Module: net

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/detect-port@1.6.1

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/detect-port@1.6.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm domutils in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/domutils@2.8.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/domutils@2.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm domutils in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/@docusaurus/core@3.10.1npm/@docusaurus/preset-classic@3.10.1npm/domutils@3.2.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/domutils@3.2.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm glob in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: packages/platform-api-docs/package.jsonnpm/glob@13.0.6

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/glob@13.0.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm htmlparser2 in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/htmlparser2@6.1.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/htmlparser2@6.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm http-proxy-middleware in module http-proxy

Module: http-proxy

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/http-proxy-middleware@2.0.9

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/http-proxy-middleware@2.0.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm http-proxy in module http

Module: http

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/http-proxy@1.18.1

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/http-proxy@1.18.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm http-proxy in module https

Module: https

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/http-proxy@1.18.1

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/http-proxy@1.18.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm http2-wrapper in module net

Module: net

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/http2-wrapper@2.2.1

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/http2-wrapper@2.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm http2-wrapper in module tls

Module: tls

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/http2-wrapper@2.2.1

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/http2-wrapper@2.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 109 more rows in the dashboard

View full report

@cryptodev-2s cryptodev-2s force-pushed the feat/messenger-docs-site branch 3 times, most recently from b55b682 to 980f677 Compare February 23, 2026 22:31
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@github-actions
Copy link
Copy Markdown
Contributor

Preview builds have been published. See these instructions for more information about preview builds.

Expand for full list of packages and versions.
{
  "@metamask-previews/account-tree-controller": "4.1.1-preview-980f677",
  "@metamask-previews/accounts-controller": "36.0.1-preview-980f677",
  "@metamask-previews/address-book-controller": "7.0.1-preview-980f677",
  "@metamask-previews/ai-controllers": "0.1.0-preview-980f677",
  "@metamask-previews/analytics-controller": "1.0.0-preview-980f677",
  "@metamask-previews/analytics-data-regulation-controller": "0.0.0-preview-980f677",
  "@metamask-previews/announcement-controller": "8.0.0-preview-980f677",
  "@metamask-previews/app-metadata-controller": "2.0.0-preview-980f677",
  "@metamask-previews/approval-controller": "8.0.0-preview-980f677",
  "@metamask-previews/assets-controller": "2.0.2-preview-980f677",
  "@metamask-previews/assets-controllers": "100.0.2-preview-980f677",
  "@metamask-previews/base-controller": "9.0.0-preview-980f677",
  "@metamask-previews/bridge-controller": "67.1.1-preview-980f677",
  "@metamask-previews/bridge-status-controller": "67.0.1-preview-980f677",
  "@metamask-previews/build-utils": "3.0.4-preview-980f677",
  "@metamask-previews/chain-agnostic-permission": "1.4.0-preview-980f677",
  "@metamask-previews/claims-controller": "0.4.2-preview-980f677",
  "@metamask-previews/client-controller": "1.0.0-preview-980f677",
  "@metamask-previews/compliance-controller": "1.0.1-preview-980f677",
  "@metamask-previews/composable-controller": "12.0.0-preview-980f677",
  "@metamask-previews/connectivity-controller": "0.1.0-preview-980f677",
  "@metamask-previews/controller-utils": "11.19.0-preview-980f677",
  "@metamask-previews/core-backend": "6.0.0-preview-980f677",
  "@metamask-previews/delegation-controller": "2.0.1-preview-980f677",
  "@metamask-previews/earn-controller": "11.1.1-preview-980f677",
  "@metamask-previews/eip-5792-middleware": "2.1.0-preview-980f677",
  "@metamask-previews/eip-7702-internal-rpc-middleware": "0.1.0-preview-980f677",
  "@metamask-previews/eip1193-permission-middleware": "1.0.3-preview-980f677",
  "@metamask-previews/ens-controller": "19.0.3-preview-980f677",
  "@metamask-previews/error-reporting-service": "3.0.1-preview-980f677",
  "@metamask-previews/eth-block-tracker": "15.0.1-preview-980f677",
  "@metamask-previews/eth-json-rpc-middleware": "23.1.0-preview-980f677",
  "@metamask-previews/eth-json-rpc-provider": "6.0.0-preview-980f677",
  "@metamask-previews/foundryup": "1.0.1-preview-980f677",
  "@metamask-previews/gas-fee-controller": "26.0.3-preview-980f677",
  "@metamask-previews/gator-permissions-controller": "2.0.0-preview-980f677",
  "@metamask-previews/json-rpc-engine": "10.2.2-preview-980f677",
  "@metamask-previews/json-rpc-middleware-stream": "8.0.8-preview-980f677",
  "@metamask-previews/keyring-controller": "25.1.0-preview-980f677",
  "@metamask-previews/logging-controller": "7.0.1-preview-980f677",
  "@metamask-previews/message-manager": "14.1.0-preview-980f677",
  "@metamask-previews/messenger": "0.3.0-preview-980f677",
  "@metamask-previews/multichain-account-service": "7.0.0-preview-980f677",
  "@metamask-previews/multichain-api-middleware": "1.2.7-preview-980f677",
  "@metamask-previews/multichain-network-controller": "3.0.4-preview-980f677",
  "@metamask-previews/multichain-transactions-controller": "7.0.1-preview-980f677",
  "@metamask-previews/name-controller": "9.0.0-preview-980f677",
  "@metamask-previews/network-controller": "30.0.0-preview-980f677",
  "@metamask-previews/network-enablement-controller": "4.1.2-preview-980f677",
  "@metamask-previews/notification-services-controller": "22.0.0-preview-980f677",
  "@metamask-previews/permission-controller": "12.2.0-preview-980f677",
  "@metamask-previews/permission-log-controller": "5.0.0-preview-980f677",
  "@metamask-previews/perps-controller": "0.0.0-preview-980f677",
  "@metamask-previews/phishing-controller": "16.3.0-preview-980f677",
  "@metamask-previews/polling-controller": "16.0.3-preview-980f677",
  "@metamask-previews/preferences-controller": "22.1.0-preview-980f677",
  "@metamask-previews/profile-metrics-controller": "3.0.1-preview-980f677",
  "@metamask-previews/profile-sync-controller": "27.1.0-preview-980f677",
  "@metamask-previews/ramps-controller": "10.0.0-preview-980f677",
  "@metamask-previews/rate-limit-controller": "7.0.0-preview-980f677",
  "@metamask-previews/remote-feature-flag-controller": "4.0.0-preview-980f677",
  "@metamask-previews/sample-controllers": "4.0.3-preview-980f677",
  "@metamask-previews/seedless-onboarding-controller": "8.1.0-preview-980f677",
  "@metamask-previews/selected-network-controller": "26.0.3-preview-980f677",
  "@metamask-previews/shield-controller": "5.0.1-preview-980f677",
  "@metamask-previews/signature-controller": "39.0.4-preview-980f677",
  "@metamask-previews/storage-service": "1.0.0-preview-980f677",
  "@metamask-previews/subscription-controller": "6.0.0-preview-980f677",
  "@metamask-previews/transaction-controller": "62.18.0-preview-980f677",
  "@metamask-previews/transaction-pay-controller": "16.0.0-preview-980f677",
  "@metamask-previews/user-operation-controller": "41.0.3-preview-980f677"
}

@cryptodev-2s cryptodev-2s force-pushed the feat/messenger-docs-site branch from 980f677 to f49a7dd Compare February 24, 2026 15:09
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

1 similar comment
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@cryptodev-2s cryptodev-2s force-pushed the feat/messenger-docs-site branch from f49a7dd to 44fb063 Compare February 24, 2026 16:22
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@cryptodev-2s cryptodev-2s changed the title feat: add Messenger API docs site with local search feat: add @metamask/messenger-docs Feb 24, 2026
@cryptodev-2s cryptodev-2s changed the title feat: add @metamask/messenger-docs feat: add @metamask/messenger-docs Feb 24, 2026
@cryptodev-2s cryptodev-2s changed the title feat: add @metamask/messenger-docs feat: add @metamask/messenger-docs package Feb 24, 2026
cryptodev-2s and others added 8 commits February 25, 2026 18:55
Docusaurus site for browsing controller messenger actions/events,
with offline search powered by docusaurus-search-local.
## Explanation

The messenger docs generation currently lives in
`scripts/generate-messenger-docs/` and the Docusaurus site template in
`docs-site/`. This makes it unusable by external clients
(metamask-extension, metamask-mobile) without access to this monorepo.

This PR extracts both into a new `@metamask/messenger-docs` package at
`packages/messenger-docs/` with a CLI, so any project with `@metamask`
controller dependencies can generate and serve messenger API docs.

### Usage

```bash
# Default: scans cwd for node_modules/@MetaMask controller/service packages
npx @metamask/messenger-docs

# Scan a specific project
npx @metamask/messenger-docs /path/to/project

# Generate + build static site
npx @metamask/messenger-docs --build

# Generate + serve (build + http server)
npx @metamask/messenger-docs --serve

# Generate + dev server (hot reload)
npx @metamask/messenger-docs --dev

# Scan source .ts files instead of .d.cts (for monorepo development)
npx @metamask/messenger-docs --source

# Custom output directory (default: .messenger-docs)
npx @metamask/messenger-docs --output ./my-docs
```

## References

- Builds on top of `feat/messenger-docs-site`

## Checklist

- [ ] I've updated the test suite for new or updated code as appropriate
- [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or
updated code as appropriate
- [ ] I've communicated my changes to consumers by [updating changelogs
for packages I've
changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md)
- [ ] I've introduced [breaking
changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md)
in this PR and have prepared draft pull requests for clients and
consumer packages to resolve them
@cryptodev-2s cryptodev-2s force-pushed the feat/messenger-docs-site branch from cb82c24 to 17adacd Compare February 25, 2026 17:55
cryptodev-2s added a commit that referenced this pull request Jun 1, 2026
`eslint-plugin-import-x`, `eslint-plugin-n`,
`eslint-import-resolver-typescript`, and `prettier` were floating to
older versions because `yarn.lock` happened to hold them; the platform-
api-docs PR (#8012) added scoped resolutions to keep that frozen.
Bumping the four packages to the latest versions matching their semver
ranges removes the need for those resolutions and surfaces five
pre-existing lint issues that the older plugins didn't flag:

- `eslint-plugin-n@18` rejects `import.meta.dirname` in
  `eslint.config.mjs:132` because the property is only stable in Node
  22.16+/24+, while the repo's engines field is `^18.18 || >=20`.
  Resolve `dirname(fileURLToPath(import.meta.url))` instead so the
  config works on every supported Node version.
- `eslint-plugin-import-x@4.16` enables `no-named-as-default` by
  default. `@metamask/api-specs` exports `MetaMaskOpenRPCDocument` as
  both a named export and the default; switch the
  `chain-agnostic-permission` import to the named form to avoid the
  ambiguous reference.
- `import-x/no-extraneous-dependencies` now catches `@metamask/messenger`
  in `react-data-query/src/createUIQueryClient.test.ts` and
  `@metamask/keyring-controller` in `transaction-pay-controller/src/strategy/relay/hyperliquid-withdraw{,.test}.ts`.
  Both packages already used these symbols at runtime/test time without
  declaring them. Add them to the relevant `dependencies` /
  `devDependencies` blocks.

`yarn dedupe` and `yarn constraints --fix` also rolled the
`messenger-cli` package's `prettier` range forward to match the new
root range. No behavior changes in any of the affected packages —
their tests all still pass at 100% coverage.
Drops the four scoped resolutions for `eslint-import-resolver-typescript`,
`eslint-plugin-import-x`, `eslint-plugin-n`, and `prettier@npm:^3.3.3`.
These were a defense against lockfile regeneration drifting forward to
plugin versions that the codebase wasn't yet lint-clean against.

Resetting `yarn.lock` to main's copy and re-running `yarn install` +
`yarn dedupe` shows the resolved versions land at the exact pins the
resolutions were enforcing — `eslint-plugin-import-x@4.6.1`,
`eslint-import-resolver-typescript@3.7.0`, `eslint-plugin-n@17.15.1`,
and `prettier@3.4.2` — because main's lockfile already records those
specific versions. So the resolutions were strictly redundant on this
branch and can come out without changing anything that yarn actually
installs.

Coverage, lint, and the end-to-end docs build all still pass.
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

The 8GB heap bump in bb3ea4d lifted the OOM ceiling that prompted the
original re-ignore in 21f1876. Verified locally: `yarn lint:eslint`
exits 0 with no output when `site/` is included, so `docusaurus.config.ts`
now gets linted as part of the normal flow.
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 1, 2026

Preview builds have been published. Learn how to use preview builds in other projects.

Expand for full list of packages and versions.
@metamask-previews/account-tree-controller@7.5.0-preview-e15374a5d
@metamask-previews/accounts-controller@38.1.2-preview-e15374a5d
@metamask-previews/address-book-controller@7.1.2-preview-e15374a5d
@metamask-previews/ai-controllers@0.7.0-preview-e15374a5d
@metamask-previews/analytics-controller@1.1.0-preview-e15374a5d
@metamask-previews/analytics-data-regulation-controller@0.0.0-preview-e15374a5d
@metamask-previews/announcement-controller@8.1.0-preview-e15374a5d
@metamask-previews/app-metadata-controller@2.0.1-preview-e15374a5d
@metamask-previews/approval-controller@9.0.1-preview-e15374a5d
@metamask-previews/assets-controller@8.2.0-preview-e15374a5d
@metamask-previews/assets-controllers@108.3.0-preview-e15374a5d
@metamask-previews/authenticated-user-storage@2.0.0-preview-e15374a5d
@metamask-previews/base-controller@9.1.0-preview-e15374a5d
@metamask-previews/base-data-service@0.1.3-preview-e15374a5d
@metamask-previews/bridge-controller@73.2.0-preview-e15374a5d
@metamask-previews/bridge-status-controller@72.0.0-preview-e15374a5d
@metamask-previews/build-utils@3.0.4-preview-e15374a5d
@metamask-previews/chain-agnostic-permission@1.6.1-preview-e15374a5d
@metamask-previews/chomp-api-service@3.1.0-preview-e15374a5d
@metamask-previews/claims-controller@0.5.2-preview-e15374a5d
@metamask-previews/client-controller@1.0.1-preview-e15374a5d
@metamask-previews/compliance-controller@2.0.1-preview-e15374a5d
@metamask-previews/composable-controller@12.0.1-preview-e15374a5d
@metamask-previews/config-registry-controller@0.3.2-preview-e15374a5d
@metamask-previews/connectivity-controller@0.2.0-preview-e15374a5d
@metamask-previews/controller-utils@12.1.0-preview-e15374a5d
@metamask-previews/core-backend@6.3.1-preview-e15374a5d
@metamask-previews/delegation-controller@3.0.1-preview-e15374a5d
@metamask-previews/earn-controller@12.2.0-preview-e15374a5d
@metamask-previews/eip-5792-middleware@3.0.4-preview-e15374a5d
@metamask-previews/eip-7702-internal-rpc-middleware@0.1.1-preview-e15374a5d
@metamask-previews/eip1193-permission-middleware@2.0.1-preview-e15374a5d
@metamask-previews/ens-controller@19.1.3-preview-e15374a5d
@metamask-previews/eth-block-tracker@15.0.1-preview-e15374a5d
@metamask-previews/eth-json-rpc-middleware@23.1.3-preview-e15374a5d
@metamask-previews/eth-json-rpc-provider@6.0.1-preview-e15374a5d
@metamask-previews/foundryup@1.0.1-preview-e15374a5d
@metamask-previews/gas-fee-controller@26.2.2-preview-e15374a5d
@metamask-previews/gator-permissions-controller@4.2.0-preview-e15374a5d
@metamask-previews/geolocation-controller@0.1.3-preview-e15374a5d
@metamask-previews/json-rpc-engine@10.5.0-preview-e15374a5d
@metamask-previews/json-rpc-middleware-stream@8.0.8-preview-e15374a5d
@metamask-previews/keyring-controller@26.0.0-preview-e15374a5d
@metamask-previews/logging-controller@8.0.2-preview-e15374a5d
@metamask-previews/message-manager@14.1.2-preview-e15374a5d
@metamask-previews/messenger@1.2.0-preview-e15374a5d
@metamask-previews/messenger-cli@0.2.0-preview-e15374a5d
@metamask-previews/money-account-balance-service@1.0.2-preview-e15374a5d
@metamask-previews/money-account-controller@0.3.1-preview-e15374a5d
@metamask-previews/money-account-upgrade-controller@2.0.3-preview-e15374a5d
@metamask-previews/multichain-account-service@10.0.1-preview-e15374a5d
@metamask-previews/multichain-api-middleware@3.1.2-preview-e15374a5d
@metamask-previews/multichain-network-controller@3.1.2-preview-e15374a5d
@metamask-previews/multichain-transactions-controller@7.1.0-preview-e15374a5d
@metamask-previews/name-controller@9.1.2-preview-e15374a5d
@metamask-previews/network-controller@32.0.0-preview-e15374a5d
@metamask-previews/network-enablement-controller@5.2.0-preview-e15374a5d
@metamask-previews/notification-services-controller@24.1.2-preview-e15374a5d
@metamask-previews/passkey-controller@2.0.1-preview-e15374a5d
@metamask-previews/permission-controller@13.1.1-preview-e15374a5d
@metamask-previews/permission-log-controller@5.1.0-preview-e15374a5d
@metamask-previews/perps-controller@7.0.0-preview-e15374a5d
@metamask-previews/phishing-controller@17.2.0-preview-e15374a5d
@metamask-previews/platform-api-docs@0.0.0-preview-e15374a5d
@metamask-previews/polling-controller@16.0.6-preview-e15374a5d
@metamask-previews/preferences-controller@23.1.0-preview-e15374a5d
@metamask-previews/profile-metrics-controller@3.1.5-preview-e15374a5d
@metamask-previews/profile-sync-controller@28.1.1-preview-e15374a5d
@metamask-previews/ramps-controller@14.0.0-preview-e15374a5d
@metamask-previews/rate-limit-controller@7.0.1-preview-e15374a5d
@metamask-previews/react-data-query@0.2.1-preview-e15374a5d
@metamask-previews/remote-feature-flag-controller@4.2.1-preview-e15374a5d
@metamask-previews/sample-controllers@5.0.1-preview-e15374a5d
@metamask-previews/seedless-onboarding-controller@10.0.0-preview-e15374a5d
@metamask-previews/selected-network-controller@26.1.3-preview-e15374a5d
@metamask-previews/shield-controller@5.1.2-preview-e15374a5d
@metamask-previews/signature-controller@39.2.3-preview-e15374a5d
@metamask-previews/snap-account-service@0.2.1-preview-e15374a5d
@metamask-previews/social-controllers@2.2.1-preview-e15374a5d
@metamask-previews/storage-service@1.0.1-preview-e15374a5d
@metamask-previews/subscription-controller@6.1.3-preview-e15374a5d
@metamask-previews/transaction-controller@66.0.0-preview-e15374a5d
@metamask-previews/transaction-pay-controller@23.0.0-preview-e15374a5d
@metamask-previews/user-operation-controller@41.2.3-preview-e15374a5d
@metamask-previews/wallet@1.0.1-preview-e15374a5d

Comment thread .github/workflows/deploy-platform-api-docs.yml
cryptodev-2s added a commit that referenced this pull request Jun 2, 2026
`eslint-plugin-import-x`, `eslint-plugin-n`,
`eslint-import-resolver-typescript`, and `prettier` were floating to
older versions because `yarn.lock` happened to hold them; the platform-
api-docs PR (#8012) added scoped resolutions to keep that frozen.
Bumping the four packages to the latest versions matching their semver
ranges removes the need for those resolutions and surfaces five
pre-existing lint issues that the older plugins didn't flag:

- `eslint-plugin-n@18` rejects `import.meta.dirname` in
  `eslint.config.mjs:132` because the property is only stable in Node
  22.16+/24+, while the repo's engines field is `^18.18 || >=20`.
  Resolve `dirname(fileURLToPath(import.meta.url))` instead so the
  config works on every supported Node version.
- `eslint-plugin-import-x@4.16` enables `no-named-as-default` by
  default. `@metamask/api-specs` exports `MetaMaskOpenRPCDocument` as
  both a named export and the default; switch the
  `chain-agnostic-permission` import to the named form to avoid the
  ambiguous reference.
- `import-x/no-extraneous-dependencies` now catches `@metamask/messenger`
  in `react-data-query/src/createUIQueryClient.test.ts` and
  `@metamask/keyring-controller` in `transaction-pay-controller/src/strategy/relay/hyperliquid-withdraw{,.test}.ts`.
  Both packages already used these symbols at runtime/test time without
  declaring them. Add them to the relevant `dependencies` /
  `devDependencies` blocks.

`yarn dedupe` and `yarn constraints --fix` also rolled the
`messenger-cli` package's `prettier` range forward to match the new
root range. No behavior changes in any of the affected packages —
their tests all still pass at 100% coverage.
cryptodev-2s added a commit that referenced this pull request Jun 2, 2026
`eslint-plugin-import-x`, `eslint-plugin-n`,
`eslint-import-resolver-typescript`, and `prettier` were floating to
older versions because `yarn.lock` happened to hold them; the platform-
api-docs PR (#8012) added scoped resolutions to keep that frozen.
Bumping the four packages to the latest versions matching their semver
ranges removes the need for those resolutions and surfaces five
pre-existing lint issues that the older plugins didn't flag:

- `eslint-plugin-n@18` rejects `import.meta.dirname` in
  `eslint.config.mjs:132` because the property is only stable in Node
  22.16+/24+, while the repo's engines field is `^18.18 || >=20`.
  Resolve `dirname(fileURLToPath(import.meta.url))` instead so the
  config works on every supported Node version.
- `eslint-plugin-import-x@4.16` enables `no-named-as-default` by
  default. `@metamask/api-specs` exports `MetaMaskOpenRPCDocument` as
  both a named export and the default; switch the
  `chain-agnostic-permission` import to the named form to avoid the
  ambiguous reference.
- `import-x/no-extraneous-dependencies` now catches `@metamask/messenger`
  in `react-data-query/src/createUIQueryClient.test.ts` and
  `@metamask/keyring-controller` in `transaction-pay-controller/src/strategy/relay/hyperliquid-withdraw{,.test}.ts`.
  Both packages already used these symbols at runtime/test time without
  declaring them. Add them to the relevant `dependencies` /
  `devDependencies` blocks.

`yarn dedupe` and `yarn constraints --fix` also rolled the
`messenger-cli` package's `prettier` range forward to match the new
root range. No behavior changes in any of the affected packages —
their tests all still pass at 100% coverage.
pull Bot pushed a commit to Reality2byte/core that referenced this pull request Jun 2, 2026
…aMask#8971)

## Explanation

`packages/react-data-query/src/createUIQueryClient.test.ts` imports
`Messenger` from `@metamask/messenger`, but the package wasn't listed in
`react-data-query`'s `devDependencies`. That's an
`import-x/no-extraneous-dependencies` violation — the currently-pinned
plugin version misses it but newer versions flag it. This PR adds the
missing devDep so the relationship is declared explicitly and the test
file lints cleanly under newer plugin versions.

Also regenerates `README.md` so the workspace dependency graph reflects
the new edge.

## References

- Surfaced while investigating the scoped lint-plugin resolutions on
MetaMask#8012.
- Extracted from the parked MetaMask#8940 so the dep cleanup can land
independently of the lint-plugin major bumps that PR also carried.

## Checklist

- [x] I've updated the test suite for new or updated code as appropriate
- [x] I've updated documentation (JSDoc, Markdown, etc.) for new or
updated code as appropriate
- [ ] I've communicated my changes to consumers by [updating changelogs
for packages I've
changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md)
— N/A, devDep only, not consumer-facing
- [ ] I've introduced [breaking
changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md)
in this PR and have prepared draft pull requests for clients and
consumer packages to resolve them — N/A
pull Bot pushed a commit to Reality2byte/core that referenced this pull request Jun 2, 2026
…er as a dependency (MetaMask#8972)

## Explanation

`src/strategy/relay/hyperliquid-withdraw{,.test}.ts` imports
`@metamask/keyring-controller` at runtime, but the package wasn't listed
in `dependencies`. Consumers were relying on transitive hoisting to
install it — once a stricter `import-x/no-extraneous-dependencies` runs
(or yarn's hoisting layout changes), the missing dep would surface. This
PR adds it explicitly so the dep relationship is correct and consumers
get the package installed transitively.

Also regenerates `README.md` so the workspace dependency graph reflects
the new edge.

## References

- Surfaced while investigating the scoped lint-plugin resolutions on
MetaMask#8012.
- Extracted from the parked MetaMask#8940 so the dep cleanup can land
independently of the lint-plugin major bumps that PR also carried.

## Checklist

- [x] I've updated the test suite for new or updated code as appropriate
- [x] I've updated documentation (JSDoc, Markdown, etc.) for new or
updated code as appropriate
- [x] I've communicated my changes to consumers by [updating changelogs
for packages I've
changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md)
- [ ] I've introduced [breaking
changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md)
in this PR and have prepared draft pull requests for clients and
consumer packages to resolve them — N/A
Copy link
Copy Markdown
Contributor

@mcmire mcmire left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess I hadn't reviewed the workflow in detail. I had some comments on that.

Comment thread .github/workflows/deploy-platform-api-docs.yml Outdated
Comment thread .github/workflows/deploy-platform-api-docs.yml Outdated
Comment thread .github/workflows/deploy-platform-api-docs.yml
Comment thread .github/workflows/deploy-platform-api-docs.yml Outdated
Comment thread .github/workflows/deploy-platform-api-docs.yml Outdated
Comment thread .github/workflows/deploy-platform-api-docs.yml Outdated
Comment thread .github/workflows/deploy-platform-api-docs.yml
Comment thread .github/workflows/deploy-platform-api-docs.yml Outdated
Comment thread .github/workflows/deploy-platform-api-docs.yml
Apply 7 cleanups from #8012 review:

- Drop `branches: [main]` from `pull_request` trigger so PRs targeting
  any base run the workflow.
- Match `main.yml`'s concurrency pattern so main pushes don't cancel
  each other and `cancel-in-progress` flips off on main.
- Remove the workflow-level `permissions:` block — `build-docs` doesn't
  need a token, and the `deploy` job declares its own.
- Drop `contents: read` on `build-docs` — the job doesn't use
  `GITHUB_TOKEN`.
- Consolidate the two `upload-artifact` steps into one driven by a
  ternary on `name` and `retention-days`.
- Pin `peaceiris/actions-gh-pages` to a specific commit
  (`4f9cc6602d…`) instead of the unallowlisted `v4.1.0` tag.
- Add an `actions/checkout@v5` step to the `deploy` job;
  `peaceiris/actions-gh-pages` uses `git` to remove existing files, so
  it needs a (shallow) checkout to run.
Comment on lines +14 to +38
name: Build Platform API docs
runs-on: ubuntu-latest
steps:
- name: Checkout and setup environment
uses: MetaMask/action-checkout-and-setup@v3
with:
is-high-risk-environment: true

- name: Generate and build Platform API docs
# The site is published under the `/platform-api/` subdirectory of
# the repo's GitHub Pages site so that other doc sites (e.g.
# package API docs) can be hosted alongside under sibling paths.
run: |
yarn docs:platform-api:build \
--site-url "https://${{ github.repository_owner }}.github.io" \
--site-base-url "/${{ github.event.repository.name }}/platform-api/"

- name: Upload build artifact
uses: actions/upload-artifact@v7
with:
name: ${{ github.ref == 'refs/heads/main' && github.event_name == 'push' && 'platform-api-docs-build' || 'platform-api-docs' }}
path: .platform-api-docs/build/
retention-days: ${{ github.ref == 'refs/heads/main' && github.event_name == 'push' && 1 || 7 }}

deploy:
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 7b7c7f2. Added permissions: contents: read to the build-docs job.

}

const branch = await resolveDefaultBranch(projectPath);
return `https://github.com/${match[1]}/blob/${branch}/`;
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Source links ignore commit SHA

Medium Severity

The CLI resolves the short Git commit and stamps it on the index and Docusaurus tagline, but GitHub Source links are built with resolveRepoBaseUrl, which always uses the default origin/HEAD branch (typically main), not that commit. In CI and on feature branches, line anchors can point at the wrong file revision relative to the documented commit.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 90a0f37. Configure here.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 3de1562. resolveRepoBaseUrl now takes the commit SHA and uses it as the ref when provided, falling back to the default branch only when no SHA is available. Source links generated from a specific commit now pin to that revision.

href: 'https://github.com/MetaMask/core',
label: 'GitHub',
position: 'right',
},
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Navbar hardcodes MetaMask core repo

Medium Severity

The Docusaurus navbar always links to https://github.com/MetaMask/core, including the optional “commit <sha>” item, even though the tool is meant to run from other repos (Extension, Mobile) and already discovers origin when building per-item source links. Published docs from non-core projects mislead readers to the wrong repository, and the commit label never opens that commit on GitHub.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 90a0f37. Configure here.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 3de1562. The CLI now resolves the project's origin remote and passes it through as DOCS_REPO_URL. The navbar uses it for both the GitHub link and the commit <sha> item (the latter now links to <repo>/commit/<sha>). Falls back to MetaMask/core only when running outside a git checkout.

`GITHUB_TOKEN` can't be granted branch protections that disallow direct
human pushes while still letting this workflow publish, which is what
we want for `gh-pages`. Switch the deploy to a PAT obtained via Token
Exchange Service — mirrors the pattern in `update-changelogs.yml`.

- New `get-token` job (runs only on the main-branch push path) uses
  `MetaMask/github-tools/.github/actions/get-token@v1` with the
  `contents: write` permission needed to push to `gh-pages`.
- `deploy` job no longer carries job-level `permissions:` (the PAT
  provides the auth) and now runs under the `github-pages` environment
  alongside `get-token`.
- `peaceiris/actions-gh-pages` now receives the token via
  `personal_token` instead of `github_token`.

Per mcmire (#8012 r3343433253). Requires the `github-pages` environment
to be configured in the repo with the Token Exchange Service URL set as
the `TOKEN_EXCHANGE_URL` variable — secrets/env wiring follows the
Notion runbook Maarten posted.
Comment on lines +58 to +89
name: Deploy to GitHub Pages
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
needs:
- build-docs
- get-token
runs-on: ubuntu-latest
environment: github-pages
steps:
- name: Checkout
uses: actions/checkout@v6
with:
fetch-depth: 1

- name: Download build artifact
uses: actions/download-artifact@v8
with:
name: platform-api-docs-build
path: build/

- name: Deploy to GitHub Pages
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
with:
# Use a PAT obtained via Token Exchange Service rather than the
# default `GITHUB_TOKEN`. `GITHUB_TOKEN` can't be granted branch
# protections that disallow direct human pushes while still letting
# this workflow publish, which is what we want for `gh-pages`.
personal_token: ${{ needs.get-token.outputs.token }}
publish_dir: ./build
destination_dir: platform-api
# Preserve sibling subdirectories (e.g. /package-api/) so this
# deploy only overwrites /platform-api/.
keep_files: true
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't understand why we need to do this, but I can take a closer look at this tomorrow to be sure.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 7b7c7f2. Added permissions: contents: read to the deploy job; the actual gh-pages push uses the TES PAT, not GITHUB_TOKEN.

Per mcmire (#8012 r3343616628): chain the docs workflow off the
`lint-build-test` job so any TypeScript / lint errors surface before
the docs build is attempted, instead of letting both run in parallel
and producing two failure reports.

Convert `deploy-platform-api-docs.yml` to a `workflow_call` callable
and add a `deploy-platform-api-docs` job to `main.yml` that depends on
`lint-build-test`. The build-docs portion of the callable still runs
on every PR (added to `all-jobs-complete`'s `needs`) so docs build
regressions block merges, while the `get-token` + `deploy` jobs
remain gated on main pushes.
console.warn(error);
}
}
return items;
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cross-file extraction order bug

Medium Severity

extractFromDirectory parses and extracts each file in the same loop pass, so a *Messenger declaration can run before sibling imports are added to the ts-morph project. Imported umbrella unions and capability types may not resolve, so actions and events are missing from generated docs depending on lexicographic file order.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 961b07a. Configure here.

cryptodev-2s and others added 3 commits June 2, 2026 22:49
CodeQL flagged both jobs for not declaring an explicit `permissions:`
block on `GITHUB_TOKEN`. `actions/checkout` (used by both via either
`MetaMask/action-checkout-and-setup` or `actions/checkout@v6`) needs
`contents: read` to fetch the repo, even though the actual `gh-pages`
push in the `deploy` job uses the TES-issued PAT rather than
`GITHUB_TOKEN`. Without the explicit block the job inherits the repo's
default token permissions, which is broader than necessary.

Resolves the two CodeQL findings linked from #8012 (153, 154).
Two related cleanups surfaced by Cursor Bugbot:

- Source links built by `resolveRepoBaseUrl` previously always used the
  default branch (typically `main`). When docs were generated from a
  feature branch or a specific commit, the line anchors pointed at
  whatever `main` happens to be — not the documented revision. The
  function now takes the commit SHA and prefers it as the ref,
  falling back to the default branch when no SHA is available.
- The Docusaurus navbar hardcoded `https://github.com/MetaMask/core`
  for both the "GitHub" link and the optional "commit <sha>" item, so
  published docs from other repos (Extension, Mobile) misled readers
  to the wrong repository. The CLI now passes the origin remote URL
  through as `DOCS_REPO_URL`, and the navbar uses it for both items
  (linking the commit item to `${DOCS_REPO_URL}/commit/<sha>`).

Plumbing: extracted `resolveRepoUrl` (the bare `https://github.com/<owner>/<repo>`)
as a reusable helper, exported it from `generate.ts`, and call it from
`cli.ts` alongside `resolveCommitSha`. `resolveRepoBaseUrl` becomes a
thin wrapper that composes the repo URL with the ref.

Two new tests: `uses the documented commit SHA in source links when
provided` and three cases for `resolveRepoUrl` covering GitHub remote,
non-GitHub remote, and missing remote.
Copy link
Copy Markdown

@cursor cursor Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 8 total unresolved issues (including 7 from previous reviews).

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit a3545ae. Configure here.

params,
returns,
handlerOrPayload: handlerOrPayloadSignature,
sourceFile: path.relative(projectPath, sourceFile.getFilePath()),
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Backslashes break GitHub source links

Medium Severity

Relative sourceFile paths are built with path.relative, which uses backslashes on Windows. Those values are concatenated into GitHub blob URLs without normalizing separators, so docs generated on Windows can produce broken Source links.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit a3545ae. Configure here.

@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 3, 2026

Preview builds have been published. Learn how to use preview builds in other projects.

Expand for full list of packages and versions.
@metamask-previews/account-tree-controller@7.5.0-preview-a3545aef8
@metamask-previews/accounts-controller@38.1.2-preview-a3545aef8
@metamask-previews/address-book-controller@7.1.2-preview-a3545aef8
@metamask-previews/ai-controllers@0.7.0-preview-a3545aef8
@metamask-previews/analytics-controller@1.1.0-preview-a3545aef8
@metamask-previews/analytics-data-regulation-controller@0.0.0-preview-a3545aef8
@metamask-previews/announcement-controller@8.1.0-preview-a3545aef8
@metamask-previews/app-metadata-controller@2.0.1-preview-a3545aef8
@metamask-previews/approval-controller@9.0.1-preview-a3545aef8
@metamask-previews/assets-controller@8.2.0-preview-a3545aef8
@metamask-previews/assets-controllers@108.3.0-preview-a3545aef8
@metamask-previews/authenticated-user-storage@2.0.0-preview-a3545aef8
@metamask-previews/base-controller@9.1.0-preview-a3545aef8
@metamask-previews/base-data-service@0.1.3-preview-a3545aef8
@metamask-previews/bridge-controller@73.2.0-preview-a3545aef8
@metamask-previews/bridge-status-controller@72.0.0-preview-a3545aef8
@metamask-previews/build-utils@3.0.4-preview-a3545aef8
@metamask-previews/chain-agnostic-permission@1.6.1-preview-a3545aef8
@metamask-previews/chomp-api-service@3.1.0-preview-a3545aef8
@metamask-previews/claims-controller@0.5.2-preview-a3545aef8
@metamask-previews/client-controller@1.0.1-preview-a3545aef8
@metamask-previews/compliance-controller@2.1.0-preview-a3545aef8
@metamask-previews/composable-controller@12.0.1-preview-a3545aef8
@metamask-previews/config-registry-controller@0.4.0-preview-a3545aef8
@metamask-previews/connectivity-controller@0.2.0-preview-a3545aef8
@metamask-previews/controller-utils@12.1.0-preview-a3545aef8
@metamask-previews/core-backend@6.3.1-preview-a3545aef8
@metamask-previews/delegation-controller@3.0.1-preview-a3545aef8
@metamask-previews/earn-controller@12.2.0-preview-a3545aef8
@metamask-previews/eip-5792-middleware@3.0.4-preview-a3545aef8
@metamask-previews/eip-7702-internal-rpc-middleware@0.1.1-preview-a3545aef8
@metamask-previews/eip1193-permission-middleware@2.0.1-preview-a3545aef8
@metamask-previews/ens-controller@19.1.3-preview-a3545aef8
@metamask-previews/eth-block-tracker@15.0.1-preview-a3545aef8
@metamask-previews/eth-json-rpc-middleware@23.1.3-preview-a3545aef8
@metamask-previews/eth-json-rpc-provider@6.0.1-preview-a3545aef8
@metamask-previews/foundryup@1.0.1-preview-a3545aef8
@metamask-previews/gas-fee-controller@26.2.2-preview-a3545aef8
@metamask-previews/gator-permissions-controller@4.2.0-preview-a3545aef8
@metamask-previews/geolocation-controller@0.1.3-preview-a3545aef8
@metamask-previews/json-rpc-engine@10.5.0-preview-a3545aef8
@metamask-previews/json-rpc-middleware-stream@8.0.8-preview-a3545aef8
@metamask-previews/keyring-controller@26.0.0-preview-a3545aef8
@metamask-previews/logging-controller@8.0.2-preview-a3545aef8
@metamask-previews/message-manager@14.1.2-preview-a3545aef8
@metamask-previews/messenger@1.2.0-preview-a3545aef8
@metamask-previews/messenger-cli@0.2.0-preview-a3545aef8
@metamask-previews/money-account-balance-service@1.0.2-preview-a3545aef8
@metamask-previews/money-account-controller@0.3.1-preview-a3545aef8
@metamask-previews/money-account-upgrade-controller@2.0.3-preview-a3545aef8
@metamask-previews/multichain-account-service@10.0.1-preview-a3545aef8
@metamask-previews/multichain-api-middleware@3.1.2-preview-a3545aef8
@metamask-previews/multichain-network-controller@3.1.2-preview-a3545aef8
@metamask-previews/multichain-transactions-controller@7.1.0-preview-a3545aef8
@metamask-previews/name-controller@9.1.2-preview-a3545aef8
@metamask-previews/network-controller@32.0.0-preview-a3545aef8
@metamask-previews/network-enablement-controller@5.2.0-preview-a3545aef8
@metamask-previews/notification-services-controller@24.1.2-preview-a3545aef8
@metamask-previews/passkey-controller@2.0.1-preview-a3545aef8
@metamask-previews/permission-controller@13.1.1-preview-a3545aef8
@metamask-previews/permission-log-controller@5.1.0-preview-a3545aef8
@metamask-previews/perps-controller@7.0.0-preview-a3545aef8
@metamask-previews/phishing-controller@17.2.0-preview-a3545aef8
@metamask-previews/platform-api-docs@0.0.0-preview-a3545aef8
@metamask-previews/polling-controller@16.0.6-preview-a3545aef8
@metamask-previews/preferences-controller@23.1.0-preview-a3545aef8
@metamask-previews/profile-metrics-controller@3.1.5-preview-a3545aef8
@metamask-previews/profile-sync-controller@28.1.1-preview-a3545aef8
@metamask-previews/ramps-controller@14.1.0-preview-a3545aef8
@metamask-previews/rate-limit-controller@7.0.1-preview-a3545aef8
@metamask-previews/react-data-query@0.2.1-preview-a3545aef8
@metamask-previews/remote-feature-flag-controller@4.2.1-preview-a3545aef8
@metamask-previews/sample-controllers@5.0.1-preview-a3545aef8
@metamask-previews/seedless-onboarding-controller@10.0.0-preview-a3545aef8
@metamask-previews/selected-network-controller@26.1.3-preview-a3545aef8
@metamask-previews/shield-controller@5.1.2-preview-a3545aef8
@metamask-previews/signature-controller@39.2.3-preview-a3545aef8
@metamask-previews/snap-account-service@0.2.1-preview-a3545aef8
@metamask-previews/social-controllers@2.2.1-preview-a3545aef8
@metamask-previews/storage-service@1.0.1-preview-a3545aef8
@metamask-previews/subscription-controller@6.1.3-preview-a3545aef8
@metamask-previews/transaction-controller@66.0.0-preview-a3545aef8
@metamask-previews/transaction-pay-controller@23.1.0-preview-a3545aef8
@metamask-previews/user-operation-controller@41.2.3-preview-a3545aef8
@metamask-previews/wallet@2.0.0-preview-a3545aef8

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants