Skip to content

feat: add @metamask/platform-api-docs package#8012

Open
cryptodev-2s wants to merge 117 commits into
mainfrom
feat/messenger-docs-site
Open

feat: add @metamask/platform-api-docs package#8012
cryptodev-2s wants to merge 117 commits into
mainfrom
feat/messenger-docs-site

Conversation

@cryptodev-2s
Copy link
Copy Markdown
Contributor

@cryptodev-2s cryptodev-2s commented Feb 22, 2026

Explanation

Adds @metamask/platform-api-docs, a publishable package that generates and serves a searchable site documenting the Platform API — the catalog of actions and events available to clients through the message bus.

The package scans TypeScript source and .d.cts declaration files, finds every *Messenger type declaration, walks its Actions and Events type arguments to discover the capability types they reference, extracts JSDoc/handler/payload information for each, and renders the result as a Docusaurus site with per-namespace pages and local search.

Features

  • Anchored on Messenger declarations. Extraction discovers *Messenger type aliases and walks Messenger<Namespace, Actions, Events> to find the capability types — eliminating false positives from unrelated types that happen to share an action/event-like shape.
  • Two capability-type patterns supported. Inline (type FooAction = { type: '...'; handler: ... }) and capability-type constructors (type FooGetStateAction = ControllerGetStateAction<typeof name, State>), including their interface variants.
  • Union expansion. When a Messenger references an umbrella union like FooActions = FooGetAction | FooSetAction, the walker descends through it without documenting the intermediate alias.
  • Scans three layouts. Configured --scan-dirs, packages/*/src/ (.ts), and node_modules/@metamask/*/dist/ (.d.cts).
  • Source links resolve automatically. Reads git remote get-url origin and git symbolic-ref refs/remotes/origin/HEAD to build https://github.com/<owner>/<repo>/blob/<branch>/<path>#L<line> URLs; falls back to main for shallow clones.
  • Project label and commit SHA stamped on the site. --project-label Core / --project-label Extension produces titles like Platform API (Core), and the short Git commit is shown in the intro and navbar so engineers can tell how current the docs are.
  • Dedup across packages. When a capability is declared in two places (e.g. once as the home definition and once as a re-export), the version with JSDoc and from the matching namespace's package wins.
  • Docusaurus site with dark/light mode, offline search (no Algolia), and MDX-safe rendering of JSDoc.

Usage

From the core monorepo:

yarn docs:platform-api:build   # Generate docs and build static site
yarn docs:platform-api:dev     # Dev server with hot reload
yarn docs:platform-api:serve   # Build and serve

From client projects (Extension, Mobile), install @metamask/platform-api-docs as a devDependency and add a script:

{
  "scripts": {
    "docs:platform-api:build": "platform-api-docs --build --project-label MyProject"
  }
}

Implementation

  • packages/platform-api-docs/ — separate workspace from @metamask/messenger-cli (different deps and release cadence).
  • CLI built with yargs; runs Docusaurus through execa. Flags: --build, --serve, --dev, --scan-dir (additive, repeatable), --output, --project-label. Configuration is CLI-only — no package.json config block.
  • AST parsing via ts-morph instead of the raw TypeScript compiler API. Standard JSDoc extraction (jsDoc.getDescription() + getTags()) replaces the previous hand-rolled comment parser.
  • Single-pass extraction. The Messenger walk returns TypeAliasDeclaration/InterfaceDeclaration nodes directly tagged with 'action'/'event' kind, so the main loop doesn't re-walk the source file looking up names.
  • File discovery via the glob package, with results sorted for deterministic output across filesystems.
  • Test coverage: 100% lines / ~93% branches. Defensive guards against AST shapes that don't appear in real messenger types are explicitly marked with // istanbul ignore comments.
  • GitHub Actions workflow (deploy-platform-api-docs.yml) builds docs on PRs (uploads the build as an artifact) and deploys to GitHub Pages on main.

References

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've communicated my changes to consumers by updating changelogs for packages I've changed
  • I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Note

Low Risk
Documentation and CI publishing only; no changes to wallet, auth, or runtime controller behavior.

Overview
Introduces @metamask/platform-api-docs, a CLI that scans TypeScript and @metamask .d.cts files for *Messenger types, walks Actions / Events unions, and emits a Docusaurus site (search, per-namespace pages, optional --project-label and commit SHA).

The Core repo wires yarn docs:platform-api:{build,dev,serve}, ignores generated .platform-api-docs/, assigns CODEOWNERS, and adds deploy-platform-api-docs.yml to build on PRs and publish to GitHub Pages under /platform-api/ with keep_files. Root ESLint heap and dependency pins are adjusted for the new package; README lists the workspace.

Reviewed by Cursor Bugbot for commit 4e8bb54. Bugbot is set up for automated code reviews on this repo. Configure here.

@cryptodev-2s cryptodev-2s self-assigned this Feb 22, 2026
@cryptodev-2s cryptodev-2s force-pushed the feat/messenger-docs-site branch 4 times, most recently from 63f3188 to 7c63a0d Compare February 22, 2026 22:26
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Feb 22, 2026

Caution

MetaMask internal reviewing guidelines:

  • Do not ignore-all
  • Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
  • Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
    @SocketSecurity ignore npm/PACKAGE@VERSION
Action Severity Alert  (click "▶" to expand/collapse)
Block High
High CVE: npm @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input

CVE: GHSA-fv7c-fp4j-7gwp @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input (HIGH)

Affected versions: >= 7.12.0 < 7.29.4; >= 8.0.0-alpha.0 < 8.0.0-alpha.13

Patched version: 7.29.4

From: ?npm/@docusaurus/core@3.10.1npm/@docusaurus/preset-classic@3.10.1npm/@babel/plugin-transform-modules-systemjs@7.29.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/plugin-transform-modules-systemjs@7.29.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: npm fast-uri vulnerable to host confusion via percent-encoded authority delimiters

CVE: GHSA-v39h-62p7-jpjc fast-uri vulnerable to host confusion via percent-encoded authority delimiters (HIGH)

Affected versions: < 3.1.2

Patched version: 3.1.2

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/@docusaurus/types@3.10.1npm/@docusaurus/core@3.10.1npm/@docusaurus/plugin-content-docs@3.10.1npm/@docusaurus/theme-common@3.10.1npm/@docusaurus/preset-classic@3.10.1npm/fast-uri@3.1.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fast-uri@3.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: npm fast-uri vulnerable to path traversal via percent-encoded dot segments

CVE: GHSA-q3j6-qgpj-74h6 fast-uri vulnerable to path traversal via percent-encoded dot segments (HIGH)

Affected versions: < 3.1.1

Patched version: 3.1.1

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/@docusaurus/types@3.10.1npm/@docusaurus/core@3.10.1npm/@docusaurus/plugin-content-docs@3.10.1npm/@docusaurus/theme-common@3.10.1npm/@docusaurus/preset-classic@3.10.1npm/fast-uri@3.1.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fast-uri@3.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
Obfuscated code: npm lunr-languages is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/lunr-languages@1.14.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lunr-languages@1.14.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
Obfuscated code: npm lunr-languages is 95.0% likely obfuscated

Confidence: 0.95

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/lunr-languages@1.14.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lunr-languages@1.14.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
Obfuscated code: npm svgo is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/@docusaurus/preset-classic@3.10.1npm/svgo@3.3.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/svgo@3.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @algolia/client-personalization in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/preset-classic@3.10.1npm/@algolia/client-personalization@5.52.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@algolia/client-personalization@5.52.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @algolia/requester-fetch in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/preset-classic@3.10.1npm/@algolia/requester-fetch@5.52.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@algolia/requester-fetch@5.52.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @algolia/requester-node-http in module http

Module: http

Location: Package overview

From: ?npm/@docusaurus/preset-classic@3.10.1npm/@algolia/requester-node-http@5.52.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@algolia/requester-node-http@5.52.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @algolia/requester-node-http in module https

Module: https

Location: Package overview

From: ?npm/@docusaurus/preset-classic@3.10.1npm/@algolia/requester-node-http@5.52.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@algolia/requester-node-http@5.52.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @docsearch/react in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/preset-classic@3.10.1npm/@docsearch/react@4.6.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@docsearch/react@4.6.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @emnapi/core in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/@emnapi/core@1.10.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: npm @node-rs/jieba in module child_process

Module: child_process

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/@node-rs/jieba@1.10.4

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@node-rs/jieba@1.10.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @pnpm/npm-conf in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/@pnpm/npm-conf@3.0.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@pnpm/npm-conf@3.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @tybys/wasm-util in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/@tybys/wasm-util@0.10.1

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tybys/wasm-util@0.10.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: npm address in module child_process

Module: child_process

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/address@1.2.2

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/address@1.2.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm algoliasearch-helper in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/preset-classic@3.10.1npm/algoliasearch-helper@3.28.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/algoliasearch-helper@3.28.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm babel-plugin-polyfill-corejs3 in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/babel-plugin-polyfill-corejs3@0.13.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/babel-plugin-polyfill-corejs3@0.13.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm babel-plugin-polyfill-corejs3 in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/@docusaurus/preset-classic@3.10.1npm/babel-plugin-polyfill-corejs3@0.14.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/babel-plugin-polyfill-corejs3@0.14.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm clean-css in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/clean-css@5.3.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/clean-css@5.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm clean-css in module http

Module: http

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/clean-css@5.3.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/clean-css@5.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm clean-css in module https

Module: https

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/clean-css@5.3.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/clean-css@5.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm config-chain in module http

Module: http

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/config-chain@1.1.13

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/config-chain@1.1.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm core-js in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/core-js@3.49.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/core-js@3.49.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm detect-port in module net

Module: net

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/detect-port@1.6.1

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/detect-port@1.6.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm domutils in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/domutils@2.8.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/domutils@2.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm domutils in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/@docusaurus/core@3.10.1npm/@docusaurus/preset-classic@3.10.1npm/domutils@3.2.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/domutils@3.2.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 118 more rows in the dashboard

View full report

@cryptodev-2s cryptodev-2s force-pushed the feat/messenger-docs-site branch 3 times, most recently from b55b682 to 980f677 Compare February 23, 2026 22:31
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@github-actions
Copy link
Copy Markdown
Contributor

Preview builds have been published. See these instructions for more information about preview builds.

Expand for full list of packages and versions.
{
  "@metamask-previews/account-tree-controller": "4.1.1-preview-980f677",
  "@metamask-previews/accounts-controller": "36.0.1-preview-980f677",
  "@metamask-previews/address-book-controller": "7.0.1-preview-980f677",
  "@metamask-previews/ai-controllers": "0.1.0-preview-980f677",
  "@metamask-previews/analytics-controller": "1.0.0-preview-980f677",
  "@metamask-previews/analytics-data-regulation-controller": "0.0.0-preview-980f677",
  "@metamask-previews/announcement-controller": "8.0.0-preview-980f677",
  "@metamask-previews/app-metadata-controller": "2.0.0-preview-980f677",
  "@metamask-previews/approval-controller": "8.0.0-preview-980f677",
  "@metamask-previews/assets-controller": "2.0.2-preview-980f677",
  "@metamask-previews/assets-controllers": "100.0.2-preview-980f677",
  "@metamask-previews/base-controller": "9.0.0-preview-980f677",
  "@metamask-previews/bridge-controller": "67.1.1-preview-980f677",
  "@metamask-previews/bridge-status-controller": "67.0.1-preview-980f677",
  "@metamask-previews/build-utils": "3.0.4-preview-980f677",
  "@metamask-previews/chain-agnostic-permission": "1.4.0-preview-980f677",
  "@metamask-previews/claims-controller": "0.4.2-preview-980f677",
  "@metamask-previews/client-controller": "1.0.0-preview-980f677",
  "@metamask-previews/compliance-controller": "1.0.1-preview-980f677",
  "@metamask-previews/composable-controller": "12.0.0-preview-980f677",
  "@metamask-previews/connectivity-controller": "0.1.0-preview-980f677",
  "@metamask-previews/controller-utils": "11.19.0-preview-980f677",
  "@metamask-previews/core-backend": "6.0.0-preview-980f677",
  "@metamask-previews/delegation-controller": "2.0.1-preview-980f677",
  "@metamask-previews/earn-controller": "11.1.1-preview-980f677",
  "@metamask-previews/eip-5792-middleware": "2.1.0-preview-980f677",
  "@metamask-previews/eip-7702-internal-rpc-middleware": "0.1.0-preview-980f677",
  "@metamask-previews/eip1193-permission-middleware": "1.0.3-preview-980f677",
  "@metamask-previews/ens-controller": "19.0.3-preview-980f677",
  "@metamask-previews/error-reporting-service": "3.0.1-preview-980f677",
  "@metamask-previews/eth-block-tracker": "15.0.1-preview-980f677",
  "@metamask-previews/eth-json-rpc-middleware": "23.1.0-preview-980f677",
  "@metamask-previews/eth-json-rpc-provider": "6.0.0-preview-980f677",
  "@metamask-previews/foundryup": "1.0.1-preview-980f677",
  "@metamask-previews/gas-fee-controller": "26.0.3-preview-980f677",
  "@metamask-previews/gator-permissions-controller": "2.0.0-preview-980f677",
  "@metamask-previews/json-rpc-engine": "10.2.2-preview-980f677",
  "@metamask-previews/json-rpc-middleware-stream": "8.0.8-preview-980f677",
  "@metamask-previews/keyring-controller": "25.1.0-preview-980f677",
  "@metamask-previews/logging-controller": "7.0.1-preview-980f677",
  "@metamask-previews/message-manager": "14.1.0-preview-980f677",
  "@metamask-previews/messenger": "0.3.0-preview-980f677",
  "@metamask-previews/multichain-account-service": "7.0.0-preview-980f677",
  "@metamask-previews/multichain-api-middleware": "1.2.7-preview-980f677",
  "@metamask-previews/multichain-network-controller": "3.0.4-preview-980f677",
  "@metamask-previews/multichain-transactions-controller": "7.0.1-preview-980f677",
  "@metamask-previews/name-controller": "9.0.0-preview-980f677",
  "@metamask-previews/network-controller": "30.0.0-preview-980f677",
  "@metamask-previews/network-enablement-controller": "4.1.2-preview-980f677",
  "@metamask-previews/notification-services-controller": "22.0.0-preview-980f677",
  "@metamask-previews/permission-controller": "12.2.0-preview-980f677",
  "@metamask-previews/permission-log-controller": "5.0.0-preview-980f677",
  "@metamask-previews/perps-controller": "0.0.0-preview-980f677",
  "@metamask-previews/phishing-controller": "16.3.0-preview-980f677",
  "@metamask-previews/polling-controller": "16.0.3-preview-980f677",
  "@metamask-previews/preferences-controller": "22.1.0-preview-980f677",
  "@metamask-previews/profile-metrics-controller": "3.0.1-preview-980f677",
  "@metamask-previews/profile-sync-controller": "27.1.0-preview-980f677",
  "@metamask-previews/ramps-controller": "10.0.0-preview-980f677",
  "@metamask-previews/rate-limit-controller": "7.0.0-preview-980f677",
  "@metamask-previews/remote-feature-flag-controller": "4.0.0-preview-980f677",
  "@metamask-previews/sample-controllers": "4.0.3-preview-980f677",
  "@metamask-previews/seedless-onboarding-controller": "8.1.0-preview-980f677",
  "@metamask-previews/selected-network-controller": "26.0.3-preview-980f677",
  "@metamask-previews/shield-controller": "5.0.1-preview-980f677",
  "@metamask-previews/signature-controller": "39.0.4-preview-980f677",
  "@metamask-previews/storage-service": "1.0.0-preview-980f677",
  "@metamask-previews/subscription-controller": "6.0.0-preview-980f677",
  "@metamask-previews/transaction-controller": "62.18.0-preview-980f677",
  "@metamask-previews/transaction-pay-controller": "16.0.0-preview-980f677",
  "@metamask-previews/user-operation-controller": "41.0.3-preview-980f677"
}

@cryptodev-2s cryptodev-2s force-pushed the feat/messenger-docs-site branch from 980f677 to f49a7dd Compare February 24, 2026 15:09
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

1 similar comment
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@cryptodev-2s cryptodev-2s force-pushed the feat/messenger-docs-site branch from f49a7dd to 44fb063 Compare February 24, 2026 16:22
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@cryptodev-2s cryptodev-2s changed the title feat: add Messenger API docs site with local search feat: add @metamask/messenger-docs Feb 24, 2026
@cryptodev-2s cryptodev-2s changed the title feat: add @metamask/messenger-docs feat: add @metamask/messenger-docs Feb 24, 2026
@cryptodev-2s cryptodev-2s changed the title feat: add @metamask/messenger-docs feat: add @metamask/messenger-docs package Feb 24, 2026
cryptodev-2s and others added 8 commits February 25, 2026 18:55
Docusaurus site for browsing controller messenger actions/events,
with offline search powered by docusaurus-search-local.
## Explanation

The messenger docs generation currently lives in
`scripts/generate-messenger-docs/` and the Docusaurus site template in
`docs-site/`. This makes it unusable by external clients
(metamask-extension, metamask-mobile) without access to this monorepo.

This PR extracts both into a new `@metamask/messenger-docs` package at
`packages/messenger-docs/` with a CLI, so any project with `@metamask`
controller dependencies can generate and serve messenger API docs.

### Usage

```bash
# Default: scans cwd for node_modules/@MetaMask controller/service packages
npx @metamask/messenger-docs

# Scan a specific project
npx @metamask/messenger-docs /path/to/project

# Generate + build static site
npx @metamask/messenger-docs --build

# Generate + serve (build + http server)
npx @metamask/messenger-docs --serve

# Generate + dev server (hot reload)
npx @metamask/messenger-docs --dev

# Scan source .ts files instead of .d.cts (for monorepo development)
npx @metamask/messenger-docs --source

# Custom output directory (default: .messenger-docs)
npx @metamask/messenger-docs --output ./my-docs
```

## References

- Builds on top of `feat/messenger-docs-site`

## Checklist

- [ ] I've updated the test suite for new or updated code as appropriate
- [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or
updated code as appropriate
- [ ] I've communicated my changes to consumers by [updating changelogs
for packages I've
changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md)
- [ ] I've introduced [breaking
changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md)
in this PR and have prepared draft pull requests for clients and
consumer packages to resolve them
@cryptodev-2s cryptodev-2s force-pushed the feat/messenger-docs-site branch from cb82c24 to 17adacd Compare February 25, 2026 17:55
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

Replace the workflow's `DOCS_URL` and `DOCS_BASE_URL` environment
variables with `--site-url` and `--site-base-url` flags on the docs
CLI. The CLI now owns the flag-to-env-var translation at the
subprocess boundary, so callers (workflow files, package scripts)
don't need to know how the values are plumbed through to Docusaurus.
The dedup-scoring helper strips a trailing `Controller` or `Service`
from a namespace to derive the home-package prefix it then searches
for in the source file path. The previous regex `/Controller|Service/u`
matched the first occurrence anywhere, so a namespace like
`ServiceWorkerController` lost its leading `Service` instead of the
trailing `Controller`, producing the wrong prefix and picking the
wrong duplicate. Anchor the alternation with `$` so only a suffix is
stripped.
The build-docs job produces an artifact that gets deployed to GitHub
Pages on pushes to main, so the checkout-and-setup action's
`is-high-risk-environment` flag should be `true` per its README
(production environments and deployable artifacts qualify). This
matches the precedent set by the utils repo's API docs workflow.
Closes the remaining coverage gaps in `generate.ts` and `extraction.ts`
and raises the jest thresholds to 100% across the board:

- Four new tests cover paths that were live behavior but exercised
  by no fixture: in-namespace action/event sort, the reverse
  direction of `replaceDuplicateInGroup` (event replaced by action),
  symlinked `@metamask/*` packages in `node_modules`, bare
  TypeReference re-export skip, and optional handler parameters
  marked with `?`.
- The remaining defensive AST guards (malformed indexed-access
  shapes, missing symbols, etc.) get `// istanbul ignore next`
  annotations explaining why they don't fire on valid messenger
  fixtures.
Comment thread package.json Outdated
- Drop the now-stale `webpackbar@^6.0.1` → `^7.0.0` resolution at
  package.json:107. It was added in 985c43c as a temporary workaround
  for the Docusaurus 3.10.0 / webpack 5.106.0 incompatibility tracked
  in facebook/docusaurus#11923, with explicit guidance to revert once
  Docusaurus 3.10.1 shipped. We're on 3.10.1 now and `@docusaurus/bundler`
  requests `webpackbar` `^7.0.0` directly, so the selector matches
  nothing.
- Declare `@docusaurus/theme-common` and `@docusaurus/plugin-content-docs`
  as direct deps of `@metamask/platform-api-docs` to satisfy yarn's
  peer-dep checks for `@easyops-cn/docusaurus-search-local` (which
  peer-depends on theme-common) and theme-common (which peer-depends
  on plugin-content-docs). Both packages were already pulled in
  transitively via `preset-classic`; the explicit declarations document
  what the site actually relies on.
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@github-actions
Copy link
Copy Markdown
Contributor

Preview builds have been published. Learn how to use preview builds in other projects.

Expand for full list of packages and versions.
@metamask-previews/account-tree-controller@7.4.0-preview-1275d0fda
@metamask-previews/accounts-controller@38.1.1-preview-1275d0fda
@metamask-previews/address-book-controller@7.1.2-preview-1275d0fda
@metamask-previews/ai-controllers@0.6.3-preview-1275d0fda
@metamask-previews/analytics-controller@1.0.1-preview-1275d0fda
@metamask-previews/analytics-data-regulation-controller@0.0.0-preview-1275d0fda
@metamask-previews/announcement-controller@8.1.0-preview-1275d0fda
@metamask-previews/app-metadata-controller@2.0.1-preview-1275d0fda
@metamask-previews/approval-controller@9.0.1-preview-1275d0fda
@metamask-previews/assets-controller@7.1.2-preview-1275d0fda
@metamask-previews/assets-controllers@108.1.0-preview-1275d0fda
@metamask-previews/authenticated-user-storage@2.0.0-preview-1275d0fda
@metamask-previews/base-controller@9.1.0-preview-1275d0fda
@metamask-previews/base-data-service@0.1.3-preview-1275d0fda
@metamask-previews/bridge-controller@73.0.0-preview-1275d0fda
@metamask-previews/bridge-status-controller@71.2.0-preview-1275d0fda
@metamask-previews/build-utils@3.0.4-preview-1275d0fda
@metamask-previews/chain-agnostic-permission@1.6.1-preview-1275d0fda
@metamask-previews/chomp-api-service@3.1.0-preview-1275d0fda
@metamask-previews/claims-controller@0.5.1-preview-1275d0fda
@metamask-previews/client-controller@1.0.1-preview-1275d0fda
@metamask-previews/compliance-controller@2.0.1-preview-1275d0fda
@metamask-previews/composable-controller@12.0.1-preview-1275d0fda
@metamask-previews/config-registry-controller@0.3.1-preview-1275d0fda
@metamask-previews/connectivity-controller@0.2.0-preview-1275d0fda
@metamask-previews/controller-utils@12.1.0-preview-1275d0fda
@metamask-previews/core-backend@6.3.0-preview-1275d0fda
@metamask-previews/delegation-controller@3.0.0-preview-1275d0fda
@metamask-previews/earn-controller@12.2.0-preview-1275d0fda
@metamask-previews/eip-5792-middleware@3.0.4-preview-1275d0fda
@metamask-previews/eip-7702-internal-rpc-middleware@0.1.1-preview-1275d0fda
@metamask-previews/eip1193-permission-middleware@2.0.1-preview-1275d0fda
@metamask-previews/ens-controller@19.1.3-preview-1275d0fda
@metamask-previews/eth-block-tracker@15.0.1-preview-1275d0fda
@metamask-previews/eth-json-rpc-middleware@23.1.3-preview-1275d0fda
@metamask-previews/eth-json-rpc-provider@6.0.1-preview-1275d0fda
@metamask-previews/foundryup@1.0.1-preview-1275d0fda
@metamask-previews/gas-fee-controller@26.2.2-preview-1275d0fda
@metamask-previews/gator-permissions-controller@4.2.0-preview-1275d0fda
@metamask-previews/geolocation-controller@0.1.3-preview-1275d0fda
@metamask-previews/json-rpc-engine@10.5.0-preview-1275d0fda
@metamask-previews/json-rpc-middleware-stream@8.0.8-preview-1275d0fda
@metamask-previews/keyring-controller@25.5.0-preview-1275d0fda
@metamask-previews/logging-controller@8.0.2-preview-1275d0fda
@metamask-previews/message-manager@14.1.2-preview-1275d0fda
@metamask-previews/messenger@1.2.0-preview-1275d0fda
@metamask-previews/messenger-cli@0.2.0-preview-1275d0fda
@metamask-previews/money-account-balance-service@1.0.2-preview-1275d0fda
@metamask-previews/money-account-controller@0.3.0-preview-1275d0fda
@metamask-previews/money-account-upgrade-controller@2.0.2-preview-1275d0fda
@metamask-previews/multichain-account-service@10.0.0-preview-1275d0fda
@metamask-previews/multichain-api-middleware@3.1.2-preview-1275d0fda
@metamask-previews/multichain-network-controller@3.1.2-preview-1275d0fda
@metamask-previews/multichain-transactions-controller@7.1.0-preview-1275d0fda
@metamask-previews/name-controller@9.1.2-preview-1275d0fda
@metamask-previews/network-controller@32.0.0-preview-1275d0fda
@metamask-previews/network-enablement-controller@5.2.0-preview-1275d0fda
@metamask-previews/notification-services-controller@24.1.0-preview-1275d0fda
@metamask-previews/passkey-controller@2.0.1-preview-1275d0fda
@metamask-previews/permission-controller@13.1.1-preview-1275d0fda
@metamask-previews/permission-log-controller@5.1.0-preview-1275d0fda
@metamask-previews/perps-controller@6.2.0-preview-1275d0fda
@metamask-previews/phishing-controller@17.2.0-preview-1275d0fda
@metamask-previews/platform-api-docs@0.0.0-preview-1275d0fda
@metamask-previews/polling-controller@16.0.6-preview-1275d0fda
@metamask-previews/preferences-controller@23.1.0-preview-1275d0fda
@metamask-previews/profile-metrics-controller@3.1.4-preview-1275d0fda
@metamask-previews/profile-sync-controller@28.1.0-preview-1275d0fda
@metamask-previews/ramps-controller@13.3.1-preview-1275d0fda
@metamask-previews/rate-limit-controller@7.0.1-preview-1275d0fda
@metamask-previews/react-data-query@0.2.1-preview-1275d0fda
@metamask-previews/remote-feature-flag-controller@4.2.1-preview-1275d0fda
@metamask-previews/sample-controllers@5.0.1-preview-1275d0fda
@metamask-previews/seedless-onboarding-controller@9.1.0-preview-1275d0fda
@metamask-previews/selected-network-controller@26.1.3-preview-1275d0fda
@metamask-previews/shield-controller@5.1.2-preview-1275d0fda
@metamask-previews/signature-controller@39.2.2-preview-1275d0fda
@metamask-previews/snap-account-service@0.2.0-preview-1275d0fda
@metamask-previews/social-controllers@2.2.1-preview-1275d0fda
@metamask-previews/storage-service@1.0.1-preview-1275d0fda
@metamask-previews/subscription-controller@6.1.3-preview-1275d0fda
@metamask-previews/transaction-controller@66.0.0-preview-1275d0fda
@metamask-previews/transaction-pay-controller@22.6.1-preview-1275d0fda
@metamask-previews/user-operation-controller@41.2.2-preview-1275d0fda
@metamask-previews/wallet@0.0.0-preview-1275d0fda

Make `site/tsconfig.json` extend the monorepo's shared
`tsconfig.base.json`, keeping only the overrides Docusaurus
actually needs (composite off, noEmit, JSX, ESNext modules, Bundler
resolution). Drop the redundant `target`, `esModuleInterop`, and
`strict` fields now that they come from base.

Also stop excluding `packages/platform-api-docs/site/**` from
ESLint so `site/docusaurus.config.ts` is type-checked as part of
the normal lint flow rather than being an island only exercised
by `yarn docs:platform-api:build`. typescript-eslint's
`projectService: true` picks up the site's tsconfig automatically.

Move `@docusaurus/types` from devDependencies to dependencies —
`site/docusaurus.config.ts` imports `Config` from it, and `site/`
is published as part of this package, so a consumer of the
published CLI needs the types resolvable when Docusaurus loads
the config at runtime.
Including `packages/platform-api-docs/site/**` in ESLint made
typescript-eslint's `projectService` discover the site's tsconfig
and try to type-check `docusaurus.config.ts`. Loading the full
Docusaurus + React + webpack type graph blows past `lint:eslint`'s
`--max-old-space-size=6144` cap and crashes CI with a heap-OOM.

The `extends`-from-base wiring on `site/tsconfig.json` and the
`@docusaurus/types` dependency move from eec9874 are kept — only
the ESLint inclusion is reverted.
The 6GB cap was set in #7906 (Feb 2026) when ESLint last started
OOM-ing under typescript-eslint's typed rules. The monorepo has grown
enough since that the cap is again insufficient — CI for this branch
started OOM-ing after a routine merge with main brought in five more
commits, despite no on-branch changes affecting lint. Bumping to 8GB.
: 'Actions and events available for use in clients via the message bus',
url: process.env.DOCS_URL ?? 'https://metamask.github.io',
baseUrl: process.env.DOCS_BASE_URL ?? '/',
favicon: 'img/favicons/favicon-96x96.png',
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Favicon references non-existent static file path

Low Severity

The Docusaurus config sets favicon to 'img/favicons/favicon-96x96.png', but the diff shows no favicons subdirectory or PNG file under site/static/img/ — only three SVG files exist there. Similarly, custom.css references a font at ../../static/fonts/MM-Sans/MM_Sans_Mono-Regular.woff2, but no fonts directory or WOFF2 file is included in the package. Both will produce broken references at build/runtime.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit e583465. Configure here.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Both files exist in the repo as tracked binary assets — they just don't surface in the PR diff:

$ git ls-files packages/platform-api-docs/site/static/
packages/platform-api-docs/site/static/fonts/MM-Sans/MM_Sans_Mono-Regular.woff2
packages/platform-api-docs/site/static/img/favicons/favicon-96x96.png
packages/platform-api-docs/site/static/img/metamask-fox.svg
packages/platform-api-docs/site/static/img/metamask-logo-dark.svg
packages/platform-api-docs/site/static/img/metamask-logo.svg

And yarn docs:platform-api:build copies them both into the static-site output (build/img/favicons/favicon-96x96.png, build/fonts/MM-Sans/MM_Sans_Mono-Regular.woff2) without any missing-asset warnings.

mcmire and others added 2 commits May 26, 2026 23:11
## Explanation

<!--
Thanks for your contribution! Take a moment to answer these questions so
that reviewers have the information they need to properly understand
your changes:

* What is the current state of things and why does it need to change?
* What is the solution your changes offer and how does it work?
* Are there any changes whose purpose might not obvious to those
unfamiliar with the domain?
* If your primary goal was to update one package but you found you had
to update another one along the way, why did you do so?
* If you had to upgrade a dependency, why did you do so?
-->

The goal of this commit is to make `extraction.ts` easier to follow.
Since we are working with the TypeScript AST, we have to accept that the
code will be somewhat dense, and we will need to ask maintainers to do
some amount of studying to develop a mental model in their head.
However, the more we can do to assist this process, the better.

To this end, this commit:

- Adds comments to illustrate steps in the parsing process and
underlying nodes in the AST that are being visited
- Renames some functions to more accurately describe their contents
- Removes unnecessary `istanbul ignore` comments in favor of either
adding tests that exercise the underlying logic or using assumptions
(non-null assertions).
- Rewrite some JSDoc so it's less technical and more natural sounding

## References

<!--
Are there any issues that this pull request is tied to?
Are there other links that reviewers should consult to understand these
changes better?
Are there client or consumer pull requests to adopt any breaking
changes?

For example:

* Fixes #12345
* Related to #67890
-->

## Checklist

- [x] I've updated the test suite for new or updated code as appropriate
- [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or
updated code as appropriate
- [ ] I've communicated my changes to consumers by [updating changelogs
for packages I've
changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md)
- [ ] I've introduced [breaking
changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md)
in this PR and have prepared draft pull requests for clients and
consumer packages to resolve them

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes core AST extraction logic that drives published API docs;
behavior should stay equivalent but edge-case handling shifted to
type-checker resolution and explicit skips.
> 
> **Overview**
> Refactors **`platform-api-docs`** messenger extraction for readability
and safer edge-case handling, without changing the public doc-generation
pipeline’s overall shape.
> 
> **`extraction.ts`** is reorganized into clearer phases: find
`*Messenger` type aliases, recursively walk Actions/Events type
parameters to collect capability declarations, then extract
**`MessengerCapabilityPacket`** records (renamed from
`ExtractedMessengerCapabilityType`) via inline object literals or
`ControllerGetStateAction` / `ControllerStateChangeEvent` constructors.
Discovery and extraction helpers are renamed and documented with
AST-oriented comments; JSDoc handling is tightened (e.g. skip nameless
`@param` tags, bare `@deprecated`).
> 
> **Type resolution** for capability `type` strings and constructor
namespace args now leans on the type checker
(`getType().isStringLiteral()`) instead of dedicated template-literal /
`typeof` helpers. Invalid shapes are skipped explicitly (missing
`type`/`handler`/`payload`, numeric `type`, qualified `Ns.Type`
references, non–string-literal constructor args, method signatures mixed
into object types).
> 
> **Tests** in `extraction.test.ts` add broad coverage for those
skip/fallback paths; several `istanbul ignore` branches are removed in
favor of tests or compile-time assumptions.
> 
> **`generate.ts`**, **`markdown.ts`**, and **`types.ts`** only adopt
the new type name.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
57ad0bd. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@github-actions
Copy link
Copy Markdown
Contributor

Preview builds have been published. Learn how to use preview builds in other projects.

Expand for full list of packages and versions.
@metamask-previews/account-tree-controller@7.4.0-preview-6235c3779
@metamask-previews/accounts-controller@38.1.1-preview-6235c3779
@metamask-previews/address-book-controller@7.1.2-preview-6235c3779
@metamask-previews/ai-controllers@0.6.3-preview-6235c3779
@metamask-previews/analytics-controller@1.1.0-preview-6235c3779
@metamask-previews/analytics-data-regulation-controller@0.0.0-preview-6235c3779
@metamask-previews/announcement-controller@8.1.0-preview-6235c3779
@metamask-previews/app-metadata-controller@2.0.1-preview-6235c3779
@metamask-previews/approval-controller@9.0.1-preview-6235c3779
@metamask-previews/assets-controller@8.0.1-preview-6235c3779
@metamask-previews/assets-controllers@108.1.0-preview-6235c3779
@metamask-previews/authenticated-user-storage@2.0.0-preview-6235c3779
@metamask-previews/base-controller@9.1.0-preview-6235c3779
@metamask-previews/base-data-service@0.1.3-preview-6235c3779
@metamask-previews/bridge-controller@73.0.1-preview-6235c3779
@metamask-previews/bridge-status-controller@71.2.0-preview-6235c3779
@metamask-previews/build-utils@3.0.4-preview-6235c3779
@metamask-previews/chain-agnostic-permission@1.6.1-preview-6235c3779
@metamask-previews/chomp-api-service@3.1.0-preview-6235c3779
@metamask-previews/claims-controller@0.5.1-preview-6235c3779
@metamask-previews/client-controller@1.0.1-preview-6235c3779
@metamask-previews/compliance-controller@2.0.1-preview-6235c3779
@metamask-previews/composable-controller@12.0.1-preview-6235c3779
@metamask-previews/config-registry-controller@0.3.1-preview-6235c3779
@metamask-previews/connectivity-controller@0.2.0-preview-6235c3779
@metamask-previews/controller-utils@12.1.0-preview-6235c3779
@metamask-previews/core-backend@6.3.0-preview-6235c3779
@metamask-previews/delegation-controller@3.0.0-preview-6235c3779
@metamask-previews/earn-controller@12.2.0-preview-6235c3779
@metamask-previews/eip-5792-middleware@3.0.4-preview-6235c3779
@metamask-previews/eip-7702-internal-rpc-middleware@0.1.1-preview-6235c3779
@metamask-previews/eip1193-permission-middleware@2.0.1-preview-6235c3779
@metamask-previews/ens-controller@19.1.3-preview-6235c3779
@metamask-previews/eth-block-tracker@15.0.1-preview-6235c3779
@metamask-previews/eth-json-rpc-middleware@23.1.3-preview-6235c3779
@metamask-previews/eth-json-rpc-provider@6.0.1-preview-6235c3779
@metamask-previews/foundryup@1.0.1-preview-6235c3779
@metamask-previews/gas-fee-controller@26.2.2-preview-6235c3779
@metamask-previews/gator-permissions-controller@4.2.0-preview-6235c3779
@metamask-previews/geolocation-controller@0.1.3-preview-6235c3779
@metamask-previews/json-rpc-engine@10.5.0-preview-6235c3779
@metamask-previews/json-rpc-middleware-stream@8.0.8-preview-6235c3779
@metamask-previews/keyring-controller@25.5.0-preview-6235c3779
@metamask-previews/logging-controller@8.0.2-preview-6235c3779
@metamask-previews/message-manager@14.1.2-preview-6235c3779
@metamask-previews/messenger@1.2.0-preview-6235c3779
@metamask-previews/messenger-cli@0.2.0-preview-6235c3779
@metamask-previews/money-account-balance-service@1.0.2-preview-6235c3779
@metamask-previews/money-account-controller@0.3.0-preview-6235c3779
@metamask-previews/money-account-upgrade-controller@2.0.2-preview-6235c3779
@metamask-previews/multichain-account-service@10.0.0-preview-6235c3779
@metamask-previews/multichain-api-middleware@3.1.2-preview-6235c3779
@metamask-previews/multichain-network-controller@3.1.2-preview-6235c3779
@metamask-previews/multichain-transactions-controller@7.1.0-preview-6235c3779
@metamask-previews/name-controller@9.1.2-preview-6235c3779
@metamask-previews/network-controller@32.0.0-preview-6235c3779
@metamask-previews/network-enablement-controller@5.2.0-preview-6235c3779
@metamask-previews/notification-services-controller@24.1.1-preview-6235c3779
@metamask-previews/passkey-controller@2.0.1-preview-6235c3779
@metamask-previews/permission-controller@13.1.1-preview-6235c3779
@metamask-previews/permission-log-controller@5.1.0-preview-6235c3779
@metamask-previews/perps-controller@6.3.0-preview-6235c3779
@metamask-previews/phishing-controller@17.2.0-preview-6235c3779
@metamask-previews/platform-api-docs@0.0.0-preview-6235c3779
@metamask-previews/polling-controller@16.0.6-preview-6235c3779
@metamask-previews/preferences-controller@23.1.0-preview-6235c3779
@metamask-previews/profile-metrics-controller@3.1.4-preview-6235c3779
@metamask-previews/profile-sync-controller@28.1.0-preview-6235c3779
@metamask-previews/ramps-controller@14.0.0-preview-6235c3779
@metamask-previews/rate-limit-controller@7.0.1-preview-6235c3779
@metamask-previews/react-data-query@0.2.1-preview-6235c3779
@metamask-previews/remote-feature-flag-controller@4.2.1-preview-6235c3779
@metamask-previews/sample-controllers@5.0.1-preview-6235c3779
@metamask-previews/seedless-onboarding-controller@9.1.0-preview-6235c3779
@metamask-previews/selected-network-controller@26.1.3-preview-6235c3779
@metamask-previews/shield-controller@5.1.2-preview-6235c3779
@metamask-previews/signature-controller@39.2.2-preview-6235c3779
@metamask-previews/snap-account-service@0.2.0-preview-6235c3779
@metamask-previews/social-controllers@2.2.1-preview-6235c3779
@metamask-previews/storage-service@1.0.1-preview-6235c3779
@metamask-previews/subscription-controller@6.1.3-preview-6235c3779
@metamask-previews/transaction-controller@66.0.0-preview-6235c3779
@metamask-previews/transaction-pay-controller@22.7.0-preview-6235c3779
@metamask-previews/user-operation-controller@41.2.2-preview-6235c3779
@metamask-previews/wallet@0.0.0-preview-6235c3779

The refactor in 0862ed5 renamed `ExtractedMessengerCapabilityType` to
`MessengerCapabilityPacket` across the source files but missed the
import + helper signatures in `markdown.test.ts`. The build didn't
catch it (test files are excluded from `tsconfig.build.json`), Jest
didn't catch it (Babel strips `import type` at compile time), and
ESLint doesn't surface TS module-resolution errors — only
`tsc --noEmit` against the dev tsconfig flagged the dangling reference.
The walker's bare-TypeReference branch — added to avoid double-documenting
plain re-exports like `type AllowedActions = ForeignAction` — was
swallowing the auto-generated `*MethodActions` alias whenever a
controller exposed exactly one bulk-registered method, e.g.

    type DelegationControllerMethodActions =
      DelegationControllerSignDelegationAction;

Since the body has no type arguments, the previous logic treated this as
a re-export and dropped the chain, so `signDelegation` never appeared in
the docs even though it was reachable from the messenger via
`DelegationControllerActions`.

Recurse into the referenced type instead. The shared `visitedTypeDeclarations`
set prevents the double-counting that the skip was originally guarding
against, so the same-file `SharedAction | AliasOfShared` case still
extracts exactly one capability. Cross-file re-exports continue to land
under their declaring file's namespace because
`extractFromMessengerCapabilityTypeDeclaration` uses the resolved
declaration's source file.

End-to-end extraction over the monorepo goes from 1062 items / 88
namespaces to 1259 items / 103 namespaces; DelegationController now
documents both `getState` and `signDelegation` as expected.
const typeNode = param.getTypeNode();
const paramType = typeNode ? typeNode.getText() : 'unknown';
return `${paramName}${optional}: ${paramType}`;
})
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rest parameters missing spread operator in handler signature

Low Severity

buildMethodInfo reconstructs method signatures but doesn't account for rest parameters. param.getNameNode().getText() returns just the identifier (e.g. args), omitting the ... spread token. A method like doStuff(...args: string[]) would be rendered as (args: string[]) => void instead of (...args: string[]) => void, producing an incorrect handler signature in the generated docs.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 737f925. Configure here.

`tryToExtractFromCapabilityTypeConstructor` was re-checking that the
declaration was a type alias and that its body was a `TypeReference`
even though `recursivelyFindMessengerCapabilityTypeDeclarations` had
already established both — the duplicate guards needed `// istanbul
ignore next` annotations to keep coverage clean. The two TODOs left in
0862ed5 ("Capture the following information ahead of time so we
don't need to check this again") flagged exactly this.

Split `MessengerCapabilityTypeDeclaration` into a discriminated union
of `bodyShape: 'constructor'` (type alias whose body is a
`TypeReferenceNode` with type arguments) and `bodyShape: 'object'`
(any other type alias or an interface). The walker classifies the body
once when it captures the declaration; `extractFromMessengerCapabilityTypeDeclaration`
dispatches on the tag instead of falling back through both extractors;
each extractor consumes its specific variant and reads the
pre-narrowed `body` directly.

This drops both duplicate `isTypeReference` / `isTypeAliasDeclaration`
guards in the constructor extractor (the istanbul-ignored ones); the
remaining `!isIdentifier(typeName)` guard stays because `getTypeName()`
returns `EntityName`, which a `TypeReferenceNode`'s type narrowing
can't refine on its own.

Added a regression test for the new walker path that handles exotic
body shapes (intersections) — they now flow through `bodyShape:
'object'` and get rejected by the literal extractor's `isTypeLiteral`
check. End-to-end extraction still produces 1259 items / 103
namespaces; coverage stays at 100/100/100/100.
namespacePrefix.length > 0 &&
item.sourceFile.toLowerCase().includes(namespacePrefix)
? 1
: 0;
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dedup home-package check uses overly broad substring match

Low Severity

The deduplicationScore function computes a "home" bonus by checking if item.sourceFile.toLowerCase().includes(namespacePrefix). For short namespace prefixes (e.g., namespace "App" → prefix "app", or "Log""log"), this matches unrelated file paths like packages/approval-controller/src/... or packages/dialog-utils/src/.... This can cause the wrong duplicate to win the tiebreaker, documenting a re-export instead of the home definition.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 09190bf. Configure here.

The block at the call site for `resolveIndexedAccessMethod` is what
makes the auto-generated `*-method-action-types.ts` flow produce rich
Parameters tables: the aliases just reference `FooController['method']`
without copying the JSDoc, so the action page would render an empty
Parameters section without this inheritance. Replace the open TODO
with a comment explaining the intent.
Copy link
Copy Markdown

@cursor cursor Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 1882f5c. Configure here.

@@ -0,0 +1,11 @@
{
"extends": "../../../tsconfig.base.json",
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Site tsconfig extends path breaks when copied to output

Low Severity

The "extends": "../../../tsconfig.base.json" path is correct from the source location at packages/platform-api-docs/site/, but setupSite copies this file via fs.cp into the output directory (e.g. <project>/.platform-api-docs/). From there, the three-level-up relative path resolves outside the project to a non-existent file. When used as a published npm package the path is even more wrong. Docusaurus likely still builds because jiti doesn't depend on this tsconfig, but the shipped file is broken.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 1882f5c. Configure here.

Action pages now reflect only the JSDoc on the type alias itself —
description, `@param`, `@returns`, and `@deprecated` no longer fall
through to the referenced class method when the alias has none. The
handler signature substitution stays so `Class['method']` still
renders as `(arg: T) => R` instead of the raw indexed-access syntax.

In practice this is a no-op for the rendered docs: every controller
that uses the `*-method-action-types.ts` bulk-registration pattern
already carries the full JSDoc (description, `@param`, `@returns`) on
the auto-generated type alias, and the hand-written `Class['method']`
handlers in `PermissionController` likewise document each alias
directly. NetworkController's `addNetwork` and DelegationController's
`signDelegation` continue to render with populated Parameters tables.

- Collapse `buildMethodInfo` into `buildMethodSignature` returning
  just the signature string; drop the `MethodInfo` type from
  `types.ts` and the import in `extraction.ts`.
- Replace the test that locked in JSDoc inheritance with one that
  locks in its absence; delete the redundant
  alias-prefers-over-method test (alias-only is now the only path).

Coverage stays at 100/100/100/100 and the end-to-end extraction still
produces 1259 items / 103 namespaces.
`oxfmt` collapses the `import type { ... } from './types'` to a single
line now that only two symbols remain, which is what `lint:misc:check`
expects.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants