Skip to content

feat: add @metamask/platform-api-docs package#8012

Open
cryptodev-2s wants to merge 105 commits into
mainfrom
feat/messenger-docs-site
Open

feat: add @metamask/platform-api-docs package#8012
cryptodev-2s wants to merge 105 commits into
mainfrom
feat/messenger-docs-site

Conversation

@cryptodev-2s
Copy link
Copy Markdown
Contributor

@cryptodev-2s cryptodev-2s commented Feb 22, 2026

Explanation

Adds @metamask/platform-api-docs, a publishable package that generates and serves a searchable site documenting the Platform API — the catalog of actions and events available to clients through the message bus.

The package scans TypeScript source and .d.cts declaration files, finds every *Messenger type declaration, walks its Actions and Events type arguments to discover the capability types they reference, extracts JSDoc/handler/payload information for each, and renders the result as a Docusaurus site with per-namespace pages and local search.

Features

  • Anchored on Messenger declarations. Extraction discovers *Messenger type aliases and walks Messenger<Namespace, Actions, Events> to find the capability types — eliminating false positives from unrelated types that happen to share an action/event-like shape.
  • Two capability-type patterns supported. Inline (type FooAction = { type: '...'; handler: ... }) and capability-type constructors (type FooGetStateAction = ControllerGetStateAction<typeof name, State>), including their interface variants.
  • Union expansion. When a Messenger references an umbrella union like FooActions = FooGetAction | FooSetAction, the walker descends through it without documenting the intermediate alias.
  • Scans three layouts. Configured --scan-dirs, packages/*/src/ (.ts), and node_modules/@metamask/*/dist/ (.d.cts).
  • Source links resolve automatically. Reads git remote get-url origin and git symbolic-ref refs/remotes/origin/HEAD to build https://github.com/<owner>/<repo>/blob/<branch>/<path>#L<line> URLs; falls back to main for shallow clones.
  • Project label and commit SHA stamped on the site. --project-label Core / --project-label Extension produces titles like Platform API (Core), and the short Git commit is shown in the intro and navbar so engineers can tell how current the docs are.
  • Dedup across packages. When a capability is declared in two places (e.g. once as the home definition and once as a re-export), the version with JSDoc and from the matching namespace's package wins.
  • Docusaurus site with dark/light mode, offline search (no Algolia), and MDX-safe rendering of JSDoc.

Usage

From the core monorepo:

yarn docs:platform-api:build   # Generate docs and build static site
yarn docs:platform-api:dev     # Dev server with hot reload
yarn docs:platform-api:serve   # Build and serve

From client projects (Extension, Mobile), install @metamask/platform-api-docs as a devDependency and add a script:

{
  "scripts": {
    "docs:platform-api:build": "platform-api-docs --build --project-label MyProject"
  }
}

Implementation

  • packages/platform-api-docs/ — separate workspace from @metamask/messenger-cli (different deps and release cadence).
  • CLI built with yargs; runs Docusaurus through execa. Flags: --build, --serve, --dev, --scan-dir (additive, repeatable), --output, --project-label. Configuration is CLI-only — no package.json config block.
  • AST parsing via ts-morph instead of the raw TypeScript compiler API. Standard JSDoc extraction (jsDoc.getDescription() + getTags()) replaces the previous hand-rolled comment parser.
  • Single-pass extraction. The Messenger walk returns TypeAliasDeclaration/InterfaceDeclaration nodes directly tagged with 'action'/'event' kind, so the main loop doesn't re-walk the source file looking up names.
  • File discovery via the glob package, with results sorted for deterministic output across filesystems.
  • Test coverage: 100% lines / ~93% branches. Defensive guards against AST shapes that don't appear in real messenger types are explicitly marked with // istanbul ignore comments.
  • GitHub Actions workflow (deploy-platform-api-docs.yml) builds docs on PRs (uploads the build as an artifact) and deploys to GitHub Pages on main.

References

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've communicated my changes to consumers by updating changelogs for packages I've changed
  • I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Note

Medium Risk
Adds a new publishable docs generator that parses TS via ts-morph and introduces a new GitHub Actions workflow to build/deploy to Pages; main risk is CI/deploy config and new dependency surface rather than runtime code paths.

Overview
Adds a new workspace package, @metamask/platform-api-docs, that generates Platform API documentation by scanning projects for *Messenger type declarations, extracting action/event metadata (JSDoc, handler/payload signatures), and rendering per-namespace markdown plus Docusaurus site assets.

Introduces a deploy-platform-api-docs GitHub Actions workflow that builds docs on PRs (uploads an artifact) and deploys the built site to GitHub Pages on main under /platform-api/.

Wires the tool into the repo via new root scripts (docs:platform-api:*), updates ESLint ignores/rules for the new package, adds CODEOWNERS/README entries, and ignores generated output (.platform-api-docs/) in git.

Reviewed by Cursor Bugbot for commit 21f1876. Bugbot is set up for automated code reviews on this repo. Configure here.

@cryptodev-2s cryptodev-2s self-assigned this Feb 22, 2026
@cryptodev-2s cryptodev-2s force-pushed the feat/messenger-docs-site branch 4 times, most recently from 63f3188 to 7c63a0d Compare February 22, 2026 22:26
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Feb 22, 2026

Caution

MetaMask internal reviewing guidelines:

  • Do not ignore-all
  • Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
  • Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
    @SocketSecurity ignore npm/PACKAGE@VERSION
Action Severity Alert  (click "▶" to expand/collapse)
Block High
High CVE: npm @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input

CVE: GHSA-fv7c-fp4j-7gwp @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input (HIGH)

Affected versions: >= 7.12.0 < 7.29.4; >= 8.0.0-alpha.0 < 8.0.0-alpha.13

Patched version: 7.29.4

From: ?npm/@docusaurus/core@3.10.1npm/@docusaurus/preset-classic@3.10.1npm/@babel/plugin-transform-modules-systemjs@7.29.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@babel/plugin-transform-modules-systemjs@7.29.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: npm fast-uri vulnerable to host confusion via percent-encoded authority delimiters

CVE: GHSA-v39h-62p7-jpjc fast-uri vulnerable to host confusion via percent-encoded authority delimiters (HIGH)

Affected versions: < 3.1.2

Patched version: 3.1.2

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/@docusaurus/types@3.10.1npm/@docusaurus/core@3.10.1npm/@docusaurus/plugin-content-docs@3.10.1npm/@docusaurus/theme-common@3.10.1npm/@docusaurus/preset-classic@3.10.1npm/fast-uri@3.1.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fast-uri@3.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
High CVE: npm fast-uri vulnerable to path traversal via percent-encoded dot segments

CVE: GHSA-q3j6-qgpj-74h6 fast-uri vulnerable to path traversal via percent-encoded dot segments (HIGH)

Affected versions: < 3.1.1

Patched version: 3.1.1

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/@docusaurus/types@3.10.1npm/@docusaurus/core@3.10.1npm/@docusaurus/plugin-content-docs@3.10.1npm/@docusaurus/theme-common@3.10.1npm/@docusaurus/preset-classic@3.10.1npm/fast-uri@3.1.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fast-uri@3.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
Obfuscated code: npm lunr-languages is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/lunr-languages@1.14.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lunr-languages@1.14.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
Obfuscated code: npm lunr-languages is 95.0% likely obfuscated

Confidence: 0.95

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/lunr-languages@1.14.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lunr-languages@1.14.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
Obfuscated code: npm svgo is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/@docusaurus/preset-classic@3.10.1npm/svgo@3.3.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/svgo@3.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @algolia/client-personalization in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/preset-classic@3.10.1npm/@algolia/client-personalization@5.52.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@algolia/client-personalization@5.52.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @algolia/requester-fetch in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/preset-classic@3.10.1npm/@algolia/requester-fetch@5.52.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@algolia/requester-fetch@5.52.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @algolia/requester-node-http in module http

Module: http

Location: Package overview

From: ?npm/@docusaurus/preset-classic@3.10.1npm/@algolia/requester-node-http@5.52.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@algolia/requester-node-http@5.52.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @algolia/requester-node-http in module https

Module: https

Location: Package overview

From: ?npm/@docusaurus/preset-classic@3.10.1npm/@algolia/requester-node-http@5.52.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@algolia/requester-node-http@5.52.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @docsearch/react in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/preset-classic@3.10.1npm/@docsearch/react@4.6.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@docsearch/react@4.6.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @emnapi/core in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/@emnapi/core@1.10.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/core@1.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: npm @node-rs/jieba in module child_process

Module: child_process

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/@node-rs/jieba@1.10.4

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@node-rs/jieba@1.10.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @pnpm/npm-conf in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/@pnpm/npm-conf@3.0.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@pnpm/npm-conf@3.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm @tybys/wasm-util in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/@tybys/wasm-util@0.10.1

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tybys/wasm-util@0.10.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
System shell access: npm address in module child_process

Module: child_process

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/address@1.2.2

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/address@1.2.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm algoliasearch-helper in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/preset-classic@3.10.1npm/algoliasearch-helper@3.28.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/algoliasearch-helper@3.28.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm babel-plugin-polyfill-corejs3 in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/babel-plugin-polyfill-corejs3@0.13.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/babel-plugin-polyfill-corejs3@0.13.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm babel-plugin-polyfill-corejs3 in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/@docusaurus/preset-classic@3.10.1npm/babel-plugin-polyfill-corejs3@0.14.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/babel-plugin-polyfill-corejs3@0.14.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm clean-css in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/clean-css@5.3.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/clean-css@5.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm clean-css in module http

Module: http

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/clean-css@5.3.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/clean-css@5.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm clean-css in module https

Module: https

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/clean-css@5.3.3

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/clean-css@5.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm config-chain in module http

Module: http

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/config-chain@1.1.13

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/config-chain@1.1.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm core-js in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/core-js@3.49.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/core-js@3.49.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm detect-port in module net

Module: net

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/detect-port@1.6.1

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/detect-port@1.6.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm domutils in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@docusaurus/core@3.10.1npm/domutils@2.8.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/domutils@2.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Medium
Network access: npm domutils in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: ?npm/@easyops-cn/docusaurus-search-local@0.55.1npm/@docusaurus/core@3.10.1npm/@docusaurus/preset-classic@3.10.1npm/domutils@3.2.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/domutils@3.2.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 118 more rows in the dashboard

View full report

@cryptodev-2s cryptodev-2s force-pushed the feat/messenger-docs-site branch 3 times, most recently from b55b682 to 980f677 Compare February 23, 2026 22:31
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@github-actions
Copy link
Copy Markdown
Contributor

Preview builds have been published. See these instructions for more information about preview builds.

Expand for full list of packages and versions.
{
  "@metamask-previews/account-tree-controller": "4.1.1-preview-980f677",
  "@metamask-previews/accounts-controller": "36.0.1-preview-980f677",
  "@metamask-previews/address-book-controller": "7.0.1-preview-980f677",
  "@metamask-previews/ai-controllers": "0.1.0-preview-980f677",
  "@metamask-previews/analytics-controller": "1.0.0-preview-980f677",
  "@metamask-previews/analytics-data-regulation-controller": "0.0.0-preview-980f677",
  "@metamask-previews/announcement-controller": "8.0.0-preview-980f677",
  "@metamask-previews/app-metadata-controller": "2.0.0-preview-980f677",
  "@metamask-previews/approval-controller": "8.0.0-preview-980f677",
  "@metamask-previews/assets-controller": "2.0.2-preview-980f677",
  "@metamask-previews/assets-controllers": "100.0.2-preview-980f677",
  "@metamask-previews/base-controller": "9.0.0-preview-980f677",
  "@metamask-previews/bridge-controller": "67.1.1-preview-980f677",
  "@metamask-previews/bridge-status-controller": "67.0.1-preview-980f677",
  "@metamask-previews/build-utils": "3.0.4-preview-980f677",
  "@metamask-previews/chain-agnostic-permission": "1.4.0-preview-980f677",
  "@metamask-previews/claims-controller": "0.4.2-preview-980f677",
  "@metamask-previews/client-controller": "1.0.0-preview-980f677",
  "@metamask-previews/compliance-controller": "1.0.1-preview-980f677",
  "@metamask-previews/composable-controller": "12.0.0-preview-980f677",
  "@metamask-previews/connectivity-controller": "0.1.0-preview-980f677",
  "@metamask-previews/controller-utils": "11.19.0-preview-980f677",
  "@metamask-previews/core-backend": "6.0.0-preview-980f677",
  "@metamask-previews/delegation-controller": "2.0.1-preview-980f677",
  "@metamask-previews/earn-controller": "11.1.1-preview-980f677",
  "@metamask-previews/eip-5792-middleware": "2.1.0-preview-980f677",
  "@metamask-previews/eip-7702-internal-rpc-middleware": "0.1.0-preview-980f677",
  "@metamask-previews/eip1193-permission-middleware": "1.0.3-preview-980f677",
  "@metamask-previews/ens-controller": "19.0.3-preview-980f677",
  "@metamask-previews/error-reporting-service": "3.0.1-preview-980f677",
  "@metamask-previews/eth-block-tracker": "15.0.1-preview-980f677",
  "@metamask-previews/eth-json-rpc-middleware": "23.1.0-preview-980f677",
  "@metamask-previews/eth-json-rpc-provider": "6.0.0-preview-980f677",
  "@metamask-previews/foundryup": "1.0.1-preview-980f677",
  "@metamask-previews/gas-fee-controller": "26.0.3-preview-980f677",
  "@metamask-previews/gator-permissions-controller": "2.0.0-preview-980f677",
  "@metamask-previews/json-rpc-engine": "10.2.2-preview-980f677",
  "@metamask-previews/json-rpc-middleware-stream": "8.0.8-preview-980f677",
  "@metamask-previews/keyring-controller": "25.1.0-preview-980f677",
  "@metamask-previews/logging-controller": "7.0.1-preview-980f677",
  "@metamask-previews/message-manager": "14.1.0-preview-980f677",
  "@metamask-previews/messenger": "0.3.0-preview-980f677",
  "@metamask-previews/multichain-account-service": "7.0.0-preview-980f677",
  "@metamask-previews/multichain-api-middleware": "1.2.7-preview-980f677",
  "@metamask-previews/multichain-network-controller": "3.0.4-preview-980f677",
  "@metamask-previews/multichain-transactions-controller": "7.0.1-preview-980f677",
  "@metamask-previews/name-controller": "9.0.0-preview-980f677",
  "@metamask-previews/network-controller": "30.0.0-preview-980f677",
  "@metamask-previews/network-enablement-controller": "4.1.2-preview-980f677",
  "@metamask-previews/notification-services-controller": "22.0.0-preview-980f677",
  "@metamask-previews/permission-controller": "12.2.0-preview-980f677",
  "@metamask-previews/permission-log-controller": "5.0.0-preview-980f677",
  "@metamask-previews/perps-controller": "0.0.0-preview-980f677",
  "@metamask-previews/phishing-controller": "16.3.0-preview-980f677",
  "@metamask-previews/polling-controller": "16.0.3-preview-980f677",
  "@metamask-previews/preferences-controller": "22.1.0-preview-980f677",
  "@metamask-previews/profile-metrics-controller": "3.0.1-preview-980f677",
  "@metamask-previews/profile-sync-controller": "27.1.0-preview-980f677",
  "@metamask-previews/ramps-controller": "10.0.0-preview-980f677",
  "@metamask-previews/rate-limit-controller": "7.0.0-preview-980f677",
  "@metamask-previews/remote-feature-flag-controller": "4.0.0-preview-980f677",
  "@metamask-previews/sample-controllers": "4.0.3-preview-980f677",
  "@metamask-previews/seedless-onboarding-controller": "8.1.0-preview-980f677",
  "@metamask-previews/selected-network-controller": "26.0.3-preview-980f677",
  "@metamask-previews/shield-controller": "5.0.1-preview-980f677",
  "@metamask-previews/signature-controller": "39.0.4-preview-980f677",
  "@metamask-previews/storage-service": "1.0.0-preview-980f677",
  "@metamask-previews/subscription-controller": "6.0.0-preview-980f677",
  "@metamask-previews/transaction-controller": "62.18.0-preview-980f677",
  "@metamask-previews/transaction-pay-controller": "16.0.0-preview-980f677",
  "@metamask-previews/user-operation-controller": "41.0.3-preview-980f677"
}

@cryptodev-2s cryptodev-2s force-pushed the feat/messenger-docs-site branch from 980f677 to f49a7dd Compare February 24, 2026 15:09
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

1 similar comment
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@cryptodev-2s cryptodev-2s force-pushed the feat/messenger-docs-site branch from f49a7dd to 44fb063 Compare February 24, 2026 16:22
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@cryptodev-2s cryptodev-2s changed the title feat: add Messenger API docs site with local search feat: add @metamask/messenger-docs Feb 24, 2026
@cryptodev-2s cryptodev-2s changed the title feat: add @metamask/messenger-docs feat: add @metamask/messenger-docs Feb 24, 2026
@cryptodev-2s cryptodev-2s changed the title feat: add @metamask/messenger-docs feat: add @metamask/messenger-docs package Feb 24, 2026
cryptodev-2s and others added 8 commits February 25, 2026 18:55
Docusaurus site for browsing controller messenger actions/events,
with offline search powered by docusaurus-search-local.
## Explanation

The messenger docs generation currently lives in
`scripts/generate-messenger-docs/` and the Docusaurus site template in
`docs-site/`. This makes it unusable by external clients
(metamask-extension, metamask-mobile) without access to this monorepo.

This PR extracts both into a new `@metamask/messenger-docs` package at
`packages/messenger-docs/` with a CLI, so any project with `@metamask`
controller dependencies can generate and serve messenger API docs.

### Usage

```bash
# Default: scans cwd for node_modules/@MetaMask controller/service packages
npx @metamask/messenger-docs

# Scan a specific project
npx @metamask/messenger-docs /path/to/project

# Generate + build static site
npx @metamask/messenger-docs --build

# Generate + serve (build + http server)
npx @metamask/messenger-docs --serve

# Generate + dev server (hot reload)
npx @metamask/messenger-docs --dev

# Scan source .ts files instead of .d.cts (for monorepo development)
npx @metamask/messenger-docs --source

# Custom output directory (default: .messenger-docs)
npx @metamask/messenger-docs --output ./my-docs
```

## References

- Builds on top of `feat/messenger-docs-site`

## Checklist

- [ ] I've updated the test suite for new or updated code as appropriate
- [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or
updated code as appropriate
- [ ] I've communicated my changes to consumers by [updating changelogs
for packages I've
changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md)
- [ ] I've introduced [breaking
changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md)
in this PR and have prepared draft pull requests for clients and
consumer packages to resolve them
@cryptodev-2s cryptodev-2s force-pushed the feat/messenger-docs-site branch from cb82c24 to 17adacd Compare February 25, 2026 17:55
Re-applies an earlier change that was lost during the messenger-docs
package split. `findTsFiles` and `findDtsFiles` are now thin wrappers
around `glob`, which replaces the hand-rolled recursive readdir walks.

`glob` doesn't guarantee result order, so the matches are explicitly
sorted before being returned. Downstream consumers (extraction,
dedup, output ordering) depend on a stable file processing order, so
this keeps generated output deterministic across filesystems.
Comment thread packages/platform-api-docs/src/markdown.ts
The package was originally named for where it lived in the codebase
(alongside `messenger-action-types`), but its actual product is the
Platform API documentation site: the catalog of actions and events
available through the message bus. The site title, the workflow
("Deploy Platform API Docs"), and the README copy all already use
"Platform API"; the package and CLI name were the last lingering bits
of the old framing.

Renames in this commit:

- Directory: `packages/messenger-docs/` → `packages/platform-api-docs/`.
- npm name: `@metamask/messenger-docs` → `@metamask/platform-api-docs`.
- Binary: `messenger-docs` → `platform-api-docs` (now explicitly named
  in `bin` rather than implicitly derived from the package name).
- Root scripts: `docs:messenger:{build,dev,serve}` → `docs:platform-api:*`.
- Output directory: `.messenger-docs/` → `.platform-api-docs/`.
- Generated `sidebars.ts` header comment and the synthetic Docusaurus
  site's `package.json#name` updated to match.
- CODEOWNERS, teams.json, tsconfig.{json,build.json}, eslint.config.mjs,
  yarn.config.cjs, .gitignore, and the workflow file all updated to
  reference the new path/name.

The package is still at 0.0.0 with no consumers, so there's no
migration path needed.
The `node_modules/` branch in `generateItemMarkdown` was producing a
nonsensical link when the path wasn't `@metamask/`-scoped: the fallback
used the entire source path as the package name, yielding URLs like
`https://www.npmjs.com/package/node_modules/some-vendor/dist/index.d.ts`.

In practice the scanner only walks `node_modules/@metamask/*/dist`, so
the fallback never fired against real input. The only thing exercising
it was a unit test I added in the coverage-bump commit — so the test
was effectively codifying broken output to inflate coverage.

Restructure to: render an npm link only when the path is actually
`@metamask`-scoped, otherwise fall through to the normal source-link
branches (GitHub blob URL if a repo base URL is available, plain path
otherwise). The two unit tests now assert the correct behavior:

- a plain `**Source**: \`<path>:<line>\`` when no repo URL is given
- a GitHub blob URL when one is

Reported by Cursor Bugbot on PR #8012.
@cryptodev-2s cryptodev-2s changed the title feat: add @metamask/messenger-docs package feat: add @metamask/platform-api-docs package May 15, 2026
Comment thread packages/platform-api-docs/src/extraction.ts Outdated
`actions/deploy-pages` deploys to the root of the gh-pages site, which
means a single repo can only publish one doc site through it. If we
ever want to add package API docs (or any other doc surface)
alongside, the platform-api site needs to live in its own
subdirectory.

Switch the deploy mechanism to `peaceiris/actions-gh-pages` and:

- Publish to `gh-pages/platform-api/` via `destination_dir: platform-api`.
- Set `keep_files: true` so sibling subdirectories (e.g. a future
  `/package-api/`) aren't clobbered on each platform-api deploy.
- Update `DOCS_BASE_URL` to `/<repo>/platform-api/` so the built
  Docusaurus site has the right `<base href>`.
- Replace the `actions/upload-pages-artifact` step with a regular
  `actions/upload-artifact` + `actions/download-artifact` pair, since
  we no longer use the Pages-specific artifact pipeline.
- Swap the `pages: write` / `id-token: write` permissions for the
  deploy job to `contents: write` (peaceiris pushes the build commit
  directly to `gh-pages`).
- Drop the `environment: github-pages` block; with peaceiris, the
  deploy isn't gated on a Pages deployment environment.
- Bump pinned action versions to match the freshest in this repo:
  `MetaMask/action-checkout-and-setup@v3`,
  `actions/upload-artifact@v6`, `actions/download-artifact@v7`,
  `peaceiris/actions-gh-pages@v4.1.0`.

Note: when this lands, the repo's GitHub Pages settings need to be
flipped from "GitHub Actions" back to "Deploy from a branch" (gh-pages)
since we're no longer using the Pages Actions pipeline.
`resolveHandler` was matching only the single-quoted form
`ClassName['method']`. TypeScript accepts three syntactically distinct
forms for indexed-access types — `Class['m']`, `Class["m"]`, and
`` Class[`m`] `` — and ts-morph's `getText()` returns whatever the
source used verbatim. When a controller author chose double quotes or
template literals, we'd fail to resolve the handler and fall back to
rendering the raw text instead of the method signature plus its JSDoc.

Updated the regex to a backreferenced quote character class
(`/^(\w+)\[(['"`])(\w+)\2\]$/u`) and shifted the method-name capture
group from `match[2]` to `match[3]` to compensate. Added two tests
covering the double-quoted and template-literal forms.

Bump the action versions in the deploy workflow to the absolute latest
pair (`upload-artifact@v7` / `download-artifact@v8`), since these are
paired by major version and v8 of `download-artifact` flips
hash-mismatch handling from warning to error (a strictly-better
default for an artifact-driven deploy).

Reported by Cursor Bugbot on PR #8012.
The site was rendering action handlers as raw TypeScript types — fine
when the types are clean, but ugly when ts-morph emits a fully-qualified
`import("/abs/path/...").TypeName`. The information engineers actually
want — what each handler argument means and what it returns — was
being thrown away (the `@param` / `@returns` tags were stripped by the
JSDoc parser before reaching the renderer).

Keep those tags as structured data and render them alongside the
handler signature:

- Add `params: { name, description }[]` and `returns: string` fields to
  `ExtractedMessengerCapabilityType` (and `MethodInfo` for inheritance).
- Replace `extractJsDocText` with `extractJsDoc`, which decomposes the
  comment into `{ description, params, returns }` — the description
  body still flows through MDX-escaping and `{@link}` resolution, but
  `@param` and `@returns` tags are pulled out into separate fields.
- Strip the conventional leading `- ` separator from `@param` comments
  (JSDoc style is `@param name - description`; the hyphen is purely
  decorative).
- When an action's handler resolves to a class method, inherit the
  method's `@param`/`@returns` if the type alias doesn't have its own.
  Type-alias-level docs win when both are present.
- In `markdown.ts`, render `**Parameters**:` as a name/description
  table and a `**Returns**:` line, both with backtick-reference
  linkification. The existing signature block is renamed to
  `**Handler signature**:` / `**Payload signature**:` so the new sections
  read naturally.

Events don't get a parameters table — they carry positional payload
tuples, not named arguments.

Coverage held at 100% lines / 94% branches with new fixtures for the
structured-fields path, multi-line params, and class-method inheritance
(including the type-alias-overrides-method ordering rule).
Most messenger capability types in this repo live in auto-generated
`*-method-action-types.ts` files alongside their controller, with the
*Messenger declaration importing an umbrella union from that sibling.
The previous extractor anchored on the file containing the messenger
and refused to follow imports — so for `NetworkController.ts` only
`NetworkControllerGetStateAction` was being extracted, despite 24 other
actions sitting in the sibling file.

Switch to a single ts-morph Project shared across every scanned file,
with a real filesystem (not the in-memory FS we were using before) so
the type checker can resolve imports normally. The walker now follows
imported references via `symbol.getAliasedSymbol()` to find the
original declaration in its home file. Same shape for `Class['method']`
handler resolution — instead of regex-matching the text, we look at
the actual `IndexedAccessTypeNode`, resolve the object type's symbol
to the class declaration (across files when needed), and look up the
method by name.

Several pieces of supporting machinery dropped or shrank:

- `collectStringConstants` / `extractStringConstants` and the manual
  single-hop import-chasing are gone. `typeof X` now resolves through
  the type checker (`.getType().getLiteralValueOrThrow()`).
- The per-file `collectClassMethods` cache is gone — methods are
  looked up on demand via the class declaration the type checker
  points to.
- The regex-based `resolveHandler` is gone. Replaced by
  `resolveIndexedAccessMethod` which inspects the AST.
- The walker now distinguishes between a TypeReference with no type
  arguments (a plain re-export to leave to the home package) and one
  with type arguments (a capability-type-constructor invocation
  worth recording).
- The walker's seen-set is keyed by declaration node, not name, so
  the same name reached through two messengers in the same file
  records the declaration once.

`extractFromFile` is preserved as a convenience wrapper for tests:
it creates a fresh Project, adds the file plus its parent directory's
siblings so relative imports resolve, and calls
`extractFromSourceFile`. The new entry points are
`createExtractionProject` + `extractFromSourceFile`, which `generate.ts`
uses for the batch pipeline so one Project amortizes the type-checker
setup across the whole run.

Live build numbers: 200 messenger items / 75 namespaces → 1058 items /
88 namespaces. NetworkController went from 1 action to 25; ApprovalController
from 1 to 17, with the rich `@param` JSDoc from the auto-generated
files now flowing into the rendered Parameters tables.

Coverage threshold adjusted to the new baseline (97/90/97/96 lines /
branches / statements / functions). The drop is mostly defensive
guards in the new symbol-resolution paths that don't fire in our
fixtures (e.g. symbols whose aliased target has no declarations).
The previous return type `TypeElementTypes | null` left the caller
with a union that included shapes like `GetAccessorDeclaration` that
don't have `getTypeNode()`, which the package's strict tsc build
rejected. Capability bodies only ever contain property signatures —
narrow the return type explicitly so the callers can read `getTypeNode`
without a cast.
Comment thread .github/workflows/deploy-platform-api-docs.yml Outdated
Comment thread packages/platform-api-docs/site/docusaurus.config.ts Outdated
- name: Generate and build Platform API docs
run: yarn docs:platform-api:build
env:
DOCS_URL: https://${{ github.repository_owner }}.github.io
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know I had a question about this earlier, but instead of setting environment variables, does it make sense to pass these values as options to the CLI inside of the yarn docs:platform-api:* package scripts?. In the Docusaurus config file we still need to read environment variables, so we need to set them at some point — but from the perspective of the CLI and thus what users see, it would be good to have only one way to specify options instead of two ways.

Comment thread packages/platform-api-docs/site/tsconfig.json
Comment thread packages/platform-api-docs/src/cli.ts Outdated
Comment thread packages/platform-api-docs/src/types.ts Outdated
Comment thread packages/platform-api-docs/CHANGELOG.md Outdated
Comment thread packages/platform-api-docs/jest.config.js Outdated
Comment thread packages/platform-api-docs/LICENSE
Comment thread packages/platform-api-docs/src/extraction.ts
* @param projectPath - Project root, used for computing relative source paths.
* @returns The extracted capability, or null if the shape doesn't match.
*/
function extractFromInlineMessengerCapabilityType(
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm. This and resolveInlineTypeString seems complicated. I was able to produce a version on my side based on a previous commit that was less complicated. I need to understand the difference between what I have and what you have.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fair — happy to compare. Could you push or paste your version so we can put the two side by side?

The reason the current pair looks heavier than what you'd get off an earlier commit is mostly the work landed in a85fa0f (cross-file type resolution). A quick map of what each function is carrying:

  • extractFromInlineMessengerCapabilityType:
    • Accepts both TypeAliasDeclaration (where the body is the TypeLiteral) and InterfaceDeclaration (where the declaration is the member list) — that's the first if/else block.
    • Resolves typeString via resolveInlineTypeString to handle the `${typeof controllerName}:action` template-literal pattern that's common in the auto-generated *-method-action-types.ts files.
    • For actions, if the handler resolves to Class['method'] (possibly in another file), it inherits the method's signature + any JSDoc fields the alias doesn't already provide. That's the chunk under if (kind === 'action').
  • resolveInlineTypeString is essentially just "walk to the type member, then dispatch on literal vs template-literal type node." It looks long because of the // istanbul ignore annotations I added in d4160fd — without those it's ~15 LOC.

If your version drops the Class['method'] inheritance and/or the template-literal path, that's the delta — those features are what got us from 200 → 1058 extracted items. If it keeps them but expresses them more compactly, I'd love to take that improvement.

- Dual-license under MIT + Apache 2.0, matching the new package
  template: `LICENSE` is now the umbrella pointer, with the MIT text
  moved to `LICENSE.MIT` and `LICENSE.APACHE2` added.
- Add the PR link to the unreleased changelog entry.
- Rename `ParamDoc` → `DocumentedParameter` (the previous name was
  cryptic-shorthand).
- Replace inline `// e.g. "..."` field comments in `types.ts` with
  proper JSDoc on every public field — both for consistency with the
  rest of the file and so type aliases render usefully in editor
  hover.
Comment thread packages/platform-api-docs/src/generate.ts Outdated
cryptodev-2s and others added 2 commits May 20, 2026 01:40
Four interlinked cleanups in the platform-api-docs CLI:

- Locate the Docusaurus binary via `npm-which` instead of hardcoding
  `require.resolve('@docusaurus/core/bin/docusaurus.mjs')`. A future
  Docusaurus upgrade can move its binary anywhere within the package;
  `npm-which` follows whatever ends up in `node_modules/.bin`.
- Drop the `NODE_PATH` override that surrounded the Docusaurus
  invocation. With the binary located directly via `npm-which`, there
  was no remaining reason to inject `NODE_PATH` — Node's normal module
  resolution from the binary's own location works.
- Drop the React-alias block from `docusaurus.config.ts`. It only
  existed to paper over the `NODE_PATH` override, looking up
  `react`/`react-dom`/`@mdx-js/react` at the injected path. Without
  the override there's nothing for it to do; the package's own
  `node_modules` carries the React versions Docusaurus needs.
- Replace the hand-rolled `copyDir` helper with `fs.cp(...,
  { recursive: true, filter })`. The lint rule complains because the
  API only got the "stable" marker in Node 22.3, but it's been
  functional throughout the package's supported range
  (`^18.18 || >=20`); a targeted disable with the rationale stays.

End-to-end build still produces 1058 messenger items across 88
namespaces.
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

Replace the workflow's `DOCS_URL` and `DOCS_BASE_URL` environment
variables with `--site-url` and `--site-base-url` flags on the docs
CLI. The CLI now owns the flag-to-env-var translation at the
subprocess boundary, so callers (workflow files, package scripts)
don't need to know how the values are plumbed through to Docusaurus.
The dedup-scoring helper strips a trailing `Controller` or `Service`
from a namespace to derive the home-package prefix it then searches
for in the source file path. The previous regex `/Controller|Service/u`
matched the first occurrence anywhere, so a namespace like
`ServiceWorkerController` lost its leading `Service` instead of the
trailing `Controller`, producing the wrong prefix and picking the
wrong duplicate. Anchor the alternation with `$` so only a suffix is
stripped.
The build-docs job produces an artifact that gets deployed to GitHub
Pages on pushes to main, so the checkout-and-setup action's
`is-high-risk-environment` flag should be `true` per its README
(production environments and deployable artifacts qualify). This
matches the precedent set by the utils repo's API docs workflow.
Closes the remaining coverage gaps in `generate.ts` and `extraction.ts`
and raises the jest thresholds to 100% across the board:

- Four new tests cover paths that were live behavior but exercised
  by no fixture: in-namespace action/event sort, the reverse
  direction of `replaceDuplicateInGroup` (event replaced by action),
  symlinked `@metamask/*` packages in `node_modules`, bare
  TypeReference re-export skip, and optional handler parameters
  marked with `?`.
- The remaining defensive AST guards (malformed indexed-access
  shapes, missing symbols, etc.) get `// istanbul ignore next`
  annotations explaining why they don't fire on valid messenger
  fixtures.
Copy link
Copy Markdown

@cursor cursor Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 1b05df4. Configure here.

Comment thread package.json Outdated
- Drop the now-stale `webpackbar@^6.0.1` → `^7.0.0` resolution at
  package.json:107. It was added in 985c43c as a temporary workaround
  for the Docusaurus 3.10.0 / webpack 5.106.0 incompatibility tracked
  in facebook/docusaurus#11923, with explicit guidance to revert once
  Docusaurus 3.10.1 shipped. We're on 3.10.1 now and `@docusaurus/bundler`
  requests `webpackbar` `^7.0.0` directly, so the selector matches
  nothing.
- Declare `@docusaurus/theme-common` and `@docusaurus/plugin-content-docs`
  as direct deps of `@metamask/platform-api-docs` to satisfy yarn's
  peer-dep checks for `@easyops-cn/docusaurus-search-local` (which
  peer-depends on theme-common) and theme-common (which peer-depends
  on plugin-content-docs). Both packages were already pulled in
  transitively via `preset-classic`; the explicit declarations document
  what the site actually relies on.
@cryptodev-2s
Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@github-actions
Copy link
Copy Markdown
Contributor

Preview builds have been published. Learn how to use preview builds in other projects.

Expand for full list of packages and versions.
@metamask-previews/account-tree-controller@7.4.0-preview-1275d0fda
@metamask-previews/accounts-controller@38.1.1-preview-1275d0fda
@metamask-previews/address-book-controller@7.1.2-preview-1275d0fda
@metamask-previews/ai-controllers@0.6.3-preview-1275d0fda
@metamask-previews/analytics-controller@1.0.1-preview-1275d0fda
@metamask-previews/analytics-data-regulation-controller@0.0.0-preview-1275d0fda
@metamask-previews/announcement-controller@8.1.0-preview-1275d0fda
@metamask-previews/app-metadata-controller@2.0.1-preview-1275d0fda
@metamask-previews/approval-controller@9.0.1-preview-1275d0fda
@metamask-previews/assets-controller@7.1.2-preview-1275d0fda
@metamask-previews/assets-controllers@108.1.0-preview-1275d0fda
@metamask-previews/authenticated-user-storage@2.0.0-preview-1275d0fda
@metamask-previews/base-controller@9.1.0-preview-1275d0fda
@metamask-previews/base-data-service@0.1.3-preview-1275d0fda
@metamask-previews/bridge-controller@73.0.0-preview-1275d0fda
@metamask-previews/bridge-status-controller@71.2.0-preview-1275d0fda
@metamask-previews/build-utils@3.0.4-preview-1275d0fda
@metamask-previews/chain-agnostic-permission@1.6.1-preview-1275d0fda
@metamask-previews/chomp-api-service@3.1.0-preview-1275d0fda
@metamask-previews/claims-controller@0.5.1-preview-1275d0fda
@metamask-previews/client-controller@1.0.1-preview-1275d0fda
@metamask-previews/compliance-controller@2.0.1-preview-1275d0fda
@metamask-previews/composable-controller@12.0.1-preview-1275d0fda
@metamask-previews/config-registry-controller@0.3.1-preview-1275d0fda
@metamask-previews/connectivity-controller@0.2.0-preview-1275d0fda
@metamask-previews/controller-utils@12.1.0-preview-1275d0fda
@metamask-previews/core-backend@6.3.0-preview-1275d0fda
@metamask-previews/delegation-controller@3.0.0-preview-1275d0fda
@metamask-previews/earn-controller@12.2.0-preview-1275d0fda
@metamask-previews/eip-5792-middleware@3.0.4-preview-1275d0fda
@metamask-previews/eip-7702-internal-rpc-middleware@0.1.1-preview-1275d0fda
@metamask-previews/eip1193-permission-middleware@2.0.1-preview-1275d0fda
@metamask-previews/ens-controller@19.1.3-preview-1275d0fda
@metamask-previews/eth-block-tracker@15.0.1-preview-1275d0fda
@metamask-previews/eth-json-rpc-middleware@23.1.3-preview-1275d0fda
@metamask-previews/eth-json-rpc-provider@6.0.1-preview-1275d0fda
@metamask-previews/foundryup@1.0.1-preview-1275d0fda
@metamask-previews/gas-fee-controller@26.2.2-preview-1275d0fda
@metamask-previews/gator-permissions-controller@4.2.0-preview-1275d0fda
@metamask-previews/geolocation-controller@0.1.3-preview-1275d0fda
@metamask-previews/json-rpc-engine@10.5.0-preview-1275d0fda
@metamask-previews/json-rpc-middleware-stream@8.0.8-preview-1275d0fda
@metamask-previews/keyring-controller@25.5.0-preview-1275d0fda
@metamask-previews/logging-controller@8.0.2-preview-1275d0fda
@metamask-previews/message-manager@14.1.2-preview-1275d0fda
@metamask-previews/messenger@1.2.0-preview-1275d0fda
@metamask-previews/messenger-cli@0.2.0-preview-1275d0fda
@metamask-previews/money-account-balance-service@1.0.2-preview-1275d0fda
@metamask-previews/money-account-controller@0.3.0-preview-1275d0fda
@metamask-previews/money-account-upgrade-controller@2.0.2-preview-1275d0fda
@metamask-previews/multichain-account-service@10.0.0-preview-1275d0fda
@metamask-previews/multichain-api-middleware@3.1.2-preview-1275d0fda
@metamask-previews/multichain-network-controller@3.1.2-preview-1275d0fda
@metamask-previews/multichain-transactions-controller@7.1.0-preview-1275d0fda
@metamask-previews/name-controller@9.1.2-preview-1275d0fda
@metamask-previews/network-controller@32.0.0-preview-1275d0fda
@metamask-previews/network-enablement-controller@5.2.0-preview-1275d0fda
@metamask-previews/notification-services-controller@24.1.0-preview-1275d0fda
@metamask-previews/passkey-controller@2.0.1-preview-1275d0fda
@metamask-previews/permission-controller@13.1.1-preview-1275d0fda
@metamask-previews/permission-log-controller@5.1.0-preview-1275d0fda
@metamask-previews/perps-controller@6.2.0-preview-1275d0fda
@metamask-previews/phishing-controller@17.2.0-preview-1275d0fda
@metamask-previews/platform-api-docs@0.0.0-preview-1275d0fda
@metamask-previews/polling-controller@16.0.6-preview-1275d0fda
@metamask-previews/preferences-controller@23.1.0-preview-1275d0fda
@metamask-previews/profile-metrics-controller@3.1.4-preview-1275d0fda
@metamask-previews/profile-sync-controller@28.1.0-preview-1275d0fda
@metamask-previews/ramps-controller@13.3.1-preview-1275d0fda
@metamask-previews/rate-limit-controller@7.0.1-preview-1275d0fda
@metamask-previews/react-data-query@0.2.1-preview-1275d0fda
@metamask-previews/remote-feature-flag-controller@4.2.1-preview-1275d0fda
@metamask-previews/sample-controllers@5.0.1-preview-1275d0fda
@metamask-previews/seedless-onboarding-controller@9.1.0-preview-1275d0fda
@metamask-previews/selected-network-controller@26.1.3-preview-1275d0fda
@metamask-previews/shield-controller@5.1.2-preview-1275d0fda
@metamask-previews/signature-controller@39.2.2-preview-1275d0fda
@metamask-previews/snap-account-service@0.2.0-preview-1275d0fda
@metamask-previews/social-controllers@2.2.1-preview-1275d0fda
@metamask-previews/storage-service@1.0.1-preview-1275d0fda
@metamask-previews/subscription-controller@6.1.3-preview-1275d0fda
@metamask-previews/transaction-controller@66.0.0-preview-1275d0fda
@metamask-previews/transaction-pay-controller@22.6.1-preview-1275d0fda
@metamask-previews/user-operation-controller@41.2.2-preview-1275d0fda
@metamask-previews/wallet@0.0.0-preview-1275d0fda

Make `site/tsconfig.json` extend the monorepo's shared
`tsconfig.base.json`, keeping only the overrides Docusaurus
actually needs (composite off, noEmit, JSX, ESNext modules, Bundler
resolution). Drop the redundant `target`, `esModuleInterop`, and
`strict` fields now that they come from base.

Also stop excluding `packages/platform-api-docs/site/**` from
ESLint so `site/docusaurus.config.ts` is type-checked as part of
the normal lint flow rather than being an island only exercised
by `yarn docs:platform-api:build`. typescript-eslint's
`projectService: true` picks up the site's tsconfig automatically.

Move `@docusaurus/types` from devDependencies to dependencies —
`site/docusaurus.config.ts` imports `Config` from it, and `site/`
is published as part of this package, so a consumer of the
published CLI needs the types resolvable when Docusaurus loads
the config at runtime.
Including `packages/platform-api-docs/site/**` in ESLint made
typescript-eslint's `projectService` discover the site's tsconfig
and try to type-check `docusaurus.config.ts`. Loading the full
Docusaurus + React + webpack type graph blows past `lint:eslint`'s
`--max-old-space-size=6144` cap and crashes CI with a heap-OOM.

The `extends`-from-base wiring on `site/tsconfig.json` and the
`@docusaurus/types` dependency move from eec9874 are kept — only
the ESLint inclusion is reverted.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants