Skip to content

feat: add chomp API service#8413

Open
Jwhiles wants to merge 15 commits intomainfrom
add-chomp-api
Open

feat: add chomp API service#8413
Jwhiles wants to merge 15 commits intomainfrom
add-chomp-api

Conversation

@Jwhiles
Copy link
Copy Markdown

@Jwhiles Jwhiles commented Apr 9, 2026

  • feat: add chomp-api-service
  • feat: add stubs for all API methods

Explanation

References

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've communicated my changes to consumers by updating changelogs for packages I've changed
  • I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Note

Medium Risk
Adds new network-facing service code that fetches with bearer-token authentication and caches results, so incorrect error handling or schema validation could impact clients integrating the new package.

Overview
Introduces a new package, @metamask/chomp-api-service, implementing ChompApiService on top of BaseDataService to make authenticated (JWT bearer) requests to the CHOMP API with response validation and cached-query semantics.

The service exposes messenger actions for key endpoints (associate address, account upgrade create/get, delegation verification, intent create/list, withdrawal create, and service details), defines the request/response types and generated action-type unions, and adds comprehensive nock-based tests for success/error/malformed-response cases.

Repo wiring is updated to include the new package in TypeScript project references, yarn workspace lockfile, docs/graph (README.md), and ownership/team mappings (CODEOWNERS, teams.json).

Reviewed by Cursor Bugbot for commit a820fad. Bugbot is set up for automated code reviews on this repo. Configure here.

@Jwhiles Jwhiles force-pushed the add-chomp-api branch 4 times, most recently from 8b1785b to be04334 Compare April 10, 2026 16:01
Copy link
Copy Markdown
Contributor

@mcmire mcmire left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks pretty good so far! I just had a few comments.

Comment on lines +258 to +273
return this.#mutationPolicy.execute(async () => {
const response = await fetch(new URL(path, this.#baseUrl), {
method: 'POST',
headers,
body: JSON.stringify(body),
});

if (!response.ok && !acceptedStatuses.includes(response.status)) {
throw new HttpError(
response.status,
`POST ${path} failed with status '${response.status}'`,
);
}

return response;
});
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After I gave you the suggest to use the service policy manually like this, I came across another PR that someone else posted here: https://github.com/MetaMask/core/pull/8260/changes#diff-df87c072da30a25c3d5d0291f962f6b7c52da863a4d1e79a11752d89bc471c4cR204.

Basically it seems that we can use fetchQuery, but pass staleTime: 0 to effectively turn off caching. Can you try that and see how that works? So this would look something like:

Suggested change
return this.#mutationPolicy.execute(async () => {
const response = await fetch(new URL(path, this.#baseUrl), {
method: 'POST',
headers,
body: JSON.stringify(body),
});
if (!response.ok && !acceptedStatuses.includes(response.status)) {
throw new HttpError(
response.status,
`POST ${path} failed with status '${response.status}'`,
);
}
return response;
});
return this.fetchQuery({
queryKey: [
// ... you might want to pass this in ...
],
queryFn: async () => {
const response = await fetch(new URL(path, this.#baseUrl), {
method: 'POST',
headers,
body: JSON.stringify(body),
});
if (!response.ok && !acceptedStatuses.includes(response.status)) {
throw new HttpError(
response.status,
`POST ${path} failed with status '${response.status}'`,
);
}
return response;
}),
staleTime: 0,
});

});

this.#baseUrl = baseUrl;
this.#getAccessToken = getAccessToken;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where will this access token come from in the clients? Will this come from another controller or service? If so, then it would be better to use the messenger to retrieve this value instead of taking a callback.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is was included in the spec written by @MoMannn - but I'm open to using the messenger. Tadej, is there a reason that you called for this design in particular?

Comment thread packages/chomp-api-service/README.md Outdated
@@ -0,0 +1,15 @@
# `@metamask/chom-api-service`
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo?

Suggested change
# `@metamask/chom-api-service`
# `@metamask/chomp-api-service`

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In addition to modifying these files you should also add chomp-api-service to the root tsconfig.json and tsconfig.build.json files to ensure that TypeScript knows about it (and its relationship to other packages) in development.

Comment thread packages/chomp-api-service/CHANGELOG.md Outdated
Comment thread packages/chomp-api-service/src/chomp-api-service.ts Outdated
Comment thread packages/chomp-api-service/src/types.ts Outdated
@Jwhiles
Copy link
Copy Markdown
Author

Jwhiles commented Apr 14, 2026

@metamaskbot publish-preview

@Jwhiles
Copy link
Copy Markdown
Author

Jwhiles commented Apr 14, 2026

@metamaskbot publish-preview

@socket-security
Copy link
Copy Markdown

socket-security bot commented Apr 14, 2026

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

@Jwhiles
Copy link
Copy Markdown
Author

Jwhiles commented Apr 14, 2026

@metamaskbot publish-preview

@Jwhiles Jwhiles force-pushed the add-chomp-api branch 2 times, most recently from 0e8c506 to 08b3d87 Compare April 14, 2026 12:16
@Jwhiles
Copy link
Copy Markdown
Author

Jwhiles commented Apr 14, 2026

@metamaskbot publish-preview

@github-actions
Copy link
Copy Markdown
Contributor

Preview builds have been published. Learn how to use preview builds in other projects.

Expand for full list of packages and versions.
@metamask-previews/account-tree-controller@7.0.0-preview-08b3d87
@metamask-previews/accounts-controller@37.2.0-preview-08b3d87
@metamask-previews/address-book-controller@7.1.1-preview-08b3d87
@metamask-previews/ai-controllers@0.6.3-preview-08b3d87
@metamask-previews/analytics-controller@1.0.1-preview-08b3d87
@metamask-previews/analytics-data-regulation-controller@0.0.0-preview-08b3d87
@metamask-previews/announcement-controller@8.1.0-preview-08b3d87
@metamask-previews/app-metadata-controller@2.0.1-preview-08b3d87
@metamask-previews/approval-controller@9.0.1-preview-08b3d87
@metamask-previews/assets-controller@5.0.0-preview-08b3d87
@metamask-previews/assets-controllers@103.1.1-preview-08b3d87
@metamask-previews/base-controller@9.0.1-preview-08b3d87
@metamask-previews/base-data-service@0.1.1-preview-08b3d87
@metamask-previews/bridge-controller@70.0.1-preview-08b3d87
@metamask-previews/bridge-status-controller@70.0.5-preview-08b3d87
@metamask-previews/build-utils@3.0.4-preview-08b3d87
@metamask-previews/chain-agnostic-permission@1.5.0-preview-08b3d87
@metamask-previews/chomp-api-service@0.0.0-preview-08b3d87
@metamask-previews/claims-controller@0.5.0-preview-08b3d87
@metamask-previews/client-controller@1.0.1-preview-08b3d87
@metamask-previews/compliance-controller@2.0.0-preview-08b3d87
@metamask-previews/composable-controller@12.0.1-preview-08b3d87
@metamask-previews/config-registry-controller@0.2.0-preview-08b3d87
@metamask-previews/connectivity-controller@0.2.0-preview-08b3d87
@metamask-previews/controller-utils@11.20.0-preview-08b3d87
@metamask-previews/core-backend@6.2.1-preview-08b3d87
@metamask-previews/delegation-controller@3.0.0-preview-08b3d87
@metamask-previews/earn-controller@12.0.0-preview-08b3d87
@metamask-previews/eip-5792-middleware@3.0.3-preview-08b3d87
@metamask-previews/eip-7702-internal-rpc-middleware@0.1.0-preview-08b3d87
@metamask-previews/eip1193-permission-middleware@1.0.3-preview-08b3d87
@metamask-previews/ens-controller@19.1.1-preview-08b3d87
@metamask-previews/eth-block-tracker@15.0.1-preview-08b3d87
@metamask-previews/eth-json-rpc-middleware@23.1.1-preview-08b3d87
@metamask-previews/eth-json-rpc-provider@6.0.1-preview-08b3d87
@metamask-previews/foundryup@1.0.1-preview-08b3d87
@metamask-previews/gas-fee-controller@26.1.1-preview-08b3d87
@metamask-previews/gator-permissions-controller@3.0.1-preview-08b3d87
@metamask-previews/geolocation-controller@0.1.2-preview-08b3d87
@metamask-previews/json-rpc-engine@10.2.4-preview-08b3d87
@metamask-previews/json-rpc-middleware-stream@8.0.8-preview-08b3d87
@metamask-previews/keyring-controller@25.2.0-preview-08b3d87
@metamask-previews/logging-controller@8.0.1-preview-08b3d87
@metamask-previews/message-manager@14.1.1-preview-08b3d87
@metamask-previews/messenger@1.1.1-preview-08b3d87
@metamask-previews/messenger-cli@0.1.0-preview-08b3d87
@metamask-previews/money-account-controller@0.1.0-preview-08b3d87
@metamask-previews/multichain-account-service@8.0.1-preview-08b3d87
@metamask-previews/multichain-api-middleware@2.0.0-preview-08b3d87
@metamask-previews/multichain-network-controller@3.0.6-preview-08b3d87
@metamask-previews/multichain-transactions-controller@7.0.4-preview-08b3d87
@metamask-previews/name-controller@9.1.1-preview-08b3d87
@metamask-previews/network-controller@30.0.1-preview-08b3d87
@metamask-previews/network-enablement-controller@5.0.2-preview-08b3d87
@metamask-previews/notification-services-controller@23.0.1-preview-08b3d87
@metamask-previews/permission-controller@12.3.0-preview-08b3d87
@metamask-previews/permission-log-controller@5.1.0-preview-08b3d87
@metamask-previews/perps-controller@3.0.0-preview-08b3d87
@metamask-previews/phishing-controller@17.1.1-preview-08b3d87
@metamask-previews/polling-controller@16.0.4-preview-08b3d87
@metamask-previews/preferences-controller@23.1.0-preview-08b3d87
@metamask-previews/profile-metrics-controller@3.1.3-preview-08b3d87
@metamask-previews/profile-sync-controller@28.0.2-preview-08b3d87
@metamask-previews/ramps-controller@13.1.0-preview-08b3d87
@metamask-previews/rate-limit-controller@7.0.1-preview-08b3d87
@metamask-previews/react-data-query@0.2.0-preview-08b3d87
@metamask-previews/remote-feature-flag-controller@4.2.0-preview-08b3d87
@metamask-previews/sample-controllers@4.0.4-preview-08b3d87
@metamask-previews/seedless-onboarding-controller@9.1.0-preview-08b3d87
@metamask-previews/selected-network-controller@26.1.0-preview-08b3d87
@metamask-previews/shield-controller@5.1.1-preview-08b3d87
@metamask-previews/signature-controller@39.1.2-preview-08b3d87
@metamask-previews/social-controllers@0.1.0-preview-08b3d87
@metamask-previews/storage-service@1.0.1-preview-08b3d87
@metamask-previews/subscription-controller@6.1.2-preview-08b3d87
@metamask-previews/transaction-controller@64.2.0-preview-08b3d87
@metamask-previews/transaction-pay-controller@19.1.1-preview-08b3d87
@metamask-previews/user-operation-controller@41.2.0-preview-08b3d87

@Jwhiles Jwhiles force-pushed the add-chomp-api branch 5 times, most recently from 039faf6 to 2f413ac Compare April 16, 2026 14:35
@Jwhiles Jwhiles marked this pull request as ready for review April 16, 2026 14:43
@Jwhiles Jwhiles requested a review from a team as a code owner April 16, 2026 14:43
@Jwhiles Jwhiles requested review from MoMannn and mcmire April 16, 2026 14:45
Copy link
Copy Markdown

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit a820fad. Configure here.


const HexStringStruct = define<string>('Hex string', (value) =>
isStrictHexString(value),
);
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Redundant HexStringStruct duplicates existing StrictHexStruct

Low Severity

The locally defined HexStringStruct using define and isStrictHexString duplicates StrictHexStruct already exported from @metamask/utils, which this package already depends on. Multiple other packages in the monorepo (eip-5792-middleware, eip-7702-internal-rpc-middleware, eth-json-rpc-middleware) import and use StrictHexStruct directly. Replacing the custom definition with the existing export avoids maintaining a redundant copy.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit a820fad. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants