refactor: base controller migration

[FrederikBolding]

Closes #3315.

---

Note

Replaces RestrictedMessenger with @metamask/messenger across packages, renames metadata flag, and updates deps/tests and controller wiring with breaking API changes.

• Core refactor (breaking):
  • Replace RestrictedMessenger with @metamask/messenger Messenger across snaps-controllers, snaps-rpc-methods, snaps-simulation, and snaps-utils.
  • Rename metadata anonymous to includeInDebugSnapshot in controllers; update persistence and debug snapshot handling.
  • Switch all messagingSystem.* calls to messenger.* (subscribe, unsubscribe, registerActionHandler, call, publish).
  • Update controller constructor types and exported messengers (e.g., CronjobControllerMessenger, SnapInsightsControllerMessenger, SnapInterfaceControllerMessenger, MultichainRouterMessenger, ExecutionServiceMessenger, WebSocketServiceMessenger).
  • snaps-rpc-methods: handleSnapInstall now takes messenger (was messagingSystem).
  • Export WithSnapKeyringFunction from MultichainRouter.
• Dependency updates:
  • Bump @metamask/approval-controller → ^8.0.0, @metamask/base-controller → ^9.0.0, @metamask/permission-controller → ^12.0.0; add @metamask/messenger where needed; remove @metamask/base-controller in some packages.
• Tests and mocks:
  • Update test utilities to use Messenger delegation; adapt expectations from rootMessenger.call to controllerMessenger.call.
  • Adjust mocks/enums (e.g., PhishingDetectorResultType), add JSON-RPC id/jsonrpc fields, and origin constants.
• Misc:
  • Minor API and typing tweaks (e.g., persistence via deriveStateFromMetadata, WebSocket mock fixes).

^{Written by Cursor Bugbot for commit b53fe57. This will update automatically on new commits. Configure here.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.28%. Comparing base (98d7c04) to head (b53fe57).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3611      +/-   ##
==========================================
- Coverage   98.29%   98.28%   -0.02%     
==========================================
  Files         417      418       +1     
  Lines       11925    12152     +227     
  Branches     1851     1876      +25     
==========================================
+ Hits        11722    11943     +221     
- Misses        203      209       +6     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mikesposito]

@metamaskbot publish-previews

[Gudahtt]

@metamaskbot publish-previews

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask/​approval-controller@​7.2.0 ⏵ 8.0.0				+6
	@​metamask/​permission-controller@​11.0.6 ⏵ 12.0.0			+1	+10

View full report

[Gudahtt]

This is odd. What is this type used for?

[FrederikBolding]

It is meant as a type for https://github.com/MetaMask/snaps/blob/fb/base-controller-migration/packages/snaps-simulation/src/simulation.ts#L362 which we pass around to be used in the snaps-jest framework.

[FrederikBolding]

May have been written before we had MockAnyNamespace

[Gudahtt]

Ah OK. I was asking because we introduced another use of any here, which our guidelines generally forbid the use of.

We should be able to get rid of all of the any instances we've introduced here, but we can figure that out later. It would also be nice to get rid of this export if we don't need it anymore.