Initialize Wallet Framework documentation#8927
Open
mcmire wants to merge 5 commits into
Open
Conversation
The Wallet Framework is a complex system, and we want to give engineers
comprehensive resources they can use to understand what it is, how it
works, and how to use it effectively when working on features.
To this end, this commit initializes a new package,
`@metamask/wallet-framework-docs`, where we can keep documentation for
the Wallet Framework. This package not only holds the content, but also
a site that can be deployed.
For now, the package is private, and the docs contain some initial dummy
content.
You can run the site locally by saying:
yarn workspace @metamask/wallet-framework-docs run start-dev
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. Ignoring alerts on:
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| "rootDir": "./src" | ||
| }, | ||
| "references": [], | ||
| "include": ["../../types", "./src"] |
There was a problem hiding this comment.
Missing src/index.ts breaks monorepo build
High Severity
The package's tsconfig.build.json sets rootDir to ./src and includes ./src, but no src/ directory or src/index.ts file exists in this package. The typedoc.json also references ./src/index.ts. Since the root tsconfig.build.json includes this package as a project reference, running yarn build at the monorepo level will fail because TypeScript cannot find any input files for this project.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 9aaf8c8. Configure here.
Contributor
Author
There was a problem hiding this comment.
Yeah, none of these properties related to exports are valid. I have left them in to appease the Yarn constraints for now. I could remove them though if it's confusing.
Contributor
Author
|
@SocketSecurity ignore npm/lunr-languages@1.20.0 - False positive. The file in question does not seem to be obfuscated: https://npmfs.com/package/lunr-languages/1.20.0/lunr.ko.js @SocketSecurity ignore npm/svgo@3.3.3 - This file is minified, it's not obfuscated. This is a common practice in some libraries. @SocketSecurity ignore npm/@algolia/client-personalization@5.52.1 - Network access is OK. This package talks to the Algolia API. @SocketSecurity ignore npm/@algolia/requester-fetch@5.52.1 - Network access makes sense for this package. @SocketSecurity ignore npm/@algolia/requester-node-http@5.52.1 - Network access makes sense for this package. @SocketSecurity ignore npm/@docsearch/react@4.6.3 - Network access is OK. This package talks to Algolia. |
Contributor
Author
|
@SocketSecurity ignore npm/@emnapi/core@1.10.0 - Network access is misleading. This is a WASM package. @SocketSecurity ignore npm/@node-rs/jieba@1.10.4 - Shell access is OK. This is a compiled package. It looks like it runs @SocketSecurity ignore npm/@pnpm/npm-conf@3.0.2 - False positive, this does not actually call |
Contributor
Author
|
@SocketSecurity ignore npm/@tybys/wasm-util@0.10.2 - Network access is misleading - this is a WASM package. @SocketSecurity ignore npm/address@1.2.2 - Shell access is OK. This library is network-related and uses |
Contributor
Author
|
@SocketSecurity ignore npm/svgo@3.3.3 - This file is minified, it's not obfuscated. This is a common practice in some libraries. |
Contributor
Author
|
@SocketSecurity ignore npm/clean-css@5.3.3 - This is a false positive, this does not access the network. |
Contributor
Author
|
@SocketSecurity ignore npm/config-chain@1.1.13 - Network access is legit. I don't know why, but this package says it's used directly by |
Contributor
Author
|
@SocketSecurity ignore npm/eta@2.2.0 - False positive, this does not access the network. |
Contributor
Author
|
@SocketSecurity ignore npm/htmlparser2@6.1.0 None of these are legit. |
Contributor
Author
|
@SocketSecurity ignore-all I've gone through the remaining alerts (a lot of which are "AI anomalies"). Nothing stands out to me as problematic. There are some changes to authorship but I double-checked them and they all seem OK. |
mcmire
commented
May 29, 2026
| border-left: 4px solid transparent; | ||
| } | ||
|
|
||
| .code-block-diff-added-line { |
Contributor
Author
There was a problem hiding this comment.
This will be useful in a future commit, when I start adding a tutorial for data services.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
There are 2 total unresolved issues (including 1 from previous review).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit bf20447. Configure here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
We want to give engineers comprehensive resources they can use to understand the Wallet Framework — what it is, how it works, and how to use it effectively when working on features.
At the moment, we have a sparse collection of docs which include best practices for controllers and a tutorial for data services. We could certainly expand them: we could add more explanations about architecture of the framework and its concepts, and we could add more guides that cover specific use cases.
But they are stored as plain Markdown files in this repo, and it's not clear that they receive a lot of visibility (as it's easy to confuse them for maintainer-specific docs). We want the Wallet Framework to function more as an opensource project, and one of the ways that opensource projects can serve their users well is by having attractive documentation sites (think React, Redux, etc.). If we create such a site, then not only can we use it to "market" the Wallet Framework across MetaMask, but we can also better track adoption and even ask engineers for direct feedback through the site itself.
To this end, this commit initializes a new package,
@metamask/wallet-framework-docs, which we can use to write a new set of docs and deploy them to a site, which will be deployed underhttps://metamask.github.io/core/wallet-framework-docs.For now, the package is private, and the docs contain some initial dummy content, but you can run the site locally by saying:
References
https://consensyssoftware.atlassian.net/browse/WPC-1003
Screenshots
Checklist
Note
Low Risk
Documentation-only scaffolding with no runtime wallet or auth changes; risk is limited to build/lint config and new dev dependencies.
Overview
Adds a new private monorepo package
@metamask/wallet-framework-docsso Wallet Framework documentation can live in a Docusaurus site (localstart-dev/build-prod) aimed athttps://metamask.github.io/core/wallet-framework-docs, with placeholder home content and stubs for future topics.Repo wiring assigns Core Platform ownership, registers the package in root TypeScript project references, ignores
**/.docusaurus, and extends ESLint fordocusaurus.config.ts(including allowingprocess.envfor deploy commit metadata). The site config enables strict broken-link checks, local search, and custom Prism styling for diff highlights.Reviewed by Cursor Bugbot for commit bf20447. Bugbot is set up for automated code reviews on this repo. Configure here.