feat: update to keyring v2

[hmalik88]

Summary

Migrates the Solana snap to the v2 Keyring API and declares the corresponding capabilities in the manifest. Also fixes a latent test-isolation bug surfaced while validating the migration.

• Implements getAccounts and exportAccount (base58/hex) on SolanaKeyring; getAccount now throws on missing IDs instead of returning undefined
• Wraps all public keyring method errors in a single SnapError
• Switches handleKeyringRequest to the v2 dispatcher (@metamask/keyring-snap-sdk/v2)
• Adds endowment:keyring.capabilities to snap.manifest.json
• Bumps @metamask/snaps-sdk → 11.1.1, snaps-cli → 8.4.1, snaps-jest → 10.1.3, keyring-snap-sdk → 9.0.1, and updates the root resolutions to match; snaps-utils resolves to 12.2.0 which is required to validate the new manifest field
• Sets moduleResolution: "bundler" in packages/snap/tsconfig.json so v2 subpath types resolve correctly
• Fixes a flaky jest --runInBand failure: replaces an incomplete jest.mock('@noble/ed25519', ...) in index.test.ts with jest.mock('./polyfills', ...). The previous mock was captured by the ed25519 polyfill's closure when it patched globalThis.crypto.subtle, leaking into other test files via shared global state under --runInBand

---

Note

High Risk
Adds private-key export and changes keyring error/lookup contracts (breaking getAccount), which are security- and integration-sensitive despite being gated by manifest capabilities and permissions.

Overview
Migrates the Solana wallet snap to Keyring API v2: SolanaKeyring now implements KeyringRpc, keyring traffic goes through handleKeyringRequest from @metamask/keyring-snap-sdk/v2, and origin permissions use v2 RPC method names (including ExportAccount for MetaMask).

New / changed keyring behavior: Adds getAccounts (delegates to listAccounts) and exportAccount (64-byte Solana secret key as base58 or hex, derived on demand). getAccount is breaking—it always returns an account or throws instead of undefined. Public keyring paths consistently surface failures as a single SnapError.

Manifest & platform: Declares endowment:keyring.capabilities (Solana scopes, private-key export formats, BIP-44 derive/discover) and bumps platformVersion / dependency stack (@metamask/snaps-sdk 11.1.1, keyring-api 23, keyring-snap-sdk 9, updated lockfile). Snap tsconfig uses moduleResolution: "bundler" for v2 subpath types.

Tests: Extends Keyring tests for v2 behavior and export; fixes index.test.ts isolation under --runInBand by mocking ./polyfills instead of partially mocking @noble/ed25519 (avoids leaking crypto.subtle patches).

^{Reviewed by Cursor Bugbot for commit de19867. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask/​keyring-api@​23.1.0
	@​metamask/​keyring-snap-sdk@​8.0.0 ⏵ 9.0.2	+1		+1
	@​metamask/​snaps-cli@​8.3.0 ⏵ 8.4.1	+1		+1
	@​metamask/​snaps-jest@​9.8.0 ⏵ 10.1.3	+1			+2

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• ses@1.15.0

View full report

[hmalik88]

@SocketSecurity ignore npm/ses@1.15.0

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0bcdc72. Configure here.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
94.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ccharly]

LGTM for v2!

One thing though, I wonder if we should really expose exportAccount for hexadecimal, it seems base58 is the way to go for Solana.

We could keep it if we wish to export them in "raw format", but I would strip the 0x prefix then (I'm not sure this is commonly used outside of Ethereum, but I could be wrong about that 😄)