feat(keyring-snap-bridge): populate v2 SnapKeyring capabilities from the manifest

[hmalik88]

• Populate the v2 SnapKeyring.capabilities from the Snap manifest (endowment:keyring) on deserialize, via SnapController:getSnap, fulfilling the v2 Keyring contract's required capabilities field. Falls back to the empty default when the Snap declares none.
• Guard v2 SnapKeyring operations (getAccounts/getAccount/createAccounts/deleteAccount/submitRequest) until deserialize has run; they now throw "SnapKeyring has not been initialized" instead of operating on an unbound keyring.
• Bump @metamask/snaps-utils to ^12.2.1 (keyring-snap-bridge + keyring-internal-snap-client) for the capabilities field on the endowment:keyring manifest type.

---

Note

Medium Risk
Changes snap keyring lifecycle and when account operations are allowed; capabilities are taken from the manifest without local shape validation, so struct drift could cause runtime issues.

Overview
v2 SnapKeyring now sets capabilities during deserialize by reading the Snap manifest’s endowment:keyring entry via SnapController:getSnap, with EMPTY_CAPABILITIES as the typed default when the snap is missing or declares none (including clearing stale values on re-hydrate).

getAccounts, getAccount, createAccounts, deleteAccount, and submitRequest are blocked until deserialize finishes, throwing SnapKeyring has not been initialized instead of running on an unbound keyring.

@metamask/snaps-utils is bumped to ^12.2.1 in keyring-snap-bridge and keyring-internal-snap-client for manifest typing around capabilities.

^{Reviewed by Cursor Bugbot for commit 39a8b94. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask/​snaps-utils@​12.1.3 ⏵ 12.2.1	+1		+1	-3
	@​metamask/​messenger@​1.1.1 ⏵ 1.2.0	+1		+1	-2
	@​metamask/​snaps-sdk@​11.0.0 ⏵ 11.1.1	+2		+1	-1

View full report

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9ac9ce9. Configure here.}