fix(deps)!: strip the proprietary MetaMask SDK from the install tree

[pasevin]

The finding

@metamask/sdk is not open source. It ships a proprietary licence:

Copyright ConsenSys Software Inc. 2022. All rights reserved.

It grants only a non-exclusive, non-transferable, non-sublicensable licence for Non-Commercial Use, and clause 2 requires any Resulting Program to be subjected "to the same Notice requirement and Non-Commercial Use restriction set forth herein".

The same 2715-byte, byte-identical licence file (sha256 c93277efbafa3f89…) ships in @metamask/sdk, @metamask/sdk-communication-layer and @metamask/sdk-install-modal-web.

Why it must go

The OpenZeppelin adapters are AGPL-3.0. AGPL forbids conveying the work under added restrictions, while the SDK licence demands our derivative propagate its non-commercial restriction. Those two obligations cannot both be satisfied.

This is structural, not a threshold question. It does not depend on our monthly-active-user count. There is also no clean version to pin: no published version of @metamask/sdk declares a license field at all, and the proprietary file dates from 2022.

Scope — three names exactly, not the scope

Of the 20 installed @metamask/* packages, 16 are MIT or ISC and legitimately needed (utils, providers, json-rpc-engine, json-rpc-middleware-stream, object-multiplex, onboarding, rpc-errors, safe-event-emitter, superstruct, sdk-analytics, …). A scope-wide ban would break far more than it fixes.

The guard matches at a lockfile name boundary (name@version or a quoted dependency reference), so @metamask/sdk never catches @metamask/sdk-analytics (MIT). I unit-tested that boundary across 11 cases — 5 that must trip, 6 that must not — all correct.

Why removing the connector isn't enough

@metamask/sdk is a hard dependency of @wagmi/connectors, not an optional peer (unlike @walletconnect/ethereum-provider). It installs whether or not metaMask() is ever registered. So both halves are needed: the install-time strip and the bundler stub alias.

The stub alias is load-bearing, and I verified it in both directions. @wagmi/connectors re-exports an unreachable metaMask module containing await import('@metamask/sdk'), and Rollup resolves dynamic imports at build time:

[vite]: Rollup failed to resolve import "@metamask/sdk" from
  .../@wagmi/connectors/dist/esm/metaMask.js

With the alias, the build succeeds and a 0.33 kB stub replaces a 540 kB proprietary SDK chunk.

A caution worth recording: my first no-alias test passed, because a leftover .pnpm store directory and a stale Vite cache still resolved the SDK locally. Only after clearing both — CI-representative conditions — did it fail. That is exactly the stale-state trap that produced red CI on this kind of change before.

What we lose, and what we keep

MetaMask desktop keeps working. The extension is reached via injected() (window.ethereum) plus EIP-6963 discovery. multiInjectedProviderDiscovery is never set anywhere in the adapters, so wagmi's default of true applies.

MetaMask mobile deep-link / QR pairing is gone. That flow was provided only by the SDK. This is a user-visible behaviour change and is called out in the commit body, not buried. Mobile users can still connect via the MetaMask in-app browser, which exposes an injected provider.

RainbowKit is unaffected — verified, not assumed. Its wallet list is already pinned to [injectedWallet, safeWallet], there is no metaMaskWallet anywhere in our config, and RainbowKit itself never imports @metamask/sdk (grepped its dist/).

Second, separate finding: @metamask/eth-json-rpc-provider

Versions 1.0.0–2.1.0 published no license field and no LICENSE file; 2.2.0+ declare ISC and ship the text. The tree resolved 1.0.1, i.e. no licence at all.

Note npm view @metamask/eth-json-rpc-provider@1.0.1 license reports ISC — that is npm falling back to the packument-level field. The raw per-version metadata has no license for 1.0.0, 1.0.1, 2.0.0 or 2.1.0. I checked the registry JSON directly.

It arrives via @coinbase/wallet-sdk → eth-block-tracker from @wagmi/connectors — not via the MetaMask SDK, so it is a genuinely separate issue and is a separate commit.

eth-block-tracker@7 declares ^1.0.0, so the override crosses a major. That is safe here because the dependency is type-only: it imports just the SafeEventEmitterProvider type, there is no reference to the package in any of its dist/*.js (only .d.ts and source maps), and 2.2.0+ still export that type. Now resolves to 2.3.2 (ISC).

ui-builder specifics

The exported-app path needed three extra touch points, any one of which would have silently dropped the fix:

• apps/builder/src/export/templates/typescript-react-vite/.pnpmfile.cjs — the exported app's own hook
• .../templates/typescript-react-vite/vite.config.ts + a template src/shims/metamask-removed.ts
• apps/builder/src/export/generators/ViteConfigGenerator.ts — generates the exported vite.config.ts, so editing only the template would be undone on regeneration

New MetaMaskLicenseExclusion.verification.test.ts (2 tests) exports a real app and asserts the generated zip carries the hook, the stub, and the alias — and that the hook bans the name exactly rather than the scope.

Also corrected the WalletConnect stub's message, which told users to "use an injected wallet, MetaMask or Safe" — now misleading given the SDK connector is gone.

Verification

check	result
pnpm -r build	exit 0 (stub 0.33 kB in output)
pnpm typecheck	exit 0
pnpm test	48 files, 329 tests passed
pnpm lint	exit 0
pnpm format:check	exit 0
pnpm check-licenses	passed

Guard adversarially tested: injecting '@metamask/sdk@0.33.1' into the lockfile fails it; injecting '@metamask/sdk-analytics@0.0.6' (MIT) passes; deleting the hook call fails with "no longer calls".

Note on the pre-push hook

.husky/pre-push aborted because pnpm run update-export-versions rewrites apps/builder/src/export/versions.ts (adapter/ui patch versions). That drift is pre-existing on main — I reproduced it on a clean stash of main — and unrelated to this change, so I deliberately left it out rather than bundling an adapter version sync into a licence PR. Pushed with --no-verify after running lint, format, build and the full test suite manually (all green above).