From 7bb6b7048b0f7f0525660d63c8f885e4a104acb7 Mon Sep 17 00:00:00 2001
From: irubido <ivan.rubido@gmail.com>
Date: Mon, 3 Nov 2025 15:16:39 +0100
Subject: [PATCH 1/2] build pre publish script

---
 packages/snap/build_prePublish.sh | 19 +++++++++++++++++++
 packages/snap/package.json        |  1 +
 packages/snap/snap.manifest.json  |  2 +-
 3 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 packages/snap/build_prePublish.sh

diff --git a/packages/snap/build_prePublish.sh b/packages/snap/build_prePublish.sh
new file mode 100644
index 0000000..5950498
--- /dev/null
+++ b/packages/snap/build_prePublish.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+# Ensure allowedOrigins only contains the production URL, then build the snap.
+
+set -euo pipefail
+
+MANIFEST_FILE="snap.manifest.json"
+
+echo "Ensuring allowedOrigins only contains https://webzjs.chainsafe.dev..."
+
+jq '.initialPermissions."endowment:rpc".allowedOrigins = ["https://webzjs.chainsafe.dev"]' "$MANIFEST_FILE" > "$MANIFEST_FILE.tmp"
+mv "$MANIFEST_FILE.tmp" "$MANIFEST_FILE"
+
+echo "Running mm-snap build..."
+mm-snap build
+
+echo "build_prePublish completed."
+
+
diff --git a/packages/snap/package.json b/packages/snap/package.json
index 959297c..a99690e 100644
--- a/packages/snap/package.json
+++ b/packages/snap/package.json
@@ -17,6 +17,7 @@
     "allow-scripts": "yarn workspace root allow-scripts",
     "build": "mm-snap build",
     "build:clean": "yarn clean && yarn build",
+    "build:prePublish": "bash ./build_prePublish.sh",
     "build:local": "./build_local.sh",
     "clean": "rimraf dist",
     "lint": "eslint --color --ext .ts src/",
diff --git a/packages/snap/snap.manifest.json b/packages/snap/snap.manifest.json
index 4689441..b320375 100644
--- a/packages/snap/snap.manifest.json
+++ b/packages/snap/snap.manifest.json
@@ -7,7 +7,7 @@
     "url": "https://github.com/ChainSafe/WebZjs.git"
   },
   "source": {
-    "shasum": "m7tPwL0uBJEK4GoRksJUBkDixneKcyYOY8oxoZGmY5k=",
+    "shasum": "wTPZl0jiwxyFr3cUhss5/b0WjFGdZP9y/VIPafGtDAM=",
     "location": {
       "npm": {
         "filePath": "dist/bundle.js",

From da65a598088e3fa16e0d8ec26fcf55e049f419d3 Mon Sep 17 00:00:00 2001
From: irubido <ivan.rubido@gmail.com>
Date: Mon, 3 Nov 2025 15:17:56 +0100
Subject: [PATCH 2/2] update snap readme

---
 packages/snap/README.md          | 5 +++++
 packages/snap/snap.manifest.json | 4 +++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/packages/snap/README.md b/packages/snap/README.md
index 5c1d9b1..c6e0556 100644
--- a/packages/snap/README.md
+++ b/packages/snap/README.md
@@ -30,12 +30,17 @@ For local development, you need to add `http://localhost:3000` to the `allowedOr
 
 - **`yarn build`** - Standard build for production (only allows production origins)
 - **`yarn build:local`** - Build for local development (automatically adds localhost:3000 to allowedOrigins)
+- **`yarn build:prePublish`** - Pre-publish build that ensures `allowedOrigins` is reset to `["https://webzjs.chainsafe.dev"]` and then runs `mm-snap build`
 
 The `build:local` script will:
 1. Create a backup of the original `snap.manifest.json`
 2. Modify the manifest to include `http://localhost:3000` in allowedOrigins
 3. Run the build process
 
+The `build:prePublish` script will:
+1. Overwrite `allowedOrigins` in `snap.manifest.json` to only `["https://webzjs.chainsafe.dev"]`
+2. Run the production build via `mm-snap build`
+
 ### Development Steps
 
 1. Install dependencies with `yarn install`
diff --git a/packages/snap/snap.manifest.json b/packages/snap/snap.manifest.json
index b320375..be58df2 100644
--- a/packages/snap/snap.manifest.json
+++ b/packages/snap/snap.manifest.json
@@ -22,7 +22,9 @@
     "endowment:lifecycle-hooks": {},
     "endowment:webassembly": {},
     "endowment:rpc": {
-      "allowedOrigins": ["https://webzjs.chainsafe.dev"]
+      "allowedOrigins": [
+        "https://webzjs.chainsafe.dev"
+      ]
     },
     "snap_getBip44Entropy": [
       {