Release/1137.0.0

[ffmcgee725]

@metamask/money-account-api-data-service

[0.3.0]

Added

• Add optional trace callback to MoneyAccountApiDataService constructor for network request tracing (#9451)
  • All HTTP calls (fetchPositions, fetchInterest, fetchHistory, fetchRateHistory) emit best-effort backdated traces with startTime, success, and errorName attributes
  • Tracing is isolated from fetch/retry logic; trace failures do not impact queries

@metamask/chomp-api-service

[4.0.0]

Added

• Add getAssociatedAddresses method, exposed as the ChompApiService:getAssociatedAddresses messenger action, which fetches the active address associations of the authenticated profile via GET /v1/auth/address (#9387)
  • Also adds the ProfileAddressEntry type describing each returned entry and the ChompApiServiceGetAssociatedAddressesAction type
  • Returned addresses are parsed into canonical lowercase form, entries are guaranteed to have status: 'active', and results are never served from cache
  • The query cache key is scoped to the authenticated profile via a SHA-256 digest of the bearer token, so concurrent calls only share an in-flight request when they are for the same profile and one profile's associations are never cached under another's key

Changed

• BREAKING: associateAddress now throws an HttpError on a 409 response instead of returning the parsed body (#9387)
  • A 409 from POST /v1/auth/address indicates the address is associated with a different profile; the previous handling attempted to parse the error body as an association result and failed with a confusing validation error. An address already associated with the authenticated profile is reported via a 201 response with status: 'active', which is unchanged.
• Bump @metamask/utils from ^11.9.0 to ^11.11.0 (#9074)
• Bump @metamask/controller-utils from ^12.0.0 to ^12.3.0 (#8774, #9058, #9083, #9218)
• Bump @metamask/base-data-service from ^0.1.2 to ^0.1.3 (#8799)
• Bump @metamask/messenger from ^1.2.0 to ^2.0.0 (#9392)
• Update LICENSE text (#9472)

@metamask/money-account-upgrade-controller

[3.0.0]

• BREAKING: Add persisted state tracking fully upgraded accounts (#9500)
  • MoneyAccountUpgradeControllerState changes from Record<string, never> to { upgradedAccounts }, keyed by lowercased account address. Each entry records when the upgrade sequence completed and a fingerprint of the config it completed under (see new MoneyAccountUpgradeStatus type). Code constructing the state type (e.g. {} in tests or default-state maps) must include upgradedAccounts.
  • The constructor now accepts an optional state option, merged with the defaults; add getDefaultMoneyAccountUpgradeControllerState to construct those defaults.
• Add TerminalUpgradeError and isTerminalMoneyAccountUpgradeError, and a terminal property on MoneyAccountUpgradeStepError, marking failures that cannot resolve by retrying — currently an account delegated to a third-party EIP-7702 implementation, an account with unexpected on-chain code, or an address confirmed to be associated with a different CHOMP profile (#9500)
  • The controller does not retry on its own; clients implementing their own retry logic around upgradeAccount can use isTerminalMoneyAccountUpgradeError to stop retrying failures that cannot succeed.

Changed

• BREAKING: The associate-address upgrade step now checks the profile's existing address associations via ChompApiService:getAssociatedAddresses before signing, and reports already-done without signing or submitting anything when the address is already associated (#9387)
  • MoneyAccountUpgradeControllerMessenger consumers must grant the ChompApiService:getAssociatedAddresses action alongside the previously required actions, and must provide a @metamask/chomp-api-service version that registers it (>=4.0.0).
  • The lookup is an optimization: if it fails, the step falls through to the previous sign-and-submit behavior.
  • A 409 conflict from the association request is disambiguated by re-fetching the associations, so a same-profile create race reports already-done instead of failing the upgrade; a genuine conflict (address associated with a different profile) still fails the step.
• upgradeAccount now skips the step sequence entirely when the account is recorded in state as upgraded under the active config fingerprint, and records the account after a successful run. If the chain, CHOMP contract addresses, or Delegation Framework version change, the fingerprint no longer matches and the sequence re-runs (#9500)
• Bump @metamask/messenger from ^1.2.0 to ^2.0.0 (#9392)
• Bump @metamask/authenticated-user-storage from ^3.0.0 to ^3.0.1 (#9458)
• Bump @metamask/chomp-api-service from ^3.1.0 to ^4.0.0 (#9586)

References

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

High Risk
Multiple breaking releases affect CHOMP address association error handling and Money account upgrade state/messenger permissions; consumers must adopt new versions and migration steps together.

Overview
Monorepo release 1137.0.0 — version bumps, finalized changelogs, and yarn.lock alignment for Money/CHOMP packages (no new implementation in this diff beyond release metadata).

@metamask/chomp-api-service@4.0.0 (breaking): ships getAssociatedAddresses and changes associateAddress to throw on HTTP 409 instead of parsing the error body.

@metamask/money-account-upgrade-controller@3.0.0 (breaking): persisted upgradedAccounts state (config fingerprint), terminal upgrade errors, associate-address pre-check via getAssociatedAddresses, and 409 disambiguation; depends on chomp-api-service@^4.0.0.

@metamask/money-account-api-data-service@0.3.0: optional constructor trace callback for Money API HTTP calls. money-account-balance-service only bumps that dependency to ^0.3.0 (changelog under Unreleased; no package version bump in this diff).

^{Reviewed by Cursor Bugbot for commit edd0ba1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[metamask-ci]

✅ Changelogs updated and pushed.