feat: Add NPM proxy support (#3695)

Add a `useNpmProxy` flag to the NPM location options. When enabled, this
proxy URL is used instead of the main NPM registry URL. The
implementation assumes that the proxy returns identical content and
respects the same headers.

This flag is enabled only for updating preinstalled Snaps.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Adds a `useNpmProxy` option to NPM locations and routes automatic
preinstalled Snap updates through the MetaMask NPM proxy.
> 
> - **Snaps Controller**
(`packages/snaps-controllers/src/snaps/SnapController.ts`):
> - Use `detectSnapLocation(..., { useNpmProxy: true })` when
auto-updating preinstalled Snaps during `updateRegistry`.
> - **NPM Location**
(`packages/snaps-controllers/src/snaps/location/npm.ts`):
>   - Add `NPM_REGISTRY_PROXY` and new `NpmOptions.useNpmProxy` flag.
> - Default registry selection now uses proxy when `useNpmProxy` is
true.
>   - Update `isNPM` to treat proxy URL as NPM.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
4dda778. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: FrederikBolding

packages/snaps-controllers/src/snaps/SnapController.ts

@@ -1516,6 +1516,7 @@ export class SnapController extends BaseController<
               versionRange: resolvedVersion,
               fetch: this.#fetchFunction,
               allowLocal: false,
+              useNpmProxy: true,
             });
 
             await this.#updateSnap({

packages/snaps-controllers/src/snaps/location/npm.ts

@@ -28,6 +28,8 @@ import type { DetectSnapLocationOptions, SnapLocation } from './location';
 
 export const DEFAULT_NPM_REGISTRY = new URL('https://registry.npmjs.org');
 
+export const NPM_REGISTRY_PROXY = new URL('https://npm-ota.api.cx.metamask.io');
+
 type NpmMeta = {
   registry: URL;
   packageName: string;
@@ -48,6 +50,12 @@ export type NpmOptions = {
    * @default false
    */
   allowCustomRegistries?: boolean;
+  /**
+   * Whether to use a MetaMask-owned proxy when sending requests to NPM.
+   *
+   * @default false
+   */
+  useNpmProxy?: boolean;
 };
 
 // Base class for NPM implementation, useful for extending with custom NPM fetching logic
@@ -74,7 +82,7 @@ export abstract class BaseNpmLocation implements SnapLocation {
       url.username === '' &&
       url.password === ''
     ) {
-      registry = DEFAULT_NPM_REGISTRY;
+      registry = opts.useNpmProxy ? NPM_REGISTRY_PROXY : DEFAULT_NPM_REGISTRY;
     } else {
       registry = 'https://';
       if (url.username) {
@@ -341,7 +349,11 @@ export function getNpmCanonicalBasePath(registryUrl: URL, packageName: string) {
  * @returns True if the registry is the NPM registry, otherwise false.
  */
 function isNPM(registryUrl: URL) {
-  return registryUrl.toString() === DEFAULT_NPM_REGISTRY.toString();
+  const registryUrlString = registryUrl.toString();
+  return (
+    registryUrlString === DEFAULT_NPM_REGISTRY.toString() ||
+    registryUrlString === NPM_REGISTRY_PROXY.toString()
+  );
 }
 
 /**