@metamask-previews/assets-controller 14.0.2-preview-4f4c98e → 14.0.2-preview-eb263b0ee

package/dist/data-sources/TokenDataSource.cjs

@@ -0,0 +1,583 @@
+"use strict";
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _TokenDataSource_instances, _TokenDataSource_apiClient, _TokenDataSource_getNativeAssetIds, _TokenDataSource_getAssetType, _TokenDataSource_messenger, _TokenDataSource_fetchTimeoutMs, _TokenDataSource_getSupportedNetworks, _TokenDataSource_getSuggestedOccurrenceFloors, _TokenDataSource_filterAssetsByNetwork, _TokenDataSource_filterBlockaidSpamTokens;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenDataSource = exports.CaipAssetNamespace = void 0;
+const core_backend_1 = require("@metamask/core-backend");
+const phishing_controller_1 = require("@metamask/phishing-controller");
+const utils_1 = require("@metamask/utils");
+const logger_js_1 = require("../logger.cjs");
+const types_js_1 = require("../types.cjs");
+const index_js_1 = require("../utils/index.cjs");
+const index_js_2 = require("./evm-rpc-services/index.cjs");
+// ============================================================================
+// CONSTANTS
+// ============================================================================
+const CONTROLLER_NAME = 'TokenDataSource';
+const DEFAULT_FETCH_TIMEOUT_MS = 15000;
+const log = (0, logger_js_1.createModuleLogger)(logger_js_1.projectLogger, CONTROLLER_NAME);
+/** Max asset IDs per tokens API request. */
+const TOKENS_API_BATCH_SIZE = 50;
+/** Max tokens per PhishingController:bulkScanTokens request (see PhishingController). */
+const BULK_SCAN_BATCH_SIZE = 100;
+/**
+ * Fallback minimum aggregator occurrences for EVM ERC-20 spam filtering when
+ * Token API `/v1/suggestedOccurrenceFloors` has no entry for the chain (or
+ * the floors request fails). Non-EVM tokens are filtered via Blockaid instead.
+ */
+const DEFAULT_OCCURRENCE_FLOOR = 3;
+/** CAIP-19 `assetNamespace` segments used across filtering logic. */
+var CaipAssetNamespace;
+(function (CaipAssetNamespace) {
+    CaipAssetNamespace["Slip44"] = "slip44";
+    CaipAssetNamespace["Erc20"] = "erc20";
+    CaipAssetNamespace["Token"] = "token";
+})(CaipAssetNamespace || (exports.CaipAssetNamespace = CaipAssetNamespace = {}));
+const MUSD_ADDRESS_LOWERCASE = '0xaca92e438df0b2401ff60da7e4337b687a2435da';
+// ============================================================================
+// HELPER FUNCTIONS
+// ============================================================================
+/**
+ * Transform V3 API response to FungibleAssetMetadata for state storage.
+ *
+ * Mapping:
+ * - assetId → used to derive `type` (native/erc20/spl)
+ * - iconUrl → image
+ * - All other fields map directly
+ *
+ * @param assetId - CAIP-19 asset ID used to derive token type.
+ * @param assetData - V3 API response data.
+ * @param getAssetType - Returns the asset type for a given CAIP-19 asset ID.
+ * @returns FungibleAssetMetadata for state storage.
+ */
+function transformV3AssetResponseToMetadata(assetId, assetData, getAssetType) {
+    const metadata = {
+        type: getAssetType(assetId),
+        // BaseAssetMetadata fields
+        name: assetData.name,
+        symbol: assetData.symbol,
+        decimals: assetData.decimals,
+        image: assetData.iconUrl,
+        // Direct mapping fields
+        coingeckoId: assetData.coingeckoId,
+        occurrences: assetData.occurrences,
+        aggregators: assetData.aggregators,
+        labels: assetData.labels,
+        erc20Permit: assetData.erc20Permit,
+        fees: assetData.fees,
+        honeypotStatus: assetData.honeypotStatus,
+        storage: assetData.storage,
+        isContractVerified: assetData.isContractVerified,
+        description: assetData.description,
+    };
+    return metadata;
+}
+/**
+ * Resolve the occurrence floor for an EVM asset from suggested floors keyed by
+ * decimal chain ID (e.g. `{ "1": 3, "143": 1 }`).
+ *
+ * @param assetId - CAIP-19 asset ID.
+ * @param floors - Map of decimal chain ID → suggested floor.
+ * @returns Floor to apply, or {@link DEFAULT_OCCURRENCE_FLOOR} when missing.
+ */
+function getOccurrenceFloorForAsset(assetId, floors) {
+    try {
+        const { chain } = (0, utils_1.parseCaipAssetType)(assetId);
+        return floors[chain.reference] ?? DEFAULT_OCCURRENCE_FLOOR;
+    }
+    catch {
+        return DEFAULT_OCCURRENCE_FLOOR;
+    }
+}
+// ============================================================================
+// TOKEN DATA SOURCE
+// ============================================================================
+/**
+ * TokenDataSource enriches responses with token metadata from the Tokens API.
+ *
+ * This middleware-based data source:
+ * - Checks detected assets for missing metadata/images
+ * - Also checks `assetsBalance` entries missing metadata/images (heal path)
+ * - Fetches metadata from Tokens API v3 for assets needing enrichment
+ * - Filters EVM ERC-20 spam using per-chain floors from Token API
+ *   `/v1/suggestedOccurrenceFloors` (default floor 3) for newly detected
+ *   assets only; balance-only heals are enriched without spam-filtering
+ * - Merges fetched metadata into the response
+ *
+ * Pass the same {@link AssetsControllerMessenger} as other data sources for Blockaid
+ * token scans.
+ */
+class TokenDataSource {
+    getName() {
+        return this.name;
+    }
+    constructor(messenger, options) {
+        _TokenDataSource_instances.add(this);
+        this.name = CONTROLLER_NAME;
+        /** ApiPlatformClient for cached API calls */
+        _TokenDataSource_apiClient.set(this, void 0);
+        /** Returns CAIP-19 native asset IDs from NetworkEnablementController state */
+        _TokenDataSource_getNativeAssetIds.set(this, void 0);
+        /** Returns the asset type for a given CAIP-19 asset ID */
+        _TokenDataSource_getAssetType.set(this, void 0);
+        /** Shared controller messenger — used for `PhishingController:bulkScanTokens`. */
+        _TokenDataSource_messenger.set(this, void 0);
+        _TokenDataSource_fetchTimeoutMs.set(this, void 0);
+        __classPrivateFieldSet(this, _TokenDataSource_messenger, messenger, "f");
+        __classPrivateFieldSet(this, _TokenDataSource_apiClient, options.queryApiClient, "f");
+        __classPrivateFieldSet(this, _TokenDataSource_getNativeAssetIds, options.getNativeAssetIds, "f");
+        __classPrivateFieldSet(this, _TokenDataSource_getAssetType, options.getAssetType, "f");
+        __classPrivateFieldSet(this, _TokenDataSource_fetchTimeoutMs, options.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS, "f");
+    }
+    /**
+     * Middleware that runs BEFORE DetectionMiddleware for account-activity
+     * (websocket) updates. New-to-state EVM ERC-20 balances are enriched with
+     * their Token API occurrence counts first, and tokens below the per-chain
+     * suggested occurrence floor are dropped from the response (balances and
+     * stub metadata) so spam airdrops never reach detection, metadata
+     * enrichment, pricing, or state. Custom assets and mUSD are exempt, and
+     * assets unknown to the Token API are kept (fail open), mirroring
+     * {@link TokenDataSource.assetsMiddleware} filtering semantics.
+     *
+     * @returns The middleware function for the assets pipeline.
+     */
+    get occurrenceFilterMiddleware() {
+        return (0, types_js_1.forDataTypes)(['balance'], async (ctx, next) => {
+            const { response } = ctx;
+            const { assetsBalance: stateBalances, assetsInfo: stateMetadata, customAssets, } = ctx.getAssetsState();
+            const customAssetIds = new Set(Object.values(customAssets ?? {})
+                .flat()
+                .map((id) => id.toLowerCase()));
+            // State keys are checksummed, but AccountActivity delivers lower-case
+            // ERC-20 IDs, so every lookup below compares lower-cased IDs. Matching
+            // case-sensitively would classify existing holdings as new and delete
+            // the very balance update this pipeline pass is meant to persist.
+            const knownMetadataIds = new Set(Object.keys(stateMetadata).map((id) => id.toLowerCase()));
+            // Candidates: EVM ERC-20s that are genuinely new (absent from state
+            // balances and metadata) — the same assets DetectionMiddleware would
+            // mark as newly detected right after this middleware.
+            const candidateByLowerId = new Map();
+            for (const [accountId, accountBalances] of Object.entries(response.assetsBalance ?? {})) {
+                const knownBalanceIds = new Set(Object.keys(stateBalances[accountId] ?? {}).map((id) => id.toLowerCase()));
+                for (const assetId of Object.keys(accountBalances)) {
+                    const caipAssetId = assetId;
+                    const lowerId = assetId.toLowerCase();
+                    if (knownBalanceIds.has(lowerId) ||
+                        knownMetadataIds.has(lowerId) ||
+                        customAssetIds.has(lowerId) ||
+                        lowerId.includes(`/erc20:${MUSD_ADDRESS_LOWERCASE}`)) {
+                        continue;
+                    }
+                    try {
+                        const { assetNamespace, chain } = (0, utils_1.parseCaipAssetType)(caipAssetId);
+                        if (assetNamespace === CaipAssetNamespace.Erc20 &&
+                            chain.namespace === utils_1.KnownCaipNamespace.Eip155) {
+                            candidateByLowerId.set(lowerId, assetId);
+                        }
+                    }
+                    catch {
+                        // Unparseable IDs are left for downstream middleware to handle.
+                    }
+                }
+            }
+            if (candidateByLowerId.size === 0) {
+                return next(ctx);
+            }
+            try {
+                const [occurrenceResponse, suggestedOccurrenceFloors] = await Promise.all([
+                    (0, index_js_2.reduceInBatchesSerially)({
+                        values: [...candidateByLowerId.values()],
+                        batchSize: TOKENS_API_BATCH_SIZE,
+                        eachBatch: async (workingResult, batch) => {
+                            const batchResponse = await (0, index_js_1.fetchWithTimeout)(() => __classPrivateFieldGet(this, _TokenDataSource_apiClient, "f").tokens.fetchV3Assets(batch, {
+                                includeOccurrences: true,
+                            }), __classPrivateFieldGet(this, _TokenDataSource_fetchTimeoutMs, "f"));
+                            return [
+                                ...workingResult,
+                                ...batchResponse,
+                            ];
+                        },
+                        initialResult: [],
+                    }),
+                    __classPrivateFieldGet(this, _TokenDataSource_instances, "m", _TokenDataSource_getSuggestedOccurrenceFloors).call(this),
+                ]);
+                // Only assets the API knows can be judged; missing ones are kept.
+                const spamAssetIds = new Set();
+                for (const assetData of occurrenceResponse) {
+                    const candidateId = candidateByLowerId.get(assetData.assetId.toLowerCase());
+                    if (candidateId !== undefined &&
+                        (assetData.occurrences ?? 0) <
+                            getOccurrenceFloorForAsset(candidateId, suggestedOccurrenceFloors)) {
+                        spamAssetIds.add(candidateId);
+                    }
+                }
+                if (spamAssetIds.size > 0) {
+                    for (const accountBalances of Object.values(response.assetsBalance ?? {})) {
+                        for (const assetId of spamAssetIds) {
+                            delete accountBalances[assetId];
+                        }
+                    }
+                    if (response.assetsInfo) {
+                        const spamLowerIds = new Set([...spamAssetIds].map((id) => id.toLowerCase()));
+                        for (const assetId of Object.keys(response.assetsInfo)) {
+                            if (spamLowerIds.has(assetId.toLowerCase())) {
+                                delete response.assetsInfo[assetId];
+                            }
+                        }
+                    }
+                    log('Filtered low-occurrence websocket assets', {
+                        assetIds: [...spamAssetIds],
+                    });
+                }
+            }
+            catch (error) {
+                // Fail open — keep all assets when occurrences cannot be fetched.
+                log('Failed to fetch occurrences for websocket update', { error });
+            }
+            return next(ctx);
+        });
+    }
+    /**
+     * Get the middleware for enriching responses with token metadata.
+     *
+     * This middleware:
+     * 1. Extracts the response from context
+     * 2. Fetches metadata for detected assets and balances missing metadata
+     * 3. Enriches the response with fetched metadata
+     * 4. Calls next() at the end to continue the middleware chain
+     *
+     * Spam filtering (EVM occurrence floors / non-EVM Blockaid) applies only to
+     * newly `detectedAssets`. Balance-only heals — assets already present in
+     * `assetsBalance` but missing `assetsInfo`, which DetectionMiddleware skips —
+     * are enriched without being filtered out of balances.
+     *
+     * @returns The middleware function for the assets pipeline.
+     */
+    get assetsMiddleware() {
+        return (0, types_js_1.forDataTypes)(['metadata'], async (ctx, next) => {
+            // Extract response from context
+            const { response } = ctx;
+            const { assetsInfo: stateMetadata, customAssets } = ctx.getAssetsState();
+            const assetIdsNeedingMetadata = new Set();
+            // Newly detected asset IDs (lowercase) — subject to spam filtering.
+            const detectedAssetIds = new Set();
+            // Balance-only heals (in assetsBalance, not newly detected) — enrich
+            // metadata but do not spam-filter / delete holdings.
+            const balanceHealAssetIds = new Set();
+            // Custom assets are user-imported — exempt from spam filtering.
+            // State stores asset IDs in their normalized (checksummed) form, but the
+            // V3 Tokens API can return them lower-cased. Lowercase both sides so the
+            // bypass is robust to address-case differences across data sources.
+            const customAssetIds = new Set(Object.values(customAssets ?? {})
+                .flat()
+                .map((id) => id.toLowerCase()));
+            // Always include native asset IDs from NetworkEnablementController
+            const nativeAssetIdsList = __classPrivateFieldGet(this, _TokenDataSource_getNativeAssetIds, "f").call(this);
+            const nativeAssetIds = new Set(nativeAssetIdsList.map((id) => id.toLowerCase()));
+            for (const nativeAssetId of nativeAssetIdsList) {
+                assetIdsNeedingMetadata.add(nativeAssetId);
+            }
+            // Also fetch metadata for detected assets that are missing it
+            if (response.detectedAssets) {
+                for (const detectedIds of Object.values(response.detectedAssets)) {
+                    for (const assetId of detectedIds) {
+                        // Skip if response already has metadata with image
+                        const responseMetadata = response.assetsInfo?.[assetId];
+                        if (responseMetadata?.image) {
+                            continue;
+                        }
+                        // Skip if state already has metadata with image
+                        const existingMetadata = stateMetadata[assetId];
+                        if (existingMetadata?.image) {
+                            continue;
+                        }
+                        // Skip staking contracts; we use built-in metadata and do not fetch from the tokens API
+                        if ((0, index_js_2.isStakingContractAssetId)(assetId)) {
+                            continue;
+                        }
+                        detectedAssetIds.add(assetId.toLowerCase());
+                        assetIdsNeedingMetadata.add(assetId);
+                    }
+                }
+            }
+            // Also fetch metadata for balances that are missing it
+            if (response.assetsBalance) {
+                for (const accountBalances of Object.values(response.assetsBalance)) {
+                    for (const assetId of Object.keys(accountBalances)) {
+                        if (response.assetsInfo?.[assetId]?.image) {
+                            continue;
+                        }
+                        if (stateMetadata[assetId]?.image) {
+                            continue;
+                        }
+                        if ((0, index_js_2.isStakingContractAssetId)(assetId)) {
+                            continue;
+                        }
+                        assetIdsNeedingMetadata.add(assetId);
+                        // Only treat as a heal when DetectionMiddleware did not queue it
+                        // as newly detected — those remain subject to spam filtering.
+                        if (!detectedAssetIds.has(assetId.toLowerCase())) {
+                            balanceHealAssetIds.add(assetId.toLowerCase());
+                        }
+                    }
+                }
+            }
+            if (assetIdsNeedingMetadata.size === 0) {
+                return next(ctx);
+            }
+            // Filter asset IDs to only include supported networks; load per-chain
+            // occurrence floors in parallel (Token API suggested floors).
+            const [supportedNetworks, suggestedOccurrenceFloors] = await Promise.all([
+                __classPrivateFieldGet(this, _TokenDataSource_instances, "m", _TokenDataSource_getSupportedNetworks).call(this),
+                __classPrivateFieldGet(this, _TokenDataSource_instances, "m", _TokenDataSource_getSuggestedOccurrenceFloors).call(this),
+            ]);
+            const supportedAssetIds = __classPrivateFieldGet(this, _TokenDataSource_instances, "m", _TokenDataSource_filterAssetsByNetwork).call(this, [...assetIdsNeedingMetadata], supportedNetworks);
+            if (supportedAssetIds.length === 0) {
+                return next(ctx);
+            }
+            try {
+                const fetchOptions = {
+                    includeIconUrl: true,
+                    includeMarketData: true,
+                    includeMetadata: true,
+                    includeLabels: true,
+                    includeRwaData: true,
+                    includeAggregators: true,
+                    includeOccurrences: true,
+                };
+                const metadataResponse = await (0, index_js_2.reduceInBatchesSerially)({
+                    values: supportedAssetIds,
+                    batchSize: TOKENS_API_BATCH_SIZE,
+                    eachBatch: async (workingResult, batch) => {
+                        const batchResponse = await (0, index_js_1.fetchWithTimeout)(() => __classPrivateFieldGet(this, _TokenDataSource_apiClient, "f").tokens.fetchV3Assets(batch, fetchOptions), __classPrivateFieldGet(this, _TokenDataSource_fetchTimeoutMs, "f"));
+                        return [...workingResult, ...batchResponse];
+                    },
+                    initialResult: [],
+                });
+                // Split assets by chain type: EVM uses occurrence-count filtering;
+                // non-EVM non-native uses Blockaid; native assets are always allowed.
+                const occurrencesByAssetId = new Map(metadataResponse.map((a) => [a.assetId, a.occurrences]));
+                const evmErc20Ids = [];
+                const nonEvmTokenIds = [];
+                for (const assetData of metadataResponse) {
+                    const assetId = assetData.assetId;
+                    const { assetNamespace, chain } = (0, utils_1.parseCaipAssetType)(assetId);
+                    if (nativeAssetIds.has(assetId.toLowerCase())) {
+                        // Native assets are always kept — no filtering.
+                    }
+                    else if (assetNamespace === CaipAssetNamespace.Erc20 &&
+                        chain.namespace === utils_1.KnownCaipNamespace.Eip155) {
+                        evmErc20Ids.push(assetId);
+                    }
+                    else if (assetNamespace === CaipAssetNamespace.Token) {
+                        nonEvmTokenIds.push(assetId);
+                    }
+                }
+                // EVM: require per-chain suggested occurrence floor (from Token API
+                // `/v1/suggestedOccurrenceFloors`, default {@link DEFAULT_OCCURRENCE_FLOOR})
+                // to suppress low-signal tokens. Tokens with no occurrence data
+                // (undefined) are treated the same as zero occurrences and filtered out.
+                // Custom assets (user-imported) bypass the occurrence filter — users
+                // can import whatever they want and we must keep their metadata even
+                // if the API has fewer aggregator hits than the floor.
+                // Balance-only heals also bypass — see `balanceHealAssetIds` below.
+                const allowedEvmIds = new Set(evmErc20Ids.filter((id) => customAssetIds.has(id.toLowerCase()) ||
+                    balanceHealAssetIds.has(id.toLowerCase()) ||
+                    (occurrencesByAssetId.get(id) ?? 0) >=
+                        getOccurrenceFloorForAsset(id, suggestedOccurrenceFloors) ||
+                    id.includes(`/erc20:${MUSD_ADDRESS_LOWERCASE}`)));
+                // Non-EVM: Blockaid bulk scan.
+                // Custom assets and balance-only heals bypass Blockaid filtering.
+                const nonEvmToScan = nonEvmTokenIds.filter((id) => !customAssetIds.has(id.toLowerCase()) &&
+                    !balanceHealAssetIds.has(id.toLowerCase()));
+                const allowedNonEvmIds = new Set([
+                    ...nonEvmTokenIds.filter((id) => customAssetIds.has(id.toLowerCase()) ||
+                        balanceHealAssetIds.has(id.toLowerCase())),
+                    ...(await __classPrivateFieldGet(this, _TokenDataSource_instances, "m", _TokenDataSource_filterBlockaidSpamTokens).call(this, nonEvmToScan)),
+                ]);
+                // Start with every asset the API returned; only remove those that
+                // fail their respective filter (EVM occurrences / non-EVM Blockaid).
+                // Native (slip44) and unrecognised namespaces are kept (fail open).
+                const allowedAssetIds = new Set(metadataResponse.map((a) => a.assetId));
+                for (const id of evmErc20Ids) {
+                    if (!allowedEvmIds.has(id)) {
+                        allowedAssetIds.delete(id);
+                    }
+                }
+                for (const id of nonEvmTokenIds) {
+                    if (!allowedNonEvmIds.has(id)) {
+                        allowedAssetIds.delete(id);
+                    }
+                }
+                response.assetsInfo ?? (response.assetsInfo = {});
+                const filteredOutAssets = new Set();
+                for (const assetData of metadataResponse) {
+                    if (!allowedAssetIds.has(assetData.assetId)) {
+                        filteredOutAssets.add(assetData.assetId);
+                        continue;
+                    }
+                    const caipAssetId = assetData.assetId;
+                    response.assetsInfo[caipAssetId] = transformV3AssetResponseToMetadata(caipAssetId, assetData, __classPrivateFieldGet(this, _TokenDataSource_getAssetType, "f"));
+                }
+                if (filteredOutAssets.size > 0) {
+                    if (response.assetsBalance) {
+                        for (const accountBalances of Object.values(response.assetsBalance)) {
+                            for (const assetId of filteredOutAssets) {
+                                delete accountBalances[assetId];
+                            }
+                        }
+                    }
+                    if (response.detectedAssets) {
+                        for (const [accountId, assetIds] of Object.entries(response.detectedAssets)) {
+                            response.detectedAssets[accountId] = assetIds.filter((id) => !filteredOutAssets.has(id));
+                        }
+                    }
+                    // Drop stub metadata (e.g. websocket-seeded name/symbol) for
+                    // filtered-out assets so it never persists to state — a persisted
+                    // stub would make the asset look "known" on the next update and
+                    // let its balance skip spam filtering as a heal. Case-insensitive
+                    // because the API may return asset IDs in a different case.
+                    const filteredOutLower = new Set([...filteredOutAssets].map((id) => id.toLowerCase()));
+                    for (const assetId of Object.keys(response.assetsInfo)) {
+                        if (filteredOutLower.has(assetId.toLowerCase())) {
+                            delete response.assetsInfo[assetId];
+                        }
+                    }
+                }
+            }
+            catch (error) {
+                log('Failed to fetch metadata', { error });
+            }
+            // Call next() at the end to continue the middleware chain
+            return next(ctx);
+        });
+    }
+}
+exports.TokenDataSource = TokenDataSource;
+_TokenDataSource_apiClient = new WeakMap(), _TokenDataSource_getNativeAssetIds = new WeakMap(), _TokenDataSource_getAssetType = new WeakMap(), _TokenDataSource_messenger = new WeakMap(), _TokenDataSource_fetchTimeoutMs = new WeakMap(), _TokenDataSource_instances = new WeakSet(), _TokenDataSource_getSupportedNetworks = 
+/**
+ * Gets the supported networks from the API.
+ * Caching is handled by ApiPlatformClient.
+ *
+ * @returns Set of supported chain IDs in CAIP format
+ */
+async function _TokenDataSource_getSupportedNetworks() {
+    try {
+        // Use v2/supportedNetworks which returns CAIP chain IDs
+        // ApiPlatformClient handles caching
+        const response = await (0, index_js_1.fetchWithTimeout)(() => __classPrivateFieldGet(this, _TokenDataSource_apiClient, "f").tokens.fetchTokenV2SupportedNetworks(), __classPrivateFieldGet(this, _TokenDataSource_fetchTimeoutMs, "f"));
+        // Combine full and partial support networks
+        const allNetworks = [...response.fullSupport, ...response.partialSupport];
+        return new Set(allNetworks);
+    }
+    catch (error) {
+        log('Failed to fetch supported networks', { error });
+        return new Set();
+    }
+}, _TokenDataSource_getSuggestedOccurrenceFloors = 
+/**
+ * Fetches per-chain suggested occurrence floors from Token API
+ * (`GET /v1/suggestedOccurrenceFloors`). Caching is handled by
+ * ApiPlatformClient. Fails open to an empty map so callers fall back to
+ * {@link DEFAULT_OCCURRENCE_FLOOR}.
+ *
+ * @returns Map of decimal chain ID → suggested occurrence floor.
+ */
+async function _TokenDataSource_getSuggestedOccurrenceFloors() {
+    try {
+        return await (0, index_js_1.fetchWithTimeout)(() => __classPrivateFieldGet(this, _TokenDataSource_apiClient, "f").token.fetchV1SuggestedOccurrenceFloors(), __classPrivateFieldGet(this, _TokenDataSource_fetchTimeoutMs, "f"));
+    }
+    catch (error) {
+        log('Failed to fetch suggested occurrence floors', { error });
+        return {};
+    }
+}, _TokenDataSource_filterAssetsByNetwork = function _TokenDataSource_filterAssetsByNetwork(assetIds, supportedNetworks) {
+    return assetIds.filter((assetId) => {
+        try {
+            const parsed = (0, utils_1.parseCaipAssetType)(assetId);
+            // chainId is in format "eip155:1" or "tron:728126428"
+            // parsed.chain has namespace and reference properties
+            const chainId = `${parsed.chain.namespace}:${parsed.chain.reference}`;
+            return supportedNetworks.has(chainId);
+        }
+        catch {
+            // If we can't parse the asset ID, filter it out
+            return false;
+        }
+    });
+}, _TokenDataSource_filterBlockaidSpamTokens = 
+/**
+ * Filters non-EVM fungible `token` assets flagged as malicious by Blockaid
+ * via `PhishingController:bulkScanTokens`. Only the `token` namespace (e.g.
+ * Solana mints) is scanned; native (`slip44`) and EVM assets are not handled
+ * here (EVM uses occurrence-count filtering instead). Fails open on error.
+ *
+ * @param assets - CAIP-19 asset IDs to filter (non-EVM only).
+ * @returns Asset IDs with malicious tokens removed.
+ */
+async function _TokenDataSource_filterBlockaidSpamTokens(assets) {
+    if (assets.length === 0) {
+        return assets;
+    }
+    const tokensByChain = {};
+    for (const asset of assets) {
+        try {
+            const { assetNamespace, assetReference, chain } = (0, utils_1.parseCaipAssetType)(asset);
+            if (assetNamespace === CaipAssetNamespace.Token) {
+                const chainName = chain.namespace;
+                if (!tokensByChain[chainName]) {
+                    tokensByChain[chainName] = [];
+                }
+                tokensByChain[chainName].push({ asset, address: assetReference });
+            }
+        }
+        catch {
+            // Malformed or unsupported for bulk scan — keep asset (fail open)
+        }
+    }
+    if (Object.keys(tokensByChain).length === 0) {
+        return assets;
+    }
+    const rejectedAssets = new Set();
+    try {
+        for (const [chainId, tokenEntries] of Object.entries(tokensByChain)) {
+            const addresses = tokenEntries.map((entry) => entry.address);
+            const batches = [];
+            for (let i = 0; i < addresses.length; i += BULK_SCAN_BATCH_SIZE) {
+                batches.push(addresses.slice(i, i + BULK_SCAN_BATCH_SIZE));
+            }
+            const batchResults = await Promise.allSettled(batches.map((batch) => __classPrivateFieldGet(this, _TokenDataSource_messenger, "f").call('PhishingController:bulkScanTokens', {
+                chainId,
+                tokens: batch,
+            })));
+            const scanResponse = {};
+            for (const result of batchResults) {
+                if (result.status === 'fulfilled') {
+                    Object.assign(scanResponse, result.value);
+                }
+            }
+            for (const entry of tokenEntries) {
+                const result = scanResponse[entry.address];
+                if (result?.result_type === phishing_controller_1.TokenScanResultType.Malicious) {
+                    rejectedAssets.add(entry.asset);
+                }
+            }
+        }
+    }
+    catch (error) {
+        log('Blockaid bulk token scan failed; keeping all tokens', { error });
+        return assets;
+    }
+    return assets.filter((asset) => !rejectedAssets.has(asset));
+};
+//# sourceMappingURL=TokenDataSource.cjs.map