@metamask-previews/phishing-controller 17.0.0-preview-17c76be24 → 17.0.0-preview-3ce0062c4

package/CHANGELOG.md

@@ -7,29 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Added
-
-- Expose missing public `PhishingController` methods through its messenger ([#8269](https://github.com/MetaMask/core/pull/8269))
-  - The following actions are now available:
-    - `PhishingController:bypass`
-    - `PhishingController:isBlockedRequest`
-    - `PhishingController:scanUrl`
-  - Corresponding action types (e.g. `PhishingControllerBypassAction`) are available as well.
-
 ### Changed
 
-- Deprecate `test` method in favor of `testOrigin` ([#8269](https://github.com/MetaMask/core/pull/8269))
-  - The `test` method is now renamed to `testOrigin` to better reflect its purpose of testing a domain origin for phishing.
-  - The old `test` method is still present but is now marked as deprecated and will be removed in a future release.
-- Deprecate action types in favor of `PhishingController...Action` types ([#8269](https://github.com/MetaMask/core/pull/8269))
-  - The following action types have been renamed:
-    - `TestOrigin` is now `PhishingControllerTestOriginAction`.
-    - `MaybeUpdateState` is now `PhishingControllerMaybeUpdateStateAction`.
-  - The old types are still exported but are now marked as deprecated and will
-    be removed in a future release.
 - `PhishingController` no longer advances `c2DomainBlocklistLastFetched` when the C2 domain blocklist fetch fails, allowing the blocklist to be retried on the next update cycle ([#8250](https://github.com/MetaMask/core/pull/8250))
 - Reduce default cache TTL for `DEFAULT_URL_SCAN_CACHE_TTL`, `DEFAULT_TOKEN_SCAN_CACHE_TTL`, and `DEFAULT_ADDRESS_SCAN_CACHE_TTL` from 15 minutes to 1 minute ([#8254](https://github.com/MetaMask/core/pull/8254))
-- Bump `@metamask/transaction-controller` from `^63.0.0` to `^63.2.0` ([#8272](https://github.com/MetaMask/core/pull/8272), [#8301](https://github.com/MetaMask/core/pull/8301))
+- Bump `@metamask/transaction-controller` from `^63.0.0` to `^63.1.0` ([#8272](https://github.com/MetaMask/core/pull/8272))
 
 ## [17.0.0]
 

package/dist/PhishingController.cjs

@@ -10,7 +10,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _PhishingController_instances, _PhishingController_detector, _PhishingController_stalelistRefreshInterval, _PhishingController_hotlistRefreshInterval, _PhishingController_c2DomainBlocklistRefreshInterval, _PhishingController_urlScanCache, _PhishingController_tokenScanCache, _PhishingController_addressScanCache, _PhishingController_inProgressHotlistUpdate, _PhishingController_inProgressStalelistUpdate, _PhishingController_isProgressC2DomainBlocklistUpdate, _PhishingController_transactionControllerStateChangeHandler, _PhishingController_subscribeToTransactionControllerStateChange, _PhishingController_isTransactionPatch, _PhishingController_isSimulationDataPatch, _PhishingController_onTransactionControllerStateChange, _PhishingController_getTokensFromTransaction, _PhishingController_scanTokensByChain, _PhishingController_fetchTokenScanBulkResults, _PhishingController_processBatch, _PhishingController_updateStalelist, _PhishingController_updateHotlist, _PhishingController_updateC2DomainBlocklist, _PhishingController_queryConfig;
+var _PhishingController_instances, _PhishingController_detector, _PhishingController_stalelistRefreshInterval, _PhishingController_hotlistRefreshInterval, _PhishingController_c2DomainBlocklistRefreshInterval, _PhishingController_urlScanCache, _PhishingController_tokenScanCache, _PhishingController_addressScanCache, _PhishingController_inProgressHotlistUpdate, _PhishingController_inProgressStalelistUpdate, _PhishingController_isProgressC2DomainBlocklistUpdate, _PhishingController_transactionControllerStateChangeHandler, _PhishingController_subscribeToTransactionControllerStateChange, _PhishingController_registerMessageHandlers, _PhishingController_isTransactionPatch, _PhishingController_isSimulationDataPatch, _PhishingController_onTransactionControllerStateChange, _PhishingController_getTokensFromTransaction, _PhishingController_scanTokensByChain, _PhishingController_fetchTokenScanBulkResults, _PhishingController_processBatch, _PhishingController_updateStalelist, _PhishingController_updateHotlist, _PhishingController_updateC2DomainBlocklist, _PhishingController_queryConfig;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PhishingController = exports.phishingListKeyNameMap = exports.ListNames = exports.ListKeys = exports.C2_DOMAIN_BLOCKLIST_URL = exports.METAMASK_HOTLIST_DIFF_URL = exports.METAMASK_STALELIST_URL = exports.STALELIST_REFRESH_INTERVAL = exports.HOTLIST_REFRESH_INTERVAL = exports.C2_DOMAIN_BLOCKLIST_REFRESH_INTERVAL = exports.DEFAULT_ADDRESS_SCAN_CACHE_MAX_SIZE = exports.DEFAULT_ADDRESS_SCAN_CACHE_TTL = exports.DEFAULT_TOKEN_SCAN_CACHE_MAX_SIZE = exports.DEFAULT_TOKEN_SCAN_CACHE_TTL = exports.DEFAULT_URL_SCAN_CACHE_MAX_SIZE = exports.DEFAULT_URL_SCAN_CACHE_TTL = exports.ADDRESS_SCAN_ENDPOINT = exports.TOKEN_BULK_SCANNING_ENDPOINT = exports.SECURITY_ALERTS_BASE_URL = exports.PHISHING_DETECTION_BULK_SCAN_ENDPOINT = exports.PHISHING_DETECTION_SCAN_ENDPOINT = exports.PHISHING_DETECTION_BASE_URL = exports.C2_DOMAIN_BLOCKLIST_ENDPOINT = exports.CLIENT_SIDE_DETECION_BASE_URL = exports.METAMASK_HOTLIST_DIFF_FILE = exports.METAMASK_STALELIST_FILE = exports.PHISHING_CONFIG_BASE_URL = void 0;
 const base_controller_1 = require("@metamask/base-controller");
@@ -149,16 +149,6 @@ const getDefaultState = () => {
         addressScanCache: {},
     };
 };
-const MESSENGER_EXPOSED_METHODS = [
-    'maybeUpdateState',
-    'testOrigin',
-    'isBlockedRequest',
-    'bypass',
-    'scanUrl',
-    'bulkScanUrls',
-    'bulkScanTokens',
-    'scanAddress',
-];
 /**
  * Controller that manages community-maintained lists of approved and unapproved website origins.
  */
@@ -204,17 +194,151 @@ class PhishingController extends base_controller_1.BaseController {
         _PhishingController_isProgressC2DomainBlocklistUpdate.set(this, void 0);
         _PhishingController_transactionControllerStateChangeHandler.set(this, void 0);
         /**
-         * Determines if a given origin is unapproved.
+         * Scan a URL for phishing. It will only scan the hostname of the URL. It also only supports
+         * web URLs.
          *
-         * It is strongly recommended that you call {@link maybeUpdateState} before calling this,
-         * to check whether the phishing configuration is up-to-date. It will be updated if necessary
-         * by calling {@link updateStalelist} or {@link updateHotlist}.
+         * @param url - The URL to scan.
+         * @returns The phishing detection scan result.
+         */
+        this.scanUrl = async (url) => {
+            const [hostname, ok] = (0, utils_1.getHostnameFromWebUrl)(url);
+            if (!ok) {
+                return {
+                    hostname: '',
+                    recommendedAction: types_1.RecommendedAction.None,
+                    fetchError: 'url is not a valid web URL',
+                };
+            }
+            const cachedResult = __classPrivateFieldGet(this, _PhishingController_urlScanCache, "f").get(hostname);
+            if (cachedResult) {
+                return cachedResult;
+            }
+            const apiResponse = await (0, controller_utils_1.safelyExecuteWithTimeout)(async () => {
+                const res = await fetch(`${exports.PHISHING_DETECTION_BASE_URL}/${exports.PHISHING_DETECTION_SCAN_ENDPOINT}?url=${encodeURIComponent(hostname)}`, {
+                    method: 'GET',
+                    headers: {
+                        Accept: 'application/json',
+                    },
+                });
+                if (!res.ok) {
+                    return {
+                        error: `${res.status} ${res.statusText}`,
+                    };
+                }
+                const data = await res.json();
+                return data;
+            }, true, 8000);
+            // Need to do it this way because safelyExecuteWithTimeout returns undefined for both timeouts and errors.
+            if (!apiResponse) {
+                return {
+                    hostname: '',
+                    recommendedAction: types_1.RecommendedAction.None,
+                    fetchError: 'timeout of 8000ms exceeded',
+                };
+            }
+            else if ('error' in apiResponse) {
+                return {
+                    hostname: '',
+                    recommendedAction: types_1.RecommendedAction.None,
+                    fetchError: apiResponse.error,
+                };
+            }
+            const result = {
+                hostname,
+                recommendedAction: apiResponse.recommendedAction,
+            };
+            __classPrivateFieldGet(this, _PhishingController_urlScanCache, "f").set(hostname, result);
+            return result;
+        };
+        /**
+         * Scan multiple URLs for phishing in bulk. It will only scan the hostnames of the URLs.
+         * It also only supports web URLs.
          *
-         * @param origin - Domain origin of a website.
-         * @returns Whether the origin is an unapproved origin.
-         * @deprecated Use {@link testOrigin} instead. This method is exposed for backward compatibility and will be removed in a future release.
+         * @param urls - The URLs to scan.
+         * @returns A mapping of URLs to their phishing detection scan results and errors.
          */
-        this.test = this.testOrigin.bind(this);
+        this.bulkScanUrls = async (urls) => {
+            if (!urls || urls.length === 0) {
+                return {
+                    results: {},
+                    errors: {},
+                };
+            }
+            // we are arbitrarily limiting the number of URLs to 250
+            const MAX_TOTAL_URLS = 250;
+            if (urls.length > MAX_TOTAL_URLS) {
+                return {
+                    results: {},
+                    errors: {
+                        too_many_urls: [
+                            `Maximum of ${MAX_TOTAL_URLS} URLs allowed per request`,
+                        ],
+                    },
+                };
+            }
+            const MAX_URL_LENGTH = 2048;
+            const combinedResponse = {
+                results: {},
+                errors: {},
+            };
+            // Extract hostnames from URLs and check for validity and length constraints
+            const urlsToHostnames = {};
+            const urlsToFetch = [];
+            for (const url of urls) {
+                if (url.length > MAX_URL_LENGTH) {
+                    combinedResponse.errors[url] = [
+                        `URL length must not exceed ${MAX_URL_LENGTH} characters`,
+                    ];
+                    continue;
+                }
+                const [hostname, ok] = (0, utils_1.getHostnameFromWebUrl)(url);
+                if (!ok) {
+                    combinedResponse.errors[url] = ['url is not a valid web URL'];
+                    continue;
+                }
+                // Check if result is already in cache
+                const cachedResult = __classPrivateFieldGet(this, _PhishingController_urlScanCache, "f").get(hostname);
+                if (cachedResult) {
+                    // Use cached result
+                    combinedResponse.results[url] = cachedResult;
+                }
+                else {
+                    // Add to list of URLs to fetch
+                    urlsToHostnames[url] = hostname;
+                    urlsToFetch.push(url);
+                }
+            }
+            // If there are URLs to fetch, process them in batches
+            if (urlsToFetch.length > 0) {
+                // The API has a limit of 50 URLs per request, so we batch the requests
+                const MAX_URLS_PER_BATCH = 50;
+                const batches = [];
+                for (let i = 0; i < urlsToFetch.length; i += MAX_URLS_PER_BATCH) {
+                    batches.push(urlsToFetch.slice(i, i + MAX_URLS_PER_BATCH));
+                }
+                // Process each batch in parallel
+                const batchResults = await Promise.all(batches.map((batchUrls) => __classPrivateFieldGet(this, _PhishingController_processBatch, "f").call(this, batchUrls)));
+                // Merge results and errors from all batches
+                batchResults.forEach((batchResponse) => {
+                    // Add results to cache and combine with response
+                    Object.entries(batchResponse.results).forEach(([url, result]) => {
+                        const hostname = urlsToHostnames[url];
+                        if (hostname) {
+                            __classPrivateFieldGet(this, _PhishingController_urlScanCache, "f").set(hostname, result);
+                        }
+                        combinedResponse.results[url] = result;
+                    });
+                    // Combine errors
+                    Object.entries(batchResponse.errors).forEach(([key, messages]) => {
+                        combinedResponse.errors[key] = [
+                            ...(combinedResponse.errors[key] || []),
+                            ...messages,
+                        ];
+                    });
+                });
+            }
+            return combinedResponse;
+        };
         /**
          * Fetch bulk token scan results from the security alerts API.
          *
@@ -258,6 +382,141 @@ class PhishingController extends base_controller_1.BaseController {
             }
             return apiResponse;
         });
+        /**
+         * Scan an address for security alerts.
+         *
+         * @param chainId - The chain ID in hex format (e.g., '0x1' for Ethereum).
+         * @param address - The address to scan.
+         * @returns The address scan result.
+         */
+        this.scanAddress = async (chainId, address) => {
+            if (!address || !chainId) {
+                return {
+                    result_type: types_1.AddressScanResultType.ErrorResult,
+                    label: '',
+                };
+            }
+            const normalizedChainId = chainId.toLowerCase();
+            const normalizedAddress = address.toLowerCase();
+            const chain = (0, utils_1.resolveChainName)(normalizedChainId);
+            if (!chain) {
+                return {
+                    result_type: types_1.AddressScanResultType.ErrorResult,
+                    label: '',
+                };
+            }
+            const cacheKey = (0, utils_1.buildCacheKey)(normalizedChainId, normalizedAddress);
+            const cachedResult = __classPrivateFieldGet(this, _PhishingController_addressScanCache, "f").get(cacheKey);
+            if (cachedResult) {
+                return {
+                    result_type: cachedResult.result_type,
+                    label: cachedResult.label,
+                };
+            }
+            const apiResponse = await (0, controller_utils_1.safelyExecuteWithTimeout)(async () => {
+                const res = await fetch(`${exports.SECURITY_ALERTS_BASE_URL}${exports.ADDRESS_SCAN_ENDPOINT}`, {
+                    method: 'POST',
+                    headers: {
+                        Accept: 'application/json',
+                        'Content-Type': 'application/json',
+                    },
+                    body: JSON.stringify({
+                        chain,
+                        address: normalizedAddress,
+                    }),
+                });
+                if (!res.ok) {
+                    return {
+                        error: `${res.status} ${res.statusText}`,
+                    };
+                }
+                const data = await res.json();
+                return data;
+            }, true, 5000);
+            if (!apiResponse) {
+                return {
+                    result_type: types_1.AddressScanResultType.ErrorResult,
+                    label: '',
+                };
+            }
+            else if ('error' in apiResponse) {
+                return {
+                    result_type: types_1.AddressScanResultType.ErrorResult,
+                    label: '',
+                };
+            }
+            const result = {
+                result_type: apiResponse.result_type,
+                label: apiResponse.label,
+            };
+            __classPrivateFieldGet(this, _PhishingController_addressScanCache, "f").set(cacheKey, result);
+            return {
+                result_type: apiResponse.result_type,
+                label: apiResponse.label,
+            };
+        };
+        /**
+         * Scan multiple tokens for malicious activity in bulk.
+         *
+         * @param request - The bulk scan request containing chainId and tokens.
+         * @param request.chainId - The chain identifier. Accepts a hex chain ID for
+         * EVM chains (e.g. `'0x1'` for Ethereum) or a chain name for non-EVM chains
+         * (e.g. `'solana'`).
+         * @param request.tokens - Array of token addresses to scan.
+         * @returns A mapping of token addresses to their scan results. For EVM chains,
+         * addresses are lowercased; for non-EVM chains, original casing is preserved.
+         * Tokens that fail to scan are omitted.
+         */
+        this.bulkScanTokens = async (request) => {
+            const { chainId, tokens } = request;
+            if (!tokens || tokens.length === 0) {
+                return {};
+            }
+            const MAX_TOKENS_PER_REQUEST = 100;
+            if (tokens.length > MAX_TOKENS_PER_REQUEST) {
+                console.warn(`Maximum of ${MAX_TOKENS_PER_REQUEST} tokens allowed per request`);
+                return {};
+            }
+            const normalizedChainId = chainId.toLowerCase();
+            const chain = (0, utils_1.resolveChainName)(normalizedChainId);
+            if (!chain) {
+                console.warn(`Unknown chain ID: ${chainId}`);
+                return {};
+            }
+            // EVM addresses are case-insensitive; non-EVM addresses (e.g. Solana
+            // base58) are case-sensitive and must not be lowercased.
+            const caseSensitive = !normalizedChainId.startsWith('0x');
+            // Split tokens into cached results and tokens that need to be fetched
+            const { cachedResults, tokensToFetch } = (0, utils_1.splitCacheHits)(__classPrivateFieldGet(this, _PhishingController_tokenScanCache, "f"), normalizedChainId, tokens, caseSensitive);
+            const results = { ...cachedResults };
+            // If there are tokens to fetch, call the bulk token scan API
+            if (tokensToFetch.length > 0) {
+                const apiResponse = await __classPrivateFieldGet(this, _PhishingController_fetchTokenScanBulkResults, "f").call(this, chain, tokensToFetch);
+                if (apiResponse?.results) {
+                    // Process API results and update cache
+                    for (const tokenAddress of tokensToFetch) {
+                        const normalizedAddress = caseSensitive
+                            ? tokenAddress
+                            : tokenAddress.toLowerCase();
+                        const tokenResult = apiResponse.results[normalizedAddress];
+                        if (tokenResult?.result_type) {
+                            const result = {
+                                result_type: tokenResult.result_type,
+                                chain: tokenResult.chain || normalizedChainId,
+                                address: tokenResult.address || normalizedAddress,
+                            };
+                            // Update cache
+                            const cacheKey = (0, utils_1.buildCacheKey)(normalizedChainId, normalizedAddress, caseSensitive);
+                            __classPrivateFieldGet(this, _PhishingController_tokenScanCache, "f").set(cacheKey, {
+                                result_type: tokenResult.result_type,
+                            });
+                            results[normalizedAddress] = result;
+                        }
+                    }
+                }
+            }
+            return results;
+        };
         /**
          * Process a batch of URLs (up to 50) for phishing detection.
          *
@@ -340,7 +599,7 @@ class PhishingController extends base_controller_1.BaseController {
                 });
             },
         }), "f");
-        this.messenger.registerMethodActionHandlers(this, MESSENGER_EXPOSED_METHODS);
+        __classPrivateFieldGet(this, _PhishingController_instances, "m", _PhishingController_registerMessageHandlers).call(this);
         this.updatePhishingDetector();
         __classPrivateFieldGet(this, _PhishingController_instances, "m", _PhishingController_subscribeToTransactionControllerStateChange).call(this);
     }
@@ -410,7 +669,7 @@ class PhishingController extends base_controller_1.BaseController {
      * @param origin - Domain origin of a website.
      * @returns Whether the origin is an unapproved origin.
      */
-    testOrigin(origin) {
+    test(origin) {
         const punycodeOrigin = (0, punycode_js_1.toASCII)(origin);
         const hostname = (0, utils_1.getHostnameFromUrl)(punycodeOrigin);
         const hostnameWithPaths = hostname + (0, utils_1.getPathnameFromUrl)(origin);
@@ -524,291 +783,16 @@ class PhishingController extends base_controller_1.BaseController {
             __classPrivateFieldSet(this, _PhishingController_inProgressStalelistUpdate, undefined, "f");
         }
     }
-    /**
-     * Scan a URL for phishing. It will only scan the hostname of the URL. It also only supports
-     * web URLs.
-     *
-     * @param url - The URL to scan.
-     * @returns The phishing detection scan result.
-     */
-    async scanUrl(url) {
-        const [hostname, ok] = (0, utils_1.getHostnameFromWebUrl)(url);
-        if (!ok) {
-            return {
-                hostname: '',
-                recommendedAction: types_1.RecommendedAction.None,
-                fetchError: 'url is not a valid web URL',
-            };
-        }
-        const cachedResult = __classPrivateFieldGet(this, _PhishingController_urlScanCache, "f").get(hostname);
-        if (cachedResult) {
-            return cachedResult;
-        }
-        const apiResponse = await (0, controller_utils_1.safelyExecuteWithTimeout)(async () => {
-            const res = await fetch(`${exports.PHISHING_DETECTION_BASE_URL}/${exports.PHISHING_DETECTION_SCAN_ENDPOINT}?url=${encodeURIComponent(hostname)}`, {
-                method: 'GET',
-                headers: {
-                    Accept: 'application/json',
-                },
-            });
-            if (!res.ok) {
-                return {
-                    error: `${res.status} ${res.statusText}`,
-                };
-            }
-            const data = await res.json();
-            return data;
-        }, true, 8000);
-        // Need to do it this way because safelyExecuteWithTimeout returns undefined for both timeouts and errors.
-        if (!apiResponse) {
-            return {
-                hostname: '',
-                recommendedAction: types_1.RecommendedAction.None,
-                fetchError: 'timeout of 8000ms exceeded',
-            };
-        }
-        else if ('error' in apiResponse) {
-            return {
-                hostname: '',
-                recommendedAction: types_1.RecommendedAction.None,
-                fetchError: apiResponse.error,
-            };
-        }
-        const result = {
-            hostname,
-            recommendedAction: apiResponse.recommendedAction,
-        };
-        __classPrivateFieldGet(this, _PhishingController_urlScanCache, "f").set(hostname, result);
-        return result;
-    }
-    /**
-     * Scan multiple URLs for phishing in bulk. It will only scan the hostnames of the URLs.
-     * It also only supports web URLs.
-     *
-     * @param urls - The URLs to scan.
-     * @returns A mapping of URLs to their phishing detection scan results and errors.
-     */
-    async bulkScanUrls(urls) {
-        if (!urls || urls.length === 0) {
-            return {
-                results: {},
-                errors: {},
-            };
-        }
-        // we are arbitrarily limiting the number of URLs to 250
-        const MAX_TOTAL_URLS = 250;
-        if (urls.length > MAX_TOTAL_URLS) {
-            return {
-                results: {},
-                errors: {
-                    too_many_urls: [
-                        `Maximum of ${MAX_TOTAL_URLS} URLs allowed per request`,
-                    ],
-                },
-            };
-        }
-        const MAX_URL_LENGTH = 2048;
-        const combinedResponse = {
-            results: {},
-            errors: {},
-        };
-        // Extract hostnames from URLs and check for validity and length constraints
-        const urlsToHostnames = {};
-        const urlsToFetch = [];
-        for (const url of urls) {
-            if (url.length > MAX_URL_LENGTH) {
-                combinedResponse.errors[url] = [
-                    `URL length must not exceed ${MAX_URL_LENGTH} characters`,
-                ];
-                continue;
-            }
-            const [hostname, ok] = (0, utils_1.getHostnameFromWebUrl)(url);
-            if (!ok) {
-                combinedResponse.errors[url] = ['url is not a valid web URL'];
-                continue;
-            }
-            // Check if result is already in cache
-            const cachedResult = __classPrivateFieldGet(this, _PhishingController_urlScanCache, "f").get(hostname);
-            if (cachedResult) {
-                // Use cached result
-                combinedResponse.results[url] = cachedResult;
-            }
-            else {
-                // Add to list of URLs to fetch
-                urlsToHostnames[url] = hostname;
-                urlsToFetch.push(url);
-            }
-        }
-        // If there are URLs to fetch, process them in batches
-        if (urlsToFetch.length > 0) {
-            // The API has a limit of 50 URLs per request, so we batch the requests
-            const MAX_URLS_PER_BATCH = 50;
-            const batches = [];
-            for (let i = 0; i < urlsToFetch.length; i += MAX_URLS_PER_BATCH) {
-                batches.push(urlsToFetch.slice(i, i + MAX_URLS_PER_BATCH));
-            }
-            // Process each batch in parallel
-            const batchResults = await Promise.all(batches.map((batchUrls) => __classPrivateFieldGet(this, _PhishingController_processBatch, "f").call(this, batchUrls)));
-            // Merge results and errors from all batches
-            batchResults.forEach((batchResponse) => {
-                // Add results to cache and combine with response
-                Object.entries(batchResponse.results).forEach(([url, result]) => {
-                    const hostname = urlsToHostnames[url];
-                    if (hostname) {
-                        __classPrivateFieldGet(this, _PhishingController_urlScanCache, "f").set(hostname, result);
-                    }
-                    combinedResponse.results[url] = result;
-                });
-                // Combine errors
-                Object.entries(batchResponse.errors).forEach(([key, messages]) => {
-                    combinedResponse.errors[key] = [
-                        ...(combinedResponse.errors[key] || []),
-                        ...messages,
-                    ];
-                });
-            });
-        }
-        return combinedResponse;
-    }
-    /**
-     * Scan an address for security alerts.
-     *
-     * @param chainId - The chain ID in hex format (e.g., '0x1' for Ethereum).
-     * @param address - The address to scan.
-     * @returns The address scan result.
-     */
-    async scanAddress(chainId, address) {
-        if (!address || !chainId) {
-            return {
-                result_type: types_1.AddressScanResultType.ErrorResult,
-                label: '',
-            };
-        }
-        const normalizedChainId = chainId.toLowerCase();
-        const normalizedAddress = address.toLowerCase();
-        const chain = (0, utils_1.resolveChainName)(normalizedChainId);
-        if (!chain) {
-            return {
-                result_type: types_1.AddressScanResultType.ErrorResult,
-                label: '',
-            };
-        }
-        const cacheKey = (0, utils_1.buildCacheKey)(normalizedChainId, normalizedAddress);
-        const cachedResult = __classPrivateFieldGet(this, _PhishingController_addressScanCache, "f").get(cacheKey);
-        if (cachedResult) {
-            return {
-                result_type: cachedResult.result_type,
-                label: cachedResult.label,
-            };
-        }
-        const apiResponse = await (0, controller_utils_1.safelyExecuteWithTimeout)(async () => {
-            const res = await fetch(`${exports.SECURITY_ALERTS_BASE_URL}${exports.ADDRESS_SCAN_ENDPOINT}`, {
-                method: 'POST',
-                headers: {
-                    Accept: 'application/json',
-                    'Content-Type': 'application/json',
-                },
-                body: JSON.stringify({
-                    chain,
-                    address: normalizedAddress,
-                }),
-            });
-            if (!res.ok) {
-                return {
-                    error: `${res.status} ${res.statusText}`,
-                };
-            }
-            const data = await res.json();
-            return data;
-        }, true, 5000);
-        if (!apiResponse) {
-            return {
-                result_type: types_1.AddressScanResultType.ErrorResult,
-                label: '',
-            };
-        }
-        else if ('error' in apiResponse) {
-            return {
-                result_type: types_1.AddressScanResultType.ErrorResult,
-                label: '',
-            };
-        }
-        const result = {
-            result_type: apiResponse.result_type,
-            label: apiResponse.label,
-        };
-        __classPrivateFieldGet(this, _PhishingController_addressScanCache, "f").set(cacheKey, result);
-        return {
-            result_type: apiResponse.result_type,
-            label: apiResponse.label,
-        };
-    }
-    /**
-     * Scan multiple tokens for malicious activity in bulk.
-     *
-     * @param request - The bulk scan request containing chainId and tokens.
-     * @param request.chainId - The chain identifier. Accepts a hex chain ID for
-     * EVM chains (e.g. `'0x1'` for Ethereum) or a chain name for non-EVM chains
-     * (e.g. `'solana'`).
-     * @param request.tokens - Array of token addresses to scan.
-     * @returns A mapping of token addresses to their scan results. For EVM chains,
-     * addresses are lowercased; for non-EVM chains, original casing is preserved.
-     * Tokens that fail to scan are omitted.
-     */
-    async bulkScanTokens(request) {
-        const { chainId, tokens } = request;
-        if (!tokens || tokens.length === 0) {
-            return {};
-        }
-        const MAX_TOKENS_PER_REQUEST = 100;
-        if (tokens.length > MAX_TOKENS_PER_REQUEST) {
-            console.warn(`Maximum of ${MAX_TOKENS_PER_REQUEST} tokens allowed per request`);
-            return {};
-        }
-        const normalizedChainId = chainId.toLowerCase();
-        const chain = (0, utils_1.resolveChainName)(normalizedChainId);
-        if (!chain) {
-            console.warn(`Unknown chain ID: ${chainId}`);
-            return {};
-        }
-        // EVM addresses are case-insensitive; non-EVM addresses (e.g. Solana
-        // base58) are case-sensitive and must not be lowercased.
-        const caseSensitive = !normalizedChainId.startsWith('0x');
-        // Split tokens into cached results and tokens that need to be fetched
-        const { cachedResults, tokensToFetch } = (0, utils_1.splitCacheHits)(__classPrivateFieldGet(this, _PhishingController_tokenScanCache, "f"), normalizedChainId, tokens, caseSensitive);
-        const results = { ...cachedResults };
-        // If there are tokens to fetch, call the bulk token scan API
-        if (tokensToFetch.length > 0) {
-            const apiResponse = await __classPrivateFieldGet(this, _PhishingController_fetchTokenScanBulkResults, "f").call(this, chain, tokensToFetch);
-            if (apiResponse?.results) {
-                // Process API results and update cache
-                for (const tokenAddress of tokensToFetch) {
-                    const normalizedAddress = caseSensitive
-                        ? tokenAddress
-                        : tokenAddress.toLowerCase();
-                    const tokenResult = apiResponse.results[normalizedAddress];
-                    if (tokenResult?.result_type) {
-                        const result = {
-                            result_type: tokenResult.result_type,
-                            chain: tokenResult.chain || normalizedChainId,
-                            address: tokenResult.address || normalizedAddress,
-                        };
-                        // Update cache
-                        const cacheKey = (0, utils_1.buildCacheKey)(normalizedChainId, normalizedAddress, caseSensitive);
-                        __classPrivateFieldGet(this, _PhishingController_tokenScanCache, "f").set(cacheKey, {
-                            result_type: tokenResult.result_type,
-                        });
-                        results[normalizedAddress] = result;
-                    }
-                }
-            }
-        }
-        return results;
-    }
 }
 exports.PhishingController = PhishingController;
 _PhishingController_detector = new WeakMap(), _PhishingController_stalelistRefreshInterval = new WeakMap(), _PhishingController_hotlistRefreshInterval = new WeakMap(), _PhishingController_c2DomainBlocklistRefreshInterval = new WeakMap(), _PhishingController_urlScanCache = new WeakMap(), _PhishingController_tokenScanCache = new WeakMap(), _PhishingController_addressScanCache = new WeakMap(), _PhishingController_inProgressHotlistUpdate = new WeakMap(), _PhishingController_inProgressStalelistUpdate = new WeakMap(), _PhishingController_isProgressC2DomainBlocklistUpdate = new WeakMap(), _PhishingController_transactionControllerStateChangeHandler = new WeakMap(), _PhishingController_fetchTokenScanBulkResults = new WeakMap(), _PhishingController_processBatch = new WeakMap(), _PhishingController_instances = new WeakSet(), _PhishingController_subscribeToTransactionControllerStateChange = function _PhishingController_subscribeToTransactionControllerStateChange() {
     this.messenger.subscribe('TransactionController:stateChange', __classPrivateFieldGet(this, _PhishingController_transactionControllerStateChangeHandler, "f"));
+}, _PhishingController_registerMessageHandlers = function _PhishingController_registerMessageHandlers() {
+    this.messenger.registerActionHandler(`${controllerName}:maybeUpdateState`, this.maybeUpdateState.bind(this));
+    this.messenger.registerActionHandler(`${controllerName}:testOrigin`, this.test.bind(this));
+    this.messenger.registerActionHandler(`${controllerName}:bulkScanUrls`, this.bulkScanUrls.bind(this));
+    this.messenger.registerActionHandler(`${controllerName}:bulkScanTokens`, this.bulkScanTokens.bind(this));
+    this.messenger.registerActionHandler(`${controllerName}:scanAddress`, this.scanAddress.bind(this));
 }, _PhishingController_isTransactionPatch = function _PhishingController_isTransactionPatch(patch) {
     const { path } = patch;
     return (path.length === 2 &&