feat: (controllers) stream swap quotes #6760

micaelae · 2025-09-30T19:34:47Z

Explanation

References

Related to https://github.com/consensys-vertical-apps/va-mmcx-bridge-api/pull/517

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've communicated my changes to consumers by updating changelogs for packages I've changed, highlighting breaking changes as necessary
I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes

Note

Introduces server‑sent events quote streaming and integrates incremental quote updates into the bridge controller polling flow.

Bridge Controller (packages/bridge-controller/src/bridge-controller.ts):
- Add streaming path in _executePoll using new #fetchBridgeQuoteStream, with abort handling, metrics, and state updates.
- Incrementally append quotes to state.quotes; set loading/fetched/error statuses; maintain refresh stats; stop polling per feature flags.
- Track validation failures and errors from stream callbacks.
Fetch Utils (packages/bridge-controller/src/utils/fetch.ts):
- Add fetchBridgeQuoteStream using fetchEventSource (SSE) to stream QuoteResponse items, validate each message, and invoke handlers (onValidQuotesReceived, onValidationFailures, onError).
Dependencies:
- Add @microsoft/fetch-event-source for SSE support; wire new imports.

^{Written by Cursor Bugbot for commit 5f4179b. This will update automatically on new commits. Configure here.}

micaelae · 2025-09-30T19:35:16Z

@metamaskbot publish-preview

packages/bridge-controller/src/utils/fetch.ts

cursor · 2025-09-30T19:39:25Z

packages/bridge-controller/src/utils/fetch.ts

+          return v;
+        })
+        .catch(() => {
+          console.error('===onValidQuotesReceived error');


Bug: Remove Debugging Logs from Function

The fetchBridgeQuoteStream function contains several debug console.log and console.error statements. These appear to be temporary debugging code and should be removed.

Additional Locations (2)

packages/bridge-controller/src/bridge-controller.ts#L748-L749

packages/bridge-controller/src/bridge-controller.ts#L758-L759

packages/bridge-controller/src/utils/fetch.ts

socket-security · 2025-09-30T19:40:43Z

Caution

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Block		`@microsoft/fetch-event-source@2.0.1` has Network access. Module: globalThis["fetch"] Location: Package overview From: packages/bridge-controller/package.json → `npm/@microsoft/fetch-event-source@2.0.1` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@microsoft/fetch-event-source@2.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

micaelae · 2025-09-30T19:48:39Z

@metamaskbot publish-preview

micaelae · 2025-09-30T20:00:01Z

@metamaskbot publish-preview

github-actions · 2025-09-30T20:06:37Z

Preview builds have been published. See these instructions for more information about preview builds.

Expand for full list of packages and versions.

{
  "@metamask-previews/account-tree-controller": "1.3.0-preview-5eac8e7",
  "@metamask-previews/accounts-controller": "33.1.0-preview-5eac8e7",
  "@metamask-previews/address-book-controller": "6.1.1-preview-5eac8e7",
  "@metamask-previews/announcement-controller": "7.0.3-preview-5eac8e7",
  "@metamask-previews/app-metadata-controller": "1.0.0-preview-5eac8e7",
  "@metamask-previews/approval-controller": "7.1.3-preview-5eac8e7",
  "@metamask-previews/assets-controllers": "77.0.2-preview-5eac8e7",
  "@metamask-previews/base-controller": "8.4.0-preview-5eac8e7",
  "@metamask-previews/bridge-controller": "47.2.0-preview-5eac8e7",
  "@metamask-previews/bridge-status-controller": "47.2.0-preview-5eac8e7",
  "@metamask-previews/build-utils": "3.0.3-preview-5eac8e7",
  "@metamask-previews/chain-agnostic-permission": "1.1.1-preview-5eac8e7",
  "@metamask-previews/composable-controller": "11.0.0-preview-5eac8e7",
  "@metamask-previews/controller-utils": "11.14.0-preview-5eac8e7",
  "@metamask-previews/delegation-controller": "0.7.0-preview-5eac8e7",
  "@metamask-previews/earn-controller": "8.0.0-preview-5eac8e7",
  "@metamask-previews/eip-5792-middleware": "1.2.0-preview-5eac8e7",
  "@metamask-previews/eip1193-permission-middleware": "1.0.0-preview-5eac8e7",
  "@metamask-previews/ens-controller": "17.0.1-preview-5eac8e7",
  "@metamask-previews/error-reporting-service": "2.1.0-preview-5eac8e7",
  "@metamask-previews/eth-json-rpc-provider": "5.0.0-preview-5eac8e7",
  "@metamask-previews/foundryup": "1.0.1-preview-5eac8e7",
  "@metamask-previews/gas-fee-controller": "24.0.0-preview-5eac8e7",
  "@metamask-previews/gator-permissions-controller": "0.2.0-preview-5eac8e7",
  "@metamask-previews/json-rpc-engine": "10.1.0-preview-5eac8e7",
  "@metamask-previews/json-rpc-middleware-stream": "8.0.7-preview-5eac8e7",
  "@metamask-previews/keyring-controller": "23.1.0-preview-5eac8e7",
  "@metamask-previews/logging-controller": "6.0.4-preview-5eac8e7",
  "@metamask-previews/message-manager": "13.0.0-preview-5eac8e7",
  "@metamask-previews/messenger": "0.3.0-preview-5eac8e7",
  "@metamask-previews/multichain-account-service": "1.4.0-preview-5eac8e7",
  "@metamask-previews/multichain-api-middleware": "1.2.0-preview-5eac8e7",
  "@metamask-previews/multichain-network-controller": "1.0.0-preview-5eac8e7",
  "@metamask-previews/multichain-transactions-controller": "5.0.0-preview-5eac8e7",
  "@metamask-previews/name-controller": "8.0.3-preview-5eac8e7",
  "@metamask-previews/network-controller": "24.2.0-preview-5eac8e7",
  "@metamask-previews/network-enablement-controller": "2.1.0-preview-5eac8e7",
  "@metamask-previews/notification-services-controller": "18.1.0-preview-5eac8e7",
  "@metamask-previews/permission-controller": "11.0.6-preview-5eac8e7",
  "@metamask-previews/permission-log-controller": "4.0.0-preview-5eac8e7",
  "@metamask-previews/phishing-controller": "14.0.0-preview-5eac8e7",
  "@metamask-previews/polling-controller": "14.0.0-preview-5eac8e7",
  "@metamask-previews/preferences-controller": "20.0.1-preview-5eac8e7",
  "@metamask-previews/profile-sync-controller": "25.1.0-preview-5eac8e7",
  "@metamask-previews/rate-limit-controller": "6.0.3-preview-5eac8e7",
  "@metamask-previews/remote-feature-flag-controller": "1.7.0-preview-5eac8e7",
  "@metamask-previews/sample-controllers": "2.0.0-preview-5eac8e7",
  "@metamask-previews/seedless-onboarding-controller": "4.0.0-preview-5eac8e7",
  "@metamask-previews/selected-network-controller": "24.0.0-preview-5eac8e7",
  "@metamask-previews/shield-controller": "0.2.0-preview-5eac8e7",
  "@metamask-previews/signature-controller": "34.0.0-preview-5eac8e7",
  "@metamask-previews/subscription-controller": "0.5.0-preview-5eac8e7",
  "@metamask-previews/token-search-discovery-controller": "3.3.0-preview-5eac8e7",
  "@metamask-previews/transaction-controller": "60.5.0-preview-5eac8e7",
  "@metamask-previews/user-operation-controller": "39.0.0-preview-5eac8e7"
}

socket-security · 2025-10-10T16:38:37Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@microsoft/fetch-event-source@2.0.1

View full report

…ll to util

micaelae · 2025-10-11T00:51:07Z

@SocketSecurity @microsoft/fetch-event-source@2.0.1

micaelae added 3 commits September 30, 2025 12:33

feat: v1 of quote streaming

c4fe11a

chore: add @microsoft/fetch-event-source dependency

1b9d3e2

test: logging etc

5f4179b

micaelae requested review from a team as code owners September 30, 2025 19:34

micaelae marked this pull request as draft September 30, 2025 19:34

cursor bot reviewed Sep 30, 2025

View reviewed changes

fix: rm TODO

5eac8e7

micaelae and others added 6 commits October 1, 2025 10:28

chore: add logs

9621d5f

Merge branch 'main' into swaps3025-quote-streaming

d19327d

chore: working wip

c699eff

Merge branch 'main' into swaps3025-quote-streaming

25ed707

refactor: clean up

ed5314a

chore: read sseEnabled FF

118d3d0

micaelae force-pushed the swaps3025-quote-streaming branch 2 times, most recently from 45b6fbd to cfbd89b Compare October 7, 2025 21:36

refactor: combine streaming + non-streaming fetch

f3be855

micaelae force-pushed the swaps3025-quote-streaming branch from cfbd89b to f3be855 Compare October 7, 2025 21:38

micaelae added 6 commits October 7, 2025 14:40

fix: fetch unit tests

b87b372

fix: bridge-controller unit tests

4229401

fix: catch mobile errors

954f1ec

refactor: comments

b5bc520

fix: clear quotes on open

9493678

test: sse unit test

6362df7

micaelae changed the title ~~feat: stream swap quotes~~ feat: (controllers) stream swap quotes Oct 9, 2025

micaelae and others added 5 commits October 9, 2025 09:41

Merge branch 'main' into swaps3025-quote-streaming

c5d3353

chore: add clientVersion to fetchQuotesStream call

e200039

fix: rename functions

0ae2c9c

refactor: reset on request change

c5212e4

refactor: unit tests

e679425

micaelae force-pushed the swaps3025-quote-streaming branch 2 times, most recently from 1e904bd to 6ae7634 Compare October 10, 2025 01:24

chore: clean up comments

bcf5a41

micaelae force-pushed the swaps3025-quote-streaming branch from 6ae7634 to bcf5a41 Compare October 10, 2025 16:36

Merge branch 'main' into swaps3025-quote-streaming

04430f8

micaelae added 6 commits October 10, 2025 10:51

fix: more readable error handling

a0ff8e6

refactor: extract quote fee logic to util file

48b1f40

refactor: extract setMinimumBalanceForRentExemptionInLamports snap ca…

b9e02f8

…ll to util

refactor: extract quote sorting to util

303e0e8

refactor: SSE

6396f66

fix: unit tests

ef5ae87

fix: lint error

0eaa63a

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat: (controllers) stream swap quotes #6760

feat: (controllers) stream swap quotes #6760

Uh oh!

micaelae commented Sep 30, 2025 •

edited

Loading

Uh oh!

micaelae commented Sep 30, 2025

Uh oh!

Uh oh!

cursor bot Sep 30, 2025

Uh oh!

Uh oh!

Uh oh!

socket-security bot commented Sep 30, 2025 •

edited

Loading

Uh oh!

micaelae commented Sep 30, 2025

Uh oh!

micaelae commented Sep 30, 2025

Uh oh!

github-actions bot commented Sep 30, 2025

Uh oh!

socket-security bot commented Oct 10, 2025 •

edited

Loading

Uh oh!

micaelae commented Oct 11, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

feat: (controllers) stream swap quotes #6760

Are you sure you want to change the base?

feat: (controllers) stream swap quotes #6760

Uh oh!

Conversation

micaelae commented Sep 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

References

Checklist

Uh oh!

micaelae commented Sep 30, 2025

Uh oh!

Uh oh!

cursor bot Sep 30, 2025

Choose a reason for hiding this comment

Bug: Remove Debugging Logs from Function

Uh oh!

Uh oh!

Uh oh!

socket-security bot commented Sep 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

micaelae commented Sep 30, 2025

Uh oh!

micaelae commented Sep 30, 2025

Uh oh!

github-actions bot commented Sep 30, 2025

Uh oh!

socket-security bot commented Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

micaelae commented Oct 11, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

micaelae commented Sep 30, 2025 •

edited

Loading

socket-security bot commented Sep 30, 2025 •

edited

Loading

socket-security bot commented Oct 10, 2025 •

edited

Loading