Skip to content

feat: init the new assets controller package under FF#39917

Merged
salimtb merged 19 commits intomainfrom
feat/init-new-assets-controller-package
Feb 11, 2026
Merged

feat: init the new assets controller package under FF#39917
salimtb merged 19 commits intomainfrom
feat/init-new-assets-controller-package

Conversation

@salimtb
Copy link
Copy Markdown
Contributor

@salimtb salimtb commented Feb 9, 2026

Description

init the new assets controller package under a feature flag

Open in GitHub Codespaces

Changelog

CHANGELOG entry: init the new assets controller under a feature flag

Related issues

Fixes:

Manual testing steps

  1. Go to this page...

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Medium Risk
Touches core controller initialization wiring and introduces new privileged messenger/action/event delegations plus new LavaMoat allowances; while feature-flagged, misconfiguration could impact startup or asset data fetching/auth token usage.

Overview
Introduces a new AssetsControllerInit that constructs @metamask/assets-controller with a cached createApiPlatformClient, token-detection preference wiring, and an isEnabled gate driven by the assetsUnifyState remote feature flag/version.

Wires the controller into modular controller initialization and the controller messenger registry, and conditionally initializes/exposes AssetsController from metamask-controller.js only when the flag is enabled. Adds new messenger plumbing + unit tests for both init/messenger behavior, updates controller type/state unions, and expands LavaMoat policies plus package.json/yarn.lock to include @metamask/assets-controller (and updated @metamask/core-backend deps such as @tanstack/query-core).

Written by Cursor Bugbot for commit 0ee26f6. This will update automatically on new commits. Configure here.

@salimtb
Copy link
Copy Markdown
Contributor Author

salimtb commented Feb 9, 2026

@metamaskbot update-policies

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Feb 9, 2026

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@socket-security
Copy link
Copy Markdown

socket-security bot commented Feb 9, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​metamask/​assets-controller@​1.0.0751007992100
Added@​metamask/​core-backend@​5.1.09910010092100

View full report

@socket-security
Copy link
Copy Markdown

socket-security bot commented Feb 9, 2026

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

  • @metamask/assets-controller@1.0.0
  • @tanstack/query-core@5.90.20
  • @metamask/core-backend@5.1.0

View full report

@github-actions github-actions bot added the size-L label Feb 9, 2026
@metamaskbotv2
Copy link
Copy Markdown
Contributor

metamaskbotv2 bot commented Feb 9, 2026

✨ Files requiring CODEOWNER review ✨

📜 @MetaMask/policy-reviewers (20 files, +708 -0)
  • 📁 lavamoat/
    • 📁 browserify/
      • 📁 beta/
        • 📄 policy.json +111 -0
      • 📁 experimental/
        • 📄 policy.json +111 -0
      • 📁 flask/
        • 📄 policy.json +111 -0
      • 📁 main/
        • 📄 policy.json +111 -0
        • 📄 policy-override.json +7 -0
    • 📁 build-system/
      • 📄 policy-override.json +7 -0
      • 📄 policy.json +7 -0
    • 📁 webpack/
      • 📁 build/
        • 📄 policy-override.json +7 -0
        • 📄 policy.json +7 -0
      • 📁 mv2/
        • 📁 beta/
          • 📄 policy-override.json +7 -0
          • 📄 policy.json +45 -0
        • 📁 experimental/
          • 📄 policy-override.json +7 -0
          • 📄 policy.json +45 -0
        • 📁 flask/
          • 📄 policy-override.json +7 -0
          • 📄 policy.json +45 -0
        • 📁 main/
          • 📄 policy-override.json +7 -0
          • 📄 policy.json +45 -0
      • 📁 mv3/
        • 📁 beta/
          • 📄 policy-override.json +7 -0
        • 📁 experimental/
          • 📄 policy-override.json +7 -0
        • 📁 flask/
          • 📄 policy-override.json +7 -0

Tip

Follow the policy review process outlined in the LavaMoat Policy Review Process doc before expecting an approval from Policy Reviewers.

@metamaskbot
Copy link
Copy Markdown
Collaborator

Policies updated.
👀 Please review the diff for suspicious new powers.

🧠 Learn how: https://lavamoat.github.io/guides/policy-diff/#what-to-look-for-when-reviewing-a-policy-diff

👀 lavamoat/browserify/beta/policy.json changes differ from main/policy.json policy changes
👀 lavamoat/browserify/experimental/policy.json changes differ from main/policy.json policy changes
👀 lavamoat/browserify/flask/policy.json changes differ from main/policy.json policy changes
👀 lavamoat/webpack/mv2/beta/policy.json changes differ from mv2/main/policy.json policy changes
👀 lavamoat/webpack/mv2/experimental/policy.json changes differ from mv2/main/policy.json policy changes
👀 lavamoat/webpack/mv2/flask/policy.json changes differ from mv2/main/policy.json policy changes
✅ lavamoat/webpack/mv3/beta/policy.json changes match mv3/main/policy.json policy changes
✅ lavamoat/webpack/mv3/experimental/policy.json changes match mv3/main/policy.json policy changes
✅ lavamoat/webpack/mv3/flask/policy.json changes match mv3/main/policy.json policy changes

@salimtb
Copy link
Copy Markdown
Contributor Author

salimtb commented Feb 9, 2026

@metamaskbot update-policies

@metamaskbot
Copy link
Copy Markdown
Collaborator

Policy update failed. You can review the logs or retry the policy update here

@salimtb
Copy link
Copy Markdown
Contributor Author

salimtb commented Feb 9, 2026

@metamaskbot update-policies

@metamaskbot
Copy link
Copy Markdown
Collaborator

Policies updated.
👀 Please review the diff for suspicious new powers.

🧠 Learn how: https://lavamoat.github.io/guides/policy-diff/#what-to-look-for-when-reviewing-a-policy-diff

👀 lavamoat/browserify/beta/policy.json changes differ from main/policy.json policy changes
👀 lavamoat/browserify/experimental/policy.json changes differ from main/policy.json policy changes
👀 lavamoat/browserify/flask/policy.json changes differ from main/policy.json policy changes
👀 lavamoat/webpack/mv2/beta/policy.json changes differ from mv2/main/policy.json policy changes
👀 lavamoat/webpack/mv2/experimental/policy.json changes differ from mv2/main/policy.json policy changes
👀 lavamoat/webpack/mv2/flask/policy.json changes differ from mv2/main/policy.json policy changes
✅ lavamoat/webpack/mv3/beta/policy.json changes match mv3/main/policy.json policy changes
✅ lavamoat/webpack/mv3/experimental/policy.json changes match mv3/main/policy.json policy changes
✅ lavamoat/webpack/mv3/flask/policy.json changes match mv3/main/policy.json policy changes

@metamaskbotv2
Copy link
Copy Markdown
Contributor

metamaskbotv2 bot commented Feb 9, 2026

Builds ready [9b130a6]
UI Startup Metrics (1348 ± 102 ms)
PlatformBuildTypePageMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P 75 (ms)P 95 (ms)
ChromeBrowserifyStandard HomeuiStartup13481173179510214041501
load117098914999212181316
domContentLoaded116498514909112141308
domInteractive2716123192370
firstPaint1346442671191244
backgroundConnect23521328312243258
firstReactRender15106961619
initialActions301741713
loadScripts9437691249909911101
setupStore1272541622
numNetworkReqs221490211583
BrowserifyPower User HomeuiStartup2571140810329191422764892
load12081010197015912451530
domContentLoaded11891001189215312331500
domInteractive3519264373060
firstPaint207731290141256354
backgroundConnect959287849017014262957
firstReactRender23154552433
initialActions103112
loadScripts95176516531489951252
setupStore1564881735
numNetworkReqs1135025640136178
WebpackStandard HomeuiStartup847687114997930983
load740616107498815897
domContentLoaded735612107098806892
domInteractive261694182377
firstPaint1116235358137223
backgroundConnect25174872838
firstReactRender1494451622
initialActions105112
loadScripts732610106897799885
setupStore1163251221
numNetworkReqs2314100231587
WebpackPower User HomeuiStartup1259934279131012911891
load72462312581227171038
domContentLoaded71461712501227081025
domInteractive38182233435109
firstPaint1446550682169304
backgroundConnect16913163072163289
firstReactRender21163732327
initialActions103111
loadScripts71161512411207061014
setupStore1254151518
numNetworkReqs1334727947158211
FirefoxBrowserifyStandard HomeuiStartup15601360236817216061914
load13451175175912614061635
domContentLoaded13441169175812614061635
domInteractive72342354296142
firstPaint------
backgroundConnect5628186225997
firstReactRender1291711213
initialActions102012
loadScripts13201159172412213811586
setupStore166181241441
numNetworkReqs231297221684
BrowserifyPower User HomeuiStartup27982074771963729193559
load15821268638055815762060
domContentLoaded15821268638055815732059
domInteractive164341557189149431
firstPaint------
backgroundConnect3861091322311528967
firstReactRender17143531822
initialActions103122
loadScripts15391234634055315401993
setupStore1207760167132546
numNetworkReqs833816634108147
WebpackStandard HomeuiStartup15861340334024215952024
load13741176311319814081540
domContentLoaded13731176311319814041540
domInteractive101311924189122146
firstPaint------
backgroundConnect54272703752125
firstReactRender14112521418
initialActions104122
loadScripts13481163309919713791504
setupStore217219401265
numNetworkReqs231186201680
WebpackPower User HomeuiStartup28732076857970330203567
load16141309682556316751997
domContentLoaded16141304682556316751996
domInteractive15833772146160473
firstPaint------
backgroundConnect43211714513355131224
firstReactRender231573102532
initialActions217123
loadScripts15701283677856016201969
setupStore17911880202271632
numNetworkReqs823721937100148
📊 Page Load Benchmark Results

Current Commit: 9b130a6 | Date: 2/9/2026

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.05s (±53ms) 🟡 | historical mean value: 1.03s ⬆️ (historical data)
  • domContentLoaded-> current mean value: 731ms (±51ms) 🟢 | historical mean value: 717ms ⬆️ (historical data)
  • firstContentfulPaint-> current mean value: 78ms (±11ms) 🟢 | historical mean value: 77ms ⬆️ (historical data)

📈 Detailed Results

Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.05s 53ms 1.01s 1.35s 1.09s 1.35s
domContentLoaded 731ms 51ms 702ms 1.03s 756ms 1.03s
firstPaint 78ms 11ms 60ms 172ms 84ms 172ms
firstContentfulPaint 78ms 11ms 60ms 172ms 84ms 172ms
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 296.99 KiB (7.41%)
  • ui: 179 Bytes (0%)
  • common: 170 Bytes (0%)

@metamaskbotv2
Copy link
Copy Markdown
Contributor

metamaskbotv2 bot commented Feb 11, 2026

Builds ready [bc34b60]
UI Startup Metrics (1415 ± 114 ms)
PlatformBuildTypePageMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P 75 (ms)P 95 (ms)
ChromeBrowserifyStandard HomeuiStartup14151186188111414751586
load12191002161910012801376
domContentLoaded121399816119912741358
domInteractive2816134202485
firstPaint169701345137213263
backgroundConnect25122746226256285
firstReactRender16113641826
initialActions109113
loadScripts97877213489710381131
setupStore147197191419
numNetworkReqs221487211583
BrowserifyPower User HomeuiStartup3310162910874189840296542
load12241071173811712521484
domContentLoaded12081047172811312431445
domInteractive3319166203460
firstPaint1948031675258295
backgroundConnect1104298491699615353200
firstReactRender23155072437
initialActions103112
loadScripts96881414441059941208
setupStore1353971523
numNetworkReqs904416125110127
WebpackStandard HomeuiStartup8366941124938821003
load72060992089778897
domContentLoaded71460391589773890
domInteractive2616112192377
firstPaint1146084290120238
backgroundConnect26185283041
firstReactRender14103341722
initialActions104112
loadScripts71260191388771885
setupStore1253761226
numNetworkReqs2214100221584
WebpackPower User HomeuiStartup1334948226725114011907
load77967112301117951057
domContentLoaded76765612141117801048
domInteractive41202083138104
firstPaint181751233138222339
backgroundConnect17813762168171302
firstReactRender22173532328
initialActions102112
loadScripts76465412051097781036
setupStore1454481722
numNetworkReqs1436525937160206
FirefoxBrowserifyStandard HomeuiStartup15331329221716815541911
load13321124193013713781600
domContentLoaded13301123192913813761600
domInteractive72331983896137
firstPaint------
backgroundConnect5529166225791
firstReactRender1292621214
initialActions103112
loadScripts13071108189913413521564
setupStore146172191333
numNetworkReqs2312101221687
BrowserifyPower User HomeuiStartup27822094362937130193505
load15301267253821515971964
domContentLoaded15301267253821515971959
domInteractive178531180161201424
firstPaint------
backgroundConnect4131251220251572896
firstReactRender19146681828
initialActions203122
loadScripts14821245250820715251911
setupStore15915751173251467
numNetworkReqs954920432109160
WebpackStandard HomeuiStartup16291403215514816611936
load14051223178310014541581
domContentLoaded14041223178310014541581
domInteractive933023749130166
firstPaint------
backgroundConnect59232133363131
firstReactRender14112731420
initialActions103012
loadScripts1377117516719414311550
setupStore196216301363
numNetworkReqs231292201779
WebpackPower User HomeuiStartup29002234826778530253679
load16521255675372216192208
domContentLoaded16521255675372116192207
domInteractive18851845177173665
firstPaint------
backgroundConnect53111114173057361055
firstReactRender22156782429
initialActions217123
loadScripts16061238671272015582140
setupStore12916700140127415
numNetworkReqs95402294691210
📊 Page Load Benchmark Results

Current Commit: bc34b60 | Date: 2/11/2026

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.04s (±42ms) 🟡 | historical mean value: 1.03s ⬆️ (historical data)
  • domContentLoaded-> current mean value: 727ms (±39ms) 🟢 | historical mean value: 721ms ⬆️ (historical data)
  • firstContentfulPaint-> current mean value: 77ms (±14ms) 🟢 | historical mean value: 76ms ⬆️ (historical data)

📈 Detailed Results

Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.04s 42ms 1.02s 1.39s 1.07s 1.39s
domContentLoaded 727ms 39ms 704ms 1.05s 755ms 1.05s
firstPaint 77ms 14ms 60ms 196ms 88ms 196ms
firstContentfulPaint 77ms 14ms 60ms 196ms 88ms 196ms
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 296.67 KiB (7.4%)
  • ui: 7.5 KiB (0.09%)
  • common: 2.31 KiB (0.02%)

@salimtb salimtb requested a review from naugtur February 11, 2026 13:16
naugtur
naugtur previously approved these changes Feb 11, 2026
Copy link
Copy Markdown
Contributor

@naugtur naugtur left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving policy and verrides on behalf of @MetaMask/policy-reviewers

"nanoid": true
}
},
"@metamask/assets-controller": {
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we're introducing a new package here

"@metamask/snaps-utils>validate-npm-package-name": true
}
},
"@metamask/assets-controller>@metamask/snaps-utils": {
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

snaps-utils version has changed

"browserify>browser-resolve": true
}
},
"@metamask/core-backend>@tanstack/query-core": {
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we use tanstack query on the new package

"define": true
}
},
"@metamask/assets-controller>bignumber.js": {
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we use bignumber js on the new package

@salimtb
Copy link
Copy Markdown
Contributor Author

salimtb commented Feb 11, 2026

LavaMoat policy.json differences (beta / flask / experimental vs main)

TL;DR: The differences between variant policy.json files (e.g. lavamoat/browserify/beta/policy.json vs lavamoat/browserify/main/policy.json) are not introduced by this PR. They come from how LavaMoat generates policy per build variant. This PR only adds overrides in policy-override.json.

What this PR changes

  • policy-override.json only: added/updated the override for @metamask/core-backend>@tanstack/query-core with:
    • document: false
    • document.visibilityState: true
    • addEventListener: false
  • Those overrides are applied in the same way in every variant’s override file (browserify, webpack mv2/mv3, main/beta/flask/experimental).

Why variant policy.json files differ

  • policy.json is generated by LavaMoat per build variant (main, beta, flask, experimental).
  • Each variant has its own build and scan, so the generated policy content and structure can differ (different packages, different globals).
  • That’s expected and pre-existing; it’s not caused by this PR.
  • This PR does not edit the generated policy.json files; it only edits policy-override.json.

Summary

Item This PR
policy-override.json ✅ Updated (override for query-core)
policy.json (main vs beta/flask/experimental) ❌ Not changed; existing per-variant differences remain

So when the bot says “policy.json changes differ from main,” that refers to the existing difference between each variant’s generated policy and main’s, not to new inconsistencies introduced here.

Kriys94
Kriys94 previously approved these changes Feb 11, 2026
Copy link
Copy Markdown
Contributor

@Kriys94 Kriys94 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have few small changes in mind but I will tackle them in another PR

Copy link
Copy Markdown
Contributor

@hjetpoluru hjetpoluru left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @salimtb, could you address the comments from the CursorBot and it could break some other tests.

Copy link
Copy Markdown
Contributor

@naugtur naugtur left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

re-approving the same policy diff on behalf of @MetaMask/policy-reviewers

@metamaskbotv2
Copy link
Copy Markdown
Contributor

metamaskbotv2 bot commented Feb 11, 2026

Builds ready [0ee26f6]
UI Startup Metrics (1382 ± 92 ms)
PlatformBuildTypePageMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P 75 (ms)P 95 (ms)
ChromeBrowserifyStandard HomeuiStartup1382117316509214491515
load1199100114108712611339
domContentLoaded119199314028812561335
domInteractive271695182379
firstPaint146651108118193228
backgroundConnect24221740123247275
firstReactRender16104551826
initialActions105113
loadScripts96477311698610281091
setupStore146164161525
numNetworkReqs231590201580
BrowserifyPower User HomeuiStartup2322146310073129022494789
load12461090219818412831677
domContentLoaded12281075218718012761631
domInteractive40201772939113
firstPaint217731597171279362
backgroundConnect647291767010183712542
firstReactRender23166672534
initialActions104111
loadScripts976830192617410161352
setupStore1776081831
numNetworkReqs1194823845147214
WebpackStandard HomeuiStartup806685103482857957
load70160287879758852
domContentLoaded69559887378753840
domInteractive251589182278
firstPaint1125937960145202
backgroundConnect25185462839
firstReactRender14102541720
initialActions103112
loadScripts69359687077751837
setupStore1163851120
numNetworkReqs231598211582
WebpackPower User HomeuiStartup1208868235319712691541
load7025871126105705976
domContentLoaded6915791120105693965
domInteractive35191652733108
firstPaint1426334469188273
backgroundConnect16713938441162217
firstReactRender22164752331
initialActions105111
loadScripts6885781113103691953
setupStore1142241318
numNetworkReqs1355328448158200
FirefoxBrowserifyStandard HomeuiStartup15871367232821216222050
load13671172210017814021661
domContentLoaded13651166209317813971661
domInteractive72343065286172
firstPaint------
backgroundConnect5528173235796
firstReactRender12102321315
initialActions102012
loadScripts13421148206817413781619
setupStore1366091329
numNetworkReqs241494211787
BrowserifyPower User HomeuiStartup26492078428435627323374
load15011188232421115542013
domContentLoaded15011187232421115542013
domInteractive13135564108126410
firstPaint------
backgroundConnect3411041087285409954
firstReactRender18146481722
initialActions107122
loadScripts14651159229420615261957
setupStore1408787197136676
numNetworkReqs763914832101134
WebpackStandard HomeuiStartup16371311226314816871938
load14101191171211214611636
domContentLoaded14091191171211214561636
domInteractive822823144117158
firstPaint------
backgroundConnect55221572860134
firstReactRender15115351521
initialActions103122
loadScripts13811173165710514341567
setupStore15682141346
numNetworkReqs241386191878
WebpackPower User HomeuiStartup26641971427641928523447
load15091211312829015582098
domContentLoaded15081210312829015582097
domInteractive14130823144125455
firstPaint------
backgroundConnect3021121406247349880
firstReactRender21155972332
initialActions207123
loadScripts14591164309926015251858
setupStore1678797218195706
numNetworkReqs77392163599138
📊 Page Load Benchmark Results

Current Commit: 0ee26f6 | Date: 2/11/2026

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.05s (±77ms) 🟡 | historical mean value: 1.04s ⬆️ (historical data)
  • domContentLoaded-> current mean value: 738ms (±75ms) 🟢 | historical mean value: 724ms ⬆️ (historical data)
  • firstContentfulPaint-> current mean value: 77ms (±12ms) 🟢 | historical mean value: 78ms ⬇️ (historical data)

📈 Detailed Results

Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.05s 77ms 1.00s 1.32s 1.30s 1.32s
domContentLoaded 738ms 75ms 695ms 1.01s 971ms 1.01s
firstPaint 77ms 12ms 60ms 184ms 84ms 184ms
firstContentfulPaint 77ms 12ms 60ms 184ms 84ms 184ms
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 297.66 KiB (7.43%)
  • ui: 7.53 KiB (0.09%)
  • common: 3.55 KiB (0.03%)

@salimtb salimtb enabled auto-merge February 11, 2026 15:56
@salimtb salimtb added this pull request to the merge queue Feb 11, 2026
Merged via the queue into main with commit c1e8825 Feb 11, 2026
176 checks passed
@salimtb salimtb deleted the feat/init-new-assets-controller-package branch February 11, 2026 16:30
@github-actions github-actions bot locked and limited conversation to collaborators Feb 11, 2026
@metamaskbot metamaskbot added the release-13.19.0 Issue or pull request that will be included in release 13.19.0 label Feb 11, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

release-13.19.0 Issue or pull request that will be included in release 13.19.0 size-L team-assets

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants