[DONT MERGE] feat: Implement FiatStrategy and getQuotes functionality

[OGPoyraz]

Explanation

This PR introduces FiatStrategy:

• Adds TransactionPayStrategy.Fiat and registers FiatStrategy in strategy resolution.
• Adds Fiat asset mapping by tx type in constants (MMPAY_FIAT_ASSET_ID_BY_TX_TYPE).
• Implements Fiat quote flow in fiat-quotes.ts with relay-first estimation:
  • reads fiatPayment.amountFiat + selected payment method
  • estimates relay fees first
  • requests ramps quotes with adjusted fiat amount
  • returns one combined strategy: fiat quote
• Splits fees in the combined quote:
  • fees.provider = relay provider/swap fee
  • fees.fiatProvider = ramps provider/network fee
  • fees.metaMask = MM fee (100 bps over amountFiat + adjustedAmountFiat)
• Updates totals/metadata sync so fee aggregation stays consistent, including combined metamaskPay.bridgeFeeFiat when fiat provider fee exists.
• Adds package wiring for ramps types/dependency and updates changelog.

References

• Fixes https://github.com/MetaMask/MetaMask-planning/issues/7069

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Introduces a new payment strategy and fee bucket that changes quote selection and total/metrics calculations; incorrect mapping or fee aggregation could affect displayed costs and downstream analytics.

Overview
Adds a new TransactionPayStrategy.Fiat with a FiatStrategy implementation that fetches quotes by first estimating a synthetic Relay quote, then requesting RampsController:getQuotes with an adjusted fiat amount and returning a single combined quote.

Extends transaction-pay state/types to support per-transaction fiatPayment inputs and a new fees.fiatProvider bucket, updates totals calculation and metamaskPay.bridgeFeeFiat metric aggregation to include fiat-provider fees when present, and wires in @metamask/ramps-controller (deps/tsconfig) plus unit tests for the new flow.

^{Written by Cursor Bugbot for commit 23e8bab. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask/​ramps-controller@​0.0.0-use.local

View full report

[socket-security]

Caution

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Network access: npm @metamask/ramps-controller in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: ? → npm/@metamask/ramps-controller@10.2.0 ℹ Read more on: This package | This alert | What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@metamask/ramps-controller@10.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[OGPoyraz]

This currently blocks the PR and will change once we define together with Ramps team.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

[cursor]

MetaMask fee double-counts base fiat amount

High Severity

getMetaMaskFee computes (amountFiat + adjustedAmountFiat) * 100 / 10_000, but adjustedAmountFiat is already defined as amountFiat + relayTotalFeeUsd. This makes the effective formula (2 * amountFiat + relayTotalFeeUsd) * 0.01, double-counting amountFiat. The stated intent is "100 bps" but the effective rate on the user's base amount is significantly higher. Likely the fee base intended here is just adjustedAmountFiat alone (or just amountFiat alone), not their sum.

Additional Locations (1)

• packages/transaction-pay-controller/src/strategy/fiat/fiat-quotes.ts#L81-L82