feat(token): vertical slice — pure-Python domain + 5 thin v1 routes

app/domain/token/ (NO FastAPI, pure business logic):
models.py Pydantic v2: Token, TokenDetail, TokenHolder, TokenLiquidity,
TokenRisk, TokenScanRequest, TokenScanResult, RiskLevel
analyzer.py PURE risk scoring (no I/O) — honeypot, concentration, liquidity
repository.py Async data fetch via Databus
service.py Composes analyzer + repository
__init__.py Public API

app/api/v1/public/token.py (5 endpoints, <100 lines):
GET /api/v1/token/{address}
GET /api/v1/token/{address}/holders
GET /api/v1/token/{address}/liquidity
GET /api/v1/token/{address}/risk
POST /api/v1/token/scan

tests/unit/domain/token/test_service.py — 14/14 PASS:
Analyzer: 10 tests (zero risk, honeypot, cannot sell, owner change,
concentrated holders, moderate concentration, low liquidity,
unlocked liquidity, score cap, RiskLevel enum).
Service: 4 tests (detail pass-through, risk composes holders+liquidity,
scan combines detail+risk, request normalization).

PATTERN PROVEN 3RD TIME: alerts, wallet, token — same shape works.
Backend healthy, 5 new token routes in openapi.
Stranglerfig with legacy /api/v1/token/* — both work side-by-side.

Total: 3 domains migrated, 35 unit tests passing, 12 v1 routes wired.

backend/app/api/v1/__init__.py

@@ -41,6 +41,10 @@ from app.api.v1.public.wallet import router as wallet_router  # noqa: E402
 
 api_v1_router.append(wallet_router)
 
+from app.api.v1.public.token import router as token_router  # noqa: E402
+
+api_v1_router.append(token_router)
+
 
 def build_v1_router() -> APIRouter:
     """Construct the v1 aggregator with all migrated routes mounted."""

backend/app/api/v1/public/token.py

@@ -0,0 +1,78 @@
+"""V1 token route — thin HTTP layer over app.domain.token."""
+from __future__ import annotations
+
+from typing import Annotated, Any
+
+from fastapi import APIRouter, Depends, Query
+
+from app.core.auth import get_optional_user
+from app.domain.token import (
+    TokenDetail,
+    TokenRisk,
+    TokenScanRequest,
+    TokenScanResult,
+    TokenService,
+)
+from app.models import PaginatedResponse
+
+router = APIRouter(prefix="/api/v1/token", tags=["token"])
+
+
+def _service() -> TokenService:
+    return TokenService()
+
+
+@router.get("/{address}", response_model=TokenDetail)
+async def get_detail(
+    address: str,
+    svc: Annotated[TokenService, Depends(_service)],
+    chain: str = Query(default="solana"),
+) -> TokenDetail:
+    """Token metadata + supply + verification."""
+    return await svc.get_detail(address, chain=chain)
+
+
+@router.get("/{address}/holders", response_model=PaginatedResponse)
+async def get_holders(
+    address: str,
+    svc: Annotated[TokenService, Depends(_service)],
+    chain: str = Query(default="solana"),
+    limit: int = Query(default=100, ge=1, le=500),
+) -> PaginatedResponse:
+    """Top token holders."""
+    holders = await svc.get_holders(address, chain=chain, limit=limit)
+    return PaginatedResponse(
+        items=[h.model_dump(mode="json") for h in holders],
+        total=len(holders),
+    )
+
+
+@router.get("/{address}/liquidity", response_model=dict)
+async def get_liquidity(
+    address: str,
+    svc: Annotated[TokenService, Depends(_service)],
+    chain: str = Query(default="solana"),
+) -> dict:
+    """Token liquidity + pool info."""
+    liq = await svc.get_liquidity(address, chain=chain)
+    return liq.model_dump(mode="json")
+
+
+@router.get("/{address}/risk", response_model=TokenRisk)
+async def get_risk(
+    address: str,
+    svc: Annotated[TokenService, Depends(_service)],
+    chain: str = Query(default="solana"),
+) -> TokenRisk:
+    """Combined risk: holders + liquidity + heuristics."""
+    return await svc.get_risk(address, chain=chain)
+
+
+@router.post("/scan", response_model=TokenScanResult)
+async def scan(
+    req: TokenScanRequest,
+    svc: Annotated[TokenService, Depends(_service)],
+    _user: Annotated[dict[str, Any] | None, Depends(get_optional_user)],
+) -> TokenScanResult:
+    """Full token scan. Multi-module. Freemium rate-limit applied in legacy router."""
+    return await svc.scan(req)

backend/app/domain/token/__init__.py

@@ -0,0 +1,40 @@
+"""Token domain — token info, holders, liquidity, deployer, risk.
+
+Public API:
+    from app.domain.token import (
+        Token, TokenDetail, TokenHolder, TokenLiquidity, TokenRisk,
+        TokenScanRequest, TokenScanResult, RiskLevel,
+        TokenAnalyzer, TokenService, TokenRepository,
+    )
+
+Domain is pure Python. NO FastAPI. NO HTTP. NO logging.basicConfig.
+"""
+from __future__ import annotations
+
+from app.domain.token.analyzer import TokenAnalyzer
+from app.domain.token.models import (
+    RiskLevel,
+    Token,
+    TokenDetail,
+    TokenHolder,
+    TokenLiquidity,
+    TokenRisk,
+    TokenScanRequest,
+    TokenScanResult,
+)
+from app.domain.token.repository import TokenRepository
+from app.domain.token.service import TokenService
+
+__all__ = [
+    "Token",
+    "TokenDetail",
+    "TokenHolder",
+    "TokenLiquidity",
+    "TokenRisk",
+    "TokenScanRequest",
+    "TokenScanResult",
+    "RiskLevel",
+    "TokenAnalyzer",
+    "TokenRepository",
+    "TokenService",
+]

backend/app/domain/token/analyzer.py

@@ -0,0 +1,103 @@
+"""Pure-Python token risk analysis. No I/O."""
+from __future__ import annotations
+
+from app.domain.token.models import (
+    RiskLevel,
+    TokenHolder,
+    TokenLiquidity,
+    TokenRisk,
+)
+
+
+class TokenAnalyzer:
+    """Pure logic — given holders + liquidity + flags, return risk."""
+
+    @staticmethod
+    def compute_risk(
+        address: str,
+        chain: str,
+        holders: list[TokenHolder] | None = None,
+        liquidity: TokenLiquidity | None = None,
+        honeypot: bool = False,
+        can_sell: bool = True,
+        can_buy: bool = True,
+        owner_change_balance: bool = False,
+        transfer_pausable: bool = False,
+    ) -> TokenRisk:
+        """Compute TokenRisk from raw inputs. Pure function of inputs."""
+        flags: list[dict] = []
+        score = 0
+
+        # Honeypot = critical
+        if honeypot or not can_sell:
+            score += 100
+            flags.append({"code": "honeypot", "severity": "critical", "message": "Cannot sell — likely honeypot."})
+
+        # Owner can change balance = rug pull risk
+        if owner_change_balance:
+            score += 50
+            flags.append({"code": "owner_change_balance", "severity": "critical", "message": "Owner can modify balances."})
+
+        # Transfer pausable = rug risk
+        if transfer_pausable:
+            score += 30
+            flags.append({"code": "transfer_pausable", "severity": "high", "message": "Transfers can be paused."})
+
+        # Holder concentration
+        if holders:
+            top_holder_pct = max((h.percentage for h in holders), default=0)
+            if top_holder_pct > 50:
+                score += 30
+                flags.append({
+                    "code": "concentrated_holders",
+                    "severity": "high",
+                    "message": f"Top holder owns {top_holder_pct:.1f}% of supply.",
+                })
+            elif top_holder_pct > 25:
+                score += 15
+                flags.append({
+                    "code": "moderate_concentration",
+                    "severity": "medium",
+                    "message": f"Top holder owns {top_holder_pct:.1f}% of supply.",
+                })
+
+            # Locked holders reduce risk
+            locked_pct = sum(h.percentage for h in holders if h.is_locked)
+            if locked_pct < 20 and len(holders) < 100:
+                score += 5
+                flags.append({
+                    "code": "few_holders",
+                    "severity": "low",
+                    "message": f"Only {len(holders)} holders, {locked_pct:.1f}% locked.",
+                })
+
+        # Liquidity lock
+        if liquidity:
+            if liquidity.total_liquidity_usd < 1000:
+                score += 20
+                flags.append({
+                    "code": "low_liquidity",
+                    "severity": "high",
+                    "message": f"Total liquidity only ${liquidity.total_liquidity_usd:.0f}.",
+                })
+            elif liquidity.locked_percentage < 50:
+                score += 15
+                flags.append({
+                    "code": "liquidity_unlocked",
+                    "severity": "medium",
+                    "message": f"Only {liquidity.locked_percentage:.1f}% of liquidity locked.",
+                })
+
+        score = max(0, min(100, score))
+        return TokenRisk(
+            address=address,
+            chain=chain,
+            risk_score=score,
+            risk_level=RiskLevel.from_score(score),
+            flags=flags,
+            honeypot=honeypot,
+            can_sell=can_sell,
+            can_buy=can_buy,
+            owner_change_balance=owner_change_balance,
+            transfer_pausable=transfer_pausable,
+        )

backend/app/domain/token/models.py

@@ -0,0 +1,127 @@
+"""Pydantic v2 models for the token domain.
+
+No FastAPI imports. Pure data shapes.
+"""
+from __future__ import annotations
+
+from datetime import datetime
+from enum import Enum
+from typing import Any
+
+from pydantic import BaseModel, ConfigDict, Field, field_validator
+
+
+class RiskLevel(str, Enum):
+    """Token risk classification."""
+
+    LOW = "low"
+    MEDIUM = "medium"
+    HIGH = "high"
+    CRITICAL = "critical"
+
+    @classmethod
+    def from_score(cls, score: int) -> "RiskLevel":
+        if score < 20:
+            return cls.LOW
+        if score < 50:
+            return cls.MEDIUM
+        if score < 80:
+            return cls.HIGH
+        return cls.CRITICAL
+
+
+class Token(BaseModel):
+    """Token identity."""
+
+    model_config = ConfigDict(str_strip_whitespace=True)
+
+    address: str = Field(..., min_length=1, max_length=256)
+    chain: str = Field(default="solana")
+    name: str = ""
+    symbol: str = ""
+    decimals: int = 9
+
+
+class TokenDetail(BaseModel):
+    """Full token details — metadata + supply + verification."""
+
+    address: str
+    chain: str
+    name: str = ""
+    symbol: str = ""
+    decimals: int = 9
+    total_supply: float = 0.0
+    circulating_supply: float = 0.0
+    holders: int = 0
+    verified: bool = False
+    metadata: dict[str, Any] = Field(default_factory=dict)
+    fetched_at: datetime = Field(default_factory=datetime.utcnow)
+
+
+class TokenHolder(BaseModel):
+    """A token holder entry."""
+
+    address: str
+    balance: float = 0.0
+    percentage: float = 0.0
+    label: str | None = None
+    is_contract: bool = False
+    is_locked: bool = False
+
+
+class TokenLiquidity(BaseModel):
+    """Token liquidity summary."""
+
+    address: str
+    chain: str
+    total_liquidity_usd: float = 0.0
+    pools: list[dict[str, Any]] = Field(default_factory=list)
+    locked_percentage: float = 0.0
+    fetched_at: datetime = Field(default_factory=datetime.utcnow)
+
+
+class TokenRisk(BaseModel):
+    """Token risk assessment."""
+
+    address: str
+    chain: str
+    risk_score: int = Field(default=0, ge=0, le=100)
+    risk_level: RiskLevel
+    flags: list[dict[str, Any]] = Field(default_factory=list)
+    honeypot: bool = False
+    can_sell: bool = True
+    can_buy: bool = True
+    take_back: bool = False
+    owner_change_balance: bool = False
+    transfer_pausable: bool = False
+    analyzed_at: datetime = Field(default_factory=datetime.utcnow)
+
+
+class TokenScanRequest(BaseModel):
+    """Request body for the token scan endpoint."""
+
+    model_config = ConfigDict(str_strip_whitespace=True)
+
+    address: str = Field(..., min_length=1, max_length=256)
+    chain: str = Field(default="solana")
+    tier: str = Field(default="free")
+
+    @field_validator("chain", "tier")
+    @classmethod
+    def _lowercase(cls, v: str) -> str:
+        return v.lower().strip()
+
+
+class TokenScanResult(BaseModel):
+    """Full token scan result."""
+
+    address: str
+    chain: str
+    safety_score: float = 100.0
+    risk_score: int = 0
+    risk_level: RiskLevel
+    risk_flags: list[str] = Field(default_factory=list)
+    warnings: list[str] = Field(default_factory=list)
+    modules_run: list[str] = Field(default_factory=list)
+    metadata: dict[str, Any] = Field(default_factory=dict)
+    scanned_at: datetime = Field(default_factory=datetime.utcnow)

backend/app/domain/token/repository.py

@@ -0,0 +1,94 @@
+"""Repository — async data fetch for token info via Databus."""
+from __future__ import annotations
+
+from typing import Any
+
+from app.core.logging import get_logger
+from app.domain.token.models import (
+    TokenDetail,
+    TokenHolder,
+    TokenLiquidity,
+)
+
+log = get_logger(__name__)
+
+
+class TokenRepository:
+    """Async data access for token info via Databus."""
+
+    async def get_detail(self, address: str, chain: str) -> TokenDetail:
+        """Fetch token metadata + supply."""
+        try:
+            from app.databus.client import get_databus_client
+
+            client = get_databus_client()
+            raw = await client.get_token_info(address, chain=chain)
+            return self._parse_detail(address, chain, raw or {})
+        except Exception as e:
+            log.warning("token_detail_fetch_failed", address=address[:12], error=str(e))
+            return TokenDetail(address=address, chain=chain)
+
+    async def get_holders(
+        self,
+        address: str,
+        chain: str,
+        limit: int = 100,
+    ) -> list[TokenHolder]:
+        """Fetch top holders."""
+        try:
+            from app.databus.client import get_databus_client
+
+            client = get_databus_client()
+            raw = await client.get_token_holders(address, chain=chain, limit=limit)
+            return [self._parse_holder(h) for h in (raw or [])]
+        except Exception as e:
+            log.warning("token_holders_fetch_failed", address=address[:12], error=str(e))
+            return []
+
+    async def get_liquidity(self, address: str, chain: str) -> TokenLiquidity:
+        """Fetch liquidity + pool info."""
+        try:
+            from app.databus.client import get_databus_client
+
+            client = get_databus_client()
+            raw = await client.get_token_liquidity(address, chain=chain)
+            return self._parse_liquidity(address, chain, raw or {})
+        except Exception as e:
+            log.warning("token_liquidity_fetch_failed", address=address[:12], error=str(e))
+            return TokenLiquidity(address=address, chain=chain)
+
+    @staticmethod
+    def _parse_detail(address: str, chain: str, raw: dict[str, Any]) -> TokenDetail:
+        return TokenDetail(
+            address=address,
+            chain=chain,
+            name=raw.get("name", ""),
+            symbol=raw.get("symbol", ""),
+            decimals=int(raw.get("decimals", 9) or 9),
+            total_supply=float(raw.get("total_supply", 0) or 0),
+            circulating_supply=float(raw.get("circulating_supply", 0) or 0),
+            holders=int(raw.get("holders", 0) or 0),
+            verified=bool(raw.get("verified", False)),
+            metadata=raw.get("metadata", {}) or {},
+        )
+
+    @staticmethod
+    def _parse_holder(raw: dict[str, Any]) -> TokenHolder:
+        return TokenHolder(
+            address=raw.get("address", ""),
+            balance=float(raw.get("balance", 0) or 0),
+            percentage=float(raw.get("percentage", raw.get("pct", 0)) or 0),
+            label=raw.get("label"),
+            is_contract=bool(raw.get("is_contract", False)),
+            is_locked=bool(raw.get("is_locked", False)),
+        )
+
+    @staticmethod
+    def _parse_liquidity(address: str, chain: str, raw: dict[str, Any]) -> TokenLiquidity:
+        return TokenLiquidity(
+            address=address,
+            chain=chain,
+            total_liquidity_usd=float(raw.get("total_usd", 0) or 0),
+            pools=raw.get("pools", []) or [],
+            locked_percentage=float(raw.get("locked_percentage", 0) or 0),
+        )

backend/app/domain/token/service.py

@@ -0,0 +1,109 @@
+"""Service — business logic for token info, risk, and scans."""
+from __future__ import annotations
+
+from app.core.logging import get_logger
+from app.domain.token.analyzer import TokenAnalyzer
+from app.domain.token.models import (
+    TokenDetail,
+    TokenHolder,
+    TokenLiquidity,
+    TokenRisk,
+    TokenScanRequest,
+    TokenScanResult,
+)
+from app.domain.token.repository import TokenRepository
+
+log = get_logger(__name__)
+
+
+class TokenService:
+    """Orchestrates token data fetch and analysis."""
+
+    def __init__(
+        self,
+        repo: TokenRepository | None = None,
+        analyzer: TokenAnalyzer | None = None,
+    ) -> None:
+        self._repo = repo or TokenRepository()
+        self._analyzer = analyzer or TokenAnalyzer()
+
+    async def get_detail(self, address: str, chain: str = "solana") -> TokenDetail:
+        return await self._repo.get_detail(address, chain)
+
+    async def get_holders(
+        self,
+        address: str,
+        chain: str = "solana",
+        limit: int = 100,
+    ) -> list[TokenHolder]:
+        return await self._repo.get_holders(address, chain, limit=limit)
+
+    async def get_liquidity(self, address: str, chain: str = "solana") -> TokenLiquidity:
+        return await self._repo.get_liquidity(address, chain)
+
+    async def get_risk(self, address: str, chain: str = "solana") -> TokenRisk:
+        """Combined risk: holders + liquidity + heuristics."""
+        log.info("token_risk_started", address=address[:12], chain=chain)
+        holders = await self._repo.get_holders(address, chain, limit=20)
+        liquidity = await self._repo.get_liquidity(address, chain)
+        risk = self._analyzer.compute_risk(
+            address=address,
+            chain=chain,
+            holders=holders,
+            liquidity=liquidity,
+        )
+        log.info(
+            "token_risk_complete",
+            address=address[:12],
+            risk_score=risk.risk_score,
+            risk_level=risk.risk_level.value,
+        )
+        return risk
+
+    async def scan(self, req: TokenScanRequest) -> TokenScanResult:
+        """Full token scan. Multi-module. Used for free-tier scanner."""
+        log.info("token_scan_started", address=req.address[:12], chain=req.chain, tier=req.tier)
+        detail = await self._repo.get_detail(req.address, req.chain)
+        risk = await self.get_risk(req.address, req.chain)
+
+        # Convert risk flags to the legacy format (list of strings)
+        risk_flags: list[str] = []
+        warnings: list[str] = []
+        for flag in risk.flags:
+            code = flag.get("code", "")
+            message = flag.get("message", "")
+            if code:
+                risk_flags.append(code)
+            if message:
+                warnings.append(message)
+
+        # Heuristic safety score (inverse of risk, 0-100)
+        safety_score = max(0.0, 100.0 - float(risk.risk_score))
+
+        result = TokenScanResult(
+            address=req.address,
+            chain=req.chain,
+            safety_score=safety_score,
+            risk_score=risk.risk_score,
+            risk_level=risk.risk_level,
+            risk_flags=risk_flags,
+            warnings=warnings,
+            modules_run=["analyzer", "holders", "liquidity"],
+            metadata={
+                "name": detail.name,
+                "symbol": detail.symbol,
+                "decimals": detail.decimals,
+                "total_supply": detail.total_supply,
+                "verified": detail.verified,
+            },
+        )
+        log.info(
+            "token_scan_complete",
+            address=req.address[:12],
+            safety_score=safety_score,
+            risk_level=risk.risk_level.value,
+        )
+        return result
+
+    def count_tokens(self) -> int:
+        return self.repo.count()

backend/tests/unit/domain/token/test_service.py

@@ -0,0 +1,152 @@
+"""Unit tests for the token domain.
+
+Pure-Python tests. No FastAPI. No HTTP.
+"""
+from __future__ import annotations
+
+from unittest.mock import AsyncMock
+
+import pytest
+
+from app.domain.token import (
+    RiskLevel,
+    TokenAnalyzer,
+    TokenHolder,
+    TokenLiquidity,
+    TokenRepository,
+    TokenScanRequest,
+    TokenService,
+)
+
+
+@pytest.fixture
+def fake_repo() -> AsyncMock:
+    repo = AsyncMock(spec=TokenRepository)
+    return repo
+
+
+@pytest.fixture
+def service(fake_repo: AsyncMock) -> TokenService:
+    return TokenService(repo=fake_repo, analyzer=TokenAnalyzer())
+
+
+# ── TokenAnalyzer (pure logic) ──────────────────────────────────────
+
+
+def test_analyzer_zero_inputs_zero_risk():
+    r = TokenAnalyzer.compute_risk("0xtoken", "solana")
+    assert r.risk_score == 0
+    assert r.risk_level == RiskLevel.LOW
+    assert r.honeypot is False
+    assert r.can_sell is True
+
+
+def test_analyzer_honeypot_is_critical():
+    r = TokenAnalyzer.compute_risk("0xtoken", "solana", honeypot=True)
+    assert r.risk_score == 100
+    assert r.risk_level == RiskLevel.CRITICAL
+    assert any(f["code"] == "honeypot" for f in r.flags)
+
+
+def test_analyzer_cant_sell_is_critical():
+    r = TokenAnalyzer.compute_risk("0xtoken", "solana", can_sell=False)
+    assert r.risk_score == 100
+    assert r.honeypot is False
+    assert r.can_sell is False
+
+
+def test_analyzer_owner_change_balance_critical():
+    r = TokenAnalyzer.compute_risk("0xtoken", "solana", owner_change_balance=True)
+    assert r.risk_score == 50
+    assert r.risk_level == RiskLevel.HIGH
+
+
+def test_analyzer_concentrated_holders_high():
+    holders = [TokenHolder(address="0xa", percentage=70.0)]
+    r = TokenAnalyzer.compute_risk("0xtoken", "solana", holders=holders)
+    assert any(f["code"] == "concentrated_holders" for f in r.flags)
+    assert r.risk_score >= 30
+
+
+def test_analyzer_moderate_concentration():
+    holders = [TokenHolder(address="0xa", percentage=30.0)]
+    r = TokenAnalyzer.compute_risk("0xtoken", "solana", holders=holders)
+    assert any(f["code"] == "moderate_concentration" for f in r.flags)
+
+
+def test_analyzer_low_liquidity_flag():
+    liq = TokenLiquidity(address="0xt", chain="solana", total_liquidity_usd=500.0)
+    r = TokenAnalyzer.compute_risk("0xtoken", "solana", liquidity=liq)
+    assert any(f["code"] == "low_liquidity" for f in r.flags)
+
+
+def test_analyzer_liquidity_unlocked():
+    liq = TokenLiquidity(address="0xt", chain="solana", total_liquidity_usd=100000.0, locked_percentage=10.0)
+    r = TokenAnalyzer.compute_risk("0xtoken", "solana", liquidity=liq)
+    assert any(f["code"] == "liquidity_unlocked" for f in r.flags)
+
+
+def test_analyzer_score_capped_at_100():
+    holders = [TokenHolder(address="0xa", percentage=80.0)]
+    liq = TokenLiquidity(address="0xt", chain="solana", total_liquidity_usd=100.0, locked_percentage=0.0)
+    r = TokenAnalyzer.compute_risk(
+        "0xtoken", "solana",
+        holders=holders, liquidity=liq,
+        honeypot=True, owner_change_balance=True, transfer_pausable=True,
+    )
+    assert r.risk_score == 100
+
+
+def test_risk_level_from_score():
+    assert RiskLevel.from_score(0) == RiskLevel.LOW
+    assert RiskLevel.from_score(50) == RiskLevel.HIGH
+    assert RiskLevel.from_score(80) == RiskLevel.CRITICAL
+
+
+# ── TokenService (composed) ─────────────────────────────────────────
+
+
+async def test_service_get_detail_passes_through(service, fake_repo):
+    from app.domain.token.models import TokenDetail
+    expected = TokenDetail(address="0xt", chain="solana", name="Test", symbol="TST")
+    fake_repo.get_detail = AsyncMock(return_value=expected)
+    result = await service.get_detail("0xt", "solana")
+    assert result is expected
+
+
+async def test_service_get_risk_composes_holder_and_liquidity(service, fake_repo):
+    fake_repo.get_holders = AsyncMock(return_value=[
+        TokenHolder(address="0xa", percentage=10.0),
+        TokenHolder(address="0xb", percentage=5.0),
+    ])
+    fake_repo.get_liquidity = AsyncMock(return_value=TokenLiquidity(
+        address="0xt", chain="solana", total_liquidity_usd=50000.0, locked_percentage=80.0,
+    ))
+    r = await service.get_risk("0xt", "solana")
+    assert r.risk_level in (RiskLevel.LOW, RiskLevel.MEDIUM)
+    fake_repo.get_holders.assert_awaited_once()
+    fake_repo.get_liquidity.assert_awaited_once()
+
+
+async def test_service_scan_combines_detail_and_risk(service, fake_repo):
+    from app.domain.token.models import TokenDetail
+    fake_repo.get_detail = AsyncMock(return_value=TokenDetail(
+        address="0xt", chain="solana", name="Test", symbol="TST", verified=True,
+    ))
+    fake_repo.get_holders = AsyncMock(return_value=[])
+    fake_repo.get_liquidity = AsyncMock(return_value=TokenLiquidity(
+        address="0xt", chain="solana", total_liquidity_usd=100000.0, locked_percentage=90.0,
+    ))
+    req = TokenScanRequest(address="0xt", chain="solana", tier="pro")
+    result = await service.scan(req)
+    assert result.address == "0xt"
+    assert result.modules_run == ["analyzer", "holders", "liquidity"]
+    assert result.metadata["symbol"] == "TST"
+    assert result.safety_score >= 80  # low risk → high safety
+
+
+async def test_scan_request_normalizes_inputs():
+    req = TokenScanRequest(address="0xT", chain="ETHEREUM", tier="ELITE")
+    assert req.chain == "ethereum"
+    assert req.tier == "elite"
+    assert req.address == "0xT"