fix(tokenfactory): add pagination to DenomsFromCreator query (PLT-410)

[amir-deris]

Summary

• DenomsFromCreator performed an unbounded full prefix scan with no limit, making it unsafe.
• Added pagination field to QueryDenomsFromCreatorRequest and QueryDenomsFromCreatorResponse, routing the handler through query.Paginate which enforces the MaxLimit/MaxOffset bounds being added in PLT-361 (fix(sei-cosmos): harden paginated RPC queries against DoS via limit, offset, and count_total caps (PLT-361) #3494)
• Updated the REST gateway, CLI, and wasm test accordingly

Changes

• proto/tokenfactory/query.proto — added PageRequest/PageResponse pagination fields to DenomsFromCreator request and response
• x/tokenfactory/types/query.pb.go — regenerated via scripts/protoc.sh
• x/tokenfactory/types/query.pb.gw.go — regenerated; REST gateway now reads ?pagination.* query parameters
• x/tokenfactory/keeper/creators.go — replaced raw unbounded iterator with query.Paginate
• x/tokenfactory/keeper/grpc_query.go — threads pagination through the handler
• x/tokenfactory/client/cli/query.go — exposes --page-* flags on the denoms-from-creator command
• x/tokenfactory/keeper/grpc_query_test.go — added pagination tests (no pagination, limit, key-based cursor, offset)
• wasmbinding/test/query_test.go — fixed assertions to compare only Denoms field since Pagination is now always non-nil in the response

Notes

• Pagination is optional and backward-compatible — callers that omit it get DefaultLimit = 100 results
• Hard limits (MaxLimit = 1000, MaxOffset = 10000) are enforced by query.Paginate once PLT-361 lands; this PR depends on that for the cap to be in effect

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Changes a public query surface and response shape; wasm uses a 2000-item default when pagination is omitted, and stricter MaxLimit behavior depends on the related PLT-361 pagination work.

Overview
Adds pagination to the tokenfactory DenomsFromCreator query so it no longer scans every denom for a creator in one shot.

The proto request/response now carry Cosmos PageRequest / PageResponse. The keeper uses query.Paginate instead of a full store iterator, and the gRPC handler returns pagination alongside denoms. The CLI exposes standard --page-* flags; the REST gateway reads pagination.* query parameters.

Wasm queries without pagination get a 2000-denom default cap (higher than typical gRPC defaults) to limit DoS while keeping many contracts working in one response. Tests cover limit, key, and offset paging; wasm binding tests assert denoms only because pagination is always set on responses now.

^{Reviewed by Cursor Bugbot for commit 0c8617c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Jun 2, 2026, 3:57 PM

[codecov]

Codecov Report

❌ Patch coverage is 52.38095% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 58.30%. Comparing base (3d3df7e) to head (0c8617c).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
x/tokenfactory/client/cli/query.go	0.00%	6 Missing ⚠️
x/tokenfactory/keeper/creators.go	77.77%	1 Missing and 1 partial ⚠️
x/tokenfactory/keeper/grpc_query.go	50.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3524      +/-   ##
==========================================
- Coverage   59.15%   58.30%   -0.85%     
==========================================
  Files        2213     2140      -73     
  Lines      182710   174352    -8358     
==========================================
- Hits       108077   101652    -6425     
+ Misses      64930    63674    -1256     
+ Partials     9703     9026     -677     

Flag	Coverage Δ
sei-chain-pr	65.27% <52.38%> (?)
sei-db	70.41% <ø> (-0.22%)	⬇️
sei-db-state-db	?

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
x/tokenfactory/client/wasm/query.go	100.00% <100.00%> (ø)
x/tokenfactory/keeper/creators.go	86.66% <77.77%> (-13.34%)	⬇️
x/tokenfactory/keeper/grpc_query.go	84.21% <50.00%> (-4.68%)	⬇️
x/tokenfactory/client/cli/query.go	0.00% <0.00%> (ø)

... and 74 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7a6849e. Configure here.}