dexe-mcp 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -1,11 +1,93 @@
 # Changelog
 
+## 0.11.0 — 2026-07-03
+
+### OTC contract/frontend alignment (audit 2026-07-03)
+
+Cross-checked every OTC tool against `ITokenSaleProposal.sol` and the
+app.dexe.io frontend (`investing-dashboard`). Four bugs fixed, one guard and
+one compat gap closed:
+
+- **Native-coin sentinel** (`dexe_otc_buyer_buy`,
+  `dexe_vote_build_token_sale_buy`): the contract keys exchange rates by
+  `Globals.sol::ETHEREUM_ADDRESS` (`0xEeee…EEeE`); the tools previously
+  encoded the zero address, which reverts `TSP: incorrect token`. The zero
+  address is still accepted as caller input but calldata now always carries
+  `ETHEREUM_ADDRESS`; the low-level builder also auto-sets `value = amount`
+  for native buys (contract requires `msg.value == amount`).
+- **`getTierViews` decode ABI** (`dexe_otc_buyer_status`,
+  `dexe_otc_list_sales_for_dao`): the contract returns the nested
+  `TierView { tierInitParams, tierInfo, tierAdditionalInfo }`; the tools
+  declared a flat pre-Bug-#25 layout that decoded garbage on live tiers.
+  Both now share one canonical fragment (`TIER_VIEW_TUPLE`), and
+  `list_sales_for_dao` gains real `totalSold` plus an `off` status from the
+  tier's on-chain `isOff` flag.
+- **Merkle proofs in `dexe_otc_buyer_status`**: supplied whitelists are now
+  turned into proofs *before* the read and passed into
+  `getUserViews(user, tierIds, proofs)` — previously empty proofs made
+  `canParticipate` false for whitelisted users of merkle tiers. The response
+  also surfaces the on-chain merkle root and a `rootMatchesOnchain` check.
+- **Zero-address purchase token rejected** in the tier builders: such a tier
+  is unbuyable on-chain; the error points at `ETHEREUM_ADDRESS`.
+- **Merkle whitelist IPFS upload** in `dexe_otc_dao_open_sale`: app.dexe.io
+  buyers regenerate proofs from the `{ list }` JSON behind the tier's merkle
+  `uri`; tiers created with an empty uri were unbuyable through the frontend.
+  The composite now auto-uploads the list (`ipfs://<cid>`, frontend
+  `IpfsEntity.path` format) and reports it under `otc.merkleWhitelistUploads`.
+- **Compat harness un-rotted**: the H-10 human-percent `vestingPercentage`
+  change had broken `tests/compat` fixture replay unnoticed (the script was
+  not in CI). Generator + fixture updated; `npm run test:compat` now runs in
+  the CI build job.
+
+## 0.10.0 — 2026-06-03
+
+### Treasury-safety advisory (low-quorum governance check)
+
+Low quorum reduces the participation required to pass a proposal, which is a
+governance-safety risk for a DAO that holds treasury assets. The durable control
+is an adequate on-chain quorum threshold configured per DAO; this release adds an
+**advisory-only** layer in the MCP that flags treasury-moving proposals under a
+low quorum so an operator/agent verifies the setting and stakeholder
+participation before executing.
+
+The MCP layer **never blocks** — it surfaces a clear alert and proceeds. It is
+harm-reduction for a legit operator/agent configuring a DAO, not an access
+control.
+
+- **New** `src/lib/quorumRisk.ts` — pure logic: treasury-action classifier
+  (approve/transfer/transferFrom/increaseAllowance/nft/native), quorum-pct math
+  (1e27 scale), `judgeQuorum`/`quorumConcentration` verdicts, advisory strings.
+- **New env** `DEXE_MIN_SAFE_QUORUM_PCT` (default 50) + `DEXE_TREASURY_GUARD`
+  (`off`|`warn`, default `warn`; `warn` = advisories everywhere, `off` = silent).
+- **DAO deploy** (`dexe_dao_build_deploy`), **`change_voting_settings`**, and the
+  **treasury builders** (`withdraw_treasury`, `token_transfer`, `apply_to_dao`,
+  `custom_abi`, `build_external`) attach a below-floor / treasury-risk advisory.
+- **`dexe_proposal_vote_and_execute`** attaches a treasury-risk advisory to the
+  execute step when the proposal moves treasury value and quorum is below the
+  floor (or no controlling member voted For). It **executes regardless** — the
+  alert is informational; fail-soft on read errors.
+- **New tool** `dexe_proposal_risk_assess` (153 → **154**) — quorum %, treasury
+  at risk, the indicative share of supply required to meet quorum, verdict
+  (SAFE/CAUTION/DANGER) + recommendation, for an on-chain proposal or hypothetical
+  actions.
+- **Phase B** — founder/validator participation signal. **New**
+  `src/lib/controllingVoters.ts` (`resolveControllingHoldersVotedFor`): enumerates
+  the "controlling set" (validators ∪ top-N token holders by voting weight) via
+  subgraph, then confirms each member's vote direction **on-chain** via
+  `GovPool.getTotalVotes` (OR across Personal/Micropool/Delegated). Surfaced in
+  `dexe_proposal_risk_assess` and the execute advisory as an informational flag
+  when **no** controlling member voted For (even at healthy quorum). **New env**
+  `DEXE_CONTROLLING_TOPN` (default 5). Subgraph + mainnet (56) only; off-chain/
+  testnet/error ⇒ `null` (unknown). **Never blocks.**
+- No `acknowledgeRisk` override anywhere — there is nothing to acknowledge; the
+  guard does not block. Tool count unchanged (**154**).
+
 ## 0.9.0 — 2026-06-02
 
 ### Security hardening (red-team audit remediation)
 
-Remediates the `dexe-mcp@0.7.2` red-team audit. The 1 CRITICAL (C-2) was guarded
-in 0.8.3; this release closes the MCP-fixable HIGH/MEDIUM/LOW findings. Each fix
+Remediates the `dexe-mcp@0.7.2` red-team audit. The most severe finding was
+guarded in 0.8.3; this release closes the remaining MCP-fixable findings. Each fix
 shipped as its own PR with a locking regression test, CI green throughout.
 
 #### Fixed — builders & numeric safety
@@ -30,9 +112,9 @@ shipped as its own PR with a locking regression test, CI green throughout.
   before rendering (`src/lib/sanitize.ts`): control chars escaped, NFKC
   normalized, non-ASCII flagged — defeats prompt-injection / newline-forgery /
   homoglyph spoofing.
-- **C-1 (decode-no-recursion)** — `decode_calldata` / `decode_proposal`
-  recursively unwrap nested `multicall` / `createProposal` / … and flag
-  privileged selectors.
+- **Recursive decode** — `decode_calldata` / `decode_proposal` recursively
+  unwrap nested `multicall` / `createProposal` / … and flag privileged selectors
+  so a reviewer sees hidden inner calls.
 - **W20** — `ipfs_fetch` verifies fetched bytes against the requested CID
   (raw/json codecs) and rejects a mismatch.
 - **W21 / L-6** — the Graph API key is only sent as a Bearer to trusted
@@ -58,9 +140,6 @@ shipped as its own PR with a locking regression test, CI green throughout.
 - New env vars: `DEXE_PROTOCOL_REF`, `DEXE_MAX_DESCRIPTION_LEN`.
 
 ### Docs
-- **`docs/ESCALATION-DEXE.md`** — contract-level findings (C-2, H-11,
-  `executionDelay=0`, `changeVotePower`, PolynomialPower) for the DeXe protocol
-  team, with root cause, contract fix, and MCP mitigation.
 - **`docs/SECURITY.md`** — security posture and remediation summary.
 
 ### Notes
@@ -72,16 +151,12 @@ shipped as its own PR with a locking regression test, CI green throughout.
 
 ## 0.8.3 — 2026-06-01
 
-### Security: guardrail against C-2 (DEFAULT-routing allowlist bypass)
+### Security: guardrail for privileged proposal-action selectors
 
-Red-team finding **C-2** (against 0.7.2): a DeXe proposal can drain an arbitrary
-depositor's *unlocked* balance by calling
-`GovUserKeeper.withdrawTokens(payer, receiver, amount)` from a DEFAULT-routed
-proposal that bypasses the `GovPoolCreate` INTERNAL allowlist. The root cause is
-in the **DeXe protocol contracts** (settings keyed on the last action only;
-`withdrawTokens` takes an unbound `payer`) and is **not fixable from the MCP** —
-only a contract upgrade closes it. dexe-mcp was an amplifier: the proposal
-builders encoded the malicious action with zero checks.
+Hardening from the `0.7.2` red-team audit. Certain `GovUserKeeper` `onlyOwner`
+accounting functions are privileged and must never be encoded as a governance
+proposal action. This release adds an MCP-side guard so the proposal builders
+refuse to construct such actions. Defense-in-depth at the MCP layer.
 
 ### Added
 
@@ -93,9 +168,8 @@ builders encoded the malicious action with zero checks.
 
 - **`dexe_proposal_build_custom_abi` and `dexe_proposal_build_external` now
   hard-refuse** (no override) any action whose calldata carries a denylisted
-  selector. Harm-reduction only — an attacker can still hand-craft calldata; the
-  protocol fix is the real remediation. See
-  `docs/security/C2-default-routing-bypass.md`.
+  selector. Defense-in-depth at the MCP layer — users move their own funds
+  through the GovPool entrypoints, never via a proposal action.
 
 ### Notes
 

package/README.md

@@ -9,7 +9,7 @@
   <a href="https://nodejs.org"><img alt="node" src="https://img.shields.io/node/v/dexe-mcp.svg?style=flat-square&labelColor=0b0f1e&color=E07AFF"></a>
   <a href="https://github.com/edward-arinin-web-dev/dexe-mcp/blob/main/LICENSE"><img alt="license" src="https://img.shields.io/npm/l/dexe-mcp.svg?style=flat-square&labelColor=0b0f1e&color=FFC878"></a>
   <a href="https://modelcontextprotocol.io"><img alt="MCP-compatible" src="https://img.shields.io/badge/MCP-compatible-9BB4FF?style=flat-square&labelColor=0b0f1e"></a>
-  <a href="https://github.com/edward-arinin-web-dev/dexe-mcp"><img alt="tools" src="https://img.shields.io/badge/tools-153-7CF2D1?style=flat-square&labelColor=0b0f1e"></a>
+  <a href="https://github.com/edward-arinin-web-dev/dexe-mcp"><img alt="tools" src="https://img.shields.io/badge/tools-154-7CF2D1?style=flat-square&labelColor=0b0f1e"></a>
   <a href="https://github.com/edward-arinin-web-dev/dexe-mcp"><img alt="proposal types" src="https://img.shields.io/badge/proposal--types-33-E07AFF?style=flat-square&labelColor=0b0f1e"></a>
 </p>
 
@@ -40,7 +40,7 @@ That era is ending.
 
 LLMs can now reason about voting power, weigh proposals against a mandate, draft calldata, simulate execution, and ask your wallet to sign — **continuously, across every DAO you care about, all at once.** What was a UI is becoming a conversation. What was a treasurer's spreadsheet is becoming an always-on agent.
 
-**`dexe-mcp` is the substrate that makes it real for the DeXe stack — and now for external OpenZeppelin Governor DAOs as well.** One MCP server. 153 typed tools across 19 groups. Every flow the DeXe frontend exposes — plus a generic `dexe_gov_*` surface targeting Uniswap, Compound, and Optimism.
+**`dexe-mcp` is the substrate that makes it real for the DeXe stack — and now for external OpenZeppelin Governor DAOs as well.** One MCP server. 154 typed tools across 19 groups. Every flow the DeXe frontend exposes — plus a generic `dexe_gov_*` surface targeting Uniswap, Compound, and Optimism.
 
 |     | What you get |
 |-----|------|
@@ -194,7 +194,7 @@ All optional. Tools that need a missing variable fail with a clear, actionable m
 
 Full docs in [`docs/`](https://github.com/edward-arinin-web-dev/dexe-mcp/tree/main/docs):
 
-- [**`docs/TOOLS.md`**](https://github.com/edward-arinin-web-dev/dexe-mcp/blob/main/docs/TOOLS.md) — complete catalog of all 153 tools, grouped, with one-line descriptions and required envs.
+- [**`docs/TOOLS.md`**](https://github.com/edward-arinin-web-dev/dexe-mcp/blob/main/docs/TOOLS.md) — complete catalog of all 154 tools, grouped, with one-line descriptions and required envs.
 - [**`docs/GOVERNOR.md`**](https://github.com/edward-arinin-web-dev/dexe-mcp/blob/main/docs/GOVERNOR.md) — external OpenZeppelin / Bravo Governor surface (Uniswap, Compound, Optimism). Family branching, fixture map, paste-able JSON examples, Tally parity harness.
 - [**`docs/WALLETCONNECT.md`**](https://github.com/edward-arinin-web-dev/dexe-mcp/blob/main/docs/WALLETCONNECT.md) — `walletconnect` signer mode: phone-approved broadcast with no hot key. Phase A (config) + Phase B (live relay, `dexe_wc_connect` / `dexe_wc_disconnect`, per-tx phone approval) shipped in v0.7.0, validated end-to-end with a live MetaMask-mobile round-trip on BSC testnet.
 - [**`docs/USAGE.md`**](https://github.com/edward-arinin-web-dev/dexe-mcp/blob/main/docs/USAGE.md) — 10 worked examples (deploy DAO, create/vote/execute proposals, delegate, validator chamber, decode calldata, off-chain proposals, multicall batching). Copy-pasteable JSON.
@@ -207,13 +207,13 @@ Full docs in [`docs/`](https://github.com/edward-arinin-web-dev/dexe-mcp/tree/ma
 
 ## Tool catalog
 
-**153 tools, 19 groups.** Run `dexe_proposal_catalog` at runtime for the live proposal-type map. Full per-tool reference → [`docs/TOOLS.md`](https://github.com/edward-arinin-web-dev/dexe-mcp/blob/main/docs/TOOLS.md).
+**154 tools, 19 groups.** Run `dexe_proposal_catalog` at runtime for the live proposal-type map. Full per-tool reference → [`docs/TOOLS.md`](https://github.com/edward-arinin-web-dev/dexe-mcp/blob/main/docs/TOOLS.md).
 
 | Group | # | What it gives you |
 |-------|---|------|
 | **Dev tooling** | 4 | One-command Hardhat lifecycle for the DeXe-Protocol monorepo — `dexe_compile`, `_test`, `_coverage`, `_lint`. Auto-clones the repo on first call. |
 | **Contract introspection** | 10 | Ask the protocol about itself — list contracts, fetch ABIs, look up selectors, read NatSpec, view source, decode arbitrary calldata or full proposal payloads. The agent's reverse-engineer toolkit. |
-| **DAO reads** | 19 | Everything you'd see on a DAO dashboard, returned as JSON — `dao_info`, predicted helper addresses, proposal state/list/voters, voting power, treasury, settings, validators, staking, distributions, privacy policy. |
+| **DAO reads** | 20 | Everything you'd see on a DAO dashboard, returned as JSON — `dao_info`, predicted helper addresses, proposal state/list/voters, voting power, treasury, settings, validators, staking, distributions, privacy policy, plus `dexe_proposal_risk_assess` (treasury-safety risk readout). |
 | **IPFS** | 9 | Pinata uploads for files / avatars / DAO + proposal metadata, smart metadata updates, deterministic identicon generation, gateway-fallback fetch, CID computation without uploading. |
 | **DAO deploy** | 1 | `dexe_dao_build_deploy` — encodes the full nested `PoolFactory.deployGovPool` struct with predicted helper addresses pre-wired. From idea to a live DAO in one signed tx. |
 | **Proposal catalog + primitives** | 5 | `dexe_proposal_catalog` enumerates **all 33** proposal types with metadata + gating. Primitives `_build_external`, `_build_internal`, `_build_custom_abi`, `_build_offchain` cover anything not in a named wrapper. |
@@ -296,7 +296,7 @@ Supply-chain hardening is enforced in CI. See [SECURITY.md](SECURITY.md) for the
 - **npm provenance.** Releases publish with `npm publish --provenance`; verify with `npm audit signatures` against an installed copy.
 - **Reproducible installs.** A `verify-lockfile` CI job installs strictly from the committed `package-lock.json` and fails on any drift.
 - **Continuous scanning.** CodeQL (SAST) runs on every PR and weekly; OSSF Scorecard runs weekly and on push to `main`; Dependency Review runs on every PR.
-- **Audit remediation (v0.9.0).** Closes the MCP-fixable findings from an independent red-team audit — numeric-input guards, RPC-key redaction, untrusted-data sanitization, recursive decode, exact-amount approvals, per-chain nonce serialization, IPFS content-hash verification, and an `--ignore-scripts` bootstrap. Contract-level findings are escalated in [`docs/ESCALATION-DEXE.md`](https://github.com/edward-arinin-web-dev/dexe-mcp/blob/main/docs/ESCALATION-DEXE.md); per-finding detail in [`CHANGELOG.md`](https://github.com/edward-arinin-web-dev/dexe-mcp/blob/main/CHANGELOG.md).
+- **Audit remediation (v0.9.0).** Closes the MCP-fixable findings from an independent red-team audit — numeric-input guards, RPC-key redaction, untrusted-data sanitization, recursive decode, exact-amount approvals, per-chain nonce serialization, IPFS content-hash verification, and an `--ignore-scripts` bootstrap. Per-finding detail in [`CHANGELOG.md`](https://github.com/edward-arinin-web-dev/dexe-mcp/blob/main/CHANGELOG.md).
 
 ## License
 

package/dist/config.d.ts

@@ -34,6 +34,28 @@ export interface DexeConfig {
     forkBlock?: number;
     /** Private key for tx signing. When set, `dexe_tx_send` can broadcast. */
     privateKey?: string;
+    /**
+     * Minimum safe quorum percent (0–100). A DAO whose quorum setting is below
+     * this is flagged as a governance-safety risk for treasury-moving proposals
+     * (low quorum reduces the participation required to pass). Default 50.
+     * See src/lib/quorumRisk.ts.
+     */
+    minSafeQuorumPct: number;
+    /**
+     * Treasury-safety advisory posture. `off` = silent; `warn` (default) =
+     * advisories / alerts everywhere (build, deploy, execute, risk_assess).
+     * **Advisory only — it never blocks.** Harm-reduction for an operator/agent
+     * configuring a DAO; the durable control is an adequate on-chain quorum
+     * threshold configured per DAO.
+     */
+    treasuryGuard: "off" | "warn";
+    /**
+     * Number of top token holders (by voting weight) included in the treasury-
+     * safety "controlling set" (alongside validators). The advisory checks whether
+     * ≥1 controlling member voted For. Default 5. Subgraph/mainnet-only.
+     * See src/lib/controllingVoters.ts.
+     */
+    controllingTopN: number;
     /**
      * B6 — destination allowlist for `dexe_tx_send`. Lowercased, checksummed-then-
      * lowercased addresses. Undefined/empty = no restriction.

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC;IAErB,uEAAuE;IACvE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzC;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAEnC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,+EAA+E;IAC/E,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACzC;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,CA+NtD;AAcD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,WAAW,CAW9E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC;IAErB,uEAAuE;IACvE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzC;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,aAAa,EAAE,KAAK,GAAG,MAAM,CAAC;IAE9B;;;;;OAKG;IACH,eAAe,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAEnC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,+EAA+E;IAC/E,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACzC;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,CA8PtD;AAcD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,WAAW,CAW9E"}

package/dist/config.js

@@ -179,6 +179,33 @@ export async function loadConfig() {
     if (walletConnectProjectId) {
         process.stderr.write(`[dexe-mcp] WalletConnect project id configured${privateKey ? " (inactive — DEXE_PRIVATE_KEY takes precedence)" : ""}\n`);
     }
+    // ---- treasury-safety advisory (low-quorum) -----------------------------
+    let minSafeQuorumPct = 50;
+    const minQuorumRaw = process.env.DEXE_MIN_SAFE_QUORUM_PCT?.trim();
+    if (minQuorumRaw) {
+        const n = Number(minQuorumRaw);
+        if (!Number.isFinite(n) || n < 0 || n > 100) {
+            fatal(`DEXE_MIN_SAFE_QUORUM_PCT must be a number between 0 and 100, got: ${minQuorumRaw}`);
+        }
+        minSafeQuorumPct = n;
+    }
+    let treasuryGuard = "warn";
+    const treasuryGuardRaw = process.env.DEXE_TREASURY_GUARD?.trim().toLowerCase();
+    if (treasuryGuardRaw) {
+        if (treasuryGuardRaw !== "off" && treasuryGuardRaw !== "warn") {
+            fatal(`DEXE_TREASURY_GUARD must be one of off|warn, got: ${treasuryGuardRaw}`);
+        }
+        treasuryGuard = treasuryGuardRaw;
+    }
+    let controllingTopN = 5;
+    const controllingTopNRaw = process.env.DEXE_CONTROLLING_TOPN?.trim();
+    if (controllingTopNRaw) {
+        const n = Number(controllingTopNRaw);
+        if (!Number.isInteger(n) || n <= 0) {
+            fatal(`DEXE_CONTROLLING_TOPN must be a positive integer, got: ${controllingTopNRaw}`);
+        }
+        controllingTopN = n;
+    }
     let forkBlock;
     if (process.env.DEXE_FORK_BLOCK) {
         const n = Number(process.env.DEXE_FORK_BLOCK);
@@ -201,6 +228,9 @@ export async function loadConfig() {
         subgraphInteractionsUrl,
         forkBlock,
         privateKey,
+        minSafeQuorumPct,
+        treasuryGuard,
+        controllingTopN,
         signerAllowlist,
         signerMaxValueWei,
         signerMaxBroadcastsPerMin,

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAiEnE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,YAAY,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAEpD,0EAA0E;IAC1E,0EAA0E;IAC1E,gEAAgE;IAChE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kDAAkD,YAAY,mDAAmD,CAClH,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wCAAwC,YAAY,0GAA0G,CAC/J,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,YAAY;IACZ,uCAAuC;IACvC,uCAAuC;IACvC,iEAAiE;IACjE,+EAA+E;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAElF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACzE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACzE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,sEAAsE;IACtE,qEAAqE;IACrE,2EAA2E;IAC3E,yEAAyE;IACzE,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,GAAG,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,4CAA4C;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAChE,IAAI,aAAiC,CAAC;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,KAAK,CAAC,kDAAkD,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,aAAa,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,aAAa,IAAI,sBAAsB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC1E,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE;YACnB,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,SAAS;YACjB,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,IAAI,cAAsB,CAAC;IAC3B,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAClE,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,KAAK,CAAC,0DAA0D,eAAe,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;YAClE,KAAK,CACH,yBAAyB,CAAC,uDAAuD,UAAU,uBAAuB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,0BAA0B,CACpM,CAAC;QACJ,CAAC;QACD,cAAc,GAAG,CAAC,CAAC;IACrB,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7B,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;IAC1C,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC3B,yFAAyF;QACzF,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;QAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sFAAsF,cAAc,KAAK,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,cAAc,EAAE,uDAAuD,CAChN,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,2EAA2E;QAC3E,cAAc,GAAG,aAAa,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,4EAA4E;IAC5E,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;aACjC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;aAClE,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,OAAO,6BAA6B,CAAC,CAAC;IACpF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAClF,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC5F,MAAM,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAEhG,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACrE,IAAI,UAAU,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpC,KAAK,CACH,iJAAiJ,CAClJ,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,IAAI,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,yCAAyC;IACzC,IAAI,eAAqC,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,sDAAsD,KAAK,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,eAAe,GAAG,UAAU,CAAC;IAC1D,CAAC;IAED,2EAA2E;IAC3E,IAAI,iBAAqC,CAAC;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IAClE,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,wEAAwE,WAAW,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,MAAO,GAAG,EAAE,EAAE,CAAC;YACjB,KAAK,CAAC,wEAAwE,WAAW,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,iBAAiB,GAAG,MAAO,CAAC;IAC9B,CAAC;IAED,2EAA2E;IAC3E,IAAI,yBAA6C,CAAC;IAClD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,IAAI,EAAE,CAAC;IAChF,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,KAAK,CAAC,uEAAuE,gBAAgB,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,yBAAyB,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,sBAAsB,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC9F,MAAM,qBAAqB,GACzB,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,+BAA+B,CAAC;IACtF,IAAI,8BAA8B,GAAG,MAAM,CAAC;IAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,EAAE,IAAI,EAAE,CAAC;IAChF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,KAAK,CAAC,gFAAgF,YAAY,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,8BAA8B,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iDAAiD,UAAU,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,EAAE,IAAI,CACzH,CAAC;IACJ,CAAC;IAED,IAAI,SAA6B,CAAC;IAClC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,wDAAwD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,SAAS,GAAG,CAAC,CAAC;IAChB,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAEhD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,cAAc;QACd,OAAO,EAAE,cAAc;QACvB,MAAM,EAAE,YAAY,EAAE,MAAM;QAC5B,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,IAAI,gBAAgB;QACpE,SAAS;QACT,gBAAgB;QAChB,qBAAqB;QACrB,uBAAuB;QACvB,SAAS;QACT,UAAU;QACV,eAAe;QACf,iBAAiB;QACjB,yBAAyB;QACzB,sBAAsB;QACtB,qBAAqB;QACrB,8BAA8B;KAC/B,CAAe,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7D,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAkB,EAAE,OAAgB;IAC/D,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,CAAC,cAAc,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,iCAAiC,MAAM,yBAAyB,UAAU,KAAK;YAC7E,oBAAoB,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,wBAAwB,CAChH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,oDAAoD;IACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAyFnE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,YAAY,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAEpD,0EAA0E;IAC1E,0EAA0E;IAC1E,gEAAgE;IAChE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kDAAkD,YAAY,mDAAmD,CAClH,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wCAAwC,YAAY,0GAA0G,CAC/J,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,YAAY;IACZ,uCAAuC;IACvC,uCAAuC;IACvC,iEAAiE;IACjE,+EAA+E;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAElF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACzE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACzE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,sEAAsE;IACtE,qEAAqE;IACrE,2EAA2E;IAC3E,yEAAyE;IACzE,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,GAAG,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,4CAA4C;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAChE,IAAI,aAAiC,CAAC;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,KAAK,CAAC,kDAAkD,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,aAAa,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,aAAa,IAAI,sBAAsB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC1E,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE;YACnB,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,SAAS;YACjB,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,IAAI,cAAsB,CAAC;IAC3B,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAClE,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,KAAK,CAAC,0DAA0D,eAAe,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;YAClE,KAAK,CACH,yBAAyB,CAAC,uDAAuD,UAAU,uBAAuB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,0BAA0B,CACpM,CAAC;QACJ,CAAC;QACD,cAAc,GAAG,CAAC,CAAC;IACrB,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7B,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;IAC1C,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC3B,yFAAyF;QACzF,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;QAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sFAAsF,cAAc,KAAK,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,cAAc,EAAE,uDAAuD,CAChN,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,2EAA2E;QAC3E,cAAc,GAAG,aAAa,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,4EAA4E;IAC5E,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;aACjC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;aAClE,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,OAAO,6BAA6B,CAAC,CAAC;IACpF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAClF,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC5F,MAAM,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAEhG,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACrE,IAAI,UAAU,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpC,KAAK,CACH,iJAAiJ,CAClJ,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,IAAI,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,yCAAyC;IACzC,IAAI,eAAqC,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,sDAAsD,KAAK,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,eAAe,GAAG,UAAU,CAAC;IAC1D,CAAC;IAED,2EAA2E;IAC3E,IAAI,iBAAqC,CAAC;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IAClE,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,wEAAwE,WAAW,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,MAAO,GAAG,EAAE,EAAE,CAAC;YACjB,KAAK,CAAC,wEAAwE,WAAW,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,iBAAiB,GAAG,MAAO,CAAC;IAC9B,CAAC;IAED,2EAA2E;IAC3E,IAAI,yBAA6C,CAAC;IAClD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,IAAI,EAAE,CAAC;IAChF,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,KAAK,CAAC,uEAAuE,gBAAgB,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,yBAAyB,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,sBAAsB,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC9F,MAAM,qBAAqB,GACzB,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,+BAA+B,CAAC;IACtF,IAAI,8BAA8B,GAAG,MAAM,CAAC;IAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,EAAE,IAAI,EAAE,CAAC;IAChF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,KAAK,CAAC,gFAAgF,YAAY,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,8BAA8B,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,sBAAsB,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iDAAiD,UAAU,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,EAAE,IAAI,CACzH,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,IAAI,gBAAgB,GAAG,EAAE,CAAC;IAC1B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAClE,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;YAC5C,KAAK,CAAC,qEAAqE,YAAY,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,gBAAgB,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,aAAa,GAAmB,MAAM,CAAC;IAC3C,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/E,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,gBAAgB,KAAK,KAAK,IAAI,gBAAgB,KAAK,MAAM,EAAE,CAAC;YAC9D,KAAK,CAAC,qDAAqD,gBAAgB,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,aAAa,GAAG,gBAAgB,CAAC;IACnC,CAAC;IACD,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,KAAK,CAAC,0DAA0D,kBAAkB,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,eAAe,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,SAA6B,CAAC;IAClC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,wDAAwD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,SAAS,GAAG,CAAC,CAAC;IAChB,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAEhD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,cAAc;QACd,OAAO,EAAE,cAAc;QACvB,MAAM,EAAE,YAAY,EAAE,MAAM;QAC5B,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,IAAI,gBAAgB;QACpE,SAAS;QACT,gBAAgB;QAChB,qBAAqB;QACrB,uBAAuB;QACvB,SAAS;QACT,UAAU;QACV,gBAAgB;QAChB,aAAa;QACb,eAAe;QACf,eAAe;QACf,iBAAiB;QACjB,yBAAyB;QACzB,sBAAsB;QACtB,qBAAqB;QACrB,8BAA8B;KAC/B,CAAe,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7D,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAkB,EAAE,OAAgB;IAC/D,MAAM,MAAM,GAAG,OAAO,IAAI,MAAM,CAAC,cAAc,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,iCAAiC,MAAM,yBAAyB,UAAU,KAAK;YAC7E,oBAAoB,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,wBAAwB,CAChH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,oDAAoD;IACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/env/schema.d.ts

@@ -40,6 +40,27 @@ export declare const ENV_SPEC: {
         readonly example: "";
         readonly doc: "Override the DeXe-Protocol checkout path. Auto-managed when unset.";
     };
+    readonly DEXE_MIN_SAFE_QUORUM_PCT: {
+        readonly schema: z.ZodOptional<z.ZodString>;
+        readonly category: "core";
+        readonly required: false;
+        readonly example: "50";
+        readonly doc: "Minimum safe quorum percent (0–100). Quorum below this is flagged as a governance-safety risk for treasury-moving proposals. Default 50.";
+    };
+    readonly DEXE_TREASURY_GUARD: {
+        readonly schema: z.ZodOptional<z.ZodEnum<["off", "warn"]>>;
+        readonly category: "core";
+        readonly required: false;
+        readonly example: "warn";
+        readonly doc: "Treasury-safety advisory posture: off | warn. 'warn' (default) emits advisories/alerts everywhere (build, deploy, execute, risk_assess) but NEVER blocks; 'off' silences them.";
+    };
+    readonly DEXE_CONTROLLING_TOPN: {
+        readonly schema: z.ZodOptional<z.ZodString>;
+        readonly category: "core";
+        readonly required: false;
+        readonly example: "5";
+        readonly doc: "Top-N token holders (by voting weight) in the treasury-guard controlling set, alongside validators. The guard checks whether ≥1 member voted For. Subgraph/mainnet-only. Default 5.";
+    };
     readonly DEXE_RPC_URL: {
         readonly schema: z.ZodOptional<z.ZodString>;
         readonly category: "rpc";

package/dist/env/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/env/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,KAAK,GACL,QAAQ,GACR,MAAM,GACN,UAAU,GACV,eAAe,GACf,MAAM,GACN,SAAS,GACT,KAAK,CAAC;AAEV;;;GAGG;AACH,MAAM,MAAM,OAAO,GACf,MAAM,GACN,WAAW,GACX,aAAa,GACb,WAAW,GACX,eAAe,GACf,YAAY,GACZ,SAAS,GACT,oBAAoB,GACpB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3B,QAAQ,EAAE,WAAW,CAAC;IACtB,yEAAyE;IACzE,QAAQ,EAAE,OAAO,CAAC;IAClB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,YAAY,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAClC,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAOD,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgOwB,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAY,CAAC;AAE/D,MAAM,MAAM,MAAM,GAAG,MAAM,OAAO,QAAQ,CAAC;AAE3C,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,IAAI,MAAM,CAEpD;AAED,wBAAgB,OAAO,IAAI,MAAM,EAAE,CAElC;AAED;;;GAGG;AACH,eAAO,MAAM,wBAAwB,QAAyB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/env/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,KAAK,GACL,QAAQ,GACR,MAAM,GACN,UAAU,GACV,eAAe,GACf,MAAM,GACN,SAAS,GACT,KAAK,CAAC;AAEV;;;GAGG;AACH,MAAM,MAAM,OAAO,GACf,MAAM,GACN,WAAW,GACX,aAAa,GACb,WAAW,GACX,eAAe,GACf,YAAY,GACZ,SAAS,GACT,oBAAoB,GACpB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3B,QAAQ,EAAE,WAAW,CAAC;IACtB,yEAAyE;IACzE,QAAQ,EAAE,OAAO,CAAC;IAClB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,YAAY,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAClC,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAOD,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqPwB,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAY,CAAC;AAE/D,MAAM,MAAM,MAAM,GAAG,MAAM,OAAO,QAAQ,CAAC;AAE3C,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,IAAI,MAAM,CAEpD;AAED,wBAAgB,OAAO,IAAI,MAAM,EAAE,CAElC;AAED;;;GAGG;AACH,eAAO,MAAM,wBAAwB,QAAyB,CAAC"}

package/dist/env/schema.js

@@ -12,6 +12,27 @@ export const ENV_SPEC = {
         example: "",
         doc: "Override the DeXe-Protocol checkout path. Auto-managed when unset.",
     },
+    DEXE_MIN_SAFE_QUORUM_PCT: {
+        schema: intStr.optional(),
+        category: "core",
+        required: false,
+        example: "50",
+        doc: "Minimum safe quorum percent (0–100). Quorum below this is flagged as a governance-safety risk for treasury-moving proposals. Default 50.",
+    },
+    DEXE_TREASURY_GUARD: {
+        schema: z.enum(["off", "warn"]).optional(),
+        category: "core",
+        required: false,
+        example: "warn",
+        doc: "Treasury-safety advisory posture: off | warn. 'warn' (default) emits advisories/alerts everywhere (build, deploy, execute, risk_assess) but NEVER blocks; 'off' silences them.",
+    },
+    DEXE_CONTROLLING_TOPN: {
+        schema: intStr.optional(),
+        category: "core",
+        required: false,
+        example: "5",
+        doc: "Top-N token holders (by voting weight) in the treasury-guard controlling set, alongside validators. The guard checks whether ≥1 member voted For. Subgraph/mainnet-only. Default 5.",
+    },
     // ─── rpc ──────────────────────────────────────────────────────────────────
     DEXE_RPC_URL: {
         schema: optionalUrl,

package/dist/env/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/env/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyDxB,MAAM,KAAK,GAAG,qBAAqB,CAAC;AACpC,MAAM,KAAK,GAAG,qBAAqB,CAAC;AACpC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACzC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAEhD,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,6EAA6E;IAC7E,kBAAkB,EAAE;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,oEAAoE;KAC1E;IAED,6EAA6E;IAC7E,YAAY,EAAE;QACZ,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,kCAAkC;QAC3C,GAAG,EAAE,+EAA+E;QACpF,YAAY,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC;KACpC;IACD,aAAa,EAAE;QACb,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,sEAAsE;KAC5E;IACD,oBAAoB,EAAE;QACpB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,iDAAiD;QAC1D,GAAG,EAAE,qCAAqC;QAC1C,YAAY,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC;KACpC;IACD,oBAAoB,EAAE;QACpB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,mCAAmC;QAC5C,GAAG,EAAE,qCAAqC;QAC1C,YAAY,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC;KACpC;IACD,qBAAqB,EAAE;QACrB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,0EAA0E;KAChF;IACD,uBAAuB,EAAE;QACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;QAC1C,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,0EAA0E;KAChF;IAED,4EAA4E;IAC5E,gBAAgB,EAAE;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;QAC1C,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,YAAY;QACrB,GAAG,EAAE,0DAA0D;QAC/D,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,MAAM,EAAE,IAAI;KACb;IACD,qBAAqB,EAAE;QACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,4EAA4E;KAClF;IACD,yBAAyB,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,yCAAyC;KAC/C;IACD,kCAAkC,EAAE;QAClC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,uDAAuD;KAC7D;IAED,4EAA4E;IAC5E,eAAe,EAAE;QACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,yBAAyB;QAClC,GAAG,EAAE,uEAAuE;QAC5E,YAAY,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC;QAC3C,MAAM,EAAE,IAAI;KACb;IACD,iBAAiB,EAAE;QACjB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,oCAAoC;QAC7C,GAAG,EAAE,0CAA0C;QAC/C,YAAY,EAAE,CAAC,WAAW,CAAC;KAC5B;IACD,2BAA2B,EAAE;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,0DAA0D;KAChE;IACD,yBAAyB,EAAE;QACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,+DAA+D;QACpE,MAAM,EAAE,IAAI;KACb;IACD,wBAAwB,EAAE;QACxB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,iDAAiD;KACvD;IAED,4EAA4E;IAC5E,uBAAuB,EAAE;QACvB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,oDAAoD;QAC7D,GAAG,EAAE,0BAA0B;QAC/B,YAAY,EAAE,CAAC,eAAe,CAAC;KAChC;IACD,4BAA4B,EAAE;QAC5B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,oDAAoD;QAC7D,GAAG,EAAE,+BAA+B;QACpC,YAAY,EAAE,CAAC,eAAe,CAAC;KAChC;IACD,8BAA8B,EAAE;QAC9B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,oDAAoD;QAC7D,GAAG,EAAE,iCAAiC;QACtC,YAAY,EAAE,CAAC,eAAe,CAAC;KAChC;IACD,kBAAkB,EAAE;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,wEAAwE;QAC7E,MAAM,EAAE,IAAI;KACb;IAED,4EAA4E;IAC5E,6BAA6B,EAAE;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,+FAA+F;QACpG,YAAY,EAAE,CAAC,oBAAoB,CAAC;KACrC;IACD,4BAA4B,EAAE;QAC5B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,+BAA+B;QACxC,GAAG,EAAE,kCAAkC;KACxC;IACD,sCAAsC,EAAE;QACtC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,QAAQ;QACjB,GAAG,EAAE,gDAAgD;KACtD;IAED,4EAA4E;IAC5E,wBAAwB,EAAE;QACxB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,+CAA+C;QACxD,GAAG,EAAE,8EAA8E;QACnF,YAAY,EAAE,CAAC,SAAS,CAAC;KAC1B;IACD,iBAAiB,EAAE;QACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,4CAA4C;QACjD,MAAM,EAAE,IAAI;KACb;IAED,4EAA4E;IAC5E,oBAAoB,EAAE;QACpB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,qBAAqB;QAC9B,GAAG,EAAE,qDAAqD;QAC1D,YAAY,EAAE,CAAC,kBAAkB,CAAC;KACnC;IAED,4EAA4E;IAC5E,eAAe,EAAE;QACf,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,oCAAoC;KAC1C;CAC0C,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAA6B,QAAQ,CAAC;AAI/D,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAa,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/env/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyDxB,MAAM,KAAK,GAAG,qBAAqB,CAAC;AACpC,MAAM,KAAK,GAAG,qBAAqB,CAAC;AACpC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACzC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAEhD,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,6EAA6E;IAC7E,kBAAkB,EAAE;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,oEAAoE;KAC1E;IACD,wBAAwB,EAAE;QACxB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,0IAA0I;KAChJ;IACD,mBAAmB,EAAE;QACnB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC1C,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,MAAM;QACf,GAAG,EAAE,gLAAgL;KACtL;IACD,qBAAqB,EAAE;QACrB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,GAAG;QACZ,GAAG,EAAE,qLAAqL;KAC3L;IAED,6EAA6E;IAC7E,YAAY,EAAE;QACZ,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,kCAAkC;QAC3C,GAAG,EAAE,+EAA+E;QACpF,YAAY,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC;KACpC;IACD,aAAa,EAAE;QACb,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,sEAAsE;KAC5E;IACD,oBAAoB,EAAE;QACpB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,iDAAiD;QAC1D,GAAG,EAAE,qCAAqC;QAC1C,YAAY,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC;KACpC;IACD,oBAAoB,EAAE;QACpB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,mCAAmC;QAC5C,GAAG,EAAE,qCAAqC;QAC1C,YAAY,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC;KACpC;IACD,qBAAqB,EAAE;QACrB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,0EAA0E;KAChF;IACD,uBAAuB,EAAE;QACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;QAC1C,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,0EAA0E;KAChF;IAED,4EAA4E;IAC5E,gBAAgB,EAAE;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;QAC1C,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,YAAY;QACrB,GAAG,EAAE,0DAA0D;QAC/D,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,MAAM,EAAE,IAAI;KACb;IACD,qBAAqB,EAAE;QACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,4EAA4E;KAClF;IACD,yBAAyB,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,yCAAyC;KAC/C;IACD,kCAAkC,EAAE;QAClC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,uDAAuD;KAC7D;IAED,4EAA4E;IAC5E,eAAe,EAAE;QACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,yBAAyB;QAClC,GAAG,EAAE,uEAAuE;QAC5E,YAAY,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC;QAC3C,MAAM,EAAE,IAAI;KACb;IACD,iBAAiB,EAAE;QACjB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,oCAAoC;QAC7C,GAAG,EAAE,0CAA0C;QAC/C,YAAY,EAAE,CAAC,WAAW,CAAC;KAC5B;IACD,2BAA2B,EAAE;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,0DAA0D;KAChE;IACD,yBAAyB,EAAE;QACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,+DAA+D;QACpE,MAAM,EAAE,IAAI;KACb;IACD,wBAAwB,EAAE;QACxB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,iDAAiD;KACvD;IAED,4EAA4E;IAC5E,uBAAuB,EAAE;QACvB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,oDAAoD;QAC7D,GAAG,EAAE,0BAA0B;QAC/B,YAAY,EAAE,CAAC,eAAe,CAAC;KAChC;IACD,4BAA4B,EAAE;QAC5B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,oDAAoD;QAC7D,GAAG,EAAE,+BAA+B;QACpC,YAAY,EAAE,CAAC,eAAe,CAAC;KAChC;IACD,8BAA8B,EAAE;QAC9B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,oDAAoD;QAC7D,GAAG,EAAE,iCAAiC;QACtC,YAAY,EAAE,CAAC,eAAe,CAAC;KAChC;IACD,kBAAkB,EAAE;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,wEAAwE;QAC7E,MAAM,EAAE,IAAI;KACb;IAED,4EAA4E;IAC5E,6BAA6B,EAAE;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,+FAA+F;QACpG,YAAY,EAAE,CAAC,oBAAoB,CAAC;KACrC;IACD,4BAA4B,EAAE;QAC5B,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,+BAA+B;QACxC,GAAG,EAAE,kCAAkC;KACxC;IACD,sCAAsC,EAAE;QACtC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,QAAQ,EAAE,eAAe;QACzB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,QAAQ;QACjB,GAAG,EAAE,gDAAgD;KACtD;IAED,4EAA4E;IAC5E,wBAAwB,EAAE;QACxB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,+CAA+C;QACxD,GAAG,EAAE,8EAA8E;QACnF,YAAY,EAAE,CAAC,SAAS,CAAC;KAC1B;IACD,iBAAiB,EAAE;QACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,4CAA4C;QACjD,MAAM,EAAE,IAAI;KACb;IAED,4EAA4E;IAC5E,oBAAoB,EAAE;QACpB,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,qBAAqB;QAC9B,GAAG,EAAE,qDAAqD;QAC1D,YAAY,EAAE,CAAC,kBAAkB,CAAC;KACnC;IAED,4EAA4E;IAC5E,eAAe,EAAE;QACf,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;QACzB,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,oCAAoC;KAC1C;CAC0C,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAA6B,QAAQ,CAAC;AAI/D,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAa,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC"}

package/dist/lib/controllingVoters.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Controlling-holder participation signal for the treasury-safety advisory.
+ *
+ * Resolves whether at least one member of a DAO's "controlling set" voted For a
+ * given proposal. The controlling set (a product decision) is:
+ *   validators ∪ top-N token holders by voting weight.
+ * "Voted For" is lenient: ≥1 member among the For-voters ⇒ `true`.
+ *
+ * Posture: **fail-soft, never throws.** Any missing subgraph, non-mainnet chain,
+ * empty set, or subgraph/RPC error ⇒ `null` (unknown). Informational only — a
+ * `false` (set non-empty, nobody voted For) adds an advisory note; it never
+ * blocks. We only return `false` when we positively enumerated the set AND
+ * confirmed no member voted For on-chain.
+ *
+ * The set is enumerated via subgraph (cheap, but untrusted for vote direction);
+ * each member's vote direction is then confirmed ON-CHAIN via
+ * `GovPool.getTotalVotes` (authoritative). We OR across PersonalVote /
+ * MicropoolVote / DelegatedVote so a member who voted via delegation or a
+ * micropool is not mistaken for a non-voter.
+ */
+import { type JsonRpcProvider } from "ethers";
+import type { DexeConfig } from "../config.js";
+/**
+ * Identical to the fragment in src/tools/vote.ts / src/tools/inbox.ts. Kept
+ * local + exported so the unit test can assert ethers parses it (ethers
+ * silently drops malformed fragments — see govProposalView Phase-A gotcha).
+ */
+export declare const GET_TOTAL_VOTES_FRAGMENT = "function getTotalVotes(uint256 proposalId, address voter, uint8 voteType) view returns (uint256 totalVoted, uint256 totalRawVoted, uint256 votesForNow, bool isVoteFor)";
+/**
+ * Did ≥1 controlling-set member vote For proposal `proposalId`?
+ *   - `true`  — at least one member voted For (any vote type).
+ *   - `false` — set was enumerated, non-empty, and NONE voted For.
+ *   - `null`  — cannot determine (no subgraph / non-mainnet / empty set / error).
+ * Never throws.
+ */
+export declare function resolveControllingHoldersVotedFor(args: {
+    provider: JsonRpcProvider;
+    govPool: string;
+    proposalId: number;
+    cfg: DexeConfig;
+    chainId: number;
+    topN?: number;
+}): Promise<boolean | null>;
+//# sourceMappingURL=controllingVoters.d.ts.map

package/dist/lib/controllingVoters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controllingVoters.d.ts","sourceRoot":"","sources":["../../src/lib/controllingVoters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,QAAQ,CAAC;AAGzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,4KACsI,CAAC;AA+E5K;;;;;;GAMG;AACH,wBAAsB,iCAAiC,CAAC,IAAI,EAAE;IAC5D,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,UAAU,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CA6C1B"}

package/dist/lib/controllingVoters.js

@@ -0,0 +1,152 @@
+/**
+ * Controlling-holder participation signal for the treasury-safety advisory.
+ *
+ * Resolves whether at least one member of a DAO's "controlling set" voted For a
+ * given proposal. The controlling set (a product decision) is:
+ *   validators ∪ top-N token holders by voting weight.
+ * "Voted For" is lenient: ≥1 member among the For-voters ⇒ `true`.
+ *
+ * Posture: **fail-soft, never throws.** Any missing subgraph, non-mainnet chain,
+ * empty set, or subgraph/RPC error ⇒ `null` (unknown). Informational only — a
+ * `false` (set non-empty, nobody voted For) adds an advisory note; it never
+ * blocks. We only return `false` when we positively enumerated the set AND
+ * confirmed no member voted For on-chain.
+ *
+ * The set is enumerated via subgraph (cheap, but untrusted for vote direction);
+ * each member's vote direction is then confirmed ON-CHAIN via
+ * `GovPool.getTotalVotes` (authoritative). We OR across PersonalVote /
+ * MicropoolVote / DelegatedVote so a member who voted via delegation or a
+ * micropool is not mistaken for a non-voter.
+ */
+import { Interface } from "ethers";
+import { multicall } from "./multicall.js";
+import { gqlRequest } from "./subgraph.js";
+/**
+ * Identical to the fragment in src/tools/vote.ts / src/tools/inbox.ts. Kept
+ * local + exported so the unit test can assert ethers parses it (ethers
+ * silently drops malformed fragments — see govProposalView Phase-A gotcha).
+ */
+export const GET_TOTAL_VOTES_FRAGMENT = "function getTotalVotes(uint256 proposalId, address voter, uint8 voteType) view returns (uint256 totalVoted, uint256 totalRawVoted, uint256 votesForNow, bool isVoteFor)";
+/** PersonalVote=0, MicropoolVote=1, DelegatedVote=2 (TreasuryVote=3 omitted). */
+const VOTE_TYPES = [0, 1, 2];
+/** Default top-N token holders when neither arg nor config overrides it. */
+const DEFAULT_TOP_N = 5;
+/** Trimmed from src/tools/subgraph.ts VALIDATORS_QUERY (fields we need only). */
+const VALIDATORS_QUERY = /* GraphQL */ `
+  query getDaoPoolValidators($offset: Int!, $limit: Int!, $address: String!) {
+    validatorInPools(
+      skip: $offset
+      first: $limit
+      orderBy: balance
+      orderDirection: desc
+      where: { pool: $address }
+    ) {
+      validatorAddress
+    }
+  }
+`;
+/** Trimmed from src/tools/subgraph.ts DAO_MEMBERS_QUERY (fields we need only). */
+const DAO_MEMBERS_QUERY = /* GraphQL */ `
+  query getVotersInPool($poolId: String!, $offset: Int!, $limit: Int!) {
+    voterInPools(skip: $offset, first: $limit, where: { pool: $poolId }) {
+      receivedDelegation
+      voter {
+        id
+        totalVotes
+      }
+    }
+  }
+`;
+function toBig(s) {
+    try {
+        return s ? BigInt(s) : 0n;
+    }
+    catch {
+        return 0n;
+    }
+}
+/** Validator addresses for `pool` (lowercased). Fail-soft → []. */
+async function fetchValidators(cfg, pool) {
+    try {
+        const data = await gqlRequest(cfg.subgraphValidatorsUrl, VALIDATORS_QUERY, { offset: 0, limit: 100, address: pool });
+        return (data.validatorInPools ?? [])
+            .map((v) => v.validatorAddress?.toLowerCase())
+            .filter((a) => !!a);
+    }
+    catch {
+        return [];
+    }
+}
+/** Top-N holders by (totalVotes + receivedDelegation), lowercased. Fail-soft → []. */
+async function fetchTopHolders(cfg, pool, topN) {
+    try {
+        const data = await gqlRequest(cfg.subgraphPoolsUrl, DAO_MEMBERS_QUERY, { poolId: pool, offset: 0, limit: 50 });
+        const weighted = (data.voterInPools ?? [])
+            .map((r) => ({
+            addr: r.voter?.id?.toLowerCase(),
+            weight: toBig(r.voter?.totalVotes) + toBig(r.receivedDelegation),
+        }))
+            .filter((x) => !!x.addr);
+        weighted.sort((a, b) => (a.weight < b.weight ? 1 : a.weight > b.weight ? -1 : 0));
+        return weighted.slice(0, Math.max(0, topN)).map((x) => x.addr);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Did ≥1 controlling-set member vote For proposal `proposalId`?
+ *   - `true`  — at least one member voted For (any vote type).
+ *   - `false` — set was enumerated, non-empty, and NONE voted For.
+ *   - `null`  — cannot determine (no subgraph / non-mainnet / empty set / error).
+ * Never throws.
+ */
+export async function resolveControllingHoldersVotedFor(args) {
+    const { provider, govPool, proposalId, cfg, chainId } = args;
+    const topN = args.topN ?? cfg.controllingTopN ?? DEFAULT_TOP_N;
+    // Gate: subgraph exists only on mainnet (56). Testnet (97) ⇒ unknown.
+    if (chainId !== 56)
+        return null;
+    if (!cfg.subgraphValidatorsUrl || !cfg.subgraphPoolsUrl)
+        return null;
+    const pool = govPool.toLowerCase();
+    // Enumerate each source independently — a transient failure of one source
+    // only shrinks the set, which can only make `false` LESS likely (the safe
+    // direction: fewer wrongful refuses).
+    const [validators, holders] = await Promise.all([
+        fetchValidators(cfg, pool),
+        fetchTopHolders(cfg, pool, topN),
+    ]);
+    const members = [...new Set([...validators, ...holders])];
+    if (members.length === 0)
+        return null;
+    try {
+        const iface = new Interface([GET_TOTAL_VOTES_FRAGMENT]);
+        const calls = [];
+        for (const member of members) {
+            for (const vt of VOTE_TYPES) {
+                calls.push({
+                    target: govPool,
+                    iface,
+                    method: "getTotalVotes",
+                    args: [proposalId, member, vt],
+                    allowFailure: true,
+                });
+            }
+        }
+        const results = await multicall(provider, calls);
+        for (const r of results) {
+            if (!r.success || r.value == null)
+                continue;
+            // getTotalVotes returns a 4-tuple: [totalVoted, totalRawVoted, votesForNow, isVoteFor]
+            const v = r.value;
+            if (v[2] > 0n && v[3] === true)
+                return true;
+        }
+        return false; // set non-empty, confirmed nobody voted For
+    }
+    catch {
+        return null; // RPC/decoding failure ⇒ unknown, never a refuse
+    }
+}
+//# sourceMappingURL=controllingVoters.js.map