feat: add hat stewards dashboard

.env.example

@@ -29,6 +29,15 @@ DAO_SHARE_CHAIN_ID=
 HATS_CONTRACT_ADDRESS=
 # Decimal or hex Hat ID values are both accepted.
 ANGRY_DWARF_HAT_ID=
+# Optional; used by /hat-stewards admin controls to fetch selectable Hats.
+HATS_SUBGRAPH_URL=
+# Optional; sent as Authorization: Bearer ... for private or API-keyed subgraphs.
+HATS_SUBGRAPH_AUTH_TOKEN=
+HAT_STEWARDS_TREE_ID=92
+HAT_STEWARDS_CHAIN_ID=100
+HATS_APP_BASE_URL=https://app.hatsprotocol.xyz
+# Optional; defaults to https://ipfs.io/ipfs for Hat metadata names.
+HATS_IPFS_GATEWAY_URL=https://ipfs.io/ipfs
 
 # Machine API / x402 demo configuration
 # Defaults to Base Sepolia chain ID 84532.
@@ -50,6 +59,8 @@ DAOHAUS_SUBGRAPH_URL=
 DAOHAUS_APP_BASE_URL=
 # Optional; defaults to https://safe-transaction-gnosis-chain.safe.global/api/v1.
 SAFE_TRANSACTION_SERVICE_URL=
+# Optional; defaults to the public Superfluid Gnosis subgraph.
+SUPERFLUID_SUBGRAPH_URL=https://subgraph-endpoints.superfluid.dev/xdai-mainnet/protocol-v1
 # Optional; default block lookback when syncing operator transfers outside a specific quarter.
 OPERATOR_TRANSFER_LOG_BLOCK_LOOKBACK=50000
 # Optional; lowers or raises ERC-20 log query chunk size for operator transfer sync.

README.md

@@ -18,13 +18,18 @@ allocation, account breakdowns, sync freshness, and stablecoin rebalancing
 guidance. Stablecoin allocation targets 25% stables and 75% other assets, with a
 5 percentage point tolerance.
 
+Hat Steward views show mapped role Safes, link each Safe to its Hats Protocol
+role, and display active incoming Superfluid streams projected by quarter.
+
 ## Architecture
 
 - Next.js App Router renders the wallet-gated dashboard.
 - Drizzle ORM models accounting records, treasury accounts, balance snapshots,
   quarter workflow state, audit records, and entity/address book records.
 - Treasury balance snapshots are synced from environment-configured accounts and
   cached for member-visible reads.
+- Hat Steward role Safe mappings are stored in Postgres. Admins choose Hats from
+  the configured Hats tree and enter the Safe address for each steward role.
 - Published quarter reports and exports are member-visible. Draft,
   ready-for-review, reopened, and administrative accounting workflows remain
   restricted to the appropriate roles.
@@ -145,6 +150,8 @@ The app targets Neon in production. At runtime it uses Neon HTTP for Neon URLs a
 RaidGuild member access is checked with `DAO_SHARE_TOKEN_ADDRESS`, the DAOhaus/Baal ERC-20 shares token. `DAO_SHARE_THRESHOLD` is written as a human share amount such as `100`.
 `HATS_CONTRACT_ADDRESS` is the Hats Protocol contract address used for hats-based permissions, formatted as a `0x`-prefixed EVM address. Use the deployed Hats contract for the target network, or a local test contract address for local chain testing.
 `ANGRY_DWARF_HAT_ID` can be provided as a decimal or hex string and requires `HATS_CONTRACT_ADDRESS` to function.
+`HATS_SUBGRAPH_URL` enables the Hat Stewards admin picker. `HATS_SUBGRAPH_AUTH_TOKEN` is optional and is sent as an `Authorization: Bearer ...` header for private or API-keyed subgraphs. `HAT_STEWARDS_TREE_ID` defaults to `92` for the RaidGuild tree, and `HAT_STEWARDS_CHAIN_ID` defaults to `100` for Gnosis. `HATS_IPFS_GATEWAY_URL` defaults to `https://ipfs.io/ipfs` and is used to resolve Hat metadata names for the admin picker.
+`SUPERFLUID_SUBGRAPH_URL` defaults to Superfluid's public Gnosis endpoint and powers Hat Steward incoming stream totals.
 
 `ENCRYPTION_KEY` must be a base64-encoded 32-byte key. Multiple-key rotation requires stable `key-id:base64-key` entries. To generate a local development key:
 

drizzle/0020_medical_mysterio.sql

@@ -0,0 +1,16 @@
+CREATE TABLE "hat_steward_role_safes" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"hat_id" text NOT NULL,
+	"hat_pretty_id" text NOT NULL,
+	"hat_label" text NOT NULL,
+	"safe_address" text NOT NULL,
+	"chain_id" integer DEFAULT 100 NOT NULL,
+	"notes" text,
+	"archived_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX "hat_steward_role_safes_hat_id_unique" ON "hat_steward_role_safes" USING btree ("hat_id");--> statement-breakpoint
+CREATE INDEX "hat_steward_role_safes_safe_idx" ON "hat_steward_role_safes" USING btree ("chain_id",lower("safe_address"));--> statement-breakpoint
+CREATE INDEX "hat_steward_role_safes_archived_at_idx" ON "hat_steward_role_safes" USING btree ("archived_at");