feat(denario): onboard Denario — partner wallet, Gold/Silver Polygon assets, and permanent referral alias

[joshuakrueger-dfx]

Overview

Bundles the full Denario onboarding into one PR:

1. Partner wallet — add Denario to the wallet table (analogous to existing partner wallets, e.g. Cake Wallet).
2. Assets — add the two Denario precious-metal tokens on Polygon (DGC, DSC) as inert, list-only assets.
3. Referral alias — permanent denario alias on the ref-keys setting (original scope of this PR).

All of it ships via a single reversible, idempotent migration each, plus the seed mirror for local dev.

---

1. Partner wallet

New migration 1784038000000-AddDenarioWalletAndAssets.js inserts a Denario row into wallet. Only name/displayName are set; every compliance/behaviour column takes its conservative DB default (isKycClient=false, autoTradeApproval=false, usesDummyAddresses=false, displayFraudWarning=false, amlRules='0', buySpecificIbanEnabled=false) — kept conservative on purpose so the partner cannot bypass any check by default. Idempotent on name (not a unique column), reversible.

Needs DFX confirmation: the partner's actual KYC/AML setup (whether isKycClient / amlRules should differ from the safe defaults). Adjust in a follow-up if required.

2. Assets (Polygon ERC-20)

Added in the same migration and mirrored into migration/seed/asset.csv (ids 411/412), values verified on-chain (decimals()/symbol()/name()):

Name	Symbol	Contract	Decimals
Denario Gold Coin	DGC	0xf7e2…042f	8
Denario Silver Coin	DSC	0x5d4e…c7e7	8

Contract addresses independently verified against Denario's official token pages (DGC 0xf7E2…042f, DSC 0x5D4E…c7E7). Backing: 1 DGC = 1 oz gold, 1 DSC = 1 oz silver (999.9), vaulted in Switzerland.

Both are inert, list-only (same pattern as OlkyFrozen/EUR): type=Token, blockchain=Polygon, category=Public, no priceRuleId, and every trade/payment flag false → isActive=false. Consequences:

• Excluded from the hourly price job (no priceRuleId).
• Not buyable/sellable/payable — no cron/observable/liquidity path picks them up.
• No automatic liquidity-management mechanism to buy or sell these tokens; any purchase or sale is handled manually, as required.
• financialType is intentionally left null (no precious-metal type exists yet) — set it when trading is enabled.

Reference txs: DGC · DSC

Note (not a liquidity mechanism): once the assets exist, the Polygon payin strategy will recognise inbound DGC/DSC transfers to DFX deposit addresses and map them to the correct asset with 8 decimals — identical to every other listed Polygon token (e.g. the already-listed non-tradeable XCHF/USDC.e). This is deposit detection/forwarding, not an automatic buy/sell.

Deliberately left empty (correct for an inert asset — not guessed)

• financialType: no precious-metal type exists in the repo (values in use: Other/USD/EUR/BTC/CHF/DEPS/FPS, plus 2 empty). It drives fee-matching (fee.entity) and balance grouping (log-job) — introducing a new bucket is a tax/reporting classification decision for DFX/DAS, so left null.
• approxPriceUsd/Chf/Eur: would hard-code a decaying gold/silver snapshot; these fields are only read for active/custody/traded assets, so an inert asset never uses them.
• sortOrder: display-order only (e.g. dEURO/SAND also leave it empty).

Follow-ups when trading is enabled (verified inputs, need DFX/DAS decision)

• Pricing is available (not on CoinGecko, but): DIA on-chain price feed for DSC, and a QuickSwap DSC/USDC pool on Polygon (0x6722e2405a3b6ee5bf862112a143cf7228ee6c18, live ≈ $36.55 ≈ 1 oz silver). Denario also publishes Proof-of-Reserve oracles (DSC PoR 0xb507a787cda02d6086f101d6067e9c35d58f1fc5). Attach a PriceRule (DEX/oracle source) then flip the buy/sell flags.
• Set financialType per token once the metal asset class is decided.
• Confirm partner-wallet compliance fields (isKycClient/amlRules).
• Out of scope but available: DGC/DSC also exist on Plume, Soneium and BNB (BinanceSmartChain) — this PR lists Polygon only, as requested.

---

3. Referral alias (original scope)

• add a permanent denario alias to the existing ref-keys setting
• resolve the target referral code from the active Denario organization account in each database, so production and development can use their own environment-local codes
• preserve all existing aliases and make the migration reversible and idempotent
• fail closed on a missing, inactive, ambiguous, malformed, or conflicting target/configuration
• fix /v1/app?code=<alias> to persist the resolved referral code instead of the unresolved alias, matching /v1/app/:app

Stable links after deployment

• Production: https://api.dfx.swiss/v1/app/services?code=denario
• Development: https://dev.api.dfx.swiss/v1/app/services?code=denario
• Generic redirect: /v1/app?code=denario

Deployment precondition

Each environment must contain exactly one active organization account whose trimmed, case-insensitive organization name is Denario or Denario AG, with exactly one active user that already has a valid referral code. The migration intentionally aborts if this invariant is not met. It also refuses to overwrite an existing denario alias that points elsewhere.

---

Tests & checks

Wallet + assets migration

• reviewed twice (conformance + logic) → 0 findings; on-chain contract/decimals independently confirmed via Polygon RPC
• idempotent (NOT EXISTS guards on uniqueName / name) and reversible (down() removes both assets + the wallet)
• seed rows: 29 columns, no id collision (prev max 410), consistent with the migration
• Prettier + Node syntax checks pass

Referral alias

• controller coverage for both redirect routes, direct refs, unknown aliases, and origin-only tracking
• migration coverage for preservation, creation, idempotency, conflicts, invalid/missing/ambiguous targets, malformed settings, and rollback
• the real migration SQL is executed against pg-mem to validate PostgreSQL semantics and reversible state changes
• full Jest suite: 189 suites passed, 3,012 tests passed, 140 tests skipped by their existing environment guards
• npm run type-check, npm run lint, npm run format:check, npm run build

[joshuakrueger-dfx]

Completed a full-diff conformance and logic review (1 round, 0 findings) before marking ready.

Verified:

• Wallet + asset migration is idempotent (NOT EXISTS guards on name/uniqueName) and reversible; mirrors the merged AddOlkyFrozenAsset precedent (migration + loc-only seed row).
• DGC/DSC contract addresses and decimals (8) confirmed on-chain and against Denario's official token pages; 1 DGC = 1 oz gold, 1 DSC = 1 oz silver.
• Assets are inert/list-only (no priceRuleId, all trade flags false → isActive=false): excluded from the price job and every buy/sell/liquidity path — no automatic liquidity mechanism, manual only, as intended.
• Partner wallet added with conservative DB defaults (compliance fields flagged for confirmation); not mirrored into the wallet seed (partners are prod-only).
• Referral alias unchanged and still fail-closed/reversible.
• All CI checks green.