@poa-box/core 0.1.0 → 1.0.0

package/dist/abis/UniversalAccountRegistry.d.ts

@@ -573,5 +573,29 @@ export declare const UniversalAccountRegistryAbi: readonly [{
     readonly type: "error";
     readonly name: "UsernameTooLong";
     readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "AuthDataTooShort";
+    readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "ChallengeMismatch";
+    readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "InvalidWebAuthnSignature";
+    readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "MalformedClientData";
+    readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "SignCountTooLow";
+    readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "UserNotPresent";
+    readonly inputs: readonly [];
 }];
 export default UniversalAccountRegistryAbi;

package/dist/abis/UniversalAccountRegistry.js

@@ -745,6 +745,36 @@ exports.UniversalAccountRegistryAbi = [
         "type": "error",
         "name": "UsernameTooLong",
         "inputs": []
+    },
+    {
+        "type": "error",
+        "name": "AuthDataTooShort",
+        "inputs": []
+    },
+    {
+        "type": "error",
+        "name": "ChallengeMismatch",
+        "inputs": []
+    },
+    {
+        "type": "error",
+        "name": "InvalidWebAuthnSignature",
+        "inputs": []
+    },
+    {
+        "type": "error",
+        "name": "MalformedClientData",
+        "inputs": []
+    },
+    {
+        "type": "error",
+        "name": "SignCountTooLow",
+        "inputs": []
+    },
+    {
+        "type": "error",
+        "name": "UserNotPresent",
+        "inputs": []
     }
 ];
 exports.default = exports.UniversalAccountRegistryAbi;

package/dist/abis/ZkEmailInvites.d.ts

@@ -819,5 +819,49 @@ export declare const ZkEmailInvitesAbi: readonly [{
     readonly type: "error";
     readonly name: "ZeroClaimer";
     readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "CapBelowCommitted";
+    readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "EmptyTitle";
+    readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "InvalidPayout";
+    readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "InvalidString";
+    readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "TitleTooLong";
+    readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "AuthDataTooShort";
+    readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "ChallengeMismatch";
+    readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "InvalidWebAuthnSignature";
+    readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "MalformedClientData";
+    readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "SignCountTooLow";
+    readonly inputs: readonly [];
+}, {
+    readonly type: "error";
+    readonly name: "UserNotPresent";
+    readonly inputs: readonly [];
 }];
 export default ZkEmailInvitesAbi;

package/dist/abis/ZkEmailInvites.js

@@ -1055,6 +1055,61 @@ exports.ZkEmailInvitesAbi = [
         "type": "error",
         "name": "ZeroClaimer",
         "inputs": []
+    },
+    {
+        "type": "error",
+        "name": "CapBelowCommitted",
+        "inputs": []
+    },
+    {
+        "type": "error",
+        "name": "EmptyTitle",
+        "inputs": []
+    },
+    {
+        "type": "error",
+        "name": "InvalidPayout",
+        "inputs": []
+    },
+    {
+        "type": "error",
+        "name": "InvalidString",
+        "inputs": []
+    },
+    {
+        "type": "error",
+        "name": "TitleTooLong",
+        "inputs": []
+    },
+    {
+        "type": "error",
+        "name": "AuthDataTooShort",
+        "inputs": []
+    },
+    {
+        "type": "error",
+        "name": "ChallengeMismatch",
+        "inputs": []
+    },
+    {
+        "type": "error",
+        "name": "InvalidWebAuthnSignature",
+        "inputs": []
+    },
+    {
+        "type": "error",
+        "name": "MalformedClientData",
+        "inputs": []
+    },
+    {
+        "type": "error",
+        "name": "SignCountTooLow",
+        "inputs": []
+    },
+    {
+        "type": "error",
+        "name": "UserNotPresent",
+        "inputs": []
     }
 ];
 exports.default = exports.ZkEmailInvitesAbi;

package/dist/abis/index.d.ts

@@ -1,10 +1,12 @@
+import { AuthorityRouterAbi } from './AuthorityRouter';
+import { CutoverVerifierAbi } from './CutoverVerifier';
 import { DirectDemocracyVotingNewAbi } from './DirectDemocracyVotingNew';
 import { ERC20Abi } from './ERC20';
 import { EducationHubNewAbi } from './EducationHubNew';
-import { EligibilityModuleNewAbi } from './EligibilityModuleNew';
 import { ExecutorAbi } from './Executor';
 import { HybridVotingNewAbi } from './HybridVotingNew';
 import { ImplementationRegistryAbi } from './ImplementationRegistry';
+import { MembershipAuthorityAbi } from './MembershipAuthority';
 import { OrgDeployerNewAbi } from './OrgDeployerNew';
 import { OrgRegistryAbi } from './OrgRegistry';
 import { ParticipationTokenAbi } from './ParticipationToken';
@@ -15,7 +17,6 @@ import { PaymentManagerAbi } from './PaymentManager';
 import { PoaManagerAbi } from './PoaManager';
 import { QuickJoinNewAbi } from './QuickJoinNew';
 import { TaskManagerNewAbi } from './TaskManagerNew';
-import { ToggleModuleAbi } from './ToggleModule';
 import { UniversalAccountRegistryAbi } from './UniversalAccountRegistry';
 import { ZkEmailInvitesAbi } from './ZkEmailInvites';
 import { AaveGovernanceV2Abi } from './external/AaveGovernanceV2';
@@ -27,13 +28,15 @@ import { GovernorAlphaAbi } from './external/GovernorAlpha';
 import { MakerDAOChiefAbi } from './external/MakerDAOChief';
 import { OZGovernorAbi } from './external/OZGovernor';
 import { SolidlyVotingEscrowAbi } from './external/SolidlyVotingEscrow';
+export { AuthorityRouterAbi };
+export { CutoverVerifierAbi };
 export { DirectDemocracyVotingNewAbi };
 export { ERC20Abi };
 export { EducationHubNewAbi };
-export { EligibilityModuleNewAbi };
 export { ExecutorAbi };
 export { HybridVotingNewAbi };
 export { ImplementationRegistryAbi };
+export { MembershipAuthorityAbi };
 export { OrgDeployerNewAbi };
 export { OrgRegistryAbi };
 export { ParticipationTokenAbi };
@@ -44,7 +47,6 @@ export { PaymentManagerAbi };
 export { PoaManagerAbi };
 export { QuickJoinNewAbi };
 export { TaskManagerNewAbi };
-export { ToggleModuleAbi };
 export { UniversalAccountRegistryAbi };
 export { ZkEmailInvitesAbi };
 export { AaveGovernanceV2Abi };

package/dist/abis/index.js

@@ -2,21 +2,25 @@
 // GENERATED by packages/core/scripts/gen-abis.mjs — do not edit.
 // Source of truth: src/abi/*.json at the repo root (see scripts/extract-abis.mjs).
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXTERNAL_ABIS = exports.ALL_ABIS = exports.SolidlyVotingEscrowAbi = exports.OZGovernorAbi = exports.MakerDAOChiefAbi = exports.GovernorAlphaAbi = exports.CurveVotingEscrowAbi = exports.CurveGaugeControllerAbi = exports.AragonVotingAbi = exports.AaveGovernanceV3Abi = exports.AaveGovernanceV2Abi = exports.ZkEmailInvitesAbi = exports.UniversalAccountRegistryAbi = exports.ToggleModuleAbi = exports.TaskManagerNewAbi = exports.QuickJoinNewAbi = exports.PoaManagerAbi = exports.PaymentManagerAbi = exports.PaymasterHubAbi = exports.PasskeyAccountFactoryAbi = exports.PasskeyAccountAbi = exports.ParticipationTokenAbi = exports.OrgRegistryAbi = exports.OrgDeployerNewAbi = exports.ImplementationRegistryAbi = exports.HybridVotingNewAbi = exports.ExecutorAbi = exports.EligibilityModuleNewAbi = exports.EducationHubNewAbi = exports.ERC20Abi = exports.DirectDemocracyVotingNewAbi = void 0;
+exports.EXTERNAL_ABIS = exports.ALL_ABIS = exports.SolidlyVotingEscrowAbi = exports.OZGovernorAbi = exports.MakerDAOChiefAbi = exports.GovernorAlphaAbi = exports.CurveVotingEscrowAbi = exports.CurveGaugeControllerAbi = exports.AragonVotingAbi = exports.AaveGovernanceV3Abi = exports.AaveGovernanceV2Abi = exports.ZkEmailInvitesAbi = exports.UniversalAccountRegistryAbi = exports.TaskManagerNewAbi = exports.QuickJoinNewAbi = exports.PoaManagerAbi = exports.PaymentManagerAbi = exports.PaymasterHubAbi = exports.PasskeyAccountFactoryAbi = exports.PasskeyAccountAbi = exports.ParticipationTokenAbi = exports.OrgRegistryAbi = exports.OrgDeployerNewAbi = exports.MembershipAuthorityAbi = exports.ImplementationRegistryAbi = exports.HybridVotingNewAbi = exports.ExecutorAbi = exports.EducationHubNewAbi = exports.ERC20Abi = exports.DirectDemocracyVotingNewAbi = exports.CutoverVerifierAbi = exports.AuthorityRouterAbi = void 0;
+const AuthorityRouter_1 = require("./AuthorityRouter");
+Object.defineProperty(exports, "AuthorityRouterAbi", { enumerable: true, get: function () { return AuthorityRouter_1.AuthorityRouterAbi; } });
+const CutoverVerifier_1 = require("./CutoverVerifier");
+Object.defineProperty(exports, "CutoverVerifierAbi", { enumerable: true, get: function () { return CutoverVerifier_1.CutoverVerifierAbi; } });
 const DirectDemocracyVotingNew_1 = require("./DirectDemocracyVotingNew");
 Object.defineProperty(exports, "DirectDemocracyVotingNewAbi", { enumerable: true, get: function () { return DirectDemocracyVotingNew_1.DirectDemocracyVotingNewAbi; } });
 const ERC20_1 = require("./ERC20");
 Object.defineProperty(exports, "ERC20Abi", { enumerable: true, get: function () { return ERC20_1.ERC20Abi; } });
 const EducationHubNew_1 = require("./EducationHubNew");
 Object.defineProperty(exports, "EducationHubNewAbi", { enumerable: true, get: function () { return EducationHubNew_1.EducationHubNewAbi; } });
-const EligibilityModuleNew_1 = require("./EligibilityModuleNew");
-Object.defineProperty(exports, "EligibilityModuleNewAbi", { enumerable: true, get: function () { return EligibilityModuleNew_1.EligibilityModuleNewAbi; } });
 const Executor_1 = require("./Executor");
 Object.defineProperty(exports, "ExecutorAbi", { enumerable: true, get: function () { return Executor_1.ExecutorAbi; } });
 const HybridVotingNew_1 = require("./HybridVotingNew");
 Object.defineProperty(exports, "HybridVotingNewAbi", { enumerable: true, get: function () { return HybridVotingNew_1.HybridVotingNewAbi; } });
 const ImplementationRegistry_1 = require("./ImplementationRegistry");
 Object.defineProperty(exports, "ImplementationRegistryAbi", { enumerable: true, get: function () { return ImplementationRegistry_1.ImplementationRegistryAbi; } });
+const MembershipAuthority_1 = require("./MembershipAuthority");
+Object.defineProperty(exports, "MembershipAuthorityAbi", { enumerable: true, get: function () { return MembershipAuthority_1.MembershipAuthorityAbi; } });
 const OrgDeployerNew_1 = require("./OrgDeployerNew");
 Object.defineProperty(exports, "OrgDeployerNewAbi", { enumerable: true, get: function () { return OrgDeployerNew_1.OrgDeployerNewAbi; } });
 const OrgRegistry_1 = require("./OrgRegistry");
@@ -37,8 +41,6 @@ const QuickJoinNew_1 = require("./QuickJoinNew");
 Object.defineProperty(exports, "QuickJoinNewAbi", { enumerable: true, get: function () { return QuickJoinNew_1.QuickJoinNewAbi; } });
 const TaskManagerNew_1 = require("./TaskManagerNew");
 Object.defineProperty(exports, "TaskManagerNewAbi", { enumerable: true, get: function () { return TaskManagerNew_1.TaskManagerNewAbi; } });
-const ToggleModule_1 = require("./ToggleModule");
-Object.defineProperty(exports, "ToggleModuleAbi", { enumerable: true, get: function () { return ToggleModule_1.ToggleModuleAbi; } });
 const UniversalAccountRegistry_1 = require("./UniversalAccountRegistry");
 Object.defineProperty(exports, "UniversalAccountRegistryAbi", { enumerable: true, get: function () { return UniversalAccountRegistry_1.UniversalAccountRegistryAbi; } });
 const ZkEmailInvites_1 = require("./ZkEmailInvites");
@@ -63,13 +65,15 @@ const SolidlyVotingEscrow_1 = require("./external/SolidlyVotingEscrow");
 Object.defineProperty(exports, "SolidlyVotingEscrowAbi", { enumerable: true, get: function () { return SolidlyVotingEscrow_1.SolidlyVotingEscrowAbi; } });
 /** Every first-party POP ABI, keyed by its historical abi/ file base name. */
 exports.ALL_ABIS = {
+    "AuthorityRouter": AuthorityRouter_1.AuthorityRouterAbi,
+    "CutoverVerifier": CutoverVerifier_1.CutoverVerifierAbi,
     "DirectDemocracyVotingNew": DirectDemocracyVotingNew_1.DirectDemocracyVotingNewAbi,
     "ERC20": ERC20_1.ERC20Abi,
     "EducationHubNew": EducationHubNew_1.EducationHubNewAbi,
-    "EligibilityModuleNew": EligibilityModuleNew_1.EligibilityModuleNewAbi,
     "Executor": Executor_1.ExecutorAbi,
     "HybridVotingNew": HybridVotingNew_1.HybridVotingNewAbi,
     "ImplementationRegistry": ImplementationRegistry_1.ImplementationRegistryAbi,
+    "MembershipAuthority": MembershipAuthority_1.MembershipAuthorityAbi,
     "OrgDeployerNew": OrgDeployerNew_1.OrgDeployerNewAbi,
     "OrgRegistry": OrgRegistry_1.OrgRegistryAbi,
     "ParticipationToken": ParticipationToken_1.ParticipationTokenAbi,
@@ -80,7 +84,6 @@ exports.ALL_ABIS = {
     "PoaManager": PoaManager_1.PoaManagerAbi,
     "QuickJoinNew": QuickJoinNew_1.QuickJoinNewAbi,
     "TaskManagerNew": TaskManagerNew_1.TaskManagerNewAbi,
-    "ToggleModule": ToggleModule_1.ToggleModuleAbi,
     "UniversalAccountRegistry": UniversalAccountRegistry_1.UniversalAccountRegistryAbi,
     "ZkEmailInvites": ZkEmailInvites_1.ZkEmailInvitesAbi,
 };

package/dist/chains.js

@@ -56,9 +56,9 @@ exports.NETWORKS = {
         blockExplorer: 'https://arbiscan.io',
         isTestnet: false,
         subgraphUrl: 'https://api.studio.thegraph.com/query/73367/poa-arb-v-1/version/latest',
-        // No gatewaySubgraphId: the Arbitrum deployment has not been published to
-        // the decentralised network (or its ID is not known here), so Arbitrum has
-        // no paid tier by default. Set POP_ARBITRUM_SUBGRAPH_ID once it is published.
+        // Published production deployment, shared with the frontend's networks.js.
+        // Studio remains the free default; GRAPH_API_KEY enables gateway fallback.
+        gatewaySubgraphId: '2egvcs94ZStD38inRtK9bp3Maw3UZw4BDinH8jLyAF4G',
         bountyTokens: {
             USDC: '0xaf88d065e77c8cC2239327C5EDb3A432268e5831',
         },

package/dist/error-catalog.js

@@ -142,6 +142,95 @@ function decodeContractError(error, iface) {
  * fails if an ABI regeneration introduces a name without an entry here.
  */
 exports.ERROR_MESSAGES = {
+    AlreadyMember: { human: "This address is already a member of the role." },
+    DeploymentComplete: { human: "The organization deployment has already completed." },
+    DuplicateGroupMemberRole: { human: "A group lists the same role more than once." },
+    ForceRequired: { human: "Closing a role with accepted members requires the explicit force flag." },
+    GlobalRuleUnknown: { human: "The requested global rule does not exist." },
+    GrantBlockedByGovernanceBan: { human: "Governance has banned this member; a delegated manager cannot override the ban." },
+    GroupSizeLimit: { human: "A group may contain at most 16 roles." },
+    GroupsPerRoleLimit: { human: "A role may belong to at most 8 groups." },
+    InvalidConfigKey: { human: "This configuration key is not supported by the authority-only protocol." },
+    InvalidRulesMode: { human: "The rule mode is invalid." },
+    InvalidTypeId: { human: "The contract type ID is invalid." },
+    LegacyConfigRemoved: { human: "Legacy Hats configuration has been removed. Configure MembershipAuthority permissions instead." },
+    MaxMembersOnGroup: { human: "Groups derive membership from roles and cannot have a member cap." },
+    NoPendingAction: { human: "This pending action does not exist or has already been resolved." },
+    NotAGroup: { human: "The subject kind does not support this operation." },
+    NotAuthorizedManager: { human: "Your account lacks the required manager capability for this subject." },
+    NotClaimable: { human: "This role is not currently claimable by your account." },
+    NotInOrg: { human: "The target must already belong to the organization; offer the role to an outsider." },
+    NotRegisteredModule: { human: "Only the registered organization module may perform this operation." },
+    NotRegistryAdmin: { human: "Your account is not the registry administrator." },
+    NotYetActive: { human: "The delegated action review delay has not elapsed." },
+    PendingActionExists: { human: "This subject and user already have a pending action." },
+    PermFanoutLimit: { human: "A permission key and context may refer to at most 16 subjects." },
+    QuickJoinRoleNotOpen: { human: "Every QuickJoin role must allow default membership." },
+    RemovalIneffective: { human: "Soft removal leaves another eligibility source active. Review the sources before proposing a ban." },
+    RemoveBlockedByStickyGovernance: { human: "A delegated manager cannot remove this sticky governance grant." },
+    RoleCapacityBelowGenesisSeed: { human: "The role cap is lower than its initial membership allocation." },
+    RoleLimit: { human: "An account may accept at most 16 roles." },
+    RuleNotDelegable: { human: "Governance marked this rule as non-delegable." },
+    SelfManagedCycle: { human: "The manager configuration creates a management cycle." },
+    SubjectExists: { human: "This subject or group composition already exists." },
+    SubjectFull: { human: "The role has reached its membership cap. Reconcile a lapsed membership or increase the cap." },
+    UnknownSubject: { human: "The subject does not exist in this organization authority." },
+    VouchRateLimited: { human: "The daily vouch limit has been reached." },
+    WiringIncompatible: { human: "The authority subject configuration is structurally incompatible." },
+    // --- Authority routing / migration invariant checks ---
+    AlreadyBound: {
+        human: 'This legacy top-hat domain is already bound to an organization authority.',
+        suggestion: 'Inspect the existing router binding before proposing any binding change.',
+    },
+    NotBound: {
+        human: 'This legacy top-hat domain has no authority binding to remove.',
+    },
+    TopHatDomainMismatch: {
+        human: 'The supplied top-hat domain does not match the organization recorded in OrgRegistry.',
+        suggestion: 'Use the domain from the registered top-hat ID: topHatId shifted right by 224 bits.',
+    },
+    ArrayLengthMismatchRouter: {
+        human: 'The router balance query must contain one subject ID for each user address.',
+    },
+    WriteToPassthrough: {
+        human: 'The authority router does not allow writes through its legacy Hats passthrough route.',
+        suggestion: 'Use the organization authority for native membership changes.',
+    },
+    NoSubjects: {
+        human: 'Cutover verification requires at least one adopted subject, with the admin subject first.',
+    },
+    AuthorityNotBound: {
+        human: 'A cutover subject resolves through the router to a different authority than expected.',
+        suggestion: 'Correct the router binding in the governance cutover batch.',
+    },
+    AuthorityPaused: {
+        human: 'The organization authority is still paused at the end of the cutover batch.',
+        suggestion: 'Include the authority unpause before the final cutover verification call.',
+    },
+    MemberCountDrift: {
+        human: 'An authority membership count differs from the count recorded when the cutover batch was prepared.',
+        suggestion: 'Reconcile the membership snapshot and regenerate the cutover batch from the current state.',
+    },
+    SupplyDrift: {
+        human: 'A legacy Hats supply differs from the supply recorded when the cutover batch was prepared.',
+        suggestion: 'Account for legacy joins and removals in the migration snapshot before regenerating the cutover batch.',
+    },
+    MemberCountExceedsSupply: {
+        human: 'An adopted subject has more authority members than its canonical legacy Hats supply.',
+        suggestion: 'Correct the migrated membership set before completing the cutover.',
+    },
+    AdminNotResolved: {
+        human: 'The router does not recognize the registered organization executor as a member of the admin subject.',
+        suggestion: 'Check the first cutover subject, its executor membership, and the router binding.',
+    },
+    AdminHatInactive: {
+        human: 'The admin subject is inactive when read through the authority router.',
+        suggestion: 'Restore the admin subject configuration before completing the cutover.',
+    },
+    RouterNotCanonical: {
+        human: 'The cutover batch names a router different from the paymaster hub’s live HATS pointer.',
+        suggestion: 'Build the cutover batch against the router currently used by PaymasterHub.',
+    },
     // --- Accounts / usernames (UniversalAccountRegistry, QuickJoin, PasskeyAccountFactory) ---
     AccountExists: {
         human: 'An account is already registered for this address.',
@@ -242,10 +331,10 @@ exports.ERROR_MESSAGES = {
     // contract-neutral — it previously named only the TaskManager permission bits, which
     // sent people to `pop task perms` for a voting or token failure.
     Unauthorized: {
-        human: 'Your wallet\'s hats do not carry the permission this action requires.',
-        suggestion: 'See which hats you hold with: pop user whoami. For task actions the required bit is '
+        human: 'Your account lacks the membership or permission this action requires.',
+        suggestion: 'Inspect your organization memberships with: pop user whoami. For task actions the required bit is '
             + 'one of CREATE/CLAIM/REVIEW/ASSIGN/SELF_REVIEW/BUDGET/EDIT_META/EDIT_FULL — inspect with '
-            + 'pop task perms show. For proposals, you need a creator hat: pop org roles.',
+            + 'pop task perms show. For proposals, inspect the authority creator permission on your roles or groups.',
     },
     UnauthorizedCaller: {
         human: 'Caller is not authorized for this executor operation.',
@@ -342,7 +431,8 @@ exports.ERROR_MESSAGES = {
         human: 'That hat is not allowed for this voting action.',
     },
     InvalidQuorum: {
-        human: 'Quorum percentage is out of range (must be 1-100).',
+        human: 'A nonzero quorum override or equal-weight tally requires a restricted proposal.',
+        suggestion: 'Specify --subject-ids for the restricted electorate. Quorum is a voter count, not a percentage.',
     },
     InvalidThreshold: {
         human: 'Threshold percentage is out of range.',
@@ -572,7 +662,7 @@ exports.ERROR_MESSAGES = {
     },
     // --- Paymaster hub ---
     NotAdmin: {
-        human: 'Caller is not the paymaster admin for this org.',
+        human: 'Caller is not an administrator authorized by this contract.',
     },
     NotOperator: {
         human: 'Caller is not a paymaster operator.',
@@ -621,8 +711,8 @@ exports.ERROR_MESSAGES = {
         human: 'This org is already registered with the paymaster.',
     },
     OrgNotRegistered: {
-        human: 'This org is not registered with the paymaster.',
-        suggestion: 'Register and fund it: pop paymaster deposit',
+        human: 'This organization is not registered in the registry required by this operation.',
+        suggestion: 'Check the organization ID and its registration in OrgRegistry or PaymasterHub, as applicable.',
     },
     OrgIsBanned: {
         human: 'This org is banned from paymaster sponsorship.',
@@ -767,6 +857,34 @@ exports.ERROR_MESSAGES = {
     InvalidSignature: {
         human: 'Signature verification failed.',
     },
+    AuthDataTooShort: {
+        human: 'WebAuthn authenticator data is shorter than the required 37 bytes.',
+        suggestion: 'Supply the complete authenticator data returned by the passkey authenticator.',
+    },
+    UserNotPresent: {
+        human: 'The passkey assertion does not confirm user presence.',
+        suggestion: 'Complete the authenticator’s user-presence prompt when authorizing the operation.',
+    },
+    ChallengeMismatch: {
+        human: 'The WebAuthn challenge is malformed or does not match the operation being authorized.',
+        suggestion: 'Check the challenge bytes, base64url encoding, and challenge index in the client data.',
+    },
+    MalformedClientData: {
+        human: 'The WebAuthn client data JSON or its field offsets are malformed.',
+        suggestion: 'Preserve the exact client data bytes and use the matching challenge and type offsets.',
+    },
+    InvalidWebAuthnSignature: {
+        human: 'The passkey assertion failed its challenge, authenticator flags, or signature checks.',
+        suggestion: 'Verify the credential, operation challenge, client data, and required authenticator verification flags.',
+    },
+    SignCountTooLow: {
+        human: 'The passkey signature counter did not advance beyond the stored value.',
+        suggestion: 'Check the credential’s counter and authenticator state; a reused assertion cannot authorize another operation.',
+    },
+    InvalidSignatureComponents: {
+        human: 'A P-256 signature component is zero or outside the curve’s valid range.',
+        suggestion: 'Check the r and s values extracted from the authenticator signature.',
+    },
     BeaconNotSet: {
         human: 'The passkey account beacon is not configured.',
     },

package/dist/graph/documents/activity.d.ts

@@ -6,4 +6,6 @@
  * Uses nested org queries for tasks/members (known working pattern),
  * and top-level queries for vouches/tokenRequests/proposals (validated in other query files).
  */
-export declare const FETCH_ORG_ACTIVITY = "\n  query FetchOrgActivity(\n    $orgId: Bytes!\n    $hybridVotingId: String\n    $eligibilityModuleId: Bytes\n    $tokenAddress: String\n  ) {\n    # Org overview + tasks + members via nested pattern (known working)\n    organization(id: $orgId) {\n      id\n      name\n      participationToken {\n        id\n        totalSupply\n        symbol\n      }\n      paymentManager {\n        distributionCounter\n      }\n      taskManager {\n        id\n        projects(where: { deleted: false }, first: 50) {\n          id\n          title\n          tasks(first: 200, orderBy: taskId, orderDirection: desc) {\n            id\n            taskId\n            title\n            status\n            payout\n            assignee\n            assigneeUsername\n            completer\n            completerUsername\n            createdAt\n            assignedAt\n            submittedAt\n            completedAt\n          }\n        }\n      }\n      users(orderBy: firstSeenAt, orderDirection: desc, first: 20) {\n        address\n        account { username }\n        membershipStatus\n        joinMethod\n        firstSeenAt\n        currentHatIds\n      }\n      directDemocracyVoting {\n        ddvProposals(\n          where: { status: \"Active\" }\n          orderBy: startTimestamp\n          orderDirection: desc\n          first: 50\n        ) {\n          id\n          proposalId\n          title\n          metadata { description optionNames }\n          numOptions\n          startTimestamp\n          endTimestamp\n          status\n          isHatRestricted\n          restrictedHatIds\n          votes { voter optionIndexes optionWeights }\n        }\n      }\n    }\n\n    # Active hybrid proposals \u2014 top-level query (validated: proposals entity exists)\n    activeHybridProposals: proposals(\n      where: { hybridVoting: $hybridVotingId, status: \"Active\" }\n      orderBy: startTimestamp\n      orderDirection: desc\n      first: 50\n    ) {\n      id\n      proposalId\n      title\n      metadata { description optionNames }\n      numOptions\n      startTimestamp\n      endTimestamp\n      status\n      isHatRestricted\n      restrictedHatIds\n      votes {\n        voter\n        voterUsername\n        optionIndexes\n        optionWeights\n        classRawPowers\n        votedAt\n      }\n    }\n\n    # Recently ended hybrid proposals (catch outcomes since last heartbeat)\n    endedHybridProposals: proposals(\n      where: { hybridVoting: $hybridVotingId, status: \"Ended\" }\n      orderBy: startTimestamp\n      orderDirection: desc\n      first: 10\n    ) {\n      id\n      proposalId\n      title\n      status\n      winningOption\n      isValid\n      wasExecuted\n      executionFailed\n      executionError\n      votes { voter optionIndexes optionWeights }\n    }\n\n    # Active vouches \u2014 top-level query (validated in vouch.ts). isActive carries the\n    # epoch filter: deployments that index the vouch epoch flip it false for every vouch\n    # a configureVouching/resetVouches/clearWearerVouches voided, so this listing needs no\n    # extra field. Older deployments still list superseded vouches \u2014 stale rather than\n    # wrong, which is fine for an activity feed but NOT for quorum maths (see vouch.ts).\n    activeVouches: vouches(\n      where: { eligibilityModule: $eligibilityModuleId, isActive: true }\n      orderBy: createdAt\n      orderDirection: desc\n      first: 100\n    ) {\n      hatId\n      wearer\n      wearerUsername\n      voucher\n      voucherUsername\n      vouchCount\n      createdAt\n    }\n\n    # Pending token requests \u2014 top-level query (validated in token.ts)\n    pendingTokenRequests: tokenRequests(\n      where: { participationToken: $tokenAddress, status: Pending }\n      orderBy: createdAt\n      orderDirection: desc\n      first: 50\n    ) {\n      requestId\n      requester\n      amount\n      metadata { reason }\n      status\n      createdAt\n    }\n  }\n";
+export declare const FETCH_ORG_ACTIVITY = "\n  query FetchOrgActivity(\n    $orgId: Bytes!\n    $hybridVotingId: String\n    $authorityId: Bytes\n    $tokenAddress: String\n  ) {\n    # Org overview + tasks + members via nested pattern (known working)\n    organization(id: $orgId) {\n      id\n      name\n      participationToken {\n        id\n        totalSupply\n        symbol\n      }\n      paymentManager {\n        distributionCounter\n      }\n      taskManager {\n        id\n        projects(where: { deleted: false }, first: 50) {\n          id\n          title\n          tasks(first: 200, orderBy: taskId, orderDirection: desc) {\n            id\n            taskId\n            title\n            status\n            payout\n            assignee\n            assigneeUsername\n            completer\n            completerUsername\n            createdAt\n            assignedAt\n            submittedAt\n            completedAt\n          }\n        }\n      }\n      users(orderBy: firstSeenAt, orderDirection: desc, first: 20) {\n        address\n        account { username }\n        membershipStatus\n        joinMethod\n        firstSeenAt\n        currentHatIds\n      }\n      directDemocracyVoting {\n        ddvProposals(\n          where: { status: \"Active\" }\n          orderBy: startTimestamp\n          orderDirection: desc\n          first: 50\n        ) {\n          id\n          proposalId\n          title\n          metadata { description optionNames }\n          numOptions\n          startTimestamp\n          endTimestamp\n          status\n          isHatRestricted\n          restrictedHatIds\n          votes { voter optionIndexes optionWeights }\n        }\n      }\n    }\n\n    # Active hybrid proposals \u2014 top-level query (validated: proposals entity exists)\n    activeHybridProposals: proposals(\n      where: { hybridVoting: $hybridVotingId, status: \"Active\" }\n      orderBy: startTimestamp\n      orderDirection: desc\n      first: 50\n    ) {\n      id\n      proposalId\n      title\n      metadata { description optionNames }\n      numOptions\n      startTimestamp\n      endTimestamp\n      status\n      isHatRestricted\n      restrictedHatIds\n      votes {\n        voter\n        voterUsername\n        optionIndexes\n        optionWeights\n        classRawPowers\n        votedAt\n      }\n    }\n\n    # Recently ended hybrid proposals (catch outcomes since last heartbeat)\n    endedHybridProposals: proposals(\n      where: { hybridVoting: $hybridVotingId, status: \"Ended\" }\n      orderBy: startTimestamp\n      orderDirection: desc\n      first: 10\n    ) {\n      id\n      proposalId\n      title\n      status\n      winningOption\n      isValid\n      wasExecuted\n      executionFailed\n      executionError\n      votes { voter optionIndexes optionWeights }\n    }\n\n    activeVouches: subjectVouchRecords(\n      where: { authority: $authorityId, active: true }\n      orderBy: vouchedAt\n      orderDirection: desc\n      first: 100\n    ) {\n      subject { subjectId }\n      wearer: user\n      membership { userUsername vouchCount }\n      voucher\n      voucherUsername\n      epoch\n      config { epoch }\n      createdAt: vouchedAt\n    }\n\n    # Pending token requests \u2014 top-level query (validated in token.ts)\n    pendingTokenRequests: tokenRequests(\n      where: { participationToken: $tokenAddress, status: Pending }\n      orderBy: createdAt\n      orderDirection: desc\n      first: 50\n    ) {\n      requestId\n      requester\n      amount\n      metadata { reason }\n      status\n      createdAt\n    }\n  }\n";
+/** Preserve activity JSON keys while taking the live epoch and count from authority rows. */
+export declare function normalizeAuthorityVouches(rows: any[]): any[];

package/dist/graph/documents/activity.js

@@ -9,11 +9,12 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FETCH_ORG_ACTIVITY = void 0;
+exports.normalizeAuthorityVouches = normalizeAuthorityVouches;
 exports.FETCH_ORG_ACTIVITY = `
   query FetchOrgActivity(
     $orgId: Bytes!
     $hybridVotingId: String
-    $eligibilityModuleId: Bytes
+    $authorityId: Bytes
     $tokenAddress: String
   ) {
     # Org overview + tasks + members via nested pattern (known working)
@@ -126,24 +127,20 @@ exports.FETCH_ORG_ACTIVITY = `
       votes { voter optionIndexes optionWeights }
     }
 
-    # Active vouches — top-level query (validated in vouch.ts). isActive carries the
-    # epoch filter: deployments that index the vouch epoch flip it false for every vouch
-    # a configureVouching/resetVouches/clearWearerVouches voided, so this listing needs no
-    # extra field. Older deployments still list superseded vouches — stale rather than
-    # wrong, which is fine for an activity feed but NOT for quorum maths (see vouch.ts).
-    activeVouches: vouches(
-      where: { eligibilityModule: $eligibilityModuleId, isActive: true }
-      orderBy: createdAt
+    activeVouches: subjectVouchRecords(
+      where: { authority: $authorityId, active: true }
+      orderBy: vouchedAt
       orderDirection: desc
       first: 100
     ) {
-      hatId
-      wearer
-      wearerUsername
+      subject { subjectId }
+      wearer: user
+      membership { userUsername vouchCount }
       voucher
       voucherUsername
-      vouchCount
-      createdAt
+      epoch
+      config { epoch }
+      createdAt: vouchedAt
     }
 
     # Pending token requests — top-level query (validated in token.ts)
@@ -162,3 +159,11 @@ exports.FETCH_ORG_ACTIVITY = `
     }
   }
 `;
+/** Preserve activity JSON keys while taking the live epoch and count from authority rows. */
+function normalizeAuthorityVouches(rows) {
+    return rows.filter(v => v.active !== false && v.config && String(v.epoch) === String(v.config.epoch))
+        .map(v => ({ hatId: v.subject.subjectId, wearer: v.wearer,
+        wearerUsername: v.membership?.userUsername ?? null, voucher: v.voucher,
+        voucherUsername: v.voucherUsername, vouchCount: v.membership?.vouchCount ?? 0,
+        createdAt: v.createdAt }));
+}

package/dist/graph/documents/org.d.ts

@@ -2,10 +2,10 @@
  * Organization Queries
  * Ported from frontend queries.js
  */
-export declare const FETCH_ORG_BY_ID = "\n  query FetchOrgById($id: Bytes!) {\n    organization(id: $id) {\n      id\n      name\n      metadataHash\n      deployedAt\n      topHatId\n      roleHatIds\n      participationToken {\n        id\n        name\n        symbol\n        totalSupply\n      }\n      quickJoin {\n        id\n      }\n      hybridVoting {\n        id\n        thresholdPct\n        quorum\n      }\n      directDemocracyVoting {\n        id\n        thresholdPct\n        quorum\n      }\n      taskManager {\n        id\n        projects {\n          id\n          title\n          deleted\n        }\n      }\n      educationHub {\n        id\n        nextModuleId\n      }\n      executorContract {\n        id\n      }\n      eligibilityModule {\n        id\n      }\n      paymentManager {\n        id\n      }\n      zkEmailInvites {\n        id\n      }\n      users {\n        id\n        address\n        account {\n          username\n          metadata {\n            avatar\n          }\n        }\n        participationTokenBalance\n        membershipStatus\n        currentHatIds\n      }\n      roles(where: { isUserRole: true }) {\n        id\n        hatId\n        name\n        image\n        canVote\n        isUserRole\n      }\n    }\n  }\n";
-export declare const FETCH_ORG_FULL_DATA = "\n  query FetchOrgFullData($orgId: Bytes!) {\n    organization(id: $orgId) {\n      id\n      name\n      metadataHash\n      metadataAdminHatId\n      metadata {\n        id\n        description\n        template\n        backgroundColor\n        logo\n        hideTreasury\n        useTokenSymbol\n        taskPayoutHoursOnly\n        taskPayoutHourlyRate\n        links {\n          name\n          url\n          index\n        }\n      }\n      deployedAt\n      topHatId\n      roleHatIds\n      participationToken {\n        id\n        name\n        symbol\n        totalSupply\n      }\n      quickJoin {\n        id\n      }\n      hybridVoting {\n        id\n        thresholdPct\n        quorum\n      }\n      directDemocracyVoting {\n        id\n        thresholdPct\n        quorum\n      }\n      zkEmailInvites {\n        id\n      }\n      taskManager {\n        id\n        creatorHatIds\n        projects(where: { deleted: false }, first: 100) {\n          id\n          tasks(first: 1000) {\n            id\n            status\n          }\n        }\n      }\n      educationHub {\n        id\n        modules {\n          id\n          moduleId\n          title\n          contentHash\n          metadata {\n            description\n            link\n            quiz\n            answersJson\n          }\n          payout\n          status\n          completions {\n            learner\n          }\n        }\n      }\n      executorContract {\n        id\n      }\n      eligibilityModule {\n        id\n      }\n      paymentManager {\n        id\n      }\n      users(orderBy: participationTokenBalance, orderDirection: desc, first: 100) {\n        id\n        address\n        account {\n          username\n          metadata {\n            avatar\n          }\n        }\n        participationTokenBalance\n        membershipStatus\n        currentHatIds\n        totalTasksCompleted\n        totalVotes\n        firstSeenAt\n      }\n      roles(where: { isUserRole: true }) {\n        id\n        hatId\n        name\n        image\n        canVote\n        isUserRole\n        hat {\n          name\n        }\n      }\n    }\n  }\n";
-export declare const GET_ORG_BY_NAME = "\n  query GetOrgByName($name: String!) {\n    organizations(where: { name: $name }, first: 1) {\n      id\n      name\n    }\n  }\n";
-export declare const FETCH_USER_ORGANIZATIONS = "\n  query FetchUserOrganizations($userAddress: Bytes!) {\n    users(where: { address: $userAddress, membershipStatus: Active }) {\n      id\n      membershipStatus\n      participationTokenBalance\n      totalTasksCompleted\n      totalVotes\n      organization {\n        id\n        name\n        metadataHash\n        participationToken {\n          symbol\n        }\n      }\n    }\n  }\n";
+export declare const FETCH_ORG_BY_ID = "\n  query FetchOrgById($id: Bytes!) {\n    organization(id: $id) {\n      id\n      name\n      metadataHash\n      deployedAt\n      topHatId\n      roleHatIds\n      participationToken {\n        id\n        name\n        symbol\n        totalSupply\n      }\n      quickJoin {\n        id\n      }\n      hybridVoting {\n        id\n        thresholdPct\n        quorum\n      }\n      directDemocracyVoting {\n        id\n        thresholdPct\n        quorum\n      }\n      taskManager {\n        id\n        projects {\n          id\n          title\n          deleted\n        }\n      }\n      educationHub {\n        id\n        nextModuleId\n      }\n      executorContract {\n        id\n      }\n      membershipAuthority {\n        id\n        isRouterBound\n        cutoverAt\n      }\n      paymentManager {\n        id\n      }\n      zkEmailInvites {\n        id\n      }\n      users {\n        id\n        address\n        account {\n          username\n          metadata {\n            avatar\n          }\n        }\n        participationTokenBalance\n        membershipStatus\n        currentHatIds\n      }\n      roles(where: { isUserRole: true }) {\n        id\n        hatId\n        name\n        image\n        canVote\n        isUserRole\n      }\n    }\n  }\n";
+export declare const FETCH_ORG_FULL_DATA = "\n  query FetchOrgFullData($orgId: Bytes!) {\n    organization(id: $orgId) {\n      id\n      name\n      metadataHash\n      metadataAdminHatId\n      metadata {\n        id\n        description\n        template\n        backgroundColor\n        logo\n        hideTreasury\n        useTokenSymbol\n        taskPayoutHoursOnly\n        taskPayoutHourlyRate\n        links {\n          name\n          url\n          index\n        }\n      }\n      deployedAt\n      topHatId\n      roleHatIds\n      participationToken {\n        id\n        name\n        symbol\n        totalSupply\n      }\n      quickJoin {\n        id\n      }\n      hybridVoting {\n        id\n        thresholdPct\n        quorum\n      }\n      directDemocracyVoting {\n        id\n        thresholdPct\n        quorum\n      }\n      zkEmailInvites {\n        id\n      }\n      taskManager {\n        id\n        creatorHatIds\n        projects(where: { deleted: false }, first: 100) {\n          id\n          tasks(first: 1000) {\n            id\n            status\n          }\n        }\n      }\n      educationHub {\n        id\n        modules {\n          id\n          moduleId\n          title\n          contentHash\n          metadata {\n            description\n            link\n            quiz\n            answersJson\n          }\n          payout\n          status\n          completions {\n            learner\n          }\n        }\n      }\n      executorContract {\n        id\n      }\n      membershipAuthority {\n        id\n        isRouterBound\n        cutoverAt\n      }\n      paymentManager {\n        id\n      }\n      users(orderBy: participationTokenBalance, orderDirection: desc, first: 100) {\n        id\n        address\n        account {\n          username\n          metadata {\n            avatar\n          }\n        }\n        participationTokenBalance\n        membershipStatus\n        currentHatIds\n        totalTasksCompleted\n        totalVotes\n        firstSeenAt\n      }\n      roles(where: { isUserRole: true }) {\n        id\n        hatId\n        name\n        image\n        canVote\n        isUserRole\n        hat {\n          name\n        }\n      }\n    }\n  }\n";
+export declare const GET_ORG_BY_NAME = "\n  query GetOrgByName($name: String!) {\n    organizations(where: { name: $name }, first: 100) {\n      id\n      name\n      membershipAuthority { id isRouterBound cutoverAt }\n    }\n  }\n";
+export declare const FETCH_USER_ORGANIZATIONS = "\n  query FetchUserOrganizations($userAddress: Bytes!) {\n    users(first: 1000, where: { address: $userAddress }) {\n      id\n      membershipStatus\n      participationTokenBalance\n      totalTasksCompleted\n      totalVotes\n      organization {\n        id\n        name\n        membershipAuthority { id isRouterBound cutoverAt }\n        metadataHash\n        participationToken {\n          symbol\n        }\n      }\n    }\n  }\n";
 /**
  * Just the org's payout convention + token symbol.
  *

package/dist/graph/documents/org.js

@@ -48,8 +48,10 @@ exports.FETCH_ORG_BY_ID = `
       executorContract {
         id
       }
-      eligibilityModule {
+      membershipAuthority {
         id
+        isRouterBound
+        cutoverAt
       }
       paymentManager {
         id
@@ -163,8 +165,10 @@ exports.FETCH_ORG_FULL_DATA = `
       executorContract {
         id
       }
-      eligibilityModule {
+      membershipAuthority {
         id
+        isRouterBound
+        cutoverAt
       }
       paymentManager {
         id
@@ -201,15 +205,16 @@ exports.FETCH_ORG_FULL_DATA = `
 `;
 exports.GET_ORG_BY_NAME = `
   query GetOrgByName($name: String!) {
-    organizations(where: { name: $name }, first: 1) {
+    organizations(where: { name: $name }, first: 100) {
       id
       name
+      membershipAuthority { id isRouterBound cutoverAt }
     }
   }
 `;
 exports.FETCH_USER_ORGANIZATIONS = `
   query FetchUserOrganizations($userAddress: Bytes!) {
-    users(where: { address: $userAddress, membershipStatus: Active }) {
+    users(first: 1000, where: { address: $userAddress }) {
       id
       membershipStatus
       participationTokenBalance
@@ -218,6 +223,7 @@ exports.FETCH_USER_ORGANIZATIONS = `
       organization {
         id
         name
+        membershipAuthority { id isRouterBound cutoverAt }
         metadataHash
         participationToken {
           symbol