@poa-box/core 0.1.0 → 1.0.0

package/dist/perms.js

@@ -5,11 +5,10 @@
  * TaskManager contract's per-member permission system.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VOUCH_FLAG_COMBINE_HIERARCHY = exports.VOUCH_FLAG_ENABLED = exports.PERM_BITS = void 0;
+exports.PERM_BITS = void 0;
 exports.parsePermList = parsePermList;
 exports.formatMask = formatMask;
 exports.describeMask = describeMask;
-exports.vouchConflictsWithDefaultEligibility = vouchConflictsWithDefaultEligibility;
 const errors_1 = require("./errors");
 exports.PERM_BITS = {
     create: 1,
@@ -99,22 +98,3 @@ function describeMask(mask) {
     }
     return sentences;
 }
-/**
- * EligibilityModule vouch-config flag bits (EligibilityModule.sol:156-157).
- * Packed into the `flags` byte of the VouchConfig tuple returned by getVouchConfig.
- */
-exports.VOUCH_FLAG_ENABLED = 0x01;
-exports.VOUCH_FLAG_COMBINE_HIERARCHY = 0x02;
-/**
- * Would enabling vouching and default-eligibility on the same hat conflict?
- *
- * Audit M-03 made these mutually exclusive in BOTH directions: a hat that everyone is eligible
- * for by default makes a vouch quorum a no-op, so the contract reverts
- * DefaultEligibilityConflictsWithVouch. The guard only fires when vouching is enabled AND
- * combineWithHierarchy is set — vouching alone, or without combine, is fine.
- */
-function vouchConflictsWithDefaultEligibility(vouchFlags, vouchQuorum, defaultEligible) {
-    const enabled = (vouchFlags & exports.VOUCH_FLAG_ENABLED) !== 0 && vouchQuorum > 0;
-    const combine = (vouchFlags & exports.VOUCH_FLAG_COMBINE_HIERARCHY) !== 0;
-    return enabled && combine && defaultEligible;
-}

package/dist/preflight.d.ts

@@ -41,8 +41,8 @@ export declare function runPreflight(provider: ethers.providers.Provider, checks
  * (the CLI resolves it from env via resolveSponsoredConfig).
  */
 export declare function checkGasBalance(address: string, minWei?: ethers.BigNumber, sponsored?: SponsoredConfig): PreflightCheck;
-/** Wearer holds the given hat (IHats balanceOf(wearer, hatId) > 0). */
-export declare function checkHasHat(hatsAddress: string, wearer: string, hatId: ethers.BigNumberish): PreflightCheck;
+/** Live accepted-and-eligible membership check for transaction preflight. */
+export declare function checkSubjectMembership(authorityAddress: string, user: string, subject: ethers.BigNumberish): PreflightCheck;
 /** Username is unregistered (UAR getAddressOfUsername returns the zero address). */
 export declare function checkUsernameFree(registryAddr: string, username: string): PreflightCheck;
 /**

package/dist/preflight.js

@@ -10,7 +10,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runPreflight = runPreflight;
 exports.checkGasBalance = checkGasBalance;
-exports.checkHasHat = checkHasHat;
+exports.checkSubjectMembership = checkSubjectMembership;
 exports.checkUsernameFree = checkUsernameFree;
 exports.checkTaskStatus = checkTaskStatus;
 exports.checkProposalActive = checkProposalActive;
@@ -122,29 +122,21 @@ function checkGasBalance(address, minWei, sponsored) {
         },
     };
 }
-const HATS_IFACE = new ethers_1.ethers.utils.Interface([
-    'function balanceOf(address wearer, uint256 hatId) view returns (uint256 balance)',
+const AUTHORITY_MEMBERSHIP_IFACE = new ethers_1.ethers.utils.Interface([
+    'function isMember(uint256 subject,address user) view returns (bool)',
 ]);
-/** Wearer holds the given hat (IHats balanceOf(wearer, hatId) > 0). */
-function checkHasHat(hatsAddress, wearer, hatId) {
-    const id = ethers_1.ethers.BigNumber.from(hatId);
-    return {
-        label: 'role (hat)',
-        call: { to: hatsAddress, data: HATS_IFACE.encodeFunctionData('balanceOf', [wearer, id]) },
-        interpret: (returnData, success) => {
-            if (!success || !returnData || returnData === '0x') {
-                return { ok: false, detail: 'could not read hat balance', suggestion: 'verify the Hats contract address' };
-            }
-            const balance = HATS_IFACE.decodeFunctionResult('balanceOf', returnData)[0];
-            if (!balance.isZero())
+/** Live accepted-and-eligible membership check for transaction preflight. */
+function checkSubjectMembership(authorityAddress, user, subject) {
+    const id = ethers_1.ethers.BigNumber.from(subject);
+    return { label: 'authority membership',
+        call: { to: authorityAddress, data: AUTHORITY_MEMBERSHIP_IFACE.encodeFunctionData('isMember', [id, user]) },
+        interpret: (data, success) => {
+            if (!success || !data || data === '0x')
+                return { ok: false, detail: 'Could not read MembershipAuthority membership' };
+            if (AUTHORITY_MEMBERSHIP_IFACE.decodeFunctionResult('isMember', data)[0])
                 return { ok: true };
-            return {
-                ok: false,
-                detail: `${wearer} does not wear hat ${id.toString()}`,
-                suggestion: 'list org roles with pop org roles, then request one via pop role apply',
-            };
-        },
-    };
+            return { ok: false, detail: `${user} is not a member of subject ${id.toString()}`, suggestion: 'List roles with pop org roles and accept eligible roles with pop role claim' };
+        } };
 }
 let uarInterface = null;
 function getUarInterface() {

package/dist/reads/authority.d.ts

@@ -0,0 +1,33 @@
+/** Current membership and permissions come exclusively from MembershipAuthority.
+ * Historical Role/User/task/proposal entities retain their original IDs. */
+import type { GraphClient } from '../graph/client';
+export interface AuthorityReadiness {
+    membershipAuthority?: {
+        id?: string;
+        isRouterBound?: boolean;
+        cutoverAt?: string | null;
+    } | null;
+}
+export declare function isAuthorityReady(org: AuthorityReadiness | null | undefined): boolean;
+export declare const FETCH_ORG_AUTHORITY = "query OrgAuthority($id: Bytes!) {\n  organization(id: $id) { id name membershipAuthority { id isRouterBound cutoverAt paused } }\n}";
+export declare const FETCH_AUTHORITY_SUBJECTS = "query AuthoritySubjects($orgId: Bytes!, $lastId: String!) {\n  subjects(first: 1000, orderBy: id, where: { organization: $orgId, id_gt: $lastId }) {\n    id subjectId kind name metadataCID imageURI maxMembers memberCount activeMemberCount defaultAllow\n    vouchConfig { quorum voucherSubjectId epoch }\n    managerConfig { managerSubjectId caps delaySecs }\n    memberRoles(first: 1000, where: { isActive: true }) { role { id subjectId name } }\n  }\n}";
+export declare const FETCH_AUTHORITY_MEMBERSHIPS = "query AuthorityMemberships($orgId: Bytes!, $lastId: String!) {\n  subjectMemberships(first: 1000, orderBy: id, where: { organization: $orgId, id_gt: $lastId }) {\n    id user userUsername accepted eligible isMember claimable acceptedAt seededWhilePaused\n    ruleKind eligibilitySource emailVerified vouchCount vouchEpoch vouchMet\n    rule { kind author delegable sticky }\n    subject { id subjectId kind name defaultAllow vouchConfig { quorum epoch } }\n    pendingAction { id pendingId action activatesAt status }\n  }\n}";
+/** Delegated offers are consumed by claim; only grants/removals use finalize. */
+export declare const FETCH_AUTHORITY_PENDING = "query AuthorityPendingActions($orgId: Bytes!, $lastId: String!) {\n  pendingActions(first: 1000, orderBy: id, where: { organization: $orgId, id_gt: $lastId }) {\n    id pendingId action user actor actorUsername activatesAt status createdAt resolvedAt cancelledBy transactionHash\n    subject { id subjectId kind name }\n  }\n}";
+export declare const FETCH_AUTHORITY_PERMS = "query AuthorityPerms($orgId: Bytes!, $lastId: String!) {\n  permRows(first: 1000, orderBy: id, where: { organization: $orgId, id_gt: $lastId }) {\n    id subject { id subjectId name kind } permKey ctx word value exists inheritGlobal\n  }\n}";
+export declare const FETCH_AUTHORITY_VOUCHES = "query AuthorityVouches($orgId: Bytes!, $lastId: String!) {\n  subjectVouchRecords(first: 1000, orderBy: id, where: { organization: $orgId, id_gt: $lastId }) {\n    id subject { id subjectId } user voucher voucherUsername active epoch seeded vouchedAt\n    config { epoch quorum voucherSubjectId }\n  }\n}";
+/** Cursor pagination avoids presenting a capped first page as a complete permission/member list. */
+export declare function readAuthorityRows(client: GraphClient, orgId: string, document: string, field: string, chainId?: number): Promise<any[]>;
+/** The index deliberately re-folds only ACCEPTED rows after subject-level configuration changes.
+ * Recompute the eligibility projection from current inputs so unaccepted offers/renounced seats do
+ * not retain a stale default or vouch quorum. `claimable` means eligible and unaccepted only: the
+ * pause, capacity and pending-offer checks still apply when the user actually calls claim(). */
+export declare function projectAuthorityMembership(row: any): any;
+export declare function readAuthorityMemberships(client: GraphClient, orgId: string, chainId?: number): Promise<any[]>;
+/** Low-level projection over already complete history. Callers supplying authority memberships must
+ * pass the org executor and retired eligibility addresses in systemAddresses. Prefer readAuthorityUsers
+ * to resolve that identity context and all history pages automatically. The optional argument keeps
+ * the existing pure-helper API compatible; it cannot infer system identities from a subject's name.
+ * An absent User entity is unknown history, not evidence of a zero balance or a new join. */
+export declare function projectAuthorityUsers(users: any[], memberships: any[], systemAddresses?: readonly string[]): any[];
+export declare function readAuthorityUsers(client: GraphClient, orgId: string, users: any[], chainId?: number): Promise<any[]>;

package/dist/reads/authority.js

@@ -0,0 +1,196 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FETCH_AUTHORITY_VOUCHES = exports.FETCH_AUTHORITY_PERMS = exports.FETCH_AUTHORITY_PENDING = exports.FETCH_AUTHORITY_MEMBERSHIPS = exports.FETCH_AUTHORITY_SUBJECTS = exports.FETCH_ORG_AUTHORITY = void 0;
+exports.isAuthorityReady = isAuthorityReady;
+exports.readAuthorityRows = readAuthorityRows;
+exports.projectAuthorityMembership = projectAuthorityMembership;
+exports.readAuthorityMemberships = readAuthorityMemberships;
+exports.projectAuthorityUsers = projectAuthorityUsers;
+exports.readAuthorityUsers = readAuthorityUsers;
+function isAuthorityReady(org) {
+    const authority = org?.membershipAuthority;
+    return !!authority?.id && /^0x[0-9a-f]{40}$/i.test(authority.id) && !/^0x0{40}$/i.test(authority.id)
+        && authority.isRouterBound === true && authority.cutoverAt != null && /^\d+$/.test(String(authority.cutoverAt)) && BigInt(authority.cutoverAt) > 0n;
+}
+exports.FETCH_ORG_AUTHORITY = `query OrgAuthority($id: Bytes!) {
+  organization(id: $id) { id name membershipAuthority { id isRouterBound cutoverAt paused } }
+}`;
+exports.FETCH_AUTHORITY_SUBJECTS = `query AuthoritySubjects($orgId: Bytes!, $lastId: String!) {
+  subjects(first: 1000, orderBy: id, where: { organization: $orgId, id_gt: $lastId }) {
+    id subjectId kind name metadataCID imageURI maxMembers memberCount activeMemberCount defaultAllow
+    vouchConfig { quorum voucherSubjectId epoch }
+    managerConfig { managerSubjectId caps delaySecs }
+    memberRoles(first: 1000, where: { isActive: true }) { role { id subjectId name } }
+  }
+}`;
+exports.FETCH_AUTHORITY_MEMBERSHIPS = `query AuthorityMemberships($orgId: Bytes!, $lastId: String!) {
+  subjectMemberships(first: 1000, orderBy: id, where: { organization: $orgId, id_gt: $lastId }) {
+    id user userUsername accepted eligible isMember claimable acceptedAt seededWhilePaused
+    ruleKind eligibilitySource emailVerified vouchCount vouchEpoch vouchMet
+    rule { kind author delegable sticky }
+    subject { id subjectId kind name defaultAllow vouchConfig { quorum epoch } }
+    pendingAction { id pendingId action activatesAt status }
+  }
+}`;
+/** Delegated offers are consumed by claim; only grants/removals use finalize. */
+exports.FETCH_AUTHORITY_PENDING = `query AuthorityPendingActions($orgId: Bytes!, $lastId: String!) {
+  pendingActions(first: 1000, orderBy: id, where: { organization: $orgId, id_gt: $lastId }) {
+    id pendingId action user actor actorUsername activatesAt status createdAt resolvedAt cancelledBy transactionHash
+    subject { id subjectId kind name }
+  }
+}`;
+exports.FETCH_AUTHORITY_PERMS = `query AuthorityPerms($orgId: Bytes!, $lastId: String!) {
+  permRows(first: 1000, orderBy: id, where: { organization: $orgId, id_gt: $lastId }) {
+    id subject { id subjectId name kind } permKey ctx word value exists inheritGlobal
+  }
+}`;
+exports.FETCH_AUTHORITY_VOUCHES = `query AuthorityVouches($orgId: Bytes!, $lastId: String!) {
+  subjectVouchRecords(first: 1000, orderBy: id, where: { organization: $orgId, id_gt: $lastId }) {
+    id subject { id subjectId } user voucher voucherUsername active epoch seeded vouchedAt
+    config { epoch quorum voucherSubjectId }
+  }
+}`;
+/** Cursor pagination avoids presenting a capped first page as a complete permission/member list. */
+async function readAuthorityRows(client, orgId, document, field, chainId) {
+    const rows = [];
+    let lastId = '';
+    for (;;) {
+        const result = await client.query(document, { orgId, lastId }, chainId);
+        const page = result[field];
+        if (!Array.isArray(page))
+            throw new Error(`MembershipAuthority index unavailable: missing ${field}. Update the subgraph; legacy fallback is unsupported.`);
+        rows.push(...page);
+        if (page.length < 1000)
+            return rows;
+        const next = String(page[page.length - 1].id);
+        if (next <= lastId)
+            throw new Error('MembershipAuthority pagination did not advance');
+        lastId = next;
+    }
+}
+/** The index deliberately re-folds only ACCEPTED rows after subject-level configuration changes.
+ * Recompute the eligibility projection from current inputs so unaccepted offers/renounced seats do
+ * not retain a stale default or vouch quorum. `claimable` means eligible and unaccepted only: the
+ * pause, capacity and pending-offer checks still apply when the user actually calls claim(). */
+function projectAuthorityMembership(row) {
+    const subject = row.subject;
+    if (subject?.kind !== 'Role' || typeof subject.defaultAllow !== 'boolean'
+        || typeof row.accepted !== 'boolean' || typeof row.emailVerified !== 'boolean'
+        || !['None', 'Grant', 'Ban'].includes(row.ruleKind)
+        || !Object.prototype.hasOwnProperty.call(subject, 'vouchConfig')) {
+        // Partial caller-supplied rows cannot be re-folded. Preserve them as explicitly cached data;
+        // the complete FETCH_AUTHORITY_MEMBERSHIPS document always supplies these non-null inputs.
+        return { ...row, membershipProjection: 'indexed-cache' };
+    }
+    const config = subject.vouchConfig;
+    const effectiveVouchCount = config && String(row.vouchEpoch) === String(config.epoch)
+        ? Number(row.vouchCount) : 0;
+    const vouchMet = Number(config?.quorum ?? 0) > 0 && effectiveVouchCount >= Number(config.quorum);
+    const eligibilitySource = row.ruleKind === 'Ban' ? 'ExplicitBan'
+        : row.ruleKind === 'Grant' ? 'ExplicitGrant'
+            : row.emailVerified ? 'EmailVerified'
+                : vouchMet ? 'VouchQuorum'
+                    : subject.defaultAllow ? 'SubjectDefault' : 'None';
+    const eligible = eligibilitySource !== 'ExplicitBan' && eligibilitySource !== 'None';
+    return { ...row,
+        indexedEligibility: { eligible: row.eligible, isMember: row.isMember, claimable: row.claimable,
+            eligibilitySource: row.eligibilitySource, vouchMet: row.vouchMet },
+        eligible, isMember: row.accepted && eligible, claimable: !row.accepted && eligible,
+        eligibilitySource, vouchMet, effectiveVouchCount, membershipProjection: 'current-authority-inputs',
+    };
+}
+async function readAuthorityMemberships(client, orgId, chainId) {
+    return (await readAuthorityRows(client, orgId, exports.FETCH_AUTHORITY_MEMBERSHIPS, 'subjectMemberships', chainId))
+        .map(projectAuthorityMembership);
+}
+/** Historical users are paginated separately from memberships: either collection can exceed a page.
+ * The retired eligibility address is identity metadata only, matching the subgraph's system-user
+ * exclusions. It never supplies a current membership or permission decision. */
+const AUTHORITY_USER_HISTORY = `query AuthorityUserHistory($orgId: Bytes!, $lastId: String!) {
+  organization(id: $orgId) { executorContract { id } eligibilityModule { id } }
+  users(first: 1000, orderBy: id, where: { organization: $orgId, id_gt: $lastId }) {
+    id address participationTokenBalance totalTasksCompleted totalTasksCancelled totalVotes totalModulesCompleted
+    totalClaimsAmount totalPaymentsAmount totalTokenRequestsAmount
+    firstSeenAt firstSeenAtBlock lastActiveAt lastActiveAtBlock joinMethod account { username }
+  }
+}`;
+async function readUserHistory(client, orgId, chainId) {
+    const users = [];
+    let lastId = '';
+    let systemAddresses = [];
+    for (;;) {
+        const result = await client.query(AUTHORITY_USER_HISTORY, { orgId, lastId }, chainId);
+        if (!result.organization || !Array.isArray(result.users))
+            throw new Error('Organization user history is unavailable');
+        systemAddresses = [result.organization.executorContract?.id, result.organization.eligibilityModule?.id].filter(Boolean);
+        users.push(...result.users);
+        if (result.users.length < 1000)
+            return { users, systemAddresses };
+        const next = String(result.users[result.users.length - 1].id);
+        if (next <= lastId)
+            throw new Error('Organization user history pagination did not advance');
+        lastId = next;
+    }
+}
+/** Low-level projection over already complete history. Callers supplying authority memberships must
+ * pass the org executor and retired eligibility addresses in systemAddresses. Prefer readAuthorityUsers
+ * to resolve that identity context and all history pages automatically. The optional argument keeps
+ * the existing pure-helper API compatible; it cannot infer system identities from a subject's name.
+ * An absent User entity is unknown history, not evidence of a zero balance or a new join. */
+function projectAuthorityUsers(users, memberships, systemAddresses = []) {
+    const excluded = new Set(systemAddresses.map(address => address.toLowerCase()));
+    const rows = new Map();
+    for (const user of users) {
+        const address = user.address.toLowerCase();
+        if (excluded.has(address))
+            continue;
+        const previous = rows.get(address);
+        const account = previous?.account && user.account
+            ? { ...previous.account, ...user.account }
+            : user.account === undefined ? previous?.account : user.account;
+        rows.set(address, { ...previous, ...user, account, historyIndexed: user.historyIndexed ?? true,
+            currentHatIds: [], subjects: [], membershipStatus: 'Inactive' });
+    }
+    for (const membership of memberships) {
+        if (membership.subject.kind !== 'Role')
+            continue;
+        const address = membership.user.toLowerCase();
+        if (excluded.has(address))
+            continue;
+        if (!rows.has(address))
+            rows.set(address, {
+                address, account: membership.userUsername ? { username: membership.userUsername } : null,
+                participationTokenBalance: null, totalTasksCompleted: null, totalVotes: null,
+                totalModulesCompleted: null, firstSeenAt: null, lastActiveAt: null, joinMethod: null,
+                historyIndexed: false, currentHatIds: [], subjects: [], membershipStatus: 'Inactive',
+            });
+        const row = rows.get(address);
+        row.subjects.push(membership);
+        if (membership.isMember) {
+            if (!row.currentHatIds.includes(membership.subject.subjectId))
+                row.currentHatIds.push(membership.subject.subjectId);
+            row.membershipStatus = 'Active';
+        }
+    }
+    return [...rows.values()];
+}
+async function readAuthorityUsers(client, orgId, users, chainId) {
+    const [history, memberships] = await Promise.all([
+        readUserHistory(client, orgId, chainId),
+        readAuthorityMemberships(client, orgId, chainId),
+    ]);
+    // Keep richer caller-specific fields (profile tasks, churn counters, etc.), while full history
+    // supplies canonical metrics even when the caller fetched only its first 20/100/1000 users.
+    return projectAuthorityUsers([...users, ...history.users], memberships, history.systemAddresses)
+        .map(user => ({ ...user, id: user.id ?? `${orgId.toLowerCase()}-${user.address.toLowerCase()}` }))
+        .sort((a, b) => {
+        // Member reports use the first rows as top holders; a cursor's ID order is not balance order.
+        if (a.participationTokenBalance == null)
+            return b.participationTokenBalance == null ? 0 : 1;
+        if (b.participationTokenBalance == null)
+            return -1;
+        const left = BigInt(a.participationTokenBalance);
+        const right = BigInt(b.participationTokenBalance);
+        return left > right ? -1 : left < right ? 1 : 0;
+    });
+}

package/dist/reads/index.d.ts

@@ -4,7 +4,6 @@
  */
 export * from './resolve';
 export * as education from './education';
-export * as eligibility from './eligibility';
 export * as org from './org';
 export * as paymaster from './paymaster';
 export * as project from './project';
@@ -14,3 +13,4 @@ export * as treasury from './treasury';
 export * as user from './user';
 export * as vote from './vote';
 export * as zkemail from './zkemail';
+export * as authority from './authority';

package/dist/reads/index.js

@@ -40,10 +40,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.zkemail = exports.vote = exports.user = exports.treasury = exports.token = exports.task = exports.project = exports.paymaster = exports.org = exports.eligibility = exports.education = void 0;
+exports.authority = exports.zkemail = exports.vote = exports.user = exports.treasury = exports.token = exports.task = exports.project = exports.paymaster = exports.org = exports.education = void 0;
 __exportStar(require("./resolve"), exports);
 exports.education = __importStar(require("./education"));
-exports.eligibility = __importStar(require("./eligibility"));
 exports.org = __importStar(require("./org"));
 exports.paymaster = __importStar(require("./paymaster"));
 exports.project = __importStar(require("./project"));
@@ -53,3 +52,4 @@ exports.treasury = __importStar(require("./treasury"));
 exports.user = __importStar(require("./user"));
 exports.vote = __importStar(require("./vote"));
 exports.zkemail = __importStar(require("./zkemail"));
+exports.authority = __importStar(require("./authority"));

package/dist/reads/org.d.ts

@@ -22,6 +22,11 @@ export interface OrgModuleRef {
 }
 /** Raw Organization row as returned by FETCH_ORG_FULL_DATA. */
 export interface OrganizationFullRow {
+    membershipAuthority: {
+        id: string;
+        isRouterBound: boolean;
+        cutoverAt: string | null;
+    } | null;
     id: string;
     name: string | null;
     metadataHash: string | null;
@@ -64,7 +69,6 @@ export interface OrganizationFullRow {
         modules: any[];
     } | null;
     executorContract: OrgModuleRef | null;
-    eligibilityModule: OrgModuleRef | null;
     paymentManager: OrgModuleRef | null;
     users: Array<{
         id: string;
@@ -75,7 +79,8 @@ export interface OrganizationFullRow {
                 avatar: string | null;
             } | null;
         } | null;
-        participationTokenBalance: string;
+        participationTokenBalance: string | null;
+        historyIndexed?: boolean;
         membershipStatus: string;
         currentHatIds: string[] | null;
         totalTasksCompleted: string | null;
@@ -95,7 +100,7 @@ export interface OrganizationFullRow {
     }>;
 }
 /** Verbatim from src/commands/org/list.ts. */
-export declare const LIST_ORGS_QUERY = "\n  query ListOrgs($first: Int!) {\n    organizations(first: $first, orderBy: deployedAt, orderDirection: desc) {\n      id\n      name\n      deployedAt\n    }\n  }\n";
+export declare const LIST_ORGS_QUERY = "\n  query ListOrgs($first: Int!) {\n    organizations(where: { membershipAuthority_: { isRouterBound: true, cutoverAt_gt: \"0\" } }, first: $first, orderBy: deployedAt, orderDirection: desc) {\n      id\n      name\n      deployedAt\n    }\n  }\n";
 /** Verbatim from src/commands/org/members.ts. */
 export declare const FETCH_MEMBERS = "\n  query FetchMembers($orgId: Bytes!) {\n    organization(id: $orgId) {\n      participationToken {\n        totalSupply\n      }\n      users(orderBy: participationTokenBalance, orderDirection: desc, first: 100) {\n        address\n        participationTokenBalance\n        membershipStatus\n        totalTasksCompleted\n        totalVotes\n        firstSeenAt\n        account {\n          username\n        }\n      }\n    }\n  }\n";
 /**
@@ -149,7 +154,8 @@ export declare function listOrgsAllChains(client: GraphClient, first?: number):
 export interface UserOrganizationRow {
     id: string;
     membershipStatus: string;
-    participationTokenBalance: string;
+    participationTokenBalance: string | null;
+    historyIndexed?: boolean;
     totalTasksCompleted: string | null;
     totalVotes: string | null;
     organization: {
@@ -165,6 +171,7 @@ export interface UserOrganizationRow {
  * Port of the `pop org list --member` read — src/commands/org/list.ts
  * (FETCH_USER_ORGANIZATIONS): active memberships for an address.
  */
+export declare const USER_AUTHORITY_ORGS_QUERY = "query UserAuthorityOrganizations($userAddress: Bytes!, $lastId: String!) {\n  subjectMemberships(first: 1000, orderBy: id, where: {\n    user: $userAddress, isMember: true, id_gt: $lastId, subject_: { kind: Role }\n  }) {\n    id organization { id name metadataHash membershipAuthority { id isRouterBound cutoverAt } participationToken { symbol } }\n    userEntity { id participationTokenBalance totalTasksCompleted totalVotes }\n  }\n}";
 export declare function listUserOrganizations(client: GraphClient, userAddress: string, chainId?: number): Promise<UserOrganizationRow[]>;
 export interface OrgMembersResult {
     participationToken: {
@@ -172,7 +179,9 @@ export interface OrgMembersResult {
     } | null;
     users: Array<{
         address: string;
-        participationTokenBalance: string;
+        participationTokenBalance: string | null;
+        /** False for a real authority wallet whose historical User entity is not indexed. */
+        historyIndexed?: boolean;
         membershipStatus: string;
         totalTasksCompleted: string | null;
         totalVotes: string | null;
@@ -184,7 +193,7 @@ export interface OrgMembersResult {
 }
 /**
  * Port of the `pop org members` read — src/commands/org/members.ts.
- * Raw member rows ordered by PT balance desc (top 100), plus totalSupply for
+ * Complete current member rows, plus totalSupply for
  * share math. Null when the org is not indexed.
  */
 export declare function listMembers(client: GraphClient, orgId: string, chainId?: number): Promise<OrgMembersResult | null>;
@@ -210,29 +219,20 @@ export interface OrgRolesResult {
         }>;
         users: Array<{
             address: string;
-            participationTokenBalance: string;
+            participationTokenBalance: string | null;
+            historyIndexed?: boolean;
             membershipStatus: string;
             currentHatIds: string[] | null;
             account: {
                 username: string | null;
             } | null;
         }>;
-        eligibilityModule: {
+        membershipAuthority: {
             id: string;
         } | null;
     } | null;
 }
-/**
- * Port of the `pop org roles` read — src/commands/org/roles.ts.
- *
- * Tier 0 carries Role.hat.vouchConfig (present + populated on Gnosis and
- * Arbitrum; a null vouchConfig means "never configured", verified equal to
- * isVouchingEnabled()==false / quorum==0 on-chain). Tier 1 is the
- * pre-vouchConfig schema; GraphQL validates the whole document, so the
- * unknown-field fallback is what keeps older deployments working. When
- * tierIndex === 1 serves, the CLI falls back to batched EligibilityModule
- * reads through Multicall3 — that RPC path stays host-side.
- */
+/** Current roles and membership are authority-owned; continuity fields retain their public names. */
 export declare function listRoles(client: GraphClient, orgId: string, chainId?: number): Promise<{
     data: OrgRolesResult;
     tierIndex: number;
@@ -247,7 +247,7 @@ export declare function listRoles(client: GraphClient, orgId: string, chainId?:
 export declare function getOrgActivity(client: GraphClient, modules: {
     orgId: string;
     hybridVotingAddress?: string | null;
-    eligibilityModuleAddress?: string | null;
+    membershipAuthorityAddress?: string | null;
     participationTokenAddress?: string | null;
 }, chainId?: number): Promise<any>;
 /**