@poa-box/core 0.1.0 → 1.0.0

package/dist/reads/org.js

@@ -15,7 +15,7 @@
  * "nonexistent".
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FETCH_MEMBERS = exports.LIST_ORGS_QUERY = void 0;
+exports.USER_AUTHORITY_ORGS_QUERY = exports.FETCH_MEMBERS = exports.LIST_ORGS_QUERY = void 0;
 exports.findOrgId = findOrgId;
 exports.getOrganization = getOrganization;
 exports.getOrgMetadataDoc = getOrgMetadataDoc;
@@ -33,13 +33,14 @@ const activity_1 = require("../graph/documents/activity");
 const infrastructure_1 = require("../graph/documents/infrastructure");
 const contracts_1 = require("../contracts");
 const ipfs_1 = require("../ipfs");
+const authority_1 = require("./authority");
 // ---------------------------------------------------------------------------
 // Inline documents ported from the org command files (not in src/queries)
 // ---------------------------------------------------------------------------
 /** Verbatim from src/commands/org/list.ts. */
 exports.LIST_ORGS_QUERY = `
   query ListOrgs($first: Int!) {
-    organizations(first: $first, orderBy: deployedAt, orderDirection: desc) {
+    organizations(where: { membershipAuthority_: { isRouterBound: true, cutoverAt_gt: "0" } }, first: $first, orderBy: deployedAt, orderDirection: desc) {
       id
       name
       deployedAt
@@ -77,10 +78,12 @@ exports.FETCH_MEMBERS = `
  * "not found" as data).
  */
 async function findOrgId(client, orgIdOrName, chainId) {
-    if (orgIdOrName.startsWith('0x'))
-        return orgIdOrName;
+    if (orgIdOrName.startsWith('0x')) {
+        const result = await client.query(authority_1.FETCH_ORG_AUTHORITY, { id: orgIdOrName }, chainId);
+        return (0, authority_1.isAuthorityReady)(result.organization) ? result.organization.id : null;
+    }
     const result = await client.query(org_1.GET_ORG_BY_NAME, { name: orgIdOrName }, chainId);
-    return result.organizations?.[0]?.id ?? null;
+    return result.organizations?.find(authority_1.isAuthorityReady)?.id ?? null;
 }
 /**
  * Port of the `pop org view` read — src/commands/org/view.ts.
@@ -92,7 +95,21 @@ async function getOrganization(client, orgIdOrName, chainId) {
     if (!orgId)
         return null;
     const result = await client.query(org_1.FETCH_ORG_FULL_DATA, { orgId }, chainId);
-    return result.organization ?? null;
+    const org = result.organization;
+    if (!org || !(0, authority_1.isAuthorityReady)(org))
+        return null;
+    const [subjects, users] = await Promise.all([
+        (0, authority_1.readAuthorityRows)(client, orgId, authority_1.FETCH_AUTHORITY_SUBJECTS, 'subjects', chainId),
+        (0, authority_1.readAuthorityUsers)(client, orgId, org.users ?? [], chainId),
+    ]);
+    org.users = users;
+    org.roles = subjects.filter(subject => subject.kind === 'Role').map(subject => {
+        const historical = org.roles?.find(role => role.hatId === subject.subjectId);
+        return { ...subject, id: historical?.id ?? `${orgId}-${subject.subjectId}`, hatId: subject.subjectId,
+            image: subject.imageURI, canVote: historical?.canVote ?? false,
+            canVoteSource: 'historical role metadata', isUserRole: historical?.isUserRole ?? false, hat: null };
+    });
+    return org;
 }
 /**
  * The org's metadata document: the indexed projection when present, else the
@@ -165,35 +182,80 @@ async function listOrgsAllChains(client, first = 50) {
  * Port of the `pop org list --member` read — src/commands/org/list.ts
  * (FETCH_USER_ORGANIZATIONS): active memberships for an address.
  */
+exports.USER_AUTHORITY_ORGS_QUERY = `query UserAuthorityOrganizations($userAddress: Bytes!, $lastId: String!) {
+  subjectMemberships(first: 1000, orderBy: id, where: {
+    user: $userAddress, isMember: true, id_gt: $lastId, subject_: { kind: Role }
+  }) {
+    id organization { id name metadataHash membershipAuthority { id isRouterBound cutoverAt } participationToken { symbol } }
+    userEntity { id participationTokenBalance totalTasksCompleted totalVotes }
+  }
+}`;
 async function listUserOrganizations(client, userAddress, chainId) {
-    const result = await client.query(org_1.FETCH_USER_ORGANIZATIONS, { userAddress }, chainId);
-    return result.users || [];
+    const rows = new Map();
+    let lastId = '';
+    for (;;) {
+        const page = await client.query(exports.USER_AUTHORITY_ORGS_QUERY, { userAddress: userAddress.toLowerCase(), lastId }, chainId);
+        if (!Array.isArray(page.subjectMemberships))
+            throw new Error('MembershipAuthority index unavailable: missing subjectMemberships');
+        for (const membership of page.subjectMemberships) {
+            const org = membership.organization;
+            if (!(0, authority_1.isAuthorityReady)(org))
+                continue;
+            const historical = membership.userEntity;
+            rows.set(org.id, { id: historical?.id ?? `${org.id}-${userAddress.toLowerCase()}`,
+                membershipStatus: 'Active', historyIndexed: historical != null,
+                participationTokenBalance: historical?.participationTokenBalance ?? null,
+                totalTasksCompleted: historical?.totalTasksCompleted ?? null, totalVotes: historical?.totalVotes ?? null, organization: org });
+        }
+        if (page.subjectMemberships.length < 1000)
+            return [...rows.values()];
+        const next = page.subjectMemberships[page.subjectMemberships.length - 1].id;
+        if (next <= lastId)
+            throw new Error('MembershipAuthority pagination did not advance');
+        lastId = next;
+    }
 }
 /**
  * Port of the `pop org members` read — src/commands/org/members.ts.
- * Raw member rows ordered by PT balance desc (top 100), plus totalSupply for
+ * Complete current member rows, plus totalSupply for
  * share math. Null when the org is not indexed.
  */
 async function listMembers(client, orgId, chainId) {
-    const result = await client.query(exports.FETCH_MEMBERS, { orgId }, chainId);
-    return result.organization ?? null;
+    const ready = await client.query(authority_1.FETCH_ORG_AUTHORITY, { id: orgId }, chainId);
+    if (!(0, authority_1.isAuthorityReady)(ready.organization))
+        return null;
+    const [result, users] = await Promise.all([
+        client.query(exports.FETCH_MEMBERS, { orgId }, chainId),
+        (0, authority_1.readAuthorityUsers)(client, orgId, [], chainId),
+    ]);
+    if (!result.organization)
+        return null;
+    return { ...result.organization, users: users.filter(user => user.membershipStatus === 'Active') };
 }
-/**
- * Port of the `pop org roles` read — src/commands/org/roles.ts.
- *
- * Tier 0 carries Role.hat.vouchConfig (present + populated on Gnosis and
- * Arbitrum; a null vouchConfig means "never configured", verified equal to
- * isVouchingEnabled()==false / quorum==0 on-chain). Tier 1 is the
- * pre-vouchConfig schema; GraphQL validates the whole document, so the
- * unknown-field fallback is what keeps older deployments working. When
- * tierIndex === 1 serves, the CLI falls back to batched EligibilityModule
- * reads through Multicall3 — that RPC path stays host-side.
- */
+/** Current roles and membership are authority-owned; continuity fields retain their public names. */
 async function listRoles(client, orgId, chainId) {
-    return client.queryWithFieldFallback([
-        { query: roles_1.FETCH_ROLES_MEMBERS_AND_VOUCH, variables: { id: orgId } },
-        { query: roles_1.FETCH_ROLES_AND_MEMBERS, variables: { id: orgId } },
-    ], { chainId });
+    const result = await client.query(`query AuthorityRoleContext($orgId: Bytes!) {
+    organization(id: $orgId) {
+      membershipAuthority { id isRouterBound cutoverAt }
+      roles { hatId canVote isUserRole }
+      users(first: 1000) { address participationTokenBalance account { username } }
+    }
+  }`, { orgId }, chainId);
+    const org = result.organization;
+    if (!(0, authority_1.isAuthorityReady)(org))
+        return { data: { organization: null }, tierIndex: 0 };
+    const [subjects, users] = await Promise.all([
+        (0, authority_1.readAuthorityRows)(client, orgId, authority_1.FETCH_AUTHORITY_SUBJECTS, 'subjects', chainId),
+        (0, authority_1.readAuthorityUsers)(client, orgId, org.users, chainId),
+    ]);
+    const roles = subjects.filter(s => s.kind === 'Role').map(subject => {
+        const continuity = org.roles.find((r) => r.hatId === subject.subjectId);
+        return { ...subject, id: orgId + '-' + subject.subjectId, hatId: subject.subjectId,
+            image: subject.imageURI, canVote: continuity?.canVote ?? false, isUserRole: continuity?.isUserRole ?? false,
+            hat: null,
+        };
+    });
+    return { data: { organization: { roles, users, membershipAuthority: org.membershipAuthority } }, tierIndex: 0 };
 }
 /**
  * Port of the `pop org status` activity read — src/commands/org/status.ts
@@ -203,12 +265,16 @@ async function listRoles(client, orgId, chainId) {
  * is separate infrastructure.
  */
 async function getOrgActivity(client, modules, chainId) {
-    return client.query(activity_1.FETCH_ORG_ACTIVITY, {
+    const result = await client.query(activity_1.FETCH_ORG_ACTIVITY, {
         orgId: modules.orgId,
         hybridVotingId: modules.hybridVotingAddress || '',
-        eligibilityModuleId: modules.eligibilityModuleAddress || '',
+        authorityId: modules.membershipAuthorityAddress || '',
         tokenAddress: modules.participationTokenAddress || '',
     }, chainId);
+    result.activeVouches = (0, activity_1.normalizeAuthorityVouches)(result.activeVouches ?? []);
+    if (result.organization)
+        result.organization.users = await (0, authority_1.readAuthorityUsers)(client, modules.orgId, result.organization.users ?? [], chainId);
+    return result;
 }
 /**
  * Global infrastructure addresses (`FETCH_INFRASTRUCTURE_ADDRESSES`) — the

package/dist/reads/project.js

@@ -12,10 +12,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.listProjects = listProjects;
 exports.resolveProjectInput = resolveProjectInput;
 const ethers_1 = require("ethers");
-const task_1 = require("../graph/documents/task");
 const encoding_1 = require("../encoding");
 const errors_1 = require("../errors");
 const exit_codes_1 = require("../exit-codes");
+const task_1 = require("./task");
 /**
  * List an org's (non-deleted) projects, tasks included.
  * Port of the read at src/commands/project/list.ts:37 — a bare
@@ -23,7 +23,7 @@ const exit_codes_1 = require("../exit-codes");
  * the deadline/release fields, so the base document always validates).
  */
 async function listProjects(client, orgId, chainId) {
-    const result = await client.query(task_1.FETCH_PROJECTS_DATA, { orgId }, chainId);
+    const { data: result } = await (0, task_1.fetchProjectsData)(client, orgId, chainId);
     return result.organization?.taskManager?.projects || [];
 }
 /**
@@ -48,7 +48,7 @@ async function resolveProjectInput(client, input, orgId, chainId) {
     // Title lookup via the subgraph (case-insensitive).
     let projects = [];
     try {
-        const result = await client.query(task_1.FETCH_PROJECTS_DATA, { orgId }, chainId);
+        const { data: result } = await (0, task_1.fetchProjectsData)(client, orgId, chainId);
         projects = result.organization?.taskManager?.projects || [];
     }
     catch {

package/dist/reads/resolve.d.ts

@@ -19,7 +19,7 @@ export interface OrgModules {
     educationHubAddress: string | null;
     executorAddress: string | null;
     quickJoinAddress: string | null;
-    eligibilityModuleAddress: string | null;
+    membershipAuthorityAddress: string | null;
     paymentManagerAddress: string | null;
     /** ZkEmailInvites proxy — null for orgs deployed without the optional ZK Email module. */
     zkEmailInvitesAddress: string | null;

package/dist/reads/resolve.js

@@ -10,6 +10,7 @@ exports.resolveOrgId = resolveOrgId;
 exports.resolveOrgModules = resolveOrgModules;
 exports.requireModule = requireModule;
 const org_1 = require("../graph/documents/org");
+const authority_1 = require("./authority");
 /**
  * Resolve an org identifier (name or hex ID) to its bytes32 ID.
  * Throws a helpful error if org is not provided.
@@ -19,13 +20,19 @@ async function resolveOrgId(client, orgIdOrName, chainId) {
         throw new Error('Missing --org flag. Provide --org or set POP_DEFAULT_ORG in .env');
     }
     if (orgIdOrName.startsWith('0x')) {
-        return orgIdOrName;
+        const result = await client.query(authority_1.FETCH_ORG_AUTHORITY, { id: orgIdOrName.toLowerCase() }, chainId);
+        if (!(0, authority_1.isAuthorityReady)(result.organization))
+            throw new Error('Organization is retired or has not completed its MembershipAuthority cutover. Only authority-ready organizations are supported.');
+        return result.organization.id;
     }
     const result = await client.query(org_1.GET_ORG_BY_NAME, { name: orgIdOrName }, chainId);
     if (!result.organizations?.length) {
         throw new Error(`Organization "${orgIdOrName}" not found. Use the hex ID or check the org name.`);
     }
-    return result.organizations[0].id;
+    const org = result.organizations.find(authority_1.isAuthorityReady);
+    if (!org)
+        throw new Error('Organization is retired or has not completed its MembershipAuthority cutover. Only authority-ready organizations are supported.');
+    return org.id;
 }
 /**
  * Resolve an org's deployed module addresses via subgraph.
@@ -37,6 +44,8 @@ async function resolveOrgModules(client, orgIdOrName, chainId) {
         throw new Error(`Organization ${orgId} not found on this chain`);
     }
     const org = result.organization;
+    if (!(0, authority_1.isAuthorityReady)(org))
+        throw new Error('Organization is retired or has not completed its MembershipAuthority cutover.');
     return {
         orgId: org.id,
         taskManagerAddress: org.taskManager?.id || null,
@@ -46,7 +55,7 @@ async function resolveOrgModules(client, orgIdOrName, chainId) {
         educationHubAddress: org.educationHub?.id || null,
         executorAddress: org.executorContract?.id || null,
         quickJoinAddress: org.quickJoin?.id || null,
-        eligibilityModuleAddress: org.eligibilityModule?.id || null,
+        membershipAuthorityAddress: org.membershipAuthority?.id || null,
         paymentManagerAddress: org.paymentManager?.id || null,
         zkEmailInvitesAddress: org.zkEmailInvites?.id || null,
     };

package/dist/reads/task.d.ts

@@ -77,7 +77,46 @@ export interface ProjectsDataRead {
  * The org's full projects → tasks tree with tier fallback.
  * Port of the read at src/commands/task/list.ts:129 (also view.ts:95).
  */
-export declare function fetchProjectsData(client: GraphClient, orgId: string, chainId?: number): Promise<ProjectsDataRead>;
+export declare function fetchProjectsData(client: Pick<GraphClient, 'queryWithFieldFallback'>, orgId: string, chainId?: number): Promise<ProjectsDataRead>;
+/** Canonical entity ID used by task-manager.ts; never cross an org boundary via a pasted ID. */
+export declare function taskEntityId(taskManagerAddress: string, input: string | number): string;
+/** Fetch one task without dropping old tasks or tasks in the 51st project. */
+export declare function fetchTaskData(client: Pick<GraphClient, 'queryWithFieldFallback'>, taskManagerAddress: string, input: string | number, chainId?: number): Promise<{
+    task: SubgraphTask | null;
+    tierIndex: number;
+}>;
+export interface TaskSubmissionRecord {
+    id: string;
+    submissionHash: string;
+    submittedAt: string;
+    submittedAtBlock: string;
+    transactionHash: string;
+    metadata: {
+        submission?: string | null;
+    } | null;
+}
+export interface TaskReviewRecord {
+    id: string;
+    rejector: string;
+    rejectorUsername?: string | null;
+    rejectionHash: string;
+    rejectedAt: string;
+    rejectedAtBlock: string;
+    transactionHash: string;
+    metadata: {
+        rejection?: string | null;
+    } | null;
+    submission: TaskSubmissionRecord | null;
+}
+export interface TaskSubmissionHistory {
+    indexed: boolean;
+    latestSubmission: TaskSubmissionRecord | null;
+    latestRejection: string | null;
+    submissions: TaskSubmissionRecord[];
+    rejections: TaskReviewRecord[];
+}
+/** Full immutable submission/review history, with explicit old-deployment fallback. */
+export declare function fetchTaskSubmissionHistory(client: Pick<GraphClient, 'queryWithFieldFallback'>, taskManagerAddress: string, input: string | number, chainId?: number): Promise<TaskSubmissionHistory>;
 /** A task row flattened out of the projects tree, with its project attached. */
 export interface TaskListRow extends SubgraphTask {
     /** Composite project entity id the task belongs to. */
@@ -150,26 +189,14 @@ export interface TaskStatsRead {
  * Port of the read at src/commands/task/stats.ts:62 (aggregation stays host-side).
  */
 export declare function fetchTaskStats(client: GraphClient, orgId: string, chainId?: number): Promise<TaskStatsRead>;
-/**
- * Tier 0: deployed v4 schema — GlobalRolePermission masks, organizerHatIds,
- * per-project ProjectRolePermission masks.
- * Port of PERMS_QUERY_FULL at src/commands/task/perms.ts:55. Masks are
- * subgraph-only: they are NOT readable per-wearer on-chain.
- */
-export declare const PERMS_QUERY_FULL = "\n  query TaskPermsFull($orgId: Bytes!) {\n    organization(id: $orgId) {\n      id\n      taskManager {\n        id\n        creatorHatIds\n        organizerHatIds\n        globalRolePermissions { hatId mask }\n        projects(where: { deleted: false }, first: 50) {\n          id\n          title\n          rolePermissions { hatId mask }\n        }\n      }\n    }\n  }\n";
-/** Tier 1: older schema — no global perms/organizer hats; boolean per-project flags. */
-export declare const PERMS_QUERY_LEGACY = "\n  query TaskPermsLegacy($orgId: Bytes!) {\n    organization(id: $orgId) {\n      id\n      taskManager {\n        id\n        creatorHatIds\n        projects(where: { deleted: false }, first: 50) {\n          id\n          title\n          rolePermissions { hatId canCreate canClaim canReview canAssign }\n        }\n      }\n    }\n  }\n";
-/** Tier array for `queryWithFieldFallback`, matching the CLI's order. */
+/** Historical project identity plus current authority readiness; no legacy permission rows. */
+export declare const PERMS_QUERY_FULL = "query TaskPermsFull($orgId: Bytes!) {\n  organization(id: $orgId) {\n    id membershipAuthority { id isRouterBound cutoverAt }\n    taskManager { id creatorHatIds organizerHatIds projects(where: { deleted: false }, first: 1000) { id title } }\n  }\n}";
 export declare function taskPermsTiers(orgId: string): FieldFallbackTier[];
 export interface SubgraphRolePermission {
+    /** Stable compatibility label; values are authority subject ids (including adopted legacy ids). */
     hatId: string;
-    /** Tier 0 field. */
+    subjectId?: string;
     mask?: number | string;
-    /** Tier 1 (legacy) boolean fields. */
-    canCreate?: boolean;
-    canClaim?: boolean;
-    canReview?: boolean;
-    canAssign?: boolean;
 }
 export interface TaskPermsResult {
     organization: {
@@ -196,11 +223,6 @@ export interface TaskPermsRead {
  * src/commands/task/perms.ts:175 (`pop task perms show`).
  */
 export declare function fetchTaskPerms(client: GraphClient, orgId: string, chainId?: number): Promise<TaskPermsRead>;
-/**
- * Rebuild a mask from tier-1 boolean flags (partial: only bits 1..8 indexable).
- * Port of src/commands/task/perms.ts maskFromBooleans.
- */
-export declare function maskFromBooleans(rp: SubgraphRolePermission): number;
 /**
  * Resolve --project-style input (bytes32 hex, subgraph composite ID, or title)
  * to the on-chain bytes32 pid using an already-fetched projects list.

package/dist/reads/task.js

@@ -11,21 +11,24 @@
  * verbatim, comments included — the live-verification notes are load-bearing.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FOLDERS_QUERY_LEGACY = exports.FOLDERS_QUERY_FULL = exports.PERMS_QUERY_LEGACY = exports.PERMS_QUERY_FULL = exports.FETCH_TASK_STATS_LEGACY = exports.FETCH_TASK_STATS = void 0;
+exports.FOLDERS_QUERY_LEGACY = exports.FOLDERS_QUERY_FULL = exports.PERMS_QUERY_FULL = exports.FETCH_TASK_STATS_LEGACY = exports.FETCH_TASK_STATS = void 0;
 exports.fetchProjectsData = fetchProjectsData;
+exports.taskEntityId = taskEntityId;
+exports.fetchTaskData = fetchTaskData;
+exports.fetchTaskSubmissionHistory = fetchTaskSubmissionHistory;
 exports.listTasks = listTasks;
 exports.findSubgraphTask = findSubgraphTask;
 exports.fetchTaskStats = fetchTaskStats;
 exports.taskPermsTiers = taskPermsTiers;
 exports.fetchTaskPerms = fetchTaskPerms;
-exports.maskFromBooleans = maskFromBooleans;
 exports.resolveProjectFromList = resolveProjectFromList;
 exports.fetchOrgFolders = fetchOrgFolders;
 exports.normalizeRoot = normalizeRoot;
 exports.fetchTaskReleaseHistory = fetchTaskReleaseHistory;
 const task_1 = require("../graph/documents/task");
 const encoding_1 = require("../encoding");
-const perms_1 = require("../perms");
+const authority_1 = require("./authority");
+const authority_2 = require("../tx/authority");
 const errors_1 = require("../errors");
 const exit_codes_1 = require("../exit-codes");
 const ethers_1 = require("ethers");
@@ -34,14 +37,103 @@ const ethers_1 = require("ethers");
  * Port of the read at src/commands/task/list.ts:129 (also view.ts:95).
  */
 async function fetchProjectsData(client, orgId, chainId) {
-    const { data, tierIndex } = await client.queryWithFieldFallback((0, task_1.projectsDataTiers)(orgId), { chainId });
+    const first = await client.queryWithFieldFallback((0, task_1.projectsDataTiers)(orgId), { chainId });
+    let tierIndex = first.tierIndex;
+    const data = first.data;
+    const manager = data.organization?.taskManager;
+    if (!manager)
+        return { data, tierIndex, hasDeadlineData: tierIndex <= 1, hasReleaseData: tierIndex === 0 };
+    const projects = [...(manager.projects ?? [])];
+    let page = manager.projects ?? [];
+    while (page.length === 50) {
+        const cursor = page[page.length - 1].id;
+        const next = await client.queryWithFieldFallback((0, task_1.projectsDataTiers)(orgId).map(tier => ({ ...tier, variables: { orgId, projectCursor: cursor } })), { chainId });
+        if (!next.data.organization?.taskManager?.projects)
+            throw new errors_1.CliError('Project pagination returned an incomplete response', exit_codes_1.EXIT.INFRA);
+        page = next.data.organization.taskManager.projects;
+        if (page.some(p => p.id <= cursor))
+            throw new errors_1.CliError('Project pagination did not advance', exit_codes_1.EXIT.INFRA);
+        projects.push(...page);
+        tierIndex = Math.max(tierIndex, next.tierIndex);
+    }
+    const completeProjects = await Promise.all(projects.map(async (project) => {
+        const tasks = [...(project.tasks ?? [])];
+        let taskPage = project.tasks ?? [];
+        while (taskPage.length === 1000) {
+            const cursor = taskPage[taskPage.length - 1].taskId;
+            const next = await client.queryWithFieldFallback(task_1.PROJECT_TASK_PAGE_TIERS.map(query => ({ query, variables: { projectId: project.id, taskCursor: cursor } })), { chainId });
+            if (!next.data.project?.tasks)
+                throw new errors_1.CliError('Task pagination returned an incomplete response', exit_codes_1.EXIT.INFRA);
+            taskPage = next.data.project.tasks;
+            if (taskPage.some(t => ethers_1.ethers.BigNumber.from(t.taskId).gte(cursor)))
+                throw new errors_1.CliError('Task pagination did not advance', exit_codes_1.EXIT.INFRA);
+            tasks.push(...taskPage);
+            tierIndex = Math.max(tierIndex, next.tierIndex);
+        }
+        return { ...project, tasks };
+    }));
     return {
-        data,
+        data: { ...data, organization: { ...data.organization, taskManager: { ...manager, projects: completeProjects } } },
         tierIndex,
         hasDeadlineData: tierIndex <= 1,
         hasReleaseData: tierIndex === 0,
     };
 }
+/** Canonical entity ID used by task-manager.ts; never cross an org boundary via a pasted ID. */
+function taskEntityId(taskManagerAddress, input) {
+    const address = ethers_1.ethers.utils.getAddress(taskManagerAddress).toLowerCase();
+    if (typeof input === 'number' && !Number.isSafeInteger(input))
+        throw new errors_1.CliError('Task ID must be an exact integer string', exit_codes_1.EXIT.USAGE);
+    const raw = String(input).trim();
+    if (raw.includes('-') && raw.split('-')[0].toLowerCase() !== address)
+        throw new errors_1.CliError('Task ID belongs to a different TaskManager', exit_codes_1.EXIT.USAGE);
+    const parsed = (0, encoding_1.parseTaskId)(raw);
+    if (!/^\d+$/.test(parsed) || raw.split('-').length > 2)
+        throw new errors_1.CliError('Task ID must be a non-negative integer or a TaskManager-taskId entity ID', exit_codes_1.EXIT.USAGE);
+    const number = ethers_1.ethers.BigNumber.from(parsed);
+    if (number.gt(ethers_1.ethers.constants.MaxUint256))
+        throw new errors_1.CliError('Task ID exceeds uint256', exit_codes_1.EXIT.USAGE);
+    return `${address}-${number.toString()}`;
+}
+/** Fetch one task without dropping old tasks or tasks in the 51st project. */
+async function fetchTaskData(client, taskManagerAddress, input, chainId) {
+    const taskId = taskEntityId(taskManagerAddress, input);
+    const { data, tierIndex } = await client.queryWithFieldFallback([task_1.FETCH_TASK_DATA_WITH_RELEASES, task_1.FETCH_TASK_DATA, task_1.FETCH_TASK_DATA_LEGACY].map(query => ({ query, variables: { taskId } })), { chainId });
+    return { task: data.task ?? null, tierIndex };
+}
+/** Full immutable submission/review history, with explicit old-deployment fallback. */
+async function fetchTaskSubmissionHistory(client, taskManagerAddress, input, chainId) {
+    const taskId = taskEntityId(taskManagerAddress, input);
+    const history = { indexed: false, latestSubmission: null, latestRejection: null, submissions: [], rejections: [] };
+    let submissionCursor = '0x';
+    let rejectionCursor = '0x';
+    while (true) {
+        const { data, tierIndex } = await client.queryWithFieldFallback([
+            { query: task_1.FETCH_TASK_SUBMISSION_HISTORY, variables: { taskId, submissionCursor, rejectionCursor } },
+            { query: task_1.FETCH_TASK_RELEASE_HISTORY_LEGACY, variables: { taskId } },
+        ], { chainId });
+        if (tierIndex !== 0 || !data.task)
+            return history;
+        history.indexed = true;
+        history.latestSubmission = data.task.latestSubmission ?? null;
+        history.latestRejection = data.task.latestRejection?.id ?? null;
+        const submissions = data.task.submissions ?? [];
+        const rejections = data.task.rejections ?? [];
+        if (submissions.some(row => row.id <= submissionCursor) || rejections.some(row => row.id <= rejectionCursor))
+            throw new errors_1.CliError('Task history pagination did not advance', exit_codes_1.EXIT.INFRA);
+        history.submissions.push(...submissions);
+        history.rejections.push(...rejections);
+        if (submissions.length < 1000 && rejections.length < 1000)
+            break;
+        if (submissions.length)
+            submissionCursor = submissions[submissions.length - 1].id;
+        if (rejections.length)
+            rejectionCursor = rejections[rejections.length - 1].id;
+    }
+    history.submissions.sort((a, b) => Number(BigInt(b.submittedAtBlock) - BigInt(a.submittedAtBlock)));
+    history.rejections.sort((a, b) => Number(BigInt(b.rejectedAtBlock) - BigInt(a.rejectedAtBlock)));
+    return history;
+}
 /**
  * Flat list of an org's tasks — the friendliest first read (`pop task list`'s
  * data, sans rendering). Sugar over fetchProjectsData: same tiered query, the
@@ -132,76 +224,43 @@ async function fetchTaskStats(client, orgId, chainId) {
     return { data, tierIndex, hasChurnCounters: tierIndex === 0 };
 }
 // ────────────────────── permission masks ──────────────────────
-/**
- * Tier 0: deployed v4 schema — GlobalRolePermission masks, organizerHatIds,
- * per-project ProjectRolePermission masks.
- * Port of PERMS_QUERY_FULL at src/commands/task/perms.ts:55. Masks are
- * subgraph-only: they are NOT readable per-wearer on-chain.
- */
-exports.PERMS_QUERY_FULL = `
-  query TaskPermsFull($orgId: Bytes!) {
-    organization(id: $orgId) {
-      id
-      taskManager {
-        id
-        creatorHatIds
-        organizerHatIds
-        globalRolePermissions { hatId mask }
-        projects(where: { deleted: false }, first: 50) {
-          id
-          title
-          rolePermissions { hatId mask }
-        }
-      }
-    }
+/** Historical project identity plus current authority readiness; no legacy permission rows. */
+exports.PERMS_QUERY_FULL = `query TaskPermsFull($orgId: Bytes!) {
+  organization(id: $orgId) {
+    id membershipAuthority { id isRouterBound cutoverAt }
+    taskManager { id creatorHatIds organizerHatIds projects(where: { deleted: false }, first: 1000) { id title } }
   }
-`;
-/** Tier 1: older schema — no global perms/organizer hats; boolean per-project flags. */
-exports.PERMS_QUERY_LEGACY = `
-  query TaskPermsLegacy($orgId: Bytes!) {
-    organization(id: $orgId) {
-      id
-      taskManager {
-        id
-        creatorHatIds
-        projects(where: { deleted: false }, first: 50) {
-          id
-          title
-          rolePermissions { hatId canCreate canClaim canReview canAssign }
-        }
-      }
-    }
-  }
-`;
-/** Tier array for `queryWithFieldFallback`, matching the CLI's order. */
+}`;
 function taskPermsTiers(orgId) {
-    return [
-        { query: exports.PERMS_QUERY_FULL, variables: { orgId } },
-        { query: exports.PERMS_QUERY_LEGACY, variables: { orgId } },
-    ];
+    return [{ query: exports.PERMS_QUERY_FULL, variables: { orgId } }];
 }
 /**
  * Global + per-project permission masks. Port of the read at
  * src/commands/task/perms.ts:175 (`pop task perms show`).
  */
 async function fetchTaskPerms(client, orgId, chainId) {
-    return client.queryWithFieldFallback(taskPermsTiers(orgId), { chainId });
-}
-/**
- * Rebuild a mask from tier-1 boolean flags (partial: only bits 1..8 indexable).
- * Port of src/commands/task/perms.ts maskFromBooleans.
- */
-function maskFromBooleans(rp) {
-    let mask = 0;
-    if (rp.canCreate)
-        mask |= perms_1.PERM_BITS.create;
-    if (rp.canClaim)
-        mask |= perms_1.PERM_BITS.claim;
-    if (rp.canReview)
-        mask |= perms_1.PERM_BITS.review;
-    if (rp.canAssign)
-        mask |= perms_1.PERM_BITS.assign;
-    return mask;
+    const data = await client.query(exports.PERMS_QUERY_FULL, { orgId }, chainId);
+    if (!(0, authority_1.isAuthorityReady)(data.organization))
+        return { data: { organization: null }, tierIndex: 0 };
+    const tm = data.organization.taskManager;
+    if (!tm)
+        return { data, tierIndex: 0 };
+    const rows = (await (0, authority_1.readAuthorityRows)(client, orgId, authority_1.FETCH_AUTHORITY_PERMS, 'permRows', chainId))
+        .filter(row => row.exists && row.permKey.toLowerCase() === authority_2.AUTHORITY_KEYS.TM_PERMS.toLowerCase());
+    const global = new Map(rows.filter(row => row.ctx.toLowerCase() === ethers_1.ethers.constants.HashZero).map(row => [row.subject.subjectId, row]));
+    // TaskManager consumes the low uint8 of the authority's OR-mask result.
+    const mask = (row) => row ? ethers_1.ethers.BigNumber.from(row.value).and(255).toNumber() : 0;
+    const projectRows = (pid) => {
+        const ctx = (0, authority_2.projectContext)((0, encoding_1.parseProjectId)(pid)).toLowerCase();
+        const scoped = new Map(rows.filter(row => row.ctx.toLowerCase() === ctx).map(row => [row.subject.subjectId, row]));
+        return [...new Set([...global.keys(), ...scoped.keys()])].map(subjectId => {
+            const row = scoped.get(subjectId);
+            return { hatId: subjectId, subjectId, mask: row ? mask(row) | (row.inheritGlobal ? mask(global.get(subjectId)) : 0) : mask(global.get(subjectId)) };
+        });
+    };
+    tm.globalRolePermissions = [...global.entries()].map(([subjectId, row]) => ({ hatId: subjectId, subjectId, mask: mask(row) }));
+    tm.projects = tm.projects.map((p) => ({ ...p, rolePermissions: projectRows(p.id) }));
+    return { data, tierIndex: 0 };
 }
 /**
  * Resolve --project-style input (bytes32 hex, subgraph composite ID, or title)