@poa-box/core 0.1.0 → 1.0.0

package/dist/tx/index.js

@@ -40,10 +40,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.zkemail = exports.vote = exports.user = exports.treasury = exports.token = exports.task = exports.project = exports.paymaster = exports.org = exports.governance = exports.eligibility = exports.education = void 0;
+exports.authority = exports.zkemail = exports.vote = exports.user = exports.treasury = exports.token = exports.task = exports.project = exports.paymaster = exports.org = exports.governance = exports.education = void 0;
 __exportStar(require("./intent"), exports);
 exports.education = __importStar(require("./education"));
-exports.eligibility = __importStar(require("./eligibility"));
 exports.governance = __importStar(require("./governance"));
 exports.org = __importStar(require("./org"));
 exports.paymaster = __importStar(require("./paymaster"));
@@ -54,3 +53,4 @@ exports.treasury = __importStar(require("./treasury"));
 exports.user = __importStar(require("./user"));
 exports.vote = __importStar(require("./vote"));
 exports.zkemail = __importStar(require("./zkemail"));
+exports.authority = __importStar(require("./authority"));

package/dist/tx/org.d.ts

@@ -27,44 +27,45 @@ export interface OrgDeployConfig {
     autoUpgrade?: boolean;
     hybridVoting: {
         thresholdPct: number;
+        quorum?: number;
         classes: Array<{
             strategy: 'DIRECT' | 'ERC20_BAL';
             slicePct: number;
             quadratic?: boolean;
             minBalance?: string;
             asset?: string;
-            hatIds?: number[];
+            subjectIds?: string[];
         }>;
     };
-    directDemocracy: {
+    directDemocracy?: {
         thresholdPct: number;
+        quorum?: number;
     };
     roles: Array<{
         name: string;
         image?: string;
         canVote: boolean;
+        metadataCID?: string;
+        open: boolean;
+        maxMembers?: number;
         vouching?: {
             enabled: boolean;
             quorum: number;
             voucherRoleIndex: number;
-            combineWithHierarchy?: boolean;
-        };
-        defaults?: {
-            eligible: boolean;
-            standing: boolean;
-        };
-        hierarchy?: {
-            adminRoleIndex: number;
         };
         distribution?: {
             mintToDeployer: boolean;
             additionalWearers?: string[];
         };
-        hatConfig?: {
-            maxSupply: number;
-            mutableHat: boolean;
-        };
     }>;
+    groups?: Array<{
+        name: string;
+        memberRoleIndices: number[];
+    }>;
+    token?: {
+        name?: string;
+        symbol?: string;
+    };
     roleAssignments: {
         quickJoinRoles: number[];
         tokenMemberRoles: number[];
@@ -90,7 +91,7 @@ export interface OrgDeployConfig {
     };
     /**
      * Optional org-wide TaskManager ROLE_PERM grants applied at deploy time
-     * (OrgDeployer.TaskManagerPermConfig — roleIndices resolve to hat IDs,
+     * (OrgDeployer.TaskManagerPermConfig — roleIndices resolve to subject IDs,
      * masks are TaskPerm bitmasks: 1=create 2=claim 4=review 8=assign …).
      */
     taskManagerPerms?: {
@@ -103,13 +104,15 @@ export declare function indicesToBitmap(indices: number[]): ethers.BigNumber;
 /**
  * Reject role indices that do not name a role in the config.
  *
- * RoleResolver reverts UnregisteredRole(roleIdx) when a bitmap bit has no registered hat
+ * The deployer rejects any bitmap bit without a registered role
  * (audit M-09) — previously hat 0 was silently stored as an "authorized" hat and the deploy
  * succeeded with a broken allowlist. Either way the config is wrong, and we know roles.length
  * here, so name the offending field instead of surfacing a bare index from gas estimation
  * (older deployers) or an aborted deploy (upgraded ones).
  */
 export declare function assertRoleIndices(field: string, indices: number[] | undefined, roleCount: number): void;
+/** Reject legacy access configs and validate the authority's genesis invariants before I/O. */
+export declare function validateOrgDeployConfig(config: OrgDeployConfig): void;
 /**
  * Derive the deterministic orgId + normalized name the deployer uses:
  * orgId = keccak256(orgName.toLowerCase().replace(/\s+/g, '-')).
@@ -189,7 +192,7 @@ export declare const DEPLOY_FULL_ORG_GAS_LIMIT = 15000000;
 /**
  * Pure assembly of the DeploymentParams struct — port of the param build in
  * `pop org deploy` (src/commands/org/deploy.ts:257-403), byte-for-byte the
- * same encoding. Validates taskManagerPerms lengths and every roleAssignments
+ * native authority encoding. Validates taskManagerPerms lengths and every roleAssignments
  * index exactly like the CLI (both gate the broadcast).
  *
  * ABI field order (verified against src/abi/OrgDeployerNew.json +
@@ -197,10 +200,12 @@ export declare const DEPLOY_FULL_ORG_GAS_LIMIT = 15000000;
  *   orgId, orgName, metadataHash, registryAddr, deployerAddress,
  *   deployerUsername, regDeadline, regNonce, regSignature, autoUpgrade,
  *   hybridThresholdPct, ddThresholdPct, hybridClasses, ddInitialTargets,
- *   roles, roleAssignments, metadataAdminRoleIndex, passkeyEnabled,
+ *   roles, groups, roleAssignments, metadataAdminRoleIndex, passkeyEnabled,
  *   educationHubConfig, bootstrap, paymasterConfig, taskManagerPerms
  */
 export declare function buildDeploymentParams(config: OrgDeployConfig, resolved: DeploymentResolvedInputs): unknown[];
+/** Fail before publishing or signing when serving infrastructure still uses the retired deployer. */
+export declare function requireAuthorityDeployerVersion(version: string): void;
 export interface DeployFullOrgArgs {
     /** OrgDeployer proxy (orgDeployerProxy from infrastructure). */
     orgDeployerAddress: string;

package/dist/tx/org.js

@@ -15,10 +15,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEPLOY_FULL_ORG_GAS_LIMIT = exports.REGISTER_ACCOUNT_TYPES = void 0;
 exports.indicesToBitmap = indicesToBitmap;
 exports.assertRoleIndices = assertRoleIndices;
+exports.validateOrgDeployConfig = validateOrgDeployConfig;
 exports.deriveOrgId = deriveOrgId;
 exports.registerAccountDomain = registerAccountDomain;
 exports.signRegisterAccount = signRegisterAccount;
 exports.buildDeploymentParams = buildDeploymentParams;
+exports.requireAuthorityDeployerVersion = requireAuthorityDeployerVersion;
 exports.buildDeployFullOrg = buildDeployFullOrg;
 exports.deployFullOrgIntent = deployFullOrgIntent;
 exports.buildUpdateOrgMetaAsAdmin = buildUpdateOrgMetaAsAdmin;
@@ -64,7 +66,7 @@ function indicesToBitmap(indices) {
 /**
  * Reject role indices that do not name a role in the config.
  *
- * RoleResolver reverts UnregisteredRole(roleIdx) when a bitmap bit has no registered hat
+ * The deployer rejects any bitmap bit without a registered role
  * (audit M-09) — previously hat 0 was silently stored as an "authorized" hat and the deploy
  * succeeded with a broken allowlist. Either way the config is wrong, and we know roles.length
  * here, so name the offending field instead of surfacing a bare index from gas estimation
@@ -78,6 +80,152 @@ function assertRoleIndices(field, indices, roleCount) {
         }
     }
 }
+/** Reject legacy access configs and validate the authority's genesis invariants before I/O. */
+function validateOrgDeployConfig(config) {
+    const invalid = (message) => { throw new errors_1.CliError('Config invalid: ' + message, exit_codes_1.EXIT.USAGE); };
+    const uint = (value, label, max = 4294967295) => {
+        if (typeof value !== 'number' || !Number.isInteger(value) || value < 0 || value > max)
+            invalid(label + ' must be an integer between 0 and ' + max);
+    };
+    if (!config?.orgName?.trim())
+        invalid('orgName is required');
+    if (!Array.isArray(config.roles) || config.roles.length < 1 || config.roles.length > 16)
+        invalid('roles must contain 1–16 authority roles');
+    if (!config.hybridVoting || !Array.isArray(config.hybridVoting.classes) || !config.hybridVoting.classes.length)
+        invalid('hybridVoting.classes is required');
+    if (config.hybridVoting.classes.length > 8)
+        invalid('hybridVoting.classes supports at most 8 classes');
+    uint(config.hybridVoting.thresholdPct, 'hybridVoting.thresholdPct', 100);
+    uint(config.directDemocracy?.thresholdPct ?? 51, 'directDemocracy.thresholdPct', 100);
+    if (config.hybridVoting.thresholdPct === 0 || config.directDemocracy?.thresholdPct === 0)
+        invalid('voting thresholds must be between 1 and 100');
+    uint(config.hybridVoting.quorum ?? 0, 'hybridVoting.quorum');
+    uint(config.directDemocracy?.quorum ?? 0, 'directDemocracy.quorum');
+    let slices = 0;
+    for (const c of config.hybridVoting.classes) {
+        if ('hatIds' in c)
+            invalid('hybridVoting.classes.hatIds is unsupported; use authority subjectIds');
+        if (c.strategy !== 'DIRECT' && c.strategy !== 'ERC20_BAL')
+            invalid('unknown voting class strategy');
+        uint(c.slicePct, 'hybridVoting.classes.slicePct', 100);
+        if (c.slicePct === 0)
+            invalid('hybridVoting.classes.slicePct must be positive');
+        slices += c.slicePct;
+        if (c.asset && !ethers_1.ethers.utils.isAddress(c.asset))
+            invalid('invalid voting asset address');
+        if (c.subjectIds && (!Array.isArray(c.subjectIds) || c.subjectIds.some(id => typeof id !== 'string' || !/^[0-9]+$/.test(id))))
+            invalid('subjectIds must be decimal strings');
+        if (c.subjectIds?.some(id => ethers_1.ethers.BigNumber.from(id).gt(ethers_1.ethers.constants.MaxUint256)))
+            invalid('subjectIds must fit uint256');
+        if (c.quadratic !== undefined && typeof c.quadratic !== 'boolean')
+            invalid('hybridVoting.classes.quadratic must be a boolean');
+        try {
+            const minimum = ethers_1.ethers.utils.parseUnits(c.minBalance ?? '0', 18);
+            if (minimum.lt(0) || minimum.gt(ethers_1.ethers.constants.MaxUint256))
+                invalid('hybridVoting.classes.minBalance must fit uint256');
+        }
+        catch {
+            invalid('hybridVoting.classes.minBalance must be a non-negative decimal amount with at most 18 decimals');
+        }
+    }
+    if (slices !== 100)
+        invalid('hybridVoting class slices must sum to 100');
+    for (const [i, role] of config.roles.entries()) {
+        if (!role.name?.trim())
+            invalid('roles[' + i + '].name is required');
+        if ('hatConfig' in role || 'defaults' in role || 'hierarchy' in role || (role.vouching && 'combineWithHierarchy' in role.vouching))
+            invalid('legacy Hats role configuration is unsupported; use open, maxMembers and authority vouching');
+        if (typeof role.open !== 'boolean')
+            invalid('roles[' + i + '].open must explicitly be true or false');
+        if (typeof role.canVote !== 'boolean')
+            invalid('roles[' + i + '].canVote must be a boolean');
+        uint(role.maxMembers ?? 0, 'roles[' + i + '].maxMembers');
+        if (role.metadataCID !== undefined && !ethers_1.ethers.utils.isHexString(role.metadataCID, 32))
+            invalid('roles[' + i + '].metadataCID must be a bytes32 digest');
+        if (role.vouching?.enabled !== undefined && typeof role.vouching.enabled !== 'boolean')
+            invalid('roles[' + i + '].vouching.enabled must be a boolean');
+        if (role.distribution?.mintToDeployer !== undefined && typeof role.distribution.mintToDeployer !== 'boolean')
+            invalid('roles[' + i + '].distribution.mintToDeployer must be a boolean');
+        // Disabled vouch rows are still ABI encoded, so validate every supplied value.
+        if (role.vouching?.quorum !== undefined)
+            uint(role.vouching.quorum, 'roles[' + i + '].vouching.quorum');
+        if (role.vouching?.voucherRoleIndex !== undefined)
+            uint(role.vouching.voucherRoleIndex, 'roles[' + i + '].vouching.voucherRoleIndex');
+        if (role.vouching?.enabled) {
+            uint(role.vouching.quorum, 'roles[' + i + '].vouching.quorum');
+            if (!role.vouching.quorum)
+                invalid('enabled vouching requires a positive quorum');
+            assertRoleIndices('roles[' + i + '].vouching.voucherRoleIndex', [role.vouching.voucherRoleIndex], config.roles.length);
+        }
+        const wearers = role.distribution?.additionalWearers ?? [];
+        if (!Array.isArray(wearers) || wearers.some(w => !ethers_1.ethers.utils.isAddress(w) || w === ethers_1.ethers.constants.AddressZero))
+            invalid('invalid additional wearer address');
+        if (new Set(wearers.map(w => w.toLowerCase())).size !== wearers.length)
+            invalid('duplicate additional wearer');
+        const seeded = wearers.length + ((role.distribution?.mintToDeployer ?? true) ? 1 : 0);
+        if (role.maxMembers && seeded > role.maxMembers)
+            invalid('roles[' + i + '].maxMembers is below the genesis membership count');
+    }
+    if (!config.roleAssignments || typeof config.roleAssignments !== 'object')
+        invalid('roleAssignments is required');
+    const assignmentFields = ['quickJoinRoles', 'tokenMemberRoles', 'tokenApproverRoles', 'taskCreatorRoles', 'educationCreatorRoles', 'educationMemberRoles', 'hybridProposalCreatorRoles', 'ddVotingRoles', 'ddCreatorRoles'];
+    for (const field of Object.keys(config.roleAssignments))
+        if (!assignmentFields.includes(field))
+            invalid('unknown roleAssignments.' + field);
+    for (const field of assignmentFields) {
+        const indices = config.roleAssignments[field] ?? [];
+        if (!Array.isArray(indices))
+            invalid('roleAssignments.' + field + ' must be an array');
+        assertRoleIndices('roleAssignments.' + field, indices, config.roles.length);
+    }
+    for (const i of config.roleAssignments.quickJoinRoles ?? [])
+        if (!config.roles[i].open)
+            invalid('QuickJoin role ' + i + ' must be open');
+    if (config.groups && (!Array.isArray(config.groups) || config.groups.length > 8))
+        invalid('groups must contain at most 8 groups');
+    for (const [i, group] of (config.groups ?? []).entries()) {
+        if (!group.name?.trim() || !Array.isArray(group.memberRoleIndices) || group.memberRoleIndices.length < 1 || group.memberRoleIndices.length > 16)
+            invalid('groups[' + i + '] requires a name and 1–16 memberRoleIndices');
+        assertRoleIndices('groups[' + i + '].memberRoleIndices', group.memberRoleIndices, config.roles.length);
+        if (new Set(group.memberRoleIndices).size !== group.memberRoleIndices.length)
+            invalid('duplicate group member role');
+    }
+    if (config.metadataAdminRoleIndex !== undefined)
+        assertRoleIndices('metadataAdminRoleIndex', [config.metadataAdminRoleIndex], config.roles.length);
+    if (config.paymaster) {
+        const pm = config.paymaster;
+        assertRoleIndices('paymaster.operatorRoleIndex', [pm.operatorRoleIndex], config.roles.length);
+        uint(pm.defaultBudgetEpochLen, 'paymaster.defaultBudgetEpochLen');
+        for (const [field, decimals, bits] of [['maxFeePerGas', 9, 256], ['maxPriorityFeePerGas', 9, 256], ['defaultBudgetCapPerEpoch', 18, 128], ['funding', 18, 256]]) {
+            const raw = pm[field];
+            if (field === 'funding' && raw === undefined)
+                continue;
+            try {
+                const value = ethers_1.ethers.utils.parseUnits(raw, decimals);
+                if (value.lt(0) || value.gte(ethers_1.ethers.BigNumber.from(2).pow(bits)))
+                    invalid('paymaster.' + field + ' is outside uint' + bits);
+            }
+            catch {
+                invalid('paymaster.' + field + ' must be a non-negative decimal amount that fits uint' + bits);
+            }
+        }
+    }
+    if (config.autoUpgrade !== undefined && typeof config.autoUpgrade !== 'boolean')
+        invalid('autoUpgrade must be a boolean');
+    if (config.educationHub?.enabled !== undefined && typeof config.educationHub.enabled !== 'boolean')
+        invalid('educationHub.enabled must be a boolean');
+    for (const field of ['name', 'symbol'])
+        if (config.token?.[field] !== undefined && typeof config.token[field] !== 'string')
+            invalid('token.' + field + ' must be a string');
+    const tm = config.taskManagerPerms;
+    if (tm) {
+        if (!Array.isArray(tm.roleIndices) || !Array.isArray(tm.masks) || tm.roleIndices.length !== tm.masks.length)
+            invalid('taskManagerPerms.roleIndices and masks must be arrays of equal length');
+        assertRoleIndices('taskManagerPerms.roleIndices', tm.roleIndices, config.roles.length);
+        for (const mask of tm.masks)
+            uint(mask, 'taskManagerPerms.masks', 255);
+    }
+}
 /**
  * Derive the deterministic orgId + normalized name the deployer uses:
  * orgId = keccak256(orgName.toLowerCase().replace(/\s+/g, '-')).
@@ -129,7 +277,7 @@ exports.DEPLOY_FULL_ORG_GAS_LIMIT = 15000000;
 /**
  * Pure assembly of the DeploymentParams struct — port of the param build in
  * `pop org deploy` (src/commands/org/deploy.ts:257-403), byte-for-byte the
- * same encoding. Validates taskManagerPerms lengths and every roleAssignments
+ * native authority encoding. Validates taskManagerPerms lengths and every roleAssignments
  * index exactly like the CLI (both gate the broadcast).
  *
  * ABI field order (verified against src/abi/OrgDeployerNew.json +
@@ -137,51 +285,26 @@ exports.DEPLOY_FULL_ORG_GAS_LIMIT = 15000000;
  *   orgId, orgName, metadataHash, registryAddr, deployerAddress,
  *   deployerUsername, regDeadline, regNonce, regSignature, autoUpgrade,
  *   hybridThresholdPct, ddThresholdPct, hybridClasses, ddInitialTargets,
- *   roles, roleAssignments, metadataAdminRoleIndex, passkeyEnabled,
+ *   roles, groups, roleAssignments, metadataAdminRoleIndex, passkeyEnabled,
  *   educationHubConfig, bootstrap, paymasterConfig, taskManagerPerms
  */
 function buildDeploymentParams(config, resolved) {
-    // Build hybrid voting classes
-    // ABI: strategy(uint8), slicePct(uint8), quadratic(bool), minBalance(uint256), asset(address), hatIds(uint256[])
-    const hybridClasses = config.hybridVoting.classes.map((c) => [
-        c.strategy === 'DIRECT' ? 0 : 1, // uint8
-        c.slicePct, // uint8 (0-100)
-        c.quadratic || false, // bool
-        c.minBalance ? ethers_1.ethers.utils.parseUnits(c.minBalance, 18) : 0, // uint256
-        c.asset || ethers_1.ethers.constants.AddressZero, // address
-        c.hatIds || [], // uint256[]
+    validateOrgDeployConfig(config);
+    const hybridClasses = config.hybridVoting.classes.map(c => [
+        c.strategy === 'DIRECT' ? 0 : 1,
+        c.slicePct,
+        c.quadratic ?? false,
+        c.minBalance ? ethers_1.ethers.utils.parseUnits(c.minBalance, 18) : 0,
+        c.asset || ethers_1.ethers.constants.AddressZero,
+        c.subjectIds || [], // ABI retains the hatIds label; values are authority subjects.
     ]);
-    // Build role configs
-    // ABI: name(string), image(string), metadataCID(bytes32), canVote(bool),
-    //      vouching(tuple), defaults(tuple), hierarchy(tuple), distribution(tuple), hatConfig(tuple)
-    const MAX_UINT32 = 4294967295; // 2^32 - 1
-    const roles = config.roles.map((r) => [
-        r.name, // string
-        r.image || '', // string
-        ethers_1.ethers.constants.HashZero, // bytes32 metadataCID
-        r.canVote, // bool
-        [
-            r.vouching?.enabled || false,
-            r.vouching?.quorum || 0,
-            r.vouching?.voucherRoleIndex ?? ethers_1.ethers.constants.MaxUint256,
-            r.vouching?.combineWithHierarchy || false,
-        ],
-        [
-            r.defaults?.eligible ?? true,
-            r.defaults?.standing ?? true,
-        ],
-        [
-            r.hierarchy?.adminRoleIndex ?? ethers_1.ethers.constants.MaxUint256,
-        ],
-        [
-            r.distribution?.mintToDeployer ?? true,
-            r.distribution?.additionalWearers || [],
-        ],
-        [
-            r.hatConfig?.maxSupply ?? MAX_UINT32, // uint32, NOT uint256
-            r.hatConfig?.mutableHat ?? true,
-        ],
+    const roles = config.roles.map(r => [
+        r.name, r.image || '', r.metadataCID || ethers_1.ethers.constants.HashZero,
+        r.canVote, r.open, r.maxMembers ?? 0,
+        [r.vouching?.enabled ?? false, r.vouching?.quorum ?? 0, r.vouching?.voucherRoleIndex ?? 0],
+        [r.distribution?.mintToDeployer ?? true, r.distribution?.additionalWearers || []],
     ]);
+    const groups = (config.groups || []).map(g => [g.name, g.memberRoleIndices]);
     // Build role assignment bitmaps
     const ra = config.roleAssignments;
     // Every index must name a real role BEFORE anything is broadcast — a stale index is
@@ -197,15 +320,15 @@ function buildDeploymentParams(config, resolved) {
     assertRoleIndices('roleAssignments.ddVotingRoles', ra.ddVotingRoles, roleCount);
     assertRoleIndices('roleAssignments.ddCreatorRoles', ra.ddCreatorRoles, roleCount);
     const roleAssignments = [
-        indicesToBitmap(ra.quickJoinRoles),
-        indicesToBitmap(ra.tokenMemberRoles),
-        indicesToBitmap(ra.tokenApproverRoles),
-        indicesToBitmap(ra.taskCreatorRoles),
+        indicesToBitmap(ra.quickJoinRoles || []),
+        indicesToBitmap(ra.tokenMemberRoles || []),
+        indicesToBitmap(ra.tokenApproverRoles || []),
+        indicesToBitmap(ra.taskCreatorRoles || []),
         indicesToBitmap(ra.educationCreatorRoles || []),
         indicesToBitmap(ra.educationMemberRoles || []),
-        indicesToBitmap(ra.hybridProposalCreatorRoles),
-        indicesToBitmap(ra.ddVotingRoles),
-        indicesToBitmap(ra.ddCreatorRoles),
+        indicesToBitmap(ra.hybridProposalCreatorRoles || []),
+        indicesToBitmap(ra.ddVotingRoles || []),
+        indicesToBitmap(ra.ddCreatorRoles || []),
     ];
     // Build paymaster config
     // ABI: operatorRoleIndex(uint256), autoWhitelistContracts(bool),
@@ -234,18 +357,15 @@ function buildDeploymentParams(config, resolved) {
         0, // defaultBudgetCapPerEpoch
         0, // defaultBudgetEpochLen
     ];
-    // Optional org-wide TaskManager ROLE_PERM grants
-    // (OrgDeployer.TaskManagerPermConfig: roleIndices[] + masks[] — empty
-    // arrays skip the bootstrapGlobalPerms step entirely; verified against
-    // contracts origin/main src/OrgDeployer.sol).
-    const tmPerms = config.taskManagerPerms;
-    if (tmPerms && (tmPerms.roleIndices?.length || 0) !== (tmPerms.masks?.length || 0)) {
-        throw new errors_1.CliError('Config invalid: taskManagerPerms.roleIndices and taskManagerPerms.masks must be the same length.', exit_codes_1.EXIT.USAGE);
+    // Config task creators can create both projects and tasks. The project creator
+    // array alone does not grant native TM_PERMS.CREATE, so seed that bit explicitly.
+    const taskMasks = new Map();
+    for (const [i, role] of (config.taskManagerPerms?.roleIndices ?? []).entries()) {
+        taskMasks.set(role, config.taskManagerPerms.masks[i]);
     }
-    const taskManagerPerms = [
-        tmPerms?.roleIndices || [], // uint256[] roleIndices
-        tmPerms?.masks || [], // uint8[] masks
-    ];
+    for (const role of config.roleAssignments.taskCreatorRoles ?? [])
+        taskMasks.set(role, (taskMasks.get(role) ?? 0) | 1);
+    const taskManagerPerms = [[...taskMasks.keys()], [...taskMasks.values()]];
     return [
         resolved.orgId, // bytes32
         config.orgName, // string
@@ -258,10 +378,11 @@ function buildDeploymentParams(config, resolved) {
         resolved.regSignature, // bytes
         config.autoUpgrade ?? true, // bool
         config.hybridVoting.thresholdPct, // uint8
-        config.directDemocracy?.thresholdPct || 51, // uint8
+        config.directDemocracy?.thresholdPct ?? 51, // uint8
         hybridClasses, // ClassConfig[]
         [], // address[] ddInitialTargets
         roles, // RoleConfig[]
+        groups, // GroupConfig[]
         roleAssignments, // RoleAssignments struct
         config.metadataAdminRoleIndex ?? ethers_1.ethers.constants.MaxUint256, // uint256
         true, // bool passkeyEnabled
@@ -269,8 +390,17 @@ function buildDeploymentParams(config, resolved) {
         [[], []], // BootstrapConfig struct (projects, tasks)
         paymasterConfig, // PaymasterConfig struct
         taskManagerPerms, // TaskManagerPermConfig struct (roleIndices, masks)
+        config.hybridVoting.quorum ?? 0,
+        config.directDemocracy?.quorum ?? 0,
+        config.token?.name ?? "",
+        config.token?.symbol ?? "",
     ];
 }
+/** Fail before publishing or signing when serving infrastructure still uses the retired deployer. */
+function requireAuthorityDeployerVersion(version) {
+    if (!/^2\./.test(version))
+        throw new errors_1.CliError(`OrgDeployer ${version || 'unknown'} is unsupported; deployer version 2 is required for native MembershipAuthority organizations.`, exit_codes_1.EXIT.PRECONDITION);
+}
 /**
  * Port of `pop org deploy` — src/commands/org/deploy.ts.
  * OrgDeployer.deployFullOrg([DeploymentParams]) — the single on-chain write,
@@ -312,12 +442,17 @@ function buildDeployFullOrg(a) {
 async function deployFullOrgIntent(ctx, params) {
     const config = params.config;
     // ── Fail fast on config problems before any network work ───────────
-    if (!config.orgName)
-        throw new errors_1.CliError('Config missing: orgName', exit_codes_1.EXIT.USAGE);
-    if (!config.roles?.length)
-        throw new errors_1.CliError('Config missing: roles', exit_codes_1.EXIT.USAGE);
-    if (!config.hybridVoting)
-        throw new errors_1.CliError('Config missing: hybridVoting', exit_codes_1.EXIT.USAGE);
+    validateOrgDeployConfig(config);
+    // Validate full ABI encoding before infrastructure reads, IPFS publication or signing.
+    const preview = buildDeploymentParams(config, {
+        orgId: ethers_1.ethers.constants.HashZero, metadataHash: ethers_1.ethers.constants.HashZero,
+        registryAddr: ethers_1.ethers.constants.AddressZero, deployerAddress: params.deployerAddress,
+        deployerUsername: '', regDeadline: 0, regNonce: 0, regSignature: '0x',
+    });
+    new ethers_1.ethers.utils.Interface((0, contracts_1.getAbi)('OrgDeployerNew')).encodeFunctionData('deployFullOrg', [preview]);
+    if (config.paymaster?.funding && ethers_1.ethers.utils.parseEther(config.paymaster.funding).lt(0)) {
+        throw new errors_1.CliError('Paymaster funding must not be negative', exit_codes_1.EXIT.USAGE);
+    }
     if (!ctx.provider) {
         throw new errors_1.CliError('deployFullOrgIntent requires ctx.provider (UniversalAccountRegistry.nonces read)', exit_codes_1.EXIT.USAGE);
     }
@@ -332,6 +467,7 @@ async function deployFullOrgIntent(ctx, params) {
         throw new errors_1.CliError('Could not resolve OrgDeployer address', exit_codes_1.EXIT.INFRA);
     if (!registryAddr)
         throw new errors_1.CliError('Could not resolve UniversalAccountRegistry address', exit_codes_1.EXIT.INFRA);
+    requireAuthorityDeployerVersion(await (0, contracts_1.createReadContract)(orgDeployerAddr, 'OrgDeployerNew', ctx.provider).VERSION());
     // Generate orgId: keccak256(orgName.toLowerCase().replace(/\s+/g, '-'))
     const { orgId, normalizedName } = deriveOrgId(config.orgName);
     const deployerUsername = config.deployerUsername || normalizedName;

package/dist/tx/project.d.ts

@@ -75,6 +75,7 @@ export interface ProposeProjectArgs {
     metadataHash?: string;
     /** Human PT cap (0/omitted = unlimited). */
     cap?: number | string;
+    managers?: string[];
     createHats?: ethers.BigNumberish[];
     claimHats?: ethers.BigNumberish[];
     reviewHats?: ethers.BigNumberish[];
@@ -88,8 +89,7 @@ export interface ProposeProjectArgs {
 /**
  * Port of `pop project propose` — src/commands/project/propose.ts.
  * HybridVoting.createProposal(`Create project: <name>`, descriptionHash,
- * duration, 2, [[createProject call], []], []). Managers, bountyTokens and
- * bountyCaps are forced empty (hat-based), matching the CLI struct.
+ * duration, 2, [[createProject call], []], []). Explicit address managers remain supported; authority TM_PERMS replaces the retired role-mask arrays.
  */
 export declare function buildProposeProject(a: ProposeProjectArgs): TxIntent;
 export interface CreateProjectParams {
@@ -130,6 +130,7 @@ export interface ProposeProjectParams {
     name: string;
     description?: string;
     cap?: number;
+    managers?: string[];
     /** Vote duration in minutes (CLI default 1440 = 24h). */
     duration?: number;
     createHats?: Array<string | number>;

package/dist/tx/project.js

@@ -33,18 +33,34 @@ const proposal_1 = require("../metadata/proposal");
  * governance-wrapped paths so the two cannot drift.
  */
 function encodeProjectStruct(a) {
-    const cap = a.cap ? ethers_1.ethers.utils.parseUnits(a.cap.toString(), 18) : 0;
+    if ([a.createHats, a.claimHats, a.reviewHats, a.assignHats].some(rows => rows?.length))
+        throw new Error('Project permission arrays were removed. Configure MembershipAuthority TM_PERMS using projectId + 1 after creating the project.');
+    const title = (0, encoding_1.stringToBytes)(a.name);
+    if (title.length === 0 || title.length > 256)
+        throw new Error('Project title must contain 1–256 UTF-8 bytes.');
+    const cap = ethers_1.ethers.utils.parseUnits(String(a.cap ?? 0), 18);
+    const caps = (a.bountyCaps ?? []).map(c => ethers_1.ethers.BigNumber.from(c));
+    const maxPayout = ethers_1.ethers.BigNumber.from(10).pow(24);
+    const unlimited = ethers_1.ethers.BigNumber.from(2).pow(128).sub(1);
+    if ([cap, ...caps].some(value => value.lt(0) || (value.gt(maxPayout) && !value.eq(unlimited))))
+        throw new Error('Project and bounty caps must be at most 1e24 base units or the uint128 unlimited sentinel.');
+    if ((a.bountyTokens ?? []).length !== caps.length)
+        throw new Error('Bounty tokens and caps must have equal lengths.');
+    for (const address of [...(a.managers ?? []), ...(a.bountyTokens ?? [])]) {
+        if (!ethers_1.ethers.utils.isAddress(address) || address.toLowerCase() === ethers_1.ethers.constants.AddressZero)
+            throw new Error('Project managers and bounty tokens must be non-zero addresses.');
+    }
     return [
-        (0, encoding_1.stringToBytes)(a.name),
+        title,
         a.metadataHash ? (0, encoding_1.ipfsCidToBytes32)(a.metadataHash) : ethers_1.ethers.constants.HashZero,
         cap,
         a.managers ?? [],
-        (a.createHats ?? []).map((h) => ethers_1.ethers.BigNumber.from(h)),
-        (a.claimHats ?? []).map((h) => ethers_1.ethers.BigNumber.from(h)),
-        (a.reviewHats ?? []).map((h) => ethers_1.ethers.BigNumber.from(h)),
-        (a.assignHats ?? []).map((h) => ethers_1.ethers.BigNumber.from(h)),
+        [],
+        [],
+        [],
+        [],
         a.bountyTokens ?? [],
-        (a.bountyCaps ?? []).map((c) => ethers_1.ethers.BigNumber.from(c)),
+        caps,
     ];
 }
 /**
@@ -90,8 +106,7 @@ function buildCreateProjectCall(a) {
 /**
  * Port of `pop project propose` — src/commands/project/propose.ts.
  * HybridVoting.createProposal(`Create project: <name>`, descriptionHash,
- * duration, 2, [[createProject call], []], []). Managers, bountyTokens and
- * bountyCaps are forced empty (hat-based), matching the CLI struct.
+ * duration, 2, [[createProject call], []], []). Explicit address managers remain supported; authority TM_PERMS replaces the retired role-mask arrays.
  */
 function buildProposeProject(a) {
     const call = buildCreateProjectCall({
@@ -99,7 +114,7 @@ function buildProposeProject(a) {
         name: a.name,
         metadataHash: a.metadataHash,
         cap: a.cap,
-        managers: [], // hat-based instead
+        managers: a.managers ?? [],
         createHats: a.createHats,
         claimHats: a.claimHats,
         reviewHats: a.reviewHats,
@@ -131,6 +146,7 @@ function buildProposeProject(a) {
  * delegates to buildCreateProject.
  */
 async function createProjectIntent(ctx, p) {
+    encodeProjectStruct({ ...p, taskManagerAddress: ethers_1.ethers.constants.AddressZero });
     const modules = await (0, resolve_1.resolveOrgModules)(ctx.client, p.org, ctx.chainId);
     const taskManagerAddress = (0, resolve_1.requireModule)(modules, 'taskManagerAddress');
     let metaCid;
@@ -179,6 +195,7 @@ async function deleteProjectIntent(ctx, p) {
  * wraps the createProject calldata in a HybridVoting proposal.
  */
 async function proposeProjectIntent(ctx, p) {
+    encodeProjectStruct({ ...p, taskManagerAddress: ethers_1.ethers.constants.AddressZero });
     const modules = await (0, resolve_1.resolveOrgModules)(ctx.client, p.org, ctx.chainId);
     const taskManagerAddress = (0, resolve_1.requireModule)(modules, 'taskManagerAddress');
     const hybridVotingAddress = modules.hybridVotingAddress;
@@ -204,6 +221,7 @@ async function proposeProjectIntent(ctx, p) {
         name: p.name,
         metadataHash: metaCid,
         cap: p.cap,
+        managers: p.managers,
         createHats: p.createHats,
         claimHats: p.claimHats,
         reviewHats: p.reviewHats,