@poa-box/core 0.1.0

package/dist/graph/documents/org.js

@@ -0,0 +1,249 @@
+"use strict";
+/**
+ * Organization Queries
+ * Ported from frontend queries.js
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FETCH_ORG_PAYOUT_CONFIG = exports.FETCH_USER_ORGANIZATIONS = exports.GET_ORG_BY_NAME = exports.FETCH_ORG_FULL_DATA = exports.FETCH_ORG_BY_ID = void 0;
+exports.FETCH_ORG_BY_ID = `
+  query FetchOrgById($id: Bytes!) {
+    organization(id: $id) {
+      id
+      name
+      metadataHash
+      deployedAt
+      topHatId
+      roleHatIds
+      participationToken {
+        id
+        name
+        symbol
+        totalSupply
+      }
+      quickJoin {
+        id
+      }
+      hybridVoting {
+        id
+        thresholdPct
+        quorum
+      }
+      directDemocracyVoting {
+        id
+        thresholdPct
+        quorum
+      }
+      taskManager {
+        id
+        projects {
+          id
+          title
+          deleted
+        }
+      }
+      educationHub {
+        id
+        nextModuleId
+      }
+      executorContract {
+        id
+      }
+      eligibilityModule {
+        id
+      }
+      paymentManager {
+        id
+      }
+      zkEmailInvites {
+        id
+      }
+      users {
+        id
+        address
+        account {
+          username
+          metadata {
+            avatar
+          }
+        }
+        participationTokenBalance
+        membershipStatus
+        currentHatIds
+      }
+      roles(where: { isUserRole: true }) {
+        id
+        hatId
+        name
+        image
+        canVote
+        isUserRole
+      }
+    }
+  }
+`;
+exports.FETCH_ORG_FULL_DATA = `
+  query FetchOrgFullData($orgId: Bytes!) {
+    organization(id: $orgId) {
+      id
+      name
+      metadataHash
+      metadataAdminHatId
+      metadata {
+        id
+        description
+        template
+        backgroundColor
+        logo
+        hideTreasury
+        useTokenSymbol
+        taskPayoutHoursOnly
+        taskPayoutHourlyRate
+        links {
+          name
+          url
+          index
+        }
+      }
+      deployedAt
+      topHatId
+      roleHatIds
+      participationToken {
+        id
+        name
+        symbol
+        totalSupply
+      }
+      quickJoin {
+        id
+      }
+      hybridVoting {
+        id
+        thresholdPct
+        quorum
+      }
+      directDemocracyVoting {
+        id
+        thresholdPct
+        quorum
+      }
+      zkEmailInvites {
+        id
+      }
+      taskManager {
+        id
+        creatorHatIds
+        projects(where: { deleted: false }, first: 100) {
+          id
+          tasks(first: 1000) {
+            id
+            status
+          }
+        }
+      }
+      educationHub {
+        id
+        modules {
+          id
+          moduleId
+          title
+          contentHash
+          metadata {
+            description
+            link
+            quiz
+            answersJson
+          }
+          payout
+          status
+          completions {
+            learner
+          }
+        }
+      }
+      executorContract {
+        id
+      }
+      eligibilityModule {
+        id
+      }
+      paymentManager {
+        id
+      }
+      users(orderBy: participationTokenBalance, orderDirection: desc, first: 100) {
+        id
+        address
+        account {
+          username
+          metadata {
+            avatar
+          }
+        }
+        participationTokenBalance
+        membershipStatus
+        currentHatIds
+        totalTasksCompleted
+        totalVotes
+        firstSeenAt
+      }
+      roles(where: { isUserRole: true }) {
+        id
+        hatId
+        name
+        image
+        canVote
+        isUserRole
+        hat {
+          name
+        }
+      }
+    }
+  }
+`;
+exports.GET_ORG_BY_NAME = `
+  query GetOrgByName($name: String!) {
+    organizations(where: { name: $name }, first: 1) {
+      id
+      name
+    }
+  }
+`;
+exports.FETCH_USER_ORGANIZATIONS = `
+  query FetchUserOrganizations($userAddress: Bytes!) {
+    users(where: { address: $userAddress, membershipStatus: Active }) {
+      id
+      membershipStatus
+      participationTokenBalance
+      totalTasksCompleted
+      totalVotes
+      organization {
+        id
+        name
+        metadataHash
+        participationToken {
+          symbol
+        }
+      }
+    }
+  }
+`;
+/**
+ * Just the org's payout convention + token symbol.
+ *
+ * Deliberately narrow: `pop task create` needs it on every invocation to price a task the way
+ * the web app would, and FETCH_ORG_FULL_DATA pulls every user, role, task and proposal.
+ */
+exports.FETCH_ORG_PAYOUT_CONFIG = `
+  query FetchOrgPayoutConfig($orgId: Bytes!) {
+    organization(id: $orgId) {
+      id
+      metadata {
+        useTokenSymbol
+        taskPayoutHoursOnly
+        taskPayoutHourlyRate
+      }
+      participationToken {
+        symbol
+      }
+    }
+  }
+`;

package/dist/graph/documents/paymaster.d.ts

@@ -0,0 +1,95 @@
+/**
+ * PaymasterHub Queries
+ *
+ * Everything here was verified field-by-field against BOTH live deployments
+ * (poa-gnosis-v-1 hub 0xdef1…4108, poa-arb-v-1 hub 0xd665…8a11) by comparing the
+ * indexed value to the same value read straight off the contract. Only the
+ * fields that matched EXACTLY are requested:
+ *
+ *   entryPoint            == PaymasterHub.ENTRY_POINT()      (both chains)
+ *   adminHatId/operatorHatId/isPaused/registeredAt/isBannedFromSolidarity
+ *                         == PaymasterHub.getOrgConfig()     (5 orgs, both chains)
+ *   feeCaps.*             == PaymasterHub.getFeeCaps()       (Argus; and a null
+ *                            `feeCaps` edge always corresponded to an all-zero
+ *                            on-chain struct on 5 further orgs, which is the
+ *                            contract's "never configured" default)
+ *   budgets.*             == PaymasterHub.getBudget()        (9 budgets, 4 orgs,
+ *                            both chains — cap, used, epochLen and epochStart
+ *                            matched to the wei)
+ *
+ * DELIBERATELY NOT REQUESTED (schema has them, the values are WRONG):
+ *   PaymasterOrgConfig.totalSpent / .depositBalance — the indexer accumulates the
+ *     gas cost but not the solidarity fee the hub also debits, so it runs exactly
+ *     1/1.01 of the contract's `spent`. Proven on Gnosis (1251669883200000000 ×
+ *     1.01 == 1264186582032000000 == on-chain spent, to the wei) and on Arbitrum
+ *     (141261159757737 × 1.01 == 142673771355313). `available = deposited - spent`
+ *     is the number that decides whether sponsorship still works, so it stays on
+ *     getOrgFinancials().
+ *   PaymasterHubContract.solidarityBalance — matches on Arbitrum but is
+ *     6376552300000000 wei HIGH on Gnosis (5115224471702250000 indexed vs
+ *     5108847919402250000 on-chain).
+ *   PaymasterHubContract.solidarityDistributionPaused — reads `false` on Arbitrum
+ *     while the contract reports `true`. The pause toggle is not indexed.
+ *
+ * `numActiveOrgs`, `feePercentageBps`, `solidarityUsedThisPeriod` and
+ * `periodStart` have no field at all. See docs in commands/paymaster/status.ts.
+ */
+/**
+ * Hub-wide immutables + one org's paymaster configuration, in a single document.
+ *
+ * Filtered on `orgId` only rather than the `<hub>-<orgId>` composite entity id:
+ * the id-construction convention is a subgraph implementation detail, and there
+ * is exactly one PaymasterHubContract per chain. Callers still cross-check
+ * `paymasterHub.id` against the hub address they resolved independently and
+ * fall back to RPC on a mismatch.
+ */
+export declare const FETCH_PAYMASTER_STATE = "\n  query FetchPaymasterState($orgId: Bytes!) {\n    paymasterHubContracts(first: 1) {\n      id\n      entryPoint\n    }\n    paymasterOrgConfigs(first: 1, where: { orgId: $orgId }) {\n      id\n      orgId\n      paymasterHub {\n        id\n      }\n      adminHatId\n      operatorHatId\n      isPaused\n      isBannedFromSolidarity\n      registeredAt\n      feeCaps {\n        maxFeePerGas\n        maxPriorityFeePerGas\n        maxCallGas\n        maxVerificationGas\n        maxPreVerificationGas\n      }\n      budgets(first: 500, orderBy: setAt, orderDirection: asc) {\n        subjectKey\n        capPerEpoch\n        usedInEpoch\n        epochLen\n        epochStart\n        totalUsed\n      }\n    }\n  }\n";
+/**
+ * Same document without `PaymasterBudget.totalUsed`.
+ *
+ * totalUsed is the one field here with no getter counterpart (getBudget() returns
+ * only the four in-epoch numbers), which makes it the field most likely to be
+ * missing from an older deployment. GraphQL validates a document as a whole, so
+ * one unknown field would fail the ENTIRE query and drop `pop paymaster status`
+ * back to the full RPC path — hence the tier rather than a bare query.
+ *
+ * Derived from the modern tier by deletion so the two cannot drift; the
+ * derivation is line-based, which test/queries/paymaster-tiers.test.ts pins.
+ */
+export declare const FETCH_PAYMASTER_STATE_LEGACY: string;
+/** Modern tier first; the pre-totalUsed shape as the fallback. */
+export declare const FETCH_PAYMASTER_STATE_TIERS: string[];
+export interface PaymasterStateResponse {
+    paymasterHubContracts: Array<{
+        id: string;
+        entryPoint: string;
+    }>;
+    paymasterOrgConfigs: Array<{
+        id: string;
+        orgId: string;
+        paymasterHub: {
+            id: string;
+        };
+        adminHatId: string;
+        operatorHatId: string;
+        isPaused: boolean;
+        isBannedFromSolidarity: boolean;
+        registeredAt: string;
+        feeCaps: {
+            maxFeePerGas: string;
+            maxPriorityFeePerGas: string;
+            maxCallGas: number;
+            maxVerificationGas: number;
+            maxPreVerificationGas: number;
+        } | null;
+        budgets: Array<{
+            subjectKey: string;
+            capPerEpoch: string;
+            usedInEpoch: string;
+            epochLen: number;
+            epochStart: number;
+            /** Absent on the legacy tier. */
+            totalUsed?: string;
+        }>;
+    }>;
+}

package/dist/graph/documents/paymaster.js

@@ -0,0 +1,101 @@
+"use strict";
+/**
+ * PaymasterHub Queries
+ *
+ * Everything here was verified field-by-field against BOTH live deployments
+ * (poa-gnosis-v-1 hub 0xdef1…4108, poa-arb-v-1 hub 0xd665…8a11) by comparing the
+ * indexed value to the same value read straight off the contract. Only the
+ * fields that matched EXACTLY are requested:
+ *
+ *   entryPoint            == PaymasterHub.ENTRY_POINT()      (both chains)
+ *   adminHatId/operatorHatId/isPaused/registeredAt/isBannedFromSolidarity
+ *                         == PaymasterHub.getOrgConfig()     (5 orgs, both chains)
+ *   feeCaps.*             == PaymasterHub.getFeeCaps()       (Argus; and a null
+ *                            `feeCaps` edge always corresponded to an all-zero
+ *                            on-chain struct on 5 further orgs, which is the
+ *                            contract's "never configured" default)
+ *   budgets.*             == PaymasterHub.getBudget()        (9 budgets, 4 orgs,
+ *                            both chains — cap, used, epochLen and epochStart
+ *                            matched to the wei)
+ *
+ * DELIBERATELY NOT REQUESTED (schema has them, the values are WRONG):
+ *   PaymasterOrgConfig.totalSpent / .depositBalance — the indexer accumulates the
+ *     gas cost but not the solidarity fee the hub also debits, so it runs exactly
+ *     1/1.01 of the contract's `spent`. Proven on Gnosis (1251669883200000000 ×
+ *     1.01 == 1264186582032000000 == on-chain spent, to the wei) and on Arbitrum
+ *     (141261159757737 × 1.01 == 142673771355313). `available = deposited - spent`
+ *     is the number that decides whether sponsorship still works, so it stays on
+ *     getOrgFinancials().
+ *   PaymasterHubContract.solidarityBalance — matches on Arbitrum but is
+ *     6376552300000000 wei HIGH on Gnosis (5115224471702250000 indexed vs
+ *     5108847919402250000 on-chain).
+ *   PaymasterHubContract.solidarityDistributionPaused — reads `false` on Arbitrum
+ *     while the contract reports `true`. The pause toggle is not indexed.
+ *
+ * `numActiveOrgs`, `feePercentageBps`, `solidarityUsedThisPeriod` and
+ * `periodStart` have no field at all. See docs in commands/paymaster/status.ts.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FETCH_PAYMASTER_STATE_TIERS = exports.FETCH_PAYMASTER_STATE_LEGACY = exports.FETCH_PAYMASTER_STATE = void 0;
+/**
+ * Hub-wide immutables + one org's paymaster configuration, in a single document.
+ *
+ * Filtered on `orgId` only rather than the `<hub>-<orgId>` composite entity id:
+ * the id-construction convention is a subgraph implementation detail, and there
+ * is exactly one PaymasterHubContract per chain. Callers still cross-check
+ * `paymasterHub.id` against the hub address they resolved independently and
+ * fall back to RPC on a mismatch.
+ */
+exports.FETCH_PAYMASTER_STATE = `
+  query FetchPaymasterState($orgId: Bytes!) {
+    paymasterHubContracts(first: 1) {
+      id
+      entryPoint
+    }
+    paymasterOrgConfigs(first: 1, where: { orgId: $orgId }) {
+      id
+      orgId
+      paymasterHub {
+        id
+      }
+      adminHatId
+      operatorHatId
+      isPaused
+      isBannedFromSolidarity
+      registeredAt
+      feeCaps {
+        maxFeePerGas
+        maxPriorityFeePerGas
+        maxCallGas
+        maxVerificationGas
+        maxPreVerificationGas
+      }
+      budgets(first: 500, orderBy: setAt, orderDirection: asc) {
+        subjectKey
+        capPerEpoch
+        usedInEpoch
+        epochLen
+        epochStart
+        totalUsed
+      }
+    }
+  }
+`;
+/**
+ * Same document without `PaymasterBudget.totalUsed`.
+ *
+ * totalUsed is the one field here with no getter counterpart (getBudget() returns
+ * only the four in-epoch numbers), which makes it the field most likely to be
+ * missing from an older deployment. GraphQL validates a document as a whole, so
+ * one unknown field would fail the ENTIRE query and drop `pop paymaster status`
+ * back to the full RPC path — hence the tier rather than a bare query.
+ *
+ * Derived from the modern tier by deletion so the two cannot drift; the
+ * derivation is line-based, which test/queries/paymaster-tiers.test.ts pins.
+ */
+exports.FETCH_PAYMASTER_STATE_LEGACY = exports.FETCH_PAYMASTER_STATE
+    .split('\n')
+    .filter(line => line.trim() !== 'totalUsed')
+    .join('\n');
+/** Modern tier first; the pre-totalUsed shape as the fallback. */
+exports.FETCH_PAYMASTER_STATE_TIERS = [exports.FETCH_PAYMASTER_STATE, exports.FETCH_PAYMASTER_STATE_LEGACY];

package/dist/graph/documents/role.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Role Application Queries
+ * Ported from frontend queries.js
+ */
+export declare const FETCH_USER_ROLE_APPLICATIONS = "\n  query FetchUserRoleApplications($eligibilityModuleId: Bytes!, $applicant: Bytes!) {\n    roleApplications(\n      where: { eligibilityModule: $eligibilityModuleId, applicant: $applicant, active: true }\n      first: 50\n    ) {\n      id\n      hatId\n      applicant\n      applicantUsername\n      applicationHash\n      active\n      appliedAt\n    }\n  }\n";
+export declare const FETCH_ALL_ROLE_APPLICATIONS = "\n  query FetchAllRoleApplications($eligibilityModuleId: Bytes!) {\n    roleApplications(\n      where: { eligibilityModule: $eligibilityModuleId, active: true }\n      orderBy: appliedAt\n      orderDirection: desc\n      first: 200\n    ) {\n      id\n      hatId\n      applicant\n      applicantUsername\n      applicationHash\n      active\n      appliedAt\n    }\n  }\n";

package/dist/graph/documents/role.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * Role Application Queries
+ * Ported from frontend queries.js
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FETCH_ALL_ROLE_APPLICATIONS = exports.FETCH_USER_ROLE_APPLICATIONS = void 0;
+exports.FETCH_USER_ROLE_APPLICATIONS = `
+  query FetchUserRoleApplications($eligibilityModuleId: Bytes!, $applicant: Bytes!) {
+    roleApplications(
+      where: { eligibilityModule: $eligibilityModuleId, applicant: $applicant, active: true }
+      first: 50
+    ) {
+      id
+      hatId
+      applicant
+      applicantUsername
+      applicationHash
+      active
+      appliedAt
+    }
+  }
+`;
+exports.FETCH_ALL_ROLE_APPLICATIONS = `
+  query FetchAllRoleApplications($eligibilityModuleId: Bytes!) {
+    roleApplications(
+      where: { eligibilityModule: $eligibilityModuleId, active: true }
+      orderBy: appliedAt
+      orderDirection: desc
+      first: 200
+    ) {
+      id
+      hatId
+      applicant
+      applicantUsername
+      applicationHash
+      active
+      appliedAt
+    }
+  }
+`;

package/dist/graph/documents/roles.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Role / hat-admin queries (pop org roles, pop org view, pop org set-metadata-admin).
+ *
+ * Kept separate from queries/org.ts and queries/role.ts so the roles commands
+ * can carry the vouch-config fields without touching the shared org document.
+ *
+ * VERIFIED against the live Gnosis (poa-gnosis-v-1) and Arbitrum (poa-arb-v-1)
+ * deployments on 2026-07-30:
+ *   - Hat.vouchConfig exists on BOTH schemas and is populated. Every non-null
+ *     row has enabled=true, quorum>=1, membershipHatId!=0.
+ *   - A null Hat.vouchConfig means "vouching was never configured for this
+ *     hat", not "the subgraph is missing data": for every role whose
+ *     vouchConfig is null (ELIGIBILITY_ADMIN on all 9 Gnosis orgs + Arb's
+ *     "Poa", plus Test6/TaskRunner, Test6/Treasurer, Decentral Park/Neighbor)
+ *     an eth_call to EligibilityModule returned isVouchingEnabled()==false and
+ *     vouchConfigs().quorum==0 — exactly what the CLI renders for a null row.
+ *   - Role.hat is non-null on all 31 Gnosis roles and all 3 Arbitrum roles.
+ *   - subgraph src/eligibility-module.ts handleVouchConfigSet writes quorum /
+ *     membershipHatId / enabled / combinesWithHierarchy on EVERY VouchConfigSet
+ *     event, including disables, so the row does not go stale after a change.
+ *   - Organization.metadataAdminHatId is non-null on all 9 Gnosis orgs and the
+ *     1 Arbitrum org, and subgraph src/org-registry.ts
+ *     handleOrgMetadataAdminHatSet rewrites it on every OrgMetadataAdminHatSet.
+ *     Spot-checked Argus against OrgRegistry.getOrgMetadataAdminHat on Gnosis:
+ *     identical (30222100625258283641858621132055137413908072809768050515156576961036288).
+ */
+/**
+ * Tier 0 for `pop org roles`: roles + members + the vouch config inlined via
+ * Role.hat.vouchConfig. Serving this tier means the command issues ZERO
+ * eth_calls (previously 2 per role: isVouchingEnabled + vouchConfigs).
+ */
+export declare const FETCH_ROLES_MEMBERS_AND_VOUCH = "\n  query FetchRolesMembersAndVouch($id: Bytes!) {\n    organization(id: $id) {\n      roles(where: { isUserRole: true }) {\n        id\n        hatId\n        name\n        image\n        canVote\n        isUserRole\n        hat {\n          id\n          vouchConfig {\n            enabled\n            quorum\n            membershipHatId\n            combinesWithHierarchy\n          }\n        }\n      }\n      users {\n        address\n        participationTokenBalance\n        membershipStatus\n        currentHatIds\n        account {\n          username\n        }\n      }\n      eligibilityModule {\n        id\n      }\n    }\n  }\n";
+/**
+ * Tier 1 for `pop org roles`: the legacy shape, for any deployment whose
+ * schema predates Hat.vouchConfig. When this tier serves, the command falls
+ * back to batched EligibilityModule reads through Multicall3.
+ */
+export declare const FETCH_ROLES_AND_MEMBERS = "\n  query FetchRolesAndMembers($id: Bytes!) {\n    organization(id: $id) {\n      roles(where: { isUserRole: true }) {\n        id\n        hatId\n        name\n        image\n        canVote\n        isUserRole\n      }\n      users {\n        address\n        participationTokenBalance\n        membershipStatus\n        currentHatIds\n        account {\n          username\n        }\n      }\n      eligibilityModule {\n        id\n      }\n    }\n  }\n";
+/**
+ * Current metadata-admin hat for one org — the subgraph mirror of
+ * OrgRegistry.getOrgMetadataAdminHat(orgId).
+ */
+export declare const FETCH_ORG_METADATA_ADMIN_HAT = "\n  query FetchOrgMetadataAdminHat($orgId: Bytes!) {\n    organization(id: $orgId) {\n      id\n      metadataAdminHatId\n    }\n  }\n";
+/** Shape of the FETCH_ORG_METADATA_ADMIN_HAT response. */
+export interface OrgMetadataAdminHatResult {
+    organization: {
+        id: string;
+        metadataAdminHatId: string | null;
+    } | null;
+}

package/dist/graph/documents/roles.js

@@ -0,0 +1,112 @@
+"use strict";
+/**
+ * Role / hat-admin queries (pop org roles, pop org view, pop org set-metadata-admin).
+ *
+ * Kept separate from queries/org.ts and queries/role.ts so the roles commands
+ * can carry the vouch-config fields without touching the shared org document.
+ *
+ * VERIFIED against the live Gnosis (poa-gnosis-v-1) and Arbitrum (poa-arb-v-1)
+ * deployments on 2026-07-30:
+ *   - Hat.vouchConfig exists on BOTH schemas and is populated. Every non-null
+ *     row has enabled=true, quorum>=1, membershipHatId!=0.
+ *   - A null Hat.vouchConfig means "vouching was never configured for this
+ *     hat", not "the subgraph is missing data": for every role whose
+ *     vouchConfig is null (ELIGIBILITY_ADMIN on all 9 Gnosis orgs + Arb's
+ *     "Poa", plus Test6/TaskRunner, Test6/Treasurer, Decentral Park/Neighbor)
+ *     an eth_call to EligibilityModule returned isVouchingEnabled()==false and
+ *     vouchConfigs().quorum==0 — exactly what the CLI renders for a null row.
+ *   - Role.hat is non-null on all 31 Gnosis roles and all 3 Arbitrum roles.
+ *   - subgraph src/eligibility-module.ts handleVouchConfigSet writes quorum /
+ *     membershipHatId / enabled / combinesWithHierarchy on EVERY VouchConfigSet
+ *     event, including disables, so the row does not go stale after a change.
+ *   - Organization.metadataAdminHatId is non-null on all 9 Gnosis orgs and the
+ *     1 Arbitrum org, and subgraph src/org-registry.ts
+ *     handleOrgMetadataAdminHatSet rewrites it on every OrgMetadataAdminHatSet.
+ *     Spot-checked Argus against OrgRegistry.getOrgMetadataAdminHat on Gnosis:
+ *     identical (30222100625258283641858621132055137413908072809768050515156576961036288).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FETCH_ORG_METADATA_ADMIN_HAT = exports.FETCH_ROLES_AND_MEMBERS = exports.FETCH_ROLES_MEMBERS_AND_VOUCH = void 0;
+/**
+ * Tier 0 for `pop org roles`: roles + members + the vouch config inlined via
+ * Role.hat.vouchConfig. Serving this tier means the command issues ZERO
+ * eth_calls (previously 2 per role: isVouchingEnabled + vouchConfigs).
+ */
+exports.FETCH_ROLES_MEMBERS_AND_VOUCH = `
+  query FetchRolesMembersAndVouch($id: Bytes!) {
+    organization(id: $id) {
+      roles(where: { isUserRole: true }) {
+        id
+        hatId
+        name
+        image
+        canVote
+        isUserRole
+        hat {
+          id
+          vouchConfig {
+            enabled
+            quorum
+            membershipHatId
+            combinesWithHierarchy
+          }
+        }
+      }
+      users {
+        address
+        participationTokenBalance
+        membershipStatus
+        currentHatIds
+        account {
+          username
+        }
+      }
+      eligibilityModule {
+        id
+      }
+    }
+  }
+`;
+/**
+ * Tier 1 for `pop org roles`: the legacy shape, for any deployment whose
+ * schema predates Hat.vouchConfig. When this tier serves, the command falls
+ * back to batched EligibilityModule reads through Multicall3.
+ */
+exports.FETCH_ROLES_AND_MEMBERS = `
+  query FetchRolesAndMembers($id: Bytes!) {
+    organization(id: $id) {
+      roles(where: { isUserRole: true }) {
+        id
+        hatId
+        name
+        image
+        canVote
+        isUserRole
+      }
+      users {
+        address
+        participationTokenBalance
+        membershipStatus
+        currentHatIds
+        account {
+          username
+        }
+      }
+      eligibilityModule {
+        id
+      }
+    }
+  }
+`;
+/**
+ * Current metadata-admin hat for one org — the subgraph mirror of
+ * OrgRegistry.getOrgMetadataAdminHat(orgId).
+ */
+exports.FETCH_ORG_METADATA_ADMIN_HAT = `
+  query FetchOrgMetadataAdminHat($orgId: Bytes!) {
+    organization(id: $orgId) {
+      id
+      metadataAdminHatId
+    }
+  }
+`;