/**
 * Shared plumbing for `pop zkemail *`.
 *
 * The ZkEmailInvites module is OPTIONAL per org — `organization.zkEmailInvites` is null for
 * orgs deployed without it — and a deployed module with `merkleRoot == 0` is DORMANT (every
 * claim reverts until governance publishes an allowlist). Both states get a named error rather
 * than a confusing revert.
 */
import { ethers } from 'ethers';
export interface ZkEmailModuleState {
    orgId: string;
    orgName: string | null;
    address: string;
    /** On-chain active merkle root; ethers.constants.HashZero when dormant. */
    merkleRoot: string;
    /** On-chain allowlist CID digest (bytes32). */
    allowlistCidDigest: string;
    /** allowlistCidDigest decoded back to a CIDv0, or null when unset. */
    allowlistCid: string | null;
    /** True when no allowlist is committed — every claim reverts with AllowlistNotActive. */
    dormant: boolean;
    executor?: string;
    domainVerifier?: string;
    emailVerifier?: string;
    dkimRegistry?: string;
    accountRegistry?: string;
    universalFactory?: string;
    /** True when the wiring came from the subgraph rather than eth_calls. */
    indexedWiring: boolean;
}
export interface SubgraphAllowlistEntry {
    index: number;
    entryType: string;
    identifier: string | null;
    identifierHash: string | null;
    hatIds: string[];
    roleIndexes: number[];
}
/**
 * Resolve the org's ZkEmailInvites proxy from the subgraph.
 * Throws a named error when the org has no module rather than letting a null address
 * turn into an opaque call failure.
 */
export declare function resolveZkEmailModule(orgArg: string | undefined, chainId?: number): Promise<{
    orgId: string;
    orgName: string | null;
    address: string;
    subgraph: any;
    indexedWiring: boolean;
}>;
/**
 * Read the module's state, preferring the subgraph.
 *
 * `activeRoot` and `activeAllowlistCid` are indexed on the ZkEmailInvites entity, so the
 * allowlist half needs no RPC at all — `resolveZkEmailModule` has already fetched it. Only the
 * wiring addresses (executor + the four verifier/registry pointers) are unindexed, so they are
 * fetched on demand: pass `withWiring` when the caller actually renders them (`zkemail status`).
 *
 * Pass an existing `provider` to avoid opening a second connection.
 */
export declare function readModuleState(address: string, orgId: string, orgName: string | null, chainId?: number, provider?: ethers.providers.Provider, opts?: {
    subgraph?: any;
    withWiring?: boolean;
    withDkimRegistry?: boolean;
}): Promise<ZkEmailModuleState>;
/** Map hatId -> role name so allowlists render as "gmail.com -> Member". */
export declare function fetchRoleNames(orgId: string, chainId?: number): Promise<Map<string, string>>;
/** Render a hat ID as "Member (0x2a)" when the name is known, else the raw id. */
export declare function labelHat(hatId: string, names: Map<string, string>): string;
/** Normalize the subgraph's allowlist entries into a stable shape. */
export declare function normalizeEntries(allowlist: any): SubgraphAllowlistEntry[];