@poa-box/core 0.1.0

package/dist/reads/vote.js

@@ -0,0 +1,392 @@
+"use strict";
+/**
+ * Vote/governance reads — typed wrappers over the voting graph documents for
+ * the entities the CLI's `pop vote list / results / execute / classes show`
+ * commands read, plus the pure selection helpers those commands share
+ * (fuzzy --proposal resolution, announce-all candidate selection, the
+ * execute state gate, results tallying, class-snapshot normalization).
+ *
+ * Raw subgraph entity shapes only — scalars arrive as strings.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GET_PROPOSAL_EXECUTION_STATE = void 0;
+exports.fetchVotingData = fetchVotingData;
+exports.fetchRecentProposals = fetchRecentProposals;
+exports.resolveProposalId = resolveProposalId;
+exports.selectAnnounceCandidates = selectAnnounceCandidates;
+exports.fetchProposalExecutionState = fetchProposalExecutionState;
+exports.evaluateExecuteGate = evaluateExecuteGate;
+exports.buildProposalResultsQuery = buildProposalResultsQuery;
+exports.computeProposalResults = computeProposalResults;
+exports.fetchProposalResults = fetchProposalResults;
+exports.normalizeSubgraphClasses = normalizeSubgraphClasses;
+exports.fetchClassConfig = fetchClassConfig;
+const ethers_1 = require("ethers");
+const voting_1 = require("../graph/documents/voting");
+const voting_classes_1 = require("../graph/documents/voting-classes");
+const resolve_1 = require("./resolve");
+const similarity_1 = require("../similarity");
+const errors_1 = require("../errors");
+const exit_codes_1 = require("../exit-codes");
+// ────────────────────────── proposals list ──────────────────────────
+/**
+ * Port of the `pop vote list` / `pop vote announce-all` data fetch
+ * (src/commands/vote/list.ts, src/commands/vote/announce-all.ts):
+ * FETCH_VOTING_DATA with the pre-#195 legacy tier as fallback.
+ *
+ * A GraphQL document validates as a whole, so one unknown field fails the
+ * entire query — the legacy tier keeps listing (and announcing) working
+ * against a pre-#195 subgraph deployment.
+ */
+async function fetchVotingData(client, orgIdOrName, chainId) {
+    const orgId = await (0, resolve_1.resolveOrgId)(client, orgIdOrName, chainId);
+    const { data } = await client.queryWithFieldFallback([
+        { query: voting_1.FETCH_VOTING_DATA, variables: { orgId } },
+        { query: voting_1.FETCH_VOTING_DATA_LEGACY, variables: { orgId } },
+    ], { chainId });
+    return data.organization ?? null;
+}
+/**
+ * Port of `fetchRecentProposals` (src/commands/vote/helpers.ts): recent
+ * proposal titles for ONE voting contract, addressed by contract address —
+ * works for both Hybrid and DD (whichever entity matches answers, the other
+ * root field returns null).
+ */
+async function fetchRecentProposals(client, contractAddr, chainId, first = 50) {
+    const data = await client.query(voting_1.RECENT_PROPOSALS_FOR_RESOLVE, { votingId: contractAddr.toLowerCase(), first }, chainId);
+    const raw = [
+        ...(data?.hybridVotingContract?.proposals ?? []),
+        ...(data?.directDemocracyVotingContract?.ddvProposals ?? []),
+    ];
+    return raw.map((p) => ({
+        proposalId: String(p.proposalId),
+        title: String(p.title ?? ''),
+        status: String(p.status ?? ''),
+        endTimestamp: p.endTimestamp !== undefined && p.endTimestamp !== null ? String(p.endTimestamp) : undefined,
+    }));
+}
+function candidateLine(c) {
+    return `#${c.proposalId} '${c.title}' (${c.status})`;
+}
+/**
+ * Port of `resolveProposalId` (src/commands/vote/helpers.ts): resolve a
+ * user-supplied proposal argument to a numeric proposal ID.
+ *
+ * - Numeric input → returned as-is (no network round-trip).
+ * - Anything else → fuzzy title query against the voting contract's recent
+ *   proposals, scored with Jaccard bestMatches at threshold 0.5.
+ *     - exactly one match → resolved
+ *     - multiple matches  → CliError listing the candidates (the CLI's
+ *       non-TTY behavior; the interactive picker is CLI UX and not ported)
+ *     - zero matches      → CliError listing the 5 most recent titles
+ *
+ * opts.preferActive (used by `vote cast`): when several proposals match but
+ * exactly ONE is still Active, that one wins — you can only cast on an open
+ * proposal, so ended homonyms are not ambiguity.
+ */
+async function resolveProposalId(client, input, contractAddr, chainId, opts) {
+    const trimmed = input.trim();
+    const n = Number(trimmed);
+    if (Number.isFinite(n) && Number.isInteger(n) && n >= 0 && String(n) === trimmed) {
+        return n;
+    }
+    const candidates = await fetchRecentProposals(client, contractAddr, chainId);
+    if (candidates.length === 0) {
+        throw new errors_1.CliError(`Cannot resolve proposal '${input}': no proposals are indexed for this voting contract yet.`, exit_codes_1.EXIT.USAGE, 'Check the org/--type, or pass the numeric proposal ID (pop vote list).');
+    }
+    let matches = (0, similarity_1.bestMatches)(trimmed, candidates, c => c.title, { threshold: 0.5, topN: 5 });
+    if (matches.length > 1 && opts?.preferActive) {
+        const active = matches.filter(m => m.item.status === 'Active');
+        if (active.length === 1)
+            matches = active;
+    }
+    if (matches.length === 1) {
+        return Number(matches[0].item.proposalId);
+    }
+    if (matches.length > 1) {
+        throw new errors_1.CliError(`Proposal query '${input}' is ambiguous — ${matches.length} proposals match:\n` +
+            matches.map(m => `  ${candidateLine(m.item)}`).join('\n'), exit_codes_1.EXIT.USAGE, `Pass the numeric ID instead, e.g. --proposal ${matches[0].item.proposalId}`);
+    }
+    const recent = candidates.slice(0, 5);
+    throw new errors_1.CliError(`No proposal title matches '${input}'. The ${recent.length} most recent proposals are:\n` +
+        recent.map(c => `  ${candidateLine(c)}`).join('\n'), exit_codes_1.EXIT.USAGE, 'Pass a numeric proposal ID from pop vote list, or refine the title query.');
+}
+/**
+ * Pure port of the `pop vote announce-all` candidate filter
+ * (src/commands/vote/announce-all.ts): proposals ready to announce are
+ *   - status "Ended" (subgraph updated), OR
+ *   - status "Active" but endTimestamp has passed (subgraph hasn't updated)
+ * excluding already-announced ones — EXCEPT the H-05 retry case: a FAILED
+ * execution is not "done". Audit H-05 releases the in-flight `executed` lock
+ * in the catch branch, so the proposal is re-announceable — but it already
+ * has a winningOption (Winner is emitted regardless), so the plain
+ * already-announced test would skip it forever and silently.
+ *
+ * Callers should still per-proposal callStatic-probe announceWinner before
+ * broadcasting (the CLI skips would-revert candidates without burning gas).
+ *
+ * @param nowSeconds unix seconds "now" — pass chain time when available.
+ */
+function selectAnnounceCandidates(org, nowSeconds) {
+    const toAnnounce = [];
+    const isEnded = (p) => p.status === 'Ended' ||
+        (p.status === 'Active' && !!p.endTimestamp && parseInt(p.endTimestamp) < nowSeconds);
+    for (const p of org.hybridVoting?.proposals ?? []) {
+        const alreadyDone = (p.status === 'Executed' || p.winningOption != null) && !p.executionFailed;
+        if (alreadyDone)
+            continue;
+        if (isEnded(p)) {
+            toAnnounce.push({
+                id: p.proposalId,
+                type: 'hybrid',
+                title: p.title || `Proposal #${p.proposalId}`,
+                retry: Boolean(p.executionFailed),
+            });
+        }
+    }
+    for (const p of org.directDemocracyVoting?.ddvProposals ?? []) {
+        // Same H-05 retry case as hybrid above.
+        const alreadyDone = (p.status === 'Executed' || p.winningOption != null) && !p.executionFailed;
+        if (alreadyDone)
+            continue;
+        if (isEnded(p)) {
+            toAnnounce.push({
+                id: p.proposalId,
+                type: 'dd',
+                title: p.title || `DD Proposal #${p.proposalId}`,
+                retry: Boolean(p.executionFailed),
+            });
+        }
+    }
+    return toAnnounce;
+}
+/** The `pop vote execute` state-gate document (src/commands/vote/execute.ts). */
+exports.GET_PROPOSAL_EXECUTION_STATE = `
+  query GetProposal($votingId: String!, $proposalId: String!) {
+    proposals(where: { hybridVoting: $votingId, proposalId: $proposalId }, first: 1) {
+      proposalId
+      status
+      winningOption
+      wasExecuted
+      executionFailed
+      isValid
+      winnerAnnouncedAt
+    }
+  }
+`;
+/**
+ * Port of the `pop vote execute` subgraph state gate: fetch the one proposal
+ * row the finalize decision is made from. Null row means the proposal is not
+ * indexed (the CLI treats that as not found).
+ */
+async function fetchProposalExecutionState(client, hybridVotingAddress, proposalId, chainId) {
+    const result = await client.query(exports.GET_PROPOSAL_EXECUTION_STATE, { votingId: hybridVotingAddress, proposalId: proposalId.toString() }, chainId);
+    return result.proposals?.[0] ?? null;
+}
+/**
+ * Pure port of the `pop vote execute` decision ladder over the subgraph row
+ * (same evaluation order as src/commands/vote/execute.ts). The caller maps
+ * 'not-ended' to the CLI's PRECONDITION error and the two "nothing to do"
+ * kinds to graceful no-ops.
+ */
+function evaluateExecuteGate(proposal) {
+    if (proposal.wasExecuted)
+        return { kind: 'already-executed' };
+    // executionFailed proposals ARE announced — the announce succeeded and the
+    // execution reverted. Audit H-05 made that retryable, so it must NOT be
+    // treated as already-announced.
+    if (proposal.winnerAnnouncedAt && !proposal.executionFailed) {
+        return { kind: 'already-announced', isValid: proposal.isValid };
+    }
+    if (proposal.status !== 'Ended')
+        return { kind: 'not-ended', status: proposal.status };
+    return { kind: 'ready', retryingFailedExecution: Boolean(proposal.executionFailed) };
+}
+/**
+ * The `pop vote results` proposal document (src/commands/vote/results.ts).
+ * Two tiers: the #195 attribution/provenance fields, then the pre-#195 field
+ * set. A GraphQL document validates as a whole, so without the fallback an
+ * endpoint that predates #195 would lose the rankings and voter breakdown
+ * this read exists to serve. The legacy tier is spelled out rather than
+ * derived so a reformat cannot silently turn it into a copy of the modern one.
+ */
+function buildProposalResultsQuery(orgId, proposalId, modern) {
+    const proposalCore = 'proposalId title status';
+    return `{
+    organization(id: "${orgId}") {
+      hybridVoting {
+        thresholdPct
+        quorum
+        ${modern ? 'classVersion' : ''}
+        proposals(where: {proposalId: ${proposalId}}) {
+          ${proposalCore}
+          ${modern ? 'proposer proposerUsername creatorUsername' : ''}
+          ${modern ? 'classesVersion winnerAnnouncedAt executedAt executedCallsCount' : ''}
+          metadata { description optionNames${modern ? ' actionSummaries promotedFrom' : ''} }
+          votes { voterUsername optionIndexes optionWeights }
+        }
+      }
+    }
+  }`;
+}
+/**
+ * Pure port of the `pop vote results` tally/ranking/attribution computation
+ * (src/commands/vote/results.ts) over the fetched hybridVoting row.
+ *
+ * Attribution: subgraph #195. proposer* are the current names; creator* the
+ * older aliases populated identically from transaction.from. proposedBy is an
+ * IDENTITY or null — never an address: most proposers are Executor or
+ * smart-account addresses with no username, and returning the address here
+ * would make `proposedBy === 'someone'` silently false for them while looking
+ * like a resolved name. The address is always available as proposerAddress.
+ */
+function computeProposalResults(hybridVoting) {
+    const proposal = hybridVoting.proposals?.[0];
+    if (!proposal)
+        return null;
+    // Two DISTINCT validity parameters — threshold is a % of weighted power,
+    // quorum is a raw voter count. Never conflate them.
+    const supportThresholdPct = hybridVoting.thresholdPct !== undefined ? Number(hybridVoting.thresholdPct) : undefined;
+    const quorumVoterCount = hybridVoting.quorum !== undefined ? Number(hybridVoting.quorum) : undefined;
+    const optionNames = proposal.metadata?.optionNames || [];
+    const votes = proposal.votes || [];
+    // Tally weighted votes per option
+    const tallies = new Array(Math.max(optionNames.length, 1)).fill(0);
+    for (const v of votes) {
+        for (let i = 0; i < (v.optionIndexes || []).length; i++) {
+            const idx = parseInt(v.optionIndexes[i]);
+            const weight = parseInt(v.optionWeights[i]);
+            if (idx < tallies.length)
+                tallies[idx] += weight;
+        }
+    }
+    // Rank options
+    const ranked = optionNames
+        .map((name, i) => ({ rank: 0, option: i, name, score: tallies[i] || 0 }))
+        .sort((a, b) => b.score - a.score);
+    ranked.forEach((r, i) => { r.rank = i + 1; });
+    // Per-voter breakdown
+    const voterBreakdown = votes.map((v) => {
+        const allocations = {};
+        for (let i = 0; i < (v.optionIndexes || []).length; i++) {
+            const idx = parseInt(v.optionIndexes[i]);
+            const name = optionNames[idx] || `Option ${idx}`;
+            allocations[name] = parseInt(v.optionWeights[i]);
+        }
+        return { voter: v.voterUsername || 'unknown', allocations };
+    });
+    const proposedBy = proposal.proposerUsername || proposal.creatorUsername || null;
+    // A proposal is tallied against the voting-class config in force when it was
+    // CREATED, so a live config change mid-flight makes the org-level
+    // threshold/quorum shown here stale.
+    const classVersionAtCreation = proposal.classesVersion != null ? String(proposal.classesVersion) : null;
+    const liveClassVersion = hybridVoting.classVersion != null ? String(hybridVoting.classVersion) : null;
+    const classConfigDrifted = Boolean(classVersionAtCreation && liveClassVersion && classVersionAtCreation !== liveClassVersion);
+    return {
+        proposalId: proposal.proposalId,
+        title: proposal.title,
+        status: proposal.status,
+        proposedBy,
+        proposerAddress: proposal.proposer || null,
+        classVersionAtCreation,
+        liveClassVersion,
+        classConfigDrifted,
+        winnerAnnouncedAt: proposal.winnerAnnouncedAt ? Number(proposal.winnerAnnouncedAt) : null,
+        executedAt: proposal.executedAt ? Number(proposal.executedAt) : null,
+        executedCallsCount: proposal.executedCallsCount != null ? Number(proposal.executedCallsCount) : null,
+        actionSummaries: proposal.metadata?.actionSummaries || [],
+        promotedFrom: proposal.metadata?.promotedFrom || null,
+        totalVoters: votes.length,
+        supportThresholdPct,
+        quorumVoterCount,
+        ranking: ranked,
+        voters: voterBreakdown,
+        winner: ranked[0],
+    };
+}
+/**
+ * Port of `pop vote results` (src/commands/vote/results.ts): rankings +
+ * per-voter breakdown for one proposal. Throws the CLI's not-found error when
+ * the proposal is not indexed.
+ */
+async function fetchProposalResults(client, orgIdOrName, proposalId, chainId) {
+    const orgId = await (0, resolve_1.resolveOrgId)(client, orgIdOrName, chainId);
+    const { data } = await client.queryWithFieldFallback([
+        { query: buildProposalResultsQuery(orgId, proposalId, true) },
+        { query: buildProposalResultsQuery(orgId, proposalId, false) },
+    ], { chainId });
+    const hybridVoting = data.organization?.hybridVoting;
+    const report = hybridVoting ? computeProposalResults(hybridVoting) : null;
+    if (!report)
+        throw new errors_1.CliError(`Proposal #${proposalId} not found`, exit_codes_1.EXIT.USAGE);
+    return report;
+}
+/**
+ * Subgraph rows → the exact shape the contract path produces. `asset` is
+ * checksummed because ethers returns a checksummed address and the subgraph
+ * returns lowercase Bytes; without this the `asset` value would change casing
+ * depending on which source answered.
+ */
+function normalizeSubgraphClasses(rows) {
+    return rows.map((c, i) => ({
+        classIndex: i,
+        strategy: String(c.strategy),
+        slicePct: Number(c.slicePct),
+        quadratic: Boolean(c.quadratic),
+        minBalance: ethers_1.ethers.BigNumber.from(String(c.minBalance ?? '0')).toString(),
+        asset: ethers_1.ethers.utils.getAddress(String(c.asset)),
+        hatIds: (c.hatIds ?? []).map(h => String(h)),
+    }));
+}
+/**
+ * Port of `pop vote classes show`'s subgraph read
+ * (fetchClassConfigFromSubgraph, src/commands/vote/classes.ts): the class
+ * table + both validity parameters. Returns null whenever the subgraph cannot
+ * answer authoritatively (contract not indexed, no rows for the requested
+ * version, missing schema fields, network error) so the caller falls back to
+ * the contract (getClasses()/getProposalClasses()/thresholdPct()/quorum())
+ * instead of showing an empty table.
+ */
+async function fetchClassConfig(client, hybridVotingAddress, proposalId, chainId) {
+    try {
+        const hybridVoting = hybridVotingAddress.toLowerCase();
+        // The proposal-snapshot query has a single tier on purpose: a deployment
+        // without Proposal.classesVersion cannot identify the frozen snapshot, and
+        // guessing the newest version would silently misreport an old proposal.
+        const tiers = proposalId === undefined
+            ? [
+                { query: voting_classes_1.FETCH_VOTING_CLASS_CONFIG, variables: { hybridVoting } },
+                { query: voting_classes_1.FETCH_VOTING_CLASS_CONFIG_LEGACY, variables: { hybridVoting } },
+            ]
+            : [
+                { query: voting_classes_1.FETCH_PROPOSAL_VOTING_CLASSES, variables: { hybridVoting, proposalId: String(proposalId) } },
+            ];
+        const { data } = await client.queryWithFieldFallback(tiers, { chainId });
+        const contract = data?.hybridVotingContract;
+        if (!contract)
+            return null;
+        const version = proposalId === undefined
+            ? contract.classVersion
+            : contract.proposals?.[0]?.classesVersion;
+        // For a proposal we must know its frozen version — no version, no answer.
+        if (proposalId !== undefined && (version === null || version === undefined))
+            return null;
+        const rows = (0, voting_classes_1.selectClassSnapshot)(contract.votingClasses, version);
+        if (rows.length === 0)
+            return null;
+        if (contract.thresholdPct === null || contract.thresholdPct === undefined)
+            return null;
+        if (contract.quorum === null || contract.quorum === undefined)
+            return null;
+        return {
+            classes: normalizeSubgraphClasses(rows),
+            supportThresholdPct: Number(contract.thresholdPct),
+            quorumVoterCount: Number(contract.quorum),
+        };
+    }
+    catch {
+        // Any subgraph problem (unknown field on an old deployment, lag, HTTP) —
+        // the contract is authoritative anyway, so just fall back.
+        return null;
+    }
+}

package/dist/reads/zkemail.d.ts

@@ -0,0 +1,117 @@
+/**
+ * ZK Email reads — module resolution + state for `pop zkemail status` /
+ * `pop zkemail claims`. Port of src/commands/zkemail/helpers.ts (client- and
+ * provider-injected) plus the claim-history read from
+ * src/commands/zkemail/claims.ts.
+ *
+ * The ZkEmailInvites module is OPTIONAL per org — `organization.zkEmailInvites`
+ * is null for orgs deployed without it — and a deployed module with
+ * `merkleRoot == 0` is DORMANT (every claim reverts until governance publishes
+ * an allowlist). Both states get a named error rather than a confusing revert.
+ */
+import { ethers } from 'ethers';
+import type { GraphClient } from '../graph/client';
+import type { EnvSource } from '../env';
+export interface ZkEmailModuleState {
+    orgId: string;
+    orgName: string | null;
+    address: string;
+    /** On-chain active merkle root; ethers.constants.HashZero when dormant. */
+    merkleRoot: string;
+    /** On-chain allowlist CID digest (bytes32). */
+    allowlistCidDigest: string;
+    /** allowlistCidDigest decoded back to a CIDv0, or null when unset. */
+    allowlistCid: string | null;
+    /** True when no allowlist is committed — every claim reverts with AllowlistNotActive. */
+    dormant: boolean;
+    executor?: string;
+    domainVerifier?: string;
+    emailVerifier?: string;
+    dkimRegistry?: string;
+    accountRegistry?: string;
+    universalFactory?: string;
+    /** True when the wiring came from the subgraph rather than eth_calls. */
+    indexedWiring: boolean;
+}
+export interface SubgraphAllowlistEntry {
+    index: number;
+    entryType: string;
+    identifier: string | null;
+    identifierHash: string | null;
+    hatIds: string[];
+    roleIndexes: number[];
+}
+/**
+ * Resolve the org's ZkEmailInvites proxy from the subgraph. Port of
+ * resolveZkEmailModule in src/commands/zkemail/helpers.ts.
+ * Throws a named error when the org has no module rather than letting a null
+ * address turn into an opaque call failure.
+ */
+export declare function resolveZkEmailModule(client: GraphClient, orgArg: string | undefined, chainId?: number): Promise<{
+    orgId: string;
+    orgName: string | null;
+    address: string;
+    subgraph: any;
+    indexedWiring: boolean;
+}>;
+/**
+ * Read the module's state, preferring the subgraph. Port of readModuleState in
+ * src/commands/zkemail/helpers.ts (the read behind `pop zkemail status`).
+ *
+ * `activeRoot` and `activeAllowlistCid` are indexed on the ZkEmailInvites entity, so the
+ * allowlist half needs no RPC at all — `resolveZkEmailModule` has already fetched it. Only the
+ * wiring addresses (executor + the four verifier/registry pointers) are unindexed pre-#197, so
+ * they are fetched on demand: pass `withWiring` when the caller actually renders them.
+ *
+ * Pass an existing `provider` to avoid opening a second connection; when omitted and an RPC
+ * read is needed, a JsonRpcProvider is built from resolveNetworkConfig(chainId, env).
+ */
+export declare function readModuleState(address: string, orgId: string, orgName: string | null, chainId?: number, provider?: ethers.providers.Provider, opts?: {
+    subgraph?: any;
+    withWiring?: boolean;
+    withDkimRegistry?: boolean;
+    env?: EnvSource;
+}): Promise<ZkEmailModuleState>;
+/**
+ * The indexed active root for an org's module, identity-guarded — the display
+ * read used by `pop zkemail propose-allowlist`
+ * (src/commands/zkemail/propose-allowlist.ts).
+ *
+ * Returns:
+ *   - a root string (HashZero for a dormant module whose row EXISTS), or
+ *   - null when the row is missing / the indexed module id does not match
+ *     `moduleAddress` (a stale org->module pointer must not describe a
+ *     different contract than the one a proposal targets). Callers fall back
+ *     to merkleRoot() on-chain for the null case.
+ */
+export declare function fetchIndexedActiveRoot(client: GraphClient, orgId: string, moduleAddress: string, chainId?: number): Promise<string | null>;
+export interface ZkEmailClaimRow {
+    id: string;
+    kind: string;
+    claimer: string;
+    claimerUsername: string | null;
+    /** The allowlist leaf the claim used — may belong to a SUPERSEDED allowlist. */
+    identifierHash: string;
+    hatIds: string[];
+    /** Absent on the passkey onboarding path, which does not emit it (majority of live Gnosis claims). */
+    nullifier: string | null;
+    registeredUsername: string | null;
+    claimedAt: string;
+    claimedAtBlock: string;
+    transactionHash: string;
+}
+/**
+ * Claim history for a module, most recent first — the read behind
+ * `pop zkemail claims` (src/commands/zkemail/claims.ts). Indexed since
+ * subgraph-pop #197; on a chain still serving the legacy tier the claim events
+ * were seen but every parameter was discarded, so there is nothing to read —
+ * callers should gate on `indexedWiring` from resolveZkEmailModule like the
+ * CLI does.
+ */
+export declare function fetchZkEmailClaims(client: GraphClient, moduleAddress: string, chainId?: number, limit?: number): Promise<ZkEmailClaimRow[]>;
+/** Map hatId -> role name so allowlists render as "gmail.com -> Member". */
+export declare function fetchRoleNames(client: GraphClient, orgId: string, chainId?: number): Promise<Map<string, string>>;
+/** Render a hat ID as "Member (0x2a)" when the name is known, else the raw id. */
+export declare function labelHat(hatId: string, names: Map<string, string>): string;
+/** Normalize the subgraph's allowlist entries into a stable shape. */
+export declare function normalizeEntries(allowlist: any): SubgraphAllowlistEntry[];