type ClientIpRequest = {
    headers?: Record<string, string | string[] | undefined>;
    ip?: string;
    socket?: {
        remoteAddress?: string;
    };
};
/**
 * Resolves the client IP without trusting spoofable forwarding headers on direct connections.
 * When TRUST_PROXY=true, Express populates req.ip from trusted proxy hops.
 * Cloudflare headers are only honored when TRUST_CLOUDFLARE_HEADERS=true.
 */
export declare function getClientIpFromRequest(req?: ClientIpRequest): string;
export declare function parseCidrs(envCidrs?: string): string[];
export declare function isIpAllowedByCidrs(ipAddress: string, cidrs: string[]): boolean;
export {};