import type { Middleware } from "@nifrajs/core/server";
import { type MaybePromise } from "./_utils.js";
export type IpMatcher = string | ((ip: string, request: Request) => MaybePromise<boolean>);
export interface IpRestrictionOptions {
    readonly allow?: readonly IpMatcher[];
    readonly deny?: readonly IpMatcher[];
    /** Preferred extraction hook when the adapter/app knows the peer address. */
    readonly clientIp?: (request: Request) => MaybePromise<string | null | undefined>;
    /** Trusted proxy count for `X-Forwarded-For` extraction. Default: 0, so XFF is ignored. */
    readonly trustedProxies?: number;
    /** Exact trusted single-IP header, e.g. an infra-set `x-real-ip`. Not used unless configured. */
    readonly header?: string;
    readonly error?: string;
}
/**
 * IP allow/deny middleware. It fails closed when no trustworthy client IP can be derived. Configure
 * `clientIp`, `trustedProxies`, or a trusted single-IP `header`; unconfigured X-Forwarded-For is never
 * trusted.
 */
export declare function ipRestriction(options: IpRestrictionOptions): Middleware;
//# sourceMappingURL=ip-restriction.d.ts.map