import type { PondoknusaRequest } from './request.js';
import type { Middleware } from './types.js';
export interface TrustedProxiesOptions {
    /**
     * Peer addresses allowed to supply `X-Forwarded-*` / `X-Real-IP` /
     * `CF-Connecting-IP`. Supports exact IPs, CIDR ranges (e.g. `10.0.0.0/8`),
     * and `*` (trust every peer — insecure; avoid in production).
     *
     * Cloudflare Tunnel and local reverse proxies typically connect as
     * `127.0.0.1` / `::1`. Docker/private networks should list the proxy CIDR.
     */
    proxies: string[];
}
export declare function createTrustedProxiesMiddleware(options: TrustedProxiesOptions): Middleware;
export declare function resolveClientIp(request: PondoknusaRequest, remoteAddress?: string): string;
export declare function resolveSecure(request: PondoknusaRequest): boolean;
export declare function shouldTrustForwardedHeaders(request: PondoknusaRequest, remoteAddress?: string): boolean;
/**
 * Returns true when `remoteAddress` matches an entry in `proxies`
 * (exact IP, CIDR, or `*`).
 */
export declare function isTrustedProxyPeer(remoteAddress: string | undefined, proxies: string[]): boolean;
export declare function normalizeIp(address: string): string | null;
export declare function ipMatchesCidr(address: string, cidr: string): boolean;
//# sourceMappingURL=trusted-proxies.d.ts.map