/**
 * Network utility functions for ThreadForge.
 *
 * Extracted from ForgeContext.js (A10) so other modules can reuse
 * isPrivateNetwork, matchCIDR, ipToInt, and isTrustedProxy without
 * pulling in the full ForgeContext dependency graph.
 */
/**
 * Convert an IPv4 dotted-quad string to a 32-bit unsigned integer.
 * Returns null if the address is malformed.
 */
export declare function ipToInt(ip: string): number | null;
/**
 * Basic CIDR match for IPv4. Matches address against prefix/length.
 */
export declare function matchCIDR(addr: string, cidr: string): boolean;
/**
 * Normalize a raw socket address by stripping IPv6 zone IDs and
 * IPv6-mapped IPv4 prefixes.
 */
export declare function normalizeAddress(address: string): string;
/**
 * Check if a remote address is from a private/trusted network.
 *
 * Covers RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16),
 * loopback (127.0.0.0/8, ::1), IPv6-mapped IPv4 (::ffff:x.x.x.x),
 * and custom trusted networks via FORGE_TRUSTED_NETWORKS env var.
 */
export declare function isPrivateNetwork(address: string): boolean;
/**
 * Check if a remote address is a trusted proxy.
 * Only trusts addresses listed in FORGE_TRUSTED_PROXIES env var.
 */
export declare function isTrustedProxy(address: string): boolean;
//# sourceMappingURL=network-utils.d.ts.map