/**
 * Transport-authenticated peer provenance for inbound Web Requests.
 *
 * Fetch Request headers and URLs are caller-controlled. Runtime adapters must
 * record the native socket peer before application code or interceptors run.
 * This module is internal and is intentionally not re-exported from a public
 * platform barrel.
 *
 * @module platform/adapters/runtime/shared/request-peer
 */
export type RequestPeerRuntime = "node" | "deno" | "bun";
export interface RequestPeerProvenance {
    readonly runtime: RequestPeerRuntime;
    readonly transport: "tcp";
    readonly hostname: string;
}
/** @internal Record native transport authority before untrusted request code runs. */
export declare function recordRequestPeerFromTransport(request: Request, provenance: RequestPeerProvenance): boolean;
/** @internal Record the native peer supplied to a Deno.serve handler. */
export declare function recordDenoServeRequestPeer(request: Request, info: unknown): boolean;
/** @internal Record the native peer supplied by a Node IncomingMessage. */
export declare function recordNodeIncomingRequestPeer(request: Request, incoming: unknown): boolean;
/** @internal Record the native peer supplied by a Bun server context. */
export declare function recordBunServerRequestPeer(request: Request, server: unknown): boolean;
/**
 * @internal Record native peer context passed through a public handler bridge.
 * Supports Deno.serve handler info, Node IncomingMessage values, and Bun server
 * context values.
 */
export declare function recordHandlerRequestPeer(request: Request, context: unknown): boolean;
/** @internal Read immutable transport provenance without consulting headers. */
export declare function getRequestPeerProvenance(request: Request): RequestPeerProvenance | undefined;
/**
 * @internal Preserve transport authority when framework code replaces a
 * Request. Missing source provenance clears any authority on the target, so a
 * replacement cannot manufacture trust.
 */
export declare function inheritRequestPeerProvenance<T extends Request>(source: Request, target: T): T;
/** @internal Run an interceptor without discarding transport peer authority. */
export declare function runRequestInterceptor(request: Request, interceptor: (request: Request) => Request | Promise<Request>): Promise<Request>;
/** @internal True for IPv4 127/8, IPv6 ::1, or mapped IPv4 127/8. */
export declare function isLoopbackAddress(hostname: string): boolean;
/** True only when recorded native peer provenance contains a loopback address. */
export declare function isRequestFromLoopbackPeer(request: Request): boolean;
//# sourceMappingURL=request-peer.d.ts.map