/**
 * hosting/signin/clientAddress — which client a request came from, for the
 * per-address attempt budget.
 *
 * The socket's address, unless the peer is a TRUSTED proxy: then the rightmost
 * `X-Forwarded-For` hop that is not itself trusted (a client can prepend any
 * hops it likes; only the ones our own proxies appended are believed).
 * `X-Forwarded-For` from anybody else is ignored.
 *
 * `trustedProxies` entries are IP literals or CIDR ranges (`10.0.0.0/8`,
 * `fd00::/8`), matched as ranges — anything else is refused at construction,
 * so a typo cannot quietly match nothing.
 */
/// <reference types="node" />
import type { IncomingMessage } from 'node:http';
export interface TrustedProxies {
    has(address: string): boolean;
    /** Were any configured? */
    readonly configured: boolean;
}
/** Parse `trustedProxies`, or refuse the first entry that is not an IP or a CIDR range. */
export declare function trustedProxies(entries: readonly string[] | undefined): TrustedProxies;
/**
 * The client address. `forwardedUnset` is called when a request carries
 * `X-Forwarded-For` and no proxy is trusted — the door warns once that every
 * person behind that proxy then shares one address budget.
 */
export declare function clientAddress(req: IncomingMessage, trusted: TrustedProxies, forwardedUnset?: () => void): string;