export interface TrustedIpOptions {
    /** When true, fall back to parsing X-Forwarded-For. Defaults to false. */
    trustProxy?: boolean;
}
export declare function getClientIp(request: Request, options?: TrustedIpOptions): string;
/**
 * Returns true when the resolved client IP is a real value we can use for
 * security-sensitive keys (rate limits, IP allowlists). Returns false for the
 * `'unknown'` sentinel.
 */
export declare function isResolvedIp(ip: string): boolean;
/**
 * One-way hash of a client IP for storage alongside form submissions.
 *
 * We never persist raw IPs — they are PII and a liability. Hashing with the
 * instance secret as salt lets operators correlate repeat submitters / abuse
 * within a single deployment while making the stored value useless to anyone
 * who exfiltrates the table without also having `CMS_SECRET`. Returns `null`
 * for the `'unknown'` sentinel so callers store SQL NULL rather than a hash of
 * the literal string `'unknown'`.
 */
export declare function hashClientIp(ip: string): string | null;
//# sourceMappingURL=client-ip.d.ts.map