/**
 * IP allowlist matcher supporting both IPv4 and IPv6, including CIDR ranges.
 *
 * - Empty allowlist allows everything (the integrator opted out).
 * - When the allowlist is non-empty, the literal `'unknown'` (the sentinel
 *   returned by the trusted-IP resolver when no proxy header was present)
 *   never matches.
 * - IPv4 entries match IPv4 addresses (with optional `/n` CIDR mask, n=0..32).
 * - IPv6 entries match IPv6 addresses (with optional `/n` CIDR mask, n=0..128).
 *   Two IPv6 strings are equal when their canonical 16-byte form matches —
 *   so `2001:db8::1` matches `2001:db8:0:0:0:0:0:1`.
 * - Mapped IPv4-in-IPv6 addresses (`::ffff:1.2.3.4`) are normalised to IPv4.
 */
export declare function isIpAllowed(ip: string, allowlist: string[]): boolean;
//# sourceMappingURL=ip-allowlist.d.ts.map