/**
 * Normalize a raw IP into a canonical string. IPv4-mapped IPv6 addresses
 * (e.g. "::ffff:1.2.3.4") collapse to their IPv4 form so the same client
 * compares equal regardless of socket family.
 */
export declare function normalizeIp(raw: string | undefined | null): string | null;
/** Validate that a string is a bare IP or CIDR (e.g. "1.2.3.4" or "10.0.0.0/8"). */
export declare function isValidIpRule(value: string): boolean;
export declare function ipMatchesAny(ip: string | null, rules: Array<{
    value: string;
}>): boolean;
export declare const DEFAULT_SESSION_IP_MASK_V4 = 24;
export declare const DEFAULT_SESSION_IP_MASK_V6 = 48;
export declare function isWithinSessionNetwork(candidate: string, reference: string, ipv4Bits?: number, ipv6Bits?: number): boolean;
