/**
 * Sliding-window rate limiter for the remote HTTP entrypoint.
 *
 * Public demo deployments hand the URL to strangers, so an unmetered endpoint is an
 * open invitation to loop it. Private deployments leave the limit at 0 (off).
 *
 * Trust note: behind a reverse proxy the peer address is always the proxy, so the
 * client comes from X-Forwarded-For. A client can forge that header, but the proxy
 * APPENDS the real peer, so only the LAST entry is trustworthy — never the first.
 */
export interface RateLimitOptions {
    /** Requests allowed per window, per client. 0 disables the limiter entirely. */
    perWindow: number;
    /** Window length in ms (default 60s). */
    windowMs?: number;
    /** Injectable clock — tests must not depend on wall time. */
    now?: () => number;
}
export declare class RateLimiter {
    private readonly perWindow;
    private readonly windowMs;
    private readonly now;
    private readonly hits;
    constructor(opts: RateLimitOptions);
    get enabled(): boolean;
    /** True if the request may proceed; false when the client is over its budget. */
    take(client: string): boolean;
    /** Seconds until this client's oldest hit expires (for Retry-After). */
    retryAfter(client: string): number;
    /** Drop clients whose window has fully expired — the map must not grow forever. */
    sweep(): void;
    /** Number of tracked clients — exposed for tests/monitoring. */
    get size(): number;
}
/**
 * Resolve the client identity from a proxied request.
 * Takes the LAST X-Forwarded-For entry (the one the trusted proxy appended);
 * spoofed values sit earlier in the list and are ignored.
 */
export declare function clientKey(headers: Record<string, unknown>, remoteAddress?: string): string;
//# sourceMappingURL=rate_limit.d.ts.map