/**
 * src/oauth/rate-limit.ts — Simple per-IP rate limiter for the token endpoint.
 *
 * No external dependencies — uses a plain Map + setInterval for cleanup.
 *
 * Usage:
 *   app.use("/oauth/token", createRateLimiter({ windowMs: 60_000, maxRequests: 10 }));
 */
import type { Request, Response, NextFunction } from "express";
export interface RateLimiterOptions {
    windowMs: number;
    maxRequests: number;
    trustProxy?: boolean;
    /**
     * Shared egress ranges (IPv4 CIDR) that get a higher ceiling. Claude's servers
     * make every token exchange and refresh from Anthropic's published range
     * (160.79.104.0/21), so all Claude users share one per-IP bucket.
     */
    sharedEgress?: {
        cidrs: string[];
        maxRequests: number;
    };
}
export declare function ipInCidr(ip: string, cidr: string): boolean;
/** Anthropic's outbound range for Claude (claude.ai, Desktop, mobile, Cowork). */
export declare const ANTHROPIC_EGRESS_CIDRS: string[];
/**
 * Creates a rate-limiting Express middleware.
 *
 * Returns 429 with Retry-After header when the per-IP limit is exceeded.
 */
export declare function createRateLimiter(options: RateLimiterOptions): (req: Request, res: Response, next: NextFunction) => void;