import { type ApiRouteDeps } from "@opengeni/core";
import type { Hono } from "hono";
export type ManagedOnboardingRouteOptions = {
    accountSetupLimiter?: {
        take(key: string): boolean;
    };
    hashPassword?: (password: string) => Promise<string>;
};
export declare function registerManagedOnboardingRoutes(app: Hono, deps: ApiRouteDeps, options?: ManagedOnboardingRouteOptions): void;
/**
 * Bounded application-tier protection for the public setup bearer endpoint.
 * The global bucket prevents spoofed/high-cardinality client keys from
 * multiplying password-hash work, while the per-client bucket limits bursts.
 * A full key map rejects new clients until an idle bucket can be pruned.
 */
export declare class PublicSetupRateLimiter {
    private readonly options;
    private readonly buckets;
    private global;
    constructor(options?: {
        globalCapacity?: number;
        globalRefillPerSecond?: number;
        clientCapacity?: number;
        clientRefillPerSecond?: number;
        maxClientKeys?: number;
        now?: () => number;
    });
    take(key: string): boolean;
}