/** Config for a {@link rateLimitByOrg} limiter. */
export interface OrgRateLimitOptions {
    /** Unique name — namespaces the Redis bucket + labels logs. */
    name: string;
    /** Max requests per window per org (or per client IP when unauthenticated). */
    max: number;
    /** Window length in ms. */
    windowMs: number;
    /** Optional 429 message override. */
    message?: string;
}
/**
 * Per-ORGANIZATION rate limiter for a specific hot/expensive route, keyed on the
 * VERIFIED auth org — the complement to the coarse global per-IP limiter in
 * `createApp` (which a whole org behind one NAT shares, and a distributed
 * attacker spreads across IP buckets to evade).
 *
 * MUST be mounted AFTER `requireAuth` so `req.user.organizationId` is populated;
 * an unauthenticated caller falls back to a client-IP bucket (never a spoofable
 * header) so it stays bounded. Verified internal service principals are exempt
 * (they carry a signed service JWT). Uses the shared env Redis store
 * (cross-replica, namespaced by `name`) when configured, else in-memory.
 *
 * @example
 *   router.post('/', ...createAuthenticatedWithOrgRoute(), requirePermission('messages:write'),
 *     rateLimitByOrg({ name: 'message-send', max: 60, windowMs: 60_000 }),
 *     withRoute(handler));
 */
export declare function rateLimitByOrg(opts: OrgRateLimitOptions): import("express-rate-limit").RateLimitRequestHandler;