import { ConnectionCounter } from './connectionCounter.js';
import { SlidingWindowLimiter } from './rateLimiter.js';
export { ConnectionCounter } from './connectionCounter.js';
export { SlidingWindowLimiter } from './rateLimiter.js';
export interface RateLimitResult {
    allowed: true;
}
export interface RateLimitDenied {
    allowed: false;
    retryAfterMs: number;
    reason: string;
}
export declare class RateLimitManager {
    readonly perToken: SlidingWindowLimiter;
    readonly perIp: SlidingWindowLimiter;
    readonly global: SlidingWindowLimiter;
    /** Pre-auth limiter: caps new session creation per IP to prevent token-validation flooding */
    readonly preAuth: SlidingWindowLimiter;
    /** All OAuth endpoints, per IP. They carry no session and no credential of their own. */
    readonly oauth: SlidingWindowLimiter;
    /**
     * POST /authorize specifically. Each submission forwards a candidate token to
     * SeaTable, so an unthrottled endpoint is an oracle for testing stolen tokens
     * and an amplifier against our own backend.
     */
    readonly tokenSubmission: SlidingWindowLimiter;
    readonly connections: ConnectionCounter;
    private cleanupInterval?;
    constructor();
    check(opts: {
        ip: string;
        token?: string;
    }): RateLimitResult | RateLimitDenied;
    private cleanup;
    destroy(): void;
}
//# sourceMappingURL=index.d.ts.map