/** ~2 MiB at 32-byte keys. The bound is on entries, not on bytes. */
export declare const MSG1_REPLAY_CACHE_ENTRIES = 65536;
/**
 * Remembers the ephemerals of message 1s that reached the handshake.
 *
 * Insertion-ordered and never refreshed on a hit — a hit is a replay, and
 * refreshing it would let an attacker pin a slot indefinitely with traffic that
 * is already being rejected. That is the one place this deliberately differs
 * from a textbook LRU: eviction is by first-seen age, which for entries that
 * are only ever written once is the same thing.
 */
export declare class Msg1ReplayCache {
    #private;
    constructor(options: {
        capacity?: number;
        ttlMs: number;
    });
    /** Live entries. For tests and for a diagnostics line — never a key. */
    get size(): number;
    /** Whether this ephemeral has already been through the handshake. */
    has(ephemeral: Buffer, now?: number): boolean;
    /**
     * Record an ephemeral that actually reached the handshake.
     *
     * Called only after `readMessage1` has succeeded, so garbage that never
     * parsed cannot fill the cache — the bound protects the thing the bound is
     * for.
     */
    record(ephemeral: Buffer, now?: number): void;
    /** A streamer restart does this by existing; tests need a call. */
    clear(): void;
}
//# sourceMappingURL=replay-cache.d.ts.map