/**
 * Auth-failure rate-limit policy: how to derive a tracking key from a request,
 * and whether a given client should be exempted before counting.
 *
 * The {@link FailureLimiter} primitive is intentionally policy-free — this
 * module is the only place that knows about IPs, browser origins, and the
 * loopback exemption. Adding a new exemption rule (e.g. private CIDRs) means
 * editing this file alone; the limiter primitive does not change.
 */
export type AuthRateLimitPolicyConfig = {
    enabled: boolean;
    exemptLoopback: boolean;
};
/**
 * `key` is `''` when `exempt` is true. We use a flat shape rather than a
 * tagged union because the project's tsconfig has `strict: false`, which
 * disables boolean-discriminator narrowing.
 */
export type AuthRateLimitTracking = {
    exempt: boolean;
    key: string;
};
/**
 * Decide whether to track this client and, if so, what key identifies them.
 * Browser clients are tracked separately (origin + IP) so a rogue `<iframe>`
 * cannot piggyback on a CLI client's bucket and DoS it.
 */
export declare function resolveAuthTracking(params: {
    clientIp: string;
    origin?: string | null;
    cfg: AuthRateLimitPolicyConfig;
}): AuthRateLimitTracking;
/** Browser-tracking key format. Stable across reloads — survives state replay. */
export declare function buildBrowserOriginKey(origin: string, clientIp: string): string;