/**
 * Named rate-limit buckets used across the gateway. Each is a thin wrapper
 * over a primitive limiter ({@link RateLimiter} or {@link FailureLimiter})
 * that hard-codes its config and exposes a small surface.
 *
 * All buckets are owned by a process-level singleton {@link BucketRegistry}
 * so that:
 *   - lifecycle (cleanup timers) is centralized — `destroyAll()` on shutdown,
 *   - tests get one obvious reset entry point (`resetAllForTests`),
 *   - new buckets are added in exactly one place.
 *
 * Tuning policy:
 *   - `auth_failure` is read from runtime config because users tune it per
 *     deployment. Other buckets keep static defaults until a real need
 *     emerges to expose them. (YAGNI > premature configurability.)
 */
import { FailureLimiter, RateLimiter } from '../../infra/rate-limit/index.js';
import type { GatewayAuthRateLimitConfig } from '../../config/schema.js';
import type { AuthRateLimitPolicyConfig } from './auth-policy.js';
/**
 * Auth-failure config validated/normalized into the shape both the limiter
 * primitive and the policy layer need.
 */
export type ResolvedAuthRateLimitConfig = {
    enabled: boolean;
    maxFailures: number;
    windowMs: number;
    blockDurationMs: number;
    burstCoalesceMs: number;
    exemptLoopback: boolean;
};
export declare function resolveAuthRateLimit(input: GatewayAuthRateLimitConfig | undefined): ResolvedAuthRateLimitConfig;
export declare function authPolicyConfig(cfg: ResolvedAuthRateLimitConfig): AuthRateLimitPolicyConfig;
declare class BucketRegistry {
    private authFailureLimiter?;
    private authFailureSignature?;
    private strictApiLimiter?;
    private chatApiLimiter?;
    private xopcCloudPollLimiter?;
    private channelApiLimiter?;
    private tunnelMutateLimiter?;
    private pairingExchangeLimiter?;
    private sharePublicShortLimiter?;
    private sharePublicLongLimiter?;
    /**
     * Reconfigured on the fly when `gateway.auth.rateLimit` is reloaded —
     * compares a stable signature to avoid swapping out a hot bucket on every
     * config read.
     */
    authFailure(cfg: ResolvedAuthRateLimitConfig): FailureLimiter;
    /** Sensitive admin / mutation endpoints — 15 req / 60 s per client IP. */
    strictApi(): RateLimiter;
    /** Interactive chat actions — 180 req / 60 s per client IP. */
    chatApi(): RateLimiter;
    /** XOPC Cloud authorization polling — 60 req / 60 s per client IP. */
    xopcCloudPoll(): RateLimiter;
    /** Channel mutation/action endpoints — 20 req / 60 s per client IP. */
    channelApi(): RateLimiter;
    /** Tunnel mutation calls — 12 req / 5 min per gateway-token fingerprint. */
    tunnelMutate(): RateLimiter;
    /** Failed pairing-exchange attempts — 30 failures / 5 min per client IP. */
    pairingExchange(): FailureLimiter;
    /** Public share download short window — 60 req / min per client IP. */
    sharePublicShort(): RateLimiter;
    /** Public share download long window — 300 req / 15 min per client IP. */
    sharePublicLong(): RateLimiter;
    destroyAll(): void;
    /** @internal */
    resetAllForTests(): void;
}
export declare const buckets: BucketRegistry;
export {};