/**
 * Pre-authentication connection budget per IP address.
 *
 * Limits the number of concurrent unauthenticated connections from a single
 * IP to prevent connection-flood DoS attacks. Once a connection authenticates
 * successfully, its slot is released.
 */
export declare function getMaxPreauthConnectionsPerIp(env?: NodeJS.ProcessEnv): number;
export type PreauthConnectionBudget = {
    /** Try to acquire a slot for the given client IP. Returns false if the budget is exhausted. */
    acquire(clientIp: string | undefined): boolean;
    /** Release a slot when the connection authenticates or closes. */
    release(clientIp: string | undefined): void;
    /** Current number of tracked IPs. */
    size(): number;
};
export declare function createPreauthConnectionBudget(limit?: number): PreauthConnectionBudget;