/**
 * In-memory, per-IP login rate limiter shared by the GUI's /auth/login route and the
 * TCP AUTHENTICATE command - one failure counter per client IP regardless of which
 * transport the attempt came in on. Never persisted to disk, reset on process restart,
 * same lifecycle as SessionStore.
 *
 * True sliding window (not fixed): each failure is timestamped, and a lockout triggers
 * once LOGIN_RATE_LIMIT_MAX_ATTEMPTS failures fall within the trailing
 * LOGIN_RATE_LIMIT_WINDOW_MS from "now" - not a fixed bucket that resets wholesale once
 * its start time expires. E.g. 4 failures at minute 0 and a 5th at minute 14 still locks
 * (all 5 are within the trailing 15-minute window), whereas a fixed window anchored at
 * minute 0 would have already rolled over and missed it.
 *
 * Deliberately IP-only (not IP+username): simpler to reason about, at the cost of
 * clients behind a shared/NAT IP being able to lock each other out. Acceptable for the
 * trusted-network deployment model this whole RBAC system targets.
 */
declare class LoginRateLimiter {
    private static instance;
    private readonly attempts;
    private sweepIntervalHandle;
    static getInstance(): LoginRateLimiter;
    /** Milliseconds remaining before this IP may attempt login again, or 0 if it's clear. */
    getCooldownRemaining(ip: string): number;
    /** Records a failed login attempt, locking the IP out once the threshold is crossed. */
    recordFailure(ip: string): void;
    /** Clears the failure counter for an IP following a successful login. */
    recordSuccess(ip: string): void;
    /** Clears every tracked IP's failure counter and any active lockouts. */
    clearAll(): void;
    startCleanupSweep(): void;
    stopCleanupSweep(): void;
}
declare const _default: LoginRateLimiter;
export default _default;