/**
 * Per-sessionId 30s rate limiter for the dashboard locate action.
 * The slot is consumed on attempt, not on success — a 404 still burns the
 * slot. This keeps the rate limit useful against sessionId enumeration via
 * fast spam and matches the design spec.
 */
export declare class LocateRateLimiter {
    private windowMs;
    private last;
    constructor(windowMs: number);
    tryAcquire(sessionId: string): {
        ok: true;
    } | {
        ok: false;
        retryAfterMs: number;
    };
}
/** Module singleton — process-wide rate limit shared across all routes. */
export declare const locateLimiter: LocateRateLimiter;
//# sourceMappingURL=dashboard-locate.d.ts.map