import * as cf from "@pulumi/cloudflare";
export type RateLimitRule = {
    /** The maximum number of requests allowed within the period. */
    requestsPerPeriod: number;
    /** The time window in seconds to count requests (10, 60, 120, 300, or 600). */
    period: 10 | 60 | 120 | 300 | 600;
    /** The action to take when the threshold is exceeded. */
    action: "block" | "challenge" | "managed_challenge" | "js_challenge" | "log";
    /**
     * How long (in seconds) to block requests after the threshold is exceeded.
     * Required when action is "block". Must be >= period. Ignored for other actions.
     */
    mitigationTimeout?: number;
    /**
     * A Cloudflare Firewall Rules expression to match requests.
     * The hostname condition is prepended automatically.
     * Examples:
     *   - `http.request.uri.path eq "/login"` — matches a single path
     *   - `http.request.uri.path matches "^/api/"` — matches a path prefix with regex
     *   - `http.request.uri.path eq "/login" and http.request.method eq "POST"` — path + method
     *
     * If not provided, matches all traffic for the domain.
     * @see https://developers.cloudflare.com/ruleset-engine/rules-language/
     */
    expression?: string;
    /** Optional description for the rule. */
    description?: string;
    /**
     * Whether to count all requests (including those served from CF cache) towards
     * the rate limit threshold. Defaults to true.
     *
     * When false, only requests forwarded to the origin count. An attacker hitting
     * a cached endpoint would not trigger the rate limit.
     */
    countCachedRequests?: boolean;
};
export type ServiceRateLimitConfig = {
    /** The service name, used for resource naming and descriptions. */
    serviceName: string;
    /** The public hostname for this service (e.g. "my-service.decentraland.org"). */
    hostname: string;
    /** The rate limiting rules for this service. */
    rules: RateLimitRule[];
};
/**
 * Validates a single rate limit rule and returns a Cloudflare Ruleset rule object.
 *
 * @param globalIndex - A unique index across all rules in the ruleset, used for
 *   resource naming and error messages.
 * @throws if the rule configuration is invalid.
 * @internal Exported for testing.
 */
export declare function buildRulesetRule(serviceName: string, hostname: string, rule: RateLimitRule, globalIndex: number): {
    action: string;
    expression: string;
    description: string;
    enabled: boolean;
    ratelimit: {
        characteristics: string[];
        period: 120 | 60 | 10 | 300 | 600;
        requestsPerPeriod: number;
        mitigationTimeout: number;
        requestsToOrigin: boolean;
    };
};
/** @internal Reset module state for testing. */
export declare function _resetForTesting(): void;
/**
 * Creates a single zone-level Cloudflare Ruleset containing rate limiting rules
 * aggregated from all services. This must be called from a centralized Pulumi
 * stack — not from individual service stacks — because Cloudflare only supports
 * one `http_ratelimit` phase ruleset per zone.
 *
 * This function must only be called once per Pulumi program. A second call will
 * throw to prevent silent overwrites of the zone-level ruleset.
 *
 * Rules are ordered so that rules with a custom expression (narrower scope) are
 * evaluated before hostname-only rules (broader scope). Within each group, the
 * original insertion order is preserved.
 *
 * @param services - Array of service rate limiting configurations to aggregate.
 * @returns The created Ruleset, or undefined if no services have rate limiting rules.
 */
export declare function createZoneRateLimitRuleset(services: ServiceRateLimitConfig[]): Promise<cf.Ruleset | undefined>;