/**
 * In-memory failed-attempt limiter for authentication endpoints.
 *
 * Tracks failures per key (typically the client IP) and enforces a temporary
 * lockout once a threshold is crossed within a rolling window. The lockout
 * duration grows on repeated lockouts. This blunts online brute-forcing of the
 * password and the 4-digit PIN without pulling in an external dependency.
 *
 * State is per-process and intentionally not persisted — a restart clears it.
 */
export declare class LoginLimiter {
    private readonly records;
    check(key: string): {
        locked: boolean;
        retryAfterMs: number;
    };
    recordFailure(key: string): void;
    recordSuccess(key: string): void;
    private evictIfNeeded;
}
export declare const authLimiter: LoginLimiter;