/** Tracks failed password attempts per key (e.g. remote IP) to throttle brute-force guessing. */
export declare class PasswordRateLimiter {
    private _maxAttempts;
    private _windowMs;
    private _maxTrackedKeys;
    private _attempts;
    private _sweepTimer?;
    constructor(_maxAttempts: number, _windowMs: number, _maxTrackedKeys?: number);
    private _startSweepIfNeeded;
    private _stopSweepIfIdle;
    private _sweep;
    isBlocked(key: string): boolean;
    recordFailure(key: string): void;
    reset(key: string): void;
    stop(): void;
}