import type { Middleware } from "../types.js";
import type { RateLimitEntry, RateLimitStore } from "./types.js";
/** Implement memory rate limit store. */
export declare class MemoryRateLimitStore implements RateLimitStore {
    private counts;
    private cleanupInterval?;
    private readonly maxEntries;
    constructor(windowMs: number, options?: MemoryRateLimitStoreOptions);
    increment(key: string, windowMs: number): Promise<RateLimitEntry>;
    reset(key: string): Promise<void>;
    destroy(): void;
    private removeExpired;
}
/** Options accepted by the in-memory rate limit store. */
export interface MemoryRateLimitStoreOptions {
    /**
     * Maximum number of active identities retained by the store.
     * Defaults to 10,000. Size this above the peak number of distinct identities
     * expected during one complete rate-limit window, including burst headroom.
     * At capacity, increments for identities without an active entry fail.
     * Active entries are never evicted because identity flooding could otherwise
     * reset an attacker's quota. When used through `rateLimit()`, capacity
     * exhaustion logs `stage=store-increment`,
     * `failureKind=capacity-exhausted`, and the configured `capacity`.
     */
    maxEntries?: number;
}
/** Options accepted by rate limit. */
export interface RateLimitOptions {
    maxRequests?: number;
    windowMs?: number;
    store?: RateLimitStore;
    /**
     * Maximum active identities retained by the default in-memory store.
     * Defaults to 10,000. At capacity, requests for identities without an active
     * entry receive HTTP 503. Active entries are not evicted because doing so
     * would let identity floods reset quotas. Capacity failures log
     * `stage=store-increment`, `failureKind=capacity-exhausted`, and the
     * configured `capacity`. Incompatible with a caller-provided `store`.
     */
    maxEntries?: number;
    keyGenerator?: (req: Request) => string;
    /**
     * Trust proxy-set forwarding headers (X-Forwarded-For) for keying. Defaults to
     * false so forwarded headers are ignored and cannot be used to evade limits.
     * Enable only when a trusted proxy that appends the real client IP sits in
     * front of this middleware.
     */
    trustProxy?: boolean;
}
/** Options accepted by the authentication rate-limit preset. */
export interface AuthRateLimitOptions {
    /** Storage backend. Existing callers can also pass the store directly. */
    store?: RateLimitStore;
    /**
     * Maximum active identities retained by the preset's default in-memory store.
     * See `RateLimitOptions.maxEntries` for capacity behavior and defaults.
     */
    maxEntries?: number;
    /** Function to derive a stable client key from the request. */
    keyGenerator?: (req: Request) => string;
    /**
     * Trust X-Forwarded-For and X-Real-IP for client identification.
     * Enable this only behind a trusted reverse proxy.
     */
    trustProxy?: boolean;
}
/** Create rate-limit middleware. */
export declare function rateLimit(optionsOrMaxRequests?: number | RateLimitOptions, windowMsArg?: number): Middleware;
/** Pre-configured rate limiter for authentication endpoints (5 req/15min). */
export declare function authRateLimit(storeOrOptions?: RateLimitStore | AuthRateLimitOptions): Middleware;
//# sourceMappingURL=rate-limit.d.ts.map