export interface RateLimitResult {
    allowed: boolean;
    remaining: number;
    resetAt: Date;
    retryAfter?: number;
}
export interface RateLimiter {
    check(key: string): Promise<RateLimitResult>;
    reset(key: string): Promise<void>;
}
export interface RateLimitConfig {
    windowMs: number;
    maxRequests: number;
    /**
     * Maximum number of distinct keys retained by the in-memory limiter.
     * When exceeded, the oldest entry (insertion order) is evicted. Defaults
     * to 10,000 — high enough to cover any legitimate single-process traffic
     * while bounding worst-case memory under enumeration / IP-spoofing
     * attacks. See M1 in the engineering audit.
     */
    maxKeys?: number;
    /**
     * When true, login/AI/upload-class limiters deny requests if Upstash is
     * unavailable (production) or returns an error, instead of failing open.
     */
    failClosed?: boolean;
}
/** Create a rate limiter backed by an in-memory sliding window (for dev/single-process). */
export declare function createInMemoryRateLimiter(config: RateLimitConfig): RateLimiter;
/** Log once at boot when strict limiters cannot reach a distributed backend in production. */
export declare function warnStrictRateLimitConfigAtBoot(): void;
/**
 * Resolve the Upstash REST URL + token from the environment.
 *
 * Accepts two naming schemes for the same credentials:
 *   1. `UPSTASH_REDIS_REST_URL` / `UPSTASH_REDIS_REST_TOKEN` — what you get
 *      from the Upstash console directly.
 *   2. `KV_REST_API_URL` / `KV_REST_API_TOKEN` — what Vercel's Marketplace
 *      Upstash (Redis/KV) integration auto-provisions. This is the *recommended*
 *      provisioning path in our deploy docs, so we must read these names too —
 *      otherwise a correctly-provisioned store silently falls back to the
 *      in-memory limiter.
 *
 * `UPSTASH_*` wins when both are present so an explicit override is honoured.
 * Both values point at the same REST endpoint / full-access token, so the
 * `/pipeline` transport below works identically regardless of which was set.
 */
export declare function resolveUpstashCredentials(env?: NodeJS.ProcessEnv): {
    url?: string;
    token?: string;
};
/** Create a rate limiter backed by Upstash Redis (for serverless/production). */
export declare function createUpstashRateLimiter(config: RateLimitConfig): RateLimiter;
export declare function createRateLimiter(config: RateLimitConfig): RateLimiter;
//# sourceMappingURL=rate-limit.d.ts.map