/**
 * Check if a request from the given session key is allowed.
 * Uses a sliding window algorithm: keeps timestamps of requests
 * within the last WINDOW_MS and checks count against max.
 *
 * @param sessionKey - Session identifier (session ID or IP)
 * @param now - Current timestamp (injectable for testing)
 * @returns Object with `allowed` boolean and `retryAfterMs` if rejected
 */
export declare function checkHttpRateLimit(sessionKey: string, now?: number): {
    allowed: true;
} | {
    allowed: false;
    retryAfterMs: number;
};
/** Reset all rate limit state (for testing). */
export declare function resetHttpRateLimits(): void;
/** Exposed for testing — the configured max requests per window. */
export declare const HTTP_RATE_LIMIT_MAX = 100;
/** Exposed for testing — the window duration in ms. */
export declare const HTTP_RATE_LIMIT_WINDOW_MS = 60000;
//# sourceMappingURL=http-rate-limiter.d.ts.map