export type RateLimitDecision = {
    allowed: true;
} | {
    allowed: false;
    retryAfterSeconds: number;
};
export type AuthRateLimiterOptions = {
    /** Max consecutive failures before the IP is locked out. */
    maxFailures?: number;
    /** Lockout duration once `maxFailures` is reached. */
    lockoutMs?: number;
    /** Reset the failure counter if no failed attempts arrive within this window. */
    failureWindowMs?: number;
    /** Cap the IP table size; oldest entries are evicted past this. */
    maxTrackedClients?: number;
    /** Injected for tests. */
    now?: () => number;
};
export declare class AuthRateLimiter {
    private readonly entries;
    private readonly maxFailures;
    private readonly lockoutMs;
    private readonly failureWindowMs;
    private readonly maxTrackedClients;
    private readonly now;
    constructor(options?: AuthRateLimiterOptions);
    check(clientKey: string | null | undefined): RateLimitDecision;
    recordFailure(clientKey: string | null | undefined): RateLimitDecision;
    recordSuccess(clientKey: string | null | undefined): void;
    /** Exposed for tests. */
    size(): number;
    private evictIfOversized;
}
