import { buckets } from "../gateway/rate-limit/buckets.js";
import "../gateway/rate-limit/index.js";
//#region src/tunnel/pairing-rate-limit.ts
/**
* Records a failed pairing exchange and returns whether subsequent attempts
* are still permitted. Called from the route handler on every invalid /
* expired pairing secret — successful exchanges do NOT call this.
*/
function consumePairingExchangeFailLimit(clientKey) {
	const fl = buckets.pairingExchange();
	const key = clientKey.trim() || "unknown";
	fl.fail(key);
	const status = fl.check(key);
	if (status.blocked) return {
		allowed: false,
		retryAfterMs: status.retryAfterSec * 1e3
	};
	return {
		allowed: true,
		retryAfterMs: 0
	};
}
/** @internal */
function resetPairingExchangeLimitsForTests() {
	buckets.pairingExchange().resetForTests();
}
//#endregion
export { consumePairingExchangeFailLimit, resetPairingExchangeLimitsForTests };

//# sourceMappingURL=pairing-rate-limit.js.map