/** Per-IP rate limiter for failed auth attempts */
export class RateLimiter {
    attempts = new Map();
    maxAttempts;
    windowMs;
    constructor(maxAttempts = 10, windowMs = 60_000) {
        this.maxAttempts = maxAttempts;
        this.windowMs = windowMs;
    }
    isRateLimited(ip) {
        const record = this.attempts.get(ip);
        if (!record)
            return false;
        if (Date.now() - record.windowStart > this.windowMs) {
            this.attempts.delete(ip);
            return false;
        }
        return record.count >= this.maxAttempts;
    }
    recordFailure(ip) {
        const now = Date.now();
        const record = this.attempts.get(ip);
        if (!record || now - record.windowStart > this.windowMs) {
            this.attempts.set(ip, { count: 1, windowStart: now });
        }
        else {
            record.count++;
        }
    }
    cleanup() {
        const now = Date.now();
        for (const [ip, record] of this.attempts) {
            if (now - record.windowStart > this.windowMs) {
                this.attempts.delete(ip);
            }
        }
    }
}
//# sourceMappingURL=rate-limit.js.map