/**
 * Tiny token-bucket rate limiter keyed by an identifier string (IP, client,
 * or bearer token). Used by the HTTP transport to cap request bursts on
 * the unauthenticated paths (`/oauth/*`, `/health`) and on the authed MCP
 * endpoint so a stolen token can't DoS Bridge.
 *
 * Token-bucket picks over leaky-bucket because it allows small bursts
 * (friendlier to legitimate session ramp-up) while still enforcing an
 * average rate.
 */
export interface TokenBucketOptions {
    /** Max tokens stored in the bucket (burst). */
    capacity: number;
    /** Tokens added per second. */
    refillPerSecond: number;
}
export declare class TokenBucketLimiter {
    private readonly buckets;
    private readonly capacity;
    private readonly refillPerMs;
    private readonly now;
    constructor(opts: TokenBucketOptions, now?: () => number);
    /**
     * Try to take a token. Returns true when allowed; false when the caller
     * should be rejected (HTTP 429).
     */
    take(key: string, tokens?: number): boolean;
    /**
     * Evict buckets that have been idle long enough to be fully refilled —
     * keeps the map from growing unbounded for transient callers.
     */
    sweep(maxIdleMs?: number): number;
    size(): number;
}
//# sourceMappingURL=rate-limit.d.ts.map