export type RateLimitArgs = {
    /** Identifier to limit on — typically the client IP. */
    key: string;
    /** Max submissions allowed per window. Defaults to 5. */
    max?: number;
    /** Window length in ms. Defaults to 60_000 (one minute). */
    windowMs?: number;
};
/**
 * Returns true when the request is within the limit, false when it should be
 * rejected. A missing key (no IP) is allowed through — better to accept a
 * submission than to block everyone behind a proxy that strips the header.
 */
export declare function checkRateLimit({ key, max, windowMs }: RateLimitArgs): boolean;