/**
 * Read the client IP from a request. Honours the "trust proxy" contract
 * of Fastify / Express (`req.ip`); otherwise falls back to the socket
 * peer address. Never trusts `X-Forwarded-For` unless the framework
 * already resolved it into `req.ip` — matches the default distrust of
 * XFF in `@exortek/security`.
 *
 * @param {any} req
 * @returns {string | undefined}
 */
export function readIp(req: any): string | undefined;
/**
 * Read the User-Agent header from a request, tolerant of both Node
 * `IncomingMessage` (headers dict) and WHATWG `Request` (`.headers.get`).
 *
 * @param {any} req
 * @returns {string | undefined}
 */
export function readUserAgent(req: any): string | undefined;
/**
 * Derive a compact fingerprint from the pieces the caller opted into.
 * Uses SHA-256 truncated to 16 bytes (128 bits) — enough to make
 * collisions unrealistic without bloating the sealed cookie payload.
 *
 * `bindTo` is an array — order MUST be stable across issue and verify.
 * We always concatenate in the same canonical order regardless of the
 * caller's array order.
 *
 * @param {any} req
 * @param {ReadonlyArray<'ip' | 'ua'>} bindTo
 * @returns {string | undefined}    base64url hash, or `undefined` when no bindTo entry resolved.
 */
export function computeFingerprint(req: any, bindTo: ReadonlyArray<"ip" | "ua">): string | undefined;