/**
 * Handles device fingerprinting and per-session device key derivation.
 *
 * **Fragility note:** The fingerprint is derived from screen resolution, color
 * depth, timezone, and canvas rendering output. Any of these changing will
 * invalidate existing sessions — for example, connecting an external monitor,
 * changing display scaling, or traveling to a different timezone. This is an
 * intentional trade-off: the fingerprint serves as a defense-in-depth layer
 * (preventing casual session replay on a different device) rather than a strong
 * authentication factor.
 */
export declare class DeviceBinder {
    /**
     * Build a stable device identifier so sessions can only be restored on the
     * same browser/device profile that created them.
     */
    generateFingerprint(): Promise<string>;
    /**
     * Derive a session-specific wrapping key from the device fingerprint.
     *
     * Why HKDF: it turns fingerprint text into cryptographic key material in a
     * repeatable way without storing raw key bytes anywhere.
     */
    deriveSessionKey(fingerprint: string, sessionId: string): Promise<CryptoKey>;
    /**
     * Add a rendering-dependent signal. This makes replay from another browser
     * profile/device harder, even when basic environment values look similar.
     */
    private generateCanvasFingerprint;
    /**
     * Normalize variable-length fingerprint input into a fixed-size identifier so
     * downstream key derivation behaves consistently.
     */
    private hashFingerprint;
}
//# sourceMappingURL=DeviceBinder.d.ts.map