export declare function deriveAesKey(sharedSecret: ArrayBuffer, passphrase: string): Promise<CryptoKey>;
/**
 * Derive a deterministic 32-byte Ed25519 seed for OAuth JWT signing.
 *
 * Used in HTTP multi-user mode (CREDENTIAL_SECRET set) so every container
 * replica converges on the SAME signing key without a shared volume or
 * external secret store. Domain-separated per server via the HKDF info label.
 *
 * HKDF-SHA256 with IKM = secret, empty salt, info =
 * `mcp-jwt-signing-key-v1:<serverName>`. Byte-identical to core-py's
 * `derive_jwt_signing_seed` for the same inputs (enforced by the shared
 * crypto-vectors fixture).
 */
export declare function deriveJwtSigningSeed(secret: string, serverName: string): Buffer;
//# sourceMappingURL=kdf.d.ts.map