@attocash/cli 0.1.0

package/node_modules/@noble/hashes/src/blake3.ts

@@ -0,0 +1,317 @@
+/**
+ * Blake3 fast hash is Blake2 with reduced security (round count). Can also be used as MAC & KDF.
+ *
+ * It is advertised as "the fastest cryptographic hash". However, it isn't true in JS.
+ * Why is this so slow? While it must be 6x faster than blake2b, perf diff is only 20%:
+ *
+ * * There is only 30% reduction in number of rounds from blake2s
+ * * Speed-up comes from tree structure, which is parallelized using SIMD & threading.
+ *   These features are not present in JS, so we only get overhead from trees.
+ * * Parallelization only happens on 1024-byte chunks: there is no benefit for small inputs.
+ * * It is still possible to make it faster using: a) loop unrolling b) web workers c) wasm
+ * @module
+ */
+import { SHA256_IV } from './_md.ts';
+import { fromBig } from './_u64.ts';
+import { _BLAKE2, compress } from './blake2.ts';
+// prettier-ignore
+import {
+  abytes, aexists, anumber, aoutput,
+  clean,
+  copyBytes,
+  createHasher, swap32IfBE,
+  u32, u8,
+  type CHashXOF,
+  type HashXOF,
+  type TArg,
+  type TRet
+} from './utils.ts';
+
+// Constructor-time mode flags (`KEYED_HASH`, `DERIVE_*`) plus per-node tree
+// flags (`CHUNK_*`, `PARENT`, `ROOT`).
+const B3_Flags = {
+  CHUNK_START: 0b1,
+  CHUNK_END: 0b10,
+  PARENT: 0b100,
+  ROOT: 0b1000,
+  KEYED_HASH: 0b10000,
+  DERIVE_KEY_CONTEXT: 0b100000,
+  DERIVE_KEY_MATERIAL: 0b1000000,
+} as const;
+
+// Default BLAKE3 IV, cloned from the shared BLAKE2s / SHA-256 IV basis.
+const B3_IV = /* @__PURE__ */ SHA256_IV.slice();
+
+// Seven 16-word rounds of BLAKE3 message schedule, generated by repeatedly
+// permuting the identity row.
+const B3_SIGMA: TRet<Uint8Array> = /* @__PURE__ */ (() => {
+  const Id = Array.from({ length: 16 }, (_, i) => i);
+  const permute = (arr: number[]) =>
+    [2, 6, 3, 10, 7, 0, 4, 13, 1, 11, 12, 5, 9, 14, 15, 8].map((i) => arr[i]);
+  const res: number[] = [];
+  for (let i = 0, v = Id; i < 7; i++, v = permute(v)) res.push(...v);
+  return Uint8Array.from(res);
+})();
+
+/**
+ * Ensure to use EITHER `key` OR `context`, not both.
+ *
+ * * `key`: 32-byte MAC key.
+ * * `context`: caller-encoded KDF context bytes. If your protocol defines a
+ *   string context, encode it before passing it here.
+ *   A good default format for the original context string is
+ *   "[application] [commit timestamp] [purpose]".
+ */
+export type Blake3Opts = {
+  /** Desired digest length in bytes. The BLAKE3 spec allows 0..2^64-1 bytes of output. */
+  dkLen?: number;
+  /** Optional 32-byte MAC key. */
+  key?: Uint8Array;
+  /** Optional KDF context bytes. */
+  context?: Uint8Array;
+};
+
+/** Blake3 hash. Can be used as MAC and KDF with caller-encoded context bytes. */
+export class _BLAKE3 extends _BLAKE2<_BLAKE3> implements HashXOF<_BLAKE3> {
+  readonly canXOF = true;
+  private chunkPos = 0; // Position of current block in chunk
+  // How many chunks we already have; exact while this stays within
+  // JS's safe-integer range.
+  private chunksDone = 0;
+  private flags = 0 | 0;
+  private IV: Uint32Array;
+  private state: Uint32Array;
+  private stack: Uint32Array[] = [];
+  // Output
+  private posOut = 0;
+  private bufferOut32 = new Uint32Array(16);
+  private bufferOut: Uint8Array;
+  // Index of output chunk; exact while this stays within JS's
+  // safe-integer range.
+  private chunkOut = 0;
+  private enableXOF = true;
+
+  constructor(opts: Blake3Opts = {}, flags = 0) {
+    super(64, opts.dkLen === undefined ? 32 : opts.dkLen);
+    const { key, context } = opts;
+    const hasContext = context !== undefined;
+    if (key !== undefined) {
+      if (hasContext) throw new Error('Only "key" or "context" can be specified at same time');
+      abytes(key, 32, 'key');
+      const k = copyBytes(key);
+      this.IV = u32(k);
+      swap32IfBE(this.IV);
+      this.flags = flags | B3_Flags.KEYED_HASH;
+    } else if (hasContext) {
+      abytes(context, undefined, 'context');
+      const ctx = context;
+      const contextKey = new _BLAKE3({ dkLen: 32 }, B3_Flags.DERIVE_KEY_CONTEXT)
+        .update(ctx)
+        .digest();
+      this.IV = u32(contextKey);
+      swap32IfBE(this.IV);
+      this.flags = flags | B3_Flags.DERIVE_KEY_MATERIAL;
+    } else {
+      this.IV = B3_IV.slice();
+      this.flags = flags;
+    }
+    this.state = this.IV.slice();
+    this.bufferOut = u8(this.bufferOut32);
+  }
+  // _BLAKE2's scalar-state hooks are unused here: BLAKE3 keeps its tree/XOF state in arrays and
+  // copies it directly in _cloneInto().
+  protected get(): [] {
+    return [];
+  }
+  protected set(): void {}
+  // Truncated chunk/parent compression: seed v8..v15 as IV[0..3], t0, t1,
+  // block length, and flags, then keep only the first 8 output words.
+  private b2Compress(counter: number, flags: number, buf: Uint32Array, bufPos: number = 0) {
+    const { state: s, pos } = this;
+    const { h, l } = fromBig(BigInt(counter), true);
+    // prettier-ignore
+    const { v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15 } =
+      compress(
+        B3_SIGMA, bufPos, buf, 7,
+        s[0], s[1], s[2], s[3], s[4], s[5], s[6], s[7],
+        B3_IV[0], B3_IV[1], B3_IV[2], B3_IV[3], h, l, pos, flags
+      );
+    s[0] = v0 ^ v8;
+    s[1] = v1 ^ v9;
+    s[2] = v2 ^ v10;
+    s[3] = v3 ^ v11;
+    s[4] = v4 ^ v12;
+    s[5] = v5 ^ v13;
+    s[6] = v6 ^ v14;
+    s[7] = v7 ^ v15;
+  }
+  protected compress(buf: Uint32Array, bufPos: number = 0, isLast: boolean = false): void {
+    // Compress last block
+    let flags = this.flags;
+    if (!this.chunkPos) flags |= B3_Flags.CHUNK_START;
+    if (this.chunkPos === 15 || isLast) flags |= B3_Flags.CHUNK_END;
+    if (!isLast) this.pos = this.blockLen;
+    this.b2Compress(this.chunksDone, flags, buf, bufPos);
+    this.chunkPos += 1;
+    // If current block is last in chunk (16 blocks), then compress chunks
+    if (this.chunkPos === 16 || isLast) {
+      let chunk = this.state;
+      this.state = this.IV.slice();
+      // If not the last one, compress only when there are trailing zeros in chunk counter
+      // Chunks are used as a binary tree where the current stack is the path.
+      // Zero means the current leaf is finished and can be compressed.
+      // 1 (001) - leaf not finished (just push current chunk to stack)
+      // 2 (010) - leaf finished at depth=1 (merge with last elm on stack and push back)
+      // 3 (011) - last leaf not finished
+      // 4 (100) - leafs finished at depth=1 and depth=2
+      for (let last, chunks = this.chunksDone + 1; isLast || !(chunks & 1); chunks >>= 1) {
+        if (!(last = this.stack.pop())) break;
+        this.buffer32.set(last, 0);
+        this.buffer32.set(chunk, 8);
+        this.pos = this.blockLen;
+        this.b2Compress(0, this.flags | B3_Flags.PARENT, this.buffer32, 0);
+        chunk = this.state;
+        this.state = this.IV.slice();
+      }
+      this.chunksDone++;
+      this.chunkPos = 0;
+      this.stack.push(chunk);
+    }
+    this.pos = 0;
+  }
+  _cloneInto(to?: _BLAKE3): _BLAKE3 {
+    to = super._cloneInto(to) as _BLAKE3;
+    const { IV, flags, state, chunkPos, posOut, chunkOut, stack, chunksDone } = this;
+    to.state.set(state.slice());
+    // Clone each CV stack entry by value so extending or destroying the clone
+    // cannot alias the source tree state.
+    to.stack = stack.map((i) => Uint32Array.from(i));
+    to.IV.set(IV);
+    to.flags = flags;
+    to.chunkPos = chunkPos;
+    to.chunksDone = chunksDone;
+    to.posOut = posOut;
+    to.chunkOut = chunkOut;
+    to.enableXOF = this.enableXOF;
+    to.bufferOut32.set(this.bufferOut32);
+    return to;
+  }
+  destroy(): void {
+    this.destroyed = true;
+    clean(this.state, this.buffer32, this.IV, this.bufferOut32);
+    clean(...this.stack);
+  }
+  // Root/XOF compression: rerun the same ROOT inputs with incrementing output
+  // counter `t` and materialize all 16 output words.
+  // Same as b2Compress, but doesn't modify state and returns 16 u32 array (instead of 8)
+  private b2CompressOut() {
+    const { state: s, pos, flags, buffer32, bufferOut32: out32 } = this;
+    const { h, l } = fromBig(BigInt(this.chunkOut++));
+    swap32IfBE(buffer32);
+    // prettier-ignore
+    const { v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15 } =
+      compress(
+        B3_SIGMA, 0, buffer32, 7,
+        s[0], s[1], s[2], s[3], s[4], s[5], s[6], s[7],
+        B3_IV[0], B3_IV[1], B3_IV[2], B3_IV[3], l, h, pos, flags
+      );
+    out32[0] = v0 ^ v8;
+    out32[1] = v1 ^ v9;
+    out32[2] = v2 ^ v10;
+    out32[3] = v3 ^ v11;
+    out32[4] = v4 ^ v12;
+    out32[5] = v5 ^ v13;
+    out32[6] = v6 ^ v14;
+    out32[7] = v7 ^ v15;
+    out32[8] = s[0] ^ v8;
+    out32[9] = s[1] ^ v9;
+    out32[10] = s[2] ^ v10;
+    out32[11] = s[3] ^ v11;
+    out32[12] = s[4] ^ v12;
+    out32[13] = s[5] ^ v13;
+    out32[14] = s[6] ^ v14;
+    out32[15] = s[7] ^ v15;
+    swap32IfBE(buffer32);
+    swap32IfBE(out32);
+    this.posOut = 0;
+  }
+  protected finish(): void {
+    if (this.finished) return;
+    this.finished = true;
+    // Padding
+    clean(this.buffer.subarray(this.pos));
+    // Process last chunk
+    let flags = this.flags | B3_Flags.ROOT;
+    if (this.stack.length) {
+      // Finalize the current chunk first, then rerun the last parent
+      // compression as ROOT with t = 0 and b = 64.
+      flags |= B3_Flags.PARENT;
+      swap32IfBE(this.buffer32);
+      this.compress(this.buffer32, 0, true);
+      swap32IfBE(this.buffer32);
+      this.chunksDone = 0;
+      this.pos = this.blockLen;
+    } else {
+      flags |= (!this.chunkPos ? B3_Flags.CHUNK_START : 0) | B3_Flags.CHUNK_END;
+    }
+    this.flags = flags;
+    this.b2CompressOut();
+  }
+  private writeInto(out: TArg<Uint8Array>): TRet<Uint8Array> {
+    aexists(this, false);
+    abytes(out);
+    this.finish();
+    const { blockLen, bufferOut } = this;
+    for (let pos = 0, len = out.length; pos < len; ) {
+      if (this.posOut >= blockLen) this.b2CompressOut();
+      const take = Math.min(blockLen - this.posOut, len - pos);
+      out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
+      this.posOut += take;
+      pos += take;
+    }
+    return out as TRet<Uint8Array>;
+  }
+  xofInto(out: TArg<Uint8Array>): TRet<Uint8Array> {
+    if (!this.enableXOF) throw new Error('XOF is not possible after digest call');
+    return this.writeInto(out);
+  }
+  xof(bytes: number): TRet<Uint8Array> {
+    anumber(bytes);
+    return this.xofInto(new Uint8Array(bytes));
+  }
+  digestInto(out: TArg<Uint8Array>): void {
+    aoutput(out, this);
+    if (this.finished) throw new Error('digest() was already called');
+    this.enableXOF = false;
+    // `aoutput(...)` allows oversized buffers; digestInto() must fill only the configured digest.
+    this.writeInto(out.subarray(0, this.outputLen));
+    this.destroy();
+  }
+  digest(): TRet<Uint8Array> {
+    const out = new Uint8Array(this.outputLen);
+    this.digestInto(out);
+    return out as TRet<Uint8Array>;
+  }
+}
+
+/**
+ * BLAKE3 hash function. Can be used as MAC and KDF.
+ * @param msg - message that would be hashed
+ * @param opts - Optional output, MAC, or KDF configuration. `key` must be
+ *   exactly 32 bytes, `context` is caller-encoded bytes, and `dkLen` can be
+ *   0..2^64-1 via the XOF-backed output path. See {@link Blake3Opts}.
+ * @returns Digest bytes.
+ * @example
+ * Hash, MAC, or derive key material with BLAKE3.
+ * ```ts
+ * import { blake3 } from '@noble/hashes/blake3.js';
+ * import { utf8ToBytes } from '@noble/hashes/utils.js';
+ * const data = new Uint8Array(32);
+ * const hash = blake3(data);
+ * const mac = blake3(data, { key: new Uint8Array(32) });
+ * const kdf = blake3(data, { context: utf8ToBytes('application name') });
+ * ```
+ */
+export const blake3: TRet<CHashXOF<_BLAKE3, Blake3Opts>> = /* @__PURE__ */ createHasher(
+  (opts = {}) => new _BLAKE3(opts)
+);

package/node_modules/@noble/hashes/src/eskdf.ts

@@ -0,0 +1,259 @@
+/**
+ * Experimental KDF for AES.
+ * @module
+ */
+import { hkdf } from './hkdf.ts';
+import { pbkdf2 as _pbkdf2 } from './pbkdf2.ts';
+import { scrypt as _scrypt } from './scrypt.ts';
+import { sha256 } from './sha2.ts';
+import {
+  abytes,
+  bytesToHex,
+  clean,
+  createView,
+  hexToBytes,
+  kdfInputToBytes,
+  type TArg,
+  type TRet,
+} from './utils.ts';
+
+// A tiny KDF for various applications like AES key-gen.
+// Uses HKDF in a non-standard way, so it's not "KDF-secure", only "PRF-secure".
+// Which is good enough: assume sha2-256 retained preimage resistance.
+
+// Fixed ESKDF scrypt work factor: interactive-latency target with about 512 MiB RAM per derivation.
+const SCRYPT_FACTOR = /* @__PURE__ */ (() => 2 ** 19)();
+// Fixed ESKDF PBKDF2 work factor: CPU-only companion branch in the same rough
+// interactive-latency range.
+const PBKDF2_FACTOR = /* @__PURE__ */ (() => 2 ** 17)();
+
+/**
+ * Scrypt KDF with the fixed ESKDF policy tuple `{ N: 2^19, r: 8, p: 1, dkLen: 32 }`.
+ * @param password - user password string, UTF-8 encoded before entering RFC 7914
+ * @param salt - unique salt string, UTF-8 encoded before entering RFC 7914
+ * @returns Derived 32-byte key.
+ * @example
+ * Derive the 32-byte scrypt key used by ESKDF.
+ * ```ts
+ * scrypt('password123', 'user@example.com');
+ * ```
+ */
+export function scrypt(password: string, salt: string): TRet<Uint8Array> {
+  return _scrypt(password, salt, { N: SCRYPT_FACTOR, r: 8, p: 1, dkLen: 32 });
+}
+
+/**
+ * PBKDF2-HMAC-SHA256 with the fixed ESKDF policy tuple `{ sha256, c: 2^17, dkLen: 32 }`.
+ * @param password - user password string, UTF-8 encoded before entering PBKDF2-HMAC-SHA-256
+ * @param salt - unique salt string, UTF-8 encoded before entering PBKDF2-HMAC-SHA-256
+ * @returns Derived 32-byte key.
+ * @example
+ * Derive the 32-byte PBKDF2 key used by ESKDF.
+ * ```ts
+ * pbkdf2('password123', 'user@example.com');
+ * ```
+ */
+export function pbkdf2(password: string, salt: string): TRet<Uint8Array> {
+  return _pbkdf2(sha256, password, salt, { c: PBKDF2_FACTOR, dkLen: 32 });
+}
+
+// Combines two 32-byte byte arrays into a fresh 32-byte result without aliasing either input.
+function xor32(a: TArg<Uint8Array>, b: TArg<Uint8Array>): TRet<Uint8Array> {
+  abytes(a, 32);
+  abytes(b, 32);
+  const arr = new Uint8Array(32);
+  for (let i = 0; i < 32; i++) {
+    arr[i] = a[i] ^ b[i];
+  }
+  return arr as TRet<Uint8Array>;
+}
+
+// All local string length checks are in JS UTF-16 code units, not UTF-8 bytes.
+function strHasLength(str: string, min: number, max: number): boolean {
+  return typeof str === 'string' && str.length >= min && str.length <= max;
+}
+
+/**
+ * Derives main seed. Takes a lot of time; prefer the higher-level `eskdf(...)`
+ * flow unless you specifically need the raw main seed.
+ * Derives the main seed by xor'ing two branches:
+ * the scrypt branch uses a `0x01` separator byte on username/password,
+ * and the PBKDF2 branch uses `0x02`.
+ * Username and password strings are encoded by the underlying KDFs after the
+ * local separator bytes are appended.
+ * @param username - account identifier used as public salt
+ * @param password - user password string
+ * @returns Main 32-byte seed for the account.
+ * @throws If the username or password length is invalid. {@link Error}
+ * @example
+ * Derive the main ESKDF seed from username and password.
+ * ```ts
+ * deriveMainSeed('example-user', 'example-password');
+ * ```
+ */
+export function deriveMainSeed(username: string, password: string): TRet<Uint8Array> {
+  if (!strHasLength(username, 8, 255)) throw new Error('invalid username');
+  if (!strHasLength(password, 8, 255)) throw new Error('invalid password');
+  // Keep the protocol separators as the literal bytes 0x01 / 0x02 even after minification.
+  // Embedding them as non-printable characters directly can be awkward across
+  // JS tooling and environments.
+  const codes = { _1: 1, _2: 2 };
+  const sep = { s: String.fromCharCode(codes._1), p: String.fromCharCode(codes._2) };
+  const scr = scrypt(password + sep.s, username + sep.s);
+  const pbk = pbkdf2(password + sep.p, username + sep.p);
+  const res = xor32(scr, pbk);
+  clean(scr, pbk);
+  return res;
+}
+
+type AccountID = number | string;
+
+/**
+ * Converts protocol & accountId pair to HKDF params:
+ * `info` is UTF-8 protocol bytes, numeric ids become 4-byte BE `salt`,
+ * and string ids become UTF-8 `salt` bytes.
+ */
+function getSaltInfo(protocol: string, accountId: AccountID = 0) {
+  // Note that length here also repeats two lines below
+  // We do an additional length check here to reduce the scope of DoS attacks
+  if (!(strHasLength(protocol, 3, 15) && /^[a-z0-9]{3,15}$/.test(protocol))) {
+    throw new Error('invalid protocol');
+  }
+
+  // Exact-match only: substring matches like `assh` / `mentor` must not widen the public whitelist.
+  const allowsStr = /^(password\d{0,3}|ssh|tor|file)$/.test(protocol);
+  let salt: Uint8Array; // Assigned below: either 4-byte BE account bytes or UTF-8 account bytes.
+  if (typeof accountId === 'string') {
+    if (!allowsStr) throw new Error('accountId must be a number');
+    if (!strHasLength(accountId, 1, 255))
+      throw new Error('accountId must be string of length 1..255');
+    salt = kdfInputToBytes(accountId);
+  } else if (Number.isSafeInteger(accountId)) {
+    if (accountId < 0 || accountId > Math.pow(2, 32) - 1) throw new Error('invalid accountId');
+    // Convert to Big Endian Uint32
+    salt = new Uint8Array(4);
+    createView(salt).setUint32(0, accountId, false);
+  } else {
+    throw new Error('accountId must be a number' + (allowsStr ? ' or string' : ''));
+  }
+  const info = kdfInputToBytes(protocol);
+  return { salt, info };
+}
+
+type OptsLength = { keyLength: number };
+type OptsMod = { modulus: bigint };
+type KeyOpts = undefined | OptsLength | OptsMod;
+
+// Local modulus-size helper, not a general bigint-byte-length primitive:
+// `<= 128n` is rejected by ESKDF policy.
+function countBytes(num: bigint): number {
+  if (typeof num !== 'bigint' || num <= BigInt(128)) throw new Error('invalid number');
+  return Math.ceil(num.toString(2).length / 8);
+}
+
+/**
+ * Parses keyLength and modulus options to extract length of result key.
+ * If modulus is used, adds 64 bits to it per the FIPS 186-5 Appendix A.3.1 /
+ * A.4.1 extra-bits guidance.
+ */
+function getKeyLength(options: KeyOpts): number {
+  if (!options || typeof options !== 'object') return 32;
+  const hasLen = 'keyLength' in options;
+  const hasMod = 'modulus' in options;
+  if (hasLen && hasMod) throw new Error('cannot combine keyLength and modulus options');
+  if (!hasLen && !hasMod) throw new Error('must have either keyLength or modulus option');
+  // FIPS 186-5 Appendix A.3.1 / A.4.1 calls for at least 64 extra bits.
+  const l = hasMod ? countBytes(options.modulus) + 8 : options.keyLength;
+  if (!(typeof l === 'number' && l >= 16 && l <= 8192)) throw new Error('invalid keyLength');
+  return l;
+}
+
+/**
+ * Converts key to bigint and divides it by modulus. Big Endian.
+ * Adapts FIPS 186-5 Appendix A.4.1: `getKeyLength()` already requested the
+ * extra 64-bit margin, and this step maps the result into `1..modulus-1`.
+ */
+function modReduceKey(key: TArg<Uint8Array>, modulus: bigint): TRet<Uint8Array> {
+  const _1 = BigInt(1);
+  const num = BigInt('0x' + bytesToHex(key)); // check for ui8a, then bytesToNumber()
+  const res = (num % (modulus - _1)) + _1; // Remove 0 from output
+  if (res < _1) throw new Error('expected positive number'); // Guard against bad values
+  // Strip the extra 64-bit margin that `getKeyLength()` requested
+  // for bias reduction.
+  const len = key.length - 8;
+  const hex = res.toString(16).padStart(len * 2, '0'); // numberToHex()
+  const bytes = hexToBytes(hex);
+  if (bytes.length !== len) throw new Error('invalid length of result key');
+  return bytes;
+}
+
+/** Not using classes because constructor cannot be async. */
+export interface ESKDF {
+  /**
+   * Derives a child key. Child key will not be associated with any
+   * other child key because of properties of underlying KDF.
+   *
+   * @param protocol - 3-15 character protocol name
+   * @param accountId - numeric account identifier, or a string id for
+   *   `password\d{0,3}`, `ssh`, `tor`, or `file`
+   * @param options - Optional child-key shaping parameters. See {@link KeyOpts}.
+   * @returns Derived child key bytes.
+   */
+  deriveChildKey: (protocol: string, accountId: AccountID, options?: KeyOpts) => TRet<Uint8Array>;
+  /** Deletes the main seed from the ESKDF instance. */
+  expire: () => void;
+  /**
+   * Human-readable fingerprint: first 6 bytes of
+   * `deriveChildKey('fingerprint', 0)`, formatted as uppercase
+   * colon-separated hex.
+   */
+  fingerprint: string;
+}
+
+/**
+ * ESKDF
+ * @param username - username, email, or identifier, min: 8 characters, should have enough entropy
+ * @param password - password, min: 8 characters, should have enough entropy
+ * @returns Frozen API that derives child keys and exposes the account fingerprint.
+ * @throws If the username or password length is invalid. {@link Error}
+ * @example
+ * Derive account-specific child keys from the main ESKDF seed.
+ * ```ts
+ * const kdf = await eskdf('example-university', 'beginning-new-example');
+ * const key = kdf.deriveChildKey('aes', 0);
+ * const fingerprint = kdf.fingerprint;
+ * kdf.expire();
+ * ```
+ */
+export async function eskdf(username: string, password: string): Promise<TRet<ESKDF>> {
+  // We are using closure + object instead of class because
+  // we want to make `seed` non-accessible for any external function.
+  let seed: Uint8Array | undefined = deriveMainSeed(username, password);
+
+  function deriveCK(
+    protocol: string,
+    accountId: AccountID = 0,
+    options?: KeyOpts
+  ): TRet<Uint8Array> {
+    // Reject expired instances before deriving any HKDF inputs from the closure-held seed.
+    abytes(seed!, 32);
+    const { salt, info } = getSaltInfo(protocol, accountId); // validate protocol & accountId
+    // Validate option shape and coarse length bounds;
+    // `hkdf()` still rejects non-integer lengths.
+    const keyLength = getKeyLength(options);
+    const key = hkdf(sha256, seed!, salt, info, keyLength);
+    // Modulus has already been validated
+    return options && 'modulus' in options ? modReduceKey(key, options.modulus) : key;
+  }
+  function expire() {
+    // Overwrite the closure-held seed before dropping the reference.
+    if (seed) seed.fill(1);
+    seed = undefined;
+  }
+  // prettier-ignore
+  const fingerprint = Array.from(deriveCK('fingerprint', 0))
+    .slice(0, 6)
+    .map((char) => char.toString(16).padStart(2, '0').toUpperCase())
+    .join(':');
+  return Object.freeze({ deriveChildKey: deriveCK, expire, fingerprint });
+}