@openclaw/nostr 2026.5.20-beta.2 → 2026.5.22

package/node_modules/@noble/hashes/src/sha3.ts

@@ -0,0 +1,295 @@
+/**
+ * SHA3 (keccak) hash function, based on a new "Sponge function" design.
+ * Different from older hashes, the internal state is bigger than output size.
+ *
+ * Check out [FIPS-202](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf),
+ * [Website](https://keccak.team/keccak.html),
+ * [the differences between SHA-3 and Keccak](https://crypto.stackexchange.com/questions/15727/what-are-the-key-differences-between-the-draft-sha-3-standard-and-the-keccak-sub).
+ *
+ * Check out `sha3-addons` module for cSHAKE, k12, and others.
+ * @module
+ */
+import { rotlBH, rotlBL, rotlSH, rotlSL, split } from './_u64.ts';
+// prettier-ignore
+import {
+  abytes, aexists, anumber, aoutput,
+  clean, createHasher,
+  oidNist,
+  swap32IfBE,
+  u32,
+  type CHash, type CHashXOF,
+  type Hash,
+  type HashInfo,
+  type HashXOF
+} from './utils.ts';
+
+// No __PURE__ annotations in sha3 header:
+// EVERYTHING is in fact used on every export.
+// Various per round constants calculations
+const _0n = BigInt(0);
+const _1n = BigInt(1);
+const _2n = BigInt(2);
+const _7n = BigInt(7);
+const _256n = BigInt(256);
+const _0x71n = BigInt(0x71);
+const SHA3_PI: number[] = [];
+const SHA3_ROTL: number[] = [];
+const _SHA3_IOTA: bigint[] = []; // no pure annotation: var is always used
+for (let round = 0, R = _1n, x = 1, y = 0; round < 24; round++) {
+  // Pi
+  [x, y] = [y, (2 * x + 3 * y) % 5];
+  SHA3_PI.push(2 * (5 * y + x));
+  // Rotational
+  SHA3_ROTL.push((((round + 1) * (round + 2)) / 2) % 64);
+  // Iota
+  let t = _0n;
+  for (let j = 0; j < 7; j++) {
+    R = ((R << _1n) ^ ((R >> _7n) * _0x71n)) % _256n;
+    if (R & _2n) t ^= _1n << ((_1n << BigInt(j)) - _1n);
+  }
+  _SHA3_IOTA.push(t);
+}
+const IOTAS = split(_SHA3_IOTA, true);
+const SHA3_IOTA_H = IOTAS[0];
+const SHA3_IOTA_L = IOTAS[1];
+
+// Left rotation (without 0, 32, 64)
+const rotlH = (h: number, l: number, s: number) => (s > 32 ? rotlBH(h, l, s) : rotlSH(h, l, s));
+const rotlL = (h: number, l: number, s: number) => (s > 32 ? rotlBL(h, l, s) : rotlSL(h, l, s));
+
+/** `keccakf1600` internal function, additionally allows to adjust round count. */
+export function keccakP(s: Uint32Array, rounds: number = 24): void {
+  const B = new Uint32Array(5 * 2);
+  // NOTE: all indices are x2 since we store state as u32 instead of u64 (bigints to slow in js)
+  for (let round = 24 - rounds; round < 24; round++) {
+    // Theta θ
+    for (let x = 0; x < 10; x++) B[x] = s[x] ^ s[x + 10] ^ s[x + 20] ^ s[x + 30] ^ s[x + 40];
+    for (let x = 0; x < 10; x += 2) {
+      const idx1 = (x + 8) % 10;
+      const idx0 = (x + 2) % 10;
+      const B0 = B[idx0];
+      const B1 = B[idx0 + 1];
+      const Th = rotlH(B0, B1, 1) ^ B[idx1];
+      const Tl = rotlL(B0, B1, 1) ^ B[idx1 + 1];
+      for (let y = 0; y < 50; y += 10) {
+        s[x + y] ^= Th;
+        s[x + y + 1] ^= Tl;
+      }
+    }
+    // Rho (ρ) and Pi (π)
+    let curH = s[2];
+    let curL = s[3];
+    for (let t = 0; t < 24; t++) {
+      const shift = SHA3_ROTL[t];
+      const Th = rotlH(curH, curL, shift);
+      const Tl = rotlL(curH, curL, shift);
+      const PI = SHA3_PI[t];
+      curH = s[PI];
+      curL = s[PI + 1];
+      s[PI] = Th;
+      s[PI + 1] = Tl;
+    }
+    // Chi (χ)
+    for (let y = 0; y < 50; y += 10) {
+      for (let x = 0; x < 10; x++) B[x] = s[y + x];
+      for (let x = 0; x < 10; x++) s[y + x] ^= ~B[(x + 2) % 10] & B[(x + 4) % 10];
+    }
+    // Iota (ι)
+    s[0] ^= SHA3_IOTA_H[round];
+    s[1] ^= SHA3_IOTA_L[round];
+  }
+  clean(B);
+}
+
+/** Keccak sponge function. */
+export class Keccak implements Hash<Keccak>, HashXOF<Keccak> {
+  protected state: Uint8Array;
+  protected pos = 0;
+  protected posOut = 0;
+  protected finished = false;
+  protected state32: Uint32Array;
+  protected destroyed = false;
+
+  public blockLen: number;
+  public suffix: number;
+  public outputLen: number;
+  protected enableXOF = false;
+  protected rounds: number;
+
+  // NOTE: we accept arguments in bytes instead of bits here.
+  constructor(
+    blockLen: number,
+    suffix: number,
+    outputLen: number,
+    enableXOF = false,
+    rounds: number = 24
+  ) {
+    this.blockLen = blockLen;
+    this.suffix = suffix;
+    this.outputLen = outputLen;
+    this.enableXOF = enableXOF;
+    this.rounds = rounds;
+    // Can be passed from user as dkLen
+    anumber(outputLen, 'outputLen');
+    // 1600 = 5x5 matrix of 64bit.  1600 bits === 200 bytes
+    // 0 < blockLen < 200
+    if (!(0 < blockLen && blockLen < 200))
+      throw new Error('only keccak-f1600 function is supported');
+    this.state = new Uint8Array(200);
+    this.state32 = u32(this.state);
+  }
+  clone(): Keccak {
+    return this._cloneInto();
+  }
+  protected keccak(): void {
+    swap32IfBE(this.state32);
+    keccakP(this.state32, this.rounds);
+    swap32IfBE(this.state32);
+    this.posOut = 0;
+    this.pos = 0;
+  }
+  update(data: Uint8Array): this {
+    aexists(this);
+    abytes(data);
+    const { blockLen, state } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      for (let i = 0; i < take; i++) state[this.pos++] ^= data[pos++];
+      if (this.pos === blockLen) this.keccak();
+    }
+    return this;
+  }
+  protected finish(): void {
+    if (this.finished) return;
+    this.finished = true;
+    const { state, suffix, pos, blockLen } = this;
+    // Do the padding
+    state[pos] ^= suffix;
+    if ((suffix & 0x80) !== 0 && pos === blockLen - 1) this.keccak();
+    state[blockLen - 1] ^= 0x80;
+    this.keccak();
+  }
+  protected writeInto(out: Uint8Array): Uint8Array {
+    aexists(this, false);
+    abytes(out);
+    this.finish();
+    const bufferOut = this.state;
+    const { blockLen } = this;
+    for (let pos = 0, len = out.length; pos < len; ) {
+      if (this.posOut >= blockLen) this.keccak();
+      const take = Math.min(blockLen - this.posOut, len - pos);
+      out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
+      this.posOut += take;
+      pos += take;
+    }
+    return out;
+  }
+  xofInto(out: Uint8Array): Uint8Array {
+    // Sha3/Keccak usage with XOF is probably mistake, only SHAKE instances can do XOF
+    if (!this.enableXOF) throw new Error('XOF is not possible for this instance');
+    return this.writeInto(out);
+  }
+  xof(bytes: number): Uint8Array {
+    anumber(bytes);
+    return this.xofInto(new Uint8Array(bytes));
+  }
+  digestInto(out: Uint8Array): Uint8Array {
+    aoutput(out, this);
+    if (this.finished) throw new Error('digest() was already called');
+    this.writeInto(out);
+    this.destroy();
+    return out;
+  }
+  digest(): Uint8Array {
+    return this.digestInto(new Uint8Array(this.outputLen));
+  }
+  destroy(): void {
+    this.destroyed = true;
+    clean(this.state);
+  }
+  _cloneInto(to?: Keccak): Keccak {
+    const { blockLen, suffix, outputLen, rounds, enableXOF } = this;
+    to ||= new Keccak(blockLen, suffix, outputLen, enableXOF, rounds);
+    to.state32.set(this.state32);
+    to.pos = this.pos;
+    to.posOut = this.posOut;
+    to.finished = this.finished;
+    to.rounds = rounds;
+    // Suffix can change in cSHAKE
+    to.suffix = suffix;
+    to.outputLen = outputLen;
+    to.enableXOF = enableXOF;
+    to.destroyed = this.destroyed;
+    return to;
+  }
+}
+
+const genKeccak = (suffix: number, blockLen: number, outputLen: number, info: HashInfo = {}) =>
+  createHasher(() => new Keccak(blockLen, suffix, outputLen), info);
+
+/** SHA3-224 hash function. */
+export const sha3_224: CHash = /* @__PURE__ */ genKeccak(
+  0x06,
+  144,
+  28,
+  /* @__PURE__ */ oidNist(0x07)
+);
+/** SHA3-256 hash function. Different from keccak-256. */
+export const sha3_256: CHash = /* @__PURE__ */ genKeccak(
+  0x06,
+  136,
+  32,
+  /* @__PURE__ */ oidNist(0x08)
+);
+/** SHA3-384 hash function. */
+export const sha3_384: CHash = /* @__PURE__ */ genKeccak(
+  0x06,
+  104,
+  48,
+  /* @__PURE__ */ oidNist(0x09)
+);
+/** SHA3-512 hash function. */
+export const sha3_512: CHash = /* @__PURE__ */ genKeccak(
+  0x06,
+  72,
+  64,
+  /* @__PURE__ */ oidNist(0x0a)
+);
+
+/** keccak-224 hash function. */
+export const keccak_224: CHash = /* @__PURE__ */ genKeccak(0x01, 144, 28);
+/** keccak-256 hash function. Different from SHA3-256. */
+export const keccak_256: CHash = /* @__PURE__ */ genKeccak(0x01, 136, 32);
+/** keccak-384 hash function. */
+export const keccak_384: CHash = /* @__PURE__ */ genKeccak(0x01, 104, 48);
+/** keccak-512 hash function. */
+export const keccak_512: CHash = /* @__PURE__ */ genKeccak(0x01, 72, 64);
+
+/** Options for SHAKE XOF. */
+export type ShakeOpts = { dkLen?: number };
+
+const genShake = (suffix: number, blockLen: number, outputLen: number, info: HashInfo = {}) =>
+  createHasher<Keccak, ShakeOpts>(
+    (opts: ShakeOpts = {}) =>
+      new Keccak(blockLen, suffix, opts.dkLen === undefined ? outputLen : opts.dkLen, true),
+    info
+  );
+
+/** SHAKE128 XOF with 128-bit security. */
+export const shake128: CHashXOF<Keccak, ShakeOpts> =
+  /* @__PURE__ */
+  genShake(0x1f, 168, 16, /* @__PURE__ */ oidNist(0x0b));
+/** SHAKE256 XOF with 256-bit security. */
+export const shake256: CHashXOF<Keccak, ShakeOpts> =
+  /* @__PURE__ */
+  genShake(0x1f, 136, 32, /* @__PURE__ */ oidNist(0x0c));
+
+/** SHAKE128 XOF with 256-bit output (NIST version). */
+export const shake128_32: CHashXOF<Keccak, ShakeOpts> =
+  /* @__PURE__ */
+  genShake(0x1f, 168, 32, /* @__PURE__ */ oidNist(0x0b));
+/** SHAKE256 XOF with 512-bit output (NIST version). */
+export const shake256_64: CHashXOF<Keccak, ShakeOpts> =
+  /* @__PURE__ */
+  genShake(0x1f, 136, 64, /* @__PURE__ */ oidNist(0x0c));

package/node_modules/@noble/hashes/src/utils.ts

@@ -0,0 +1,338 @@
+/**
+ * Utilities for hex, bytes, CSPRNG.
+ * @module
+ */
+/*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+/** Checks if something is Uint8Array. Be careful: nodejs Buffer will return true. */
+export function isBytes(a: unknown): a is Uint8Array {
+  return a instanceof Uint8Array || (ArrayBuffer.isView(a) && a.constructor.name === 'Uint8Array');
+}
+
+/** Asserts something is positive integer. */
+export function anumber(n: number, title: string = ''): void {
+  if (!Number.isSafeInteger(n) || n < 0) {
+    const prefix = title && `"${title}" `;
+    throw new Error(`${prefix}expected integer >= 0, got ${n}`);
+  }
+}
+
+/** Asserts something is Uint8Array. */
+export function abytes(value: Uint8Array, length?: number, title: string = ''): Uint8Array {
+  const bytes = isBytes(value);
+  const len = value?.length;
+  const needsLen = length !== undefined;
+  if (!bytes || (needsLen && len !== length)) {
+    const prefix = title && `"${title}" `;
+    const ofLen = needsLen ? ` of length ${length}` : '';
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    throw new Error(prefix + 'expected Uint8Array' + ofLen + ', got ' + got);
+  }
+  return value;
+}
+
+/** Asserts something is hash */
+export function ahash(h: CHash): void {
+  if (typeof h !== 'function' || typeof h.create !== 'function')
+    throw new Error('Hash must wrapped by utils.createHasher');
+  anumber(h.outputLen);
+  anumber(h.blockLen);
+}
+
+/** Asserts a hash instance has not been destroyed / finished */
+export function aexists(instance: any, checkFinished = true): void {
+  if (instance.destroyed) throw new Error('Hash instance has been destroyed');
+  if (checkFinished && instance.finished) throw new Error('Hash#digest() has already been called');
+}
+
+/** Asserts output is properly-sized byte array */
+export function aoutput(out: any, instance: any): void {
+  abytes(out, undefined, 'digestInto() output');
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new Error('"digestInto() output" expected to be of length >=' + min);
+  }
+}
+
+/** Generic type encompassing 8/16/32-byte arrays - but not 64-byte. */
+// prettier-ignore
+export type TypedArray = Int8Array | Uint8ClampedArray | Uint8Array |
+  Uint16Array | Int16Array | Uint32Array | Int32Array;
+
+/** Cast u8 / u16 / u32 to u8. */
+export function u8(arr: TypedArray): Uint8Array {
+  return new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+
+/** Cast u8 / u16 / u32 to u32. */
+export function u32(arr: TypedArray): Uint32Array {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+
+/** Zeroize a byte array. Warning: JS provides no guarantees. */
+export function clean(...arrays: TypedArray[]): void {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+
+/** Create DataView of an array for easy byte-level manipulation. */
+export function createView(arr: TypedArray): DataView {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+
+/** The rotate right (circular right shift) operation for uint32 */
+export function rotr(word: number, shift: number): number {
+  return (word << (32 - shift)) | (word >>> shift);
+}
+
+/** The rotate left (circular left shift) operation for uint32 */
+export function rotl(word: number, shift: number): number {
+  return (word << shift) | ((word >>> (32 - shift)) >>> 0);
+}
+
+/** Is current platform little-endian? Most are. Big-Endian platform: IBM */
+export const isLE: boolean = /* @__PURE__ */ (() =>
+  new Uint8Array(new Uint32Array([0x11223344]).buffer)[0] === 0x44)();
+
+/** The byte swap operation for uint32 */
+export function byteSwap(word: number): number {
+  return (
+    ((word << 24) & 0xff000000) |
+    ((word << 8) & 0xff0000) |
+    ((word >>> 8) & 0xff00) |
+    ((word >>> 24) & 0xff)
+  );
+}
+/** Conditionally byte swap if on a big-endian platform */
+export const swap8IfBE: (n: number) => number = isLE
+  ? (n: number) => n
+  : (n: number) => byteSwap(n);
+
+/** In place byte swap for Uint32Array */
+export function byteSwap32(arr: Uint32Array): Uint32Array {
+  for (let i = 0; i < arr.length; i++) {
+    arr[i] = byteSwap(arr[i]);
+  }
+  return arr;
+}
+
+export const swap32IfBE: (u: Uint32Array) => Uint32Array = isLE
+  ? (u: Uint32Array) => u
+  : byteSwap32;
+
+// Built-in hex conversion https://caniuse.com/mdn-javascript_builtins_uint8array_fromhex
+const hasHexBuiltin: boolean = /* @__PURE__ */ (() =>
+  // @ts-ignore
+  typeof Uint8Array.from([]).toHex === 'function' && typeof Uint8Array.fromHex === 'function')();
+
+// Array where index 0xf0 (240) is mapped to string 'f0'
+const hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) =>
+  i.toString(16).padStart(2, '0')
+);
+
+/**
+ * Convert byte array to hex string. Uses built-in function, when available.
+ * @example bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])) // 'cafe0123'
+ */
+export function bytesToHex(bytes: Uint8Array): string {
+  abytes(bytes);
+  // @ts-ignore
+  if (hasHexBuiltin) return bytes.toHex();
+  // pre-caching improves the speed 6x
+  let hex = '';
+  for (let i = 0; i < bytes.length; i++) {
+    hex += hexes[bytes[i]];
+  }
+  return hex;
+}
+
+// We use optimized technique to convert hex string to byte array
+const asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 } as const;
+function asciiToBase16(ch: number): number | undefined {
+  if (ch >= asciis._0 && ch <= asciis._9) return ch - asciis._0; // '2' => 50-48
+  if (ch >= asciis.A && ch <= asciis.F) return ch - (asciis.A - 10); // 'B' => 66-(65-10)
+  if (ch >= asciis.a && ch <= asciis.f) return ch - (asciis.a - 10); // 'b' => 98-(97-10)
+  return;
+}
+
+/**
+ * Convert hex string to byte array. Uses built-in function, when available.
+ * @example hexToBytes('cafe0123') // Uint8Array.from([0xca, 0xfe, 0x01, 0x23])
+ */
+export function hexToBytes(hex: string): Uint8Array {
+  if (typeof hex !== 'string') throw new Error('hex string expected, got ' + typeof hex);
+  // @ts-ignore
+  if (hasHexBuiltin) return Uint8Array.fromHex(hex);
+  const hl = hex.length;
+  const al = hl / 2;
+  if (hl % 2) throw new Error('hex string expected, got unpadded hex of length ' + hl);
+  const array = new Uint8Array(al);
+  for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
+    const n1 = asciiToBase16(hex.charCodeAt(hi));
+    const n2 = asciiToBase16(hex.charCodeAt(hi + 1));
+    if (n1 === undefined || n2 === undefined) {
+      const char = hex[hi] + hex[hi + 1];
+      throw new Error('hex string expected, got non-hex character "' + char + '" at index ' + hi);
+    }
+    array[ai] = n1 * 16 + n2; // multiply first octet, e.g. 'a3' => 10*16+3 => 160 + 3 => 163
+  }
+  return array;
+}
+
+/**
+ * There is no setImmediate in browser and setTimeout is slow.
+ * Call of async fn will return Promise, which will be fullfiled only on
+ * next scheduler queue processing step and this is exactly what we need.
+ */
+export const nextTick = async (): Promise<void> => {};
+
+/** Returns control to thread each 'tick' ms to avoid blocking. */
+export async function asyncLoop(
+  iters: number,
+  tick: number,
+  cb: (i: number) => void
+): Promise<void> {
+  let ts = Date.now();
+  for (let i = 0; i < iters; i++) {
+    cb(i);
+    // Date.now() is not monotonic, so in case if clock goes backwards we return return control too
+    const diff = Date.now() - ts;
+    if (diff >= 0 && diff < tick) continue;
+    await nextTick();
+    ts += diff;
+  }
+}
+
+// Global symbols, but ts doesn't see them: https://github.com/microsoft/TypeScript/issues/31535
+declare const TextEncoder: any;
+
+/**
+ * Converts string to bytes using UTF8 encoding.
+ * Built-in doesn't validate input to be string: we do the check.
+ * @example utf8ToBytes('abc') // Uint8Array.from([97, 98, 99])
+ */
+export function utf8ToBytes(str: string): Uint8Array {
+  if (typeof str !== 'string') throw new Error('string expected');
+  return new Uint8Array(new TextEncoder().encode(str)); // https://bugzil.la/1681809
+}
+
+/** KDFs can accept string or Uint8Array for user convenience. */
+export type KDFInput = string | Uint8Array;
+
+/**
+ * Helper for KDFs: consumes uint8array or string.
+ * When string is passed, does utf8 decoding, using TextDecoder.
+ */
+export function kdfInputToBytes(data: KDFInput, errorTitle = ''): Uint8Array {
+  if (typeof data === 'string') return utf8ToBytes(data);
+  return abytes(data, undefined, errorTitle);
+}
+
+/** Copies several Uint8Arrays into one. */
+export function concatBytes(...arrays: Uint8Array[]): Uint8Array {
+  let sum = 0;
+  for (let i = 0; i < arrays.length; i++) {
+    const a = arrays[i];
+    abytes(a);
+    sum += a.length;
+  }
+  const res = new Uint8Array(sum);
+  for (let i = 0, pad = 0; i < arrays.length; i++) {
+    const a = arrays[i];
+    res.set(a, pad);
+    pad += a.length;
+  }
+  return res;
+}
+
+type EmptyObj = {};
+/** Merges default options and passed options. */
+export function checkOpts<T1 extends EmptyObj, T2 extends EmptyObj>(
+  defaults: T1,
+  opts?: T2
+): T1 & T2 {
+  if (opts !== undefined && {}.toString.call(opts) !== '[object Object]')
+    throw new Error('options must be object or undefined');
+  const merged = Object.assign(defaults, opts);
+  return merged as T1 & T2;
+}
+
+/** Common interface for all hashes. */
+export interface Hash<T> {
+  blockLen: number; // Bytes per block
+  outputLen: number; // Bytes in output
+  update(buf: Uint8Array): this;
+  digestInto(buf: Uint8Array): void;
+  digest(): Uint8Array;
+  destroy(): void;
+  _cloneInto(to?: T): T;
+  clone(): T;
+}
+
+/** PseudoRandom (number) Generator */
+export interface PRG {
+  addEntropy(seed: Uint8Array): void;
+  randomBytes(length: number): Uint8Array;
+  clean(): void;
+}
+
+/**
+ * XOF: streaming API to read digest in chunks.
+ * Same as 'squeeze' in keccak/k12 and 'seek' in blake3, but more generic name.
+ * When hash used in XOF mode it is up to user to call '.destroy' afterwards, since we cannot
+ * destroy state, next call can require more bytes.
+ */
+export type HashXOF<T extends Hash<T>> = Hash<T> & {
+  xof(bytes: number): Uint8Array; // Read 'bytes' bytes from digest stream
+  xofInto(buf: Uint8Array): Uint8Array; // read buf.length bytes from digest stream into buf
+};
+
+/** Hash constructor */
+export type HasherCons<T, Opts = undefined> = Opts extends undefined ? () => T : (opts?: Opts) => T;
+/** Optional hash params. */
+export type HashInfo = {
+  oid?: Uint8Array; // DER encoded OID in bytes
+};
+/** Hash function */
+export type CHash<T extends Hash<T> = Hash<any>, Opts = undefined> = {
+  outputLen: number;
+  blockLen: number;
+} & HashInfo &
+  (Opts extends undefined
+    ? {
+        (msg: Uint8Array): Uint8Array;
+        create(): T;
+      }
+    : {
+        (msg: Uint8Array, opts?: Opts): Uint8Array;
+        create(opts?: Opts): T;
+      });
+/** XOF with output */
+export type CHashXOF<T extends HashXOF<T> = HashXOF<any>, Opts = undefined> = CHash<T, Opts>;
+
+/** Creates function with outputLen, blockLen, create properties from a class constructor. */
+export function createHasher<T extends Hash<T>, Opts = undefined>(
+  hashCons: HasherCons<T, Opts>,
+  info: HashInfo = {}
+): CHash<T, Opts> {
+  const hashC: any = (msg: Uint8Array, opts?: Opts) => hashCons(opts).update(msg).digest();
+  const tmp = hashCons(undefined);
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.create = (opts?: Opts) => hashCons(opts);
+  Object.assign(hashC, info);
+  return Object.freeze(hashC);
+}
+
+/** Cryptographically secure PRNG. Uses internal OS-level `crypto.getRandomValues`. */
+export function randomBytes(bytesLength = 32): Uint8Array {
+  const cr = typeof globalThis === 'object' ? (globalThis as any).crypto : null;
+  if (typeof cr?.getRandomValues !== 'function')
+    throw new Error('crypto.getRandomValues must be defined');
+  return cr.getRandomValues(new Uint8Array(bytesLength));
+}
+
+/** Creates OID opts for NIST hashes, with prefix 06 09 60 86 48 01 65 03 04 02. */
+export const oidNist = (suffix: number): Required<HashInfo> => ({
+  oid: Uint8Array.from([0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, suffix]),
+});