toolcraft 0.0.749 → 0.0.750

package/node_modules/@noble/hashes/blake3.js

@@ -0,0 +1,310 @@
+/**
+ * Blake3 fast hash is Blake2 with reduced security (round count). Can also be used as MAC & KDF.
+ *
+ * It is advertised as "the fastest cryptographic hash". However, it isn't true in JS.
+ * Why is this so slow? While it must be 6x faster than blake2b, perf diff is only 20%:
+ *
+ * * There is only 30% reduction in number of rounds from blake2s
+ * * Speed-up comes from tree structure, which is parallelized using SIMD & threading.
+ *   These features are not present in JS, so we only get overhead from trees.
+ * * Parallelization only happens on 1024-byte chunks: there is no benefit for small inputs.
+ * * It is still possible to make it faster using: a) loop unrolling b) web workers c) wasm
+ * @module
+ */
+import { SHA256_IV } from "./_md.js";
+import { fromNumH, fromNumL } from "./_u64.js";
+import { _BLAKE2, _compress } from "./blake2.js";
+// prettier-ignore
+import { abytes, aexists, anumber, aoutput, checkOpts, clean, copyBytes, createHasher, swap32IfBE, u32, u8 } from "./utils.js";
+// Constructor-time mode flags (`KEYED_HASH`, `DERIVE_*`) plus per-node tree
+// flags (`CHUNK_*`, `PARENT`, `ROOT`).
+const B3_Flags = {
+    CHUNK_START: 0b1,
+    CHUNK_END: 0b10,
+    PARENT: 0b100,
+    ROOT: 0b1000,
+    KEYED_HASH: 0b10000,
+    DERIVE_KEY_CONTEXT: 0b100000,
+    DERIVE_KEY_MATERIAL: 0b1000000,
+};
+// Default BLAKE3 IV, cloned from the shared BLAKE2s / SHA-256 IV basis.
+const B3_IV = /* @__PURE__ */ SHA256_IV.slice();
+// Seven 16-word rounds of BLAKE3 message schedule, generated by repeatedly
+// permuting the identity row.
+const B3_SIGMA = /* @__PURE__ */ (() => {
+    const Id = Array.from({ length: 16 }, (_, i) => i);
+    const permute = (arr) => [2, 6, 3, 10, 7, 0, 4, 13, 1, 11, 12, 5, 9, 14, 15, 8].map((i) => arr[i]);
+    const res = [];
+    for (let i = 0, v = Id; i < 7; i++, v = permute(v))
+        res.push(...v);
+    return Uint8Array.from(res);
+})();
+/** Blake3 hash. Can be used as MAC and KDF with caller-encoded context bytes. */
+export class _BLAKE3 extends _BLAKE2 {
+    canXOF = true;
+    chunkPos = 0; // Position of current block in chunk
+    // How many chunks we already have; exact while this stays within
+    // JS's safe-integer range.
+    chunksDone = 0;
+    flags = 0 | 0;
+    IV;
+    state;
+    stack = [];
+    // Output
+    posOut = 0;
+    bufferOut32 = new Uint32Array(16);
+    bufferOut;
+    // Index of output chunk; exact while this stays within JS's
+    // safe-integer range.
+    chunkOut = 0;
+    enableXOF = true;
+    constructor(opts = {}, flags = 0) {
+        opts = checkOpts({}, opts);
+        super(64, opts.dkLen === undefined ? 32 : opts.dkLen);
+        const { key, context } = opts;
+        const hasContext = context !== undefined;
+        if (key !== undefined) {
+            if (hasContext)
+                throw new Error('cannot use both "key" and "context"');
+            abytes(key, 32, 'key');
+            const k = copyBytes(key);
+            this.IV = u32(k);
+            swap32IfBE(this.IV);
+            this.flags = flags | B3_Flags.KEYED_HASH;
+        }
+        else if (hasContext) {
+            abytes(context, undefined, 'context');
+            const ctx = context;
+            const contextKey = new _BLAKE3({ dkLen: 32 }, B3_Flags.DERIVE_KEY_CONTEXT)
+                .update(ctx)
+                .digest();
+            this.IV = u32(contextKey);
+            swap32IfBE(this.IV);
+            this.flags = flags | B3_Flags.DERIVE_KEY_MATERIAL;
+        }
+        else {
+            this.IV = B3_IV; // Share the module-private immutable default IV.
+            this.flags = flags;
+        }
+        this.state = this.IV.slice();
+        this.bufferOut = u8(this.bufferOut32);
+    }
+    // _BLAKE2's scalar-state hooks are unused here: BLAKE3 keeps its tree/XOF state in arrays and
+    // copies it directly in _cloneInto().
+    get() {
+        return [];
+    }
+    set() { }
+    // Truncated chunk/parent compression: seed v8..v15 as IV[0..3], t0, t1,
+    // block length, and flags, then keep only the first 8 output words.
+    b2Compress(counter, flags, buf, bufPos = 0) {
+        const { state: s, pos } = this;
+        const t0 = fromNumL(counter);
+        const t1 = fromNumH(counter);
+        // prettier-ignore
+        const { v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15 } = _compress(B3_SIGMA, bufPos, buf, 7, s[0], s[1], s[2], s[3], s[4], s[5], s[6], s[7], B3_IV[0], B3_IV[1], B3_IV[2], B3_IV[3], t0, t1, pos, flags);
+        s[0] = v0 ^ v8;
+        s[1] = v1 ^ v9;
+        s[2] = v2 ^ v10;
+        s[3] = v3 ^ v11;
+        s[4] = v4 ^ v12;
+        s[5] = v5 ^ v13;
+        s[6] = v6 ^ v14;
+        s[7] = v7 ^ v15;
+    }
+    compress(buf, bufPos = 0, isLast = false) {
+        // Compress last block
+        let flags = this.flags;
+        if (!this.chunkPos)
+            flags |= B3_Flags.CHUNK_START;
+        if (this.chunkPos === 15 || isLast)
+            flags |= B3_Flags.CHUNK_END;
+        if (!isLast)
+            this.pos = this.blockLen;
+        this.b2Compress(this.chunksDone, flags, buf, bufPos);
+        this.chunkPos += 1;
+        // If current block is last in chunk (16 blocks), then compress chunks
+        if (this.chunkPos === 16 || isLast) {
+            let chunk = this.state;
+            this.state = this.IV.slice();
+            // If not the last one, compress only when there are trailing zeros in chunk counter
+            // Chunks are used as a binary tree where the current stack is the path.
+            // Zero means the current leaf is finished and can be compressed.
+            // 1 (001) - leaf not finished (just push current chunk to stack)
+            // 2 (010) - leaf finished at depth=1 (merge with last elm on stack and push back)
+            // 3 (011) - last leaf not finished
+            // 4 (100) - leafs finished at depth=1 and depth=2
+            // Reading the low bit is safe for parity, but keep division full-width: shifting would
+            // truncate the safe-integer chunk counter to 32 bits.
+            for (let last, chunks = this.chunksDone + 1; isLast || !(chunks & 1); chunks = Math.floor(chunks / 2)) {
+                if (!(last = this.stack.pop()))
+                    break;
+                this.buffer32.set(last, 0);
+                this.buffer32.set(chunk, 8);
+                this.pos = this.blockLen;
+                this.b2Compress(0, this.flags | B3_Flags.PARENT, this.buffer32, 0);
+                chunk = this.state;
+                this.state = this.IV.slice();
+            }
+            this.chunksDone++;
+            this.chunkPos = 0;
+            this.stack.push(chunk);
+        }
+        this.pos = 0;
+    }
+    // Overriding hides _BLAKE2's flat implementation, which would otherwise be inherited
+    // and silently miss the tree state (CV stack, chunk counters; get()/set() are stubs here).
+    _cloneInto(to) {
+        const staleOutput = !!to && to.finished && !to.destroyed; // Save before super copies lifecycle.
+        to = super._cloneInto(to);
+        const { IV, flags, state, chunkPos, posOut, chunkOut, stack, chunksDone } = this;
+        to.state.set(state);
+        // Clone each CV stack entry by value so extending or destroying the clone
+        // cannot alias the source tree state.
+        to.stack = stack.map((i) => Uint32Array.from(i));
+        if (IV === B3_IV) {
+            if (to.IV !== B3_IV)
+                clean(to.IV);
+            to.IV = B3_IV; // Share immutable default; configured IVs stay private.
+        }
+        else if (to.IV === B3_IV) {
+            to.IV = IV.slice();
+        }
+        else {
+            to.IV.set(IV);
+        }
+        to.flags = flags;
+        to.chunkPos = chunkPos;
+        to.chunksDone = chunksDone;
+        to.posOut = posOut;
+        to.chunkOut = chunkOut;
+        to.enableXOF = this.enableXOF;
+        if (this.finished) {
+            to.bufferOut32.set(this.bufferOut32);
+        }
+        else if (staleOutput) {
+            clean(to.bufferOut32); // Wipe stale output; finish() overwrites scratch.
+        }
+        return to;
+    }
+    destroy() {
+        this.destroyed = true;
+        clean(this.state, this.buffer32, this.bufferOut32);
+        if (this.IV !== B3_IV)
+            clean(this.IV);
+        clean(...this.stack);
+    }
+    // Root/XOF compression: rerun the same ROOT inputs with incrementing output
+    // counter `t` and materialize all 16 output words.
+    // Same as b2Compress, but doesn't modify state and returns 16 u32 array (instead of 8)
+    b2CompressOut() {
+        const { state: s, pos, flags, buffer32, bufferOut32: out32 } = this;
+        const outCounter = this.chunkOut++;
+        const t0 = fromNumL(outCounter);
+        const t1 = fromNumH(outCounter);
+        swap32IfBE(buffer32);
+        // prettier-ignore
+        const { v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15 } = _compress(B3_SIGMA, 0, buffer32, 7, s[0], s[1], s[2], s[3], s[4], s[5], s[6], s[7], B3_IV[0], B3_IV[1], B3_IV[2], B3_IV[3], t0, t1, pos, flags);
+        out32[0] = v0 ^ v8;
+        out32[1] = v1 ^ v9;
+        out32[2] = v2 ^ v10;
+        out32[3] = v3 ^ v11;
+        out32[4] = v4 ^ v12;
+        out32[5] = v5 ^ v13;
+        out32[6] = v6 ^ v14;
+        out32[7] = v7 ^ v15;
+        out32[8] = s[0] ^ v8;
+        out32[9] = s[1] ^ v9;
+        out32[10] = s[2] ^ v10;
+        out32[11] = s[3] ^ v11;
+        out32[12] = s[4] ^ v12;
+        out32[13] = s[5] ^ v13;
+        out32[14] = s[6] ^ v14;
+        out32[15] = s[7] ^ v15;
+        swap32IfBE(buffer32);
+        swap32IfBE(out32);
+        this.posOut = 0;
+    }
+    finish() {
+        if (this.finished)
+            return;
+        this.finished = true;
+        // Padding
+        this.buffer.fill(0, this.pos);
+        // Process last chunk
+        let flags = this.flags | B3_Flags.ROOT;
+        if (this.stack.length) {
+            // Finalize the current chunk first, then rerun the last parent
+            // compression as ROOT with t = 0 and b = 64.
+            flags |= B3_Flags.PARENT;
+            swap32IfBE(this.buffer32);
+            this.compress(this.buffer32, 0, true);
+            swap32IfBE(this.buffer32);
+            this.chunksDone = 0;
+            this.pos = this.blockLen;
+        }
+        else {
+            flags |= (!this.chunkPos ? B3_Flags.CHUNK_START : 0) | B3_Flags.CHUNK_END;
+        }
+        this.flags = flags;
+        this.b2CompressOut();
+    }
+    writeInto(out) {
+        aexists(this, false);
+        abytes(out);
+        this.finish();
+        const { blockLen, bufferOut } = this;
+        for (let pos = 0, len = out.length; pos < len;) {
+            if (this.posOut >= blockLen)
+                this.b2CompressOut();
+            const take = Math.min(blockLen - this.posOut, len - pos);
+            out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
+            this.posOut += take;
+            pos += take;
+        }
+        return out;
+    }
+    xofInto(out) {
+        if (!this.enableXOF)
+            throw new Error('no XOF after digest()');
+        return this.writeInto(out);
+    }
+    xof(bytes) {
+        anumber(bytes);
+        return this.xofInto(new Uint8Array(bytes));
+    }
+    digestInto(out) {
+        aoutput(out, this);
+        if (this.finished)
+            throw new Error('digest() was already called');
+        this.enableXOF = false;
+        // `aoutput(...)` allows oversized buffers; digestInto() must fill only the configured digest.
+        this.writeInto(out.length === this.outputLen ? out : out.subarray(0, this.outputLen));
+        this.destroy();
+    }
+    digest() {
+        const out = new Uint8Array(this.outputLen);
+        this.digestInto(out);
+        return out;
+    }
+}
+/**
+ * BLAKE3 hash function. Can be used as MAC and KDF.
+ * @param msg - message that would be hashed
+ * @param opts - Optional output, MAC, or KDF configuration. `key` must be
+ *   exactly 32 bytes, `context` is caller-encoded bytes, and `dkLen` can be
+ *   0..2^64-1 via the XOF-backed output path. See {@link Blake3Opts}.
+ * @returns Digest bytes.
+ * @example
+ * Hash, MAC, or derive key material with BLAKE3.
+ * ```ts
+ * import { blake3 } from '@noble/hashes/blake3.js';
+ * import { utf8ToBytes } from '@noble/hashes/utils.js';
+ * const data = new Uint8Array(32);
+ * const hash = blake3(data);
+ * const mac = blake3(data, { key: new Uint8Array(32) });
+ * const kdf = blake3(data, { context: utf8ToBytes('application name') });
+ * const xof = blake3(data, { dkLen: 64 });
+ * ```
+ */
+export const blake3 = /* @__PURE__ */ createHasher((opts = {}) => new _BLAKE3(opts));

package/node_modules/@noble/hashes/eskdf.d.ts

@@ -0,0 +1,91 @@
+import { type TRet } from './utils.ts';
+/**
+ * Scrypt KDF with the fixed ESKDF policy tuple `{ N: 2^19, r: 8, p: 1, dkLen: 32 }`.
+ * @param password - user password string, UTF-8 encoded before entering RFC 7914
+ * @param salt - unique salt string, UTF-8 encoded before entering RFC 7914
+ * @returns Derived 32-byte key.
+ * @example
+ * Derive the 32-byte scrypt key used by ESKDF.
+ * ```ts
+ * scrypt('password123', 'user@example.com');
+ * ```
+ */
+export declare function scrypt(password: string, salt: string): TRet<Uint8Array>;
+/**
+ * PBKDF2-HMAC-SHA256 with the fixed ESKDF policy tuple `{ sha256, c: 2^17, dkLen: 32 }`.
+ * @param password - user password string, UTF-8 encoded before entering PBKDF2-HMAC-SHA-256
+ * @param salt - unique salt string, UTF-8 encoded before entering PBKDF2-HMAC-SHA-256
+ * @returns Derived 32-byte key.
+ * @example
+ * Derive the 32-byte PBKDF2 key used by ESKDF.
+ * ```ts
+ * pbkdf2('password123', 'user@example.com');
+ * ```
+ */
+export declare function pbkdf2(password: string, salt: string): TRet<Uint8Array>;
+/**
+ * Derives main seed. Takes a lot of time; prefer the higher-level `eskdf(...)`
+ * flow unless you specifically need the raw main seed.
+ * Derives the main seed by xor'ing two branches:
+ * the scrypt branch uses a `0x01` separator byte on username/password,
+ * and the PBKDF2 branch uses `0x02`.
+ * Username and password strings are encoded by the underlying KDFs after the
+ * local separator bytes are appended.
+ * @param username - account identifier used as public salt
+ * @param password - user password string
+ * @returns Main 32-byte seed for the account.
+ * @throws If the username or password length is invalid. {@link Error}
+ * @example
+ * Derive the main ESKDF seed from username and password.
+ * ```ts
+ * deriveMainSeed('example-user', 'example-password');
+ * ```
+ */
+export declare function deriveMainSeed(username: string, password: string): TRet<Uint8Array>;
+type AccountID = number | string;
+type OptsLength = {
+    keyLength: number;
+};
+type OptsMod = {
+    modulus: bigint;
+};
+type KeyOpts = undefined | OptsLength | OptsMod;
+/** Not using classes because constructor cannot be async. */
+export interface ESKDF {
+    /**
+     * Derives a child key. Child key will not be associated with any
+     * other child key because of properties of underlying KDF.
+     *
+     * @param protocol - 3-15 character protocol name
+     * @param accountId - numeric account identifier, or a string id for
+     *   `password\d{0,3}`, `ssh`, `tor`, or `file`
+     * @param options - Optional child-key shaping parameters. See {@link KeyOpts}.
+     * @returns Derived child key bytes.
+     */
+    deriveChildKey: (protocol: string, accountId: AccountID, options?: KeyOpts) => TRet<Uint8Array>;
+    /** Deletes the main seed from the ESKDF instance. */
+    expire: () => void;
+    /**
+     * Human-readable fingerprint: first 6 bytes of
+     * `deriveChildKey('fingerprint', 0)`, formatted as uppercase
+     * colon-separated hex.
+     */
+    fingerprint: string;
+}
+/**
+ * ESKDF
+ * @param username - username, email, or identifier, min: 8 characters, should have enough entropy
+ * @param password - password, min: 8 characters, should have enough entropy
+ * @returns Frozen API that derives child keys and exposes the account fingerprint.
+ * @throws If the username or password length is invalid. {@link Error}
+ * @example
+ * Derive account-specific child keys from the main ESKDF seed.
+ * ```ts
+ * const kdf = await eskdf('example-university', 'beginning-new-example');
+ * const key = kdf.deriveChildKey('aes', 0);
+ * const fingerprint = kdf.fingerprint;
+ * kdf.expire();
+ * ```
+ */
+export declare function eskdf(username: string, password: string): Promise<TRet<ESKDF>>;
+export {};

package/node_modules/@noble/hashes/eskdf.js

@@ -0,0 +1,225 @@
+/**
+ * Experimental KDF for AES.
+ * @module
+ */
+import { hkdf } from "./hkdf.js";
+import { pbkdf2 as _pbkdf2 } from "./pbkdf2.js";
+import { scrypt as _scrypt } from "./scrypt.js";
+import { sha256 } from "./sha2.js";
+import { abytes, bytesToHex, clean, createView, hexToBytes, kdfInputToBytes, } from "./utils.js";
+// A tiny KDF for various applications like AES key-gen.
+// Uses HKDF in a non-standard way, so it's not "KDF-secure", only "PRF-secure".
+// Which is good enough: assume sha2-256 retained preimage resistance.
+// Fixed ESKDF scrypt work factor: interactive-latency target with about 512 MiB RAM per derivation.
+const SCRYPT_FACTOR = /* @__PURE__ */ (() => 2 ** 19)();
+// Fixed ESKDF PBKDF2 work factor: CPU-only companion branch in the same rough
+// interactive-latency range.
+const PBKDF2_FACTOR = /* @__PURE__ */ (() => 2 ** 17)();
+/**
+ * Scrypt KDF with the fixed ESKDF policy tuple `{ N: 2^19, r: 8, p: 1, dkLen: 32 }`.
+ * @param password - user password string, UTF-8 encoded before entering RFC 7914
+ * @param salt - unique salt string, UTF-8 encoded before entering RFC 7914
+ * @returns Derived 32-byte key.
+ * @example
+ * Derive the 32-byte scrypt key used by ESKDF.
+ * ```ts
+ * scrypt('password123', 'user@example.com');
+ * ```
+ */
+export function scrypt(password, salt) {
+    return _scrypt(password, salt, { N: SCRYPT_FACTOR, r: 8, p: 1, dkLen: 32 });
+}
+/**
+ * PBKDF2-HMAC-SHA256 with the fixed ESKDF policy tuple `{ sha256, c: 2^17, dkLen: 32 }`.
+ * @param password - user password string, UTF-8 encoded before entering PBKDF2-HMAC-SHA-256
+ * @param salt - unique salt string, UTF-8 encoded before entering PBKDF2-HMAC-SHA-256
+ * @returns Derived 32-byte key.
+ * @example
+ * Derive the 32-byte PBKDF2 key used by ESKDF.
+ * ```ts
+ * pbkdf2('password123', 'user@example.com');
+ * ```
+ */
+export function pbkdf2(password, salt) {
+    return _pbkdf2(sha256, password, salt, { c: PBKDF2_FACTOR, dkLen: 32 });
+}
+// Combines two 32-byte byte arrays into a fresh 32-byte result without aliasing either input.
+function xor32(a, b) {
+    abytes(a, 32);
+    abytes(b, 32);
+    const arr = new Uint8Array(32);
+    for (let i = 0; i < 32; i++) {
+        arr[i] = a[i] ^ b[i];
+    }
+    return arr;
+}
+// All local string length checks are in JS UTF-16 code units, not UTF-8 bytes.
+function strHasLength(str, min, max) {
+    return typeof str === 'string' && str.length >= min && str.length <= max;
+}
+/**
+ * Derives main seed. Takes a lot of time; prefer the higher-level `eskdf(...)`
+ * flow unless you specifically need the raw main seed.
+ * Derives the main seed by xor'ing two branches:
+ * the scrypt branch uses a `0x01` separator byte on username/password,
+ * and the PBKDF2 branch uses `0x02`.
+ * Username and password strings are encoded by the underlying KDFs after the
+ * local separator bytes are appended.
+ * @param username - account identifier used as public salt
+ * @param password - user password string
+ * @returns Main 32-byte seed for the account.
+ * @throws If the username or password length is invalid. {@link Error}
+ * @example
+ * Derive the main ESKDF seed from username and password.
+ * ```ts
+ * deriveMainSeed('example-user', 'example-password');
+ * ```
+ */
+export function deriveMainSeed(username, password) {
+    if (typeof username !== 'string')
+        kdfInputToBytes(username, 'username');
+    if (typeof password !== 'string')
+        kdfInputToBytes(password, 'password');
+    if (!strHasLength(username, 8, 255))
+        throw new Error('invalid username');
+    if (!strHasLength(password, 8, 255))
+        throw new Error('invalid password');
+    // Keep the protocol separators as the literal bytes 0x01 / 0x02 even after minification.
+    // Embedding them as non-printable characters directly can be awkward across
+    // JS tooling and environments.
+    const codes = { _1: 1, _2: 2 };
+    const sep = { s: String.fromCharCode(codes._1), p: String.fromCharCode(codes._2) };
+    const scr = scrypt(password + sep.s, username + sep.s);
+    const pbk = pbkdf2(password + sep.p, username + sep.p);
+    const res = xor32(scr, pbk);
+    clean(scr, pbk);
+    return res;
+}
+/**
+ * Converts protocol & accountId pair to HKDF params:
+ * `info` is UTF-8 protocol bytes, numeric ids become 4-byte BE `salt`,
+ * and string ids become UTF-8 `salt` bytes.
+ * Numeric and string account ids share the existing salt byte namespace;
+ * changing this would require a new ESKDF encoding, so callers should use one account
+ * id kind per application.
+ */
+function getSaltInfo(protocol, accountId = 0) {
+    // Note that length here also repeats two lines below
+    // We do an additional length check here to reduce the scope of DoS attacks
+    if (!(strHasLength(protocol, 3, 15) && /^[a-z0-9]{3,15}$/.test(protocol))) {
+        throw new Error('invalid protocol');
+    }
+    // Exact-match only: substring matches like `assh` / `mentor` must not widen the public whitelist.
+    const allowsStr = /^(password\d{0,3}|ssh|tor|file)$/.test(protocol);
+    let salt; // Assigned below: either 4-byte BE account bytes or UTF-8 account bytes.
+    if (typeof accountId === 'string') {
+        if (!allowsStr)
+            throw new Error('accountId must be a number');
+        if (!strHasLength(accountId, 1, 255))
+            throw new Error('accountId must be string of length 1..255');
+        salt = kdfInputToBytes(accountId);
+    }
+    else if (Number.isSafeInteger(accountId)) {
+        if (accountId < 0 || accountId > Math.pow(2, 32) - 1)
+            throw new Error('invalid accountId');
+        // Convert to Big Endian Uint32
+        salt = new Uint8Array(4);
+        createView(salt).setUint32(0, accountId, false);
+    }
+    else {
+        throw new Error('accountId must be a number' + (allowsStr ? ' or string' : ''));
+    }
+    const info = kdfInputToBytes(protocol);
+    return { salt, info };
+}
+// Local modulus-size helper, not a general bigint-byte-length primitive:
+// `<= 128n` is rejected by ESKDF policy.
+function countBytes(num) {
+    if (typeof num !== 'bigint' || num <= BigInt(128))
+        throw new Error('invalid number');
+    return Math.ceil(num.toString(2).length / 8);
+}
+/**
+ * Parses keyLength and modulus options to extract length of result key.
+ * If modulus is used, adds 64 bits to it per the FIPS 186-5 Appendix A.3.1 /
+ * A.4.1 extra-bits guidance.
+ */
+function getKeyLength(options) {
+    if (!options || typeof options !== 'object')
+        return 32;
+    const hasLen = 'keyLength' in options;
+    const hasMod = 'modulus' in options;
+    if (hasLen && hasMod)
+        throw new Error('cannot combine keyLength and modulus options');
+    if (!hasLen && !hasMod)
+        throw new Error('must have either keyLength or modulus option');
+    // FIPS 186-5 Appendix A.3.1 / A.4.1 calls for at least 64 extra bits.
+    const l = hasMod ? countBytes(options.modulus) + 8 : options.keyLength;
+    // HKDF-SHA256 ultimately caps output at 8160 bytes; values above that still fail in hkdf().
+    if (!(typeof l === 'number' && l >= 16 && l <= 8192))
+        throw new Error('invalid keyLength');
+    return l;
+}
+/**
+ * Converts key to bigint and divides it by modulus. Big Endian.
+ * Adapts FIPS 186-5 Appendix A.4.1: `getKeyLength()` already requested the
+ * extra 64-bit margin, and this step maps the result into `1..modulus-1`.
+ */
+function modReduceKey(key, modulus) {
+    const _1 = BigInt(1);
+    const num = BigInt('0x' + bytesToHex(key)); // check for ui8a, then bytesToNumber()
+    const res = (num % (modulus - _1)) + _1; // Remove 0 from output
+    if (res < _1)
+        throw new Error('expected positive number'); // Guard against bad values
+    // Strip the extra 64-bit margin that `getKeyLength()` requested
+    // for bias reduction.
+    const len = key.length - 8;
+    const hex = res.toString(16).padStart(len * 2, '0'); // numberToHex()
+    const bytes = hexToBytes(hex);
+    if (bytes.length !== len)
+        throw new Error('invalid length of result key');
+    return bytes;
+}
+/**
+ * ESKDF
+ * @param username - username, email, or identifier, min: 8 characters, should have enough entropy
+ * @param password - password, min: 8 characters, should have enough entropy
+ * @returns Frozen API that derives child keys and exposes the account fingerprint.
+ * @throws If the username or password length is invalid. {@link Error}
+ * @example
+ * Derive account-specific child keys from the main ESKDF seed.
+ * ```ts
+ * const kdf = await eskdf('example-university', 'beginning-new-example');
+ * const key = kdf.deriveChildKey('aes', 0);
+ * const fingerprint = kdf.fingerprint;
+ * kdf.expire();
+ * ```
+ */
+export async function eskdf(username, password) {
+    // We are using closure + object instead of class because
+    // we want to make `seed` non-accessible for any external function.
+    let seed = deriveMainSeed(username, password);
+    function deriveCK(protocol, accountId = 0, options) {
+        // Reject expired instances before deriving any HKDF inputs from the closure-held seed.
+        abytes(seed, 32);
+        const { salt, info } = getSaltInfo(protocol, accountId); // validate protocol & accountId
+        // Validate option shape and coarse length bounds;
+        // `hkdf()` still rejects non-integer lengths.
+        const keyLength = getKeyLength(options);
+        const key = hkdf(sha256, seed, salt, info, keyLength);
+        // Modulus has already been validated
+        return options && 'modulus' in options ? modReduceKey(key, options.modulus) : key;
+    }
+    function expire() {
+        // Overwrite the closure-held seed before dropping the reference.
+        if (seed)
+            seed.fill(1);
+        seed = undefined;
+    }
+    // prettier-ignore
+    const fingerprint = Array.from(deriveCK('fingerprint', 0))
+        .slice(0, 6)
+        .map((char) => char.toString(16).padStart(2, '0').toUpperCase())
+        .join(':');
+    return Object.freeze({ deriveChildKey: deriveCK, expire, fingerprint });
+}