web-dc-api 0.0.57 → 0.0.59

package/dist/cjs/node_modules/@noble/curves/esm/ed25519.js

@@ -0,0 +1,148 @@
+'use strict';
+
+var sha2 = require('../../hashes/esm/sha2.js');
+var utils = require('../../hashes/esm/utils.js');
+var edwards = require('./abstract/edwards.js');
+var modular = require('./abstract/modular.js');
+var montgomery = require('./abstract/montgomery.js');
+
+/**
+ * ed25519 Twisted Edwards curve with following addons:
+ * - X25519 ECDH
+ * - Ristretto cofactor elimination
+ * - Elligator hash-to-group / point indistinguishability
+ * @module
+ */
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+// 2n**255n - 19n
+const ED25519_P = BigInt('57896044618658097711785492504343953926634992332820282019728792003956564819949');
+// √(-1) aka √(a) aka 2^((p-1)/4)
+// Fp.sqrt(Fp.neg(1))
+const ED25519_SQRT_M1 = /* @__PURE__ */BigInt('19681161376707505956807079304988542015446066515923890162744021073123829784752');
+// prettier-ignore
+BigInt(0);
+  const _1n = BigInt(1),
+  _2n = BigInt(2),
+  _3n = BigInt(3);
+// prettier-ignore
+const _5n = BigInt(5),
+  _8n = BigInt(8);
+function ed25519_pow_2_252_3(x) {
+  // prettier-ignore
+  const _10n = BigInt(10),
+    _20n = BigInt(20),
+    _40n = BigInt(40),
+    _80n = BigInt(80);
+  const P = ED25519_P;
+  const x2 = x * x % P;
+  const b2 = x2 * x % P; // x^3, 11
+  const b4 = modular.pow2(b2, _2n, P) * b2 % P; // x^15, 1111
+  const b5 = modular.pow2(b4, _1n, P) * x % P; // x^31
+  const b10 = modular.pow2(b5, _5n, P) * b5 % P;
+  const b20 = modular.pow2(b10, _10n, P) * b10 % P;
+  const b40 = modular.pow2(b20, _20n, P) * b20 % P;
+  const b80 = modular.pow2(b40, _40n, P) * b40 % P;
+  const b160 = modular.pow2(b80, _80n, P) * b80 % P;
+  const b240 = modular.pow2(b160, _80n, P) * b80 % P;
+  const b250 = modular.pow2(b240, _10n, P) * b10 % P;
+  const pow_p_5_8 = modular.pow2(b250, _2n, P) * x % P;
+  // ^ To pow to (p+3)/8, multiply it by x.
+  return {
+    pow_p_5_8,
+    b2
+  };
+}
+function adjustScalarBytes(bytes) {
+  // Section 5: For X25519, in order to decode 32 random bytes as an integer scalar,
+  // set the three least significant bits of the first byte
+  bytes[0] &= 248; // 0b1111_1000
+  // and the most significant bit of the last to zero,
+  bytes[31] &= 127; // 0b0111_1111
+  // set the second most significant bit of the last byte to 1
+  bytes[31] |= 64; // 0b0100_0000
+  return bytes;
+}
+// sqrt(u/v)
+function uvRatio(u, v) {
+  const P = ED25519_P;
+  const v3 = modular.mod(v * v * v, P); // v³
+  const v7 = modular.mod(v3 * v3 * v, P); // v⁷
+  // (p+3)/8 and (p-5)/8
+  const pow = ed25519_pow_2_252_3(u * v7).pow_p_5_8;
+  let x = modular.mod(u * v3 * pow, P); // (uv³)(uv⁷)^(p-5)/8
+  const vx2 = modular.mod(v * x * x, P); // vx²
+  const root1 = x; // First root candidate
+  const root2 = modular.mod(x * ED25519_SQRT_M1, P); // Second root candidate
+  const useRoot1 = vx2 === u; // If vx² = u (mod p), x is a square root
+  const useRoot2 = vx2 === modular.mod(-u, P); // If vx² = -u, set x <-- x * 2^((p-1)/4)
+  const noRoot = vx2 === modular.mod(-u * ED25519_SQRT_M1, P); // There is no valid root, vx² = -u√(-1)
+  if (useRoot1) x = root1;
+  if (useRoot2 || noRoot) x = root2; // We return root2 anyway, for const-time
+  if (modular.isNegativeLE(x, P)) x = modular.mod(-x, P);
+  return {
+    isValid: useRoot1 || useRoot2,
+    value: x
+  };
+}
+const Fp = /* @__PURE__ */(() => modular.Field(ED25519_P, undefined, true))();
+const ed25519Defaults = /* @__PURE__ */(() => ({
+  // Removing Fp.create() will still work, and is 10% faster on sign
+  a: Fp.create(BigInt(-1)),
+  // d is -121665/121666 a.k.a. Fp.neg(121665 * Fp.inv(121666))
+  d: BigInt('37095705934669439343138083508754565189542113879843219016388785533085940283555'),
+  // Finite field 2n**255n - 19n
+  Fp,
+  // Subgroup order 2n**252n + 27742317777372353535851937790883648493n;
+  n: BigInt('7237005577332262213973186563042994240857116359379907606001950938285454250989'),
+  h: _8n,
+  Gx: BigInt('15112221349535400772501151409588531511454012693041857206046113283949847762202'),
+  Gy: BigInt('46316835694926478169428394003475163141307993866256225615783033603165251855960'),
+  hash: sha2.sha512,
+  randomBytes: utils.randomBytes,
+  adjustScalarBytes,
+  // dom2
+  // Ratio of u to v. Allows us to combine inversion and square root. Uses algo from RFC8032 5.1.3.
+  // Constant-time, u/√v
+  uvRatio
+}))();
+/**
+ * ed25519 curve with EdDSA signatures.
+ * @example
+ * import { ed25519 } from '@noble/curves/ed25519';
+ * const priv = ed25519.utils.randomPrivateKey();
+ * const pub = ed25519.getPublicKey(priv);
+ * const msg = new TextEncoder().encode('hello');
+ * const sig = ed25519.sign(msg, priv);
+ * ed25519.verify(sig, msg, pub); // Default mode: follows ZIP215
+ * ed25519.verify(sig, msg, pub, { zip215: false }); // RFC8032 / FIPS 186-5
+ */
+const ed25519 = /* @__PURE__ */(() => edwards.twistedEdwards(ed25519Defaults))();
+/**
+ * ECDH using curve25519 aka x25519.
+ * @example
+ * import { x25519 } from '@noble/curves/ed25519';
+ * const priv = 'a546e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449ac4';
+ * const pub = 'e6db6867583030db3594c1a424b15f7c726624ec26b3353b10a903a6d0ab1c4c';
+ * x25519.getSharedSecret(priv, pub) === x25519.scalarMult(priv, pub); // aliases
+ * x25519.getPublicKey(priv) === x25519.scalarMultBase(priv);
+ * x25519.getPublicKey(x25519.utils.randomPrivateKey());
+ */
+const x25519 = /* @__PURE__ */(() => montgomery.montgomery({
+  P: ED25519_P,
+  type: 'x25519',
+  powPminus2: x => {
+    const P = ED25519_P;
+    // x^(p-2) aka x^(2^255-21)
+    const {
+      pow_p_5_8,
+      b2
+    } = ed25519_pow_2_252_3(x);
+    return modular.mod(modular.pow2(pow_p_5_8, _3n, P) * b2, P);
+  },
+  adjustScalarBytes,
+  randomBytes: utils.randomBytes
+}))();
+ // legacy
+
+exports.ed25519 = ed25519;
+exports.x25519 = x25519;

package/dist/cjs/node_modules/@noble/curves/esm/secp256k1.js

@@ -0,0 +1,117 @@
+'use strict';
+
+var sha2 = require('../../hashes/esm/sha2.js');
+var _shortw_utils = require('./_shortw_utils.js');
+var modular = require('./abstract/modular.js');
+
+/**
+ * NIST secp256k1. See [pdf](https://www.secg.org/sec2-v2.pdf).
+ *
+ * Seems to be rigid (not backdoored)
+ * [as per discussion](https://bitcointalk.org/index.php?topic=289795.msg3183975#msg3183975).
+ *
+ * secp256k1 belongs to Koblitz curves: it has efficiently computable endomorphism.
+ * Endomorphism uses 2x less RAM, speeds up precomputation by 2x and ECDH / key recovery by 20%.
+ * For precomputed wNAF it trades off 1/2 init time & 1/3 ram for 20% perf hit.
+ * [See explanation](https://gist.github.com/paulmillr/eb670806793e84df628a7c434a873066).
+ * @module
+ */
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+const secp256k1P = BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f');
+const secp256k1N = BigInt('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141');
+const _0n = BigInt(0);
+const _1n = BigInt(1);
+const _2n = BigInt(2);
+const divNearest = (a, b) => (a + b / _2n) / b;
+/**
+ * √n = n^((p+1)/4) for fields p = 3 mod 4. We unwrap the loop and multiply bit-by-bit.
+ * (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]
+ */
+function sqrtMod(y) {
+  const P = secp256k1P;
+  // prettier-ignore
+  const _3n = BigInt(3),
+    _6n = BigInt(6),
+    _11n = BigInt(11),
+    _22n = BigInt(22);
+  // prettier-ignore
+  const _23n = BigInt(23),
+    _44n = BigInt(44),
+    _88n = BigInt(88);
+  const b2 = y * y * y % P; // x^3, 11
+  const b3 = b2 * b2 * y % P; // x^7
+  const b6 = modular.pow2(b3, _3n, P) * b3 % P;
+  const b9 = modular.pow2(b6, _3n, P) * b3 % P;
+  const b11 = modular.pow2(b9, _2n, P) * b2 % P;
+  const b22 = modular.pow2(b11, _11n, P) * b11 % P;
+  const b44 = modular.pow2(b22, _22n, P) * b22 % P;
+  const b88 = modular.pow2(b44, _44n, P) * b44 % P;
+  const b176 = modular.pow2(b88, _88n, P) * b88 % P;
+  const b220 = modular.pow2(b176, _44n, P) * b44 % P;
+  const b223 = modular.pow2(b220, _3n, P) * b3 % P;
+  const t1 = modular.pow2(b223, _23n, P) * b22 % P;
+  const t2 = modular.pow2(t1, _6n, P) * b2 % P;
+  const root = modular.pow2(t2, _2n, P);
+  if (!Fpk1.eql(Fpk1.sqr(root), y)) throw new Error('Cannot find square root');
+  return root;
+}
+const Fpk1 = modular.Field(secp256k1P, undefined, undefined, {
+  sqrt: sqrtMod
+});
+/**
+ * secp256k1 curve, ECDSA and ECDH methods.
+ *
+ * Field: `2n**256n - 2n**32n - 2n**9n - 2n**8n - 2n**7n - 2n**6n - 2n**4n - 1n`
+ *
+ * @example
+ * ```js
+ * import { secp256k1 } from '@noble/curves/secp256k1';
+ * const priv = secp256k1.utils.randomPrivateKey();
+ * const pub = secp256k1.getPublicKey(priv);
+ * const msg = new Uint8Array(32).fill(1); // message hash (not message) in ecdsa
+ * const sig = secp256k1.sign(msg, priv); // `{prehash: true}` option is available
+ * const isValid = secp256k1.verify(sig, msg, pub) === true;
+ * ```
+ */
+const secp256k1 = _shortw_utils.createCurve({
+  a: _0n,
+  b: BigInt(7),
+  Fp: Fpk1,
+  n: secp256k1N,
+  Gx: BigInt('55066263022277343669578718895168534326250603453777594175500187360389116729240'),
+  Gy: BigInt('32670510020758816978083085130507043184471273380659243275938904335757337482424'),
+  h: BigInt(1),
+  lowS: true,
+  // Allow only low-S signatures by default in sign() and verify()
+  endo: {
+    // Endomorphism, see above
+    beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),
+    splitScalar: k => {
+      const n = secp256k1N;
+      const a1 = BigInt('0x3086d221a7d46bcde86c90e49284eb15');
+      const b1 = -_1n * BigInt('0xe4437ed6010e88286f547fa90abfe4c3');
+      const a2 = BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8');
+      const b2 = a1;
+      const POW_2_128 = BigInt('0x100000000000000000000000000000000'); // (2n**128n).toString(16)
+      const c1 = divNearest(b2 * k, n);
+      const c2 = divNearest(-b1 * k, n);
+      let k1 = modular.mod(k - c1 * a1 - c2 * a2, n);
+      let k2 = modular.mod(-c1 * b1 - c2 * b2, n);
+      const k1neg = k1 > POW_2_128;
+      const k2neg = k2 > POW_2_128;
+      if (k1neg) k1 = n - k1;
+      if (k2neg) k2 = n - k2;
+      if (k1 > POW_2_128 || k2 > POW_2_128) {
+        throw new Error('splitScalar: Endomorphism failed, k=' + k);
+      }
+      return {
+        k1neg,
+        k1,
+        k2neg,
+        k2
+      };
+    }
+  }
+}, sha2.sha256);
+
+exports.secp256k1 = secp256k1;

package/dist/cjs/node_modules/@noble/hashes/esm/_md.js

@@ -0,0 +1,164 @@
+'use strict';
+
+var utils = require('./utils.js');
+
+/**
+ * Internal Merkle-Damgard hash utils.
+ * @module
+ */
+/** Polyfill for Safari 14. https://caniuse.com/mdn-javascript_builtins_dataview_setbiguint64 */
+function setBigUint64(view, byteOffset, value, isLE) {
+  if (typeof view.setBigUint64 === 'function') return view.setBigUint64(byteOffset, value, isLE);
+  const _32n = BigInt(32);
+  const _u32_max = BigInt(0xffffffff);
+  const wh = Number(value >> _32n & _u32_max);
+  const wl = Number(value & _u32_max);
+  const h = isLE ? 4 : 0;
+  const l = isLE ? 0 : 4;
+  view.setUint32(byteOffset + h, wh, isLE);
+  view.setUint32(byteOffset + l, wl, isLE);
+}
+/** Choice: a ? b : c */
+function Chi(a, b, c) {
+  return a & b ^ ~a & c;
+}
+/** Majority function, true if any two inputs is true. */
+function Maj(a, b, c) {
+  return a & b ^ a & c ^ b & c;
+}
+/**
+ * Merkle-Damgard hash construction base class.
+ * Could be used to create MD5, RIPEMD, SHA1, SHA2.
+ */
+class HashMD extends utils.Hash {
+  constructor(blockLen, outputLen, padOffset, isLE) {
+    super();
+    this.finished = false;
+    this.length = 0;
+    this.pos = 0;
+    this.destroyed = false;
+    this.blockLen = blockLen;
+    this.outputLen = outputLen;
+    this.padOffset = padOffset;
+    this.isLE = isLE;
+    this.buffer = new Uint8Array(blockLen);
+    this.view = utils.createView(this.buffer);
+  }
+  update(data) {
+    utils.aexists(this);
+    data = utils.toBytes(data);
+    utils.abytes(data);
+    const {
+      view,
+      buffer,
+      blockLen
+    } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len;) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      // Fast path: we have at least one block in input, cast it to view and process
+      if (take === blockLen) {
+        const dataView = utils.createView(data);
+        for (; blockLen <= len - pos; pos += blockLen) this.process(dataView, pos);
+        continue;
+      }
+      buffer.set(data.subarray(pos, pos + take), this.pos);
+      this.pos += take;
+      pos += take;
+      if (this.pos === blockLen) {
+        this.process(view, 0);
+        this.pos = 0;
+      }
+    }
+    this.length += data.length;
+    this.roundClean();
+    return this;
+  }
+  digestInto(out) {
+    utils.aexists(this);
+    utils.aoutput(out, this);
+    this.finished = true;
+    // Padding
+    // We can avoid allocation of buffer for padding completely if it
+    // was previously not allocated here. But it won't change performance.
+    const {
+      buffer,
+      view,
+      blockLen,
+      isLE
+    } = this;
+    let {
+      pos
+    } = this;
+    // append the bit '1' to the message
+    buffer[pos++] = 0b10000000;
+    utils.clean(this.buffer.subarray(pos));
+    // we have less than padOffset left in buffer, so we cannot put length in
+    // current block, need process it and pad again
+    if (this.padOffset > blockLen - pos) {
+      this.process(view, 0);
+      pos = 0;
+    }
+    // Pad until full block byte with zeros
+    for (let i = pos; i < blockLen; i++) buffer[i] = 0;
+    // Note: sha512 requires length to be 128bit integer, but length in JS will overflow before that
+    // You need to write around 2 exabytes (u64_max / 8 / (1024**6)) for this to happen.
+    // So we just write lowest 64 bits of that value.
+    setBigUint64(view, blockLen - 8, BigInt(this.length * 8), isLE);
+    this.process(view, 0);
+    const oview = utils.createView(out);
+    const len = this.outputLen;
+    // NOTE: we do division by 4 later, which should be fused in single op with modulo by JIT
+    if (len % 4) throw new Error('_sha2: outputLen should be aligned to 32bit');
+    const outLen = len / 4;
+    const state = this.get();
+    if (outLen > state.length) throw new Error('_sha2: outputLen bigger than state');
+    for (let i = 0; i < outLen; i++) oview.setUint32(4 * i, state[i], isLE);
+  }
+  digest() {
+    const {
+      buffer,
+      outputLen
+    } = this;
+    this.digestInto(buffer);
+    const res = buffer.slice(0, outputLen);
+    this.destroy();
+    return res;
+  }
+  _cloneInto(to) {
+    to || (to = new this.constructor());
+    to.set(...this.get());
+    const {
+      blockLen,
+      buffer,
+      length,
+      finished,
+      destroyed,
+      pos
+    } = this;
+    to.destroyed = destroyed;
+    to.finished = finished;
+    to.length = length;
+    to.pos = pos;
+    if (length % blockLen) to.buffer.set(buffer);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+}
+/**
+ * Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.
+ * Check out `test/misc/sha2-gen-iv.js` for recomputation guide.
+ */
+/** Initial SHA256 state. Bits 0..32 of frac part of sqrt of primes 2..19 */
+const SHA256_IV = /* @__PURE__ */Uint32Array.from([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19]);
+/** Initial SHA512 state. Bits 0..64 of frac part of sqrt of primes 2..19 */
+const SHA512_IV = /* @__PURE__ */Uint32Array.from([0x6a09e667, 0xf3bcc908, 0xbb67ae85, 0x84caa73b, 0x3c6ef372, 0xfe94f82b, 0xa54ff53a, 0x5f1d36f1, 0x510e527f, 0xade682d1, 0x9b05688c, 0x2b3e6c1f, 0x1f83d9ab, 0xfb41bd6b, 0x5be0cd19, 0x137e2179]);
+
+exports.Chi = Chi;
+exports.HashMD = HashMD;
+exports.Maj = Maj;
+exports.SHA256_IV = SHA256_IV;
+exports.SHA512_IV = SHA512_IV;
+exports.setBigUint64 = setBigUint64;

package/dist/cjs/node_modules/@noble/hashes/esm/_u64.js

@@ -0,0 +1,75 @@
+'use strict';
+
+/**
+ * Internal helpers for u64. BigUint64Array is too slow as per 2025, so we implement it using Uint32Array.
+ * @todo re-check https://issues.chromium.org/issues/42212588
+ * @module
+ */
+const U32_MASK64 = /* @__PURE__ */BigInt(2 ** 32 - 1);
+const _32n = /* @__PURE__ */BigInt(32);
+function fromBig(n) {
+  let le = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : false;
+  if (le) return {
+    h: Number(n & U32_MASK64),
+    l: Number(n >> _32n & U32_MASK64)
+  };
+  return {
+    h: Number(n >> _32n & U32_MASK64) | 0,
+    l: Number(n & U32_MASK64) | 0
+  };
+}
+function split(lst) {
+  let le = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : false;
+  const len = lst.length;
+  let Ah = new Uint32Array(len);
+  let Al = new Uint32Array(len);
+  for (let i = 0; i < len; i++) {
+    const {
+      h,
+      l
+    } = fromBig(lst[i], le);
+    [Ah[i], Al[i]] = [h, l];
+  }
+  return [Ah, Al];
+}
+// for Shift in [0, 32)
+const shrSH = (h, _l, s) => h >>> s;
+const shrSL = (h, l, s) => h << 32 - s | l >>> s;
+// Right rotate for Shift in [1, 32)
+const rotrSH = (h, l, s) => h >>> s | l << 32 - s;
+const rotrSL = (h, l, s) => h << 32 - s | l >>> s;
+// Right rotate for Shift in (32, 64), NOTE: 32 is special case.
+const rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32;
+const rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s;
+// JS uses 32-bit signed integers for bitwise operations which means we cannot
+// simple take carry out of low bit sum by shift, we need to use division.
+function add(Ah, Al, Bh, Bl) {
+  const l = (Al >>> 0) + (Bl >>> 0);
+  return {
+    h: Ah + Bh + (l / 2 ** 32 | 0) | 0,
+    l: l | 0
+  };
+}
+// Addition with more than 2 elements
+const add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
+const add3H = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0;
+const add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
+const add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0;
+const add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
+const add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
+
+exports.add = add;
+exports.add3H = add3H;
+exports.add3L = add3L;
+exports.add4H = add4H;
+exports.add4L = add4L;
+exports.add5H = add5H;
+exports.add5L = add5L;
+exports.fromBig = fromBig;
+exports.rotrBH = rotrBH;
+exports.rotrBL = rotrBL;
+exports.rotrSH = rotrSH;
+exports.rotrSL = rotrSL;
+exports.shrSH = shrSH;
+exports.shrSL = shrSL;
+exports.split = split;

package/dist/cjs/node_modules/@noble/hashes/esm/crypto.js

@@ -0,0 +1,5 @@
+'use strict';
+
+const crypto = typeof globalThis === 'object' && 'crypto' in globalThis ? globalThis.crypto : undefined;
+
+exports.crypto = crypto;

package/dist/cjs/node_modules/@noble/hashes/esm/hkdf.js

@@ -0,0 +1,64 @@
+'use strict';
+
+var hmac = require('./hmac.js');
+var utils = require('./utils.js');
+
+/**
+ * HKDF (RFC 5869): extract + expand in one step.
+ * See https://soatok.blog/2021/11/17/understanding-hkdf/.
+ * @module
+ */
+/**
+ * HKDF-extract from spec. Less important part. `HKDF-Extract(IKM, salt) -> PRK`
+ * Arguments position differs from spec (IKM is first one, since it is not optional)
+ * @param hash - hash function that would be used (e.g. sha256)
+ * @param ikm - input keying material, the initial key
+ * @param salt - optional salt value (a non-secret random value)
+ */
+function extract(hash, ikm, salt) {
+  utils.ahash(hash);
+  // NOTE: some libraries treat zero-length array as 'not provided';
+  // we don't, since we have undefined as 'not provided'
+  // https://github.com/RustCrypto/KDFs/issues/15
+  if (salt === undefined) salt = new Uint8Array(hash.outputLen);
+  return hmac.hmac(hash, utils.toBytes(salt), utils.toBytes(ikm));
+}
+const HKDF_COUNTER = /* @__PURE__ */Uint8Array.from([0]);
+const EMPTY_BUFFER = /* @__PURE__ */Uint8Array.of();
+/**
+ * HKDF-expand from the spec. The most important part. `HKDF-Expand(PRK, info, L) -> OKM`
+ * @param hash - hash function that would be used (e.g. sha256)
+ * @param prk - a pseudorandom key of at least HashLen octets (usually, the output from the extract step)
+ * @param info - optional context and application specific information (can be a zero-length string)
+ * @param length - length of output keying material in bytes
+ */
+function expand(hash, prk, info) {
+  let length = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : 32;
+  utils.ahash(hash);
+  utils.anumber(length);
+  const olen = hash.outputLen;
+  if (length > 255 * olen) throw new Error('Length should be <= 255*HashLen');
+  const blocks = Math.ceil(length / olen);
+  if (info === undefined) info = EMPTY_BUFFER;
+  // first L(ength) octets of T
+  const okm = new Uint8Array(blocks * olen);
+  // Re-use HMAC instance between blocks
+  const HMAC = hmac.hmac.create(hash, prk);
+  const HMACTmp = HMAC._cloneInto();
+  const T = new Uint8Array(HMAC.outputLen);
+  for (let counter = 0; counter < blocks; counter++) {
+    HKDF_COUNTER[0] = counter + 1;
+    // T(0) = empty string (zero length)
+    // T(N) = HMAC-Hash(PRK, T(N-1) | info | N)
+    HMACTmp.update(counter === 0 ? EMPTY_BUFFER : T).update(info).update(HKDF_COUNTER).digestInto(T);
+    okm.set(T, olen * counter);
+    HMAC._cloneInto(HMACTmp);
+  }
+  HMAC.destroy();
+  HMACTmp.destroy();
+  utils.clean(T, HKDF_COUNTER);
+  return okm.slice(0, length);
+}
+
+exports.expand = expand;
+exports.extract = extract;

package/dist/cjs/node_modules/@noble/hashes/esm/hmac.js

@@ -0,0 +1,95 @@
+'use strict';
+
+var utils = require('./utils.js');
+
+/**
+ * HMAC: RFC2104 message authentication code.
+ * @module
+ */
+class HMAC extends utils.Hash {
+  constructor(hash, _key) {
+    super();
+    this.finished = false;
+    this.destroyed = false;
+    utils.ahash(hash);
+    const key = utils.toBytes(_key);
+    this.iHash = hash.create();
+    if (typeof this.iHash.update !== 'function') throw new Error('Expected instance of class which extends utils.Hash');
+    this.blockLen = this.iHash.blockLen;
+    this.outputLen = this.iHash.outputLen;
+    const blockLen = this.blockLen;
+    const pad = new Uint8Array(blockLen);
+    // blockLen can be bigger than outputLen
+    pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
+    for (let i = 0; i < pad.length; i++) pad[i] ^= 0x36;
+    this.iHash.update(pad);
+    // By doing update (processing of first block) of outer hash here we can re-use it between multiple calls via clone
+    this.oHash = hash.create();
+    // Undo internal XOR && apply outer XOR
+    for (let i = 0; i < pad.length; i++) pad[i] ^= 0x36 ^ 0x5c;
+    this.oHash.update(pad);
+    utils.clean(pad);
+  }
+  update(buf) {
+    utils.aexists(this);
+    this.iHash.update(buf);
+    return this;
+  }
+  digestInto(out) {
+    utils.aexists(this);
+    utils.abytes(out, this.outputLen);
+    this.finished = true;
+    this.iHash.digestInto(out);
+    this.oHash.update(out);
+    this.oHash.digestInto(out);
+    this.destroy();
+  }
+  digest() {
+    const out = new Uint8Array(this.oHash.outputLen);
+    this.digestInto(out);
+    return out;
+  }
+  _cloneInto(to) {
+    // Create new instance without calling constructor since key already in state and we don't know it.
+    to || (to = Object.create(Object.getPrototypeOf(this), {}));
+    const {
+      oHash,
+      iHash,
+      finished,
+      destroyed,
+      blockLen,
+      outputLen
+    } = this;
+    to = to;
+    to.finished = finished;
+    to.destroyed = destroyed;
+    to.blockLen = blockLen;
+    to.outputLen = outputLen;
+    to.oHash = oHash._cloneInto(to.oHash);
+    to.iHash = iHash._cloneInto(to.iHash);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+  destroy() {
+    this.destroyed = true;
+    this.oHash.destroy();
+    this.iHash.destroy();
+  }
+}
+/**
+ * HMAC: RFC2104 message authentication code.
+ * @param hash - function that would be used e.g. sha256
+ * @param key - message key
+ * @param message - message data
+ * @example
+ * import { hmac } from '@noble/hashes/hmac';
+ * import { sha256 } from '@noble/hashes/sha2';
+ * const mac1 = hmac(sha256, 'key', 'message');
+ */
+const hmac = (hash, key, message) => new HMAC(hash, key).update(message).digest();
+hmac.create = (hash, key) => new HMAC(hash, key);
+
+exports.HMAC = HMAC;
+exports.hmac = hmac;