HMAC Generator — TypeScript source

// Keyed-hash HMAC via the Web Crypto API (SubtleCrypto). Pure logic - no React,
// no DOM. Deterministic for a given (message, secret, algorithm); async only
// because SubtleCrypto is. Requires a secure context (https or localhost).
//
// Mirrors src/lib/base64.ts (pure, testable surface) and the inline digest
// helper in src/tools/HashGenerator.tsx.

export type HmacAlgorithm = 'SHA-1' | 'SHA-256' | 'SHA-384' | 'SHA-512';

/** Lowercase hex of an ArrayBuffer. */
function toHex(buf: ArrayBuffer): string {
  return [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, '0')).join('');
}

/**
 * Compute the HMAC of `message` under `secret` and return it as lowercase hex.
 * Both inputs are UTF-8 encoded. Rejects if `secret` is empty (SubtleCrypto
 * rejects a zero-length key) or if `algorithm` is unsupported.
 */
export async function hmacHex(
  message: string,
  secret: string,
  algorithm: HmacAlgorithm = 'SHA-256',
): Promise<string> {
  const encoder = new TextEncoder();
  const key = await crypto.subtle.importKey(
    'raw',
    encoder.encode(secret),
    { name: 'HMAC', hash: algorithm },
    false,
    ['sign'],
  );
  const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(message));
  return toHex(signature);
}