import { hkdfSync } from 'node:crypto'

/**
 * Derive a key using HKDF-SHA256.
 *
 * @param ikm - Input keying material (string, will be UTF-8 encoded)
 * @param salt - Salt value (string, will be UTF-8 encoded)
 * @param info - Info/context string (will be UTF-8 encoded)
 * @param length - Output key length in bytes (default: 32 for AES-256)
 * @returns Derived key as Buffer
 */
export const hkdfSha256 = (ikm: string, salt: string, info: string, length = 32): Buffer => {
  const derived = hkdfSync('sha256', ikm, salt, info, length)
  return Buffer.from(derived)
}