@openclaw/nostr 2026.5.20 → 2026.5.22

package/node_modules/@noble/hashes/src/legacy.ts

@@ -0,0 +1,293 @@
+/**
+
+SHA1 (RFC 3174), MD5 (RFC 1321) and RIPEMD160 (RFC 2286) legacy, weak hash functions.
+Don't use them in a new protocol. What "weak" means:
+
+- Collisions can be made with 2^18 effort in MD5, 2^60 in SHA1, 2^80 in RIPEMD160.
+- No practical pre-image attacks (only theoretical, 2^123.4)
+- HMAC seems kinda ok: https://www.rfc-editor.org/rfc/rfc6151
+ * @module
+ */
+import { Chi, HashMD, Maj } from './_md.ts';
+import { type CHash, clean, createHasher, rotl } from './utils.ts';
+
+/** Initial SHA1 state */
+const SHA1_IV = /* @__PURE__ */ Uint32Array.from([
+  0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476, 0xc3d2e1f0,
+]);
+
+// Reusable temporary buffer
+const SHA1_W = /* @__PURE__ */ new Uint32Array(80);
+
+/** Internal SHA1 legacy hash class. */
+export class _SHA1 extends HashMD<_SHA1> {
+  private A = SHA1_IV[0] | 0;
+  private B = SHA1_IV[1] | 0;
+  private C = SHA1_IV[2] | 0;
+  private D = SHA1_IV[3] | 0;
+  private E = SHA1_IV[4] | 0;
+
+  constructor() {
+    super(64, 20, 8, false);
+  }
+  protected get(): [number, number, number, number, number] {
+    const { A, B, C, D, E } = this;
+    return [A, B, C, D, E];
+  }
+  protected set(A: number, B: number, C: number, D: number, E: number): void {
+    this.A = A | 0;
+    this.B = B | 0;
+    this.C = C | 0;
+    this.D = D | 0;
+    this.E = E | 0;
+  }
+  protected process(view: DataView, offset: number): void {
+    for (let i = 0; i < 16; i++, offset += 4) SHA1_W[i] = view.getUint32(offset, false);
+    for (let i = 16; i < 80; i++)
+      SHA1_W[i] = rotl(SHA1_W[i - 3] ^ SHA1_W[i - 8] ^ SHA1_W[i - 14] ^ SHA1_W[i - 16], 1);
+    // Compression function main loop, 80 rounds
+    let { A, B, C, D, E } = this;
+    for (let i = 0; i < 80; i++) {
+      let F, K;
+      if (i < 20) {
+        F = Chi(B, C, D);
+        K = 0x5a827999;
+      } else if (i < 40) {
+        F = B ^ C ^ D;
+        K = 0x6ed9eba1;
+      } else if (i < 60) {
+        F = Maj(B, C, D);
+        K = 0x8f1bbcdc;
+      } else {
+        F = B ^ C ^ D;
+        K = 0xca62c1d6;
+      }
+      const T = (rotl(A, 5) + F + E + K + SHA1_W[i]) | 0;
+      E = D;
+      D = C;
+      C = rotl(B, 30);
+      B = A;
+      A = T;
+    }
+    // Add the compressed chunk to the current hash value
+    A = (A + this.A) | 0;
+    B = (B + this.B) | 0;
+    C = (C + this.C) | 0;
+    D = (D + this.D) | 0;
+    E = (E + this.E) | 0;
+    this.set(A, B, C, D, E);
+  }
+  protected roundClean(): void {
+    clean(SHA1_W);
+  }
+  destroy(): void {
+    this.set(0, 0, 0, 0, 0);
+    clean(this.buffer);
+  }
+}
+
+/** SHA1 (RFC 3174) legacy hash function. It was cryptographically broken. */
+export const sha1: CHash = /* @__PURE__ */ createHasher(() => new _SHA1());
+
+/** Per-round constants */
+const p32 = /* @__PURE__ */ Math.pow(2, 32);
+const K = /* @__PURE__ */ Array.from({ length: 64 }, (_, i) =>
+  Math.floor(p32 * Math.abs(Math.sin(i + 1)))
+);
+
+/** md5 initial state: same as sha1, but 4 u32 instead of 5. */
+const MD5_IV = /* @__PURE__ */ SHA1_IV.slice(0, 4);
+
+// Reusable temporary buffer
+const MD5_W = /* @__PURE__ */ new Uint32Array(16);
+/** Internal MD5 legacy hash class. */
+export class _MD5 extends HashMD<_MD5> {
+  private A = MD5_IV[0] | 0;
+  private B = MD5_IV[1] | 0;
+  private C = MD5_IV[2] | 0;
+  private D = MD5_IV[3] | 0;
+
+  constructor() {
+    super(64, 16, 8, true);
+  }
+  protected get(): [number, number, number, number] {
+    const { A, B, C, D } = this;
+    return [A, B, C, D];
+  }
+  protected set(A: number, B: number, C: number, D: number): void {
+    this.A = A | 0;
+    this.B = B | 0;
+    this.C = C | 0;
+    this.D = D | 0;
+  }
+  protected process(view: DataView, offset: number): void {
+    for (let i = 0; i < 16; i++, offset += 4) MD5_W[i] = view.getUint32(offset, true);
+    // Compression function main loop, 64 rounds
+    let { A, B, C, D } = this;
+    for (let i = 0; i < 64; i++) {
+      let F, g, s;
+      if (i < 16) {
+        F = Chi(B, C, D);
+        g = i;
+        s = [7, 12, 17, 22];
+      } else if (i < 32) {
+        F = Chi(D, B, C);
+        g = (5 * i + 1) % 16;
+        s = [5, 9, 14, 20];
+      } else if (i < 48) {
+        F = B ^ C ^ D;
+        g = (3 * i + 5) % 16;
+        s = [4, 11, 16, 23];
+      } else {
+        F = C ^ (B | ~D);
+        g = (7 * i) % 16;
+        s = [6, 10, 15, 21];
+      }
+      F = F + A + K[i] + MD5_W[g];
+      A = D;
+      D = C;
+      C = B;
+      B = B + rotl(F, s[i % 4]);
+    }
+    // Add the compressed chunk to the current hash value
+    A = (A + this.A) | 0;
+    B = (B + this.B) | 0;
+    C = (C + this.C) | 0;
+    D = (D + this.D) | 0;
+    this.set(A, B, C, D);
+  }
+  protected roundClean(): void {
+    clean(MD5_W);
+  }
+  destroy(): void {
+    this.set(0, 0, 0, 0);
+    clean(this.buffer);
+  }
+}
+
+/**
+ * MD5 (RFC 1321) legacy hash function. It was cryptographically broken.
+ * MD5 architecture is similar to SHA1, with some differences:
+ * - Reduced output length: 16 bytes (128 bit) instead of 20
+ * - 64 rounds, instead of 80
+ * - Little-endian: could be faster, but will require more code
+ * - Non-linear index selection: huge speed-up for unroll
+ * - Per round constants: more memory accesses, additional speed-up for unroll
+ */
+export const md5: CHash = /* @__PURE__ */ createHasher(() => new _MD5());
+
+// RIPEMD-160
+
+const Rho160 = /* @__PURE__ */ Uint8Array.from([
+  7, 4, 13, 1, 10, 6, 15, 3, 12, 0, 9, 5, 2, 14, 11, 8,
+]);
+const Id160 = /* @__PURE__ */ (() => Uint8Array.from(new Array(16).fill(0).map((_, i) => i)))();
+const Pi160 = /* @__PURE__ */ (() => Id160.map((i) => (9 * i + 5) % 16))();
+const idxLR = /* @__PURE__ */ (() => {
+  const L = [Id160];
+  const R = [Pi160];
+  const res = [L, R];
+  for (let i = 0; i < 4; i++) for (let j of res) j.push(j[i].map((k) => Rho160[k]));
+  return res;
+})();
+const idxL = /* @__PURE__ */ (() => idxLR[0])();
+const idxR = /* @__PURE__ */ (() => idxLR[1])();
+// const [idxL, idxR] = idxLR;
+
+const shifts160 = /* @__PURE__ */ [
+  [11, 14, 15, 12, 5, 8, 7, 9, 11, 13, 14, 15, 6, 7, 9, 8],
+  [12, 13, 11, 15, 6, 9, 9, 7, 12, 15, 11, 13, 7, 8, 7, 7],
+  [13, 15, 14, 11, 7, 7, 6, 8, 13, 14, 13, 12, 5, 5, 6, 9],
+  [14, 11, 12, 14, 8, 6, 5, 5, 15, 12, 15, 14, 9, 9, 8, 6],
+  [15, 12, 13, 13, 9, 5, 8, 6, 14, 11, 12, 11, 8, 6, 5, 5],
+].map((i) => Uint8Array.from(i));
+const shiftsL160 = /* @__PURE__ */ idxL.map((idx, i) => idx.map((j) => shifts160[i][j]));
+const shiftsR160 = /* @__PURE__ */ idxR.map((idx, i) => idx.map((j) => shifts160[i][j]));
+const Kl160 = /* @__PURE__ */ Uint32Array.from([
+  0x00000000, 0x5a827999, 0x6ed9eba1, 0x8f1bbcdc, 0xa953fd4e,
+]);
+const Kr160 = /* @__PURE__ */ Uint32Array.from([
+  0x50a28be6, 0x5c4dd124, 0x6d703ef3, 0x7a6d76e9, 0x00000000,
+]);
+// It's called f() in spec.
+function ripemd_f(group: number, x: number, y: number, z: number): number {
+  if (group === 0) return x ^ y ^ z;
+  if (group === 1) return (x & y) | (~x & z);
+  if (group === 2) return (x | ~y) ^ z;
+  if (group === 3) return (x & z) | (y & ~z);
+  return x ^ (y | ~z);
+}
+// Reusable temporary buffer
+const BUF_160 = /* @__PURE__ */ new Uint32Array(16);
+export class _RIPEMD160 extends HashMD<_RIPEMD160> {
+  private h0 = 0x67452301 | 0;
+  private h1 = 0xefcdab89 | 0;
+  private h2 = 0x98badcfe | 0;
+  private h3 = 0x10325476 | 0;
+  private h4 = 0xc3d2e1f0 | 0;
+
+  constructor() {
+    super(64, 20, 8, true);
+  }
+  protected get(): [number, number, number, number, number] {
+    const { h0, h1, h2, h3, h4 } = this;
+    return [h0, h1, h2, h3, h4];
+  }
+  protected set(h0: number, h1: number, h2: number, h3: number, h4: number): void {
+    this.h0 = h0 | 0;
+    this.h1 = h1 | 0;
+    this.h2 = h2 | 0;
+    this.h3 = h3 | 0;
+    this.h4 = h4 | 0;
+  }
+  protected process(view: DataView, offset: number): void {
+    for (let i = 0; i < 16; i++, offset += 4) BUF_160[i] = view.getUint32(offset, true);
+    // prettier-ignore
+    let al = this.h0 | 0, ar = al,
+        bl = this.h1 | 0, br = bl,
+        cl = this.h2 | 0, cr = cl,
+        dl = this.h3 | 0, dr = dl,
+        el = this.h4 | 0, er = el;
+
+    // Instead of iterating 0 to 80, we split it into 5 groups
+    // And use the groups in constants, functions, etc. Much simpler
+    for (let group = 0; group < 5; group++) {
+      const rGroup = 4 - group;
+      const hbl = Kl160[group], hbr = Kr160[group]; // prettier-ignore
+      const rl = idxL[group], rr = idxR[group]; // prettier-ignore
+      const sl = shiftsL160[group], sr = shiftsR160[group]; // prettier-ignore
+      for (let i = 0; i < 16; i++) {
+        const tl = (rotl(al + ripemd_f(group, bl, cl, dl) + BUF_160[rl[i]] + hbl, sl[i]) + el) | 0;
+        al = el, el = dl, dl = rotl(cl, 10) | 0, cl = bl, bl = tl; // prettier-ignore
+      }
+      // 2 loops are 10% faster
+      for (let i = 0; i < 16; i++) {
+        const tr = (rotl(ar + ripemd_f(rGroup, br, cr, dr) + BUF_160[rr[i]] + hbr, sr[i]) + er) | 0;
+        ar = er, er = dr, dr = rotl(cr, 10) | 0, cr = br, br = tr; // prettier-ignore
+      }
+    }
+    // Add the compressed chunk to the current hash value
+    this.set(
+      (this.h1 + cl + dr) | 0,
+      (this.h2 + dl + er) | 0,
+      (this.h3 + el + ar) | 0,
+      (this.h4 + al + br) | 0,
+      (this.h0 + bl + cr) | 0
+    );
+  }
+  protected roundClean(): void {
+    clean(BUF_160);
+  }
+  destroy(): void {
+    this.destroyed = true;
+    clean(this.buffer);
+    this.set(0, 0, 0, 0, 0);
+  }
+}
+
+/**
+ * RIPEMD-160 - a legacy hash function from 1990s.
+ * * https://homes.esat.kuleuven.be/~bosselae/ripemd160.html
+ * * https://homes.esat.kuleuven.be/~bosselae/ripemd160/pdf/AB-9601/AB-9601.pdf
+ */
+export const ripemd160: CHash = /* @__PURE__ */ createHasher(() => new _RIPEMD160());

package/node_modules/@noble/hashes/src/pbkdf2.ts

@@ -0,0 +1,129 @@
+/**
+ * PBKDF (RFC 2898). Can be used to create a key from password and salt.
+ * @module
+ */
+import { hmac } from './hmac.ts';
+// prettier-ignore
+import {
+  ahash, anumber,
+  asyncLoop, checkOpts, clean, createView, kdfInputToBytes,
+  type CHash,
+  type Hash,
+  type KDFInput
+} from './utils.ts';
+
+/**
+ * PBKDF2 options:
+ * * c: iterations, should probably be higher than 100_000
+ * * dkLen: desired length of derived key in bytes
+ * * asyncTick: max time in ms for which async function can block execution
+ */
+export type Pbkdf2Opt = {
+  c: number;
+  dkLen?: number;
+  asyncTick?: number;
+};
+// Common start and end for sync/async functions
+function pbkdf2Init(hash: CHash, _password: KDFInput, _salt: KDFInput, _opts: Pbkdf2Opt) {
+  ahash(hash);
+  const opts = checkOpts({ dkLen: 32, asyncTick: 10 }, _opts);
+  const { c, dkLen, asyncTick } = opts;
+  anumber(c, 'c');
+  anumber(dkLen, 'dkLen');
+  anumber(asyncTick, 'asyncTick');
+  if (c < 1) throw new Error('iterations (c) must be >= 1');
+  const password = kdfInputToBytes(_password, 'password');
+  const salt = kdfInputToBytes(_salt, 'salt');
+  // DK = PBKDF2(PRF, Password, Salt, c, dkLen);
+  const DK = new Uint8Array(dkLen);
+  // U1 = PRF(Password, Salt + INT_32_BE(i))
+  const PRF = hmac.create(hash, password);
+  const PRFSalt = PRF._cloneInto().update(salt);
+  return { c, dkLen, asyncTick, DK, PRF, PRFSalt };
+}
+
+function pbkdf2Output<T extends Hash<T>>(
+  PRF: Hash<T>,
+  PRFSalt: Hash<T>,
+  DK: Uint8Array,
+  prfW: Hash<T>,
+  u: Uint8Array
+) {
+  PRF.destroy();
+  PRFSalt.destroy();
+  if (prfW) prfW.destroy();
+  clean(u);
+  return DK;
+}
+
+/**
+ * PBKDF2-HMAC: RFC 2898 key derivation function
+ * @param hash - hash function that would be used e.g. sha256
+ * @param password - password from which a derived key is generated
+ * @param salt - cryptographic salt
+ * @param opts - {c, dkLen} where c is work factor and dkLen is output message size
+ * @example
+ * const key = pbkdf2(sha256, 'password', 'salt', { dkLen: 32, c: Math.pow(2, 18) });
+ */
+export function pbkdf2(
+  hash: CHash,
+  password: KDFInput,
+  salt: KDFInput,
+  opts: Pbkdf2Opt
+): Uint8Array {
+  const { c, dkLen, DK, PRF, PRFSalt } = pbkdf2Init(hash, password, salt, opts);
+  let prfW: any; // Working copy
+  const arr = new Uint8Array(4);
+  const view = createView(arr);
+  const u = new Uint8Array(PRF.outputLen);
+  // DK = T1 + T2 + ⋯ + Tdklen/hlen
+  for (let ti = 1, pos = 0; pos < dkLen; ti++, pos += PRF.outputLen) {
+    // Ti = F(Password, Salt, c, i)
+    const Ti = DK.subarray(pos, pos + PRF.outputLen);
+    view.setInt32(0, ti, false);
+    // F(Password, Salt, c, i) = U1 ^ U2 ^ ⋯ ^ Uc
+    // U1 = PRF(Password, Salt + INT_32_BE(i))
+    (prfW = PRFSalt._cloneInto(prfW)).update(arr).digestInto(u);
+    Ti.set(u.subarray(0, Ti.length));
+    for (let ui = 1; ui < c; ui++) {
+      // Uc = PRF(Password, Uc−1)
+      PRF._cloneInto(prfW).update(u).digestInto(u);
+      for (let i = 0; i < Ti.length; i++) Ti[i] ^= u[i];
+    }
+  }
+  return pbkdf2Output(PRF, PRFSalt, DK, prfW, u);
+}
+
+/**
+ * PBKDF2-HMAC: RFC 2898 key derivation function. Async version.
+ * @example
+ * await pbkdf2Async(sha256, 'password', 'salt', { dkLen: 32, c: 500_000 });
+ */
+export async function pbkdf2Async(
+  hash: CHash,
+  password: KDFInput,
+  salt: KDFInput,
+  opts: Pbkdf2Opt
+): Promise<Uint8Array> {
+  const { c, dkLen, asyncTick, DK, PRF, PRFSalt } = pbkdf2Init(hash, password, salt, opts);
+  let prfW: any; // Working copy
+  const arr = new Uint8Array(4);
+  const view = createView(arr);
+  const u = new Uint8Array(PRF.outputLen);
+  // DK = T1 + T2 + ⋯ + Tdklen/hlen
+  for (let ti = 1, pos = 0; pos < dkLen; ti++, pos += PRF.outputLen) {
+    // Ti = F(Password, Salt, c, i)
+    const Ti = DK.subarray(pos, pos + PRF.outputLen);
+    view.setInt32(0, ti, false);
+    // F(Password, Salt, c, i) = U1 ^ U2 ^ ⋯ ^ Uc
+    // U1 = PRF(Password, Salt + INT_32_BE(i))
+    (prfW = PRFSalt._cloneInto(prfW)).update(arr).digestInto(u);
+    Ti.set(u.subarray(0, Ti.length));
+    await asyncLoop(c - 1, asyncTick, () => {
+      // Uc = PRF(Password, Uc−1)
+      PRF._cloneInto(prfW).update(u).digestInto(u);
+      for (let i = 0; i < Ti.length; i++) Ti[i] ^= u[i];
+    });
+  }
+  return pbkdf2Output(PRF, PRFSalt, DK, prfW, u);
+}

package/node_modules/@noble/hashes/src/scrypt.ts

@@ -0,0 +1,249 @@
+/**
+ * RFC 7914 Scrypt KDF. Can be used to create a key from password and salt.
+ * @module
+ */
+import { pbkdf2 } from './pbkdf2.ts';
+import { sha256 } from './sha2.ts';
+// prettier-ignore
+import {
+  anumber, asyncLoop,
+  checkOpts, clean,
+  type KDFInput, rotl,
+  swap32IfBE,
+  u32
+} from './utils.ts';
+
+// The main Scrypt loop: uses Salsa extensively.
+// Six versions of the function were tried, this is the fastest one.
+// prettier-ignore
+function XorAndSalsa(
+  prev: Uint32Array,
+  pi: number,
+  input: Uint32Array,
+  ii: number,
+  out: Uint32Array,
+  oi: number
+) {
+  // Based on https://cr.yp.to/salsa20.html
+  // Xor blocks
+  let y00 = prev[pi++] ^ input[ii++], y01 = prev[pi++] ^ input[ii++];
+  let y02 = prev[pi++] ^ input[ii++], y03 = prev[pi++] ^ input[ii++];
+  let y04 = prev[pi++] ^ input[ii++], y05 = prev[pi++] ^ input[ii++];
+  let y06 = prev[pi++] ^ input[ii++], y07 = prev[pi++] ^ input[ii++];
+  let y08 = prev[pi++] ^ input[ii++], y09 = prev[pi++] ^ input[ii++];
+  let y10 = prev[pi++] ^ input[ii++], y11 = prev[pi++] ^ input[ii++];
+  let y12 = prev[pi++] ^ input[ii++], y13 = prev[pi++] ^ input[ii++];
+  let y14 = prev[pi++] ^ input[ii++], y15 = prev[pi++] ^ input[ii++];
+  // Save state to temporary variables (salsa)
+  let x00 = y00, x01 = y01, x02 = y02, x03 = y03,
+      x04 = y04, x05 = y05, x06 = y06, x07 = y07,
+      x08 = y08, x09 = y09, x10 = y10, x11 = y11,
+      x12 = y12, x13 = y13, x14 = y14, x15 = y15;
+  // Main loop (salsa)
+  for (let i = 0; i < 8; i += 2) {
+    x04 ^= rotl(x00 + x12 | 0,  7); x08 ^= rotl(x04 + x00 | 0,  9);
+    x12 ^= rotl(x08 + x04 | 0, 13); x00 ^= rotl(x12 + x08 | 0, 18);
+    x09 ^= rotl(x05 + x01 | 0,  7); x13 ^= rotl(x09 + x05 | 0,  9);
+    x01 ^= rotl(x13 + x09 | 0, 13); x05 ^= rotl(x01 + x13 | 0, 18);
+    x14 ^= rotl(x10 + x06 | 0,  7); x02 ^= rotl(x14 + x10 | 0,  9);
+    x06 ^= rotl(x02 + x14 | 0, 13); x10 ^= rotl(x06 + x02 | 0, 18);
+    x03 ^= rotl(x15 + x11 | 0,  7); x07 ^= rotl(x03 + x15 | 0,  9);
+    x11 ^= rotl(x07 + x03 | 0, 13); x15 ^= rotl(x11 + x07 | 0, 18);
+    x01 ^= rotl(x00 + x03 | 0,  7); x02 ^= rotl(x01 + x00 | 0,  9);
+    x03 ^= rotl(x02 + x01 | 0, 13); x00 ^= rotl(x03 + x02 | 0, 18);
+    x06 ^= rotl(x05 + x04 | 0,  7); x07 ^= rotl(x06 + x05 | 0,  9);
+    x04 ^= rotl(x07 + x06 | 0, 13); x05 ^= rotl(x04 + x07 | 0, 18);
+    x11 ^= rotl(x10 + x09 | 0,  7); x08 ^= rotl(x11 + x10 | 0,  9);
+    x09 ^= rotl(x08 + x11 | 0, 13); x10 ^= rotl(x09 + x08 | 0, 18);
+    x12 ^= rotl(x15 + x14 | 0,  7); x13 ^= rotl(x12 + x15 | 0,  9);
+    x14 ^= rotl(x13 + x12 | 0, 13); x15 ^= rotl(x14 + x13 | 0, 18);
+  }
+  // Write output (salsa)
+  out[oi++] = (y00 + x00) | 0; out[oi++] = (y01 + x01) | 0;
+  out[oi++] = (y02 + x02) | 0; out[oi++] = (y03 + x03) | 0;
+  out[oi++] = (y04 + x04) | 0; out[oi++] = (y05 + x05) | 0;
+  out[oi++] = (y06 + x06) | 0; out[oi++] = (y07 + x07) | 0;
+  out[oi++] = (y08 + x08) | 0; out[oi++] = (y09 + x09) | 0;
+  out[oi++] = (y10 + x10) | 0; out[oi++] = (y11 + x11) | 0;
+  out[oi++] = (y12 + x12) | 0; out[oi++] = (y13 + x13) | 0;
+  out[oi++] = (y14 + x14) | 0; out[oi++] = (y15 + x15) | 0;
+}
+
+function BlockMix(input: Uint32Array, ii: number, out: Uint32Array, oi: number, r: number) {
+  // The block B is r 128-byte chunks (which is equivalent of 2r 64-byte chunks)
+  let head = oi + 0;
+  let tail = oi + 16 * r;
+  for (let i = 0; i < 16; i++) out[tail + i] = input[ii + (2 * r - 1) * 16 + i]; // X ← B[2r−1]
+  for (let i = 0; i < r; i++, head += 16, ii += 16) {
+    // We write odd & even Yi at same time. Even: 0bXXXXX0 Odd:  0bXXXXX1
+    XorAndSalsa(out, tail, input, ii, out, head); // head[i] = Salsa(blockIn[2*i] ^ tail[i-1])
+    if (i > 0) tail += 16; // First iteration overwrites tmp value in tail
+    XorAndSalsa(out, head, input, (ii += 16), out, tail); // tail[i] = Salsa(blockIn[2*i+1] ^ head[i])
+  }
+}
+
+/**
+ * Scrypt options:
+ * - `N` is cpu/mem work factor (power of 2 e.g. `2**18`)
+ * - `r` is block size (8 is common), fine-tunes sequential memory read size and performance
+ * - `p` is parallelization factor (1 is common)
+ * - `dkLen` is output key length in bytes e.g. 32.
+ * - `asyncTick` - (default: 10) max time in ms for which async function can block execution
+ * - `maxmem` - (default: `1024 ** 3 + 1024` aka 1GB+1KB). A limit that the app could use for scrypt
+ * - `onProgress` - callback function that would be executed for progress report
+ */
+export type ScryptOpts = {
+  N: number; // cost factor
+  r: number; // block size
+  p: number; // parallelization
+  dkLen?: number; // key length
+  asyncTick?: number; // block execution max time
+  maxmem?: number;
+  onProgress?: (progress: number) => void;
+};
+
+// Common prologue and epilogue for sync/async functions
+function scryptInit(password: KDFInput, salt: KDFInput, _opts?: ScryptOpts) {
+  // Maxmem - 1GB+1KB by default
+  const opts = checkOpts(
+    {
+      dkLen: 32,
+      asyncTick: 10,
+      maxmem: 1024 ** 3 + 1024,
+    },
+    _opts
+  );
+  const { N, r, p, dkLen, asyncTick, maxmem, onProgress } = opts;
+  anumber(N, 'N');
+  anumber(r, 'r');
+  anumber(p, 'p');
+  anumber(dkLen, 'dkLen');
+  anumber(asyncTick, 'asyncTick');
+  anumber(maxmem, 'maxmem');
+  if (onProgress !== undefined && typeof onProgress !== 'function')
+    throw new Error('progressCb must be a function');
+  const blockSize = 128 * r;
+  const blockSize32 = blockSize / 4;
+
+  // Max N is 2^32 (Integrify is 32-bit).
+  // Real limit can be 2^22: some JS engines limit Uint8Array to 4GB.
+  // Spec check `N >= 2^(blockSize / 8)` is not done for compat with popular libs,
+  // which used incorrect r: 1, p: 8. Also, the check seems to be a spec error:
+  // https://www.rfc-editor.org/errata_search.php?rfc=7914
+  const pow32 = Math.pow(2, 32);
+  if (N <= 1 || (N & (N - 1)) !== 0 || N > pow32)
+    throw new Error('"N" expected a power of 2, and 2^1 <= N <= 2^32');
+  if (p < 1 || p > ((pow32 - 1) * 32) / blockSize)
+    throw new Error('"p" expected integer 1..((2^32 - 1) * 32) / (128 * r)');
+  if (dkLen < 1 || dkLen > (pow32 - 1) * 32)
+    throw new Error('"dkLen" expected integer 1..(2^32 - 1) * 32');
+  const memUsed = blockSize * (N + p);
+  if (memUsed > maxmem)
+    throw new Error('"maxmem" limit was hit, expected 128*r*(N+p) <= "maxmem"=' + maxmem);
+  // [B0...Bp−1] ← PBKDF2HMAC-SHA256(Passphrase, Salt, 1, blockSize*ParallelizationFactor)
+  // Since it has only one iteration there is no reason to use async variant
+  const B = pbkdf2(sha256, password, salt, { c: 1, dkLen: blockSize * p });
+  const B32 = u32(B);
+  // Re-used between parallel iterations. Array(iterations) of B
+  const V = u32(new Uint8Array(blockSize * N));
+  const tmp = u32(new Uint8Array(blockSize));
+  let blockMixCb = () => {};
+  if (onProgress) {
+    const totalBlockMix = 2 * N * p;
+    // Invoke callback if progress changes from 10.01 to 10.02
+    // Allows to draw smooth progress bar on up to 8K screen
+    const callbackPer = Math.max(Math.floor(totalBlockMix / 10000), 1);
+    let blockMixCnt = 0;
+    blockMixCb = () => {
+      blockMixCnt++;
+      if (onProgress && (!(blockMixCnt % callbackPer) || blockMixCnt === totalBlockMix))
+        onProgress(blockMixCnt / totalBlockMix);
+    };
+  }
+  return { N, r, p, dkLen, blockSize32, V, B32, B, tmp, blockMixCb, asyncTick };
+}
+
+function scryptOutput(
+  password: KDFInput,
+  dkLen: number,
+  B: Uint8Array,
+  V: Uint32Array,
+  tmp: Uint32Array
+) {
+  const res = pbkdf2(sha256, password, B, { c: 1, dkLen });
+  clean(B, V, tmp);
+  return res;
+}
+
+/**
+ * Scrypt KDF from RFC 7914. See {@link ScryptOpts}.
+ * @example
+ * scrypt('password', 'salt', { N: 2**18, r: 8, p: 1, dkLen: 32 });
+ */
+export function scrypt(password: KDFInput, salt: KDFInput, opts: ScryptOpts): Uint8Array {
+  const { N, r, p, dkLen, blockSize32, V, B32, B, tmp, blockMixCb } = scryptInit(
+    password,
+    salt,
+    opts
+  );
+  swap32IfBE(B32);
+  for (let pi = 0; pi < p; pi++) {
+    const Pi = blockSize32 * pi;
+    for (let i = 0; i < blockSize32; i++) V[i] = B32[Pi + i]; // V[0] = B[i]
+    for (let i = 0, pos = 0; i < N - 1; i++) {
+      BlockMix(V, pos, V, (pos += blockSize32), r); // V[i] = BlockMix(V[i-1]);
+      blockMixCb();
+    }
+    BlockMix(V, (N - 1) * blockSize32, B32, Pi, r); // Process last element
+    blockMixCb();
+    for (let i = 0; i < N; i++) {
+      // First u32 of the last 64-byte block (u32 is LE)
+      // & (N - 1) is % N as N is a power of 2, N & (N - 1) = 0 is checked above; >>> 0 for unsigned, input fits in u32
+      const j = (B32[Pi + blockSize32 - 16] & (N - 1)) >>> 0; // j = Integrify(X) % iterations
+      for (let k = 0; k < blockSize32; k++) tmp[k] = B32[Pi + k] ^ V[j * blockSize32 + k]; // tmp = B ^ V[j]
+      BlockMix(tmp, 0, B32, Pi, r); // B = BlockMix(B ^ V[j])
+      blockMixCb();
+    }
+  }
+  swap32IfBE(B32);
+  return scryptOutput(password, dkLen, B, V, tmp);
+}
+
+/**
+ * Scrypt KDF from RFC 7914. Async version. See {@link ScryptOpts}.
+ * @example
+ * await scryptAsync('password', 'salt', { N: 2**18, r: 8, p: 1, dkLen: 32 });
+ */
+export async function scryptAsync(
+  password: KDFInput,
+  salt: KDFInput,
+  opts: ScryptOpts
+): Promise<Uint8Array> {
+  const { N, r, p, dkLen, blockSize32, V, B32, B, tmp, blockMixCb, asyncTick } = scryptInit(
+    password,
+    salt,
+    opts
+  );
+  swap32IfBE(B32);
+  for (let pi = 0; pi < p; pi++) {
+    const Pi = blockSize32 * pi;
+    for (let i = 0; i < blockSize32; i++) V[i] = B32[Pi + i]; // V[0] = B[i]
+    let pos = 0;
+    await asyncLoop(N - 1, asyncTick, () => {
+      BlockMix(V, pos, V, (pos += blockSize32), r); // V[i] = BlockMix(V[i-1]);
+      blockMixCb();
+    });
+    BlockMix(V, (N - 1) * blockSize32, B32, Pi, r); // Process last element
+    blockMixCb();
+    await asyncLoop(N, asyncTick, () => {
+      // First u32 of the last 64-byte block (u32 is LE)
+      // & (N - 1) is % N as N is a power of 2, N & (N - 1) = 0 is checked above; >>> 0 for unsigned, input fits in u32
+      const j = (B32[Pi + blockSize32 - 16] & (N - 1)) >>> 0; // j = Integrify(X) % iterations
+      for (let k = 0; k < blockSize32; k++) tmp[k] = B32[Pi + k] ^ V[j * blockSize32 + k]; // tmp = B ^ V[j]
+      BlockMix(tmp, 0, B32, Pi, r); // B = BlockMix(B ^ V[j])
+      blockMixCb();
+    });
+  }
+  swap32IfBE(B32);
+  return scryptOutput(password, dkLen, B, V, tmp);
+}