{"version":3,"sources":["jsdelivr-header.js","/npm/@aws-sdk/cloudfront-signer@3.965.0/dist-cjs/index.js"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA,ACNA,aAEA,IAAI,UAAY,QAAQ,0BACpB,OAAS,QAAQ,UAErB,SAAS,cAAa,aAAE,EAAY,gBAAE,EAAe,IAAE,EAAG,UAAE,EAAS,WAAE,EAAU,UAAE,EAAS,OAAE,EAAM,WAAE,IAClG,MAAM,EAAwB,IAAI,sBAAsB,CACpD,YACA,aACA,eAEJ,IAAK,IAAQ,EACT,MAAM,IAAI,MAAM,iEAapB,IAAI,EACJ,GAZI,EACA,EAAsB,gBAAgB,GAGtC,EAAsB,oBAAoB,CACtC,MACA,eACA,kBACA,cAIJ,EACA,EAAU,OAET,GAAI,EAAQ,CACb,MAAM,EAAY,mBAAmB,GACrC,IAAK,EAAU,GACX,MAAM,IAAI,MAAM,iHAEpB,EAAU,EAAU,GAAG,QAAQ,OAAQ,WAC3C,CACA,MAAM,EAAY,EAAQ,SAAS,KAAO,IAAM,IAC1C,EAAS,OAAO,QAAQ,EAAsB,6BAC/C,QAAO,EAAE,CAAE,UAAqB,IAAV,IACtB,KAAI,EAAE,EAAK,KAAW,GAAG,UAAU,2BAA2B,MAAQ,UAAU,2BAA2B,OAC3G,KAAK,KAWV,MAAM,EAVN,SAA4B,GACxB,GAAI,EAAI,SAAS,KAAM,CACnB,MAAO,EAAa,GAAS,EAAI,MAAM,KAIvC,MAAO,GAAG,KAHK,IAAI,IAAI,gBAAgB,GAAO,WACzC,KAAI,EAAE,EAAK,KAAW,GAAG,mBAAmB,MAAQ,mBAAmB,OACvE,KAAK,MAEd,CACA,OAAO,CACX,CACkB,CAAmB,GAAW,EAAY,EAC5D,OAAO,YAAY,EACvB,CACA,SAAS,kBAAiB,UAAE,EAAS,IAAE,EAAG,WAAE,EAAU,UAAE,EAAS,aAAE,EAAY,gBAAE,EAAe,OAAE,EAAM,WAAE,IACtG,MAAM,EAAwB,IAAI,sBAAsB,CACpD,YACA,aACA,eAEA,EACA,EAAsB,gBAAgB,GAGtC,EAAsB,oBAAoB,CACtC,MACA,eACA,kBACA,cAGR,MAAM,EAA6B,EAAsB,4BACnD,EAAU,CACZ,yBAA0B,EAA2B,eACrD,uBAAwB,EAAsC,WAQlE,OANI,EAAoC,UACpC,EAAQ,sBAAwB,EAAoC,SAEpE,EAAmC,SACnC,EAAQ,qBAAuB,EAAmC,QAE/D,CACX,CACA,SAAS,mBAAmB,GACxB,MAAM,EAAiC,iBAAX,EAAsB,KAAK,MAAM,GAAU,EACvE,OAAQ,GAAc,WAAa,IAAI,KAAK,GAAM,EAAE,UACxD,CACA,SAAS,YAAY,GACjB,MAAM,EAAW,EAAU,MAAM,EAAG,EAAU,QAAQ,OACtD,OAAQ,GACJ,IAAK,QACL,IAAK,SACL,IAAK,MACL,IAAK,OACD,OAAO,EACX,IAAK,QACD,MACM,EAAS,GAAG,MADN,IAAI,IAAI,GACe,WACnC,OAAO,EAAU,UAAU,EAAO,QAAQ,QAAQ,cAAe,IACrE,QACI,MAAM,IAAI,MAAM,kEAE5B,CACA,MAAM,sBACF,UACA,WACA,WACA,OACA,cAAe,EACf,aACA,WAAA,EAAY,WAAE,EAAU,UAAE,EAAS,WAAE,IACjC,KAAK,UAAY,EACjB,KAAK,WAAa,EAClB,KAAK,OAAS,GACd,KAAK,WAAa,CACtB,CACA,WAAA,CAAY,GACR,MAAM,EAAS,CACX,UAAW,CACP,CACI,SAAU,EAAK,SACf,UAAW,CACP,aAAc,CACV,gBAAiB,EAAK,kBAW1C,GALI,EAAK,kBACL,EAAO,UAAU,GAAG,UAA2B,gBAAI,CAC/C,gBAAiB,EAAK,kBAG1B,EAAK,UAAW,CAChB,MAAM,EAAO,KAAK,UAAU,EAAK,WACjC,EAAO,UAAU,GAAG,UAAqB,UAAI,CACzC,eAAgB,EAExB,CACA,OAAO,CACX,CACA,eAAA,CAAgB,GACZ,MAAM,EAAe,CACjB,IAAK,IACL,IAAK,IACL,IAAK,KAET,OAAO,EAAI,QAAQ,UAAU,SAAU,GACnC,OAAO,EAAa,EACxB,GACJ,CACA,cAAA,CAAe,GACX,OAAO,KAAK,gBAAgB,OAAO,KAAK,GAAK,SAAS,UAC1D,CACA,UAAA,CAAW,GACP,MAAM,EAAS,EAAM,MAAM,KAC3B,GAAsB,IAAlB,EAAO,OACP,MAAM,IAAI,MAAM,oCAMpB,IAJgB,EAAO,OAAO,IAC1B,MAAM,EAAM,OAAO,GACnB,OAAO,OAAO,UAAU,IAAQ,GAAO,GAAK,GAAO,GAAG,IAGtD,MAAM,IAAI,MAAM,oBAExB,CACA,YAAA,CAAa,GACT,MAAM,EAAO,OAAO,GAEpB,KADgB,OAAO,UAAU,IAAS,GAAQ,GAAK,GAAQ,IAE3D,MAAM,IAAI,MAAM,eAExB,CACA,SAAA,CAAU,GACN,IACI,MAAM,EAAY,EAAQ,MAAM,KAChC,GAAI,EAAU,MAAM,GAAyB,IAAhB,EAAK,SAC9B,MAAM,IAAI,MAAM,mCAEpB,KAAK,WAAW,EAAU,IAC1B,IAAI,EAAO,KAKX,OAJyB,IAArB,EAAU,SACV,KAAK,aAAa,EAAU,IAC5B,EAAO,EAAU,IAEd,GAAG,EAAU,MAAM,GAC9B,CACA,MAAO,GACH,MAAM,EAAa,eAAe,gBAClC,MAAI,aAAiB,MACX,IAAI,MAAM,GAAG,YAAqB,EAAM,YAGxC,IAAI,MAAM,GAAG,KAE3B,CACJ,CACA,SAAA,CAAU,GACN,OAAO,KAAK,MAAM,EAAK,UAAY,IACvC,CACA,SAAA,CAAU,GACN,IAAK,EACD,OAEJ,MAAM,EAAa,IAAI,KAAK,GAC5B,OAAO,MAAM,EAAW,gBAAa,EAAY,KAAK,UAAU,EACpE,CACA,eAAA,CAAgB,EAAY,GACxB,MAAM,EAAe,KAAK,UAAU,GACpC,IAAK,EACD,MAAM,IAAI,MAAM,2FAEpB,MAAO,CACH,eACA,gBAAiB,KAAK,UAAU,GAExC,CACA,QAAA,CAAS,EAAM,EAAY,GACvB,MAAM,EAAO,OAAO,WAAW,YAE/B,OADA,EAAK,OAAO,GACL,EAAK,KAAK,CAAE,IAAK,EAAY,cAAc,SACtD,CACA,UAAA,CAAW,EAAQ,EAAY,GAC3B,OAAO,KAAK,gBAAgB,KAAK,SAAS,EAAQ,EAAY,GAClE,CACA,eAAA,CAAgB,GACZ,KAAK,cAAe,EACpB,KAAK,OAAS,CAClB,CACA,mBAAA,EAAoB,IAAE,EAAG,aAAE,EAAY,gBAAE,EAAe,UAAE,IACtD,IAAK,IAAQ,EACT,OAAO,EAEX,MAAM,EAAW,YAAY,GACvB,EAAc,KAAK,gBAAgB,EAAc,GACvD,KAAK,aAAe,EAAY,aAChC,KAAK,aAAe,QAAQ,EAAY,kBAAoB,QAAQ,GACpE,KAAK,OAAS,KAAK,UAAU,KAAK,YAAY,CAC1C,WACA,YACA,aAAc,EAAY,aAC1B,gBAAiB,EAAY,kBAErC,CACA,yBAAA,GACI,IAAK,QAAQ,KAAK,QACd,MAAM,IAAI,MAAM,kBAEpB,MAAM,EAAY,KAAK,WAAW,KAAK,OAAQ,KAAK,WAAY,KAAK,YACrE,MAAO,CACH,QAAS,KAAK,kBAAe,EAAY,KAAK,aAC9C,OAAQ,KAAK,aAAe,KAAK,eAAe,KAAK,aAAU,EAC/D,cAAe,KAAK,UACpB,UAAW,EAEnB,EAGJ,QAAQ,iBAAmB,iBAC3B,QAAQ,aAAe","file":"/npm/@aws-sdk/cloudfront-signer@3.965.0/dist-cjs/index.js","sourceRoot":"","sourcesContent":["/**\n * Minified by jsDelivr using Terser v5.39.0.\n * Original file: /npm/@aws-sdk/cloudfront-signer@3.965.0/dist-cjs/index.js\n *\n * Do NOT use SRI with dynamically generated files! More information: https://www.jsdelivr.com/using-sri-with-dynamic-files\n */\n","'use strict';\n\nvar protocols = require('@smithy/core/protocols');\nvar crypto = require('crypto');\n\nfunction getSignedUrl({ dateLessThan, dateGreaterThan, url, keyPairId, privateKey, ipAddress, policy, passphrase, }) {\n    const cloudfrontSignBuilder = new CloudfrontSignBuilder({\n        keyPairId,\n        privateKey,\n        passphrase,\n    });\n    if (!url && !policy) {\n        throw new Error(\"@aws-sdk/cloudfront-signer: Please provide 'url' or 'policy'.\");\n    }\n    if (policy) {\n        cloudfrontSignBuilder.setCustomPolicy(policy);\n    }\n    else {\n        cloudfrontSignBuilder.setPolicyParameters({\n            url,\n            dateLessThan,\n            dateGreaterThan,\n            ipAddress,\n        });\n    }\n    let baseUrl;\n    if (url) {\n        baseUrl = url;\n    }\n    else if (policy) {\n        const resources = getPolicyResources(policy);\n        if (!resources[0]) {\n            throw new Error(\"@aws-sdk/cloudfront-signer: No URL provided and unable to determine URL from first policy statement resource.\");\n        }\n        baseUrl = resources[0].replace(\"*://\", \"https://\");\n    }\n    const startFlag = baseUrl.includes(\"?\") ? \"&\" : \"?\";\n    const params = Object.entries(cloudfrontSignBuilder.createCloudfrontAttribute())\n        .filter(([, value]) => value !== undefined)\n        .map(([key, value]) => `${protocols.extendedEncodeURIComponent(key)}=${protocols.extendedEncodeURIComponent(value)}`)\n        .join(\"&\");\n    function encodeBaseUrlQuery(url) {\n        if (url.includes(\"?\")) {\n            const [hostAndPath, query] = url.split(\"?\");\n            const params = [...new URLSearchParams(query).entries()]\n                .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)\n                .join(\"&\");\n            return `${hostAndPath}?${params}`;\n        }\n        return url;\n    }\n    const urlString = encodeBaseUrlQuery(baseUrl) + startFlag + params;\n    return getResource(urlString);\n}\nfunction getSignedCookies({ ipAddress, url, privateKey, keyPairId, dateLessThan, dateGreaterThan, policy, passphrase, }) {\n    const cloudfrontSignBuilder = new CloudfrontSignBuilder({\n        keyPairId,\n        privateKey,\n        passphrase,\n    });\n    if (policy) {\n        cloudfrontSignBuilder.setCustomPolicy(policy);\n    }\n    else {\n        cloudfrontSignBuilder.setPolicyParameters({\n            url,\n            dateLessThan,\n            dateGreaterThan,\n            ipAddress,\n        });\n    }\n    const cloudfrontCookieAttributes = cloudfrontSignBuilder.createCloudfrontAttribute();\n    const cookies = {\n        \"CloudFront-Key-Pair-Id\": cloudfrontCookieAttributes[\"Key-Pair-Id\"],\n        \"CloudFront-Signature\": cloudfrontCookieAttributes[\"Signature\"],\n    };\n    if (cloudfrontCookieAttributes[\"Expires\"]) {\n        cookies[\"CloudFront-Expires\"] = cloudfrontCookieAttributes[\"Expires\"];\n    }\n    if (cloudfrontCookieAttributes[\"Policy\"]) {\n        cookies[\"CloudFront-Policy\"] = cloudfrontCookieAttributes[\"Policy\"];\n    }\n    return cookies;\n}\nfunction getPolicyResources(policy) {\n    const parsedPolicy = typeof policy === \"string\" ? JSON.parse(policy) : policy;\n    return (parsedPolicy?.Statement ?? []).map((s) => s.Resource);\n}\nfunction getResource(urlString) {\n    const protocol = urlString.slice(0, urlString.indexOf(\"//\"));\n    switch (protocol) {\n        case \"http:\":\n        case \"https:\":\n        case \"ws:\":\n        case \"wss:\":\n            return urlString;\n        case \"rtmp:\":\n            const url = new URL(urlString);\n            const origin = `${protocol}//${url.hostname}`;\n            return urlString.substring(origin.length).replace(/(?::\\d+)?\\//, \"\");\n        default:\n            throw new Error(\"Invalid URI scheme. Scheme must be one of http, https, or rtmp\");\n    }\n}\nclass CloudfrontSignBuilder {\n    keyPairId;\n    privateKey;\n    passphrase;\n    policy;\n    customPolicy = false;\n    dateLessThan;\n    constructor({ privateKey, keyPairId, passphrase }) {\n        this.keyPairId = keyPairId;\n        this.privateKey = privateKey;\n        this.policy = \"\";\n        this.passphrase = passphrase;\n    }\n    buildPolicy(args) {\n        const policy = {\n            Statement: [\n                {\n                    Resource: args.resource,\n                    Condition: {\n                        DateLessThan: {\n                            \"AWS:EpochTime\": args.dateLessThan,\n                        },\n                    },\n                },\n            ],\n        };\n        if (args.dateGreaterThan) {\n            policy.Statement[0].Condition[\"DateGreaterThan\"] = {\n                \"AWS:EpochTime\": args.dateGreaterThan,\n            };\n        }\n        if (args.ipAddress) {\n            const cidr = this.parseCIDR(args.ipAddress);\n            policy.Statement[0].Condition[\"IpAddress\"] = {\n                \"AWS:SourceIp\": cidr,\n            };\n        }\n        return policy;\n    }\n    normalizeBase64(str) {\n        const replacements = {\n            \"+\": \"-\",\n            \"=\": \"_\",\n            \"/\": \"~\",\n        };\n        return str.replace(/[+=/]/g, function (match) {\n            return replacements[match];\n        });\n    }\n    encodeToBase64(str) {\n        return this.normalizeBase64(Buffer.from(str).toString(\"base64\"));\n    }\n    validateIP(ipStr) {\n        const octets = ipStr.split(\".\");\n        if (octets.length !== 4) {\n            throw new Error(`IP does not contain four octets.`);\n        }\n        const isValid = octets.every((octet) => {\n            const num = Number(octet);\n            return Number.isInteger(num) && num >= 0 && num <= 255;\n        });\n        if (!isValid) {\n            throw new Error(\"invalid IP octets\");\n        }\n    }\n    validateMask(maskStr) {\n        const mask = Number(maskStr);\n        const isValid = Number.isInteger(mask) && mask >= 0 && mask <= 32;\n        if (!isValid) {\n            throw new Error(\"invalid mask\");\n        }\n    }\n    parseCIDR(cidrStr) {\n        try {\n            const cidrParts = cidrStr.split(\"/\");\n            if (cidrParts.some((part) => part.length === 0)) {\n                throw new Error(\"missing ip or mask part of CIDR\");\n            }\n            this.validateIP(cidrParts[0]);\n            let mask = \"32\";\n            if (cidrParts.length === 2) {\n                this.validateMask(cidrParts[1]);\n                mask = cidrParts[1];\n            }\n            return `${cidrParts[0]}/${mask}`;\n        }\n        catch (error) {\n            const errMessage = `IP address \"${cidrStr}\" is invalid`;\n            if (error instanceof Error) {\n                throw new Error(`${errMessage} due to ${error.message}.`);\n            }\n            else {\n                throw new Error(`${errMessage}.`);\n            }\n        }\n    }\n    epochTime(date) {\n        return Math.round(date.getTime() / 1000);\n    }\n    parseDate(date) {\n        if (!date) {\n            return undefined;\n        }\n        const parsedDate = new Date(date);\n        return isNaN(parsedDate.getTime()) ? undefined : this.epochTime(parsedDate);\n    }\n    parseDateWindow(expiration, start) {\n        const dateLessThan = this.parseDate(expiration);\n        if (!dateLessThan) {\n            throw new Error(\"dateLessThan is invalid. Ensure the date value is compatible with the Date constructor.\");\n        }\n        return {\n            dateLessThan,\n            dateGreaterThan: this.parseDate(start),\n        };\n    }\n    signData(data, privateKey, passphrase) {\n        const sign = crypto.createSign(\"RSA-SHA1\");\n        sign.update(data);\n        return sign.sign({ key: privateKey, passphrase }, \"base64\");\n    }\n    signPolicy(policy, privateKey, passphrase) {\n        return this.normalizeBase64(this.signData(policy, privateKey, passphrase));\n    }\n    setCustomPolicy(policy) {\n        this.customPolicy = true;\n        this.policy = policy;\n    }\n    setPolicyParameters({ url, dateLessThan, dateGreaterThan, ipAddress, }) {\n        if (!url || !dateLessThan) {\n            return false;\n        }\n        const resource = getResource(url);\n        const parsedDates = this.parseDateWindow(dateLessThan, dateGreaterThan);\n        this.dateLessThan = parsedDates.dateLessThan;\n        this.customPolicy = Boolean(parsedDates.dateGreaterThan) || Boolean(ipAddress);\n        this.policy = JSON.stringify(this.buildPolicy({\n            resource,\n            ipAddress,\n            dateLessThan: parsedDates.dateLessThan,\n            dateGreaterThan: parsedDates.dateGreaterThan,\n        }));\n    }\n    createCloudfrontAttribute() {\n        if (!Boolean(this.policy)) {\n            throw new Error(\"Invalid policy\");\n        }\n        const signature = this.signPolicy(this.policy, this.privateKey, this.passphrase);\n        return {\n            Expires: this.customPolicy ? undefined : this.dateLessThan,\n            Policy: this.customPolicy ? this.encodeToBase64(this.policy) : undefined,\n            \"Key-Pair-Id\": this.keyPairId,\n            Signature: signature,\n        };\n    }\n}\n\nexports.getSignedCookies = getSignedCookies;\nexports.getSignedUrl = getSignedUrl;\n"]}