{"version":3,"sources":["jsdelivr-header.js","/npm/iron@5.0.6/lib/index.js"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA,ACNA,aAIA,MAAM,OAAS,QAAQ,UAEjB,IAAM,QAAQ,OACd,KAAO,QAAQ,QACf,UAAY,QAAQ,aACpB,KAAO,QAAQ,QAKf,UAAY,CAAC,EAKnB,QAAQ,SAAW,CACf,WAAY,CACR,SAAU,IACV,UAAW,cACX,WAAY,EACZ,kBAAmB,IAGvB,UAAW,CACP,SAAU,IACV,UAAW,SACX,WAAY,EACZ,kBAAmB,IAGvB,IAAK,EACL,iBAAkB,GAClB,oBAAqB,GAMzB,QAAQ,WAAa,CACjB,cAAe,CAAE,QAAS,IAAK,OAAQ,KACvC,cAAe,CAAE,QAAS,IAAK,OAAQ,KACvC,OAAU,CAAE,QAAS,MAMzB,QAAQ,iBAAmB,IAE3B,QAAQ,UAAY,QAAU,QAAQ,iBAgBtC,QAAQ,YAAc,eAAgB,EAAU,GAE5C,IAAK,EACD,MAAM,IAAI,KAAK,kBAGnB,IAAK,GACkB,iBAAZ,EAEP,MAAM,IAAI,KAAK,eAGnB,MAAM,EAAY,QAAQ,WAAW,EAAQ,WAC7C,IAAK,EACD,MAAM,IAAI,KAAK,sBAAwB,EAAQ,WAGnD,MAAM,EAAS,CAAC,EAEhB,GAAI,OAAO,SAAS,GAAW,CAC3B,GAAI,EAAS,OAAS,EAAU,QAAU,EACtC,MAAM,IAAI,KAAK,mCAGnB,EAAO,IAAM,EACb,EAAO,KAAO,EAClB,KACK,CACD,GAAI,EAAS,OAAS,EAAQ,kBAC1B,MAAM,IAAI,KAAK,kCAAoC,EAAQ,kBAAoB,yBAGnF,IAAI,EAAO,EAAQ,KACnB,IAAK,EAAM,CACP,IAAK,EAAQ,SACT,MAAM,IAAI,KAAK,qCAInB,EADmB,UAAU,WAAW,EAAQ,UAC9B,SAAS,MAC/B,CAEA,MAAM,QAAmB,UAAU,OAAO,EAAU,EAAM,EAAQ,WAAY,EAAU,QAAU,EAAG,QAErG,EAAO,IAAM,EACb,EAAO,KAAO,CAClB,CASA,OAPI,EAAQ,GACR,EAAO,GAAK,EAAQ,GAEf,EAAU,SACf,EAAO,GAAK,UAAU,WAAW,EAAU,SAGxC,CACX,EAMA,QAAQ,QAAU,eAAgB,EAAU,EAAS,GAEjD,MAAM,QAAY,QAAQ,YAAY,EAAU,GAC1C,EAAS,OAAO,eAAe,EAAQ,UAAW,EAAI,IAAK,EAAI,IAGrE,MAAO,CAAE,UAFS,OAAO,OAAO,CAAC,EAAO,OAAO,EAAM,QAAS,EAAO,UAEjD,MACxB,EAMA,QAAQ,QAAU,eAAgB,EAAU,EAAS,GAEjD,MAAM,QAAY,QAAQ,YAAY,EAAU,GAC1C,EAAW,OAAO,iBAAiB,EAAQ,UAAW,EAAI,IAAK,EAAI,IACzE,IAAI,EAAM,EAAS,OAAO,EAAM,KAAM,QAGtC,OAFA,GAAY,EAAS,MAAM,QAEpB,CACX,EAMA,QAAQ,iBAAmB,eAAgB,EAAU,EAAS,GAE1D,MAAM,QAAY,QAAQ,YAAY,EAAU,GAShD,MALe,CACX,OAJS,OAAO,WAAW,EAAQ,UAAW,EAAI,KAAK,OAAO,GAC9C,OAAO,UAAU,QAAQ,MAAO,KAAK,QAAQ,MAAO,KAAK,QAAQ,MAAO,IAIxF,KAAM,EAAI,KAIlB,EAMA,UAAU,kBAAoB,SAAU,GAEpC,MAAM,EAAM,CAAC,EAcb,OAZI,aAAoB,SACnB,OAAO,SAAS,IAEjB,EAAI,GAAK,EAAS,GAClB,EAAI,WAAa,EAAS,QAAU,EAAS,WAC7C,EAAI,UAAY,EAAS,QAAU,EAAS,YAG5C,EAAI,WAAa,EACjB,EAAI,UAAY,GAGb,CACX,EAOA,QAAQ,KAAO,eAAgB,EAAQ,EAAU,GAE7C,EAAU,OAAO,OAAO,CAAC,EAAG,GAE5B,MAAM,EAAM,KAAK,OAAS,EAAQ,qBAAuB,GAInD,EAAe,UAAU,UAAU,GAIzC,IAAI,EAAa,GAEjB,IADA,EAAW,UAAU,kBAAkB,IAC1B,GAAI,CACb,IAAK,QAAQ,KAAK,EAAS,IACvB,MAAM,IAAI,KAAK,uBAGnB,EAAa,EAAS,EAC1B,CAIA,MAAM,UAAE,EAAS,IAAE,SAAc,QAAQ,QAAQ,EAAS,WAAY,EAAQ,WAAY,GAIpF,EAAe,IAAI,gBAAgB,GACnC,EAAK,IAAI,gBAAgB,EAAI,IAC7B,EAAc,EAAQ,IAAM,EAAM,EAAQ,IAAM,GAChD,EAAgB,QAAQ,UAAY,IAAM,EAAa,IAAM,EAAI,KAAO,IAAM,EAAK,IAAM,EAAe,IAAM,EAI9G,QAAY,QAAQ,iBAAiB,EAAS,UAAW,EAAQ,UAAW,GAQlF,OADe,EAAgB,IAAM,EAAI,KAAO,IAAM,EAAI,MAE9D,EAOA,QAAQ,OAAS,eAAgB,EAAQ,EAAU,GAE/C,EAAU,OAAO,OAAO,CAAC,EAAG,GAE5B,MAAM,EAAM,KAAK,OAAS,EAAQ,qBAAuB,GAInD,EAAQ,EAAO,MAAM,KAC3B,GAAqB,IAAjB,EAAM,OACN,MAAM,IAAI,KAAK,yCAGnB,MAAM,EAAY,EAAM,GAClB,EAAa,EAAM,GACnB,EAAiB,EAAM,GACvB,EAAe,EAAM,GACrB,EAAe,EAAM,GACrB,EAAa,EAAM,GACnB,EAAW,EAAM,GACjB,EAAO,EAAM,GACb,EAAgB,EAAY,IAAM,EAAa,IAAM,EAAiB,IAAM,EAAe,IAAM,EAAe,IAAM,EAI5H,GAAI,IAAc,QAAQ,UACtB,MAAM,IAAI,KAAK,oBAKnB,GAAI,EAAY,CACZ,IAAK,EAAW,MAAM,SAClB,MAAM,IAAI,KAAK,sBAInB,GADY,SAAS,EAAY,KACrB,EAAkC,IAA3B,EAAQ,iBACvB,MAAM,IAAI,KAAK,eAEvB,CAIA,GAAI,aAAoB,SAClB,OAAO,SAAS,MAElB,EAAW,EAAS,GAAc,YAE9B,MAAM,IAAI,KAAK,yBAA2B,GAIlD,EAAW,UAAU,kBAAkB,GAIvC,MAAM,EAAa,KAAK,MAAM,EAAQ,WACtC,EAAW,KAAO,EAClB,MAAM,QAAY,QAAQ,iBAAiB,EAAS,UAAW,EAAY,GAE3E,IAAK,UAAU,oBAAoB,EAAI,OAAQ,GAC3C,MAAM,IAAI,KAAK,kBAKnB,IACI,IAAI,EAAY,IAAI,gBAAgB,EAAc,SACtD,CACA,MAAO,GACH,MAAM,KAAK,QAAQ,EACvB,CAEA,MAAM,EAAiB,KAAK,MAAM,EAAQ,YAC1C,EAAe,KAAO,EAEtB,IACI,EAAe,GAAK,IAAI,gBAAgB,EAAc,SAC1D,CACA,MAAO,GACH,MAAM,KAAK,QAAQ,EACvB,CAEA,MAAM,QAAkB,QAAQ,QAAQ,EAAS,WAAY,EAAgB,GAI7E,IAAI,EAAS,KACb,IACI,EAAS,KAAK,MAAM,EACxB,CACA,MAAO,GACH,MAAM,IAAI,KAAK,sCAAwC,EAAI,QAC/D,CAEA,OAAO,CACX,EAGA,UAAU,UAAY,SAAU,GAE5B,IACI,OAAO,KAAK,UAAU,EAC1B,CACA,MAAO,GACH,MAAM,IAAI,KAAK,+BAAiC,EAAI,QACxD,CACJ,EAGA,UAAU,OAAS,YAAa,GAE5B,OAAO,IAAI,SAAQ,CAAC,EAAS,KAWzB,EAAK,MATQ,CAAC,EAAK,KAEf,GAAI,EACA,OAAO,EAAO,KAAK,QAAQ,IAG/B,EAAQ,EAAO,IAInB,OAAO,UAAU,EAAK,GAE9B","file":"/npm/iron@5.0.6/lib/index.js","sourceRoot":"","sourcesContent":["/**\n * Minified by jsDelivr using Terser v5.39.0.\n * Original file: /npm/iron@5.0.6/lib/index.js\n *\n * Do NOT use SRI with dynamically generated files! More information: https://www.jsdelivr.com/using-sri-with-dynamic-files\n */\n","'use strict';\n\n// Load modules\n\nconst Crypto = require('crypto');\n\nconst B64 = require('b64');\nconst Boom = require('boom');\nconst Cryptiles = require('cryptiles');\nconst Hoek = require('hoek');\n\n\n// Declare internals\n\nconst internals = {};\n\n\n// Common defaults\n\nexports.defaults = {\n    encryption: {\n        saltBits: 256,\n        algorithm: 'aes-256-cbc',\n        iterations: 1,\n        minPasswordlength: 32\n    },\n\n    integrity: {\n        saltBits: 256,\n        algorithm: 'sha256',\n        iterations: 1,\n        minPasswordlength: 32\n    },\n\n    ttl: 0,                                             // Milliseconds, 0 means forever\n    timestampSkewSec: 60,                               // Seconds of permitted clock skew for incoming expirations\n    localtimeOffsetMsec: 0                              // Local clock time offset express in a number of milliseconds (positive or negative)\n};\n\n\n// Algorithm configuration\n\nexports.algorithms = {\n    'aes-128-ctr': { keyBits: 128, ivBits: 128 },\n    'aes-256-cbc': { keyBits: 256, ivBits: 128 },\n    'sha256': { keyBits: 256 }\n};\n\n\n// MAC normalization format version\n\nexports.macFormatVersion = '2';                         // Prevent comparison of mac values generated with different normalized string formats\n\nexports.macPrefix = 'Fe26.' + exports.macFormatVersion;\n\n\n// Generate a unique encryption key\n\n/*\n    const options =  {\n        saltBits: 256,                                  // Ignored if salt is set\n        salt: '4d8nr9q384nr9q384nr93q8nruq9348run',\n        algorithm: 'aes-128-ctr',\n        iterations: 10000,\n        iv: 'sdfsdfsdfsdfscdrgercgesrcgsercg',          // Optional\n        minPasswordlength: 32\n    };\n*/\n\nexports.generateKey = async function (password, options) {\n\n    if (!password) {\n        throw new Boom('Empty password');\n    }\n\n    if (!options ||\n        typeof options !== 'object') {\n\n        throw new Boom('Bad options');\n    }\n\n    const algorithm = exports.algorithms[options.algorithm];\n    if (!algorithm) {\n        throw new Boom('Unknown algorithm: ' + options.algorithm);\n    }\n\n    const result = {};\n\n    if (Buffer.isBuffer(password)) {\n        if (password.length < algorithm.keyBits / 8) {\n            throw new Boom('Key buffer (password) too small');\n        }\n\n        result.key = password;\n        result.salt = '';\n    }\n    else {\n        if (password.length < options.minPasswordlength) {\n            throw new Boom('Password string too short (min ' + options.minPasswordlength + ' characters required)');\n        }\n\n        let salt = options.salt;\n        if (!salt) {\n            if (!options.saltBits) {\n                throw new Boom('Missing salt and saltBits options');\n            }\n\n            const randomSalt = Cryptiles.randomBits(options.saltBits);\n            salt = randomSalt.toString('hex');\n        }\n\n        const derivedKey = await internals.pbkdf2(password, salt, options.iterations, algorithm.keyBits / 8, 'sha1');\n\n        result.key = derivedKey;\n        result.salt = salt;\n    }\n\n    if (options.iv) {\n        result.iv = options.iv;\n    }\n    else if (algorithm.ivBits) {\n        result.iv = Cryptiles.randomBits(algorithm.ivBits);\n    }\n\n    return result;\n};\n\n\n// Encrypt data\n// options: see exports.generateKey()\n\nexports.encrypt = async function (password, options, data) {\n\n    const key = await exports.generateKey(password, options);\n    const cipher = Crypto.createCipheriv(options.algorithm, key.key, key.iv);\n    const encrypted = Buffer.concat([cipher.update(data, 'utf8'), cipher.final()]);\n\n    return { encrypted, key };\n};\n\n\n// Decrypt data\n// options: see exports.generateKey()\n\nexports.decrypt = async function (password, options, data) {\n\n    const key = await exports.generateKey(password, options);\n    const decipher = Crypto.createDecipheriv(options.algorithm, key.key, key.iv);\n    let dec = decipher.update(data, null, 'utf8');\n    dec = dec + decipher.final('utf8');\n\n    return dec;\n};\n\n\n// HMAC using a password\n// options: see exports.generateKey()\n\nexports.hmacWithPassword = async function (password, options, data) {\n\n    const key = await exports.generateKey(password, options);\n    const hmac = Crypto.createHmac(options.algorithm, key.key).update(data);\n    const digest = hmac.digest('base64').replace(/\\+/g, '-').replace(/\\//g, '_').replace(/\\=/g, '');\n\n    const result = {\n        digest,\n        salt: key.salt\n    };\n\n    return result;\n};\n\n\n// Normalizes a password parameter into a { id, encryption, integrity } object\n// password: string, buffer or object with { id, secret } or { id, encryption, integrity }\n\ninternals.normalizePassword = function (password) {\n\n    const obj = {};\n\n    if (password instanceof Object &&\n        !Buffer.isBuffer(password)) {\n\n        obj.id = password.id;\n        obj.encryption = password.secret || password.encryption;\n        obj.integrity = password.secret || password.integrity;\n    }\n    else {\n        obj.encryption = password;\n        obj.integrity = password;\n    }\n\n    return obj;\n};\n\n\n// Encrypt and HMAC an object\n// password: string, buffer or object with { id, secret } or { id, encryption, integrity }\n// options: see exports.defaults\n\nexports.seal = async function (object, password, options) {\n\n    options = Object.assign({}, options);       // Shallow cloned to prevent changes during async operations\n\n    const now = Date.now() + (options.localtimeOffsetMsec || 0);                 // Measure now before any other processing\n\n    // Serialize object\n\n    const objectString = internals.stringify(object);\n\n    // Obtain password\n\n    let passwordId = '';\n    password = internals.normalizePassword(password);\n    if (password.id) {\n        if (!/^\\w+$/.test(password.id)) {\n            throw new Boom('Invalid password id');\n        }\n\n        passwordId = password.id;\n    }\n\n    // Encrypt object string\n\n    const { encrypted, key } = await exports.encrypt(password.encryption, options.encryption, objectString);\n\n    // Base64url the encrypted value\n\n    const encryptedB64 = B64.base64urlEncode(encrypted);\n    const iv = B64.base64urlEncode(key.iv);\n    const expiration = (options.ttl ? now + options.ttl : '');\n    const macBaseString = exports.macPrefix + '*' + passwordId + '*' + key.salt + '*' + iv + '*' + encryptedB64 + '*' + expiration;\n\n    // Mac the combined values\n\n    const mac = await exports.hmacWithPassword(password.integrity, options.integrity, macBaseString);\n\n    // Put it all together\n\n    // prefix*[password-id]*encryption-salt*encryption-iv*encrypted*[expiration]*hmac-salt*hmac\n    // Allowed URI query name/value characters: *-. \\d \\w\n\n    const sealed = macBaseString + '*' + mac.salt + '*' + mac.digest;\n    return sealed;\n};\n\n\n// Decrypt and validate sealed string\n// password: string, buffer or object with { id: secret } or { id: { encryption, integrity } }\n// options: see exports.defaults\n\nexports.unseal = async function (sealed, password, options) {\n\n    options = Object.assign({}, options);       // Shallow cloned to prevent changes during async operations\n\n    const now = Date.now() + (options.localtimeOffsetMsec || 0);                 // Measure now before any other processing\n\n    // Break string into components\n\n    const parts = sealed.split('*');\n    if (parts.length !== 8) {\n        throw new Boom('Incorrect number of sealed components');\n    }\n\n    const macPrefix = parts[0];\n    const passwordId = parts[1];\n    const encryptionSalt = parts[2];\n    const encryptionIv = parts[3];\n    const encryptedB64 = parts[4];\n    const expiration = parts[5];\n    const hmacSalt = parts[6];\n    const hmac = parts[7];\n    const macBaseString = macPrefix + '*' + passwordId + '*' + encryptionSalt + '*' + encryptionIv + '*' + encryptedB64 + '*' + expiration;\n\n    // Check prefix\n\n    if (macPrefix !== exports.macPrefix) {\n        throw new Boom('Wrong mac prefix');\n    }\n\n    // Check expiration\n\n    if (expiration) {\n        if (!expiration.match(/^\\d+$/)) {\n            throw new Boom('Invalid expiration');\n        }\n\n        const exp = parseInt(expiration, 10);\n        if (exp <= (now - (options.timestampSkewSec * 1000))) {\n            throw new Boom('Expired seal');\n        }\n    }\n\n    // Obtain password\n\n    if (password instanceof Object &&\n        !(Buffer.isBuffer(password))) {\n\n        password = password[passwordId || 'default'];\n        if (!password) {\n            throw new Boom('Cannot find password: ' + passwordId);\n        }\n    }\n\n    password = internals.normalizePassword(password);\n\n    // Check hmac\n\n    const macOptions = Hoek.clone(options.integrity);\n    macOptions.salt = hmacSalt;\n    const mac = await exports.hmacWithPassword(password.integrity, macOptions, macBaseString);\n\n    if (!Cryptiles.fixedTimeComparison(mac.digest, hmac)) {\n        throw new Boom('Bad hmac value');\n    }\n\n    // Decrypt\n\n    try {\n        var encrypted = B64.base64urlDecode(encryptedB64, 'buffer');\n    }\n    catch (err) {\n        throw Boom.boomify(err);\n    }\n\n    const decryptOptions = Hoek.clone(options.encryption);\n    decryptOptions.salt = encryptionSalt;\n\n    try {\n        decryptOptions.iv = B64.base64urlDecode(encryptionIv, 'buffer');\n    }\n    catch (err) {\n        throw Boom.boomify(err);\n    }\n\n    const decrypted = await exports.decrypt(password.encryption, decryptOptions, encrypted);\n\n    // Parse JSON\n\n    let object = null;\n    try {\n        object = JSON.parse(decrypted);\n    }\n    catch (err) {\n        throw new Boom('Failed parsing sealed object JSON: ' + err.message);\n    }\n\n    return object;\n};\n\n\ninternals.stringify = function (object) {\n\n    try {\n        return JSON.stringify(object);\n    }\n    catch (err) {\n        throw new Boom('Failed to stringify object: ' + err.message);\n    }\n};\n\n\ninternals.pbkdf2 = function (...args) {\n\n    return new Promise((resolve, reject) => {\n\n        const next = (err, result) => {\n\n            if (err) {\n                return reject(Boom.boomify(err));\n            }\n\n            resolve(result);\n        };\n\n        args.push(next);\n        Crypto.pbkdf2(...args);\n    });\n};\n"]}