const require_rolldown_runtime = require('../../../_virtual/rolldown_runtime.cjs');
const require_forge$1 = require('./forge.cjs');
const require_util$1 = require('./util.cjs');
const require_cipher$1 = require('./cipher.cjs');
const require_cipherModes$1 = require('./cipherModes.cjs');

//#region ../../node_modules/node-forge/lib/aes.js
var require_aes = /* @__PURE__ */ require_rolldown_runtime.__commonJS({ "../../node_modules/node-forge/lib/aes.js": ((exports, module) => {
	/**
	* Advanced Encryption Standard (AES) implementation.
	*
	* This implementation is based on the public domain library 'jscrypto' which
	* was written by:
	*
	* Emily Stark (estark@stanford.edu)
	* Mike Hamburg (mhamburg@stanford.edu)
	* Dan Boneh (dabo@cs.stanford.edu)
	*
	* Parts of this code are based on the OpenSSL implementation of AES:
	* http://www.openssl.org
	*
	* @author Dave Longley
	*
	* Copyright (c) 2010-2014 Digital Bazaar, Inc.
	*/
	var forge = require_forge$1.default;
	require_cipher$1.default;
	require_cipherModes$1.default;
	require_util$1.default;
	module.exports = forge.aes = forge.aes || {};
	/**
	* Deprecated. Instead, use:
	*
	* var cipher = forge.cipher.createCipher('AES-<mode>', key);
	* cipher.start({iv: iv});
	*
	* Creates an AES cipher object to encrypt data using the given symmetric key.
	* The output will be stored in the 'output' member of the returned cipher.
	*
	* The key and iv may be given as a string of bytes, an array of bytes,
	* a byte buffer, or an array of 32-bit words.
	*
	* @param key the symmetric key to use.
	* @param iv the initialization vector to use.
	* @param output the buffer to write to, null to create one.
	* @param mode the cipher mode to use (default: 'CBC').
	*
	* @return the cipher.
	*/
	forge.aes.startEncrypting = function(key, iv, output, mode) {
		var cipher = _createCipher({
			key,
			output,
			decrypt: false,
			mode
		});
		cipher.start(iv);
		return cipher;
	};
	/**
	* Deprecated. Instead, use:
	*
	* var cipher = forge.cipher.createCipher('AES-<mode>', key);
	*
	* Creates an AES cipher object to encrypt data using the given symmetric key.
	*
	* The key may be given as a string of bytes, an array of bytes, a
	* byte buffer, or an array of 32-bit words.
	*
	* @param key the symmetric key to use.
	* @param mode the cipher mode to use (default: 'CBC').
	*
	* @return the cipher.
	*/
	forge.aes.createEncryptionCipher = function(key, mode) {
		return _createCipher({
			key,
			output: null,
			decrypt: false,
			mode
		});
	};
	/**
	* Deprecated. Instead, use:
	*
	* var decipher = forge.cipher.createDecipher('AES-<mode>', key);
	* decipher.start({iv: iv});
	*
	* Creates an AES cipher object to decrypt data using the given symmetric key.
	* The output will be stored in the 'output' member of the returned cipher.
	*
	* The key and iv may be given as a string of bytes, an array of bytes,
	* a byte buffer, or an array of 32-bit words.
	*
	* @param key the symmetric key to use.
	* @param iv the initialization vector to use.
	* @param output the buffer to write to, null to create one.
	* @param mode the cipher mode to use (default: 'CBC').
	*
	* @return the cipher.
	*/
	forge.aes.startDecrypting = function(key, iv, output, mode) {
		var cipher = _createCipher({
			key,
			output,
			decrypt: true,
			mode
		});
		cipher.start(iv);
		return cipher;
	};
	/**
	* Deprecated. Instead, use:
	*
	* var decipher = forge.cipher.createDecipher('AES-<mode>', key);
	*
	* Creates an AES cipher object to decrypt data using the given symmetric key.
	*
	* The key may be given as a string of bytes, an array of bytes, a
	* byte buffer, or an array of 32-bit words.
	*
	* @param key the symmetric key to use.
	* @param mode the cipher mode to use (default: 'CBC').
	*
	* @return the cipher.
	*/
	forge.aes.createDecryptionCipher = function(key, mode) {
		return _createCipher({
			key,
			output: null,
			decrypt: true,
			mode
		});
	};
	/**
	* Creates a new AES cipher algorithm object.
	*
	* @param name the name of the algorithm.
	* @param mode the mode factory function.
	*
	* @return the AES algorithm object.
	*/
	forge.aes.Algorithm = function(name, mode) {
		if (!init) initialize();
		var self = this;
		self.name = name;
		self.mode = new mode({
			blockSize: 16,
			cipher: {
				encrypt: function(inBlock, outBlock) {
					return _updateBlock(self._w, inBlock, outBlock, false);
				},
				decrypt: function(inBlock, outBlock) {
					return _updateBlock(self._w, inBlock, outBlock, true);
				}
			}
		});
		self._init = false;
	};
	/**
	* Initializes this AES algorithm by expanding its key.
	*
	* @param options the options to use.
	*          key the key to use with this algorithm.
	*          decrypt true if the algorithm should be initialized for decryption,
	*            false for encryption.
	*/
	forge.aes.Algorithm.prototype.initialize = function(options) {
		if (this._init) return;
		var key = options.key;
		var tmp;
		if (typeof key === "string" && (key.length === 16 || key.length === 24 || key.length === 32)) key = forge.util.createBuffer(key);
		else if (forge.util.isArray(key) && (key.length === 16 || key.length === 24 || key.length === 32)) {
			tmp = key;
			key = forge.util.createBuffer();
			for (var i = 0; i < tmp.length; ++i) key.putByte(tmp[i]);
		}
		if (!forge.util.isArray(key)) {
			tmp = key;
			key = [];
			var len = tmp.length();
			if (len === 16 || len === 24 || len === 32) {
				len = len >>> 2;
				for (var i = 0; i < len; ++i) key.push(tmp.getInt32());
			}
		}
		if (!forge.util.isArray(key) || !(key.length === 4 || key.length === 6 || key.length === 8)) throw new Error("Invalid key parameter.");
		var mode = this.mode.name;
		var encryptOp = [
			"CFB",
			"OFB",
			"CTR",
			"GCM"
		].indexOf(mode) !== -1;
		this._w = _expandKey(key, options.decrypt && !encryptOp);
		this._init = true;
	};
	/**
	* Expands a key. Typically only used for testing.
	*
	* @param key the symmetric key to expand, as an array of 32-bit words.
	* @param decrypt true to expand for decryption, false for encryption.
	*
	* @return the expanded key.
	*/
	forge.aes._expandKey = function(key, decrypt) {
		if (!init) initialize();
		return _expandKey(key, decrypt);
	};
	/**
	* Updates a single block. Typically only used for testing.
	*
	* @param w the expanded key to use.
	* @param input an array of block-size 32-bit words.
	* @param output an array of block-size 32-bit words.
	* @param decrypt true to decrypt, false to encrypt.
	*/
	forge.aes._updateBlock = _updateBlock;
	/** Register AES algorithms **/
	registerAlgorithm("AES-ECB", forge.cipher.modes.ecb);
	registerAlgorithm("AES-CBC", forge.cipher.modes.cbc);
	registerAlgorithm("AES-CFB", forge.cipher.modes.cfb);
	registerAlgorithm("AES-OFB", forge.cipher.modes.ofb);
	registerAlgorithm("AES-CTR", forge.cipher.modes.ctr);
	registerAlgorithm("AES-GCM", forge.cipher.modes.gcm);
	function registerAlgorithm(name, mode) {
		var factory = function() {
			return new forge.aes.Algorithm(name, mode);
		};
		forge.cipher.registerAlgorithm(name, factory);
	}
	/** AES implementation **/
	var init = false;
	var Nb = 4;
	var sbox;
	var isbox;
	var rcon;
	var mix;
	var imix;
	/**
	* Performs initialization, ie: precomputes tables to optimize for speed.
	*
	* One way to understand how AES works is to imagine that 'addition' and
	* 'multiplication' are interfaces that require certain mathematical
	* properties to hold true (ie: they are associative) but they might have
	* different implementations and produce different kinds of results ...
	* provided that their mathematical properties remain true. AES defines
	* its own methods of addition and multiplication but keeps some important
	* properties the same, ie: associativity and distributivity. The
	* explanation below tries to shed some light on how AES defines addition
	* and multiplication of bytes and 32-bit words in order to perform its
	* encryption and decryption algorithms.
	*
	* The basics:
	*
	* The AES algorithm views bytes as binary representations of polynomials
	* that have either 1 or 0 as the coefficients. It defines the addition
	* or subtraction of two bytes as the XOR operation. It also defines the
	* multiplication of two bytes as a finite field referred to as GF(2^8)
	* (Note: 'GF' means "Galois Field" which is a field that contains a finite
	* number of elements so GF(2^8) has 256 elements).
	*
	* This means that any two bytes can be represented as binary polynomials;
	* when they multiplied together and modularly reduced by an irreducible
	* polynomial of the 8th degree, the results are the field GF(2^8). The
	* specific irreducible polynomial that AES uses in hexadecimal is 0x11b.
	* This multiplication is associative with 0x01 as the identity:
	*
	* (b * 0x01 = GF(b, 0x01) = b).
	*
	* The operation GF(b, 0x02) can be performed at the byte level by left
	* shifting b once and then XOR'ing it (to perform the modular reduction)
	* with 0x11b if b is >= 128. Repeated application of the multiplication
	* of 0x02 can be used to implement the multiplication of any two bytes.
	*
	* For instance, multiplying 0x57 and 0x13, denoted as GF(0x57, 0x13), can
	* be performed by factoring 0x13 into 0x01, 0x02, and 0x10. Then these
	* factors can each be multiplied by 0x57 and then added together. To do
	* the multiplication, values for 0x57 multiplied by each of these 3 factors
	* can be precomputed and stored in a table. To add them, the values from
	* the table are XOR'd together.
	*
	* AES also defines addition and multiplication of words, that is 4-byte
	* numbers represented as polynomials of 3 degrees where the coefficients
	* are the values of the bytes.
	*
	* The word [a0, a1, a2, a3] is a polynomial a3x^3 + a2x^2 + a1x + a0.
	*
	* Addition is performed by XOR'ing like powers of x. Multiplication
	* is performed in two steps, the first is an algebriac expansion as
	* you would do normally (where addition is XOR). But the result is
	* a polynomial larger than 3 degrees and thus it cannot fit in a word. So
	* next the result is modularly reduced by an AES-specific polynomial of
	* degree 4 which will always produce a polynomial of less than 4 degrees
	* such that it will fit in a word. In AES, this polynomial is x^4 + 1.
	*
	* The modular product of two polynomials 'a' and 'b' is thus:
	*
	* d(x) = d3x^3 + d2x^2 + d1x + d0
	* with
	* d0 = GF(a0, b0) ^ GF(a3, b1) ^ GF(a2, b2) ^ GF(a1, b3)
	* d1 = GF(a1, b0) ^ GF(a0, b1) ^ GF(a3, b2) ^ GF(a2, b3)
	* d2 = GF(a2, b0) ^ GF(a1, b1) ^ GF(a0, b2) ^ GF(a3, b3)
	* d3 = GF(a3, b0) ^ GF(a2, b1) ^ GF(a1, b2) ^ GF(a0, b3)
	*
	* As a matrix:
	*
	* [d0] = [a0 a3 a2 a1][b0]
	* [d1]   [a1 a0 a3 a2][b1]
	* [d2]   [a2 a1 a0 a3][b2]
	* [d3]   [a3 a2 a1 a0][b3]
	*
	* Special polynomials defined by AES (0x02 == {02}):
	* a(x)    = {03}x^3 + {01}x^2 + {01}x + {02}
	* a^-1(x) = {0b}x^3 + {0d}x^2 + {09}x + {0e}.
	*
	* These polynomials are used in the MixColumns() and InverseMixColumns()
	* operations, respectively, to cause each element in the state to affect
	* the output (referred to as diffusing).
	*
	* RotWord() uses: a0 = a1 = a2 = {00} and a3 = {01}, which is the
	* polynomial x3.
	*
	* The ShiftRows() method modifies the last 3 rows in the state (where
	* the state is 4 words with 4 bytes per word) by shifting bytes cyclically.
	* The 1st byte in the second row is moved to the end of the row. The 1st
	* and 2nd bytes in the third row are moved to the end of the row. The 1st,
	* 2nd, and 3rd bytes are moved in the fourth row.
	*
	* More details on how AES arithmetic works:
	*
	* In the polynomial representation of binary numbers, XOR performs addition
	* and subtraction and multiplication in GF(2^8) denoted as GF(a, b)
	* corresponds with the multiplication of polynomials modulo an irreducible
	* polynomial of degree 8. In other words, for AES, GF(a, b) will multiply
	* polynomial 'a' with polynomial 'b' and then do a modular reduction by
	* an AES-specific irreducible polynomial of degree 8.
	*
	* A polynomial is irreducible if its only divisors are one and itself. For
	* the AES algorithm, this irreducible polynomial is:
	*
	* m(x) = x^8 + x^4 + x^3 + x + 1,
	*
	* or {01}{1b} in hexadecimal notation, where each coefficient is a bit:
	* 100011011 = 283 = 0x11b.
	*
	* For example, GF(0x57, 0x83) = 0xc1 because
	*
	* 0x57 = 87  = 01010111 = x^6 + x^4 + x^2 + x + 1
	* 0x85 = 131 = 10000101 = x^7 + x + 1
	*
	* (x^6 + x^4 + x^2 + x + 1) * (x^7 + x + 1)
	* =  x^13 + x^11 + x^9 + x^8 + x^7 +
	*    x^7 + x^5 + x^3 + x^2 + x +
	*    x^6 + x^4 + x^2 + x + 1
	* =  x^13 + x^11 + x^9 + x^8 + x^6 + x^5 + x^4 + x^3 + 1 = y
	*    y modulo (x^8 + x^4 + x^3 + x + 1)
	* =  x^7 + x^6 + 1.
	*
	* The modular reduction by m(x) guarantees the result will be a binary
	* polynomial of less than degree 8, so that it can fit in a byte.
	*
	* The operation to multiply a binary polynomial b with x (the polynomial
	* x in binary representation is 00000010) is:
	*
	* b_7x^8 + b_6x^7 + b_5x^6 + b_4x^5 + b_3x^4 + b_2x^3 + b_1x^2 + b_0x^1
	*
	* To get GF(b, x) we must reduce that by m(x). If b_7 is 0 (that is the
	* most significant bit is 0 in b) then the result is already reduced. If
	* it is 1, then we can reduce it by subtracting m(x) via an XOR.
	*
	* It follows that multiplication by x (00000010 or 0x02) can be implemented
	* by performing a left shift followed by a conditional bitwise XOR with
	* 0x1b. This operation on bytes is denoted by xtime(). Multiplication by
	* higher powers of x can be implemented by repeated application of xtime().
	*
	* By adding intermediate results, multiplication by any constant can be
	* implemented. For instance:
	*
	* GF(0x57, 0x13) = 0xfe because:
	*
	* xtime(b) = (b & 128) ? (b << 1 ^ 0x11b) : (b << 1)
	*
	* Note: We XOR with 0x11b instead of 0x1b because in javascript our
	* datatype for b can be larger than 1 byte, so a left shift will not
	* automatically eliminate bits that overflow a byte ... by XOR'ing the
	* overflow bit with 1 (the extra one from 0x11b) we zero it out.
	*
	* GF(0x57, 0x02) = xtime(0x57) = 0xae
	* GF(0x57, 0x04) = xtime(0xae) = 0x47
	* GF(0x57, 0x08) = xtime(0x47) = 0x8e
	* GF(0x57, 0x10) = xtime(0x8e) = 0x07
	*
	* GF(0x57, 0x13) = GF(0x57, (0x01 ^ 0x02 ^ 0x10))
	*
	* And by the distributive property (since XOR is addition and GF() is
	* multiplication):
	*
	* = GF(0x57, 0x01) ^ GF(0x57, 0x02) ^ GF(0x57, 0x10)
	* = 0x57 ^ 0xae ^ 0x07
	* = 0xfe.
	*/
	function initialize() {
		init = true;
		rcon = [
			0,
			1,
			2,
			4,
			8,
			16,
			32,
			64,
			128,
			27,
			54
		];
		var xtime = new Array(256);
		for (var i = 0; i < 128; ++i) {
			xtime[i] = i << 1;
			xtime[i + 128] = i + 128 << 1 ^ 283;
		}
		sbox = new Array(256);
		isbox = new Array(256);
		mix = new Array(4);
		imix = new Array(4);
		for (var i = 0; i < 4; ++i) {
			mix[i] = new Array(256);
			imix[i] = new Array(256);
		}
		var e = 0, ei = 0, e2, e4, e8, sx, sx2, me, ime;
		for (var i = 0; i < 256; ++i) {
			sx = ei ^ ei << 1 ^ ei << 2 ^ ei << 3 ^ ei << 4;
			sx = sx >> 8 ^ sx & 255 ^ 99;
			sbox[e] = sx;
			isbox[sx] = e;
			sx2 = xtime[sx];
			e2 = xtime[e];
			e4 = xtime[e2];
			e8 = xtime[e4];
			me = sx2 << 24 ^ sx << 16 ^ sx << 8 ^ (sx ^ sx2);
			ime = (e2 ^ e4 ^ e8) << 24 ^ (e ^ e8) << 16 ^ (e ^ e4 ^ e8) << 8 ^ (e ^ e2 ^ e8);
			for (var n = 0; n < 4; ++n) {
				mix[n][e] = me;
				imix[n][sx] = ime;
				me = me << 24 | me >>> 8;
				ime = ime << 24 | ime >>> 8;
			}
			if (e === 0) e = ei = 1;
			else {
				e = e2 ^ xtime[xtime[xtime[e2 ^ e8]]];
				ei ^= xtime[xtime[ei]];
			}
		}
	}
	/**
	* Generates a key schedule using the AES key expansion algorithm.
	*
	* The AES algorithm takes the Cipher Key, K, and performs a Key Expansion
	* routine to generate a key schedule. The Key Expansion generates a total
	* of Nb*(Nr + 1) words: the algorithm requires an initial set of Nb words,
	* and each of the Nr rounds requires Nb words of key data. The resulting
	* key schedule consists of a linear array of 4-byte words, denoted [wi ],
	* with i in the range 0 <= i < Nb(Nr + 1).
	*
	* KeyExpansion(byte key[4*Nk], word w[Nb*(Nr+1)], Nk)
	* AES-128 (Nb=4, Nk=4, Nr=10)
	* AES-192 (Nb=4, Nk=6, Nr=12)
	* AES-256 (Nb=4, Nk=8, Nr=14)
	* Note: Nr=Nk+6.
	*
	* Nb is the number of columns (32-bit words) comprising the State (or
	* number of bytes in a block). For AES, Nb=4.
	*
	* @param key the key to schedule (as an array of 32-bit words).
	* @param decrypt true to modify the key schedule to decrypt, false not to.
	*
	* @return the generated key schedule.
	*/
	function _expandKey(key, decrypt) {
		var w = key.slice(0);
		var temp, iNk = 1;
		var Nk = w.length;
		var end = Nb * (Nk + 6 + 1);
		for (var i = Nk; i < end; ++i) {
			temp = w[i - 1];
			if (i % Nk === 0) {
				temp = sbox[temp >>> 16 & 255] << 24 ^ sbox[temp >>> 8 & 255] << 16 ^ sbox[temp & 255] << 8 ^ sbox[temp >>> 24] ^ rcon[iNk] << 24;
				iNk++;
			} else if (Nk > 6 && i % Nk === 4) temp = sbox[temp >>> 24] << 24 ^ sbox[temp >>> 16 & 255] << 16 ^ sbox[temp >>> 8 & 255] << 8 ^ sbox[temp & 255];
			w[i] = w[i - Nk] ^ temp;
		}
		if (decrypt) {
			var tmp;
			var m0 = imix[0];
			var m1 = imix[1];
			var m2 = imix[2];
			var m3 = imix[3];
			var wnew = w.slice(0);
			end = w.length;
			for (var i = 0, wi = end - Nb; i < end; i += Nb, wi -= Nb) if (i === 0 || i === end - Nb) {
				wnew[i] = w[wi];
				wnew[i + 1] = w[wi + 3];
				wnew[i + 2] = w[wi + 2];
				wnew[i + 3] = w[wi + 1];
			} else for (var n = 0; n < Nb; ++n) {
				tmp = w[wi + n];
				wnew[i + (3 & -n)] = m0[sbox[tmp >>> 24]] ^ m1[sbox[tmp >>> 16 & 255]] ^ m2[sbox[tmp >>> 8 & 255]] ^ m3[sbox[tmp & 255]];
			}
			w = wnew;
		}
		return w;
	}
	/**
	* Updates a single block (16 bytes) using AES. The update will either
	* encrypt or decrypt the block.
	*
	* @param w the key schedule.
	* @param input the input block (an array of 32-bit words).
	* @param output the updated output block.
	* @param decrypt true to decrypt the block, false to encrypt it.
	*/
	function _updateBlock(w, input, output, decrypt) {
		var Nr = w.length / 4 - 1;
		var m0, m1, m2, m3, sub;
		if (decrypt) {
			m0 = imix[0];
			m1 = imix[1];
			m2 = imix[2];
			m3 = imix[3];
			sub = isbox;
		} else {
			m0 = mix[0];
			m1 = mix[1];
			m2 = mix[2];
			m3 = mix[3];
			sub = sbox;
		}
		var a = input[0] ^ w[0], b = input[decrypt ? 3 : 1] ^ w[1], c = input[2] ^ w[2], d = input[decrypt ? 1 : 3] ^ w[3], a2, b2, c2;
		var i = 3;
		for (var round = 1; round < Nr; ++round) {
			a2 = m0[a >>> 24] ^ m1[b >>> 16 & 255] ^ m2[c >>> 8 & 255] ^ m3[d & 255] ^ w[++i];
			b2 = m0[b >>> 24] ^ m1[c >>> 16 & 255] ^ m2[d >>> 8 & 255] ^ m3[a & 255] ^ w[++i];
			c2 = m0[c >>> 24] ^ m1[d >>> 16 & 255] ^ m2[a >>> 8 & 255] ^ m3[b & 255] ^ w[++i];
			d = m0[d >>> 24] ^ m1[a >>> 16 & 255] ^ m2[b >>> 8 & 255] ^ m3[c & 255] ^ w[++i];
			a = a2;
			b = b2;
			c = c2;
		}
		output[0] = sub[a >>> 24] << 24 ^ sub[b >>> 16 & 255] << 16 ^ sub[c >>> 8 & 255] << 8 ^ sub[d & 255] ^ w[++i];
		output[decrypt ? 3 : 1] = sub[b >>> 24] << 24 ^ sub[c >>> 16 & 255] << 16 ^ sub[d >>> 8 & 255] << 8 ^ sub[a & 255] ^ w[++i];
		output[2] = sub[c >>> 24] << 24 ^ sub[d >>> 16 & 255] << 16 ^ sub[a >>> 8 & 255] << 8 ^ sub[b & 255] ^ w[++i];
		output[decrypt ? 1 : 3] = sub[d >>> 24] << 24 ^ sub[a >>> 16 & 255] << 16 ^ sub[b >>> 8 & 255] << 8 ^ sub[c & 255] ^ w[++i];
	}
	/**
	* Deprecated. Instead, use:
	*
	* forge.cipher.createCipher('AES-<mode>', key);
	* forge.cipher.createDecipher('AES-<mode>', key);
	*
	* Creates a deprecated AES cipher object. This object's mode will default to
	* CBC (cipher-block-chaining).
	*
	* The key and iv may be given as a string of bytes, an array of bytes, a
	* byte buffer, or an array of 32-bit words.
	*
	* @param options the options to use.
	*          key the symmetric key to use.
	*          output the buffer to write to.
	*          decrypt true for decryption, false for encryption.
	*          mode the cipher mode to use (default: 'CBC').
	*
	* @return the cipher.
	*/
	function _createCipher(options) {
		options = options || {};
		var algorithm = "AES-" + (options.mode || "CBC").toUpperCase();
		var cipher;
		if (options.decrypt) cipher = forge.cipher.createDecipher(algorithm, options.key);
		else cipher = forge.cipher.createCipher(algorithm, options.key);
		var start = cipher.start;
		cipher.start = function(iv, options$1) {
			var output = null;
			if (options$1 instanceof forge.util.ByteBuffer) {
				output = options$1;
				options$1 = {};
			}
			options$1 = options$1 || {};
			options$1.output = output;
			options$1.iv = iv;
			start.call(cipher, options$1);
		};
		return cipher;
	}
}) });

//#endregion
Object.defineProperty(exports, 'default', {
  enumerable: true,
  get: function () {
    return require_aes();
  }
});
//# sourceMappingURL=aes.cjs.map