@parcel/utils 2.7.0 → 2.8.1

package/lib/index.js

@@ -81,7 +81,13 @@ parcelRequire.register("iGlOy", function(module, exports) {
 });
 
 parcelRequire.register("ai0Z9", function(module, exports) {
-
+/**
+ * Node.js module for Forge message digests.
+ *
+ * @author Dave Longley
+ *
+ * Copyright 2011-2017 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 module.exports = $iGlOy.md = $iGlOy.md || {};
 $iGlOy.md.algorithms = $iGlOy.md.algorithms || {};
@@ -3078,12 +3084,10 @@ function $6e1ae4ed5b62d1d9$var$parseAsync(str, opts) {
         setImmediate(parseAsyncNext, index, blocksize, resolve, reject);
     });
     function parseAsyncNext(index, blocksize, resolve, reject) {
-        if (index >= str.length) {
-            try {
-                return resolve(parser.finish());
-            } catch (err) {
-                return reject($ciuZ9(err, str));
-            }
+        if (index >= str.length) try {
+            return resolve(parser.finish());
+        } catch (err) {
+            return reject($ciuZ9(err, str));
         }
         try {
             parser.parse(str.slice(index, index + blocksize));
@@ -3406,6 +3410,7 @@ $parcel$export(module.exports, "countLines", () => $fddc9169ba2fd655$export$2e2b
 $parcel$export(module.exports, "generateBuildMetrics", () => $15d4bc8b6fca8c7e$export$2e2bcd8739ae039);
 $parcel$export(module.exports, "generateCertificate", () => $c6cbdbdbaf0fafc1$export$2e2bcd8739ae039);
 $parcel$export(module.exports, "getCertificate", () => $186980c178984fd2$export$2e2bcd8739ae039);
+$parcel$export(module.exports, "getModuleParts", () => $313980afb666b13e$export$2e2bcd8739ae039);
 $parcel$export(module.exports, "getRootDir", () => $275c1a71c92a4142$export$2e2bcd8739ae039);
 $parcel$export(module.exports, "isDirectoryInside", () => $ea105385370dfccd$export$2e2bcd8739ae039);
 $parcel$export(module.exports, "isURL", () => $f7d48e99e9c9e3b2$export$2e2bcd8739ae039);
@@ -3578,22 +3583,50 @@ async function $15d4bc8b6fca8c7e$export$2e2bcd8739ae039(bundles, fs, projectRoot
 
 
 var $99e85628b30fe009$exports = {};
-
 /**
  * Node.js module for Forge.
  *
  * @author Dave Longley
  *
  * Copyright 2011-2016 Digital Bazaar, Inc.
- */ $99e85628b30fe009$exports = (parcelRequire("iGlOy"));
+ */ 
+$99e85628b30fe009$exports = (parcelRequire("iGlOy"));
 var $ca9d5cba0afae339$exports = {};
-
+/**
+ * Advanced Encryption Standard (AES) implementation.
+ *
+ * This implementation is based on the public domain library 'jscrypto' which
+ * was written by:
+ *
+ * Emily Stark (estark@stanford.edu)
+ * Mike Hamburg (mhamburg@stanford.edu)
+ * Dan Boneh (dabo@cs.stanford.edu)
+ *
+ * Parts of this code are based on the OpenSSL implementation of AES:
+ * http://www.openssl.org
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2010-2014 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 var $871289bd32ea5f15$exports = {};
-
+/**
+ * Cipher base API.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2010-2014 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 var $4143f576ffbec226$exports = {};
-
+/**
+ * Utility functions for web applications.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2010-2018 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 var $53abc20733f4b0dc$exports = {};
 /**
@@ -5624,7 +5657,7 @@ $4143f576ffbec226$var$util.text = {
             case "s":
             case "o":
                 // check if enough arguments were given
-                if (argi < arguments.length) parts.push(arguments[(argi++) + 1]);
+                if (argi < arguments.length) parts.push(arguments[argi++ + 1]);
                 else parts.push("<?>");
                 break;
             // FIXME: do proper formating for numbers, etc
@@ -6073,7 +6106,13 @@ var $871289bd32ea5f15$var$BlockCipher = $iGlOy.cipher.BlockCipher = function(opt
 
 
 var $8e7d87db09a5396f$exports = {};
-
+/**
+ * Supported cipher modes.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2010-2014 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 $iGlOy.cipher = $iGlOy.cipher || {};
@@ -7355,8 +7394,14 @@ var $ca9d5cba0afae339$var$imix; // inverse mix-columns table
         e2 = xtime[e];
         e4 = xtime[e2];
         e8 = xtime[e4];
-        me = sx2 << 24 ^ sx << 16 ^ sx << 8 ^ (sx ^ sx2); // 3
-        ime = (e2 ^ e4 ^ e8) << 24 ^ (e ^ e8) << 16 ^ (e ^ e4 ^ e8) << 8 ^ (e ^ e2 ^ e8); // B (11)
+        me = sx2 << 24 ^ // 2
+        sx << 16 ^ // 1
+        sx << 8 ^ // 1
+        (sx ^ sx2); // 3
+        ime = (e2 ^ e4 ^ e8) << 24 ^ // E (14)
+        (e ^ e8) << 16 ^ // 9
+        (e ^ e4 ^ e8) << 8 ^ // D (13)
+        (e ^ e2 ^ e8); // B (11)
         // produce each of the mix tables by rotating the 2,1,1,3 value
         for(var n = 0; n < 4; ++n){
             $ca9d5cba0afae339$var$mix[n][e] = me;
@@ -7757,18 +7802,396 @@ var $ca9d5cba0afae339$var$imix; // inverse mix-columns table
 
 
 var $48103dfbc323e2e4$exports = {};
-
+/**
+ * A Javascript implementation of AES Cipher Suites for TLS.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2009-2015 Digital Bazaar, Inc.
+ *
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 var $e55982d45da68b81$exports = {};
-
+/**
+ * A Javascript implementation of Transport Layer Security (TLS).
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2009-2014 Digital Bazaar, Inc.
+ *
+ * The TLS Handshake Protocol involves the following steps:
+ *
+ * - Exchange hello messages to agree on algorithms, exchange random values,
+ * and check for session resumption.
+ *
+ * - Exchange the necessary cryptographic parameters to allow the client and
+ * server to agree on a premaster secret.
+ *
+ * - Exchange certificates and cryptographic information to allow the client
+ * and server to authenticate themselves.
+ *
+ * - Generate a master secret from the premaster secret and exchanged random
+ * values.
+ *
+ * - Provide security parameters to the record layer.
+ *
+ * - Allow the client and server to verify that their peer has calculated the
+ * same security parameters and that the handshake occurred without tampering
+ * by an attacker.
+ *
+ * Up to 4 different messages may be sent during a key exchange. The server
+ * certificate, the server key exchange, the client certificate, and the
+ * client key exchange.
+ *
+ * A typical handshake (from the client's perspective).
+ *
+ * 1. Client sends ClientHello.
+ * 2. Client receives ServerHello.
+ * 3. Client receives optional Certificate.
+ * 4. Client receives optional ServerKeyExchange.
+ * 5. Client receives ServerHelloDone.
+ * 6. Client sends optional Certificate.
+ * 7. Client sends ClientKeyExchange.
+ * 8. Client sends optional CertificateVerify.
+ * 9. Client sends ChangeCipherSpec.
+ * 10. Client sends Finished.
+ * 11. Client receives ChangeCipherSpec.
+ * 12. Client receives Finished.
+ * 13. Client sends/receives application data.
+ *
+ * To reuse an existing session:
+ *
+ * 1. Client sends ClientHello with session ID for reuse.
+ * 2. Client receives ServerHello with same session ID if reusing.
+ * 3. Client receives ChangeCipherSpec message if reusing.
+ * 4. Client receives Finished.
+ * 5. Client sends ChangeCipherSpec.
+ * 6. Client sends Finished.
+ *
+ * Note: Client ignores HelloRequest if in the middle of a handshake.
+ *
+ * Record Layer:
+ *
+ * The record layer fragments information blocks into TLSPlaintext records
+ * carrying data in chunks of 2^14 bytes or less. Client message boundaries are
+ * not preserved in the record layer (i.e., multiple client messages of the
+ * same ContentType MAY be coalesced into a single TLSPlaintext record, or a
+ * single message MAY be fragmented across several records).
+ *
+ * struct {
+ *   uint8 major;
+ *   uint8 minor;
+ * } ProtocolVersion;
+ *
+ * struct {
+ *   ContentType type;
+ *   ProtocolVersion version;
+ *   uint16 length;
+ *   opaque fragment[TLSPlaintext.length];
+ * } TLSPlaintext;
+ *
+ * type:
+ *   The higher-level protocol used to process the enclosed fragment.
+ *
+ * version:
+ *   The version of the protocol being employed. TLS Version 1.2 uses version
+ *   {3, 3}. TLS Version 1.0 uses version {3, 1}. Note that a client that
+ *   supports multiple versions of TLS may not know what version will be
+ *   employed before it receives the ServerHello.
+ *
+ * length:
+ *   The length (in bytes) of the following TLSPlaintext.fragment. The length
+ *   MUST NOT exceed 2^14 = 16384 bytes.
+ *
+ * fragment:
+ *   The application data. This data is transparent and treated as an
+ *   independent block to be dealt with by the higher-level protocol specified
+ *   by the type field.
+ *
+ * Implementations MUST NOT send zero-length fragments of Handshake, Alert, or
+ * ChangeCipherSpec content types. Zero-length fragments of Application data
+ * MAY be sent as they are potentially useful as a traffic analysis
+ * countermeasure.
+ *
+ * Note: Data of different TLS record layer content types MAY be interleaved.
+ * Application data is generally of lower precedence for transmission than
+ * other content types. However, records MUST be delivered to the network in
+ * the same order as they are protected by the record layer. Recipients MUST
+ * receive and process interleaved application layer traffic during handshakes
+ * subsequent to the first one on a connection.
+ *
+ * struct {
+ *   ContentType type;       // same as TLSPlaintext.type
+ *   ProtocolVersion version;// same as TLSPlaintext.version
+ *   uint16 length;
+ *   opaque fragment[TLSCompressed.length];
+ * } TLSCompressed;
+ *
+ * length:
+ *   The length (in bytes) of the following TLSCompressed.fragment.
+ *   The length MUST NOT exceed 2^14 + 1024.
+ *
+ * fragment:
+ *   The compressed form of TLSPlaintext.fragment.
+ *
+ * Note: A CompressionMethod.null operation is an identity operation; no fields
+ * are altered. In this implementation, since no compression is supported,
+ * uncompressed records are always the same as compressed records.
+ *
+ * Encryption Information:
+ *
+ * The encryption and MAC functions translate a TLSCompressed structure into a
+ * TLSCiphertext. The decryption functions reverse the process. The MAC of the
+ * record also includes a sequence number so that missing, extra, or repeated
+ * messages are detectable.
+ *
+ * struct {
+ *   ContentType type;
+ *   ProtocolVersion version;
+ *   uint16 length;
+ *   select (SecurityParameters.cipher_type) {
+ *     case stream: GenericStreamCipher;
+ *     case block:  GenericBlockCipher;
+ *     case aead:   GenericAEADCipher;
+ *   } fragment;
+ * } TLSCiphertext;
+ *
+ * type:
+ *   The type field is identical to TLSCompressed.type.
+ *
+ * version:
+ *   The version field is identical to TLSCompressed.version.
+ *
+ * length:
+ *   The length (in bytes) of the following TLSCiphertext.fragment.
+ *   The length MUST NOT exceed 2^14 + 2048.
+ *
+ * fragment:
+ *   The encrypted form of TLSCompressed.fragment, with the MAC.
+ *
+ * Note: Only CBC Block Ciphers are supported by this implementation.
+ *
+ * The TLSCompressed.fragment structures are converted to/from block
+ * TLSCiphertext.fragment structures.
+ *
+ * struct {
+ *   opaque IV[SecurityParameters.record_iv_length];
+ *   block-ciphered struct {
+ *     opaque content[TLSCompressed.length];
+ *     opaque MAC[SecurityParameters.mac_length];
+ *     uint8 padding[GenericBlockCipher.padding_length];
+ *     uint8 padding_length;
+ *   };
+ * } GenericBlockCipher;
+ *
+ * The MAC is generated as described in Section 6.2.3.1.
+ *
+ * IV:
+ *   The Initialization Vector (IV) SHOULD be chosen at random, and MUST be
+ *   unpredictable. Note that in versions of TLS prior to 1.1, there was no
+ *   IV field, and the last ciphertext block of the previous record (the "CBC
+ *   residue") was used as the IV. This was changed to prevent the attacks
+ *   described in [CBCATT]. For block ciphers, the IV length is of length
+ *   SecurityParameters.record_iv_length, which is equal to the
+ *   SecurityParameters.block_size.
+ *
+ * padding:
+ *   Padding that is added to force the length of the plaintext to be an
+ *   integral multiple of the block cipher's block length. The padding MAY be
+ *   any length up to 255 bytes, as long as it results in the
+ *   TLSCiphertext.length being an integral multiple of the block length.
+ *   Lengths longer than necessary might be desirable to frustrate attacks on
+ *   a protocol that are based on analysis of the lengths of exchanged
+ *   messages. Each uint8 in the padding data vector MUST be filled with the
+ *   padding length value. The receiver MUST check this padding and MUST use
+ *   the bad_record_mac alert to indicate padding errors.
+ *
+ * padding_length:
+ *   The padding length MUST be such that the total size of the
+ *   GenericBlockCipher structure is a multiple of the cipher's block length.
+ *   Legal values range from zero to 255, inclusive. This length specifies the
+ *   length of the padding field exclusive of the padding_length field itself.
+ *
+ * The encrypted data length (TLSCiphertext.length) is one more than the sum of
+ * SecurityParameters.block_length, TLSCompressed.length,
+ * SecurityParameters.mac_length, and padding_length.
+ *
+ * Example: If the block length is 8 bytes, the content length
+ * (TLSCompressed.length) is 61 bytes, and the MAC length is 20 bytes, then the
+ * length before padding is 82 bytes (this does not include the IV. Thus, the
+ * padding length modulo 8 must be equal to 6 in order to make the total length
+ * an even multiple of 8 bytes (the block length). The padding length can be
+ * 6, 14, 22, and so on, through 254. If the padding length were the minimum
+ * necessary, 6, the padding would be 6 bytes, each containing the value 6.
+ * Thus, the last 8 octets of the GenericBlockCipher before block encryption
+ * would be xx 06 06 06 06 06 06 06, where xx is the last octet of the MAC.
+ *
+ * Note: With block ciphers in CBC mode (Cipher Block Chaining), it is critical
+ * that the entire plaintext of the record be known before any ciphertext is
+ * transmitted. Otherwise, it is possible for the attacker to mount the attack
+ * described in [CBCATT].
+ *
+ * Implementation note: Canvel et al. [CBCTIME] have demonstrated a timing
+ * attack on CBC padding based on the time required to compute the MAC. In
+ * order to defend against this attack, implementations MUST ensure that
+ * record processing time is essentially the same whether or not the padding
+ * is correct. In general, the best way to do this is to compute the MAC even
+ * if the padding is incorrect, and only then reject the packet. For instance,
+ * if the pad appears to be incorrect, the implementation might assume a
+ * zero-length pad and then compute the MAC. This leaves a small timing
+ * channel, since MAC performance depends, to some extent, on the size of the
+ * data fragment, but it is not believed to be large enough to be exploitable,
+ * due to the large block size of existing MACs and the small size of the
+ * timing signal.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 var $579f29a8775d6845$exports = {};
-
+/**
+ * Javascript implementation of Abstract Syntax Notation Number One.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2010-2015 Digital Bazaar, Inc.
+ *
+ * An API for storing data using the Abstract Syntax Notation Number One
+ * format using DER (Distinguished Encoding Rules) encoding. This encoding is
+ * commonly used to store data for PKI, i.e. X.509 Certificates, and this
+ * implementation exists for that purpose.
+ *
+ * Abstract Syntax Notation Number One (ASN.1) is used to define the abstract
+ * syntax of information without restricting the way the information is encoded
+ * for transmission. It provides a standard that allows for open systems
+ * communication. ASN.1 defines the syntax of information data and a number of
+ * simple data types as well as a notation for describing them and specifying
+ * values for them.
+ *
+ * The RSA algorithm creates public and private keys that are often stored in
+ * X.509 or PKCS#X formats -- which use ASN.1 (encoded in DER format). This
+ * class provides the most basic functionality required to store and load DSA
+ * keys that are encoded according to ASN.1.
+ *
+ * The most common binary encodings for ASN.1 are BER (Basic Encoding Rules)
+ * and DER (Distinguished Encoding Rules). DER is just a subset of BER that
+ * has stricter requirements for how data must be encoded.
+ *
+ * Each ASN.1 structure has a tag (a byte identifying the ASN.1 structure type)
+ * and a byte array for the value of this ASN1 structure which may be data or a
+ * list of ASN.1 structures.
+ *
+ * Each ASN.1 structure using BER is (Tag-Length-Value):
+ *
+ * | byte 0 | bytes X | bytes Y |
+ * |--------|---------|----------
+ * |  tag   | length  |  value  |
+ *
+ * ASN.1 allows for tags to be of "High-tag-number form" which allows a tag to
+ * be two or more octets, but that is not supported by this class. A tag is
+ * only 1 byte. Bits 1-5 give the tag number (ie the data type within a
+ * particular 'class'), 6 indicates whether or not the ASN.1 value is
+ * constructed from other ASN.1 values, and bits 7 and 8 give the 'class'. If
+ * bits 7 and 8 are both zero, the class is UNIVERSAL. If only bit 7 is set,
+ * then the class is APPLICATION. If only bit 8 is set, then the class is
+ * CONTEXT_SPECIFIC. If both bits 7 and 8 are set, then the class is PRIVATE.
+ * The tag numbers for the data types for the class UNIVERSAL are listed below:
+ *
+ * UNIVERSAL 0 Reserved for use by the encoding rules
+ * UNIVERSAL 1 Boolean type
+ * UNIVERSAL 2 Integer type
+ * UNIVERSAL 3 Bitstring type
+ * UNIVERSAL 4 Octetstring type
+ * UNIVERSAL 5 Null type
+ * UNIVERSAL 6 Object identifier type
+ * UNIVERSAL 7 Object descriptor type
+ * UNIVERSAL 8 External type and Instance-of type
+ * UNIVERSAL 9 Real type
+ * UNIVERSAL 10 Enumerated type
+ * UNIVERSAL 11 Embedded-pdv type
+ * UNIVERSAL 12 UTF8String type
+ * UNIVERSAL 13 Relative object identifier type
+ * UNIVERSAL 14-15 Reserved for future editions
+ * UNIVERSAL 16 Sequence and Sequence-of types
+ * UNIVERSAL 17 Set and Set-of types
+ * UNIVERSAL 18-22, 25-30 Character string types
+ * UNIVERSAL 23-24 Time types
+ *
+ * The length of an ASN.1 structure is specified after the tag identifier.
+ * There is a definite form and an indefinite form. The indefinite form may
+ * be used if the encoding is constructed and not all immediately available.
+ * The indefinite form is encoded using a length byte with only the 8th bit
+ * set. The end of the constructed object is marked using end-of-contents
+ * octets (two zero bytes).
+ *
+ * The definite form looks like this:
+ *
+ * The length may take up 1 or more bytes, it depends on the length of the
+ * value of the ASN.1 structure. DER encoding requires that if the ASN.1
+ * structure has a value that has a length greater than 127, more than 1 byte
+ * will be used to store its length, otherwise just one byte will be used.
+ * This is strict.
+ *
+ * In the case that the length of the ASN.1 value is less than 127, 1 octet
+ * (byte) is used to store the "short form" length. The 8th bit has a value of
+ * 0 indicating the length is "short form" and not "long form" and bits 7-1
+ * give the length of the data. (The 8th bit is the left-most, most significant
+ * bit: also known as big endian or network format).
+ *
+ * In the case that the length of the ASN.1 value is greater than 127, 2 to
+ * 127 octets (bytes) are used to store the "long form" length. The first
+ * byte's 8th bit is set to 1 to indicate the length is "long form." Bits 7-1
+ * give the number of additional octets. All following octets are in base 256
+ * with the most significant digit first (typical big-endian binary unsigned
+ * integer storage). So, for instance, if the length of a value was 257, the
+ * first byte would be set to:
+ *
+ * 10000010 = 130 = 0x82.
+ *
+ * This indicates there are 2 octets (base 256) for the length. The second and
+ * third bytes (the octets just mentioned) would store the length in base 256:
+ *
+ * octet 2: 00000001 = 1 * 256^1 = 256
+ * octet 3: 00000001 = 1 * 256^0 = 1
+ * total = 257
+ *
+ * The algorithm for converting a js integer value of 257 to base-256 is:
+ *
+ * var value = 257;
+ * var bytes = [];
+ * bytes[0] = (value >>> 8) & 0xFF; // most significant byte first
+ * bytes[1] = value & 0xFF;        // least significant byte last
+ *
+ * On the ASN.1 UNIVERSAL Object Identifier (OID) type:
+ *
+ * An OID can be written like: "value1.value2.value3...valueN"
+ *
+ * The DER encoding rules:
+ *
+ * The first byte has the value 40 * value1 + value2.
+ * The following bytes, if any, encode the remaining values. Each value is
+ * encoded in base 128, most significant digit first (big endian), with as
+ * few digits as possible, and the most significant bit of each byte set
+ * to 1 except the last in each value's encoding. For example: Given the
+ * OID "1.2.840.113549", its DER encoding is (remember each byte except the
+ * last one in each encoding is OR'd with 0x80):
+ *
+ * byte 1: 40 * 1 + 2 = 42 = 0x2A.
+ * bytes 2-3: 128 * 6 + 72 = 840 = 6 72 = 6 72 = 0x0648 = 0x8648
+ * bytes 4-6: 16384 * 6 + 128 * 119 + 13 = 6 119 13 = 0x06770D = 0x86F70D
+ *
+ * The final value is: 0x2A864886F70D.
+ * The full OID (including ASN.1 tag and length of 6 bytes) is:
+ * 0x06062A864886F70D
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 var $10862ec0f65326f9$exports = {};
-
+/**
+ * Object IDs for ASN.1.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2010-2013 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 $iGlOy.pki = $iGlOy.pki || {};
 var $10862ec0f65326f9$var$oids = $10862ec0f65326f9$exports = $iGlOy.pki.oids = $iGlOy.oids = $iGlOy.oids || {};
@@ -8244,7 +8667,9 @@ $10862ec0f65326f9$var$_IN("1.3.6.1.5.5.7.3.8", "timeStamping");
     // determine if a non-constructed value should be decoded as a composed
     // value that contains other ASN.1 objects. BIT STRINGs (and OCTET STRINGs)
     // can be used this way.
-    if (value === undefined && options.decodeBitStrings && tagClass === $579f29a8775d6845$var$asn1.Class.UNIVERSAL && type === $579f29a8775d6845$var$asn1.Type.BITSTRING /*|| type === asn1.Type.OCTETSTRING*/  && length > 1) {
+    if (value === undefined && options.decodeBitStrings && tagClass === $579f29a8775d6845$var$asn1.Class.UNIVERSAL && // FIXME: OCTET STRINGs not yet supported here
+    // .. other parts of forge expect to decode OCTET STRINGs manually
+    type === $579f29a8775d6845$var$asn1.Type.BITSTRING /*|| type === asn1.Type.OCTETSTRING*/  && length > 1) {
         // save read position
         var savedRead = bytes.read;
         var savedRemaining = remaining;
@@ -8347,7 +8772,9 @@ $10862ec0f65326f9$var$_IN("1.3.6.1.5.5.7.3.8", "timeStamping");
         else // ensure integer is minimally-encoded
         // TODO: should all leading bytes be stripped vs just one?
         // .. ex '00 00 01' => '01'?
-        if (obj.type === $579f29a8775d6845$var$asn1.Type.INTEGER && obj.value.length > 1 && (obj.value.charCodeAt(0) === 0 && (obj.value.charCodeAt(1) & 0x80) === 0 || obj.value.charCodeAt(0) === 0xFF && (obj.value.charCodeAt(1) & 0x80) === 0x80)) value.putBytes(obj.value.substr(1));
+        if (obj.type === $579f29a8775d6845$var$asn1.Type.INTEGER && obj.value.length > 1 && // leading 0x00 for positive integer
+        (obj.value.charCodeAt(0) === 0 && (obj.value.charCodeAt(1) & 0x80) === 0 || // leading 0xFF for negative integer
+        obj.value.charCodeAt(0) === 0xFF && (obj.value.charCodeAt(1) & 0x80) === 0x80)) value.putBytes(obj.value.substr(1));
         else value.putBytes(obj.value);
     }
     // add tag byte
@@ -8892,7 +9319,15 @@ var $579f29a8775d6845$var$_nonLatinRegex = /[^\\u0000-\\u00ff]/;
 
 
 var $84d5ddf5dc7c5415$exports = {};
-
+/**
+ * Hash-based Message Authentication Code implementation. Requires a message
+ * digest object that can be obtained, for example, from forge.md.sha1 or
+ * forge.md.md5.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2010-2012 Digital Bazaar, Inc. All rights reserved.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 parcelRequire("ai0Z9");
 
@@ -9003,7 +9438,13 @@ parcelRequire("ai0Z9");
 
 
 var $a933e3938fe5f3ff$exports = {};
-
+/**
+ * Message Digest Algorithm 5 with 128-bit digest (MD5) implementation.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2010-2014 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 parcelRequire("ai0Z9");
 
@@ -9362,7 +9803,34 @@ var $a933e3938fe5f3ff$var$_initialized = false;
 
 
 var $6c81a009b991fd79$exports = {};
-
+/**
+ * Javascript implementation of basic PEM (Privacy Enhanced Mail) algorithms.
+ *
+ * See: RFC 1421.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2013-2014 Digital Bazaar, Inc.
+ *
+ * A Forge PEM object has the following fields:
+ *
+ * type: identifies the type of message (eg: "RSA PRIVATE KEY").
+ *
+ * procType: identifies the type of processing performed on the message,
+ *   it has two subfields: version and type, eg: 4,ENCRYPTED.
+ *
+ * contentDomain: identifies the type of content in the message, typically
+ *   only uses the value: "RFC822".
+ *
+ * dekInfo: identifies the message encryption algorithm and mode and includes
+ *   any parameters for the algorithm, it has two subfields: algorithm and
+ *   parameters, eg: DES-CBC,F8143EDE5960C597.
+ *
+ * headers: contains all other PEM encapsulated headers -- where order is
+ *   significant (for pairing data like recipient ID + key info).
+ *
+ * body: the binary-encoded body.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 // shortcut for pem API
@@ -9529,17 +9997,72 @@ function $6c81a009b991fd79$var$ltrim(str) {
 
 
 var $71c5302ef2ea3950$exports = {};
-
+/**
+ * Javascript implementation of a basic Public Key Infrastructure, including
+ * support for RSA public and private keys.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2010-2013 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 
 var $4ead143e6089ae29$exports = {};
-
+/**
+ * Password-based encryption functions.
+ *
+ * @author Dave Longley
+ * @author Stefan Siegl <stesie@brokenpipe.de>
+ *
+ * Copyright (c) 2010-2013 Digital Bazaar, Inc.
+ * Copyright (c) 2012 Stefan Siegl <stesie@brokenpipe.de>
+ *
+ * An EncryptedPrivateKeyInfo:
+ *
+ * EncryptedPrivateKeyInfo ::= SEQUENCE {
+ *   encryptionAlgorithm  EncryptionAlgorithmIdentifier,
+ *   encryptedData        EncryptedData }
+ *
+ * EncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
+ *
+ * EncryptedData ::= OCTET STRING
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 
 var $ff4c3bd9116e15cc$exports = {};
-
+/**
+ * DES (Data Encryption Standard) implementation.
+ *
+ * This implementation supports DES as well as 3DES-EDE in ECB and CBC mode.
+ * It is based on the BSD-licensed implementation by Paul Tero:
+ *
+ * Paul Tero, July 2001
+ * http://www.tero.co.uk/des/
+ *
+ * Optimised for performance with large blocks by
+ * Michael Hayworth, November 2001
+ * http://www.netdealing.com
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * @author Stefan Siegl
+ * @author Dave Longley
+ *
+ * Copyright (c) 2012 Stefan Siegl <stesie@brokenpipe.de>
+ * Copyright (c) 2012-2014 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 
@@ -10704,7 +11227,15 @@ var $ff4c3bd9116e15cc$var$spfunction8 = [
 parcelRequire("ai0Z9");
 
 var $7436abf0cf29a7b7$exports = {};
-
+/**
+ * Password-Based Key-Derivation Function #2 implementation.
+ *
+ * See RFC 2898 for details.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2010-2013 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 parcelRequire("ai0Z9");
@@ -10863,11 +11394,33 @@ if ($iGlOy.util.isNodejs && !$iGlOy.options.usePureJavaScript) $7436abf0cf29a7b7
 
 
 var $b9b57fce3e6d85ef$exports = {};
-
+/**
+ * An API for getting cryptographically-secure random bytes. The bytes are
+ * generated using the Fortuna algorithm devised by Bruce Schneier and
+ * Niels Ferguson.
+ *
+ * Getting strong random bytes is not yet easy to do in javascript. The only
+ * truish random entropy that can be collected is from the mouse, keyboard, or
+ * from timing with respect to page loads, etc. This generator makes a poor
+ * attempt at providing random bytes when those sources haven't yet provided
+ * enough entropy to initially seed or to reseed the PRNG.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2009-2014 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 var $e523b90a804c5bd3$exports = {};
-
+/**
+ * Secure Hash Algorithm with 256-bit digest (SHA-256) implementation.
+ *
+ * See FIPS 180-2 for details.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2010-2015 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 parcelRequire("ai0Z9");
 
@@ -11177,7 +11730,17 @@ var $e523b90a804c5bd3$var$_k = null;
 
 
 var $c761b0edb959b99a$exports = {};
-
+/**
+ * A javascript implementation of a cryptographically-secure
+ * Pseudo Random Number Generator (PRNG). The Fortuna algorithm is followed
+ * here though the use of SHA-256 is not enforced; when generating an
+ * a PRNG context, the hashing algorithm and block cipher used for
+ * the generator are specified via a plugin.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2010-2014 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 var $c761b0edb959b99a$var$_crypto = null;
@@ -11641,7 +12204,16 @@ if ($iGlOy.util.isNodejs && !$iGlOy.options.usePureJavaScript && !process.versio
 
 
 var $e745366ef6f504e1$exports = {};
-
+/**
+ * RC2 implementation.
+ *
+ * @author Stefan Siegl
+ *
+ * Copyright (c) 2012 Stefan Siegl <stesie@brokenpipe.de>
+ *
+ * Information on the RC2 cipher is available from RFC #2268,
+ * http://www.ietf.org/rfc/rfc2268.txt
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 var $e745366ef6f504e1$var$piTable = [
@@ -12202,11 +12774,116 @@ var $e745366ef6f504e1$var$s = [
 
 
 var $8ab3548bea1beb81$exports = {};
-
+/**
+ * Javascript implementation of basic RSA algorithms.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2010-2014 Digital Bazaar, Inc.
+ *
+ * The only algorithm currently supported for PKI is RSA.
+ *
+ * An RSA key is often stored in ASN.1 DER format. The SubjectPublicKeyInfo
+ * ASN.1 structure is composed of an algorithm of type AlgorithmIdentifier
+ * and a subjectPublicKey of type bit string.
+ *
+ * The AlgorithmIdentifier contains an Object Identifier (OID) and parameters
+ * for the algorithm, if any. In the case of RSA, there aren't any.
+ *
+ * SubjectPublicKeyInfo ::= SEQUENCE {
+ *   algorithm AlgorithmIdentifier,
+ *   subjectPublicKey BIT STRING
+ * }
+ *
+ * AlgorithmIdentifer ::= SEQUENCE {
+ *   algorithm OBJECT IDENTIFIER,
+ *   parameters ANY DEFINED BY algorithm OPTIONAL
+ * }
+ *
+ * For an RSA public key, the subjectPublicKey is:
+ *
+ * RSAPublicKey ::= SEQUENCE {
+ *   modulus            INTEGER,    -- n
+ *   publicExponent     INTEGER     -- e
+ * }
+ *
+ * PrivateKeyInfo ::= SEQUENCE {
+ *   version                   Version,
+ *   privateKeyAlgorithm       PrivateKeyAlgorithmIdentifier,
+ *   privateKey                PrivateKey,
+ *   attributes           [0]  IMPLICIT Attributes OPTIONAL
+ * }
+ *
+ * Version ::= INTEGER
+ * PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier
+ * PrivateKey ::= OCTET STRING
+ * Attributes ::= SET OF Attribute
+ *
+ * An RSA private key as the following structure:
+ *
+ * RSAPrivateKey ::= SEQUENCE {
+ *   version Version,
+ *   modulus INTEGER, -- n
+ *   publicExponent INTEGER, -- e
+ *   privateExponent INTEGER, -- d
+ *   prime1 INTEGER, -- p
+ *   prime2 INTEGER, -- q
+ *   exponent1 INTEGER, -- d mod (p-1)
+ *   exponent2 INTEGER, -- d mod (q-1)
+ *   coefficient INTEGER -- (inverse of q) mod p
+ * }
+ *
+ * Version ::= INTEGER
+ *
+ * The OID for the RSA key algorithm is: 1.2.840.113549.1.1.1
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 var $1831e702d86f54be$exports = {};
-
+// Copyright (c) 2005  Tom Wu
+// All Rights Reserved.
+// See "LICENSE" for details.
+// Basic JavaScript BN library - subset useful for RSA encryption.
+/*
+Licensing (LICENSE)
+-------------------
+
+This software is covered under the following copyright:
+*/ /*
+ * Copyright (c) 2003-2005  Tom Wu
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
+ * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+ *
+ * IN NO EVENT SHALL TOM WU BE LIABLE FOR ANY SPECIAL, INCIDENTAL,
+ * INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, OR ANY DAMAGES WHATSOEVER
+ * RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER OR NOT ADVISED OF
+ * THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF LIABILITY, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * In addition, the following condition applies:
+ *
+ * All redistributions must retain an intact copy of this copyright notice
+ * and disclaimer.
+ */ /*
+Address all questions regarding this license to:
+
+  Tom Wu
+  tjw@cs.Stanford.EDU
+*/ 
 var $iGlOy = parcelRequire("iGlOy");
 $1831e702d86f54be$exports = $iGlOy.jsbn = $iGlOy.jsbn || {};
 // Bits per digit
@@ -13535,7 +14212,7 @@ function $1831e702d86f54be$var$bnpMillerRabin(t) {
         var y = a.modPow(r, this);
         if (y.compareTo($1831e702d86f54be$var$BigInteger.ONE) != 0 && y.compareTo(n1) != 0) {
             var j = 1;
-            while((j++) < k && y.compareTo(n1) != 0){
+            while(j++ < k && y.compareTo(n1) != 0){
                 y = y.modPowInt(2, this);
                 if (y.compareTo($1831e702d86f54be$var$BigInteger.ONE) == 0) return false;
             }
@@ -13612,12 +14289,62 @@ $1831e702d86f54be$var$BigInteger.prototype.isProbablePrime = $1831e702d86f54be$v
 
 
 var $564ac6480d83471d$exports = {};
-
+/**
+ * Partial implementation of PKCS#1 v2.2: RSA-OEAP
+ *
+ * Modified but based on the following MIT and BSD licensed code:
+ *
+ * https://github.com/kjur/jsjws/blob/master/rsa.js:
+ *
+ * The 'jsjws'(JSON Web Signature JavaScript Library) License
+ *
+ * Copyright (c) 2012 Kenji Urushima
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ *
+ * http://webrsa.cvs.sourceforge.net/viewvc/webrsa/Client/RSAES-OAEP.js?content-type=text%2Fplain:
+ *
+ * RSAES-OAEP.js
+ * $Id: RSAES-OAEP.js,v 1.1.1.1 2003/03/19 15:37:20 ellispritchard Exp $
+ * JavaScript Implementation of PKCS #1 v2.1 RSA CRYPTOGRAPHY STANDARD (RSA Laboratories, June 14, 2002)
+ * Copyright (C) Ellis Pritchard, Guardian Unlimited 2003.
+ * Contact: ellis@nukinetics.com
+ * Distributed under the BSD License.
+ *
+ * Official documentation: http://www.rsa.com/rsalabs/node.asp?id=2125
+ *
+ * @author Evan Jones (http://evanjones.ca/)
+ * @author Dave Longley
+ *
+ * Copyright (c) 2013-2014 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 
 var $7dc60e406dad2a14$exports = {};
-
+/**
+ * Secure Hash Algorithm with 160-bit digest (SHA-1) implementation.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2010-2015 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 parcelRequire("ai0Z9");
 
@@ -14052,7 +14779,13 @@ function $564ac6480d83471d$var$rsa_mgf1(seed, maskLength, hash) {
 
 
 var $82c15eca7626be33$exports = {};
-
+/**
+ * Prime number generation API.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2014 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 
@@ -14163,7 +14896,7 @@ var $iGlOy = parcelRequire("iGlOy");
             // do primality test
             if (num.isProbablePrime(mrTests)) return callback(null, num);
             // get next potential prime
-            num.dAddOffset(GCD_30_DELTA[(deltaIdx++) % 8], 0);
+            num.dAddOffset(GCD_30_DELTA[deltaIdx++ % 8], 0);
         }while (maxBlockTime < 0 || +new Date() - start < maxBlockTime);
         // keep trying later
         $iGlOy.util.setImmediate(function() {
@@ -14918,7 +15651,7 @@ var $8ab3548bea1beb81$var$digestInfoValidator = {
                 state.pqState = 0;
                 else if (state.num.isProbablePrime($8ab3548bea1beb81$var$_getMillerRabinTests(state.num.bitLength()))) ++state.pqState;
                 else // get next potential prime
-                state.num.dAddOffset($8ab3548bea1beb81$var$GCD_30_DELTA[(deltaIdx++) % 8], 0);
+                state.num.dAddOffset($8ab3548bea1beb81$var$GCD_30_DELTA[deltaIdx++ % 8], 0);
             } else if (state.pqState === 2) // ensure number is coprime with e
             state.pqState = state.num.subtract($8ab3548bea1beb81$var$BigInteger.ONE).gcd(state.e).compareTo($8ab3548bea1beb81$var$BigInteger.ONE) === 0 ? 3 : 0;
             else if (state.pqState === 3) {
@@ -15782,7 +16515,9 @@ var $8ab3548bea1beb81$var$digestInfoValidator = {
     if (hex[0] >= "8") hex = "00" + hex;
     var bytes = $iGlOy.util.hexToBytes(hex);
     // ensure integer is minimally-encoded
-    if (bytes.length > 1 && (bytes.charCodeAt(0) === 0 && (bytes.charCodeAt(1) & 0x80) === 0 || bytes.charCodeAt(0) === 0xFF && (bytes.charCodeAt(1) & 0x80) === 0x80)) return bytes.substr(1);
+    if (bytes.length > 1 && // leading 0x00 for positive integer
+    (bytes.charCodeAt(0) === 0 && (bytes.charCodeAt(1) & 0x80) === 0 || // leading 0xFF for negative integer
+    bytes.charCodeAt(0) === 0xFF && (bytes.charCodeAt(1) & 0x80) === 0x80)) return bytes.substr(1);
     return bytes;
 }
 /**
@@ -16733,13 +17468,215 @@ function $4ead143e6089ae29$var$createPbkdf2Params(salt, countBytes, dkLen, prfAl
 
 
 var $6fcb727b03413917$exports = {};
-
+/**
+ * Javascript implementation of PKCS#12.
+ *
+ * @author Dave Longley
+ * @author Stefan Siegl <stesie@brokenpipe.de>
+ *
+ * Copyright (c) 2010-2014 Digital Bazaar, Inc.
+ * Copyright (c) 2012 Stefan Siegl <stesie@brokenpipe.de>
+ *
+ * The ASN.1 representation of PKCS#12 is as follows
+ * (see ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-12/pkcs-12-tc1.pdf for details)
+ *
+ * PFX ::= SEQUENCE {
+ *   version  INTEGER {v3(3)}(v3,...),
+ *   authSafe ContentInfo,
+ *   macData  MacData OPTIONAL
+ * }
+ *
+ * MacData ::= SEQUENCE {
+ *   mac DigestInfo,
+ *   macSalt OCTET STRING,
+ *   iterations INTEGER DEFAULT 1
+ * }
+ * Note: The iterations default is for historical reasons and its use is
+ * deprecated. A higher value, like 1024, is recommended.
+ *
+ * DigestInfo is defined in PKCS#7 as follows:
+ *
+ * DigestInfo ::= SEQUENCE {
+ *   digestAlgorithm DigestAlgorithmIdentifier,
+ *   digest Digest
+ * }
+ *
+ * DigestAlgorithmIdentifier ::= AlgorithmIdentifier
+ *
+ * The AlgorithmIdentifier contains an Object Identifier (OID) and parameters
+ * for the algorithm, if any. In the case of SHA1 there is none.
+ *
+ * AlgorithmIdentifer ::= SEQUENCE {
+ *    algorithm OBJECT IDENTIFIER,
+ *    parameters ANY DEFINED BY algorithm OPTIONAL
+ * }
+ *
+ * Digest ::= OCTET STRING
+ *
+ *
+ * ContentInfo ::= SEQUENCE {
+ *   contentType ContentType,
+ *   content     [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL
+ * }
+ *
+ * ContentType ::= OBJECT IDENTIFIER
+ *
+ * AuthenticatedSafe ::= SEQUENCE OF ContentInfo
+ * -- Data if unencrypted
+ * -- EncryptedData if password-encrypted
+ * -- EnvelopedData if public key-encrypted
+ *
+ *
+ * SafeContents ::= SEQUENCE OF SafeBag
+ *
+ * SafeBag ::= SEQUENCE {
+ *   bagId     BAG-TYPE.&id ({PKCS12BagSet})
+ *   bagValue  [0] EXPLICIT BAG-TYPE.&Type({PKCS12BagSet}{@bagId}),
+ *   bagAttributes SET OF PKCS12Attribute OPTIONAL
+ * }
+ *
+ * PKCS12Attribute ::= SEQUENCE {
+ *   attrId ATTRIBUTE.&id ({PKCS12AttrSet}),
+ *   attrValues SET OF ATTRIBUTE.&Type ({PKCS12AttrSet}{@attrId})
+ * } -- This type is compatible with the X.500 type 'Attribute'
+ *
+ * PKCS12AttrSet ATTRIBUTE ::= {
+ *   friendlyName | -- from PKCS #9
+ *   localKeyId, -- from PKCS #9
+ *   ... -- Other attributes are allowed
+ * }
+ *
+ * CertBag ::= SEQUENCE {
+ *   certId    BAG-TYPE.&id   ({CertTypes}),
+ *   certValue [0] EXPLICIT BAG-TYPE.&Type ({CertTypes}{@certId})
+ * }
+ *
+ * x509Certificate BAG-TYPE ::= {OCTET STRING IDENTIFIED BY {certTypes 1}}
+ *   -- DER-encoded X.509 certificate stored in OCTET STRING
+ *
+ * sdsiCertificate BAG-TYPE ::= {IA5String IDENTIFIED BY {certTypes 2}}
+ * -- Base64-encoded SDSI certificate stored in IA5String
+ *
+ * CertTypes BAG-TYPE ::= {
+ *   x509Certificate |
+ *   sdsiCertificate,
+ *   ... -- For future extensions
+ * }
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 
 
 var $a5c085c32c6e5e1a$exports = {};
-
+/**
+ * Javascript implementation of ASN.1 validators for PKCS#7 v1.5.
+ *
+ * @author Dave Longley
+ * @author Stefan Siegl
+ *
+ * Copyright (c) 2012-2015 Digital Bazaar, Inc.
+ * Copyright (c) 2012 Stefan Siegl <stesie@brokenpipe.de>
+ *
+ * The ASN.1 representation of PKCS#7 is as follows
+ * (see RFC #2315 for details, http://www.ietf.org/rfc/rfc2315.txt):
+ *
+ * A PKCS#7 message consists of a ContentInfo on root level, which may
+ * contain any number of further ContentInfo nested into it.
+ *
+ * ContentInfo ::= SEQUENCE {
+ *   contentType                ContentType,
+ *   content               [0]  EXPLICIT ANY DEFINED BY contentType OPTIONAL
+ * }
+ *
+ * ContentType ::= OBJECT IDENTIFIER
+ *
+ * EnvelopedData ::= SEQUENCE {
+ *   version                    Version,
+ *   recipientInfos             RecipientInfos,
+ *   encryptedContentInfo       EncryptedContentInfo
+ * }
+ *
+ * EncryptedData ::= SEQUENCE {
+ *   version                    Version,
+ *   encryptedContentInfo       EncryptedContentInfo
+ * }
+ *
+ * id-signedData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
+ *   us(840) rsadsi(113549) pkcs(1) pkcs7(7) 2 }
+ *
+ * SignedData ::= SEQUENCE {
+ *   version           INTEGER,
+ *   digestAlgorithms  DigestAlgorithmIdentifiers,
+ *   contentInfo       ContentInfo,
+ *   certificates      [0] IMPLICIT Certificates OPTIONAL,
+ *   crls              [1] IMPLICIT CertificateRevocationLists OPTIONAL,
+ *   signerInfos       SignerInfos
+ * }
+ *
+ * SignerInfos ::= SET OF SignerInfo
+ *
+ * SignerInfo ::= SEQUENCE {
+ *   version                    Version,
+ *   issuerAndSerialNumber      IssuerAndSerialNumber,
+ *   digestAlgorithm            DigestAlgorithmIdentifier,
+ *   authenticatedAttributes    [0] IMPLICIT Attributes OPTIONAL,
+ *   digestEncryptionAlgorithm  DigestEncryptionAlgorithmIdentifier,
+ *   encryptedDigest            EncryptedDigest,
+ *   unauthenticatedAttributes  [1] IMPLICIT Attributes OPTIONAL
+ * }
+ *
+ * EncryptedDigest ::= OCTET STRING
+ *
+ * Attributes ::= SET OF Attribute
+ *
+ * Attribute ::= SEQUENCE {
+ *   attrType    OBJECT IDENTIFIER,
+ *   attrValues  SET OF AttributeValue
+ * }
+ *
+ * AttributeValue ::= ANY
+ *
+ * Version ::= INTEGER
+ *
+ * RecipientInfos ::= SET OF RecipientInfo
+ *
+ * EncryptedContentInfo ::= SEQUENCE {
+ *   contentType                 ContentType,
+ *   contentEncryptionAlgorithm  ContentEncryptionAlgorithmIdentifier,
+ *   encryptedContent       [0]  IMPLICIT EncryptedContent OPTIONAL
+ * }
+ *
+ * ContentEncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
+ *
+ * The AlgorithmIdentifier contains an Object Identifier (OID) and parameters
+ * for the algorithm, if any. In the case of AES and DES3, there is only one,
+ * the IV.
+ *
+ * AlgorithmIdentifer ::= SEQUENCE {
+ *    algorithm OBJECT IDENTIFIER,
+ *    parameters ANY DEFINED BY algorithm OPTIONAL
+ * }
+ *
+ * EncryptedContent ::= OCTET STRING
+ *
+ * RecipientInfo ::= SEQUENCE {
+ *   version                     Version,
+ *   issuerAndSerialNumber       IssuerAndSerialNumber,
+ *   keyEncryptionAlgorithm      KeyEncryptionAlgorithmIdentifier,
+ *   encryptedKey                EncryptedKey
+ * }
+ *
+ * IssuerAndSerialNumber ::= SEQUENCE {
+ *   issuer                      Name,
+ *   serialNumber                CertificateSerialNumber
+ * }
+ *
+ * CertificateSerialNumber ::= INTEGER
+ *
+ * KeyEncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
+ *
+ * EncryptedKey ::= OCTET STRING
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 
@@ -17086,17 +18023,139 @@ $a5c085c32c6e5e1a$var$p7v.recipientInfoValidator = {
 
 
 var $f71d929f259208f7$exports = {};
-
+/**
+ * Javascript implementation of X.509 and related components (such as
+ * Certification Signing Requests) of a Public Key Infrastructure.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2010-2014 Digital Bazaar, Inc.
+ *
+ * The ASN.1 representation of an X.509v3 certificate is as follows
+ * (see RFC 2459):
+ *
+ * Certificate ::= SEQUENCE {
+ *   tbsCertificate       TBSCertificate,
+ *   signatureAlgorithm   AlgorithmIdentifier,
+ *   signatureValue       BIT STRING
+ * }
+ *
+ * TBSCertificate ::= SEQUENCE {
+ *   version         [0]  EXPLICIT Version DEFAULT v1,
+ *   serialNumber         CertificateSerialNumber,
+ *   signature            AlgorithmIdentifier,
+ *   issuer               Name,
+ *   validity             Validity,
+ *   subject              Name,
+ *   subjectPublicKeyInfo SubjectPublicKeyInfo,
+ *   issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
+ *                        -- If present, version shall be v2 or v3
+ *   subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
+ *                        -- If present, version shall be v2 or v3
+ *   extensions      [3]  EXPLICIT Extensions OPTIONAL
+ *                        -- If present, version shall be v3
+ * }
+ *
+ * Version ::= INTEGER  { v1(0), v2(1), v3(2) }
+ *
+ * CertificateSerialNumber ::= INTEGER
+ *
+ * Name ::= CHOICE {
+ *   // only one possible choice for now
+ *   RDNSequence
+ * }
+ *
+ * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
+ *
+ * RelativeDistinguishedName ::= SET OF AttributeTypeAndValue
+ *
+ * AttributeTypeAndValue ::= SEQUENCE {
+ *   type     AttributeType,
+ *   value    AttributeValue
+ * }
+ * AttributeType ::= OBJECT IDENTIFIER
+ * AttributeValue ::= ANY DEFINED BY AttributeType
+ *
+ * Validity ::= SEQUENCE {
+ *   notBefore      Time,
+ *   notAfter       Time
+ * }
+ *
+ * Time ::= CHOICE {
+ *   utcTime        UTCTime,
+ *   generalTime    GeneralizedTime
+ * }
+ *
+ * UniqueIdentifier ::= BIT STRING
+ *
+ * SubjectPublicKeyInfo ::= SEQUENCE {
+ *   algorithm            AlgorithmIdentifier,
+ *   subjectPublicKey     BIT STRING
+ * }
+ *
+ * Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
+ *
+ * Extension ::= SEQUENCE {
+ *   extnID      OBJECT IDENTIFIER,
+ *   critical    BOOLEAN DEFAULT FALSE,
+ *   extnValue   OCTET STRING
+ * }
+ *
+ * The only key algorithm currently supported for PKI is RSA.
+ *
+ * RSASSA-PSS signatures are described in RFC 3447 and RFC 4055.
+ *
+ * PKCS#10 v1.7 describes certificate signing requests:
+ *
+ * CertificationRequestInfo:
+ *
+ * CertificationRequestInfo ::= SEQUENCE {
+ *   version       INTEGER { v1(0) } (v1,...),
+ *   subject       Name,
+ *   subjectPKInfo SubjectPublicKeyInfo{{ PKInfoAlgorithms }},
+ *   attributes    [0] Attributes{{ CRIAttributes }}
+ * }
+ *
+ * Attributes { ATTRIBUTE:IOSet } ::= SET OF Attribute{{ IOSet }}
+ *
+ * CRIAttributes  ATTRIBUTE  ::= {
+ *   ... -- add any locally defined attributes here -- }
+ *
+ * Attribute { ATTRIBUTE:IOSet } ::= SEQUENCE {
+ *   type   ATTRIBUTE.&id({IOSet}),
+ *   values SET SIZE(1..MAX) OF ATTRIBUTE.&Type({IOSet}{@type})
+ * }
+ *
+ * CertificationRequest ::= SEQUENCE {
+ *   certificationRequestInfo CertificationRequestInfo,
+ *   signatureAlgorithm AlgorithmIdentifier{{ SignatureAlgorithms }},
+ *   signature          BIT STRING
+ * }
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 
 
 parcelRequire("ai0Z9");
 var $c01d1f977f850a49$exports = {};
-
+/**
+ * Node.js module for Forge mask generation functions.
+ *
+ * @author Stefan Siegl
+ *
+ * Copyright 2012 Stefan Siegl <stesie@brokenpipe.de>
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 var $1a758e61c98aa2f6$exports = {};
-
+/**
+ * Javascript implementation of mask generation function MGF1.
+ *
+ * @author Stefan Siegl
+ * @author Dave Longley
+ *
+ * Copyright (c) 2012 Stefan Siegl <stesie@brokenpipe.de>
+ * Copyright (c) 2014 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 $iGlOy.mgf = $iGlOy.mgf || {};
@@ -17141,7 +18200,13 @@ $iGlOy.mgf.mgf1 = $iGlOy.mgf1;
 
 
 var $6aa068716df79957$exports = {};
-
+/**
+ * Javascript implementation of PKCS#1 PSS signature padding.
+ *
+ * @author Stefan Siegl
+ *
+ * Copyright (c) 2012 Stefan Siegl <stesie@brokenpipe.de>
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 
@@ -23392,7 +24457,12 @@ $e55982d45da68b81$var$hsTable[$e55982d45da68b81$var$tls.ConnectionEnd.server] =
     // cipher suites and compression methods size will need to be
     // updated if more get added to the list
     var sessionId = c.session.id;
-    var length = sessionId.length + 1 + 2 + 4 + 28 + 2 + cSuites + 1 + cMethods + extLength; // extensions vector
+    var length = sessionId.length + 1 + // session ID vector
+    2 + // version (major + minor)
+    4 + 28 + // random time and random bytes
+    2 + cSuites + // cipher suites vector
+    1 + cMethods + // compression methods vector
+    extLength; // extensions vector
     // build record fragment
     var rval = $iGlOy.util.createBuffer();
     rval.putByte($e55982d45da68b81$var$tls.HandshakeType.client_hello);
@@ -23415,7 +24485,11 @@ $e55982d45da68b81$var$hsTable[$e55982d45da68b81$var$tls.ConnectionEnd.server] =
  */ $e55982d45da68b81$var$tls.createServerHello = function(c) {
     // determine length of the handshake message
     var sessionId = c.session.id;
-    var length = sessionId.length + 1 + 2 + 4 + 28 + 2 + 1; // chosen compression method
+    var length = sessionId.length + 1 + // session ID vector
+    2 + // version (major + minor)
+    4 + 28 + // random time and random bytes
+    2 + // chosen cipher suite
+    1; // chosen compression method
     // build record fragment
     var rval = $iGlOy.util.createBuffer();
     rval.putByte($e55982d45da68b81$var$tls.HandshakeType.server_hello);
@@ -24851,12 +25925,32 @@ function $48103dfbc323e2e4$var$initConnectionState(state, c, sp) {
 
 
 var $96695cc1b97188e1$exports = {};
-
+/**
+ * JavaScript implementation of Ed25519.
+ *
+ * Copyright (c) 2017-2019 Digital Bazaar, Inc.
+ *
+ * This implementation is based on the most excellent TweetNaCl which is
+ * in the public domain. Many thanks to its contributors:
+ *
+ * https://github.com/dchest/tweetnacl-js
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 
 var $33c8fc1a702f0359$exports = {};
-
+/**
+ * Secure Hash Algorithm with a 1024-bit block size implementation.
+ *
+ * This includes: SHA-512, SHA-384, SHA-512/224, and SHA-512/256. For
+ * SHA-256 (block size 512 bits), see sha256.js.
+ *
+ * See FIPS 180-4 for details.
+ *
+ * @author Dave Longley
+ *
+ * Copyright (c) 2014-2015 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 parcelRequire("ai0Z9");
 
@@ -25551,17 +26645,25 @@ var $33c8fc1a702f0359$var$_states = null;
             hi = w2[0];
             lo = w2[1];
             // high bits
-            t1_hi = ((hi >>> 19 | lo << 13) ^ (lo >>> 29 | hi << 3) ^ hi >>> 6) >>> 0; // SHR 6
+            t1_hi = ((hi >>> 19 | lo << 13) ^ // ROTR 19
+            (lo >>> 29 | hi << 3) ^ // ROTR 61/(swap + ROTR 29)
+            hi >>> 6) >>> 0; // SHR 6
             // low bits
-            t1_lo = ((hi << 13 | lo >>> 19) ^ (lo << 3 | hi >>> 29) ^ (hi << 26 | lo >>> 6)) >>> 0; // SHR 6
+            t1_lo = ((hi << 13 | lo >>> 19) ^ (// ROTR 19
+            lo << 3 | hi >>> 29) ^ // ROTR 61/(swap + ROTR 29)
+            (hi << 26 | lo >>> 6)) >>> 0; // SHR 6
             // for word 15 words ago: ROTR 1(x) ^ ROTR 8(x) ^ SHR 7(x)
             w15 = w[i - 15];
             hi = w15[0];
             lo = w15[1];
             // high bits
-            t2_hi = ((hi >>> 1 | lo << 31) ^ (hi >>> 8 | lo << 24) ^ hi >>> 7) >>> 0; // SHR 7
+            t2_hi = ((hi >>> 1 | lo << 31) ^ // ROTR 1
+            (hi >>> 8 | lo << 24) ^ // ROTR 8
+            hi >>> 7) >>> 0; // SHR 7
             // low bits
-            t2_lo = ((hi << 31 | lo >>> 1) ^ (hi << 24 | lo >>> 8) ^ (hi << 25 | lo >>> 7)) >>> 0; // SHR 7
+            t2_lo = ((hi << 31 | lo >>> 1) ^ // ROTR 1
+            (hi << 24 | lo >>> 8) ^ (// ROTR 8
+            hi << 25 | lo >>> 7)) >>> 0; // SHR 7
             // sum(t1, word 7 ago, t2, word 16 ago) modulo 2^64 (carry lo overflow)
             w7 = w[i - 7];
             w16 = w[i - 16];
@@ -25589,14 +26691,22 @@ var $33c8fc1a702f0359$var$_states = null;
         // round function
         for(i = 0; i < 80; ++i){
             // Sum1(e) = ROTR 14(e) ^ ROTR 18(e) ^ ROTR 41(e)
-            s1_hi = ((e_hi >>> 14 | e_lo << 18) ^ (e_hi >>> 18 | e_lo << 14) ^ (e_lo >>> 9 | e_hi << 23)) >>> 0; // ROTR 41/(swap + ROTR 9)
-            s1_lo = ((e_hi << 18 | e_lo >>> 14) ^ (e_hi << 14 | e_lo >>> 18) ^ (e_lo << 23 | e_hi >>> 9)) >>> 0; // ROTR 41/(swap + ROTR 9)
+            s1_hi = ((e_hi >>> 14 | e_lo << 18) ^ (// ROTR 14
+            e_hi >>> 18 | e_lo << 14) ^ (// ROTR 18
+            e_lo >>> 9 | e_hi << 23)) >>> 0; // ROTR 41/(swap + ROTR 9)
+            s1_lo = ((e_hi << 18 | e_lo >>> 14) ^ // ROTR 14
+            (e_hi << 14 | e_lo >>> 18) ^ (// ROTR 18
+            e_lo << 23 | e_hi >>> 9)) >>> 0; // ROTR 41/(swap + ROTR 9)
             // Ch(e, f, g) (optimized the same way as SHA-1)
             ch_hi = (g_hi ^ e_hi & (f_hi ^ g_hi)) >>> 0;
             ch_lo = (g_lo ^ e_lo & (f_lo ^ g_lo)) >>> 0;
             // Sum0(a) = ROTR 28(a) ^ ROTR 34(a) ^ ROTR 39(a)
-            s0_hi = ((a_hi >>> 28 | a_lo << 4) ^ (a_lo >>> 2 | a_hi << 30) ^ (a_lo >>> 7 | a_hi << 25)) >>> 0; // ROTR 39/(swap + ROTR 7)
-            s0_lo = ((a_hi << 4 | a_lo >>> 28) ^ (a_lo << 30 | a_hi >>> 2) ^ (a_lo << 25 | a_hi >>> 7)) >>> 0; // ROTR 39/(swap + ROTR 7)
+            s0_hi = ((a_hi >>> 28 | a_lo << 4) ^ (// ROTR 28
+            a_lo >>> 2 | a_hi << 30) ^ // ROTR 34/(swap + ROTR 2)
+            (a_lo >>> 7 | a_hi << 25)) >>> 0; // ROTR 39/(swap + ROTR 7)
+            s0_lo = ((a_hi << 4 | a_lo >>> 28) ^ (// ROTR 28
+            a_lo << 30 | a_hi >>> 2) ^ (// ROTR 34/(swap + ROTR 2)
+            a_lo << 25 | a_hi >>> 7)) >>> 0; // ROTR 39/(swap + ROTR 7)
             // Maj(a, b, c) (optimized the same way as SHA-1)
             maj_hi = (a_hi & b_hi | c_hi & (a_hi ^ b_hi)) >>> 0;
             maj_lo = (a_lo & b_lo | c_lo & (a_lo ^ b_lo)) >>> 0;
@@ -25661,7 +26771,9 @@ var $33c8fc1a702f0359$var$_states = null;
 
 
 
-var $4540a91b15e72417$export$fed72f95cdc10258;
+/**
+ * Copyright (c) 2019 Digital Bazaar, Inc.
+ */ var $4540a91b15e72417$export$fed72f95cdc10258;
 var $4540a91b15e72417$export$16f1063872153885;
 
 var $iGlOy = parcelRequire("iGlOy");
@@ -26767,7 +27879,15 @@ function $96695cc1b97188e1$var$M(o, a, b) {
 
 
 var $8866d3403f6374db$exports = {};
-
+/**
+ * Javascript implementation of RSA-KEM.
+ *
+ * @author Lautaro Cozzani Rodriguez
+ * @author Dave Longley
+ *
+ * Copyright (c) 2014 Lautaro Cozzani <lautaro.cozzani@scytl.com>
+ * Copyright (c) 2014 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 
@@ -26900,7 +28020,13 @@ var $8866d3403f6374db$var$BigInteger = $iGlOy.jsbn.BigInteger;
 
 
 var $4b898e145571f67c$exports = {};
-
+/**
+ * Cross-browser support for logging in a web application.
+ *
+ * @author David I. Lehn <dlehn@digitalbazaar.com>
+ *
+ * Copyright (c) 2008-2013 Digital Bazaar, Inc.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 /* LOG API */ $4b898e145571f67c$exports = $iGlOy.log = $iGlOy.log || {};
@@ -27171,14 +28297,14 @@ $iGlOy.log.consoleLogger = $4b898e145571f67c$var$sConsoleLogger;
 
 
 var $8e579bac14cccf16$exports = {};
-
 /**
  * Node.js module for all known Forge message digests.
  *
  * @author Dave Longley
  *
  * Copyright 2011-2017 Digital Bazaar, Inc.
- */ $8e579bac14cccf16$exports = (parcelRequire("ai0Z9"));
+ */ 
+$8e579bac14cccf16$exports = (parcelRequire("ai0Z9"));
 
 
 
@@ -27191,7 +28317,24 @@ var $8e579bac14cccf16$exports = {};
 
 
 var $e128d865c5cf51a7$exports = {};
-
+/**
+ * Javascript implementation of PKCS#7 v1.5.
+ *
+ * @author Stefan Siegl
+ * @author Dave Longley
+ *
+ * Copyright (c) 2012 Stefan Siegl <stesie@brokenpipe.de>
+ * Copyright (c) 2012-2015 Digital Bazaar, Inc.
+ *
+ * Currently this implementation only supports ContentType of EnvelopedData,
+ * EncryptedData, or SignedData at the root level. The top level elements may
+ * contain only a ContentInfo of ContentType Data, i.e. plain data. Further
+ * nesting is not (yet) supported.
+ *
+ * The Forge validators for PKCS #7's ASN.1 structures are available from
+ * a separate file pkcs7asn1.js, since those are referenced from other
+ * PKCS standards like PKCS #12.
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 
@@ -27487,39 +28630,31 @@ $e128d865c5cf51a7$var$p7.createSignedData = function() {
         for(var i = 0; i < msg.signers.length; ++i){
             var signer = msg.signers[i];
             var oid = signer.digestAlgorithm;
-            if (!(oid in mds)) {
-                // content digest
-                mds[oid] = $iGlOy.md[$iGlOy.pki.oids[oid]].create();
-            }
-            if (signer.authenticatedAttributes.length === 0) {
-                // no custom attributes to digest; use content message digest
-                signer.md = mds[oid];
-            } else {
-                // custom attributes to be digested; use own message digest
-                // TODO: optimize to just copy message digest state if that
-                // feature is ever supported with message digests
-                signer.md = $iGlOy.md[$iGlOy.pki.oids[oid]].create();
-            }
+            if (!(oid in mds)) // content digest
+            mds[oid] = $iGlOy.md[$iGlOy.pki.oids[oid]].create();
+            if (signer.authenticatedAttributes.length === 0) // no custom attributes to digest; use content message digest
+            signer.md = mds[oid];
+            else // custom attributes to be digested; use own message digest
+            // TODO: optimize to just copy message digest state if that
+            // feature is ever supported with message digests
+            signer.md = $iGlOy.md[$iGlOy.pki.oids[oid]].create();
         }
         // add unique digest algorithm identifiers
         msg.digestAlgorithmIdentifiers = [];
-        for(var oid in mds){
-            msg.digestAlgorithmIdentifiers.push(// AlgorithmIdentifier
-            $e128d865c5cf51a7$var$asn1.create($e128d865c5cf51a7$var$asn1.Class.UNIVERSAL, $e128d865c5cf51a7$var$asn1.Type.SEQUENCE, true, [
-                // algorithm
-                $e128d865c5cf51a7$var$asn1.create($e128d865c5cf51a7$var$asn1.Class.UNIVERSAL, $e128d865c5cf51a7$var$asn1.Type.OID, false, $e128d865c5cf51a7$var$asn1.oidToDer(oid).getBytes()),
-                // parameters (null)
-                $e128d865c5cf51a7$var$asn1.create($e128d865c5cf51a7$var$asn1.Class.UNIVERSAL, $e128d865c5cf51a7$var$asn1.Type.NULL, false, "")
-            ]));
-        }
+        for(var oid in mds)msg.digestAlgorithmIdentifiers.push(// AlgorithmIdentifier
+        $e128d865c5cf51a7$var$asn1.create($e128d865c5cf51a7$var$asn1.Class.UNIVERSAL, $e128d865c5cf51a7$var$asn1.Type.SEQUENCE, true, [
+            // algorithm
+            $e128d865c5cf51a7$var$asn1.create($e128d865c5cf51a7$var$asn1.Class.UNIVERSAL, $e128d865c5cf51a7$var$asn1.Type.OID, false, $e128d865c5cf51a7$var$asn1.oidToDer(oid).getBytes()),
+            // parameters (null)
+            $e128d865c5cf51a7$var$asn1.create($e128d865c5cf51a7$var$asn1.Class.UNIVERSAL, $e128d865c5cf51a7$var$asn1.Type.NULL, false, "")
+        ]));
         return mds;
     }
     function addSignerInfos(mds) {
         var content;
-        if (msg.detachedContent) {
-            // Signature has been made in detached mode.
-            content = msg.detachedContent;
-        } else {
+        if (msg.detachedContent) // Signature has been made in detached mode.
+        content = msg.detachedContent;
+        else {
             // Note: ContentInfo is a SEQUENCE with 2 values, second value is
             // the content field and is optional for a ContentInfo but required here
             // since signers are present
@@ -27528,9 +28663,7 @@ $e128d865c5cf51a7$var$p7.createSignedData = function() {
             // skip [0] EXPLICIT content wrapper
             content = content.value[0];
         }
-        if (!content) {
-            throw new Error("Could not sign PKCS#7 message; there is no content to sign.");
-        }
+        if (!content) throw new Error("Could not sign PKCS#7 message; there is no content to sign.");
         // get ContentInfo content type
         var contentType = $e128d865c5cf51a7$var$asn1.derToOid(msg.contentInfo.value[0].value);
         // serialize content
@@ -27542,9 +28675,7 @@ $e128d865c5cf51a7$var$p7.createSignedData = function() {
         $e128d865c5cf51a7$var$asn1.getBerValueLength(bytes);
         bytes = bytes.getBytes();
         // digest content DER value bytes
-        for(var oid in mds){
-            mds[oid].start().update(bytes);
-        }
+        for(var oid in mds)mds[oid].start().update(bytes);
         // sign content
         var signingTime = new Date();
         for(var i = 0; i < msg.signers.length; ++i){
@@ -27552,9 +28683,7 @@ $e128d865c5cf51a7$var$p7.createSignedData = function() {
             if (signer.authenticatedAttributes.length === 0) {
                 // if ContentInfo content type is not "Data", then
                 // authenticatedAttributes must be present per RFC 2315
-                if (contentType !== $iGlOy.pki.oids.data) {
-                    throw new Error("Invalid signer; authenticatedAttributes must be present when the ContentInfo content type is not PKCS#7 Data.");
-                }
+                if (contentType !== $iGlOy.pki.oids.data) throw new Error("Invalid signer; authenticatedAttributes must be present when the ContentInfo content type is not PKCS#7 Data.");
             } else {
                 // process authenticated attributes
                 // [0] IMPLICIT
@@ -27564,14 +28693,11 @@ $e128d865c5cf51a7$var$p7.createSignedData = function() {
                 var attrsAsn1 = $e128d865c5cf51a7$var$asn1.create($e128d865c5cf51a7$var$asn1.Class.UNIVERSAL, $e128d865c5cf51a7$var$asn1.Type.SET, true, []);
                 for(var ai = 0; ai < signer.authenticatedAttributes.length; ++ai){
                     var attr = signer.authenticatedAttributes[ai];
-                    if (attr.type === $iGlOy.pki.oids.messageDigest) {
-                        // use content message digest as value
-                        attr.value = mds[signer.digestAlgorithm].digest();
-                    } else if (attr.type === $iGlOy.pki.oids.signingTime) {
-                        // auto-populate signing time if not already set
-                        if (!attr.value) {
-                            attr.value = signingTime;
-                        }
+                    if (attr.type === $iGlOy.pki.oids.messageDigest) // use content message digest as value
+                    attr.value = mds[signer.digestAlgorithm].digest();
+                    else if (attr.type === $iGlOy.pki.oids.signingTime) // auto-populate signing time if not already set
+                    {
+                        if (!attr.value) attr.value = signingTime;
                     }
                     // convert to ASN.1 and push onto Attributes SET (for signing) and
                     // onto authenticatedAttributesAsn1 to complete SignedData ASN.1
@@ -28138,7 +29264,16 @@ $e128d865c5cf51a7$var$p7.createSignedData = function() {
 
 
 var $85c6486b1bf8bee8$exports = {};
-
+/**
+ * Functions to output keys in SSH-friendly formats.
+ *
+ * This is part of the Forge project which may be used under the terms of
+ * either the BSD License or the GNU General Public License (GPL) Version 2.
+ *
+ * See: https://github.com/digitalbazaar/forge/blob/cbebca3780658703d925b61b2caffb1d263a6c1d/LICENSE
+ *
+ * @author https://github.com/shellac
+ */ 
 var $iGlOy = parcelRequire("iGlOy");
 
 
@@ -28457,8 +29592,49 @@ async function $186980c178984fd2$export$2e2bcd8739ae039(fs, options) {
 }
 
 
+
+
+const $3dff16cfd200ff25$var$ABSOLUTE_PATH_REGEX = /^([a-zA-Z]:){0,1}[\\/]+/;
+const $3dff16cfd200ff25$var$SEPARATOR_REGEX = /[\\]+/g;
+function $3dff16cfd200ff25$export$e434c7255acda994(filepath) {
+    return $3dff16cfd200ff25$var$ABSOLUTE_PATH_REGEX.test(filepath);
+}
+function $3dff16cfd200ff25$export$16778b798ae8e49d(filePath) {
+    return filePath.replace($3dff16cfd200ff25$var$SEPARATOR_REGEX, "/");
+}
+function $3dff16cfd200ff25$export$6af368f973c74c5(filePath, leadingDotSlash = true) {
+    if (leadingDotSlash && (filePath[0] !== "." || filePath[1] !== "." && filePath[1] !== "/" && filePath[1] !== "\\") && !(0, ($parcel$interopDefault($8C1kk$path))).isAbsolute(filePath)) return $3dff16cfd200ff25$export$16778b798ae8e49d("./" + filePath);
+    else return $3dff16cfd200ff25$export$16778b798ae8e49d(filePath);
+}
+function $3dff16cfd200ff25$export$7413eea5ad243d4(from, to, leadingDotSlash = true) {
+    // Fast path
+    if (to.startsWith(from + "/")) return (leadingDotSlash ? "./" : "") + to.slice(from.length + 1);
+    return $3dff16cfd200ff25$export$6af368f973c74c5((0, ($parcel$interopDefault($8C1kk$path))).relative(from, to), leadingDotSlash);
+}
+
+
+function $313980afb666b13e$export$2e2bcd8739ae039(_name) {
+    let name = (0, ($parcel$interopDefault($8C1kk$path))).normalize(_name);
+    let splitOn = name.indexOf((0, ($parcel$interopDefault($8C1kk$path))).sep);
+    if (name.charAt(0) === "@") splitOn = name.indexOf((0, ($parcel$interopDefault($8C1kk$path))).sep, splitOn + 1);
+    if (splitOn < 0) return [
+        (0, $3dff16cfd200ff25$export$16778b798ae8e49d)(name),
+        undefined
+    ];
+    else return [
+        (0, $3dff16cfd200ff25$export$16778b798ae8e49d)(name.substring(0, splitOn)),
+        name.substring(splitOn + 1) || undefined
+    ];
+}
+
+
 var $5aee5a8e09e874bf$exports = {};
-var $49a059b76f641953$exports = {};
+/*!
+ * is-glob <https://github.com/jonschlinkert/is-glob>
+ *
+ * Copyright (c) 2014-2017, Jon Schlinkert.
+ * Released under the MIT License.
+ */ var $49a059b76f641953$exports = {};
 /*!
  * is-extglob <https://github.com/jonschlinkert/is-extglob>
  *
@@ -30999,27 +32175,17 @@ function $4609f2cae016f1ac$var$fastqueue(context, worker, concurrency) {
         }
     }
     function release(holder) {
-        if (holder) {
-            cache.release(holder);
-        }
+        if (holder) cache.release(holder);
         var next = queueHead;
         if (next) {
             if (!self.paused) {
-                if (queueTail === queueHead) {
-                    queueTail = null;
-                }
+                if (queueTail === queueHead) queueTail = null;
                 queueHead = next.next;
                 next.next = null;
                 worker.call(context, next.value, next.worked);
-                if (queueTail === null) {
-                    self.empty();
-                }
-            } else {
-                _running--;
-            }
-        } else if (--_running === 0) {
-            self.drain();
-        }
+                if (queueTail === null) self.empty();
+            } else _running--;
+        } else if (--_running === 0) self.drain();
     }
     function kill() {
         queueHead = null;
@@ -31882,25 +33048,6 @@ $b57e78be4f7a2622$exports = $b57e78be4f7a2622$var$FastGlob;
 
 
 
-const $3dff16cfd200ff25$var$ABSOLUTE_PATH_REGEX = /^([a-zA-Z]:){0,1}[\\/]+/;
-const $3dff16cfd200ff25$var$SEPARATOR_REGEX = /[\\]+/g;
-function $3dff16cfd200ff25$export$e434c7255acda994(filepath) {
-    return $3dff16cfd200ff25$var$ABSOLUTE_PATH_REGEX.test(filepath);
-}
-function $3dff16cfd200ff25$export$16778b798ae8e49d(filePath) {
-    return filePath.replace($3dff16cfd200ff25$var$SEPARATOR_REGEX, "/");
-}
-function $3dff16cfd200ff25$export$6af368f973c74c5(filePath, leadingDotSlash = true) {
-    if (leadingDotSlash && (filePath[0] !== "." || filePath[1] !== "." && filePath[1] !== "/" && filePath[1] !== "\\") && !(0, ($parcel$interopDefault($8C1kk$path))).isAbsolute(filePath)) return $3dff16cfd200ff25$export$16778b798ae8e49d("./" + filePath);
-    else return $3dff16cfd200ff25$export$16778b798ae8e49d(filePath);
-}
-function $3dff16cfd200ff25$export$7413eea5ad243d4(from, to, leadingDotSlash = true) {
-    // Fast path
-    if (to.startsWith(from + "/")) return (leadingDotSlash ? "./" : "") + to.slice(from.length + 1);
-    return $3dff16cfd200ff25$export$6af368f973c74c5((0, ($parcel$interopDefault($8C1kk$path))).relative(from, to), leadingDotSlash);
-}
-
-
 function $e8d0e504a4244d84$export$f3a2344a73dbdd42(p) {
     return (0, (/*@__PURE__*/$parcel$interopDefault($5aee5a8e09e874bf$exports)))((0, $3dff16cfd200ff25$export$16778b798ae8e49d)(p));
 }
@@ -32061,7 +33208,6 @@ function $ec068ba9e84f8eea$export$2e2bcd8739ae039(timeInMs) {
 
 
 
-
 var $77226306a1863103$exports = {};
 "use strict";
 var $3124255f7fbe16f0$exports = {};
@@ -32338,8 +33484,8 @@ async function $f02d6a9d30f55938$export$2e2bcd8739ae039(diagnostic, options, ter
         let filePath = codeFrame.filePath;
         if (filePath != null && options && !(0, ($parcel$interopDefault($8C1kk$path))).isAbsolute(filePath)) filePath = (0, ($parcel$interopDefault($8C1kk$path))).join(options.projectRoot, filePath);
         let highlights = codeFrame.codeHighlights;
-        var _code;
-        let code = (_code = codeFrame.code) !== null && _code !== void 0 ? _code : options && await options.inputFS.readFile((0, (/*@__PURE__*/$parcel$interopDefault($812806c6461f2963$exports)))(filePath), "utf8");
+        let code = codeFrame.code;
+        if (code == null && options && filePath != null) code = await options.inputFS.readFile(filePath, "utf8");
         let formattedCodeFrame = "";
         if (code != null) formattedCodeFrame = (0, ($parcel$interopDefault($8C1kk$parcelcodeframe)))(code, highlights, {
             useColor: true,
@@ -32925,9 +34071,9 @@ function $e499d3e618e93ebd$export$2e2bcd8739ae039(fn, delay) {
 
 
 var $618f8c1de80a427f$exports = {};
-"use strict";
 
 var $618f8c1de80a427f$var$$parcel$__dirname = $8C1kk$path.resolve(__dirname, "../../../../node_modules/open");
+"use strict";
 
 var $618f8c1de80a427f$require$promisify = $8C1kk$util.promisify;
 
@@ -34194,22 +35340,13 @@ var $5dc3ee1f90b35876$var$stringify = function stringify(value, replacer, space)
     function serializeProperty(key, holder) {
         let value = holder[key];
         if (value != null) {
-            if (typeof value.toJSON5 === "function") {
-                value = value.toJSON5(key);
-            } else if (typeof value.toJSON === "function") {
-                value = value.toJSON(key);
-            }
-        }
-        if (replacerFunc) {
-            value = replacerFunc.call(holder, key, value);
-        }
-        if (value instanceof Number) {
-            value = Number(value);
-        } else if (value instanceof String) {
-            value = String(value);
-        } else if (value instanceof Boolean) {
-            value = value.valueOf();
+            if (typeof value.toJSON5 === "function") value = value.toJSON5(key);
+            else if (typeof value.toJSON === "function") value = value.toJSON(key);
         }
+        if (replacerFunc) value = replacerFunc.call(holder, key, value);
+        if (value instanceof Number) value = Number(value);
+        else if (value instanceof String) value = String(value);
+        else if (value instanceof Boolean) value = value.valueOf();
         switch(value){
             case null:
                 return "null";
@@ -34218,15 +35355,9 @@ var $5dc3ee1f90b35876$var$stringify = function stringify(value, replacer, space)
             case false:
                 return "false";
         }
-        if (typeof value === "string") {
-            return quoteString(value, false);
-        }
-        if (typeof value === "number") {
-            return String(value);
-        }
-        if (typeof value === "object") {
-            return Array.isArray(value) ? serializeArray(value) : serializeObject(value);
-        }
+        if (typeof value === "string") return quoteString(value, false);
+        if (typeof value === "number") return String(value);
+        if (typeof value === "object") return Array.isArray(value) ? serializeArray(value) : serializeObject(value);
         return undefined;
     }
     function quoteString(value) {
@@ -34279,9 +35410,7 @@ var $5dc3ee1f90b35876$var$stringify = function stringify(value, replacer, space)
         return quoteChar + product + quoteChar;
     }
     function serializeObject(value) {
-        if (stack.indexOf(value) >= 0) {
-            throw TypeError("Converting circular structure to JSON5");
-        }
+        if (stack.indexOf(value) >= 0) throw TypeError("Converting circular structure to JSON5");
         stack.push(value);
         let stepback = indent;
         indent = indent + gap;
@@ -34291,17 +35420,14 @@ var $5dc3ee1f90b35876$var$stringify = function stringify(value, replacer, space)
             const propertyString = serializeProperty(key, value);
             if (propertyString !== undefined) {
                 let member = serializeKey(key) + ":";
-                if (gap !== "") {
-                    member += " ";
-                }
+                if (gap !== "") member += " ";
                 member += propertyString;
                 partial.push(member);
             }
         }
         let final;
-        if (partial.length === 0) {
-            final = "{}";
-        } else {
+        if (partial.length === 0) final = "{}";
+        else {
             let properties;
             if (gap === "") {
                 properties = partial.join(",");
@@ -34317,24 +35443,16 @@ var $5dc3ee1f90b35876$var$stringify = function stringify(value, replacer, space)
         return final;
     }
     function serializeKey(key) {
-        if (key.length === 0) {
-            return quoteString(key, true);
-        }
+        if (key.length === 0) return quoteString(key, true);
         const firstChar = String.fromCodePoint(key.codePointAt(0));
-        if (!$5dc3ee1f90b35876$var$util.isIdStartChar(firstChar)) {
-            return quoteString(key, true);
-        }
+        if (!$5dc3ee1f90b35876$var$util.isIdStartChar(firstChar)) return quoteString(key, true);
         for(let i = firstChar.length; i < key.length; i++){
-            if (!$5dc3ee1f90b35876$var$util.isIdContinueChar(String.fromCodePoint(key.codePointAt(i)))) {
-                return quoteString(key, true);
-            }
+            if (!$5dc3ee1f90b35876$var$util.isIdContinueChar(String.fromCodePoint(key.codePointAt(i)))) return quoteString(key, true);
         }
         return key;
     }
     function serializeArray(value) {
-        if (stack.indexOf(value) >= 0) {
-            throw TypeError("Converting circular structure to JSON5");
-        }
+        if (stack.indexOf(value) >= 0) throw TypeError("Converting circular structure to JSON5");
         stack.push(value);
         let stepback = indent;
         indent = indent + gap;
@@ -34344,17 +35462,14 @@ var $5dc3ee1f90b35876$var$stringify = function stringify(value, replacer, space)
             partial.push(propertyString !== undefined ? propertyString : "null");
         }
         let final;
-        if (partial.length === 0) {
-            final = "[]";
+        if (partial.length === 0) final = "[]";
+        else if (gap === "") {
+            let properties = partial.join(",");
+            final = "[" + properties + "]";
         } else {
-            if (gap === "") {
-                let properties = partial.join(",");
-                final = "[" + properties + "]";
-            } else {
-                let separator = ",\n" + indent;
-                let properties1 = partial.join(separator);
-                final = "[\n" + indent + properties1 + ",\n" + stepback + "]";
-            }
+            let separator = ",\n" + indent;
+            let properties1 = partial.join(separator);
+            final = "[\n" + indent + properties1 + ",\n" + stepback + "]";
         }
         stack.pop();
         indent = stepback;
@@ -35203,7 +36318,7 @@ function $4b14026b40817fca$export$42462553d605d8cd(fs, filePath) {
 }
 
 
-let $1c93db5abaa33eaa$export$8b1c306fed4227bf; // $FlowFixMe[prop-missing]
+/* global MessageChannel:readonly */ let $1c93db5abaa33eaa$export$8b1c306fed4227bf; // $FlowFixMe[prop-missing]
 if (process.browser) {
     $1c93db5abaa33eaa$export$8b1c306fed4227bf = ArrayBuffer; // Safari has removed the constructor
     if (typeof SharedArrayBuffer !== "undefined") {