# Changelog

All notable changes are documented here.

## Unreleased

## 0.3.1 - 2026-09-01

- Corrected the packaged corresponding-source identity to name this release and its immutable source tag.
- Serialized the unit-test worker pool so release verification remains reliable on shared filesystems.
- Normalized ZIP creation to UTC so release bytes remain reproducible across host timezones.

## 0.3.0 - 2026-08-19

- Added a live WebAuthn Extensions Lab for `credProps`, PRF, `largeBlob`, `appid` and `appidExclude`, including client-capability detection and normalized request/result inspection.
- Added bounded, versioned WebAuthn ceremony traces with raw and redacted export, offline cryptographic replay and structural comparison.
- Added user-pinned Metadata Service trust roots, signer-chain signature validation and historical, firmware-aware attestation status policy evaluation.
- Added strict Google Authenticator migration export with multi-part QR rendering and loss-prevention checks.
- Added local password-vault decryption for Aegis AES-256-GCM/scrypt password slots with bounded work parameters.
- Added an authenticated RFC 6030 PSKC password profile using PBKDF2, AES-CBC, an encrypted MAC key and per-secret HMAC `ValueMAC` checks.
- Added secret-free collection snapshots, before/after comparison, secret-reuse detection and prioritized rotation planning.
- Added bounded HOTP counter resynchronization with optional consecutive-code confirmation.
- Added explicitly triggered camera QR scanning with native/fallback decoding, automatic track cleanup and a dedicated-origin Permissions Policy.
- Added `@noble/hashes` 2.3.0 for audited, asynchronous local scrypt derivation; the locked dependency audit reports no known vulnerabilities.

## 0.2.0 - 2026-08-19

- Added auditable TOTP time travel using live time, bounded positive or negative period offsets, or a frozen local date/time interpreted in an explicit IANA timezone.
- Added DST gap rejection and earlier/later disambiguation for repeated wall-clock times, with effective local time, UTC instant, Unix seconds and TOTP counter diagnostics.
- Added an OTP timeline, bounded clock-drift search, JSON interoperability vectors, and custom RFC 6238 T0 support with provisioning-portability warnings.
- Added complete Google Authenticator multi-QR batch assembly and explicit Aegis, 2FAS, andOTP and legacy FreeOTP JSON importers.
- Added the Apache-2.0 jsQR decoder as a bundled fallback when `BarcodeDetector` is missing or cannot decode an image.
- Added collection health reports for reused secrets, duplicate labels, short secrets and non-default timing.
- Added a versioned encrypted-backup format using PBKDF2-HMAC-SHA-256 and authenticated AES-256-GCM, with no persistent browser storage.
- Added layered WebAuthn registration verification for none, packed/self, FIDO U2F, TPM 2.0, Android Key and Apple anonymous attestation statements.
- Added explicit local import and JWS verification of FIDO Metadata Service v3 snapshots, while keeping signer-chain trust separate and unestablished by default.
- Updated the transitive `nanoid` build dependency to 3.3.18; `npm audit` reports no known vulnerabilities.

## 0.1.0 - 2026-08-19

- Initial HOTP, TOTP and OCRA credential laboratory with official RFC-vector coverage.
- Added strict provisioning URI handling, local QR generation/image detection, Google migration, CSV, URI-list and plain-secret PSKC workflows.
- Added bounded WebAuthn CBOR/client/authenticator/attestation inspection and layered assertion verification.
- Added origin-gated, memory-only WebAuthn registration/authentication lab and browser capability diagnostics.
- Added Toolbox SDK 0.2.3 integration, responsive light/dark/system UI, reproducible release packaging, source identity and security/licence documentation.