# Corresponding source and provenance

The corresponding source for OTP & Passkey Tools 0.2.0 is published at:

https://git.add-ideas.de/lotobo/auth-tools/src/tag/v0.2.0

Build that tag with Node.js 22 and the exact `package-lock.json`:

```sh
npm ci
npm run release:artifact
```

No generated bundle is the preferred source form. No runtime code, metadata or cryptographic service is loaded from a CDN.

## Standards and revisions used

| Source                                       | Revision                                                   | Use                                                               |
| -------------------------------------------- | ---------------------------------------------------------- | ----------------------------------------------------------------- |
| Toolbox SDK                                  | `ef2dab4b46c61812c9a877d8a19fe497b4a4630a`, packages 0.2.3 | manifest, context, shell and build checks                         |
| Toolbox Portal                               | tag v0.12.0                                                | release and UX integration contract                               |
| RFC 4226                                     | December 2005                                              | HOTP semantics and vectors                                        |
| RFC 6238                                     | May 2011                                                   | TOTP semantics and vectors                                        |
| RFC 6287                                     | June 2011                                                  | OCRA suite grammar, semantics and vectors                         |
| RFC 6030                                     | October 2010                                               | bounded plain-secret PSKC import                                  |
| Google Authenticator migration protobuf      | observed public interchange schema                         | local import only; unknown fields are skipped safely              |
| Aegis vault specification/importer sources   | upstream `master`, accessed 19 August 2026                 | bounded plaintext Aegis, andOTP, 2FAS and FreeOTP migration       |
| Web Authentication                           | W3C WebAuthn Level 3 Recommendation, 13 January 2026       | client/authenticator structures and ceremony expectations         |
| FIDO Metadata Service                        | v3.1 Proposed Standard, 21 May 2025                        | explicit offline Metadata BLOB import and status interpretation   |
| RFC 8949 / RFC 9052 / RFC 8152 registrations | published versions                                         | bounded CBOR and COSE key interpretation                          |
| QR Code for JavaScript                       | Kazuhiko Arase, 2009                                       | QR construction algorithm rewritten in TypeScript under MIT terms |
| jsQR                                         | 1.4.0                                                      | bundled cross-browser QR image decoder under Apache-2.0           |

The OCRA implementation was authored from the normative RFC definition and tested with its published interoperability values; the RFC Java reference implementation is not included. The QR module is an acknowledged clean TypeScript rewrite of the MIT-licensed construction algorithm, with deliberately bounded version support.