3.4 KiB
3.4 KiB
Corresponding source and provenance
The corresponding source for OTP & Passkey Tools 0.2.0 is published at:
https://git.add-ideas.de/lotobo/auth-tools/src/tag/v0.2.0
Build that tag with Node.js 22 and the exact package-lock.json:
npm ci
npm run release:artifact
No generated bundle is the preferred source form. No runtime code, metadata or cryptographic service is loaded from a CDN.
Standards and revisions used
| Source | Revision | Use |
|---|---|---|
| Toolbox SDK | ef2dab4b46c61812c9a877d8a19fe497b4a4630a, packages 0.2.3 |
manifest, context, shell and build checks |
| Toolbox Portal | tag v0.12.0 | release and UX integration contract |
| RFC 4226 | December 2005 | HOTP semantics and vectors |
| RFC 6238 | May 2011 | TOTP semantics and vectors |
| RFC 6287 | June 2011 | OCRA suite grammar, semantics and vectors |
| RFC 6030 | October 2010 | bounded plain-secret PSKC import |
| Google Authenticator migration protobuf | observed public interchange schema | local import only; unknown fields are skipped safely |
| Aegis vault specification/importer sources | upstream master, accessed 19 August 2026 |
bounded plaintext Aegis, andOTP, 2FAS and FreeOTP migration |
| Web Authentication | W3C WebAuthn Level 3 Recommendation, 13 January 2026 | client/authenticator structures and ceremony expectations |
| FIDO Metadata Service | v3.1 Proposed Standard, 21 May 2025 | explicit offline Metadata BLOB import and status interpretation |
| RFC 8949 / RFC 9052 / RFC 8152 registrations | published versions | bounded CBOR and COSE key interpretation |
| QR Code for JavaScript | Kazuhiko Arase, 2009 | QR construction algorithm rewritten in TypeScript under MIT terms |
| jsQR | 1.4.0 | bundled cross-browser QR image decoder under Apache-2.0 |
The OCRA implementation was authored from the normative RFC definition and tested with its published interoperability values; the RFC Java reference implementation is not included. The QR module is an acknowledged clean TypeScript rewrite of the MIT-licensed construction algorithm, with deliberately bounded version support.