2.8 KiB
2.8 KiB
Corresponding source and provenance
The corresponding source for OTP & Passkey Tools 0.1.0 will be published at:
https://git.add-ideas.de/lotobo/auth-tools/src/tag/v0.1.0
Build that tag with Node.js 22 and the exact package-lock.json:
npm ci
npm run release:artifact
No generated bundle is the preferred source form. No runtime code, metadata or cryptographic service is loaded from a CDN.
Standards and revisions used
| Source | Revision | Use |
|---|---|---|
| Toolbox SDK | ef2dab4b46c61812c9a877d8a19fe497b4a4630a, packages 0.2.3 |
manifest, context, shell and build checks |
| Toolbox Portal | 5ed7134d42f0b563bc47a1572107ea94994dfe3c, tag v0.10.0 |
release and UX integration contract |
| RFC 4226 | December 2005 | HOTP semantics and vectors |
| RFC 6238 | May 2011 | TOTP semantics and vectors |
| RFC 6287 | June 2011 | OCRA suite grammar, semantics and vectors |
| RFC 6030 | October 2010 | bounded plain-secret PSKC import |
| Google Authenticator migration protobuf | observed public interchange schema | local import only; unknown fields are skipped safely |
| Web Authentication | W3C WebAuthn Level 3 Recommendation, 13 January 2026 | client/authenticator structures and ceremony expectations |
| RFC 8949 / RFC 9052 / RFC 8152 registrations | published versions | bounded CBOR and COSE key interpretation |
| QR Code for JavaScript | Kazuhiko Arase, 2009 | QR construction algorithm rewritten in TypeScript under MIT terms |
The OCRA implementation was authored from the normative RFC definition and tested with its published interoperability values; the RFC Java reference implementation is not included. The QR module is an acknowledged clean TypeScript rewrite of the MIT-licensed construction algorithm, with deliberately bounded version support.