Changelog

All notable changes are documented here.

Unreleased

Added auditable TOTP time travel using live time, bounded positive or negative period offsets, or a frozen local date/time interpreted in an explicit IANA timezone.
Added DST gap rejection and earlier/later disambiguation for repeated wall-clock times, with effective local time, UTC instant, Unix seconds and TOTP counter diagnostics.
Added an OTP timeline, bounded clock-drift search, JSON interoperability vectors, and custom RFC 6238 T0 support with provisioning-portability warnings.
Added complete Google Authenticator multi-QR batch assembly and explicit Aegis, 2FAS, andOTP and legacy FreeOTP JSON importers.
Added the Apache-2.0 jsQR decoder as a bundled fallback when BarcodeDetector is missing or cannot decode an image.
Added collection health reports for reused secrets, duplicate labels, short secrets and non-default timing.
Added a versioned encrypted-backup format using PBKDF2-HMAC-SHA-256 and authenticated AES-256-GCM, with no persistent browser storage.
Added layered WebAuthn registration verification for none, packed/self, FIDO U2F, TPM 2.0, Android Key and Apple anonymous attestation statements.
Added explicit local import and JWS verification of FIDO Metadata Service v3 snapshots, while keeping signer-chain trust separate and unestablished by default.
Updated the transitive nanoid build dependency to 3.3.18; npm audit reports no known vulnerabilities.

Initial HOTP, TOTP and OCRA credential laboratory with official RFC-vector coverage.
Added strict provisioning URI handling, local QR generation/image detection, Google migration, CSV, URI-list and plain-secret PSKC workflows.
Added bounded WebAuthn CBOR/client/authenticator/attestation inspection and layered assertion verification.
Added origin-gated, memory-only WebAuthn registration/authentication lab and browser capability diagnostics.
Added Toolbox SDK 0.2.3 integration, responsive light/dark/system UI, reproducible release packaging, source identity and security/licence documentation.