auth-tools/public/SOURCE.md

Corresponding source and provenance

The corresponding source for OTP & Passkey Tools 0.3.1 is published at:

https://git.add-ideas.de/lotobo/auth-tools/src/tag/v0.3.1

Build that tag with Node.js 22 and the exact package-lock.json:

npm ci
npm run release:artifact

No generated bundle is the preferred source form. No runtime code, metadata or cryptographic service is loaded from a CDN.

Standards and revisions used

Source	Revision	Use
Toolbox SDK	ef2dab4b46c61812c9a877d8a19fe497b4a4630a, packages 0.2.3	manifest, context, shell and build checks
Toolbox Portal	tag v0.12.0	release and UX integration contract
RFC 4226	December 2005	HOTP semantics and vectors
RFC 6238	May 2011	TOTP semantics and vectors
RFC 6287	June 2011	OCRA suite grammar, semantics and vectors
RFC 6030	October 2010	bounded plain-secret PSKC import
Google Authenticator migration protobuf	observed public interchange schema	local import only; unknown fields are skipped safely
Aegis vault specification/importer sources	upstream master, accessed 19 August 2026	bounded plaintext Aegis, andOTP, 2FAS and FreeOTP migration
Web Authentication	W3C WebAuthn Level 3 Recommendation, 13 January 2026	client/authenticator structures and ceremony expectations
FIDO Metadata Service	v3.1 Proposed Standard, 21 May 2025	explicit offline Metadata BLOB import and status interpretation
RFC 8949 / RFC 9052 / RFC 8152 registrations	published versions	bounded CBOR and COSE key interpretation
QR Code for JavaScript	Kazuhiko Arase, 2009	QR construction algorithm rewritten in TypeScript under MIT terms
jsQR	1.4.0	bundled cross-browser QR image decoder under Apache-2.0

The OCRA implementation was authored from the normative RFC definition and tested with its published interoperability values; the RFC Java reference implementation is not included. The QR module is an acknowledged clean TypeScript rewrite of the MIT-licensed construction algorithm, with deliberately bounded version support.