otpGarmin/source/util, branch v0.7.0

feat(settings): apply the Import form from the phone and show results

2026-10-19T23:51:05+00:00

Import group in the app settings; the processor runs after the first frame and on settings changes, clears the fields, writes the status, remembers form hashes and opens the results screen. Co-Authored-By: Claude Opus 5.5

feat(import): parse otpauth URIs and unencrypted Aegis JSON in resumable steps

2026-10-19T23:51:05+00:00

Streaming JSON tokenizer with depth and length limits and native skipping of long strings; Aegis reader for database versions 1-3 with groups and encrypted-export detection; otpauth parser with ';' separators and Steam; import job with Replace mode, duplicate and replacement checks, a sealed multi-part buffer and a report. Google Authenticator exports deferred. Co-Authored-By: Claude Opus 5.5

feat(ui): add the list, OTP detail, PIN entry, menu, info screens and glance

2026-10-19T20:28:09+00:00

List with live codes and countdowns, adaptive rows and lazy headers; OTP detail with ring or bar, next code and HOTP next; PIN keypad or button selector with create, unlock, change, lockout display and pending promotion; native menu; glance with the entry count; self-test after the first frame; option properties with defaults. Codes are computed one per timer event, apart from drawing, for the watchdog. A UI-test build (uitest.jungle) starts with fake entries, PIN 123456 and a frozen clock. Co-Authored-By: Claude Opus 5.5

feat(storage): add the encrypted vault, PIN keys, lockout, session and migrations

2026-10-19T13:27:37+00:00

Records are one ByteArray each: a readable TLV header plus an encrypt-then-MAC box whose aad binds the entry ID and the header. The device key seals unlocked entries and pending items; a random master key, wrapped under a PBKDF2 PIN key, seals locked ones. Wrong PINs are counted before the check, with delays on the trusted clock and an uptime fallback. Bytes.toUtf8 validates UTF-8 first, because the native conversion crashes on invalid input. Co-Authored-By: Claude Opus 5.5

feat(crypto): add SHA-512, HMAC, PBKDF2, HKDF, AES-256 records and self-test

2026-10-18T21:44:18+00:00

- Sha512: FIPS 180-4 in Monkey C (no native SHA-512), rotations inlined with precomputed masks; constants derived from the primes, not typed. - Hmac: RFC 2104 over SHA-1/256/512 (native HMAC only supports SHA-256). - Kdf: resumable PBKDF2-HMAC-SHA256 job with calibration bounds (2,000-200,000 iterations) and HKDF-SHA256. - Aes: CBC with PKCS#7 over the native cipher; AES-256 chosen. - SealedBox: encrypt-then-MAC records (HKDF-split keys, length-prefixed aad, constant-time tag check before decryption). - SelfTest: known-answer tests for every primitive at start-up. - Bytes (wipe, constant-time equal), Clock (2038-safe widening, trusted clock), Jobs (bounded steps against the watchdog, timer runner). Co-Authored-By: Claude Opus 5.5

feat(app): add minimal watch app with smoke test and per-size icons

2026-10-18T19:10:37+00:00

The M0 placeholder app: AppBase entry point, home screen with name and version, debug-only diagnostics (start-up time, memory) and a unit test that runs in the headless simulator. Builds with strict type checking and zero warnings for all 72 products; icons.jungle gives every product a launcher icon of its exact size. Co-Authored-By: Claude Opus 5.5