otpGarmin/source, branch v0.5.0

feat(settings): apply the Import form from the phone and show results

2026-10-19T23:51:05+00:00

Import group in the app settings; the processor runs after the first frame and on settings changes, clears the fields, writes the status, remembers form hashes and opens the results screen. Co-Authored-By: Claude Opus 5.5

feat(import): parse otpauth URIs and unencrypted Aegis JSON in resumable steps

2026-10-19T23:51:05+00:00

Streaming JSON tokenizer with depth and length limits and native skipping of long strings; Aegis reader for database versions 1-3 with groups and encrypted-export detection; otpauth parser with ';' separators and Steam; import job with Replace mode, duplicate and replacement checks, a sealed multi-part buffer and a report. Google Authenticator exports deferred. Co-Authored-By: Claude Opus 5.5

feat(storage): add keyed secret fingerprints to record headers

2026-10-19T23:51:05+00:00

An 8-byte HMAC of kind, type and secret (key derived from the device key) in header tag 13 lets imports find duplicates of locked entries while the watch is locked. Vault gains anyHeader() and storage(). Co-Authored-By: Claude Opus 5.5

feat(ui): add the list, OTP detail, PIN entry, menu, info screens and glance

2026-10-19T20:28:09+00:00

List with live codes and countdowns, adaptive rows and lazy headers; OTP detail with ring or bar, next code and HOTP next; PIN keypad or button selector with create, unlock, change, lockout display and pending promotion; native menu; glance with the entry count; self-test after the first frame; option properties with defaults. Codes are computed one per timer event, apart from drawing, for the watchdog. A UI-test build (uitest.jungle) starts with fake entries, PIN 123456 and a frozen clock. Co-Authored-By: Claude Opus 5.5

perf(crypto): XOR PBKDF2 blocks as 32-bit words and step 100 iterations

2026-10-19T20:28:09+00:00

200 byte-wise iterations in one event tripped the 120,000-bytecode watchdog on the Forerunner 255S profile. Word-wise XOR makes PBKDF2 2.3x faster (22 ms per 1000 iterations in the simulator). Co-Authored-By: Claude Opus 5.5

docs: document the storage format and record M3 results; bump to 0.3.0

2026-10-19T13:27:37+00:00

Co-Authored-By: Claude Opus 5.5

feat(storage): add the encrypted vault, PIN keys, lockout, session and migrations

2026-10-19T13:27:37+00:00

Records are one ByteArray each: a readable TLV header plus an encrypt-then-MAC box whose aad binds the entry ID and the header. The device key seals unlocked entries and pending items; a random master key, wrapped under a PBKDF2 PIN key, seals locked ones. Wrong PINs are counted before the check, with delays on the trusted clock and an uptime fallback. Bytes.toUtf8 validates UTF-8 first, because the native conversion crashes on invalid input. Co-Authored-By: Claude Opus 5.5

docs: record M2 results and bump version to 0.2.0

2026-10-18T21:44:18+00:00

CHANGELOG 0.2.0; PERFORMANCE (simulator benchmarks and what they mean for the watch); TESTING (vector sources, M2 results, watchdog caveat); FEASIBILITY (verified: no native HMAC-SHA1, AES-256 works, Long semantics); README status and targets; developer-guide Monkey C facts. Co-Authored-By: Claude Opus 5.5

feat(otp): add Base32 decoding, HOTP, TOTP and Steam Guard codes

2026-10-18T21:44:18+00:00

Base32 accepts any case, spaces, hyphens and missing padding, and reports the exact position of a bad character. TOTP uses 64-bit time, so codes stay correct after 2038. Steam Guard is a separate, optional code type. Co-Authored-By: Claude Opus 5.5

feat(crypto): add SHA-512, HMAC, PBKDF2, HKDF, AES-256 records and self-test

2026-10-18T21:44:18+00:00

- Sha512: FIPS 180-4 in Monkey C (no native SHA-512), rotations inlined with precomputed masks; constants derived from the primes, not typed. - Hmac: RFC 2104 over SHA-1/256/512 (native HMAC only supports SHA-256). - Kdf: resumable PBKDF2-HMAC-SHA256 job with calibration bounds (2,000-200,000 iterations) and HKDF-SHA256. - Aes: CBC with PKCS#7 over the native cipher; AES-256 chosen. - SealedBox: encrypt-then-MAC records (HKDF-split keys, length-prefixed aad, constant-time tag check before decryption). - SelfTest: known-answer tests for every primitive at start-up. - Bytes (wipe, constant-time equal), Clock (2038-safe widening, trusted clock), Jobs (bounded steps against the watchdog, timer runner). Co-Authored-By: Claude Opus 5.5