Android 0.4.0

Features

• registration (create) + pending handoff (step 3)
• assertion flow - sign in with a stored passkey (step 2b)
• vault passkey read + W3C response JSON builder (step 2a)
• register a Credential Manager provider (skeleton)
• finalize Bramble AAGUID; TODO to register it in the community list
• make a freshly-created passkey usable without opening the app
• register (create) passkeys + persist via a pending handoff
• assert stored passkeys (sign-in) in the credential provider
• surface stored passkeys to the OS credential store
• passkey rows in the login item edit + view
• get-time passkey picker for multiple accounts
• confirmation toast when the provider saves a passkey
• account picker when saving a passkey to an ambiguous domain
• differentiate save-passkey card for an existing login
• pause passkey proxy during Bramble's own WebAuthn unlock
• Settings toggle for the passkey provider (General)
• save-passkey corner prompt + create/get wiring
• webAuthenticationProxy passkey handler (orchestration)
• passkey provider vault logic (find + placement)
• WebAuthn JSON helpers for the passkey provider
• expose passkey crypto through TS adapter + transports
• passkey authenticator crypto + entry model (provider role)

Bug Fixes

• sync screenshots instead of overwrite to stop duplicates
• replace deprecated kSecUseOperationPrompt with LAContext
• squash duplicate toasts (same message + variant)
• sign in with a single unlock (bridge list->sign)
• use a freshly-created passkey before the app drains it
• sign the browser-provided clientDataHash (fixes sign-in)
• empty save toast - use i18n._(msg…) not the useLingui macro
• rename usePendingPasskeys to .tsx so its lingui macro is transformed
• registration response needs response.publicKey (SPKI)
• set BE+BS backup flags on synced passkeys
• registration response needs authenticatorData + publicKeyAlgorithm
• attach a new passkey to the right account by username
• route background passkey crypto through the offscreen
• render the passkey card account row as markup, not text
• resolve passkey request origin from the active tab

Refactors

• centralized reusable Toast (success/error/info)

Documentation

• broaden README to mobile + passkeys, add passkeys to iOS store metadata
• correct passkey + P2P sync findings
• Android provider built (assertion + registration), compile-verified
• Android dep check — androidx.credentials is Play-Services-free
• mark iOS provider device-verified (register + sign-in on webauthn.io)
• document the seamless-create refinements (foreground drain + immediate-use bridge)
• mark iOS provider built (assertion + registration + handoff)
• record the device-verified registration-response field set
• spec item edit (passkey row below TOTP + remove) and view badge
• update phased route with shipped status
• plan passkey-provider role across extension + mobile

Other

• chore(ios): make app iPhone-only (drops 13-inch iPad screenshot requirement)
• chore(ios/metadata): add 7th App Store screenshot, reorder to sequence
• i18n(extension): localize manifest description + lock command via Chrome _locales
• chore(i18n): translate passkey strings (web catalogs + iOS String Catalog)
• test(extension): cover the passkey ceremony flow (incl. the account picker)
• i18n(passkeys): extract + compile the passkey provider setting strings

Full Changelog: 0.3.0-android...0.4.0-android