From 3adb3f1c2b28bab8a42e9cf5c92c179e9e153439 Mon Sep 17 00:00:00 2001
From: Andrew Gregory <andrew.gregory@gmail.com>
Date: Sun, 5 Dec 2021 19:27:50 +0800
Subject: [PATCH 01/20] Make main digits height configurable

---
 apps/authentiwatch/app.js | 33 +++++++++++++++++----------------
 1 file changed, 17 insertions(+), 16 deletions(-)

diff --git a/apps/authentiwatch/app.js b/apps/authentiwatch/app.js
index c0cb608c0..392ed8940 100644
--- a/apps/authentiwatch/app.js
+++ b/apps/authentiwatch/app.js
@@ -1,4 +1,5 @@
-const tokenentryheight = 46;
+const tokenextraheight = 16;
+var tokendigitsheight = 30;
 // Hash functions
 const crypto = require("crypto");
 const algos = {
@@ -124,14 +125,14 @@ function drawToken(id, r) {
     // current token
     g.setColor(g.theme.fgH);
     g.setBgColor(g.theme.bgH);
-    g.setFont("Vector", 16);
+    g.setFont("Vector", tokenextraheight);
     // center just below top line
     g.setFontAlign(0, -1, 0);
     adj = y1;
   } else {
     g.setColor(g.theme.fg);
     g.setBgColor(g.theme.bg);
-    g.setFont("Vector", 30);
+    g.setFont("Vector", tokendigitsheight);
     // center in box
     g.setFontAlign(0, 0, 0);
     adj = (y1 + y2) / 2;
@@ -148,14 +149,14 @@ function drawToken(id, r) {
       // counter - draw triangle as swipe hint
       let yc = (y1 + y2) / 2;
       g.fillPoly([0, yc, 10, yc - 10, 10, yc + 10, 0, yc]);
-      adj = 10;
+      adj = 12;
     }
     // digits just below label
-    sz = 30;
+    sz = tokendigitsheight;
     do {
       g.setFont("Vector", sz--);
     } while (g.stringWidth(state.otp) > (r.w - adj));
-    g.drawString(state.otp, (x1 + adj + x2) / 2, y1 + 16, false);
+    g.drawString(state.otp, (x1 + adj + x2) / 2, y1 + tokenextraheight, false);
   }
   // shaded lines top and bottom
   g.setColor(0.5, 0.5, 0.5);
@@ -196,15 +197,15 @@ function draw() {
   }
   if (tokens.length > 0) {
     var drewcur = false;
-    var id = Math.floor(state.listy / tokenentryheight);
-    var y = id * tokenentryheight + Bangle.appRect.y - state.listy;
+    var id = Math.floor(state.listy / (tokendigitsheight + tokenextraheight));
+    var y = id * (tokendigitsheight + tokenextraheight) + Bangle.appRect.y - state.listy;
     while (id < tokens.length && y < Bangle.appRect.y2) {
-      drawToken(id, {x:Bangle.appRect.x, y:y, w:Bangle.appRect.w, h:tokenentryheight});
+      drawToken(id, {x:Bangle.appRect.x, y:y, w:Bangle.appRect.w, h:(tokendigitsheight + tokenextraheight)});
       if (id == state.curtoken && (tokens[id].period <= 0 || state.nextTime != 0)) {
         drewcur = true;
       }
       id += 1;
-      y += tokenentryheight;
+      y += (tokendigitsheight + tokenextraheight);
     }
     if (drewcur) {
       // the current token has been drawn - schedule a redraw
@@ -226,7 +227,7 @@ function draw() {
       state.nexttime = 0;
     }
   } else {
-    g.setFont("Vector", 30);
+    g.setFont("Vector", tokendigitsheight);
     g.setFontAlign(0, 0, 0);
     g.drawString(notokens, Bangle.appRect.x + Bangle.appRect.w / 2, Bangle.appRect.y + Bangle.appRect.h / 2, false);
   }
@@ -238,18 +239,18 @@ function draw() {
 
 function onTouch(zone, e) {
   if (e) {
-    var id = Math.floor((state.listy + (e.y - Bangle.appRect.y)) / tokenentryheight);
+    var id = Math.floor((state.listy + (e.y - Bangle.appRect.y)) / (tokendigitsheight + tokenextraheight));
     if (id == state.curtoken || tokens.length == 0 || id >= tokens.length) {
       id = -1;
     }
     if (state.curtoken != id) {
       if (id != -1) {
-        var y = id * tokenentryheight - state.listy;
+        var y = id * (tokendigitsheight + tokenextraheight) - state.listy;
         if (y < 0) {
           state.listy += y;
           y = 0;
         }
-        y += tokenentryheight;
+        y += (tokendigitsheight + tokenextraheight);
         if (y > Bangle.appRect.h) {
           state.listy += (y - Bangle.appRect.h);
         }
@@ -266,7 +267,7 @@ function onTouch(zone, e) {
 function onDrag(e) {
   if (e.x > g.getWidth() || e.y > g.getHeight()) return;
   if (e.dx == 0 && e.dy == 0) return;
-  var newy = Math.min(state.listy - e.dy, tokens.length * tokenentryheight - Bangle.appRect.h);
+  var newy = Math.min(state.listy - e.dy, tokens.length * (tokendigitsheight + tokenextraheight) - Bangle.appRect.h);
   state.listy = Math.max(0, newy);
   draw();
 }
@@ -296,7 +297,7 @@ function bangle1Btn(e) {
     state.curtoken = Math.max(state.curtoken, 0);
     state.curtoken = Math.min(state.curtoken, tokens.length - 1);
     var fakee = {};
-    fakee.y = state.curtoken * tokenentryheight - state.listy + Bangle.appRect.y;
+    fakee.y = state.curtoken * (tokendigitsheight + tokenextraheight) - state.listy + Bangle.appRect.y;
     state.curtoken = -1;
     state.nextTime = 0;
     onTouch(0, fakee);

From d9cb12bdf15f203052e3dd8eac5bdde9a44608c0 Mon Sep 17 00:00:00 2001
From: Andrew Gregory <andrew.gregory@gmail.com>
Date: Sun, 5 Dec 2021 19:42:44 +0800
Subject: [PATCH 02/20] Shrink label to fit

---
 apps/authentiwatch/app.js | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/apps/authentiwatch/app.js b/apps/authentiwatch/app.js
index 392ed8940..bb797edc4 100644
--- a/apps/authentiwatch/app.js
+++ b/apps/authentiwatch/app.js
@@ -118,9 +118,10 @@ function drawToken(id, r) {
   var y1 = r.y;
   var x2 = r.x + r.w - 1;
   var y2 = r.y + r.h - 1;
-  var adj, sz;
+  var adj, lbl, sz;
   g.setClipRect(Math.max(x1, Bangle.appRect.x ), Math.max(y1, Bangle.appRect.y ),
                 Math.min(x2, Bangle.appRect.x2), Math.min(y2, Bangle.appRect.y2));
+  lbl = tokens[id].label.substr(0, 10);
   if (id == state.curtoken) {
     // current token
     g.setColor(g.theme.fgH);
@@ -132,13 +133,16 @@ function drawToken(id, r) {
   } else {
     g.setColor(g.theme.fg);
     g.setBgColor(g.theme.bg);
-    g.setFont("Vector", tokendigitsheight);
+    sz = tokendigitsheight;
+    do {
+      g.setFont("Vector", sz--);
+    } while (g.stringWidth(lbl) > r.w);
     // center in box
     g.setFontAlign(0, 0, 0);
     adj = (y1 + y2) / 2;
   }
   g.clearRect(x1, y1, x2, y2);
-  g.drawString(tokens[id].label.substr(0, 10), (x1 + x2) / 2, adj, false);
+  g.drawString(lbl, (x1 + x2) / 2, adj, false);
   if (id == state.curtoken) {
     if (tokens[id].period > 0) {
       // timed - draw progress bar

From 26079db909677e565a3718daae6ea7a181190048 Mon Sep 17 00:00:00 2001
From: Andrew Gregory <andrew.gregory@gmail.com>
Date: Fri, 31 Dec 2021 11:39:22 +0800
Subject: [PATCH 03/20] Update app.js

Restore swipe to exit.
---
 apps/authentiwatch/app.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/apps/authentiwatch/app.js b/apps/authentiwatch/app.js
index bb797edc4..de3d02163 100644
--- a/apps/authentiwatch/app.js
+++ b/apps/authentiwatch/app.js
@@ -277,6 +277,9 @@ function onDrag(e) {
 }
 
 function onSwipe(e) {
+  if (e == 1) {
+    Bangle.showLauncher();
+  }
   if (e == -1 && state.curtoken != -1 && tokens[state.curtoken].period <= 0) {
     tokens[state.curtoken].period--;
     let newsettings={tokens:tokens,misc:settings.misc};

From d1e7a7a220626070f7e9f1a29211dec9bd9bec6c Mon Sep 17 00:00:00 2001
From: Andrew Gregory <andrew.gregory@gmail.com>
Date: Fri, 31 Dec 2021 12:00:11 +0800
Subject: [PATCH 04/20] Update app.js

Fix extra zeros out of b32decode()
---
 apps/authentiwatch/app.js | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/apps/authentiwatch/app.js b/apps/authentiwatch/app.js
index de3d02163..d2a72c8a8 100644
--- a/apps/authentiwatch/app.js
+++ b/apps/authentiwatch/app.js
@@ -45,9 +45,6 @@ function b32decode(seedstr) {
       }
     }
   }
-  if (bitcount > 0) {
-    retstr += String.fromCharCode(buf << (8 - bitcount));
-  }
   var retbuf = new Uint8Array(retstr.length);
   for (i in retstr) {
     retbuf[i] = retstr.charCodeAt(i);

From 7b6386ce5d0860ed81deed91a1c2a4304cb6e00b Mon Sep 17 00:00:00 2001
From: Andrew Gregory <andrew.gregory@gmail.com>
Date: Fri, 31 Dec 2021 15:56:39 +0800
Subject: [PATCH 05/20] Update app.js

Use exitApp()
---
 apps/authentiwatch/app.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/authentiwatch/app.js b/apps/authentiwatch/app.js
index d2a72c8a8..640183230 100644
--- a/apps/authentiwatch/app.js
+++ b/apps/authentiwatch/app.js
@@ -275,7 +275,7 @@ function onDrag(e) {
 
 function onSwipe(e) {
   if (e == 1) {
-    Bangle.showLauncher();
+    exitApp();
   }
   if (e == -1 && state.curtoken != -1 && tokens[state.curtoken].period <= 0) {
     tokens[state.curtoken].period--;

From d16ee688d22e8bcf3f0a56e0a5bf75d19dba0842 Mon Sep 17 00:00:00 2001
From: Martin Boonk <martin@boonk.info>
Date: Fri, 4 Feb 2022 13:03:22 +0100
Subject: [PATCH 06/20] BTHRM - Fix connection problem if no request grace
 period is configured

---
 apps/bthrm/boot.js | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/apps/bthrm/boot.js b/apps/bthrm/boot.js
index c7f9cca53..da0205177 100644
--- a/apps/bthrm/boot.js
+++ b/apps/bthrm/boot.js
@@ -365,18 +365,18 @@
         
         if (settings.gracePeriodRequest){
           log("Add " + settings.gracePeriodRequest + "ms grace period after request");
-          
-          promise = promise.then((d)=>{
-            log("Got device: ", d);
-            d.on('gattserverdisconnected', onDisconnect);
-            device = d;
-          });
-          
-          promise = promise.then(()=>{
-            log("Wait after request");
-            return waitingPromise(settings.gracePeriodRequest);
-          });
         }
+          
+        promise = promise.then((d)=>{
+          log("Got device: ", d);
+          d.on('gattserverdisconnected', onDisconnect);
+          device = d;
+        });
+        
+        promise = promise.then(()=>{
+          log("Wait after request");
+          return waitingPromise(settings.gracePeriodRequest);
+        });
         
       } else {
         promise = Promise.resolve();

From 228a2c410de2bbf2ba15220135694346355d717a Mon Sep 17 00:00:00 2001
From: Martin Boonk <martin@boonk.info>
Date: Fri, 4 Feb 2022 13:04:47 +0100
Subject: [PATCH 07/20] BTHRM - Fix infinite recursion if no cached data is
 available

---
 apps/bthrm/boot.js | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/apps/bthrm/boot.js b/apps/bthrm/boot.js
index da0205177..59cd2e718 100644
--- a/apps/bthrm/boot.js
+++ b/apps/bthrm/boot.js
@@ -426,14 +426,14 @@
       });
 
       promise = promise.then(()=>{
-        var getCharacteristicsPromise = Promise.resolve();
+        var characteristicsPromise = Promise.resolve();
         if (characteristics.length == 0){
-          getCharacteristicsPromise = getCharacteristicsPromise.then(()=>{
+          characteristicsPromise = characteristicsPromise.then(()=>{
             log("Getting services");
             return gatt.getPrimaryServices();
           });
 
-          getCharacteristicsPromise = getCharacteristicsPromise().then((services)=>{
+          characteristicsPromise = characteristicsPromise.then((services)=>{
             log("Got services:", services);
             var result = Promise.resolve();
             for (var service of services){
@@ -453,11 +453,11 @@
           
         } else {
           for (var characteristic of characteristics){
-            getCharacteristicsPromise = attachCharacteristicPromise(getCharacteristicsPromise, characteristic, true);
+            characteristicsPromise = attachCharacteristicPromise(characteristicsPromise, characteristic, true);
           }
         }
         
-        return getCharacteristicsPromise;
+        return characteristicsPromise;
       });
       
       promise = promise.then(()=>{

From d347d0a0afd08c0c1aa334026447f189eec581c9 Mon Sep 17 00:00:00 2001
From: Martin Boonk <martin@boonk.info>
Date: Fri, 4 Feb 2022 13:06:27 +0100
Subject: [PATCH 08/20] Bump version

---
 apps/bthrm/ChangeLog     | 2 ++
 apps/bthrm/metadata.json | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/apps/bthrm/ChangeLog b/apps/bthrm/ChangeLog
index 0f776586c..df7e2caa9 100644
--- a/apps/bthrm/ChangeLog
+++ b/apps/bthrm/ChangeLog
@@ -14,3 +14,5 @@
       Always emit BTHRM event
       Cleanup promises code and allow to configure custom additional waiting times to work around bugs
       Disconnect cleanly on exit
+0.06: Fix bug if no request waiting time is set
+      Fix bug if no connection data was cached
diff --git a/apps/bthrm/metadata.json b/apps/bthrm/metadata.json
index dd5db7e1d..9aea5f3aa 100644
--- a/apps/bthrm/metadata.json
+++ b/apps/bthrm/metadata.json
@@ -2,7 +2,7 @@
   "id": "bthrm",
   "name": "Bluetooth Heart Rate Monitor",
   "shortName": "BT HRM",
-  "version": "0.05",
+  "version": "0.06",
   "description": "Overrides Bangle.js's build in heart rate monitor with an external Bluetooth one.",
   "icon": "app.png",
   "type": "app",

From f979da095b0862d7fd0894a7562ad60b94df4065 Mon Sep 17 00:00:00 2001
From: Andrew Gregory <andrew.gregory@gmail.com>
Date: Sun, 6 Feb 2022 13:10:40 +0800
Subject: [PATCH 09/20] Update interface.html

Fix #6
---
 apps/authentiwatch/interface.html | 290 ++++++++++++++++++++++++++++--
 1 file changed, 272 insertions(+), 18 deletions(-)

diff --git a/apps/authentiwatch/interface.html b/apps/authentiwatch/interface.html
index 26533b17b..33466d1b3 100644
--- a/apps/authentiwatch/interface.html
+++ b/apps/authentiwatch/interface.html
@@ -7,7 +7,10 @@
 <style type="text/css">
 body{font-family:sans-serif}
 body div{display:none}
-body.select div#tokens,body.editing div#edit,body.scanning div#scan,body.showqr div#tokenqr{display:block}
+body.select tr>:first-child,body.export tr>:nth-child(3),body.export tr>:nth-child(4){display:none}
+body.select div.select,body.export div.export{display:block}
+body.select div.export,body.export div.select{display:none}
+body.select div#tokens,body.editing div#edit,body.scanning div#scan,body.showqr div#showqr,body.export div#tokens{display:block}
 #tokens th,#tokens td{padding:5px}
 #tokens tr:nth-child(odd){background-color:#ccc}
 #tokens tr:nth-child(even){background-color:#eee}
@@ -33,6 +36,12 @@ form.totp tr.hotp,form.hotp tr.totp{display:none}
 /* Start of all TOTP URLs */
 const otpAuthUrl = 'otpauth://';
 
+/* Start of all OTP migration URLs */
+const otpMigrUrl = 'otpauth-migration://offline?data=';
+
+/* Hash algorithms */
+const otpAlgos = ['SHA1','SHA256','SHA512'];
+
 const tokentypes = ['TOTP (Timed)', 'HOTP (Counter)'];
 
 /* Settings */
@@ -45,6 +54,8 @@ var tokens = settings.tokens;
  */
 function base32clean(val, nows) {
   var ret = val.replaceAll(/\s+/g, ' ');
+  ret = val.replaceAll(/0/g, 'O');
+  ret = val.replaceAll(/1/g, 'I');
   ret = ret.replaceAll(/[^A-Za-z2-7 ]/g, '');
   if (nows) {
     ret = ret.replaceAll(/\s+/g, '');
@@ -52,6 +63,48 @@ function base32clean(val, nows) {
   return ret;
 }
 
+function b32encode(str) {
+  let buf = 0, bitcount = 0, ret = '';
+  while (str.length > 0) {
+    buf <<= 8;
+    buf |= str.charCodeAt(0);
+    bitcount += 8;
+    str = str.substr(1);
+    while (bitcount >= 5) {
+      ret += 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'[(buf >> (bitcount - 5)) & 31];
+      bitcount -= 5;
+    }
+  }
+  return ret;
+}
+
+function b32decode(seedstr) {
+  // RFC4648
+  var i, buf = 0, bitcount = 0, ret = '';
+  for (i in seedstr) {
+    var c = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'.indexOf(seedstr.charAt(i).toUpperCase(), 0);
+    if (c != -1) {
+      buf <<= 5;
+      buf |= c;
+      bitcount += 5;
+      if (bitcount >= 8) {
+        ret += String.fromCharCode(buf >> (bitcount - 8));
+        buf &= (0xFF >> (16 - bitcount));
+        bitcount -= 8;
+      }
+    }
+  }
+  return ret;
+}
+
+function makeLabel(token) {
+  let lbl = token['label'];
+  if (lbl == '') {
+    lbl = (token['issuer'] == '') ? token['account'] : token['issuer'] + ' (' + token['account'] + ')';
+  }
+  token['label'] = lbl.substr(0, 10);
+}
+
 /* Save changes to a token to the global tokens[] array.
  * id is the index into the global tokens[].
  * forget is a flag indicating if the token should be forgotten.
@@ -84,9 +137,16 @@ function saveEdit(id, forget) {
   }
 }
 
+function showQr(url) {
+  tokenqr.clear();
+  tokenqr.makeCode(url);
+  qrPreviousClass = document.body.className;
+  document.body.className = 'showqr';
+}
+
 /* Generate and display a QR-code representing the current token.
  */
-function showQrCode() {
+function showTokenQr() {
   var fe = document.forms['edittoken'].elements;
   var url = new String(otpAuthUrl);
   switch (fe['type'].value) {
@@ -122,9 +182,7 @@ function showQrCode() {
   if (fe['algorithm'].value != 'SHA1') {
     url += '&algorithm=' + fe['algorithm'].value;
   }
-  tokenqr.clear();
-  tokenqr.makeCode(url);
-  document.body.className = 'showqr';
+  showQr(url);
 }
 
 function onTypeChanged() {
@@ -138,6 +196,7 @@ function onTypeChanged() {
  * id is the index into the global tokens[].
  */
 function editToken(id) {
+  if (document.body.className == 'export') return;
   var p;
   const selectMarkup = function(name, ary, cur, onchg) {
     var ret = '<select name="' + name + '"' + ((typeof onchg == 'string') ? ' onchange="' + onchg + '"' : '') + '>';
@@ -163,7 +222,7 @@ function editToken(id) {
   markup += selectMarkup('digits', ['6','7','8','9','10'], tokens[id].digits);
   markup += '</td></tr>';
   markup += '<tr><td>Hash:</td><td>';
-  markup += selectMarkup('algorithm', ['SHA1','SHA256','SHA512'], tokens[id].algorithm);
+  markup += selectMarkup('algorithm', otpAlgos, tokens[id].algorithm);
   markup += '</td></tr>';
   markup += '</tbody><tr><td id="advbtn" colspan="2">';
   markup += '<button type="button" onclick="document.getElementById(\'edittoken\').classList.toggle(\'showadv\')">Advanced</button>';
@@ -171,9 +230,9 @@ function editToken(id) {
   markup += '<button type="button" onclick="updateTokens()">Cancel Edit</button>';
   markup += '<button type="button" onclick="saveEdit(' + id + ', false)">Save Changes</button>';
   if (tokens[id].isnew) {
-    markup += '<button type="button" onclick="startScan()">Scan QR Code</button>';
+    markup += '<button type="button" onclick="startScan(handleTokenQr,cancelTokenQr)">Scan QR</button>';
   } else {
-    markup += '<button type="button" onclick="showQrCode()">Show QR Code</button>';
+    markup += '<button type="button" onclick="showTokenQr()">Show QR</button>';
     markup += '<button type="button" onclick="saveEdit(' + id + ', true)">Forget Token</button>';
   }
   document.getElementById('edit').innerHTML = markup;
@@ -188,6 +247,46 @@ function addToken() {
   editToken(tokens.length - 1);
 }
 
+/* Convert a number to a proto3 varint.
+ */
+function int2proto3varint(val) {
+  var ret = '';
+  do {
+    let c = val & 0x7F;
+    val >>>= 7;
+    if (val > 0) {
+      c |= 0x80;
+    }
+    ret += String.fromCharCode(c);
+  } while (val > 0);
+  return ret;
+}
+
+/* Convert a string to a proto3 field.
+ */
+function str2proto3(field_number, str) {
+  return int2proto3varint((field_number << 3) + 2) + int2proto3varint(str.length) + str;
+}
+
+/* Convert a number to a proto3 field.
+ */
+function int2proto3(field_number, val) {
+  return int2proto3varint(field_number << 3) + int2proto3varint(val);
+}
+
+/* Convert the specified token to its proto3 representation.
+ */
+function token2proto3(id) {
+  var secret    = str2proto3(1, b32decode(tokens[id].secret));
+  var name      = str2proto3(2, (tokens[id].account == '') ? tokens[id].label : tokens[id].account);
+  var issuer    = (tokens[id].issuer == '') ? '' : str2proto3(3, tokens[id].issuer);
+  var algorithm = int2proto3(4, (tokens[id].algorithm == 'SHA512') ? 3 : ((tokens[id].algorithm == 'SHA256') ? 2 : 1));
+  var digits    = int2proto3(5, (tokens[id].digits == 8) ? 2 : 1);
+  var type      = int2proto3(6, (tokens[id].period <= 0) ? 1 : 2);
+  var counter   = (tokens[id].period <= 0) ? int2proto3(7, -tokens[id].period) : '';
+  return str2proto3(1, secret + name + issuer + algorithm + digits + type + counter);
+}
+
 /* Move the specified token up or down in the global tokens[].
  * id is the index in the global tokens[] of the token to move.
  * dir is the direction to move: -1=up, 1=down.
@@ -200,10 +299,15 @@ function moveToken(id, dir) {
 /* Update the display listing all the tokens.
  */
 function updateTokens() {
+  const tokenSelect = function(id) {
+    return '<input name="exp_' + id + '" type="checkbox" onclick="exportTokens(false, \'' + id + '\')">';
+  };
   const tokenButton = function(fn, id, label, dir) {
     return '<button type="button" onclick="' + fn + '(' + id + (dir ? ',' + dir : '') + ')">' + label + '</button>';
   };
-  var markup = '<table><tr><th>Token</th><th colspan="2">Order</th></tr>';
+  var markup = '<table><tr><th>';
+  markup += tokenSelect('all');
+  markup += '</th><th>Token</th><th colspan="2">Order</th></tr>';
   /* any tokens marked new are cancelled new additions and must be removed */
   for (let i = 0; i < tokens.length; i++) {
     if (tokens[i].isnew) {
@@ -212,6 +316,8 @@ function updateTokens() {
   }
   for (let i = 0; i < tokens.length; i++) {
     markup += '<tr><td>';
+    markup += tokenSelect(i);
+    markup += '</td><td>';
     markup += tokenButton('editToken', i, tokens[i].label);
     markup += '</td><td>';
     if (i < (tokens.length - 1)) {
@@ -224,14 +330,20 @@ function updateTokens() {
     markup += '</td></tr>';
   }
   markup += '</table>';
+  markup += '<div class="select">';
   markup += '<button type="button" onclick="addToken()">Add Token</button>';
   markup += '<button type="button" onclick="saveTokens()">Save to watch</button>';
+  markup += '<button type="button" onclick="startScan(handleImportQr,cancelImportQr)">Import</button>';
+  markup += '<button type="button" onclick="document.body.className=\'export\'">Export</button>';
+  markup += '</div><div class="export">';
+  markup += '<button type="button" onclick="document.body.className=\'select\'">Cancel</button>';
+  markup += '<button type="button" onclick="exportTokens(true, null)">Show QR</button>';
+  markup += '</div>';
   document.getElementById('tokens').innerHTML = markup;
   document.body.className = 'select';
 }
 
-/* Original QR-code reader: https://www.sitepoint.com/create-qr-code-reader-mobile-website/ */
-qrcode.callback = res => {
+function handleTokenQr(res) {
   if (res) {
     if (res.startsWith(otpAuthUrl)) {
       res = decodeURIComponent(res);
@@ -243,7 +355,8 @@ qrcode.callback = res => {
         'counter':'0',
         'period':'30',
         'secret':'',
-        'issuer':''
+        'issuer':'',
+        'label':''
       };
       var otpok = true;
       for (let pi in params) {
@@ -261,8 +374,7 @@ qrcode.callback = res => {
       if (otpok) {
         scanning = false;
         editToken(parseInt(document.forms['edittoken'].elements['tokenid'].value));
-        t['label'] = (t['issuer'] == '') ? t['account'] : t['issuer'] + ' (' + t['account'] + ')';
-        t['label'] = t['label'].substr(0, 10);
+        makeLabel(t);
         var fe = document.forms['edittoken'].elements;
         if (res.startsWith(otpAuthUrl + 'hotp/')) {
           t['period'] = '30';
@@ -283,8 +395,93 @@ qrcode.callback = res => {
       }
     }
   }
+}
+function cancelTokenQr() {
+  editToken(parseInt(document.forms['edittoken'].elements['tokenid'].value));
+}
+class proto3decoder {
+  constructor(str) {
+    this.buf = [];
+    for (let i in str) {
+      this.buf = this.buf.concat(str.charCodeAt(i));
+    }
+  }
+  getVarint() {
+    let c, ret = 0
+    do {
+      c = this.buf.shift();
+      ret = (ret << 7) | (c & 0x7F);
+    } while ((c & 0x80) != 0);
+    return ret;
+  }
+  getString(length) {
+    let ret = '';
+    for (let i = 0; i < length; ++i) {
+      ret += String.fromCharCode(this.buf.shift());
+    }
+    return ret;
+  }
+  parse() {
+    let ret = null;
+    if (this.buf.length > 0) {
+      let field_data = null;
+      let field_type = this.getVarint();
+      let field_number = field_type >>> 3;
+      let wire_type = field_type & 7;
+      switch (wire_type) {
+      case 0: field_data = this.getVarint(); break;
+      case 2: field_data = this.getString(this.getVarint()); break;
+      }
+      ret = {number:field_number,data:field_data};
+    }
+    return ret;
+  }
+}
+function handleImportQr(res) {
+  if (res) {
+    if (res.startsWith(otpMigrUrl)) {
+      scanning = false;
+      let data = new proto3decoder(atob(decodeURIComponent(res.substr(otpMigrUrl.length))));
+      while (data.buf.length > 0) {
+        let field = data.parse();
+        if (field?.number == 1) {
+          let newtoken = {'algorithm':'SHA1','digits':6,'period':30,'issuer':'','account':'','secret':'','label':''};
+          let p3token = new proto3decoder(field.data);
+          while (p3token.buf.length > 0) {
+            let buf = p3token.parse();
+            switch (buf?.number) {
+            case 1: newtoken.secret = b32encode(buf.data); break;
+            case 2: newtoken.account = buf.data; break;
+            case 3: newtoken.issuer = buf.data; break;
+            case 4: newtoken.algorithm = otpAlgos[buf.data - 1]; break;
+            case 5: newtoken.digits = (['6','8'])[buf.data - 1]; break;
+            case 7: newtoken.period = -buf.data; break;
+            }
+          }
+          makeLabel(newtoken);
+          tokens[tokens.length] = newtoken;
+        }
+      }
+      updateTokens();
+    }
+  }
+}
+function cancelImportQr() {
+  document.body.className = 'select';
+}
+/* Original QR-code reader: https://www.sitepoint.com/create-qr-code-reader-mobile-website/ */
+qrcode.callback = res => {
+  if (res) {
+    scanCallback(res);
+    if (scanning) {
+      scanning = false;
+      scanBack();
+    }
+  }
 };
-function startScan() {
+function startScan(handler,cancel) {
+  scanCallback = handler;
+  scanBack = cancel;
   document.body.className = 'scanning';
   navigator.mediaDevices
     .getUserMedia({video:{facingMode:'environment'}})
@@ -339,30 +536,87 @@ function saveTokens() {
     Util.hideModal();
   });
 }
+/* Handle token export.
+ * showqr is true if the QR code should be shown, if false the checkboxes need updating
+ * id is the name of the clicked checkbox, or null if the export button was pressed
+ */
+function exportTokens(showqr, id) {
+  let allchecked = true, allclear = true;
+  let cball;
+  let exp = '';
+  for (let cb of document.querySelectorAll('input[type=checkbox]')) {
+    let cbid = cb.name.substring(4);
+    if (cbid == 'all') {
+      cball = cb;
+    } else {
+      if (id == 'all') {
+        cb.checked = cball.checked;
+      } else {
+        if (cb.checked) {
+          if (showqr) {
+            exp += token2proto3(parseInt(cbid));
+          }
+          allclear = false;
+        } else {
+          allchecked = false;
+        }
+      }
+    }
+  }
+  if (id != 'all') {
+    if (allclear) {
+      cball.indeterminate = false;
+      cball.checked = false;
+    } else if (allchecked) {
+      cball.indeterminate = false;
+      cball.checked = true;
+    } else {
+      cball.indeterminate = true;
+    }
+  }
+  if (showqr) {
+    if (exp != '') {
+      /* add version, batch_size, batch_index, but no batch_id */
+      exp += int2proto3(2, 1) + int2proto3(3, 1) + int2proto3(4, 0);
+      let url = otpMigrUrl + encodeURIComponent(btoa(exp));
+      showQr(url);
+    }
+  }
+}
 function onInit() {
   loadTokens();
   updateTokens();
 }
+function qrBack() {
+  document.body.className = qrPreviousClass;
+}
 </script>
 </head>
 <body class="select">
 <h1>Authentiwatch</h1>
+
 <div id="tokens">
 <p>No watch comms.</p>
 </div>
+
 <div id="scan">
 <table>
 <tr><td><canvas id="qr-canvas"></canvas></td></tr>
-<tr><td><button type="button" onclick="editToken(parseInt(document.forms['edittoken'].elements['tokenid'].value))">Cancel</button></td></tr>
+<tr><td><button type="button" onclick="scanBack()">Cancel</button></td></tr>
 </table>
 </div>
+
 <div id="edit">
 </div>
-<div id="tokenqr">
+
+<div id="showqr">
 <table><tr><td id="qrcode"></td></tr><tr><td>
-<button type="button" onclick="document.body.className='editing'">Back</button>
+<button type="button" onclick="qrBack()">Back</button>
 </td></tr></table>
 </div>
+
+</div>
+
 <script type="text/javascript">
 const video=document.createElement('video');
 const canvasElement=document.getElementById('qr-canvas');

From 6483b8d71ae1b77bcac9a281bccdd82356b9172d Mon Sep 17 00:00:00 2001
From: Andrew Gregory <andrew.gregory@gmail.com>
Date: Sun, 6 Feb 2022 13:11:46 +0800
Subject: [PATCH 10/20] Update ChangeLog

---
 apps/authentiwatch/ChangeLog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/apps/authentiwatch/ChangeLog b/apps/authentiwatch/ChangeLog
index 7a902a731..7d6f96026 100644
--- a/apps/authentiwatch/ChangeLog
+++ b/apps/authentiwatch/ChangeLog
@@ -2,3 +2,4 @@
 0.02: Fix JSON save format
 0.03: Add "Calculating" placeholder, update JSON save format
 0.04: Fix tapping at very bottom of list, exit on inactivity
+0.05: Add support for bulk importing and exporting tokens

From 64fc4c96ed1397139a429d9ae4239646d33a9d4b Mon Sep 17 00:00:00 2001
From: Andrew Gregory <andrew.gregory@gmail.com>
Date: Sun, 6 Feb 2022 13:12:10 +0800
Subject: [PATCH 11/20] Update metadata.json

---
 apps/authentiwatch/metadata.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/authentiwatch/metadata.json b/apps/authentiwatch/metadata.json
index 7a0138d24..676d8da9f 100644
--- a/apps/authentiwatch/metadata.json
+++ b/apps/authentiwatch/metadata.json
@@ -4,7 +4,7 @@
   "shortName": "AuthWatch",
   "icon": "app.png",
   "screenshots": [{"url":"screenshot.png"}],
-  "version": "0.04",
+  "version": "0.05",
   "description": "Google Authenticator compatible tool.",
   "tags": "tool",
   "interface": "interface.html",

From 7cb9e2b206caf8b47364221b04e836f9cd756abf Mon Sep 17 00:00:00 2001
From: Andrew Gregory <andrew.gregory@gmail.com>
Date: Sun, 6 Feb 2022 13:21:14 +0800
Subject: [PATCH 12/20] Update README.md

---
 apps/authentiwatch/README.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/apps/authentiwatch/README.md b/apps/authentiwatch/README.md
index 8d0e74a0c..4b4cc94d7 100644
--- a/apps/authentiwatch/README.md
+++ b/apps/authentiwatch/README.md
@@ -14,8 +14,8 @@
 * Between 6 and 10 digits
 * Phone/PC configuration web page:
   * Add/edit/delete/arrange tokens
-  * Scan QR codes
-  * Produce scannable QR codes
+  * Scan token and migration(import) QR codes
+  * Produce scannable token and migration(export) QR codes
 
 ## Usage
 
@@ -24,6 +24,8 @@
 * Swipe right to exit to the app launcher.
 * Swipe left on selected counter token to advance the counter to the next value.
 
+![Screenshot](screenshot.png)
+
 ## Creator
 
 Andrew Gregory (andrew.gregory at gmail)

From 5df7e94d8fee2c88016188e81a36aaf5aab8c52a Mon Sep 17 00:00:00 2001
From: Andrew Gregory <andrew.gregory@gmail.com>
Date: Sun, 6 Feb 2022 13:31:28 +0800
Subject: [PATCH 13/20] Update README.md

---
 apps/authentiwatch/README.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/apps/authentiwatch/README.md b/apps/authentiwatch/README.md
index 4b4cc94d7..cc25e9604 100644
--- a/apps/authentiwatch/README.md
+++ b/apps/authentiwatch/README.md
@@ -3,6 +3,15 @@
 * GitHub: https://github.com/andrewgoz/Authentiwatch <-- Report bugs here
 * Bleeding edge AppLoader: https://andrewgoz.github.io/Authentiwatch/
 
+## Important!
+
+Tokens are stored *ONLY* on the watch. Make sure you do one or more of the following:
+
+* Make a backup copy of the "authentiwatch.json" file.
+* Export all your tokens to another device or print the QR code.
+
+Keep those copies safe and secure.
+
 ## Supports
 
 * Google Authenticator compatible 2-factor authentication

From e3cecb6d732c1068fd3362065bec77c8d1e0aaea Mon Sep 17 00:00:00 2001
From: Andrew Gregory <andrew.gregory@gmail.com>
Date: Sun, 6 Feb 2022 14:07:39 +0800
Subject: [PATCH 14/20] Update interface.html

---
 apps/authentiwatch/interface.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/authentiwatch/interface.html b/apps/authentiwatch/interface.html
index 33466d1b3..525ec2bc9 100644
--- a/apps/authentiwatch/interface.html
+++ b/apps/authentiwatch/interface.html
@@ -622,7 +622,7 @@ const video=document.createElement('video');
 const canvasElement=document.getElementById('qr-canvas');
 const canvas=canvasElement.getContext('2d');
 let scanning=false;
-const tokenqr=new QRCode(document.getElementById('qrcode'), '');
+const tokenqr=new QRCode(document.getElementById('qrcode'), {width:512,height:512});
 </script>
 <script src="../../core/lib/interface.js"></script>
 </body>

From dcd23f5dd9916da588813dd96a547e82f3f0c4a5 Mon Sep 17 00:00:00 2001
From: Andrew Gregory <andrew.gregory@gmail.com>
Date: Sun, 6 Feb 2022 14:18:30 +0800
Subject: [PATCH 15/20] Update interface.html

---
 apps/authentiwatch/interface.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/authentiwatch/interface.html b/apps/authentiwatch/interface.html
index 525ec2bc9..d1afee7c0 100644
--- a/apps/authentiwatch/interface.html
+++ b/apps/authentiwatch/interface.html
@@ -622,7 +622,7 @@ const video=document.createElement('video');
 const canvasElement=document.getElementById('qr-canvas');
 const canvas=canvasElement.getContext('2d');
 let scanning=false;
-const tokenqr=new QRCode(document.getElementById('qrcode'), {width:512,height:512});
+const tokenqr=new QRCode(document.getElementById('qrcode'), {width:400,height:400});
 </script>
 <script src="../../core/lib/interface.js"></script>
 </body>

From bded3b9171a87529329c4f04a778821389737dae Mon Sep 17 00:00:00 2001
From: Andrew Gregory <andrew.gregory@gmail.com>
Date: Sun, 6 Feb 2022 16:26:35 +0800
Subject: [PATCH 16/20] Update interface.html

---
 apps/authentiwatch/interface.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/authentiwatch/interface.html b/apps/authentiwatch/interface.html
index d1afee7c0..90d5ae87b 100644
--- a/apps/authentiwatch/interface.html
+++ b/apps/authentiwatch/interface.html
@@ -622,7 +622,7 @@ const video=document.createElement('video');
 const canvasElement=document.getElementById('qr-canvas');
 const canvas=canvasElement.getContext('2d');
 let scanning=false;
-const tokenqr=new QRCode(document.getElementById('qrcode'), {width:400,height:400});
+const tokenqr=new QRCode(document.getElementById('qrcode'), {width:354,height:354});
 </script>
 <script src="../../core/lib/interface.js"></script>
 </body>

From 565aea574c505845eb375f3b70ead6cc16d7cdb3 Mon Sep 17 00:00:00 2001
From: Andrew Gregory <andrew.gregory@gmail.com>
Date: Sun, 6 Feb 2022 17:06:49 +0800
Subject: [PATCH 17/20] Update interface.html

---
 apps/authentiwatch/interface.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/apps/authentiwatch/interface.html b/apps/authentiwatch/interface.html
index 90d5ae87b..22f03e22f 100644
--- a/apps/authentiwatch/interface.html
+++ b/apps/authentiwatch/interface.html
@@ -397,6 +397,7 @@ function handleTokenQr(res) {
   }
 }
 function cancelTokenQr() {
+  scanning = false;
   editToken(parseInt(document.forms['edittoken'].elements['tokenid'].value));
 }
 class proto3decoder {
@@ -467,6 +468,7 @@ function handleImportQr(res) {
   }
 }
 function cancelImportQr() {
+  scanning = false;
   document.body.className = 'select';
 }
 /* Original QR-code reader: https://www.sitepoint.com/create-qr-code-reader-mobile-website/ */
@@ -474,7 +476,6 @@ qrcode.callback = res => {
   if (res) {
     scanCallback(res);
     if (scanning) {
-      scanning = false;
       scanBack();
     }
   }

From 371cd8ba134b9307a14e67c8379f20939d49594b Mon Sep 17 00:00:00 2001
From: Francesco Bedussi <francesco.bedussi@abstract.it>
Date: Sun, 6 Feb 2022 10:14:18 +0100
Subject: [PATCH 18/20] widbata: fix vertical align

---
 apps/widbata/ChangeLog      | 1 +
 apps/widbata/metadata.json  | 2 +-
 apps/widbata/widbata.wid.js | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/apps/widbata/ChangeLog b/apps/widbata/ChangeLog
index f23705341..06d5f99e8 100644
--- a/apps/widbata/ChangeLog
+++ b/apps/widbata/ChangeLog
@@ -1,3 +1,4 @@
 0.01: Created
 0.02: Set sort order to -10 so always display in right hand corner
 0.03: Set sort order from the code
+0.04: fix vertical align
diff --git a/apps/widbata/metadata.json b/apps/widbata/metadata.json
index d8149d13f..26968a7d7 100644
--- a/apps/widbata/metadata.json
+++ b/apps/widbata/metadata.json
@@ -4,7 +4,7 @@
   "shortName":"Battery Theme",
   "icon": "widbata.png",
   "screenshots": [{"url":"screenshot_widbata_1.png"}],
-  "version":"0.03",
+  "version":"0.04",
   "type": "widget",
   "supports": ["BANGLEJS", "BANGLEJS2"],
   "readme": "README.md",
diff --git a/apps/widbata/widbata.wid.js b/apps/widbata/widbata.wid.js
index 1de4c2fe9..16554057f 100644
--- a/apps/widbata/widbata.wid.js
+++ b/apps/widbata/widbata.wid.js
@@ -5,7 +5,7 @@ Bangle.on('lcdPower', function(on) {
 WIDGETS["bata"]={area:"tr",sortorder:-10,width:27,draw:function() {
   var s = 26;
   var t = 13; // thickness
-  var x = this.x, y = this.y;
+  var x = this.x, y = this.y + 5;
   g.reset();
   g.setColor(g.theme.fg);
   g.fillRect(x,y+2,x+s-4,y+2+t); // outer

From d0ca5d38a5f3126667f354488ec860b91bb31bf3 Mon Sep 17 00:00:00 2001
From: Martin Boonk <martin@boonk.info>
Date: Sun, 6 Feb 2022 22:02:56 +0100
Subject: [PATCH 19/20] bthrm - fix error during planned disconnect when
 turning BTHRM off

---
 apps/bthrm/ChangeLog | 1 +
 apps/bthrm/boot.js   | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/apps/bthrm/ChangeLog b/apps/bthrm/ChangeLog
index df7e2caa9..3354a19e8 100644
--- a/apps/bthrm/ChangeLog
+++ b/apps/bthrm/ChangeLog
@@ -16,3 +16,4 @@
       Disconnect cleanly on exit
 0.06: Fix bug if no request waiting time is set
       Fix bug if no connection data was cached
+      Fix error during disconnect
diff --git a/apps/bthrm/boot.js b/apps/bthrm/boot.js
index 59cd2e718..6ac6382d6 100644
--- a/apps/bthrm/boot.js
+++ b/apps/bthrm/boot.js
@@ -489,8 +489,8 @@
           if (gatt.connected){
             log("Disconnect with gatt: ", gatt);
             gatt.disconnect().then(()=>{
-              log("Successful disconnect", e);
-            }).catch(()=>{
+              log("Successful disconnect");
+            }).catch((e)=>{
               log("Error during disconnect", e);
             });
           }

From bc70dfb34fcc2f66805ec4958435cc08799c698b Mon Sep 17 00:00:00 2001
From: Andrew Gregory <andrew.gregory@gmail.com>
Date: Mon, 7 Feb 2022 14:56:03 +0800
Subject: [PATCH 20/20] Update interface.html

---
 apps/authentiwatch/interface.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/authentiwatch/interface.html b/apps/authentiwatch/interface.html
index 22f03e22f..d2213b819 100644
--- a/apps/authentiwatch/interface.html
+++ b/apps/authentiwatch/interface.html
@@ -54,8 +54,8 @@ var tokens = settings.tokens;
  */
 function base32clean(val, nows) {
   var ret = val.replaceAll(/\s+/g, ' ');
-  ret = val.replaceAll(/0/g, 'O');
-  ret = val.replaceAll(/1/g, 'I');
+  ret = ret.replaceAll(/0/g, 'O');
+  ret = ret.replaceAll(/1/g, 'I');
   ret = ret.replaceAll(/[^A-Za-z2-7 ]/g, '');
   if (nows) {
     ret = ret.replaceAll(/\s+/g, '');