TypeLess — Auto Form Filler | v1.0.5 | Notes for Certification
==============================================================

PURPOSE
Saves web form data as reusable profiles and auto-fills them on demand.
No accounts, no external servers, no telemetry. All data stored locally.

NO LOGIN REQUIRED — test on any public form:
  https://getbootstrap.com/docs/5.0/forms/overview/
  https://html.form.guide/html-form/html-form-example/

HOW TO TEST
1. SAVE A PROFILE
   Go to a form → fill dummy data → click 💾 in the floating toolbar
   → select fields → name the profile → Save Profile.

2. AUTO-FILL
   Reload the page → click the profile chip in the toolbar.

3. SMART FILL
   Click ⚡ in the toolbar. Detects field types and fills with generated data.

4. SENSITIVE FIELD WARNING
   On a login page, open the Save modal. A ⚠️ banner appears.
   "Exclude sensitive fields" checkbox prevents password/PIN/OTP from saving.

5. PROFILE MANAGER
   Options → Profiles: search, edit, reorder, and delete profiles.

6. DATA EXPORT / IMPORT
   Options → Data Management → Export (JSON backup) / Import.

7. USER-AGENT SWITCHER
   Popup → Tools → select a mobile preset → page reloads with that UA.
   Click Reset UA to restore default.

8. LANGUAGE SWITCH
   Click the language button in the toolbar (e.g. "EN") to cycle through
   EN / VI / ZH-CN / ZH-TW / JA / KO. All UI updates instantly.

9. KEYBOARD SHORTCUT
   Ctrl+Shift+H (Cmd+Shift+H on Mac) — toggle toolbar visibility.

webNavigation PERMISSION
Listens for URL changes in SPAs (pushState/replaceState). Refreshes the
profile list when a SPA navigates to a new view. No history is collected.

SECURITY (v1.0.5)
- AES-256-GCM encryption before writing profiles to storage.
- Trusted Types API prevents unsafe innerHTML injection.
- CSP: script-src 'self'; object-src 'none'; base-uri 'none'.
- No eval(), no remote scripts, no external fetch() calls.