@ideem/zsm-client-sdk 2.5.0 → 2.6.0

package/WebAuthnClientBase.js

@@ -4,6 +4,7 @@ import { uid2iid, iid4uid } from './IdentityIndexing.js';
 import { toObject }         from './Utils.js';
 import {zsmPluginManager}   from './PluginManager.js';
 
+
 eventCoordinator.update('WebAuthnClientBase');
 
 const tracePrimer = (obj=false) => {
@@ -98,7 +99,7 @@ class WebAuthnClientBase {
      * @                by the initializeZsm thereafter. Fixes several potential race conditions and improves performance.
      * @returns         {Promise<ZSMAPI>}                           Resolves with the initialized ZSM API.
      */
-    primeZsmApi = async () => (!this.zsmApi) ? (this.zsmApi = await this.getZsmApi(Object.assign({}, GLOBAL.mpcConfig, {consumer_id: await iid4uid(GLOBAL.mpcConfig.consumer_id)}))) : this.zsmApi;
+    async primeZsmApi () { return  (!this.zsmApi) ? (this.zsmApi = await this.getZsmApi(Object.assign({}, GLOBAL.mpcConfig, {consumer_id: await iid4uid(GLOBAL.mpcConfig.consumer_id)}))) : this.zsmApi; }
 
     /**
      * @name            initializeZsm
@@ -126,22 +127,66 @@ class WebAuthnClientBase {
     */
 
     async checkIdentity (userIdentifier, primeEnroll=false) {
+
         try {
-            this.status='CHECKING_IDENTITY_STARTING';
             const resultOfCheck = await this.relyingParty.checkServerSideIdentity(primeEnroll);
+
             if(!resultOfCheck)  throw new Error('Unable to communicate with identity server!');
-            const identityID    = resultOfCheck.identity_id;
+            const identityID    = Array.isArray(resultOfCheck) ? resultOfCheck[0].identity_id : resultOfCheck.identity_id;
+
             if(!identityID)     throw new Error('Unable to acquire identity_id!');
+
             uid2iid(userIdentifier, identityID);
             GLOBAL.mpcConfig.consumer_id = identityID;
-            this.status         = 'CHECKING_IDENTITY_FINISHED';
-            return Promise.resolve(identityID);
+            return identityID;
         } catch(err) {
-            this.status         = 'CHECKING_IDENTITY_FAILED';
             return Promise.reject(err);
         }
     }
 
+    /**
+     * @name            webauthnCreate
+     * @description     Creates a new WebAuthn credential for the specified userIdentifier.
+     * @param           {string}                  userIdentifier    The user identifier.
+     * @returns         {Promise<Object>}                           Resolves with the created credential.
+     * @throws          {Error}                                     Throws a COUNTED error if unable to retrieve the public key from the Relying Party Server.
+     * @throws          {Error}                                     [MPC] Throws an error if unable to obtain the createResponse from the Crypto Server.
+     * @throws          {Error}                                     [MPC] Throws an error if the createResponse is missing the credential.
+     * @throws          {Error}                                     [MPC] Throws an error if the credential is missing the attestation object.
+     * @throws          {Error}                                     Throws a COUNTED error if unable to verify the credential with the Relying Party Server.
+     */
+    async webauthnCreate (userIdentifier) {
+
+        await this.initializeZsm('webauthnCreate');
+
+
+        const publicKey = await this.relyingParty.registrationStart();
+        if(publicKey instanceof Error)          throw new Error(publicKey);
+        else if (!publicKey)                    throw new Error('[WebAuthnClient] :: webauthnCreate :: Unable to retrieve public key from Relying Party Server!');
+
+        publicKey.user_id = publicKey.user.id;
+        
+        let createResponse = await this.zsmApi.webauthn_create(publicKey, undefined, userIdentifier, tracePrimer());
+        if(!createResponse)                     throw new Error('[WebAuthnClient - mpc_round] :: webauthnCreate :: Unable to obtain response from Crypto Server!');
+
+        
+        createResponse = toObject(createResponse);
+        GLOBAL.dispatchEvent(new CustomEvent("MPCResponse", {bubbles: true, cancelable: false, detail: createResponse }));
+        
+        if(!createResponse?.result)             throw new Error('[WebAuthnClient - mpc_round] :: webauthnCreate :: Unable to obtain credential from Crypto Server!');
+        if(!createResponse?.result?.response)   throw new Error('[WebAuthnClient - mpc_round] :: webauthnCreate :: Unable to acquire attestation object!');
+        
+        const credential = createResponse.result;
+
+        
+        const registrationResult = await this.relyingParty.registrationFinish(credential);
+        if(registrationResult instanceof Error) throw new Error(registrationResult);
+        else if(registrationResult == false)    throw new Error('[WebAuthnClient] :: webauthnCreate :: Unable to verify credential Relying Party Server!');
+
+        
+        return registrationResult;
+    };
+
     /**
      * @name            webauthnCreate
      * @description     Creates a new WebAuthn credential for the specified userIdentifier.
@@ -154,14 +199,11 @@ class WebAuthnClientBase {
      * @throws          {Error}                                     Throws an error if unable to acquire the identity ID from the Relying Party Server.
      * @throws          {Error}                                     Throws an error if the user ID or token is missing from the response body.
      */
-    async webauthnCreate (userIdentifier) {
+    async webauthnCreateMpcThenFinish (userIdentifier, publicKey, pairing_token) {
         this.status = 'ENROLLMENT_STARTING';
         await this.initializeZsm('webauthnCreate');
 
-        const publicKey = await this.relyingParty.registrationStart();
-        if(!publicKey)   throw new Error('[WebAuthnClient] :: webauthnCreate :: Unable to retrieve public key from Relying Party Server!');
-
-        let createResponse = await this.zsmApi.webauthn_create(publicKey, tracePrimer());
+        let createResponse = await this.zsmApi.webauthn_create(publicKey, pairing_token, userIdentifier, tracePrimer());
         if(!createResponse) throw new Error('[WebAuthnClient - mpc_round] :: webauthnCreate :: Unable to obtain response from Crypto Server!');
 
         createResponse = toObject(createResponse);
@@ -175,7 +217,7 @@ class WebAuthnClientBase {
         const registrationResult = await this.relyingParty.registrationFinish(credential);
         if (!registrationResult) throw new Error('[WebAuthnClient] :: webauthnCreate :: Unable to verify credential Relying Party Server!');
 
-        return registrationResult;
+        return registrationResult.credential;
     };
 
     /**
@@ -184,157 +226,124 @@ class WebAuthnClientBase {
      * @param           {string}                  userIdentifier    The user identifier.
      * @returns         {Promise<ZSMAPI>}                           Resolves with the retrieved credential.
      * @throws          {Error}                                     Throws an error if no credential ID is found.
-     * @throws          {Error}                                     Throws an error if unable to start authentication with the Relying Party Server.
+     * @throws          {Error}                                     Throws a COUNTED error if unable to start authentication with the Relying Party Server.
      * @throws          {Error}                                     Throws an error if unable to retrieve the public key/challenge from the Relying Party Server.
-     * @throws          {Error}                                     Throws an error if unable to obtain the getResponse/credential from the Crypto Server.
+     * @throws          {Error}                                     Throws an error if unable to obtain the mpcResponse/credential from the Crypto Server.
      * @throws          {Error}                                     Throws an error if unable to verify the credential with the Relying Party Server.
      * @throws          {Error}                                     Throws an error if the user ID or token is missing from the response body.
      */
     async webauthnGet (userIdentifier) {
-        this.status = 'AUTHENTICATION_STARTING';
 
         await this.initializeZsm('webauthnGet');
-        await this.webauthnRetrieve(userIdentifier, true)
+        const credentialId = await this.webauthnRetrieve(userIdentifier, true);
 
+        if (!this.isEnrolled)                               throw new Error(`[WebAuthnClient] :: webauthnGet :: ${userIdentifier} is not enrolled, lacks a credential, or credential is corrupted!`);
 
-        if (!this.isEnrolled)                                               throw new Error(`[WebAuthnClient] :: webauthnGet :: Credential is missing for ${userIdentifier}`);
-
-        let authStartResponse = await this.relyingParty.authenticationStart(this.credentialID);
-        if(!authStartResponse)                                              throw new Error('[WebAuthnClient] :: webauthnGet :: Unable to start authentication with Relying Party Server!');
+        let authStartResponse = await this.relyingParty.authenticationStart(credentialId);
 
+        if      (authStartResponse instanceof Error)        throw new Error(authStartResponse);
+        else if (!authStartResponse)                        throw new Error('[WebAuthnClient] :: webauthnGet :: Unable to start authentication with Relying Party Server!');
+        
         authStartResponse = toObject(authStartResponse);
 
-        if(!authStartResponse?.rcr || !authStartResponse?.rcr?.publicKey)   throw new Error('[WebAuthnClient] :: webauthnGet :: Unable to retrieve public key from Relying Party Server!');
-
-        const pubKey = authStartResponse?.rcr?.publicKey;
+        if(!authStartResponse?.rcr?.publicKey?.challenge)   throw new Error('[WebAuthnClient] :: webauthnGet :: Unable to locate public key/challenge inside Relying Party Server response!\nResponse Body: ' + JSON.stringify(authStartResponse));
+        const publicKey = authStartResponse.rcr.publicKey;
 
-        if(!pubKey || !pubKey?.challenge)                                   throw new Error('[WebAuthnClient] :: webauthnGet :: Unable to acquire challenge from public key!');
+        let mpcResponse = await this.zsmApi.webauthn_get(publicKey, undefined, userIdentifier, tracePrimer());
+        
 
-        let getResponse = await this.zsmApi.webauthn_get(pubKey, tracePrimer());
-        if(!getResponse)                                                    throw new Error('[WebAuthnClient - mpc_round] :: webauthnGet :: Unable to obtain getResponse from Crypto Server!');
+        if(!mpcResponse)                                    throw new Error('[WebAuthnClient - mpc_round] :: webauthnGet :: Crypto server did not respond!');
 
-        getResponse = toObject(getResponse);
+        mpcResponse = toObject(mpcResponse);
+        if(!mpcResponse?.result)                            throw new Error('[WebAuthnClient - mpc_round] :: webauthnGet :: Response from Crypto Server did not contain a credential!\nResponse Body: ' + JSON.stringify(mpcResponse));
 
-        if(!getResponse?.result)                                            throw new Error('[WebAuthnClient - mpc_round] :: webauthnGet :: Unable to obtain credential from Crypto Server!');
+        GLOBAL.dispatchEvent(new CustomEvent("MPCResponse", {bubbles: true, cancelable: false, detail: mpcResponse }));
 
-        GLOBAL.dispatchEvent(new CustomEvent("MPCResponse", {bubbles: true, cancelable: false, detail: getResponse }));
-
-        const credential = getResponse.result;
+        const credential = mpcResponse.result;
         let authFinishResponse = await this.relyingParty.authenticationFinish(credential);
 
-        if (!authFinishResponse)                                            throw new Error('[WebAuthnClient] :: webauthnGet :: Unable to verify credential Relying Party Server!');
+        if      (authFinishResponse instanceof Error)       throw new Error(authFinishResponse);
+        else if (!authFinishResponse)                       throw new Error('[WebAuthnClient] :: webauthnGet :: Unable to verify credential from Relying Party Server!');
 
         authFinishResponse = toObject(authFinishResponse)
-
-        if (!authFinishResponse.user_id || !authFinishResponse.token)       throw new Error('[WebAuthnClient] :: webauthnGet :: User ID or token is missing from response body!');
+        if (!authFinishResponse.token)                      throw new Error('[WebAuthnClient] :: webauthnGet :: Token mismatched or missing from Relying Party Server verification attempt!\nResponse Body: '   + JSON.stringify(authFinishResponse));
 
         return {
             signature       : credential.response.signature,
             signedChallenge : credential.response.clientDataJSON,
             user_id         : authFinishResponse.user_id,
             token           : authFinishResponse.token,
-            challenge       : pubKey.challenge,
+            challenge       : publicKey.challenge,
             credential
         };
     };
 
+    
+
     /**
      * @name            webauthnRetrieve
      * @description     Looks up the Identity ID for the specified userIdentifier and retrieves its credential ID (if it exists).
      * @                This is used to make a client-only check to see if a given userIdentifier already has an enrollment on the device.
      * @param           {string}                  userIdentifier    The user identifier.
-     * @param           {boolean}                 silent            Whether to suppress status updates. [default: false]
-     * @returns         {Promise<Boolean>}                          Resolves with the credential ID or `false` if retrieval fails.
-     * @returns         {Promise<String>}                           Resolves with the retrieved rawID for the specified user.
+     * @param           {string}                  targetData        The specific data to retrieve. Options are:
+     * @                                                             - 'id' or omitted: retrieves the ZSM credential ID (default)
+     * @                                                             - 'all': retrieves an object containing all relevant credential data
+     * @                                                             - any other string: retrieves the specified field from the response
+     * @returns         {Promise<Boolean:false>}                    Returns `false` if retrieval fails (no enrollment found).
+     * @returns         {Promise<String>}                           Returns the requested data if found (e.g., ").
+     * @returns         {Promise<Object>}                           Resolves with an object containing all relevant credential data.
+     * @returns         {Promise<Null>}                             Resolves with null if the requested data is not found.
+     * @throws          {Error}                                     Throws an error if an uncaught/unhandled error occurs while retrieving the credential.
      */
-    async webauthnRetrieve (userIdentifier, silent=false) {
+    async webauthnRetrieve (userIdentifier) {
         this.credentialID = null;
-        if (!silent) {
-            this.status = 'CREDENTIAL_RETRIEVING';
-        }
-
-        try {
-            await this.initializeZsm('webauthnRetrieve');
-            let credentialIdentifier     = await iid4uid(userIdentifier);
-            GLOBAL.mpcConfig.consumer_id = credentialIdentifier;
-
-            let response      = await this.zsmApi.webauthn_retrieve(credentialIdentifier);
-                response      = toObject(response);
-
-            if (response.error || !response?.result?.rawId) return false;
-
-            this.credentialID = response.result.rawId;
-            if (!silent) this.status = 'CREDENTIAL_RETRIEVED';
-
-            return this.credentialID;
-        } catch (error) {
-            if(!silent){
-                this.status = 'CREDENTIAL_RETRIEVAL_FAILED';
-                throw error;
-            }
-        }
-    };
-
-    /**
-     * @name            webauthnCreateThenPartialGet
-     * @description     UMFA-OPTIMIZED FLOW: Creates a new WebAuthn credential and then performs a partial get operation.
-     * @description     This is used to create a new credential and then immediately retrieve it for authentication.
-     * @param           {string}                  userIdentifier    The user identifier.
-     * @returns         {Promise<Object>}                           Resolves with the created credential.
-     * @throws          {Error}                                     Throws an error if unable to retieve public key/regFinishAuthStart from the Relying Party Server.
-     * @throws          {Error}                                     Throws an error if unable to obtain the createResponse/credential from the Crypto Server.
-     */
-    async webauthnCreateThenPartialGet (userIdentifier) {
-        this.status = 'ENROLLMENT_STARTING';
-
-        const returnObj    = await this.relyingParty.createIdentityThenRegistrationStart();
-        if (!returnObj)     throw new Error('[WebAuthnClient] :: webauthnCreateThenPartialGet :: Unable to retrieve public key from Relying Party Server!');
 
-        const {publicKey, identity_id} = returnObj;
-        await this.initializeZsm('webauthnCreateThenPartialGet');
-
-        let createResponse = await this.zsmApi.webauthn_create(publicKey, tracePrimer());
-        if (!createResponse) throw new Error('[WebAuthnClient - mpc_round] :: webauthnCreateThenPartialGet :: Unable to obtain response from Crypto Server!');
-
-        createResponse = toObject(createResponse);
-
-        GLOBAL.dispatchEvent(new CustomEvent("MPCResponse", {bubbles: true, cancelable: false, detail: createResponse }));
-
-        if(!createResponse?.result)            throw new Error('[WebAuthnClient - mpc_round] :: webauthnCreateThenPartialGet :: Unable to obtain credential from Crypto Server!');
-
-        const createCredential = createResponse.result;
-
-        let regFinishAuthStartResponse =  await this.relyingParty.registrationFinishAuthenticationStart(createCredential);
-        if (!regFinishAuthStartResponse) throw new Error('[WebAuthnClient] :: webauthnCreateThenPartialGet :: Unable to retrieve response from Relying Party Server!');
-
-        regFinishAuthStartResponse = toObject(regFinishAuthStartResponse);
-
-        if(!regFinishAuthStartResponse?.rcr || !regFinishAuthStartResponse?.rcr?.publicKey) throw new Error('[WebAuthnClient] :: webauthnCreateThenPartialGet :: Unable to retrieve public key from Relying Party Server!');
-
-        const getChallenge = regFinishAuthStartResponse.rcr.publicKey;
-
-        let getResponse = await this.zsmApi.webauthn_get(getChallenge, tracePrimer());
-        if(!getResponse)                   throw new Error('[WebAuthnClient - mpc_round] :: webauthnGet :: Unable to obtain response from Crypto Server!');
-
-        getResponse = toObject(getResponse);
-
-        if(!getResponse?.result)           throw new Error('[WebAuthnClient - mpc_round] :: webauthnGet :: Unable to obtain credential from Crypto Server!');
-
-        GLOBAL.dispatchEvent(new CustomEvent("MPCResponse", {bubbles: true, cancelable: false, detail: getResponse }));
-
-
-        const getCredential = getResponse.result;
-        let op = {
-            user_id         : userIdentifier,
-            credential      : getCredential,
-            signature       : getCredential.response.signature,
-            signedChallenge : getCredential.response.clientDataJSON,
-            challenge       : getChallenge.challenge,
-        };
+        this.initializeZsm('webauthnRetrieve');
+        let credentialIdentifier     = await iid4uid(userIdentifier),
+            requestedData            = {};
+        GLOBAL.mpcConfig.consumer_id = credentialIdentifier;
 
-        return op;
+        let response      = await this.zsmApi.webauthn_retrieve(userIdentifier);
+            response      = toObject(response);
 
+        if (response?.error || !response?.result) return false;
+        
+        this.credentialID = response?.result['zsm_credential_id']??null;
+        return this.credentialID || false;
     };
+//     async webauthnRetrieve (userIdentifier, targetData='id') {
+//         this.credentialID = null;
+// 
+//         this.initializeZsm('webauthnRetrieve');
+//         let credentialIdentifier     = await iid4uid(userIdentifier),
+//             requestedData            = {};
+//         GLOBAL.mpcConfig.consumer_id = credentialIdentifier;
+// 
+//         let response      = await this.zsmApi.webauthn_retrieve(userIdentifier);
+//             response      = toObject(response);
+// 
+//         if (response?.error || !response?.result) return false;
+//         
+//         this.credentialID = response?.result['zsm_credential_id']??null;
+// 
+//         if([undefined,true,false,null,'','id'].includes(targetData)) {
+//             return this.credentialID;
+//         } 
+//         let pkpCred = await iid4uid(`pk:${userIdentifier}`);
+//         if(pkpCred === `pk:${userIdentifier}`) pkpCred = undefined;
+//         requestedData = { 
+//             userIdentifier,
+//             zsmCredID        : this.credentialID, 
+//             hasZSMCred       : (this.credentialID != null), 
+//             pkpCredID        : pkpCred, 
+//             hasLocalPasskey       : (typeof pkpCred === 'string' && pkpCred !== ''),
+//             hasRemotePasskey : (typeof pkpCred === 'object')
+//         };
+//         if (targetData === "all") {
+//             return requestedData;
+//         }
+//         return response?.[targetData] ?? response?.result?.[targetData] ?? requestedData?.[targetData] ?? null;
+//     };
 
     /**
      * @name            webauthnPartialGet
@@ -344,8 +353,8 @@ class WebAuthnClientBase {
      * @throws          {Error}                                    Throws an error if the credential is missing for the userIdentifier provided.
      * @throws          {Error}                                    Throws an error if unable to start authentication with the Relying Party Server.
      * @throws          {Error}                                    Throws an error if unable to retrieve the public key from the Relying Party Server.
-     * @throws          {Error}                                    Throws an error if unable to obtain the getResponse/credential from the Crypto Server.
-     * @emits           {CustomEvent}                              Emits a "MPCResponse" event with the getResponse data.
+     * @throws          {Error}                                    Throws an error if unable to obtain the mpcResponse/credential from the Crypto Server.
+     * @emits           {CustomEvent}                              Emits a "MPCResponse" event with the mpcResponse data.
      */
     async webauthnPartialGet (userIdentifier) {
         this.status = 'AUTHENTICATION_STARTING';
@@ -361,16 +370,16 @@ class WebAuthnClientBase {
         if(!getChallenge?.rcr || !getChallenge.rcr.publicKey) throw new Error('[WebAuthnClient] :: webauthnPartialGet :: Unable to retrieve public key from Relying Party Server!');
         const pubKey = getChallenge.rcr.publicKey;
 
-        let getResponse = await this.zsmApi.webauthn_get(pubKey, tracePrimer());
-        if(!getResponse)         throw new Error('[WebAuthnClient - mpc_round] :: webauthnGet :: Unable to obtain getResponse from Crypto Server!');
+        let mpcResponse = await this.zsmApi.webauthn_get(pubKey, null, userIdentifier, tracePrimer());
+        if(!mpcResponse)         throw new Error('[WebAuthnClient - mpc_round] :: webauthnPartialGet :: Unable to obtain mpcResponse from Crypto Server!');
 
-        getResponse = toObject(getResponse);
+        mpcResponse = toObject(mpcResponse);
 
-        if(!getResponse?.result) throw new Error('[WebAuthnClient - mpc_round] :: webauthnGet :: Unable to obtain credential from Crypto Server!');
+        if(!mpcResponse?.result) throw new Error('[WebAuthnClient - mpc_round] :: webauthnPartialGet :: Unable to obtain credential from Crypto Server!');
 
-        GLOBAL.dispatchEvent(new CustomEvent("MPCResponse", {bubbles: true, cancelable: false, detail: getResponse }));
+        GLOBAL.dispatchEvent(new CustomEvent("MPCResponse", {bubbles: true, cancelable: false, detail: mpcResponse }));
 
-        const getCredential = getResponse.result;
+        const getCredential = mpcResponse.result;
         return {
             signature: getCredential.response.signature,
             signedChallenge: getCredential.response.clientDataJSON,
@@ -405,7 +414,11 @@ class WebAuthnClientBase {
                 const cursor = event.target.result;
                 if (cursor) {
                     const { key, value } = cursor;
-                    if (value instanceof Map && value.has("rawId") && value.get("rawId") === rawID) return (store.delete(key), true);
+                    if(
+                        key.includes(userIdentifier) || 
+                        (typeof value === 'string' && value.includes(userIdentifier)) ||
+                        typeof value === 'object' && value?.zsm_credential?.get('rawId') === rawID
+                    )  (store.delete(key), true);
                     cursor.continue();
                 }
             };

package/package.json

@@ -1,23 +1,72 @@
 {
-    "name"            : "@ideem/zsm-client-sdk",
-    "version"         : "2.5.0",
-    "description"     : "ZSM makes 2FA easy and invisible for everyone, all the time, using advanced cryptography like MPC to establish cryptographic proof of the origin of any transaction or login attempt, while eliminating opportunities for social engineering. ZSM has no reliance on specific hardware. Our cryptographic module has completed FIPS 140-3 NIST approved lab testing, is FIDO2-ready, and is on the Modules In Progress (MIP) list. Superior Usability. no opt-in, no codes, no downloads, no authenticator apps. Better Security.",
-    "author"          : "@JJ (Jason Jurusz) <jj@useideem.com>/<nerdy.deeds@done.cheap>",
-    "keywords"        : ["ideem", "zsm", "zsm-client-sdk", "UMFAClient", "FIDO2Client", "library", "UMFA", "FIDO2", "client", "authentication", "javascript", "multi-factor", "webauthn", "authentication", "security", "cryptography", "MPC", "FIPS", "NIST", "FIDO2-ready", "Modules In Progress", "MIP"],
-    "type"            : "module",
-    "main"            : "./ZSMClientSDK.js",
-    "scripts"         : {
-        "start"       : "echo 'This is the Ideem SDK library, not a freestanding application. There is no start script defined. To use, import the library into a browser application.' 1>&2",
-        "version"     : "echo \"$(npm pkg get name | tr -d \\\") current version: $(npm pkg get version | tr -d \\\")\""
+    "name": "@ideem/zsm-client-sdk",
+    "version": "2.6.0",
+    "description": "ZSM makes 2FA easy and invisible for everyone, all the time, using advanced cryptography like MPC to establish cryptographic proof of the origin of any transaction or login attempt, while eliminating opportunities for social engineering. ZSM has no reliance on specific hardware. Our cryptographic module has completed FIPS 140-3 NIST approved lab testing, is FIDO2-ready, and is on the Modules In Progress (MIP) list. Superior Usability. no opt-in, no codes, no downloads, no authenticator apps. Better Security.",
+    "author": "@JJ (Jason Jurusz) <jj@useideem.com>/<nerdy.deeds@done.cheap>",
+    "keywords": [
+        "ideem",
+        "zsm",
+        "zsm-client-sdk",
+        "UMFAClient",
+        "FIDO2Client",
+        "library",
+        "UMFA",
+        "FIDO2",
+        "client",
+        "authentication",
+        "javascript",
+        "multi-factor",
+        "webauthn",
+        "authentication",
+        "security",
+        "cryptography",
+        "MPC",
+        "FIPS",
+        "NIST",
+        "FIDO2-ready",
+        "Modules In Progress",
+        "MIP"
+    ],
+    "type": "module",
+    "main": "./ZSMClientSDK.js",
+    "scripts": {
+        "start": "echo 'This is the Ideem SDK library, not a freestanding application. There is no start script defined. To use, import the library into a browser application.' 1>&2",
+        "version": "echo \"$(npm pkg get name | tr -d \\\") current version: $(npm pkg get version | tr -d \\\")\""
     },
-    "collaborators"   : [ "Joel Teply <joel@useideem.com>", "Todd Decker <todd@useideem.com>", "Brian Koziel <brian@useideem.com>" ],
-    "license"         : "SEE LICENSE IN LICENSE",
-    "repository"      : {
-        "type"        : "git",
-        "url"         : "github : useideem/vHSM"
+    "collaborators": [
+        "Joel Teply <joel@useideem.com>",
+        "Todd Decker <todd@useideem.com>",
+        "Brian Koziel <brian@useideem.com>"
+    ],
+    "license": "SEE LICENSE IN LICENSE",
+    "repository": {
+        "type": "git",
+        "url": "github : useideem/vHSM"
     },
-    "homepage"        : "https://useideem.com",
-    "bugs"            : "https://github.com/useideem/vHSM/issues",
-    "files"           : ["./EventCoordinator.js", "./FIDO2Client.js", "./FIDO2ClientBase.js", "./GlobalScoping.js", "./IdentityIndexing.js", "./PluginManager.js", "./RelyingParty.js", "./RelyingPartyBase.js", "./UMFAClient.js", "./UMFAClientBase.js", "./Utils.js", "./WASMRustInterface.js", "./WebAuthnClient.js", "./WebAuthnClientBase.js", "./ZSMClientSDK.js", "./shims/", "./LICENSE", "./README.md", "./CHANGELOG.md"],
-    "sideEffects"     : false
+    "homepage": "https://useideem.com",
+    "bugs": "https://github.com/useideem/vHSM/issues",
+    "files": [
+        "./ErrorHandler.js",
+        "./EventCoordinator.js",
+        "./FIDO2Client.js",
+        "./FIDO2ClientBase.js",
+        "./GlobalScoping.js",
+        "./IdentityIndexing.js",
+        "./package.json",
+        "./PluginManager.js",
+        "./RelyingParty.js",
+        "./RelyingPartyBase.js",
+        "./shims/",
+        "./UMFAClient.js",
+        "./UMFAClientBase.js",
+        "./Utils.js",
+        "./WASMRustInterface.js",
+        "./WebAuthnClient.js",
+        "./WebAuthnClientBase.js",
+        "./ZSMClientSDK.js",
+        "./CHANGELOG.md",
+        "./LICENSE",
+        "./README.md"
+    ],
+    "sideEffects": false
 }

package/shims/VanillaJSLoader.js

@@ -1,96 +0,0 @@
-// @ideem/zsm-client-sdk/shims/VanillaJSLoader.js  (ESM; single-tag, passive loader)
-
-/* ---------- tiny helpers ---------- */
-const $tag = () =>
-    document.querySelector('script[type="module"][src$="shims/VanillaJSLoader.js"]') ||
-document.currentScript ||
-null;
-
-const join = (base, rel) => new URL(String(rel).replace(/^\.\//, ""), base).href;
-
-function computeNodeModulesBase({ allowGuessAtRoot = true } = {}) {
-    const el = $tag();
-    
-    // 1) Explicit overrides (absolute or relative to page)
-    const override = el?.dataset?.nodeModules || window.IDEEM_NODE_MODULES;
-    if (override) return new URL(override, document.baseURI).href.replace(/\/+$/, "/");
-    
-    // 2) Infer from the actual URL this loader was fetched from (or its tag src)
-    const candidates = [
-        (typeof import.meta !== "undefined" && import.meta && import.meta.url) ? import.meta.url : null,
-        el?.src || null,
-    ];
-    
-    for (const c of candidates) {
-        if (!c) continue;
-        try {
-            const href = new URL(c, document.baseURI).href;
-            const m = href.match(/^(.*\/node_modules\/)/i);
-            if (m) return m[1];
-        } catch { /* ignore */ }
-    }
-    
-    // 3) Optional last-ditch guess at site root
-    if (allowGuessAtRoot) return new URL("/node_modules/", document.baseURI).href;
-    
-    throw new TypeError(
-        '[VanillaJSLoader] :: Could not determine the `/node_modules/` base path.\n' +
-        'Pass the path to your `node_modules/` folder via either a `data-node-modules="<URL>"` attribute on the loader <script> ' +
-        'or set window.IDEEM_NODE_MODULES="<URL>" before including the shim <script>.'
-    );
-}
-
-function injectImportMap(imports) {
-    const el = document.createElement("script");
-    el.type = "importmap";
-    el.textContent = JSON.stringify({ imports }, null, 2);
-    document.head.appendChild(el);
-}
-
-async function ensureImportMapSupport() {
-    const hasNative =
-    typeof HTMLScriptElement !== "undefined" &&
-    "supports" in HTMLScriptElement &&
-    HTMLScriptElement.supports?.("importmap");
-    
-    if (hasNative) return; // synchronous path on modern browsers
-    
-    // Load shim from the same shims/ folder as this file, then proceed
-    const s = document.createElement("script");
-    s.defer = true;
-    s.src = new URL("./es-module-shims.js", import.meta.url).href;
-    document.head.appendChild(s);
-    await new Promise((res, rej) => {
-        s.addEventListener("load", res, { once: true });
-        s.addEventListener("error", () => rej(new Error("Failed to load es-module-shims")));
-    });
-}
-
-/* ---------- first-party plugin registry ---------- */
-const PLUGINS = [
-    { pkg: "@ideem/plugins.passkeys-plus",  entry: "PasskeysPlus.js" },
-    { pkg: "@ideem/plugins.perf-logger",    entry: "index.js" },
-    { pkg: "@ideem/plugins.worker-thread",  entry: "WorkerThread.js" },
-];
-
-/* ---------- main ---------- */
-(async function main() {
-    // Only async if we need to load the shim; users never touch promises.
-    await ensureImportMapSupport();
-    
-    const base = computeNodeModulesBase(); // or { allowGuessAtRoot: true } if you prefer
-    
-    // Core SDK (adjust entry filename if different)
-    const imports = {
-        "@ideem/zsm-client-sdk":  join(base, "@ideem/zsm-client-sdk/ZSMClientSDK.js"),
-        "@ideem/zsm-client-sdk/": join(base, "@ideem/zsm-client-sdk/"),
-    };
-    
-    // Map all official plugins (harmless unless actually imported)
-    for (const { pkg, entry } of PLUGINS) {
-        imports[pkg]       = join(base, `${pkg}/${entry}`);
-        imports[`${pkg}/`] = join(base, `${pkg}/`);
-    }
-    
-    injectImportMap(imports);
-})();