@ideem/zsm-client-sdk 2.6.2 → 2.7.0

package/CHANGELOG.md

@@ -11,7 +11,18 @@ and Universal MFA into a browser application.
 - None at this time.
 
 ----
-## Release 2.6.2 - December 19, 2025 [ NPM PACKAGE RELEASE ] **[ LATEST ]**
+
+## Release 2.7.0 - January 15, 2026 [ NPM PACKAGE RELEASE ] **[ LATEST ]**
+- Minor bug fixes and improvements
+- Standardization of credential responses across all SDK platforms (browser, mobile, native)
+- Standardization of credential schema across all all UMFA workflows
+- Improved security by addition of new validation checks for webauthn attestation and assertion responses
+- Improvements to performance by removing now-unnecessary API trips during UMFA enrollment and authentication flows
+
+## Release 2.6.3 - January 6, 2026 [ NPM PACKAGE RELEASE ]
+- Minor alteration to event coordinator to support legacy versions of Safari (versions  14-18.4)
+
+## Release 2.6.2 - December 19, 2025 [ NPM PACKAGE RELEASE ]
 - Hotfix release to address an issue with the Passkeys+ plugin integration.
 
 ## Release 2.6.1 - December 16, 2025 [ NPM PACKAGE RELEASE ]

package/EventCoordinator.js

@@ -182,7 +182,7 @@ class EventCoordinator {
     byStatus(eventStatus) {
         if (!eventStatus || typeof eventStatus !== 'string' || !eventStatus.length || !["UNREGISTERED", "PENDING", "READY", "ERROR"].includes(eventStatus)) 
             throw new Error(`[ZSM EventCoordinator] :: byStatus :: Invalid 'eventStatus' value: "${eventStatus}". Valid statuses are: UNREGISTERED, PENDING, READY, ERROR.`);
-        return [...this._eventStack.entries().flatMap(([k, v]) => (v === eventStatus) ? [k] : [])];
+        return this.entries.flatMap(([k, v]) => v === eventStatus ? [k] : []);
     }
 
     /**
@@ -202,7 +202,8 @@ class EventCoordinator {
      * @returns         {Object}                            Returns the reset event stack object.
      */
     reset() {
-        this._eventStack.keys().forEach(key=>this._eventStack.set(key,'PENDING'));
+        this.keys.forEach(key => this._eventStack.set(key, 'PENDING'));
+
         if(window && window?.queueMicrotask) {
             queueMicrotask(() => this.dispatchEvent('ZSMClientEventStackReset', { stack: this.object }));
         } else  this.dispatchEvent('ZSMClientEventStackReset', { stack: this.object });

package/PluginManager.js

@@ -1,14 +1,15 @@
 class PluginManager {
-    #sdkClassMap = new Map();           // Map of SDK class names to their implementations
-    #classCorpus = new Map();           // Map of plugin identities to their class maps
-    #status      = 'INITIALIZED';       // Indicates the current status of the plugin manager (INITIALIZED, SEEDED, FROZEN)
-
+    constructor() {
+        this._sdkClassMap = new Map();           // Map of SDK class names to their implementations
+        this._classCorpus = new Map();           // Map of plugin identities to their class maps
+        this._status      = 'INITIALIZED';       // Indicates the current status of the plugin manager (INITIALIZED, SEEDED, FROZEN)
+    }
     /**
      * Returns whether the plugin manager is frozen.
      * @returns         {boolean}                                       True if the plugin manager is frozen, false otherwise.
      */
     get isFrozen() {
-        return this.#status === 'FROZEN';
+        return this._status === 'FROZEN';
     }
 
     /**
@@ -20,15 +21,15 @@ class PluginManager {
      * @throws          {Error}                                         If no class is registered for the given name.
      */
     classes (classDesc) {
-        if(this.#status === 'INITIALIZED')              throw new Error('[zsmPluginManager] :: classes :: collection accessor cannot be referenced before SOME classes are registered!');
+        if(this._status === 'INITIALIZED')              throw new Error('[zsmPluginManager] :: classes :: collection accessor cannot be referenced before SOME classes are registered!');
         if(!classDesc || typeof classDesc !== 'string') throw new Error(`[zsmPluginManager] :: classes :: collection accessor requires a valid class description (received ${typeof classDesc}: ${classDesc})!`);
         classDesc = classDesc.toUpperCase();
         if(!this.isFrozen){
             console.warn('[zsmPluginManager] :: Freezing the plugin manager as the first class has been preemptively requested. No further plugins can be registered after this point.\nIf you feel you received this message unexpectedly, please ensure all plugins are imported before initializing (`new UMFAClient()` or `new FIDO2Client()`) a client.');
             this.freezePlugins();
         }
-        if(!this.#sdkClassMap.has(classDesc))           throw new Error(`[zsmPluginManager] :: classes :: No SDK class registered for: ${classDesc}`);
-        return this.#sdkClassMap.get(classDesc);
+        if(!this._sdkClassMap.has(classDesc))           throw new Error(`[zsmPluginManager] :: classes :: No SDK class registered for: ${classDesc}`);
+        return this._sdkClassMap.get(classDesc);
     }
 
     /**
@@ -56,9 +57,9 @@ class PluginManager {
         if (this.isFrozen) throw new Error('[zsmPluginManager] :: registerPlugin :: Cannot register plugin: PlugInManager is frozen!\nThis typically occurs when a plugin is imported after a client - UMFAClient or FIDO2Client - has already been initialized.\nMake sure to import all plugins before initializing (`new UMFAClient()` or `new FIDO2Client()`) a client.');
         if (!pluginIdentity || typeof classObj !== 'object' || classObj == null)  throw new Error('[zsmPluginManager] :: registerPlugin :: pluginIdentity and class map object required');
 
-        this.#status = 'SEEDED';
+        this._status = 'SEEDED';
 
-        this.#classCorpus.set(pluginIdentity.toUpperCase(), classObj);
+        this._classCorpus.set(pluginIdentity.toUpperCase(), classObj);
         console.info(`[zsmPluginManager] :: PluginManager :: Registered plugin "${pluginIdentity}".`);
         return true;
     }
@@ -74,19 +75,19 @@ class PluginManager {
         // As new plugins are DEVELOPED, they may introduce new classes or modify existing ones, and their extension/override logic must be declared below.
         
         // [CORE PACKAGE] Default all of the active classes to the "core" classes (set below this declaration)
-        const core = this.#classCorpus.get('CORE');
+        const core = this._classCorpus.get('CORE');
         if (!core) throw new Error('[zsmPluginManager] :: freezePlugins :: Core not registered before freeze');
         
         const constructedMap = this.seedClassMap(core); // returns Map
 
         // [PASSKEYS+ PLUGIN PACKAGE] If the "PASSKEYS+" plugin is registered, supercede the core classes with the passkeys classes
-        if(this.#classCorpus.has('PASSKEYS+')) {
-            const passkeysMap = this.#classCorpus.get('PASSKEYS+');
+        if(this._classCorpus.has('PASSKEYS+')) {
+            const passkeysMap = this._classCorpus.get('PASSKEYS+');
             if (passkeysMap?.classDefs) for (const [k,v] of Object.entries(passkeysMap.classDefs)) constructedMap.set(k.toUpperCase(), v);
         }
         
         // Apply class decorators (wrappers) AFTER overlays, if present in any of the registrations
-        const postConstructDecorators = [...this.#classCorpus.values()].filter(entry => entry.mode === 'DECORATOR');
+        const postConstructDecorators = [...this._classCorpus.values()].filter(entry => entry.mode === 'DECORATOR');
         if (postConstructDecorators.length) {
             for (const modifier of postConstructDecorators) {
                 let { classDesc, postModFn } = modifier;
@@ -101,8 +102,8 @@ class PluginManager {
             }
         }
         
-        this.#sdkClassMap = constructedMap;
-        this.#status = 'FROZEN';
+        this._sdkClassMap = constructedMap;
+        this._status = 'FROZEN';
     }
 }
 

package/RelyingPartyBase.js

@@ -114,6 +114,7 @@ class RelyingPartyBase {
      * @throws          {Error}                                     Throws an error if the request fails.
      */
     registrationFinish (credential) {
+        return credential;
         return  this.makePostRequest(`api/webauthn/registration/finish`, { credential })
                 .then(body => {
                     this.credentialID = credential.rawId;
@@ -153,6 +154,7 @@ class RelyingPartyBase {
      * @throws          {Error}                                     Throws an error if the request fails.
      */
     authenticationFinish (credential) {
+        return credential;
         return  this.makePostRequest("api/webauthn/authentication/finish", { credential })
                 .then(result => result)
                 .catch(error => Promise.reject(new Error(error)));
@@ -192,6 +194,7 @@ class RelyingPartyBase {
      * @throws          {Error}                                     Throws an error if the request fails.
      */
     registrationFinishAuthenticationStart (credential) {
+        return credential;
         return  this.makePostRequest(`api/webauthn/registration/finish-then-authentication-start`, { credential })
                 .then(result     => (this.credentialID = credential.rawId, result))
                 .then(credential => credential)

package/UMFAClientBase.js

@@ -99,7 +99,7 @@ class UMFAClientBase  {
             let userIsEnrolled                  = await this.checkEnrollment(userIdentifier);
             if(userIsEnrolled === false)        throw(`${userIdentifier} is not enrolled.`);
             let authCredential                  = await this.zsmAPI.webauthnPartialGet(userIdentifier);
-            return authCredential.credential;
+            return authCredential?.credential??authCredential;
         }catch(e) {
             return new Error(e.message || e || '[UMFAClient] :: authenticate :: An error occurred during authentication.');
         }

package/WebAuthnClientBase.js

@@ -12,6 +12,11 @@ const tracePrimer = (obj=false) => {
     return (obj) ? {"trace": traceBase} : traceBase;
 }
 
+const canParseURL = (url) => {
+  try { new URL(url); return true; } catch { return false; }
+}
+
+
 class WebAuthnClientBase {
     /**
      * Constructs a WebAuthnClientBase object.
@@ -20,7 +25,7 @@ class WebAuthnClientBase {
    constructor(config) {
         // console.log('config :', Object.assign({}, config));
         // Helper function to standardize URL format (ensuring it's parsable and ends with a '/')
-        const cleanURL = (url) => URL.canParse(url) ? new URL(url).origin + '/' : false;
+        const cleanURL = (url) => canParseURL(url) ? new URL(url).origin + '/' : false;
 
         if(config?.region){
             config.authenticator_host_url ||= config.authenticator_host = `https://zsm-authenticator-${config.region}.useideem.com/`;
@@ -282,6 +287,7 @@ class WebAuthnClientBase {
         GLOBAL.dispatchEvent(new CustomEvent("MPCResponse", {bubbles: true, cancelable: false, detail: mpcResponse }));
 
         const credential = mpcResponse.result;
+        return credential;
         let authFinishResponse = await this.relyingParty.authenticationFinish(credential);
 
         if      (authFinishResponse instanceof Error)       throw new Error(authFinishResponse);
@@ -375,6 +381,7 @@ class WebAuthnClientBase {
         GLOBAL.dispatchEvent(new CustomEvent("MPCResponse", {bubbles: true, cancelable: false, detail: mpcResponse }));
 
         const getCredential = mpcResponse.result;
+        return getCredential;
         return {
             signature: getCredential.response.signature,
             signedChallenge: getCredential.response.clientDataJSON,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name"          : "@ideem/zsm-client-sdk",
-    "version"       : "2.6.2",
+    "version"       : "2.7.0",
     "description"   : "ZSM makes 2FA easy and invisible for everyone, all the time, using advanced cryptography like MPC to establish cryptographic proof of the origin of any transaction or login attempt, while eliminating opportunities for social engineering. ZSM has no reliance on specific hardware. Our cryptographic module has completed FIPS 140-3 NIST approved lab testing, is FIDO2-ready, and is on the Modules In Progress (MIP) list. Superior Usability. no opt-in, no codes, no downloads, no authenticator apps. Better Security.",
     "author"        : "Jason Jurusz <jj@useideem.com>",
     "keywords"      : [ "ideem", "zsm", "zsm-client-sdk", "umfaclient", "fido2client", "library", "umfa", "fido", "fido2", "client", "javascript", "multifactor", "multi-factor", "webauthn", "authentication", "security", "cryptography", "mpc", "fips", "nist", "mip", "passkeys" ],