@ideem/zsm-client-sdk 2.6.3 → 2.7.0

package/CHANGELOG.md

@@ -11,7 +11,15 @@ and Universal MFA into a browser application.
 - None at this time.
 
 ----
-## Release 2.6.3 - January 6, 2026 [ NPM PACKAGE RELEASE ] **[ LATEST ]**
+
+## Release 2.7.0 - January 15, 2026 [ NPM PACKAGE RELEASE ] **[ LATEST ]**
+- Minor bug fixes and improvements
+- Standardization of credential responses across all SDK platforms (browser, mobile, native)
+- Standardization of credential schema across all all UMFA workflows
+- Improved security by addition of new validation checks for webauthn attestation and assertion responses
+- Improvements to performance by removing now-unnecessary API trips during UMFA enrollment and authentication flows
+
+## Release 2.6.3 - January 6, 2026 [ NPM PACKAGE RELEASE ]
 - Minor alteration to event coordinator to support legacy versions of Safari (versions  14-18.4)
 
 ## Release 2.6.2 - December 19, 2025 [ NPM PACKAGE RELEASE ]

package/RelyingPartyBase.js

@@ -114,6 +114,7 @@ class RelyingPartyBase {
      * @throws          {Error}                                     Throws an error if the request fails.
      */
     registrationFinish (credential) {
+        return credential;
         return  this.makePostRequest(`api/webauthn/registration/finish`, { credential })
                 .then(body => {
                     this.credentialID = credential.rawId;
@@ -153,6 +154,7 @@ class RelyingPartyBase {
      * @throws          {Error}                                     Throws an error if the request fails.
      */
     authenticationFinish (credential) {
+        return credential;
         return  this.makePostRequest("api/webauthn/authentication/finish", { credential })
                 .then(result => result)
                 .catch(error => Promise.reject(new Error(error)));
@@ -192,6 +194,7 @@ class RelyingPartyBase {
      * @throws          {Error}                                     Throws an error if the request fails.
      */
     registrationFinishAuthenticationStart (credential) {
+        return credential;
         return  this.makePostRequest(`api/webauthn/registration/finish-then-authentication-start`, { credential })
                 .then(result     => (this.credentialID = credential.rawId, result))
                 .then(credential => credential)

package/UMFAClientBase.js

@@ -99,7 +99,7 @@ class UMFAClientBase  {
             let userIsEnrolled                  = await this.checkEnrollment(userIdentifier);
             if(userIsEnrolled === false)        throw(`${userIdentifier} is not enrolled.`);
             let authCredential                  = await this.zsmAPI.webauthnPartialGet(userIdentifier);
-            return authCredential.credential;
+            return authCredential?.credential??authCredential;
         }catch(e) {
             return new Error(e.message || e || '[UMFAClient] :: authenticate :: An error occurred during authentication.');
         }

package/WebAuthnClientBase.js

@@ -287,6 +287,7 @@ class WebAuthnClientBase {
         GLOBAL.dispatchEvent(new CustomEvent("MPCResponse", {bubbles: true, cancelable: false, detail: mpcResponse }));
 
         const credential = mpcResponse.result;
+        return credential;
         let authFinishResponse = await this.relyingParty.authenticationFinish(credential);
 
         if      (authFinishResponse instanceof Error)       throw new Error(authFinishResponse);
@@ -380,6 +381,7 @@ class WebAuthnClientBase {
         GLOBAL.dispatchEvent(new CustomEvent("MPCResponse", {bubbles: true, cancelable: false, detail: mpcResponse }));
 
         const getCredential = mpcResponse.result;
+        return getCredential;
         return {
             signature: getCredential.response.signature,
             signedChallenge: getCredential.response.clientDataJSON,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name"          : "@ideem/zsm-client-sdk",
-    "version"       : "2.6.3",
+    "version"       : "2.7.0",
     "description"   : "ZSM makes 2FA easy and invisible for everyone, all the time, using advanced cryptography like MPC to establish cryptographic proof of the origin of any transaction or login attempt, while eliminating opportunities for social engineering. ZSM has no reliance on specific hardware. Our cryptographic module has completed FIPS 140-3 NIST approved lab testing, is FIDO2-ready, and is on the Modules In Progress (MIP) list. Superior Usability. no opt-in, no codes, no downloads, no authenticator apps. Better Security.",
     "author"        : "Jason Jurusz <jj@useideem.com>",
     "keywords"      : [ "ideem", "zsm", "zsm-client-sdk", "umfaclient", "fido2client", "library", "umfa", "fido", "fido2", "client", "javascript", "multifactor", "multi-factor", "webauthn", "authentication", "security", "cryptography", "mpc", "fips", "nist", "mip", "passkeys" ],