sgcWebSockets 2026.10

sgcWebSockets 2026.10 is out. Two threads run through it: sgcHTML grew the parts a business web application needs and stops you writing by hand, and the cryptography went post-quantum without adding a single external library.

Web Applications: the Boring Parts, Done

Sessions, login and CSRF. The new TsgcHTMLAuth component and its session stores keep the cookie, answer the login and logout requests, close idle sessions and throttle failed logins. The CSRF token travels in a meta tag, htmx adds it to every request on its own, and the server rejects a post that does not carry it.

FAuth := TsgcHTMLAuth.Create(Self);
FAuth.SessionStore := TsgcHTMLSessionStore_Memory.Create(Self);
FAuth.CookieName := 'app_session';
FEngine.Auth := FAuth;

Routes that read like routes. Path parameters, a method filter, and access to the headers, the cookies and the body:

with FRouter.Routes.Add do
begin
  Path := '/customers/{id}/edit';
  Methods := [hrmGet, hrmPost];
  RequireLogin := True;
  RequireRoles := 'admin,sales';
end;

Pages you can test. DispatchDirect answers a request with no socket behind it, and a new unit reads the generated HTML, finds elements by id, class, tag or attribute and compares a page against a saved copy, so an unintended change in the markup is noticed by a test rather than by a customer.

Navigation that feels like an application. Pages change without a full reload and keep the scroll position and what the user was typing, with a loading bar, a dialog when the connection drops and a message when a request fails. All of it off by default.

The Four Headline Features

Each of these has an article of its own, linked at the end, so here is only what it is:

• MCP Apps. An MCP tool that answers with a page instead of a paragraph, rendered inside ChatGPT, Claude or VS Code, built from the same components as any other sgcHTML page.
• The AI page generator. Describe a page, or hand the designer a screenshot, and it builds it out of your registered components as a candidate you accept or discard.
• The CRUD component. List, search, paging, form, delete and the write path of one dataset, over a TDataSet or over your own SQL, with an IDE wizard and a command line generator.
• The AI Data Pack. Ask a grid, a data table or a pivot a question in plain language, with a rule based parser that answers when there is no API key at all.

Push, Two Ways

Server sent events can now carry the updates instead of a WebSocket, with replay of what was missed while disconnected, and it works with the plain HTTP server. Web Push reaches a browser that is closed. A notification inbox and a preferences table come with them, and the notification component decides which channel a given user gets.

AI: Answers You Can Act On

TsgcAIChat can ask for JSON that follows a schema you supply, on OpenAI, Anthropic, Gemini, DeepSeek, Ollama, Grok and Mistral, through the new ChatJSON method, which parses the answer and asks once more with the parse error attached when it cannot be read. The chat component also sends and receives images now, and BaseUrl is honoured by every provider rather than only by Ollama, so any of them can be pointed at a proxy or a local gateway.

Cryptography: Post-Quantum, in Object Pascal

ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), X-Wing hybrid key encapsulation, post-quantum X.509 certificates and certificate authorities, and JWT signed with ML-DSA. All of it written in Object Pascal in the sgcCrypto pack, with no external library, validated against the NIST known answer vectors.

On top of that sits a native TLS 1.3 engine, also pure Pascal: a client or a server speaks TLS without OpenSSL and without SChannel, negotiating the hybrid post-quantum groups of RFC 10024, with ALPN, S N I, client certificates and optional use of the operating system trust store.

The classical side was hardened in the same pass: blinded constant time RSA, constant time elliptic curve scalar multiplication and Ed25519, table free AES and GHASH, imported private keys checked against their public half, and non minimal DER signatures rejected.

Fixes Worth Naming

• JWT signing and validation with RSA and ECDSA keys, and memory corruption in 32-bit applications, when OpenSSL is linked statically.
• The SChannel handler leaving a copy of the private key in the Windows key store for every connection using a PFX file, and not sending the client certificate on recent Windows versions.
• Concurrent SChannel connections using a certificate from the Windows store failing the handshake.
• The OAuth2 server rejecting DPoP proofs signed with RSA keys.
• CloudFront signed URLs whose signature was not URL safe encoded.

.NET

The .NET library keeps pace: auth and sessions with a ClaimsPrincipal bridge for ASP.NET Core, the router, the testing helpers, SPA navigation, the SSE transport with a native endpoint, structured output, the AI Data Pack, Web Push, MCP Apps and the CRUD component with its adapters, all with the same API names as Delphi.

Upgrading

Everything new is additive and off by default. Drop in the new units, rebuild your packages, and an existing application behaves exactly as it did.

The Long Versions

• Run Your Delphi App Inside ChatGPT and Claude
• Turn a Screenshot Into a Delphi Web Page
• Delphi TLS 1.3 Without OpenSSL DLLs
• A Delphi Web CRUD Page in Five Minutes
• Ask Your Delphi Grid a Question in Plain English
• Reach a Browser That Is Closed, From Delphi

Watch It

There is a short video of this on the eSeGeCe channel.

Questions, feedback or migration help? Get in touch — you will get a reply from the people who wrote the code.