@idp.global/sdk 18.3.1 → 19.0.0

package/changelog.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 2026-10-07 - 19.0.0
+
+### Breaking Changes
+
+- the relying-party socket binding takes the application's own TypedSocket, of any major (relyingparty)
+  - `RelyingPartySocketBinding` named TypedSocket 8 and SmartServe 6 types, so an application whose server runs TypedSocket 9 could not pass its transport. The binding reads only `setServerTag`, `findAllTargetConnectionsByTag` and a peer's upgrade headers; `TRelyingPartySocketConnection`, `TRelyingPartySocketPeer` and `TRelyingPartySocketTransport` are now exactly those structural shapes, and relyingparty imports no TypedSocket.
+  - Migration: an application that hands the connections of `connectionsOfSession` back to its TypedSocket (e.g. `removeServerTag`) names its connection type as the second type parameter: `RelyingPartySocketBinding<IUser, ISmartServeConnectionWrapper>`.
+
+### Maintenance
+
+- release tooling: pnpm 12.8.2, @git.zone/tsbuild ^5.1.2, @git.zone/tsdoc ^3.0.2, @git.zone/tstest ^7.2.0, @types/node 26.6.3
+
 ## 2026-10-01 - 18.3.1
 
 ### Fixes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@idp.global/sdk',
-    version: '18.3.1',
+    version: '19.0.0',
     description: 'Reusable browser and server SDK for idp.global authentication.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxpQkFBaUI7SUFDdkIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLGdFQUFnRTtDQUM5RSxDQUFBIn0=

package/dist_ts_relyingparty/classes.socketbinding.d.ts

@@ -1,13 +1,32 @@
-import * as plugins from './plugins.js';
 import type { RelyingPartySessions } from './classes.relyingpartysessions.js';
 import type { IRelyingPartySession } from './interfaces.js';
-/** The part of a server `TypedSocket` the binding uses. */
-export type TRelyingPartySocketTransport = Pick<plugins.typedsocket.TypedSocket, 'setServerTag' | 'findAllTargetConnectionsByTag'>;
-export type TRelyingPartySocketConnection = plugins.typedsocket.ISmartServeConnectionWrapper;
-/** The SmartServe WebSocket peer underneath a connection, as a TypedSocket server hands it out. */
-export type TRelyingPartySocketPeer = TRelyingPartySocketConnection['peer'];
-/** A connection wrapper or its peer; `TypedSocket.setServerTag` takes either. */
-export type TRelyingPartySocketTarget = TRelyingPartySocketConnection | TRelyingPartySocketPeer;
+/**
+ * The WebSocket peer underneath a connection, as far as the binding reads it:
+ * the headers its upgrade arrived with. A SmartServe peer of any major fits.
+ */
+export type TRelyingPartySocketPeer = {
+    context: {
+        headers: {
+            get(nameArg: string): string | null;
+        };
+    };
+};
+/** A server connection as the binding reads it: its peer. A TypedSocket connection wrapper of any major fits. */
+export type TRelyingPartySocketConnection = {
+    peer: TRelyingPartySocketPeer;
+};
+/** A connection or its peer; `TypedSocket.setServerTag` takes either. */
+export type TRelyingPartySocketTarget<TConnection extends TRelyingPartySocketConnection = TRelyingPartySocketConnection> = TConnection | TConnection['peer'];
+/**
+ * The part of the application's server `TypedSocket` the binding uses. The
+ * binding names no TypedSocket or SmartServe version: the application's own
+ * transport fits whichever major it runs, and `connectionsOfSession` answers
+ * its own connection type.
+ */
+export type TRelyingPartySocketTransport<TConnection extends TRelyingPartySocketConnection = TRelyingPartySocketConnection> = {
+    setServerTag(targetArg: TRelyingPartySocketTarget<TConnection>, nameArg: string): void;
+    findAllTargetConnectionsByTag(nameArg: string): Promise<TConnection[]>;
+};
 /** What a browser connection is pinned to for its whole life; no cookie and no CSRF token is kept. */
 export interface IRelyingPartyPinnedSession {
     sessionId: string;
@@ -27,10 +46,10 @@ export type TRelyingPartySocketRegistration = {
     registered: false;
     refusal: IRelyingPartySocketRefusal;
 };
-export interface IRelyingPartySocketBindingOptions<TPrincipal extends object | undefined = undefined> {
+export interface IRelyingPartySocketBindingOptions<TPrincipal extends object | undefined = undefined, TConnection extends TRelyingPartySocketConnection = TRelyingPartySocketConnection> {
     sessions: RelyingPartySessions<TPrincipal>;
     /** the transport typedserver created; `undefined` before the server runs */
-    transport: () => TRelyingPartySocketTransport | undefined;
+    transport: () => TRelyingPartySocketTransport<TConnection> | undefined;
     /** the server-owned tag prefix that finds the connections of a session */
     tagPrefix?: string;
 }
@@ -43,10 +62,10 @@ export interface IRelyingPartySocketBindingOptions<TPrincipal extends object | u
  * request. Connection limits, rate limits and sweeps belong to the
  * application's socket gate.
  */
-export declare class RelyingPartySocketBinding<TPrincipal extends object | undefined = undefined> {
+export declare class RelyingPartySocketBinding<TPrincipal extends object | undefined = undefined, TConnection extends TRelyingPartySocketConnection = TRelyingPartySocketConnection> {
     #private;
     readonly tagPrefix: string;
-    constructor(optionsArg: IRelyingPartySocketBindingOptions<TPrincipal>);
+    constructor(optionsArg: IRelyingPartySocketBindingOptions<TPrincipal, TConnection>);
     /** The upgrade headers a connection (or its peer) arrived with. */
     upgradeOf(targetArg: TRelyingPartySocketTarget): {
         origin: string | null;
@@ -66,7 +85,7 @@ export declare class RelyingPartySocketBinding<TPrincipal extends object | undef
      * Tags a connection — its wrapper or its peer — with its session; throws
      * when the transport is not running or the connection is gone.
      */
-    tagConnection(targetArg: TRelyingPartySocketTarget, sessionIdArg: string): void;
+    tagConnection(targetArg: TRelyingPartySocketTarget<TConnection>, sessionIdArg: string): void;
     /**
      * The pinned session as it stands right now: re-read, live, its principal
      * active and unchanged (and resolved, with `principals.resolve`), touched
@@ -80,5 +99,5 @@ export declare class RelyingPartySocketBinding<TPrincipal extends object | undef
         verifyCsrf(candidateArg: unknown): boolean;
     } | null>;
     /** The live connections of one session, for closing them when it ends. */
-    connectionsOfSession(sessionIdArg: string): Promise<readonly TRelyingPartySocketConnection[]>;
+    connectionsOfSession(sessionIdArg: string): Promise<readonly TConnection[]>;
 }

package/dist_ts_relyingparty/classes.socketbinding.js

@@ -1,4 +1,3 @@
-import * as plugins from './plugins.js';
 import { sha256, timingSafeEqualString } from './helpers.crypto.js';
 const peerOf = (targetArg) => 'peer' in targetArg ? targetArg.peer : targetArg;
 /**
@@ -97,4 +96,4 @@ export class RelyingPartySocketBinding {
         return transport.findAllTargetConnectionsByTag(this.tagOf(sessionIdArg));
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zb2NrZXRiaW5kaW5nLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfcmVseWluZ3BhcnR5L2NsYXNzZXMuc29ja2V0YmluZGluZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUV4QyxPQUFPLEVBQUUsTUFBTSxFQUFFLHFCQUFxQixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFpQnBFLE1BQU0sTUFBTSxHQUFHLENBQUMsU0FBb0MsRUFBMkIsRUFBRSxDQUMvRSxNQUFNLElBQUksU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUEyQm5EOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxPQUFPLHlCQUF5QjtJQUMzQixTQUFTLENBQW1DO0lBQzVDLFVBQVUsQ0FBaUQ7SUFDcEQsU0FBUyxDQUFTO0lBRWxDLFlBQVksVUFBeUQ7UUFDbkUsSUFBSSxDQUFDLFNBQVMsR0FBRyxVQUFVLENBQUMsUUFBUSxDQUFDO1FBQ3JDLElBQUksQ0FBQyxVQUFVLEdBQUcsVUFBVSxDQUFDLFNBQVMsQ0FBQztRQUN2QyxJQUFJLENBQUMsU0FBUyxHQUFHLFVBQVUsQ0FBQyxTQUFTLElBQUksaUJBQWlCLENBQUM7SUFDN0QsQ0FBQztJQUVELG1FQUFtRTtJQUM1RCxTQUFTLENBQUMsU0FBb0M7UUFDbkQsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUM7UUFDbEQsT0FBTyxFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7SUFDMUUsQ0FBQztJQUVEOzs7O09BSUc7SUFDSSxLQUFLLENBQUMsMEJBQTBCLENBQ3JDLFVBQW1CLEVBQ25CLFVBQTREO1FBRTVELElBQUksQ0FBQyxVQUFVLElBQUksT0FBTyxVQUFVLEtBQUssUUFBUSxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLEVBQUUsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUMzRixPQUFPLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRSxJQUFJLEVBQUUsZUFBZSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsRUFBRSxDQUFDO1FBQ2hGLENBQUM7UUFDRCxJQUFJLFVBQVUsQ0FBQyxNQUFNLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUN0RCxPQUFPLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsRUFBRSxDQUFDO1FBQzVFLENBQUM7UUFDRCxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsb0JBQW9CLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzlFLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNkLE9BQU8sRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFLElBQUksRUFBRSxjQUFjLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxFQUFFLENBQUM7UUFDL0UsQ0FBQztRQUNELElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLEVBQUUsV0FBVyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ2pGLE9BQU8sRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFLElBQUksRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxFQUFFLENBQUM7UUFDNUUsQ0FBQztRQUNELE9BQU87WUFDTCxVQUFVLEVBQUUsSUFBSTtZQUNoQixNQUFNLEVBQUU7Z0JBQ04sU0FBUyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRTtnQkFDOUIsV0FBVyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsV0FBVztnQkFDekMsYUFBYSxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO2FBQzFDO1lBQ0QsU0FBUyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsU0FBUztTQUN0QyxDQUFDO0lBQ0osQ0FBQztJQUVNLEtBQUssQ0FBQyxZQUFvQjtRQUMvQixPQUFPLElBQUksQ0FBQyxTQUFTLEdBQUcsWUFBWSxDQUFDO0lBQ3ZDLENBQUM7SUFFRDs7O09BR0c7SUFDSSxhQUFhLENBQUMsU0FBb0MsRUFBRSxZQUFvQjtRQUM3RSxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDcEMsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ2YsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDO1FBQ3pELENBQUM7UUFDRCxTQUFTLENBQUMsWUFBWSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUVEOzs7Ozs7T0FNRztJQUNJLEtBQUssQ0FBQyxVQUFVLENBQ3JCLFNBQXFDO1FBRXJDLE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxDQUFDLFNBQVMsQ0FBQyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDN0UsSUFBSSxDQUFDLElBQUksSUFBSSxJQUFJLENBQUMsT0FBTyxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDaEUsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsTUFBTSxZQUFZLEdBQUcsU0FBUyxDQUFDLGFBQWEsQ0FBQztRQUM3QyxPQUFPO1lBQ0wsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPO1lBQ3JCLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUztZQUN6QixVQUFVLEVBQUUsQ0FBQyxZQUFZLEVBQUUsRUFBRSxDQUMzQixPQUFPLFlBQVksS0FBSyxRQUFRO21CQUM3QixZQUFZLENBQUMsTUFBTSxHQUFHLENBQUM7bUJBQ3ZCLHFCQUFxQixDQUFDLFlBQVksRUFBRSxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUM7U0FDL0QsQ0FBQztJQUNKLENBQUM7SUFFRCwwRUFBMEU7SUFDbkUsS0FBSyxDQUFDLG9CQUFvQixDQUFDLFlBQW9CO1FBQ3BELE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUNwQyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDZixPQUFPLEVBQUUsQ0FBQztRQUNaLENBQUM7UUFDRCxPQUFPLFNBQVMsQ0FBQyw2QkFBNkIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFDM0UsQ0FBQztDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zb2NrZXRiaW5kaW5nLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfcmVseWluZ3BhcnR5L2NsYXNzZXMuc29ja2V0YmluZGluZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEVBQUUsTUFBTSxFQUFFLHFCQUFxQixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFnQ3BFLE1BQU0sTUFBTSxHQUFHLENBQUMsU0FBb0MsRUFBMkIsRUFBRSxDQUMvRSxNQUFNLElBQUksU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUE4Qm5EOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxPQUFPLHlCQUF5QjtJQUkzQixTQUFTLENBQW1DO0lBQzVDLFVBQVUsQ0FBOEQ7SUFDakUsU0FBUyxDQUFTO0lBRWxDLFlBQVksVUFBc0U7UUFDaEYsSUFBSSxDQUFDLFNBQVMsR0FBRyxVQUFVLENBQUMsUUFBUSxDQUFDO1FBQ3JDLElBQUksQ0FBQyxVQUFVLEdBQUcsVUFBVSxDQUFDLFNBQVMsQ0FBQztRQUN2QyxJQUFJLENBQUMsU0FBUyxHQUFHLFVBQVUsQ0FBQyxTQUFTLElBQUksaUJBQWlCLENBQUM7SUFDN0QsQ0FBQztJQUVELG1FQUFtRTtJQUM1RCxTQUFTLENBQUMsU0FBb0M7UUFDbkQsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUM7UUFDbEQsT0FBTyxFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7SUFDMUUsQ0FBQztJQUVEOzs7O09BSUc7SUFDSSxLQUFLLENBQUMsMEJBQTBCLENBQ3JDLFVBQW1CLEVBQ25CLFVBQTREO1FBRTVELElBQUksQ0FBQyxVQUFVLElBQUksT0FBTyxVQUFVLEtBQUssUUFBUSxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLEVBQUUsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUMzRixPQUFPLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRSxJQUFJLEVBQUUsZUFBZSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsRUFBRSxDQUFDO1FBQ2hGLENBQUM7UUFDRCxJQUFJLFVBQVUsQ0FBQyxNQUFNLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUN0RCxPQUFPLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsRUFBRSxDQUFDO1FBQzVFLENBQUM7UUFDRCxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsb0JBQW9CLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzlFLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNkLE9BQU8sRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFLElBQUksRUFBRSxjQUFjLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxFQUFFLENBQUM7UUFDL0UsQ0FBQztRQUNELElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLEVBQUUsV0FBVyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ2pGLE9BQU8sRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFLElBQUksRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxFQUFFLENBQUM7UUFDNUUsQ0FBQztRQUNELE9BQU87WUFDTCxVQUFVLEVBQUUsSUFBSTtZQUNoQixNQUFNLEVBQUU7Z0JBQ04sU0FBUyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRTtnQkFDOUIsV0FBVyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsV0FBVztnQkFDekMsYUFBYSxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO2FBQzFDO1lBQ0QsU0FBUyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsU0FBUztTQUN0QyxDQUFDO0lBQ0osQ0FBQztJQUVNLEtBQUssQ0FBQyxZQUFvQjtRQUMvQixPQUFPLElBQUksQ0FBQyxTQUFTLEdBQUcsWUFBWSxDQUFDO0lBQ3ZDLENBQUM7SUFFRDs7O09BR0c7SUFDSSxhQUFhLENBQUMsU0FBaUQsRUFBRSxZQUFvQjtRQUMxRixNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDcEMsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ2YsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDO1FBQ3pELENBQUM7UUFDRCxTQUFTLENBQUMsWUFBWSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUVEOzs7Ozs7T0FNRztJQUNJLEtBQUssQ0FBQyxVQUFVLENBQ3JCLFNBQXFDO1FBRXJDLE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxDQUFDLFNBQVMsQ0FBQyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDN0UsSUFBSSxDQUFDLElBQUksSUFBSSxJQUFJLENBQUMsT0FBTyxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDaEUsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsTUFBTSxZQUFZLEdBQUcsU0FBUyxDQUFDLGFBQWEsQ0FBQztRQUM3QyxPQUFPO1lBQ0wsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPO1lBQ3JCLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUztZQUN6QixVQUFVLEVBQUUsQ0FBQyxZQUFZLEVBQUUsRUFBRSxDQUMzQixPQUFPLFlBQVksS0FBSyxRQUFRO21CQUM3QixZQUFZLENBQUMsTUFBTSxHQUFHLENBQUM7bUJBQ3ZCLHFCQUFxQixDQUFDLFlBQVksRUFBRSxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUM7U0FDL0QsQ0FBQztJQUNKLENBQUM7SUFFRCwwRUFBMEU7SUFDbkUsS0FBSyxDQUFDLG9CQUFvQixDQUFDLFlBQW9CO1FBQ3BELE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUNwQyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDZixPQUFPLEVBQUUsQ0FBQztRQUNaLENBQUM7UUFDRCxPQUFPLFNBQVMsQ0FBQyw2QkFBNkIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFDM0UsQ0FBQztDQUNGIn0=

package/dist_ts_relyingparty/plugins.d.ts

@@ -2,8 +2,7 @@ import * as asyncHooks from 'node:async_hooks';
 import * as crypto from 'node:crypto';
 export { asyncHooks, crypto };
 import * as typedrequest from '@api.global/typedrequest';
-import * as typedsocket from '@api.global/typedsocket';
-export { typedrequest, typedsocket };
+export { typedrequest };
 import * as nosqldb from '@lossless.org/client/nosqldb';
 export { nosqldb };
 import * as openidClient from 'openid-client';

package/dist_ts_relyingparty/plugins.js

@@ -2,10 +2,9 @@ import * as asyncHooks from 'node:async_hooks';
 import * as crypto from 'node:crypto';
 export { asyncHooks, crypto };
 import * as typedrequest from '@api.global/typedrequest';
-import * as typedsocket from '@api.global/typedsocket';
-export { typedrequest, typedsocket };
+export { typedrequest };
 import * as nosqldb from '@lossless.org/client/nosqldb';
 export { nosqldb };
 import * as openidClient from 'openid-client';
 export { openidClient };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3JlbHlpbmdwYXJ0eS9wbHVnaW5zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxVQUFVLE1BQU0sa0JBQWtCLENBQUM7QUFDL0MsT0FBTyxLQUFLLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFFdEMsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsQ0FBQztBQUU5QixPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFFdkQsT0FBTyxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsQ0FBQztBQUVyQyxPQUFPLEtBQUssT0FBTyxNQUFNLDhCQUE4QixDQUFDO0FBRXhELE9BQU8sRUFBRSxPQUFPLEVBQUUsQ0FBQztBQUVuQixPQUFPLEtBQUssWUFBWSxNQUFNLGVBQWUsQ0FBQztBQUU5QyxPQUFPLEVBQUUsWUFBWSxFQUFFLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3JlbHlpbmdwYXJ0eS9wbHVnaW5zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxVQUFVLE1BQU0sa0JBQWtCLENBQUM7QUFDL0MsT0FBTyxLQUFLLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFFdEMsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsQ0FBQztBQUU5QixPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBRXpELE9BQU8sRUFBRSxZQUFZLEVBQUUsQ0FBQztBQUV4QixPQUFPLEtBQUssT0FBTyxNQUFNLDhCQUE4QixDQUFDO0FBRXhELE9BQU8sRUFBRSxPQUFPLEVBQUUsQ0FBQztBQUVuQixPQUFPLEtBQUssWUFBWSxNQUFNLGVBQWUsQ0FBQztBQUU5QyxPQUFPLEVBQUUsWUFBWSxFQUFFLENBQUMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@idp.global/sdk",
-  "version": "18.3.1",
+  "version": "19.0.0",
   "private": false,
   "description": "Reusable browser and server SDK for idp.global authentication.",
   "type": "module",
@@ -34,13 +34,13 @@
   },
   "devDependencies": {
     "@api.global/typedserver": "^11.4.0",
-    "@git.zone/tsbuild": "^5.0.0",
-    "@git.zone/tsdoc": "^3.0.0",
+    "@git.zone/tsbuild": "^5.1.2",
+    "@git.zone/tsdoc": "^3.0.2",
     "@git.zone/tsrun": "^3.0.2",
-    "@git.zone/tstest": "^6.3.2",
+    "@git.zone/tstest": "^7.2.0",
     "@lossless.org/client": "^1.0.0",
     "@lossless.org/nosqldb": "10.5.0",
-    "@types/node": "26.6.2"
+    "@types/node": "26.6.3"
   },
   "files": [
     "ts/**/*",

package/readme.md

@@ -660,7 +660,24 @@ then the application's. The two options are not combined.
 
 **Socket peers.** `RelyingPartySocketBinding.tagConnection` and `upgradeOf` take
 the connection wrapper or the bare SmartServe peer (`TRelyingPartySocketPeer`),
-the two forms `TypedSocket.setServerTag` accepts.
+the two forms `TypedSocket.setServerTag` accepts. The binding names no
+TypedSocket or SmartServe version: its transport, connection and peer types are
+only what it reads (`setServerTag`, `findAllTargetConnectionsByTag`, a peer's
+upgrade headers), so the application's own server `TypedSocket` fits whichever
+major it runs. Name the application's connection type as the second type
+parameter and `connectionsOfSession` answers it:
+
+```ts
+import type { ISmartServeConnectionWrapper } from '@api.global/typedsocket';
+
+const binding = new RelyingPartySocketBinding<IUser, ISmartServeConnectionWrapper>({
+  sessions,
+  transport: () => typedserver.typedsocket,
+});
+for (const connection of await binding.connectionsOfSession(sessionId)) {
+  typedserver.removeServerTag(connection, binding.tagOf(sessionId));
+}
+```
 
 ### Relying-Party API Surface
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@idp.global/sdk',
-  version: '18.3.1',
+  version: '19.0.0',
   description: 'Reusable browser and server SDK for idp.global authentication.'
 }

package/ts_relyingparty/classes.socketbinding.ts

@@ -1,21 +1,35 @@
-import * as plugins from './plugins.js';
 import type { RelyingPartySessions } from './classes.relyingpartysessions.js';
 import { sha256, timingSafeEqualString } from './helpers.crypto.js';
 import type { IRelyingPartySession } from './interfaces.js';
 
-/** The part of a server `TypedSocket` the binding uses. */
-export type TRelyingPartySocketTransport = Pick<
-  plugins.typedsocket.TypedSocket,
-  'setServerTag' | 'findAllTargetConnectionsByTag'
->;
+/**
+ * The WebSocket peer underneath a connection, as far as the binding reads it:
+ * the headers its upgrade arrived with. A SmartServe peer of any major fits.
+ */
+export type TRelyingPartySocketPeer = {
+  context: { headers: { get(nameArg: string): string | null } };
+};
 
-export type TRelyingPartySocketConnection = plugins.typedsocket.ISmartServeConnectionWrapper;
+/** A server connection as the binding reads it: its peer. A TypedSocket connection wrapper of any major fits. */
+export type TRelyingPartySocketConnection = {
+  peer: TRelyingPartySocketPeer;
+};
 
-/** The SmartServe WebSocket peer underneath a connection, as a TypedSocket server hands it out. */
-export type TRelyingPartySocketPeer = TRelyingPartySocketConnection['peer'];
+/** A connection or its peer; `TypedSocket.setServerTag` takes either. */
+export type TRelyingPartySocketTarget<TConnection extends TRelyingPartySocketConnection = TRelyingPartySocketConnection> =
+  | TConnection
+  | TConnection['peer'];
 
-/** A connection wrapper or its peer; `TypedSocket.setServerTag` takes either. */
-export type TRelyingPartySocketTarget = TRelyingPartySocketConnection | TRelyingPartySocketPeer;
+/**
+ * The part of the application's server `TypedSocket` the binding uses. The
+ * binding names no TypedSocket or SmartServe version: the application's own
+ * transport fits whichever major it runs, and `connectionsOfSession` answers
+ * its own connection type.
+ */
+export type TRelyingPartySocketTransport<TConnection extends TRelyingPartySocketConnection = TRelyingPartySocketConnection> = {
+  setServerTag(targetArg: TRelyingPartySocketTarget<TConnection>, nameArg: string): void;
+  findAllTargetConnectionsByTag(nameArg: string): Promise<TConnection[]>;
+};
 
 const peerOf = (targetArg: TRelyingPartySocketTarget): TRelyingPartySocketPeer =>
   'peer' in targetArg ? targetArg.peer : targetArg;
@@ -37,10 +51,13 @@ export type TRelyingPartySocketRegistration =
   | { registered: true; pinned: IRelyingPartyPinnedSession; expiresAt: number }
   | { registered: false; refusal: IRelyingPartySocketRefusal };
 
-export interface IRelyingPartySocketBindingOptions<TPrincipal extends object | undefined = undefined> {
+export interface IRelyingPartySocketBindingOptions<
+  TPrincipal extends object | undefined = undefined,
+  TConnection extends TRelyingPartySocketConnection = TRelyingPartySocketConnection,
+> {
   sessions: RelyingPartySessions<TPrincipal>;
   /** the transport typedserver created; `undefined` before the server runs */
-  transport: () => TRelyingPartySocketTransport | undefined;
+  transport: () => TRelyingPartySocketTransport<TConnection> | undefined;
   /** the server-owned tag prefix that finds the connections of a session */
   tagPrefix?: string;
 }
@@ -54,12 +71,15 @@ export interface IRelyingPartySocketBindingOptions<TPrincipal extends object | u
  * request. Connection limits, rate limits and sweeps belong to the
  * application's socket gate.
  */
-export class RelyingPartySocketBinding<TPrincipal extends object | undefined = undefined> {
+export class RelyingPartySocketBinding<
+  TPrincipal extends object | undefined = undefined,
+  TConnection extends TRelyingPartySocketConnection = TRelyingPartySocketConnection,
+> {
   readonly #sessions: RelyingPartySessions<TPrincipal>;
-  readonly #transport: () => TRelyingPartySocketTransport | undefined;
+  readonly #transport: () => TRelyingPartySocketTransport<TConnection> | undefined;
   public readonly tagPrefix: string;
 
-  constructor(optionsArg: IRelyingPartySocketBindingOptions<TPrincipal>) {
+  constructor(optionsArg: IRelyingPartySocketBindingOptions<TPrincipal, TConnection>) {
     this.#sessions = optionsArg.sessions;
     this.#transport = optionsArg.transport;
     this.tagPrefix = optionsArg.tagPrefix ?? 'idp_rp_session:';
@@ -112,7 +132,7 @@ export class RelyingPartySocketBinding<TPrincipal extends object | undefined = u
    * Tags a connection — its wrapper or its peer — with its session; throws
    * when the transport is not running or the connection is gone.
    */
-  public tagConnection(targetArg: TRelyingPartySocketTarget, sessionIdArg: string): void {
+  public tagConnection(targetArg: TRelyingPartySocketTarget<TConnection>, sessionIdArg: string): void {
     const transport = this.#transport();
     if (!transport) {
       throw new Error('The socket transport is not running');
@@ -146,7 +166,7 @@ export class RelyingPartySocketBinding<TPrincipal extends object | undefined = u
   }
 
   /** The live connections of one session, for closing them when it ends. */
-  public async connectionsOfSession(sessionIdArg: string): Promise<readonly TRelyingPartySocketConnection[]> {
+  public async connectionsOfSession(sessionIdArg: string): Promise<readonly TConnection[]> {
     const transport = this.#transport();
     if (!transport) {
       return [];

package/ts_relyingparty/plugins.ts

@@ -4,9 +4,8 @@ import * as crypto from 'node:crypto';
 export { asyncHooks, crypto };
 
 import * as typedrequest from '@api.global/typedrequest';
-import * as typedsocket from '@api.global/typedsocket';
 
-export { typedrequest, typedsocket };
+export { typedrequest };
 
 import * as nosqldb from '@lossless.org/client/nosqldb';