Module wss 

WebSocket Secure (WSS) transport for the RPC layer. Mirrors the Unix socket transport (unix.rs) but uses TLS-encrypted WebSocket connections, enabling remote TUI-to-daemon connectivity.

Structs

WssLimits

Bounds on the WSS listener’s pre-authentication and session state.

WssTransport

Constants

DEFAULT_HANDSHAKE_TIMEOUT_SECS

Default absolute budget for TLS accept plus the WebSocket upgrade. See WssLimits::handshake_timeout.

DEFAULT_INCOMPLETE_MESSAGE_TIMEOUT_SECS

Default lifetime bound on a partially-received data message. See WssLimits::incomplete_message_timeout.

DEFAULT_MAX_PENDING_HANDSHAKES

Default ceiling on sockets past accept() but not yet through the TLS and WebSocket handshakes. See WssLimits::max_pending_handshakes.

DEFAULT_MAX_SESSIONS

Default ceiling on concurrently established WSS sessions. See WssLimits::max_sessions. Sized as an explicit host-memory policy, not a connection-count guess: the parser envelope (rpc_ws_config) is 32 MiB per session, so this default caps the aggregate parser reservation at 2 GiB - defensible on a small daemon host - while 64 concurrent remote sessions is far beyond a personal daemon’s working set. Operators with bigger hosts and fleets raise it consciously, envelope arithmetic in hand.

DEFAULT_MAX_SESSIONS_PER_CLIENT

Default ceiling on concurrent sessions holding ONE client certificate. See WssLimits::max_sessions_per_client.

Functions

build_tls_acceptor

Build a [TlsAcceptor] for the remote WSS RPC plane.

run_wss_listener

Run the WSS RPC listener as a daemon subsystem. client_count is incremented on connect, decremented on disconnect — shared with the Unix socket listener for --ephemeral shutdown logic.