Struct WebSocketConfig 

pub struct WebSocketConfig {
    pub listen_address: SocketAddr,
    pub path: String,
    pub allowed_origins: Vec<String>,
    pub ping_interval_ms: Option<u64>,
}

WebSocket transport acceptor configuration ([websocket], LP-WS-TRANSPORT R1).

The sibling WebSocket route is an explicit opt-in: the section itself must be present for any HTTP/WebSocket listener to start, and inside it the listen address and the single exact upgrade path are required with no defaults.

The deployment TLS contract (tear ruling Q1) is raw ws:// behind a named TLS-terminating proxy that owns public wss:// and certificates; liminal grows no TLS stack. Origin validation nonetheless belongs to this acceptor: Self::allowed_origins is the explicit allow-list checked on every Origin-bearing upgrade, and there is NO default list — absent or empty configuration fails closed for browser-origin upgrades while a native client that sends no Origin header may still upgrade (F6).

OPERATOR NOTE — the same deployment contract covers the pre-upgrade window (domain-owner ruling, 2026-07-18): the fronting proxy must ALSO enforce pre-upgrade read timeouts, handshake concurrency limits, and connection rate limits. Between TCP accept and a completed WebSocket upgrade this listener does not count the socket against [limits] max_connections and applies no read deadline of its own (only the fixed request-head size bound), so a deployment that exposes this port without the named proxy is out of contract on untrusted networks. A named handshake read-deadline config plus an in-flight handshake cap derived from the configured max_connections value is the ledgered post-demo hardening.

Fields

listen_address: SocketAddr

Socket address the WebSocket acceptor binds. Required; distinct from the main wire listener, the health listener, and any cluster listener.

path: String

The single exact HTTP request path that accepts WebSocket upgrades. Required; must start with /. Every other path — and every ordinary HTTP request — receives a small fixed non-success response and closes.

allowed_origins: Vec<String>

Explicit browser-origin allow-list checked on every Origin-bearing upgrade (F6). Entries are compared byte-exact against the request’s serialized Origin header value (RFC 6454 ASCII serialization, e.g. https://app.example.com). Absent or empty means NO browser origin is accepted (fail closed); native clients sending no Origin header are unaffected.

ping_interval_ms: Option<u64>

Q-A transport-liveness keepalive: the server-side WebSocket Ping interval in milliseconds. This is a precise LAW-1 carve-out — liveness pings never mint application events, never re-arm application state, and never serve as a source of truth; failure detection remains the socket’s typed terminal events. The bound is one ping per interval per connection, so the idle cost is interval x connection-count. Absent means pings are DISABLED, accepting proxy-idle-disconnect churn as the documented consequence. A configured zero is a validation error.

Trait Implementations

impl Clone for WebSocketConfig

fn clone(&self) -> WebSocketConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WebSocketConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for WebSocketConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.