Merge remote-tracking branch 'origin/main'

docs/concepts/flows.md

@@ -131,7 +131,7 @@ The canvas reports issues on the affected nodes:
 | `self_loop_needs_initial` | a node reads and writes a message with no starting value |
 | `missing_source` | a Function node has no saved code |
 | `node_error` | code or configuration could not load |
-| `unauthenticated_hook` | a webhook has no shared secret; advisory |
+| `unauthenticated_hook` | a webhook or served websocket has no shared secret; advisory |
 | `node_unhealthy` | a loaded node reports a runtime problem, such as a lost connection |
 
 Build issues prevent the affected flow from running. The last two are runtime

docs/reference/node-types.md

@@ -75,6 +75,31 @@ Outputs only makes it a **webhook**: the engine mounts a route at
     The canvas flags this as an advisory issue rather than stopping the flow,
     because a webhook on a private network is a legitimate thing to want.
 
+### WebSocket
+
+**`websocket`** — listen on a socket, or send to it, as a client or a server.
+
+The URL picks the role: `ws://…` or `wss://…` connects to a server and
+reconnects when it drops; a path such as `/ticker` is served at
+`/hooks/{flow}/{url}/{secret}` while the flow runs. The ports pick the
+direction: outputs only make a **listener**, inputs a **sender**. A served
+sender sends to every connected client.
+
+| Setting | Default | Notes |
+|---|---|---|
+| `url` | — | `ws://` or `wss://` URL, or the path to serve |
+| `headers` | `{}` | handshake headers, client only; a value may be a secret reference |
+| `on_connect` | `[]` | frames sent after every (re)connect, client only — a subscribe or auth message; an item may be a secret reference |
+| `secret` | — | shared secret appended to a served socket's URL; takes a secret reference |
+| `timeout` | `10.0` | seconds for the handshake, and for a send to one client of a served socket |
+| `send_queue_size` | `256` | messages that may wait to be sent; past this the oldest is dropped and the node reports degraded |
+| `json_key` | — | as on `mqtt` |
+
+Frames are text. An incoming frame is parsed as JSON: an object feeds the
+ports it names, and a node with a single output takes any other frame whole.
+A single input is sent as it stands — a string raw, anything else as JSON —
+and several go as one object keyed by port.
+
 ### InfluxDB
 
 **`influxdb`** — write measurements to a bucket, or read them back.