refactor: tls backend feature flags

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## Unreleased
+
+### Breaking Changes
+
+* Split websocket TLS backend selection into explicit feature flags:
+  `tungstenite-native-tls`, `tungstenite-rustls-native-roots`, and
+  `tungstenite-rustls-webpki-roots`. The base `tungstenite` feature no longer
+  forces `native-tls`.
+
 ## 0.9.0 - 2026-03-25
 
 ### Breaking Changes

samod/Cargo.toml

@@ -10,7 +10,12 @@ repository = "https://github.com/alexjg/samod"
 [features]
 tokio = ["dep:tokio", "dep:tokio-util"]
 axum = ["dep:axum", "dep:tokio", "dep:tokio-util"]
-tungstenite = ["dep:tungstenite", "dep:tokio-tungstenite", "tokio", "tungstenite/native-tls", "tokio-tungstenite/native-tls"]
+tungstenite = ["dep:tungstenite", "dep:tokio-tungstenite", "tokio"]
+# TLS backend selection for tungstenite-based dialing (`wss://`).
+# Pick one explicitly in downstream crates.
+tungstenite-native-tls = ["tungstenite", "tokio-tungstenite/native-tls"]
+tungstenite-rustls-native-roots = ["tungstenite", "tokio-tungstenite/rustls-tls-native-roots"]
+tungstenite-rustls-webpki-roots = ["tungstenite", "tokio-tungstenite/rustls-tls-webpki-roots"]
 gio = ["dep:gio", "dep:glib"]
 threadpool = ["dep:rayon"]
 

samod/src/websocket.rs

@@ -214,6 +214,9 @@ impl Repo {
     /// # Arguments
     ///
     /// * `url` - The WebSocket URL to connect to (e.g. `"wss://sync.example.com"`).
+    ///   For `wss://` URLs, enable one TLS backend feature:
+    ///   `tungstenite-native-tls`, `tungstenite-rustls-native-roots`,
+    ///   or `tungstenite-rustls-webpki-roots`.
     /// * `backoff` - Backoff configuration for reconnection attempts.
     ///
     /// # Returns