Upstream's featuretags work turned the wasm build into an allow-list scoped
to its SSH-in-browser client, which strips most of what this fork's JS bridge
exposes. Two problems, both silent at build time:
- cmd/tsconnect/wasm never imported feature/condregister, so extensions only
registered if the wasm happened to import them directly (taildrop did, ACME
did not). Without it getCert/listenTLS/setFunnel fail with "cert support not
compiled in this build".
- The Keep allow-list omitted acme, serve, taildrop, drive, tailnetlock,
bakedroots and the exit node features. bakedroots matters especially: a
browser has no system roots, so net/tlsdial's LetsEncrypt fallback is the
only verification path there.
Invert the polarity to an explicit Omit list, matching how this build behaved
before featuretags existed. Only feature/ace is omitted, because it does not
compile for GOOS=js. Trimming the bundle is worth doing later with
measurements; an allow-list turns each mistake into a runtime failure rather
than a build error.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
