fedipod-server 0.28.1 → 0.30.0

package/web/admin/upkeep.js

@@ -1,177 +0,0 @@
-// upkeep.js — upkeep and the lifecycle: the output pane, drain, recover,
-// log and dead letters; the confirmations for rotate, retire and move; and
-// the inbox backlog panel.
-
-// Which button filled the output pane, so clicking that one again closes it
-// rather than re-fetching the same thing under an already-open panel.
-let outputSource = null;
-
-const OUTPUT_TITLES = { log: 'Log', deadletter: 'Dead letters', drain: 'Inbox drain', rebuild: 'Recovered posts' };
-const output = (obj, source = null) => {
-  closePanels('output');
-  outputSource = source;
-  solWindow.show('output', OUTPUT_TITLES[source] || 'Output');
-  $('output').textContent = typeof obj === 'string' ? obj : JSON.stringify(obj, null, 2);
-};
-
-const showingFrom = (source) => outputSource === source && solWindow.openId() === 'output';
-
-// Drain is the one that does work rather than reveals it, so a second click
-// re-runs instead of closing. It can take a while — the agent joins a sweep
-// already in flight and queues another after it — and a button that looks dead
-// for a minute reads as broken.
-$('do-drain').addEventListener('click', async (ev) => {
-  const b = ev.currentTarget;
-  b.disabled = true;
-  b.textContent = 'draining…';
-  say('draining the inbox — if a sweep is already running this waits for it to finish');
-  const r = await write('/drain', {}, 'inbox drained');
-  b.disabled = false;
-  b.textContent = 'Drain the inbox';
-  if (r) {
-    const box = r.inbox || {};
-    say(`inbox drained — ${box.count ?? 0} still waiting`);
-    output(r, 'drain');
-  }
-});
-
-// Like the drain, this does work rather than reveals it, so a second click
-// re-runs. Nothing here can lose anything: it only adds posts back.
-$('do-rebuild').addEventListener('click', async (ev) => {
-  const b = ev.currentTarget;
-  b.disabled = true;
-  b.textContent = 'recovering…';
-  say('reading what the pod still holds — one request per post, so this takes a moment');
-  const r = await write('/rebuild', {}, 'checked');
-  b.disabled = false;
-  b.textContent = 'Recover posts';
-  if (!r) return;
-  if (r.why) { say(r.why, 'err'); return; }
-  if (!r.landed) { say('recovered posts could NOT be saved — see the log', 'err'); return; }
-  say(r.recovered
-    ? `recovered ${r.recovered} post(s) the pod had and this machine did not`
-    : `nothing was missing — the pod indexed ${r.indexed} post(s), all of them already here`);
-  output(r, 'rebuild');
-});
-
-$('do-log').addEventListener('click', async () => {
-  if (showingFrom('log')) { closePanels(); return; }
-  const { json } = await api('/log');
-  output((json?.lines || []).slice(-60).join('\n') || 'nothing logged yet', 'log');
-});
-
-$('do-deadletter').addEventListener('click', async () => {
-  if (showingFrom('deadletter')) { closePanels(); return; }
-  const { json } = await api('/deadletter');
-  output(json?.items?.length ? json.items : 'no dead letters', 'deadletter');
-});
-
-// ---- lifecycle ----
-// None of these can be taken back by clicking again, so the button only opens
-// the matching warning in the markup; the second click is the one that acts.
-// Retire also wants the handle typed, because a misclick cannot produce it.
-
-const LIFECYCLE = {
-  'rotate-key': { path: '/rotate-key', title: 'Rotate the signing key', done: (r) => (r.changed ? 'rotated and republished' : 'no change — the key was already fresh') },
-  retire: { path: '/retire', title: 'Retire this identity', go: 'Retire it', danger: true, done: (r) => `retired ${r.deletedAt}: Delete delivered to ${r.inboxes} inbox(es)` },
-  move: { path: '/move', title: 'Transfer this account away', go: 'Transfer it', focus: 'move-target',
-    done: (r) => `transferred to ${r.target}: Move delivered to ${r.inboxes} inbox(es), unfollowed ${r.unfollowed}/${r.following}` },
-  // The address at the gateway, not the identity: the pod keeps everything.
-  'close-address': { path: '/gateway/close', title: 'Close this address', go: 'Close it', danger: true, focus: 'confirm-handle-close',
-    done: (r) => (r.closed ? 'closed — this address is gone for good; everything on your pod is untouched' : 'not closed') },
-};
-let pending = null;
-
-const closeConfirm = () => closePanels();
-
-for (const btn of document.querySelectorAll('[data-confirm]')) {
-  btn.addEventListener('click', () => {
-    const what = btn.dataset.confirm;
-    // The same button again closes its question rather than re-asking it.
-    if (pending === what && solWindow.openId() === 'confirm-form') { closePanels(); return; }
-    closePanels();                    // including whatever else was open
-    pending = what;
-    const spec = LIFECYCLE[what];
-    $(`warn-${what}`).hidden = false;
-    solWindow.show('confirm-form', spec.title);
-    $('confirm-go').className = spec.danger ? 'danger' : 'primary';
-    $('confirm-go').textContent = spec.go || 'Confirm';
-    if (spec.focus) $(spec.focus).focus();
-    else if (what === 'retire') $('confirm-handle').focus();
-  });
-}
-
-// Offered from inside the retire warning: someone reading it has already said
-// what they want ("not this account, here, any more") and these are the two
-// answers that are not destruction. Switching panels rather than closing means
-// they do not have to go and find the button themselves.
-const openConfirm = (what) => {
-  closePanels();                 // or `show` toggles: same panel, different warning
-  document.querySelector(`[data-confirm="${what}"]`).click();
-};
-// Park lives on the status control now; from inside the retire warning it is
-// still one click — close the question and park.
-$('go-park').addEventListener('click', () => { closePanels(); setStatus(true); });
-$('go-move').addEventListener('click', () => openConfirm('move'));
-
-$('confirm-cancel').addEventListener('click', () => { closeConfirm(); say('nothing changed'); });
-
-$('confirm-form').addEventListener('submit', async (ev) => {
-  ev.preventDefault();
-  if (!pending) return;
-  const what = pending;
-  const body = what === 'retire' ? { confirm: $('confirm-handle').value.trim() }
-    : what === 'move' ? { target: $('move-target').value.trim(), confirm: $('confirm-handle-move').value.trim() }
-      : what === 'close-address' ? { confirm: $('confirm-handle-close').value.trim() }
-        : {};
-  if (what === 'move' && !body.target) { say('name the account to transfer to', 'err'); return; }
-  $('confirm-go').disabled = true;
-  say(`${what} — this talks to the pod and to other servers, so it takes a moment`);
-  const r = await write(LIFECYCLE[what].path, body, what);
-  $('confirm-go').disabled = false;
-  if (!r) return;                        // write() already said why
-  closeConfirm();
-  say(LIFECYCLE[what].done(r));
-  load();                                // mode, and whether it is retired, both changed
-});
-
-// ---- inbox ----
-// Only appears when there is enough waiting to be worth a decision. The agent
-// drains oldest-first regardless; this exists to let the owner say "do not
-// bother with that fortnight", which is not a call an agent should make on
-// someone's mail by itself.
-const INBOX_PROMPT_AT = 500;
-let dismissed = false;
-
-async function renderInbox() {
-  const { json: st } = await api('/status');
-  // A state document the last load could not read is a timeline or a contact
-  // list quietly missing; the page says which, under the facts.
-  const skipped = st?.stateSkipped || [];
-  const line = $('state-skipped');
-  line.hidden = !skipped.length;
-  line.textContent = skipped.length
-    ? `${skipped.length} state document${skipped.length === 1 ? '' : 's'} could not be read on the last load: ${skipped.join(', ')}.`
-    : '';
-  if (dismissed) return;
-  const box = st?.inbox;
-  const panel = $('pane-inbox');
-  if (!box || box.count < INBOX_PROMPT_AT) { panel.hidden = true; return; }
-  const mb = box.bytes >= 1048576
-    ? `${(box.bytes / 1048576).toFixed(1)} MB` : `${Math.round(box.bytes / 1024)} kB`;
-  const since = box.oldest ? new Date(box.oldest).toLocaleDateString() : 'unknown';
-  $('inbox-summary').textContent =
-    `${box.count.toLocaleString()} deliveries waiting (${mb}), the oldest from ${since}.`;
-  // One request each to read and delete, and the agent holds itself to 60 a
-  // minute, so the honest number is minutes not seconds.
-  $('inbox-warn').hidden = box.count < 2000;
-  $('inbox-warn').textContent = box.count >= 2000
-    ? `At 60 requests a minute this is roughly ${Math.ceil(box.count * 2 / 60)} minutes of `
-      + 'draining if you keep everything. Discarding the old content is much quicker.'
-    : '';
-  panel.hidden = false;
-}
-
-// The gateway, as a facts row under software: attach through a multi-user
-// front with this agent's own credential, detach back to the pod inbox. The
-// forms live in the floating window, like every other disclosure.

package/web/admin/window.css

@@ -1,55 +0,0 @@
-/* window.css — the floating panel every page of ours puts a form in.
-   Shared like bar.css, so the three surfaces cannot drift apart. */
-
-/* Fixed, so it floats over the page rather than pushing it about — which is
-   what the accordions did, moving the line you were reading every time one
-   opened. Resizing is the browser's own grip: `resize` needs `overflow` set to
-   anything but visible, which is also what keeps a long form inside the frame. */
-#win {
-  position: fixed; z-index: 40;
-  top: 5rem; left: 50%; transform: translateX(-50%);
-  width: min(46rem, calc(100vw - 2rem));
-  /* Tall enough for what is in it and no taller: a fixed height made a short
-     panel roomy and a long one scroll for no reason. `auto` up to a cap, so it
-     only ever scrolls when the content genuinely will not fit the screen — and
-     the moment you drag the corner, that inline height wins over both. */
-  height: auto;
-  min-width: 18rem; min-height: 8rem;
-  max-width: 100vw; max-height: calc(100vh - 7rem);
-  resize: both; overflow: hidden;
-  display: flex; flex-direction: column;
-  /* Raised, like the bar: it sits ON the page, so it takes the same colour the
-     bar does rather than the page's own. The shadow lifts it; the colour says
-     which layer it belongs to. */
-  background: var(--raised); color: CanvasText;
-  border: 1px solid var(--btn-edge); border-radius: .5rem;
-  box-shadow: 0 .6rem 2rem #0004;
-}
-/* Dragged by the bar, so the grab area is obvious and a text selection inside
-   the form never moves the window. */
-/* Its own title bar keeps a rule: this one IS two surfaces meeting inside a
-   single small box, where a tone change alone is too quiet to read as a grab
-   handle. Different problem from the page bar, different answer. */
-#win-bar {
-  flex: 0 0 auto; display: flex; align-items: baseline; gap: .6rem;
-  padding: .45rem .7rem; cursor: move; user-select: none;
-  border-bottom: 1px solid var(--btn-edge); border-radius: .5rem .5rem 0 0;
-  background: var(--surface);
-}
-#win-title { flex: 1 1 auto; font-weight: 600; color: var(--heading); }
-/* 24x24 is the 2.5.8 minimum; at .1rem of vertical padding this came out
-   21.6px tall, which is a small target for the one control that dismisses the
-   thing covering your page. Same glyph, same place, bigger hit area. */
-#win-close {
-  font: inherit; line-height: 1; cursor: pointer;
-  min-width: 24px; min-height: 24px; padding: .2rem .5rem;
-  display: inline-flex; align-items: center; justify-content: center;
-  border: 0; background: none; color: var(--link);
-}
-/* The window scrolls, never the page — same rule the rest of the app follows. */
-#win-body { flex: 1 1 auto; min-height: 0; overflow: auto; padding: .2rem 1rem 1rem; }
-#win-body > * { margin-top: .6rem; }
-#win-body pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
-  font-size: .9rem; }
-/* Dragging with the pointer over the frame would otherwise select text inside it. */
-body.dragging { user-select: none; }

package/web/admin/window.js

@@ -1,136 +0,0 @@
-// window.js — the floating panel, shared by every page of ours.
-//
-// It replaces the accordions. Those opened at the foot of the page and pushed
-// whatever you were reading out from under you; worse, only one could be open,
-// so looking at the log meant closing the form you were filling in. A window
-// floats over the page instead, and you can move it off whatever it covers.
-//
-// Resizing is the browser's own grip (`resize: both`), so there is no drag
-// maths here beyond moving it. Nothing is created in script: every panel is
-// declared in the page's markup inside #win-body, and this only shows one.
-
-(() => {
-  const win = document.getElementById('win');
-  if (!win) return;
-  const bar = document.getElementById('win-bar');
-  const title = document.getElementById('win-title');
-  const body = document.getElementById('win-body');
-
-  // Every direct child of the body is a panel; showing one hides the rest.
-  const panels = () => [...body.children];
-  let open = null;
-  // Where focus was when the window opened, so closing can put it back. Without
-  // this, Escape from inside the panel drops focus on <body> and the tab order
-  // restarts from the top of the page.
-  let returnTo = null;
-
-  // It IS a dialog, so it says so — and a dialog that opens without taking
-  // focus leaves a keyboard user tabbing forward through the rest of the page
-  // to find it, and a screen-reader user with no announcement that anything
-  // happened at all. It also sits over the control that opened it, so moving
-  // focus in is what stops that control being focused-but-obscured.
-  win.setAttribute('role', 'dialog');
-  win.setAttribute('aria-modal', 'false');       // the page behind stays usable
-  win.setAttribute('aria-labelledby', 'win-title');
-
-  // The first focusable that is actually SHOWING. A plain querySelector matches
-  // elements inside hidden sub-blocks (a confirm panel has one warning block per
-  // action, all but one hidden), and .focus() on a display:none element is a
-  // silent no-op — so a dialog whose first match is hidden would open with focus
-  // still outside it. offsetParent is null for anything display:none.
-  const focusFirst = () => {
-    const panel = panels().find(p => !p.hidden);
-    if (!panel) { document.getElementById('win-close')?.focus(); return; }
-    const candidates = panel.querySelectorAll(
-      'input:not([type=hidden]), select, textarea, button, [href], [tabindex]:not([tabindex="-1"])',
-    );
-    // Prefer a non-committing control: never open a destructive dialog with a
-    // submit/confirm button pre-focused where a stray Enter would fire it.
-    let firstVisible = null;
-    for (const el of candidates) {
-      if (el.offsetParent === null && el !== document.body) continue;   // hidden
-      if (!firstVisible) firstVisible = el;
-      const commits = el.type === 'submit' || /\bconfirm-go\b/.test(el.id);
-      if (!commits) { el.focus(); return; }
-    }
-    (firstVisible || document.getElementById('win-close'))?.focus();
-  };
-
-  const close = () => {
-    win.hidden = true;
-    for (const p of panels()) p.hidden = true;
-    const was = open;
-    open = null;
-    // Only if focus is still ours to move: the user may have clicked away.
-    const back = returnTo;
-    returnTo = null;
-    if (back && document.contains(back) && win.contains(document.activeElement)) back.focus();
-    else if (back && document.contains(back) && document.activeElement === document.body) back.focus();
-    win.dispatchEvent(new CustomEvent('win:closed', { detail: { was } }));
-  };
-
-  // Returns false when it CLOSED an already-open panel, so a button can toggle
-  // itself without every caller repeating the check.
-  const show = (id, label) => {
-    if (open === id && !win.hidden) { close(); return false; }
-    const opener = document.activeElement;
-    for (const p of panels()) p.hidden = p.id !== id;
-    title.textContent = label || '';
-    win.hidden = false;
-    open = id;
-    clampIntoView();
-    if (opener && opener !== document.body && !win.contains(opener)) returnTo = opener;
-    focusFirst();
-    return true;
-  };
-
-  // A window remembers where it was left, so it does not jump back to the
-  // middle every time — but only within the page, because a position saved on a
-  // wide screen is off-screen on a narrow one and there is nothing to grab.
-  let placed = false;
-  function clampIntoView() {
-    if (!placed) return;
-    const r = win.getBoundingClientRect();
-    const x = Math.min(Math.max(r.left, 0), Math.max(0, innerWidth - r.width));
-    const y = Math.min(Math.max(r.top, 0), Math.max(0, innerHeight - r.height));
-    moveTo(x, y);
-  }
-  function moveTo(x, y) {
-    win.style.transform = 'none';          // the centring transform, undone once moved
-    win.style.left = `${x}px`;
-    win.style.top = `${y}px`;
-    placed = true;
-  }
-
-  let drag = null;
-  bar.addEventListener('pointerdown', (e) => {
-    if (e.target.closest('button')) return;             // the close button is not a handle
-    const r = win.getBoundingClientRect();
-    drag = { dx: e.clientX - r.left, dy: e.clientY - r.top };
-    bar.setPointerCapture(e.pointerId);
-    document.body.classList.add('dragging');
-  });
-  bar.addEventListener('pointermove', (e) => {
-    if (!drag) return;
-    const r = win.getBoundingClientRect();
-    moveTo(Math.min(Math.max(e.clientX - drag.dx, 0), Math.max(0, innerWidth - r.width)),
-      Math.min(Math.max(e.clientY - drag.dy, 0), Math.max(0, innerHeight - r.height)));
-  });
-  const endDrag = (e) => {
-    if (!drag) return;
-    drag = null;
-    try { bar.releasePointerCapture(e.pointerId); } catch { /* already released */ }
-    document.body.classList.remove('dragging');
-  };
-  bar.addEventListener('pointerup', endDrag);
-  bar.addEventListener('pointercancel', endDrag);
-  addEventListener('resize', clampIntoView);
-
-  document.getElementById('win-close').addEventListener('click', close);
-  // Escape closes it, which is what every floating thing does and what people
-  // try first when a window is covering the thing they wanted to read.
-  addEventListener('keydown', (e) => { if (e.key === 'Escape' && !win.hidden) close(); });
-
-  // The whole API: open a declared panel by id, close, and ask what is open.
-  window.solWindow = { show, close, openId: () => (win.hidden ? null : open) };
-})();

package/web/app/README.md

@@ -1,81 +0,0 @@
-# web/app — FediPod in the browser
-
-The in-browser build: sign up and run a FediPod account in a tab, no install.
-See `claude/plans/browser-agent.md` for the whole design and status.
-
-| file | what |
-|---|---|
-| `pod-auth.mjs` | A CSS account API client, browser-native: create an account + pod, mint a client credential, and a DPoP-bound `fetch`. Since 1.28.0 the app itself uses none of it — a pod is made on the provider's own page and the app runs on the pod's Solid-OIDC login — but the harnesses do, to make scratch pods and stand in for a login form. The twin of `lib/device/account.mjs` + `vendor/idp-grant.cjs`. |
-| `keystore.mjs` | WebCrypto RSA/Ed25519 key generation. The key is stored on the pod as it is, in the owner-only state container, since 1.28.0 (2026-09-22); `unwrapKeys` remains for accounts from before then, whose key is under the sign-up password until it is opened once. |
-| `keys-browser.mjs` | Importing a keys record for signing, and finding one: this browser's opened copy in IndexedDB first, else the pod's, read with the pod session. A pre-1.28.0 envelope raises `KeyPasswordNeeded`, which `boot.mjs` answers with the open-once pane; the same pane offers a new key to someone who no longer has that password. |
-| `signup.mjs` | The `fedipod setup` flow, in the browser, up to publish, on the pod session the person already holds: pod check, gateway attach, key stored on the pod (owner-only ACL written *before* the key), config. Takes no password and no credential. Also `readAccount` (what the pod already holds) and `moveIn` (an address at another gateway moving here: attach fronted, rewrite the config with the old actor as an alias, restamp the key, leave the Move pending). |
-| `gateway-move.mjs` | The pending half of a move, run when the agent goes active under the new ids: tells the old gateway (`/api/move`) and sends the Move to every follower from the old actor, signed under the old key id through the old relay. Safe to run again. |
-| `shims/fedify-sig.mjs` | Browser stand-in for `@fedify/fedify/sig` (which will not bundle for a browser). `sign()` returns signed headers as data for the relay; `signRequest()` wraps it Fedify-shaped. Proven byte-identical to Fedify. |
-| `shims/node-crypto.mjs` | Browser stand-in for `node:crypto` — the small synchronous slice the agent uses, via crypto-browserify, plus native WebCrypto. |
-| `shims/safefetch.mjs` | Browser stand-in for `lib/shared/safefetch.mjs`. Pinning and the private-address checks are unnecessary here (a browser closes DNS rebinding itself); the BYTE BUDGET is not, so `readCapped` streams and stops at the cap exactly as the Node one does. |
-| `dist/` | The bundled agent, built by `scripts/build-app.mjs`. Committed like `phanpy/dist`, regenerated on release. (Not present until the agent entry is built.) |
-
-Build: `node scripts/build-app.mjs`. Tests live in `claude/validation/`:
-`signup-browser/`, `signing-shim/`, `agent-bundle/`.
-
-## The agent (built 2026-09-07)
-
-| file | what |
-|---|---|
-| `pod-remote.mjs` | RemotePod over the DPoP session — the agent's pod I/O, ACLs and deletion deny-list, browser-native. |
-| `keys-browser.mjs` | Load the signing key into WebCrypto. |
-| `deliver-relay.mjs` | lib's Deliverer, sending through the relay (a browser cannot set Date/Host). |
-| `agent.mjs` | Wires lib's store, publisher, intake and Mastodon facade with the browser edges. |
-| `sw-src.mjs` | The service worker that hosts the agent and answers the facade (Mastodon paths + the owner/manage paths); static files fall through. Built to `dist/sw.js`. |
-| `boot.mjs` | Page side: sign in at the pod (also the first half of sign-up), the identity screen on the way back, sign in by address, register the worker, route into `/admin/client/`; `?signout` / `?add` teardown. Built to `dist/boot.js`. |
-| `shims/` | Browser stand-ins the bundle needs: `node-crypto`, `node-path`, `node-url`, `node-fs`, `web-push`, `safefetch`, `prelude` (process + Buffer). |
-
-## The manage surface & connected accounts (built 2026-09-08)
-
-The owner's record/manage page is the SAME `web/admin` UI the Node agent serves,
-reused as static files under `/admin/` (staged by `scripts/stage-site.mjs`); the
-worker answers the data endpoints it calls. See
-`claude/plans/browser-manage-surface.md` for the whole design and status, and
-`claude/plans/post-as-connected-account.md` for the deferred "post as" plan.
-
-| file | what |
-|---|---|
-| `admin-facade.mjs` | Answers the owner/manage endpoints (`/status`, `/config`, `/gateway`, `/alias`, `/rotate-key`, `/rebuild`, `/move`, `/retire`, `/inbox/prune`, `/deadletter`, `/blocks`, `/atproto*`, `/fediacct*`) over the browser agent, mirroring `lib/device/admin.mjs`. Personal only. |
-| `atproto-browser.mjs` | The Bluesky connection (`lib/connections/atproto.mjs`) with a per-connection storage choice — IndexedDB (this browser) or owner-only pod state — plus pause. |
-| `fediacct-browser.mjs` | Connections to fediverse accounts on other servers (`lib/connections/fediacct.mjs`): the OAuth dance, the same storage choice, and a best-effort server-side revoke on disconnect. |
-| `idb-kv.mjs` | The per-origin IndexedDB key/value store the two connectors use for "on this device, never the pod" credentials. |
-
-`agent.mjs` also holds the single-active-agent **lease** (`lib/core/lease.mjs`) — a
-second device runs read-only until it takes over — and starts the drain/mirrors
-only when it is the active holder.
-
-Build: `node scripts/build-app.mjs --entry web/app/sw-src.mjs --out web/app/dist/sw.js` and `--entry web/app/boot.mjs --out web/app/dist/boot.js`, then `node scripts/stage-site.mjs` to assemble `web/app/site/` (the front, the worker, Phanpy under `/app/`, and `web/admin` under `/admin/`).
-
-Tests: `claude/smoke-tests/admin-facade-smoke.mjs`, and eight harnesses in
-`claude/validation/browser-agent/` that drive a real Chrome against a scratch
-Solid server — `run` (the agent and the facade), `sw-run` (the same through the
-service worker, plus media upload and notification paging), `full-run` (the
-staged site, sign-up to Phanpy rendering), `unlock-run` (a browser with no opened
-key, and a pre-1.28.0 account opened once), `oidc-run`, `resume-run`,
-`gateway-run`, and `provider-csp-run` (the sign-up page's own policy, read from
-the browser's refusal reports). Four helpers sit beside them: `idp-login.mjs`
-fills the pod's login and consent screens, `page-signup.mjs` drives the page
-through sign-up the way a person does since 1.28.0 (pod first, then the pod's
-login, then the identity screen), `worker-log.mjs` reads the agent's console
-out of the service worker, and the attach and relay stubs in `sw-run.mjs` stand
-in for the front.
-
-## What this build does not have
-
-Declared rather than pretended: each is omitted from the instance document, so
-a client hides the control instead of offering one that quietly does nothing.
-See the `MastoApi` options in `agent.mjs`.
-
-| | why |
-|---|---|
-| **Streaming** | a service worker answers fetches, not sockets. No streaming URL is advertised, so clients poll. |
-| **Web push** | `shims/web-push.mjs` is a no-op. `vapid` is omitted, and a client that subscribes anyway gets a 422 rather than a subscription nothing will push to. |
-| **Scheduled posts** | nothing runs between now and the scheduled time. A `scheduled_at` is refused with a 422 that says so — accepting one was silent loss. |
-| **Groups** | sign-up makes personal identities only (`signup.mjs`), and the moderation surface is not here. Joining a group works; hosting one needs the DeviceAgent. See `groups.md`. |
-| **Changing where the address lives** | the shape is chosen at sign-up (`signup.mjs`): on the pod, `@you@yourpod` with the gateway as a mail door, or at the gateway, `@you@front` — and a pod on a suffix-based host is always fronted. `admin-facade.mjs` refuses changing it afterwards, because a rename needs a restart a browser does not have. |
-| **Moving the private half** | `/state-move` is about filesystem paths and `credential.json`. A browser has neither; its private half is always on the pod. |