@makerclay/core 1.0.0

package/src/auth/none.js

@@ -0,0 +1,24 @@
+// Everyone-is-owner. This is hyperclay-local's posture: a single-user process on
+// loopback where every file on disk belongs to the person at the keyboard.
+//
+// The two client-readable cookies are set unconditionally, byte-for-byte what
+// hyperclay-local does today, because clayjs reads `isAdminOfCurrentResource`
+// (httpOnly:false) to decide whether the page is editable.
+
+export function none() {
+  return {
+    name: 'none',
+
+    routes() {},
+
+    async identify() {
+      return { kind: 'owner' };
+    },
+
+    decorate(req, res) {
+      const options = { httpOnly: false, secure: false, sameSite: 'lax' };
+      res.cookie('isAdminOfCurrentResource', 'true', options);
+      res.cookie('isLoggedIn', 'true', options);
+    },
+  };
+}

package/src/auth/password.js

@@ -0,0 +1,281 @@
+import crypto from 'node:crypto';
+import express from 'express';
+import { createSessions } from './sessions.js';
+import { hashPassword, verifyPassword } from './passwords.js';
+import { createRateLimiter } from './rate-limit.js';
+import { createCsrfGuard } from './csrf.js';
+import { jsonError } from '../json-errors.js';
+import { token as mintToken } from '../util/id.js';
+
+// Single-owner password auth, WordPress-style first run. No email anywhere.
+//
+// The owner's hash lives in `kv`, not in a users table, and that is deliberate:
+// the schema cannot express two owners. There is no invite flow to leave
+// half-finished and no "admin" role to escalate into.
+//
+// First boot prints a one-time setup key to the console. Requiring it closes the
+// race-to-claim hole: without it, an exposed fresh server belongs to whoever
+// loads /_/setup first, which on a public IP is a scanner, not the owner.
+
+const OWNER_HASH_KEY = 'owner_password';
+const SETUP_TOKEN_KEY = 'setup_token';
+const RESET_TOKEN_KEY = 'reset_token';
+const RESET_EXPIRY_KEY = 'reset_token_expires';
+
+const MIN_PASSWORD = 8;
+const RESET_TTL_MS = 60 * 60 * 1000;
+
+// The setup page needs the client to boot, and /_/health is how anyone finds
+// out what is going on. Everything else waits for an owner to exist.
+const OPEN_WHILE_UNCLAIMED = /^\/_\/(setup|health|clay[\w-]*\.js|sap\.js|all\.js|src\/)/;
+
+function timingSafeEquals(a, b) {
+  const left = Buffer.from(String(a ?? ''), 'utf8');
+  const right = Buffer.from(String(b ?? ''), 'utf8');
+  if (left.length !== right.length || left.length === 0) return false;
+  return crypto.timingSafeEqual(left, right);
+}
+
+export function ownerPassword(options = {}) {
+  let ctx = null;
+  let sessions = null;
+  let loginLimiter = null;
+
+  function ownerHash() {
+    return ctx.store.getKv(OWNER_HASH_KEY);
+  }
+
+  function claimed() {
+    return !!ownerHash();
+  }
+
+  // Minted once, when the host starts with nobody in charge of it.
+  function setupToken() {
+    if (!ctx?.store || claimed()) return null;
+    let value = ctx.store.getKv(SETUP_TOKEN_KEY);
+    if (!value) {
+      value = mintToken(18);
+      ctx.store.setKv(SETUP_TOKEN_KEY, value);
+    }
+    return value;
+  }
+
+  async function setPassword(raw) {
+    if (typeof raw !== 'string' || raw.length < MIN_PASSWORD) {
+      throw new Error(`The password must be at least ${MIN_PASSWORD} characters.`);
+    }
+    ctx.store.setKv(OWNER_HASH_KEY, await hashPassword(raw));
+    ctx.store.deleteKv(SETUP_TOKEN_KEY);
+    ctx.store.deleteKv(RESET_TOKEN_KEY);
+    ctx.store.deleteKv(RESET_EXPIRY_KEY);
+    return true;
+  }
+
+  // `makerclay reset-password` on the box. The recovery path is physical access
+  // to the machine, which is the only authority this host recognises above the
+  // owner's own password.
+  function createResetToken() {
+    const value = mintToken(18);
+    ctx.store.setKv(RESET_TOKEN_KEY, value);
+    ctx.store.setKv(RESET_EXPIRY_KEY, String(ctx.clock.now() + RESET_TTL_MS));
+    return { token: value, expiresAt: ctx.clock.now() + RESET_TTL_MS };
+  }
+
+  function resetTokenValid(candidate) {
+    const stored = ctx.store.getKv(RESET_TOKEN_KEY);
+    const expires = Number(ctx.store.getKv(RESET_EXPIRY_KEY) || 0);
+    if (!stored || !expires || expires <= ctx.clock.now()) return false;
+    return timingSafeEquals(candidate, stored);
+  }
+
+  function wantsJson(req) {
+    return req.accepts(['html', 'json']) === 'json' || req.is('application/json');
+  }
+
+  function finish(req, res, redirect, body = {}) {
+    if (wantsJson(req)) return res.json({ ok: true, redirect, ...body });
+    return res.redirect(303, redirect);
+  }
+
+  const provider = {
+    name: 'password',
+
+    routes(app, hostCtx) {
+      ctx = hostCtx;
+      if (!ctx.store) {
+        throw new Error('ownerPassword() needs a store: there is nowhere to keep the owner hash.');
+      }
+
+      sessions = createSessions({
+        store: ctx.store,
+        clock: ctx.clock,
+        ids: ctx.ids,
+        secure: String(ctx.config.publicUrl || '').startsWith('https://'),
+        ttlMs: options.sessionTtlMs,
+      });
+      loginLimiter = createRateLimiter({ clock: ctx.clock, max: options.loginAttempts ?? 10, windowMs: 15 * 60 * 1000 });
+      setupToken();
+
+      const router = express.Router();
+      // Scoped to these four paths, never to `/_` as a whole. A provider mounts
+      // ahead of the host's own router, so an unscoped `router.use` here would
+      // put a 64kb body limit on every save and re-run the CSRF guard without
+      // the host's exemptions.
+      const OWN_PATHS = ['/setup', '/login', '/logout', '/reset'];
+      router.use(
+        OWN_PATHS,
+        express.json({ limit: '64kb' }),
+        express.urlencoded({ extended: false, limit: '64kb' }),
+        createCsrfGuard({ publicUrl: ctx.config.publicUrl || null }),
+      );
+
+      // ---- setup ---------------------------------------------------------
+
+      router.get('/setup', async (req, res) => {
+        if (claimed()) return res.redirect(303, '/_/login');
+        return ctx.ui.send(res, 'setup', {
+          title: 'Set up makerclay',
+          key: typeof req.query.key === 'string' ? req.query.key : '',
+          mode: 'setup',
+          action: '/_/setup',
+        });
+      });
+
+      router.post('/setup', async (req, res) => {
+        if (claimed()) return jsonError(res, 'forbidden', 'This server already has an owner.');
+        const limit = loginLimiter.check(req);
+        if (!limit.ok) return jsonError(res, 'rate-limited', 'Too many attempts. Wait a minute.');
+
+        const { key, password } = req.body || {};
+        if (!timingSafeEquals(key, ctx.store.getKv(SETUP_TOKEN_KEY))) {
+          return jsonError(res, 'unauthorized', 'That setup key is not right. It was printed in the terminal at startup.');
+        }
+        if (typeof password !== 'string' || password.length < MIN_PASSWORD) {
+          return jsonError(res, 'bad-request', `Choose a password of at least ${MIN_PASSWORD} characters.`);
+        }
+
+        await setPassword(password);
+        loginLimiter.forgive(req);
+        sessions.issue(res, 'owner');
+        ctx.logger.info?.('[makerclay] owner password set. Setup is closed.');
+        return finish(req, res, '/_/');
+      });
+
+      // ---- login ---------------------------------------------------------
+
+      router.get('/login', async (req, res) => {
+        if (!claimed()) return res.redirect(303, '/_/setup');
+        // A tenant is signed in but has no dashboard, and `/_/` would send them
+        // straight back here. Their own document is the only landing page they
+        // have, so send them there rather than around the loop.
+        //
+        // `req.actor`, never the raw session: a tenant who is not approved, or
+        // who was disabled, still holds a `tenant:` cookie that `identify`
+        // refuses. Trusting the cookie would send them to a page that refuses
+        // them too, and the sign-in page would be unreachable for a month.
+        if (req.actor?.kind === 'tenant') return res.redirect(303, '/_/tenant/home');
+        if (req.actor?.kind === 'owner') return res.redirect(303, '/_/');
+        return ctx.ui.send(res, 'login', { title: 'Sign in', action: '/_/login', error: '' });
+      });
+
+      router.post('/login', async (req, res) => {
+        if (!claimed()) return jsonError(res, 'forbidden', 'This server has no owner yet.');
+        const limit = loginLimiter.check(req);
+        if (!limit.ok) {
+          return jsonError(res, 'rate-limited', `Too many attempts. Try again in ${limit.retryAfter} seconds.`);
+        }
+        const ok = await verifyPassword(req.body?.password, ownerHash());
+        if (!ok) return jsonError(res, 'unauthorized', 'That password is not right.');
+
+        // A correct password must not spend from the attacker budget, or a
+        // person who mistypes twice locks themselves out of their own box.
+        loginLimiter.forgive(req);
+        sessions.issue(res, 'owner');
+        return finish(req, res, typeof req.body?.next === 'string' && req.body.next.startsWith('/') ? req.body.next : '/_/');
+      });
+
+      router.post('/logout', (req, res) => {
+        sessions.destroy(req, res);
+        return finish(req, res, '/_/login');
+      });
+
+      // ---- reset ---------------------------------------------------------
+
+      router.get('/reset', async (req, res) => {
+        return ctx.ui.send(res, 'setup', {
+          title: 'Choose a new password',
+          key: typeof req.query.key === 'string' ? req.query.key : '',
+          mode: 'reset',
+          action: '/_/reset',
+        });
+      });
+
+      router.post('/reset', async (req, res) => {
+        const limit = loginLimiter.check(req);
+        if (!limit.ok) return jsonError(res, 'rate-limited', 'Too many attempts. Wait a minute.');
+        if (!resetTokenValid(req.body?.key)) {
+          return jsonError(res, 'unauthorized', 'That reset link is not valid or has expired. Run `makerclay reset-password` again.');
+        }
+        const { password } = req.body || {};
+        if (typeof password !== 'string' || password.length < MIN_PASSWORD) {
+          return jsonError(res, 'bad-request', `Choose a password of at least ${MIN_PASSWORD} characters.`);
+        }
+
+        await setPassword(password);
+        // Every other device is signed out. Without this, "reset the password"
+        // does not evict whoever prompted the reset.
+        sessions.destroyAllFor('owner');
+        loginLimiter.forgive(req);
+        sessions.issue(res, 'owner');
+        return finish(req, res, '/_/');
+      });
+
+      app.use('/_', router);
+
+      // ---- the unclaimed-server gate --------------------------------------
+
+      app.use((req, res, next) => {
+        if (claimed() || OPEN_WHILE_UNCLAIMED.test(req.path)) return next();
+        if (req.method === 'GET' && !wantsJson(req)) return res.redirect(303, '/_/setup');
+        return jsonError(res, 'unauthorized', 'This server has not been set up yet. Open /_/setup.');
+      });
+    },
+
+    async identify(req) {
+      if (!sessions) return null;
+      const session = sessions.read(req);
+      if (!session) return null;
+      if (session.principal === 'owner') return { kind: 'owner' };
+      if (session.principal.startsWith('tenant:')) {
+        const username = session.principal.slice('tenant:'.length);
+        const tenant = ctx.store.getTenant(username);
+        if (!tenant || tenant.disabledAt || !tenant.approvedAt) return null;
+        return { kind: 'tenant', username };
+      }
+      return null;
+    },
+
+    decorate(req, res, actor) {
+      // clayjs 0.2.0 reads this client-readable cookie to decide whether the
+      // page is editable. A share or token grant gets edit mode from the
+      // injected savetoken instead, so this only ever speaks for the owner.
+      // [wire-compat]
+      const isOwner = actor?.kind === 'owner';
+      res.cookie('isAdminOfCurrentResource', isOwner ? 'true' : 'false', {
+        httpOnly: false, sameSite: 'lax', path: '/',
+      });
+      res.cookie('isLoggedIn', actor && actor.kind !== 'guest' ? 'true' : 'false', {
+        httpOnly: false, sameSite: 'lax', path: '/',
+      });
+    },
+
+    // Used by the CLI and by tenants (M5), which share the session table.
+    get sessions() { return sessions; },
+    claimed: () => claimed(),
+    setupToken,
+    setPassword,
+    createResetToken,
+  };
+
+  return provider;
+}

package/src/auth/passwords.js

@@ -0,0 +1,79 @@
+import crypto from 'node:crypto';
+import { promisify } from 'node:util';
+
+// Password hashing. scrypt from node:crypto, so there is no bcrypt, no native
+// build step, and nothing to compile when someone runs `npx makerclay` on a
+// machine without a toolchain.
+//
+// One format string holds the parameters, so raising the cost later does not
+// invalidate anyone's existing password: verify reads N/r/p from the stored
+// value, and only a re-hash on next login moves them up.
+
+const scrypt = promisify(crypto.scrypt);
+
+// Cost is a knob so the test suite can stop paying it. Production stays at the
+// OWASP-ish default; the suite runs thousands of hashes and only cares that the
+// format round-trips. Safe to vary because the parameters travel INSIDE the
+// stored hash: verifyPassword reads N/r/p back off the value it is checking, so
+// a password hashed at one cost still verifies after the cost changes.
+const N = Number(process.env.MAKERCLAY_SCRYPT_N) || 16384;
+const R = 8;
+const P = 1;
+const KEY_LEN = 64;
+const MAXMEM = 64 * 1024 * 1024;
+
+export async function hashPassword(password) {
+  if (typeof password !== 'string' || password.length === 0) {
+    throw new Error('a password is required');
+  }
+  const salt = crypto.randomBytes(16);
+  const key = await scrypt(password, salt, KEY_LEN, { N, r: R, p: P, maxmem: MAXMEM });
+  return ['scrypt', N, R, P, salt.toString('base64'), key.toString('base64')].join('$');
+}
+
+export async function verifyPassword(password, stored) {
+  if (typeof password !== 'string' || typeof stored !== 'string') return false;
+  const parts = stored.split('$');
+  if (parts.length !== 6 || parts[0] !== 'scrypt') return false;
+
+  const [, n, r, p, saltB64, keyB64] = parts;
+  let derived;
+  try {
+    const salt = Buffer.from(saltB64, 'base64');
+    const expected = Buffer.from(keyB64, 'base64');
+    derived = await scrypt(password, salt, expected.length, {
+      N: Number(n), r: Number(r), p: Number(p), maxmem: MAXMEM,
+    });
+    return derived.length === expected.length && crypto.timingSafeEqual(derived, expected);
+  } catch {
+    return false;
+  }
+}
+
+// Recovery codes are shown once and never again, because there is no email on
+// this server to send them to. Grouped in fives so they can be read aloud.
+//
+// Crockford base32 specifically: it omits I, L, O and U, and the three
+// confusable ones fold back onto characters that ARE in the alphabet (I and L
+// to 1, O to 0). An alphabet that merely omits 0 and 1 cannot do that, because
+// a person who typed `0` has no valid character to be corrected to.
+// 256 % 32 === 0, so the modulo below is unbiased.
+const RECOVERY_ALPHABET = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
+
+export function generateRecoveryCode(length = 20) {
+  const bytes = crypto.randomBytes(length);
+  let out = '';
+  for (let i = 0; i < length; i++) {
+    if (i > 0 && i % 5 === 0) out += '-';
+    out += RECOVERY_ALPHABET[bytes[i] % RECOVERY_ALPHABET.length];
+  }
+  return out;
+}
+
+export function normalizeRecoveryCode(value) {
+  return String(value || '')
+    .toUpperCase()
+    .replace(/[^0-9A-Z]/g, '')
+    .replace(/[IL]/g, '1')
+    .replace(/O/g, '0');
+}

package/src/auth/rate-limit.js

@@ -0,0 +1,66 @@
+// A sliding-window limiter, in memory, per host.
+//
+// In-memory is the correct scope here and not a shortcut: makerclay is a single
+// writer process by invariant 10, so there is no second node whose counters
+// would need sharing. It exists to make guessing an owner password or spraying
+// signups expensive, not to survive a restart.
+
+const DEFAULT_SWEEP_MS = 60_000;
+
+export function parseRate(spec, fallback = { max: 30, windowMs: 60_000 }) {
+  if (typeof spec === 'number') return { max: spec, windowMs: fallback.windowMs };
+  const match = /^(\d+)\s*\/\s*(\d*)\s*(ms|s|sec|m|min|h|hour)$/i.exec(String(spec || '').trim());
+  if (!match) return fallback;
+  const unit = { ms: 1, s: 1000, sec: 1000, m: 60_000, min: 60_000, h: 3_600_000, hour: 3_600_000 }[match[3].toLowerCase()];
+  return { max: Number(match[1]), windowMs: (Number(match[2]) || 1) * unit };
+}
+
+function clientKey(req) {
+  // req.ip already honors trust proxy when the embedder sets it; the raw socket
+  // address is the fallback so a misconfigured proxy fails closed to per-socket
+  // limiting rather than to one shared bucket for the whole internet.
+  return req.ip || req.socket?.remoteAddress || 'unknown';
+}
+
+export function createRateLimiter({ clock = Date, max = 30, windowMs = 60_000, key = clientKey } = {}) {
+  const hits = new Map();
+  let lastSweep = 0;
+
+  function sweep(now) {
+    if (now - lastSweep < DEFAULT_SWEEP_MS) return;
+    lastSweep = now;
+    for (const [id, stamps] of hits) {
+      const live = stamps.filter((stamp) => now - stamp < windowMs);
+      if (live.length) hits.set(id, live);
+      else hits.delete(id);
+    }
+  }
+
+  function check(req) {
+    const now = clock.now ? clock.now() : Date.now();
+    sweep(now);
+    const id = key(req);
+    const stamps = (hits.get(id) || []).filter((stamp) => now - stamp < windowMs);
+    if (stamps.length >= max) {
+      hits.set(id, stamps);
+      return { ok: false, retryAfter: Math.ceil((windowMs - (now - stamps[0])) / 1000) };
+    }
+    stamps.push(now);
+    hits.set(id, stamps);
+    return { ok: true, remaining: max - stamps.length };
+  }
+
+  // Undo one hit, so a SUCCESSFUL login does not spend from the attacker budget.
+  // Without this, a busy legitimate user locks themselves out.
+  function forgive(req) {
+    const id = key(req);
+    const stamps = hits.get(id);
+    if (stamps?.length) stamps.pop();
+  }
+
+  function reset() {
+    hits.clear();
+  }
+
+  return { check, forgive, reset, size: () => hits.size };
+}

package/src/auth/sessions.js

@@ -0,0 +1,86 @@
+import crypto from 'node:crypto';
+import { token as mintToken } from '../util/id.js';
+
+// Sessions, stored as hashes.
+//
+// The cookie holds the only copy of the raw token. The `sessions` table holds
+// sha256 of it, so a stolen database read (a backup on a laptop, a support
+// bundle, the delete-the-db test's own tarball) does not hand anyone a live
+// login. sha256 rather than scrypt is right here and wrong for passwords: the
+// input is 192 bits of our own randomness, so there is nothing to brute-force,
+// and this runs on every single request.
+
+const SESSION_COOKIE = 'mk_session';
+const DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+const TOUCH_AFTER_MS = 60 * 60 * 1000;
+
+function hashSessionToken(raw) {
+  return crypto.createHash('sha256').update(String(raw)).digest('hex');
+}
+
+export function createSessions({
+  store, clock, ids = { token: mintToken }, ttlMs = DEFAULT_TTL_MS,
+  cookieName = SESSION_COOKIE, secure = false,
+}) {
+  function cookieOptions(maxAgeMs) {
+    return {
+      httpOnly: true,
+      sameSite: 'lax',
+      secure,
+      path: '/',
+      maxAge: Math.round(maxAgeMs / 1000),
+    };
+  }
+
+  function issue(res, principal) {
+    if (!store) return null;
+    const raw = ids.token(24);
+    const now = clock.now();
+    store.insertSession({
+      tokenHash: hashSessionToken(raw),
+      principal,
+      createdAt: now,
+      expiresAt: now + ttlMs,
+    });
+    res.cookie(cookieName, raw, cookieOptions(ttlMs));
+    return raw;
+  }
+
+  function read(req) {
+    if (!store) return null;
+    const raw = req.cookies?.[cookieName];
+    if (!raw) return null;
+    const tokenHash = hashSessionToken(raw);
+    const session = store.getSession(tokenHash);
+    if (!session) return null;
+    const now = clock.now();
+    if (session.expiresAt <= now) {
+      store.deleteSession(tokenHash);
+      return null;
+    }
+    // One write an hour instead of one per request: last_seen is for the
+    // sessions list, not for accounting.
+    if (!session.lastSeenAt || now - session.lastSeenAt > TOUCH_AFTER_MS) {
+      store.touchSession(tokenHash, now);
+    }
+    return session;
+  }
+
+  function destroy(req, res) {
+    const raw = req.cookies?.[cookieName];
+    if (raw && store) store.deleteSession(hashSessionToken(raw));
+    res.clearCookie(cookieName, { path: '/' });
+  }
+
+  // Used by a password reset: every other device is logged out, which is the
+  // only thing that makes "reset the password" mean anything.
+  function destroyAllFor(principal) {
+    return store ? store.deleteSessionsFor(principal) : 0;
+  }
+
+  function purgeExpired() {
+    return store ? store.purgeExpiredSessions(clock.now()) : 0;
+  }
+
+  return { issue, read, destroy, destroyAllFor, purgeExpired, cookieName };
+}

package/src/auth/token-lanes.js

@@ -0,0 +1,72 @@
+import { createCsrfGuard } from './csrf.js';
+
+// The token lanes, and the two gates that both have to know about them.
+//
+// A lane whose credential is a save token in the URL is addressed by a sandboxed
+// document, which has an opaque origin. That single fact has two consequences,
+// and a lane that gets one of them and not the other is broken in a way that
+// shows up as a browser-side CORS failure with a completely healthy server log:
+//
+//   1. §8's origin gate must let it through, because it has no origin to check.
+//   2. It must answer `Access-Control-Allow-Origin: null`, or the response the
+//      host sent lands in a browser that will not let the document read it.
+//
+// One list, read by both, in one file, so adding a lane cannot satisfy half of
+// that. `/sync` was the case that proved it: it was in the origin gate and not
+// in the CORS headers, so a sandboxed document could save but never sync, which
+// is the state this host shipped in until 2026-08-28.
+
+const TOKEN_LANES = [
+  '/save/:token', '/meta/:token', '/versions/:token',
+  '/version/:token/:name', '/restore/:token/:name',
+  '/upload/:token',
+];
+
+// The sync lane's credential is the same per-document save token, but it arrives
+// as `?token=` rather than in the path, because §10 gives send and receive one
+// address and a GET carries no body.
+const TOKEN_QUERY_LANES = ['/sync', '/live-sync/save', '/live-sync/stream'];
+
+const TOKEN_LANE_PATTERN = new RegExp(
+  `^(?:${TOKEN_LANES.map((lane) => lane.replace(/:[A-Za-z]+/g, '[^/]+')).join('|')})$`,
+);
+const TOKEN_QUERY_LANE_PATTERN = new RegExp(`^(?:${TOKEN_QUERY_LANES.join('|')})$`);
+
+// X-Hyperclay-User-Driven is clayjs 0.2.0's spelling of Save-Trigger, and
+// spec/wire.js already reads it. Leaving it out of the preflight is enough on
+// its own to make every sandboxed save fail before it is sent. [wire-compat]
+const CORS_HEADERS = 'Content-Type, Document-URL, Page-URL, If-Match, Save-Trigger, '
+  + 'X-Sender-Id, X-Hyperclay-User-Driven, Accept';
+
+export function mountTokenLanes({ system, config }) {
+  // Spec §8 lives on the host's own prefix, which is where every state-changing
+  // route is. The collection submit lane is exempt because a form on the owner's
+  // blog posting into their makerclay is a feature (§15).
+  system.use(createCsrfGuard({
+    tokenLanes: TOKEN_LANE_PATTERN,
+    queryTokenLanes: TOKEN_QUERY_LANE_PATTERN,
+
+    // The submit lane only. Update, delete and restore stay behind the origin
+    // check, because they answer to the owner's cookie and the exemption exists
+    // for a stranger's form, not for a stranger's page acting as the owner.
+    exempt: [/^\/collection\/[^/]+\/records$/],
+    publicUrl: config.publicUrl || null,
+  }));
+
+  // §16.3. `null` rather than `*`: the token in the path is the entire
+  // credential, and a page with a real origin has no business reading one. Never
+  // Allow-Credentials, because `Origin: null` is forgeable and must never buy
+  // ambient authority.
+  system.use([...TOKEN_LANES, ...TOKEN_QUERY_LANES], (req, res, next) => {
+    res.setHeader('Access-Control-Allow-Origin', 'null');
+    res.setHeader('Vary', 'Origin');
+    next();
+  });
+
+  system.options([...TOKEN_LANES, ...TOKEN_QUERY_LANES], (req, res) => {
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', CORS_HEADERS);
+    res.setHeader('Access-Control-Max-Age', '600');
+    res.status(204).end();
+  });
+}