Three additions on top of last commit's security headers + banner.
Countdown auto-redirect (path form banner):
Visible "Moving in <N> s" between the message and the Isolated-view
button, default 10 s, counts down once per second and location.replace
to the subdomain form on expiry. The whole thing stops instantly on:
- any click / keydown / wheel / touchstart / scroll / pointerdown
(we don't yank a page out from under someone who's reading it),
- "Stay here" button (persists for the tab via sessionStorage),
- "✕" dismiss (persists for 24 h via localStorage dismissed_at).
First-time visitors drift to the isolated origin; return visitors
who've once said Stay are left alone for the rest of the session.
Persistent trust chip (both forms):
Bottom-right pill reading "📡 <name> · via navigate.st", with
backdrop blur so it reads over any page. Click opens a 280 px pop
that explains the trust context: on the PATH form it adds an
Isolated-view button; on the SUBDOMAIN form it reads
"Each name has its own origin here. Scripts can't reach other BCDN
sites." Essential on mobile where URL bars hide the subdomain
structure — the user can still see which BCDN name they are on and
that it is being relayed through navigate.st. Click-away collapses.
ACAO lockdown on HTML:
res.removeHeader("access-control-allow-origin") before every HTML
writeHead so relayed PAGES are no longer readable cross-origin.
Static assets (fonts, images, JSON) keep the broad ACAO because
embedding those from BCDN names on other origins is a legit use
case; HTML being readable cross-origin was a surveillance surface
(any site could fetch BCDN pages and inspect their rendered content)
with no legit case the subdomain form doesn't already cover.
53fd569b0d