@fabrika/proxy-core 0.5.2 → 0.5.3

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/proxy-core",
-	"version": "0.5.2",
+	"version": "0.5.3",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -37,9 +37,9 @@
 	},
 	"dependencies": {
 		"zod": "^3.25.76",
-		"@fabrika/auth-core": "0.5.2",
-		"@fabrika/jwks": "0.5.2",
+		"@fabrika/auth-core": "0.5.3",
+		"@fabrika/jwks": "0.5.3",
 		"jose": "^5.9.0",
-		"@fabrika/platform": "0.5.2"
+		"@fabrika/platform": "0.5.3"
 	}
 }

package/src/authorize.ts

@@ -2,7 +2,8 @@
  * The proxy authorization core ([ADR-0022](../../../docs/decisions/0022-the-proxy-is-the-only-enforcement-point.md)).
  *
  * Every entry — a contract application or an installation service — is protected by its endpoint table, in one pass
- * over ONE selected endpoint: `planEndpoint` → a `px_` key whose caller kind the endpoint admits, or else the session
+ * over ONE selected endpoint. A contract application's preflight is decided first, from the endpoint the requested
+ * method selects, and never reaches a credential. Then: `planEndpoint` → a `px_` key whose caller kind the endpoint admits, or else the session
  * when `human` may call → the requirement (`satisfies`) → admission → the delegation grant. There is no fall-through
  * to another endpoint. On an installation row that admits `oauth`, a bearer that is not a `px_` key is an OAuth
  * resource token, verified locally. A key or a session is exchanged with IAM once, cached, and thereafter verified
@@ -37,7 +38,14 @@ import { LOGIN_REDIRECT_PARAM } from './constants'
 import { readBearer, readCookie } from './credentials'
 import { createHandoffAttempt, type HandoffAttempt, handoffCookieName, setHandoffParams } from './handoff'
 import { type DelegationIssuer, type IamGateway, IamUnavailableError } from './iam'
-import { type ManifestEndpointRow, type OAuthBearerChallenge, type OAuthProtectedResource, oauthResourceOfRow, type ProxyApp } from './manifest'
+import {
+	isApplicationEntry,
+	type ManifestEndpointRow,
+	type OAuthBearerChallenge,
+	type OAuthProtectedResource,
+	oauthResourceOfRow,
+	type ProxyApp,
+} from './manifest'
 import { TokenVerifier } from './verifier'
 
 /** Every way a request can be refused. Coarse on purpose — these are logged, not returned to clients. */
@@ -69,6 +77,8 @@ export type DenyReason =
 	| 'cross_site'
 	/** The request's `Content-Type` is not one the endpoint admits. */
 	| 'content_type'
+	/** A preflight for an endpoint the contract does not open to another origin, or from an origin it does not admit. */
+	| 'cross_origin'
 	/** IAM refused the delegation grant a membership or scope-creating endpoint needs. */
 	| 'delegation_refused'
 	/** The `Host` maps to no app in the manifest. */
@@ -93,6 +103,8 @@ export type Decision =
 		endpoint: string
 		/** The single-use delegation grant for `X-Fabrika-Delegation`, when the endpoint spends one. */
 		delegation: string | null
+		/** The `Access-Control-Allow-Origin` the answer carries: the request's admitted origin, `*`, or none. */
+		crossOrigin: string | null
 	}
 	| {
 		outcome: 'deny'
@@ -101,7 +113,14 @@ export type Decision =
 		clearHandoffState?: string
 		/** Set on an `oauth` row's 401/403: rendered as the RFC 6750 `WWW-Authenticate` challenge. */
 		challenge?: OAuthBearerChallenge
+		/** Set when the request's origin is admitted, so the page can read why it was refused. */
+		crossOrigin?: string
 	}
+	/**
+	 * A contract application's preflight that the selected endpoint admits (ADR-0022 "Cross-origin endpoints"). The
+	 * proxy answers it itself; it never reaches the application. `method` is the endpoint's.
+	 */
+	| { outcome: 'preflight'; allowOrigin: string; method: string }
 	/**
 	 * A human reached an endpoint `human` may call without a usable session. `location` is where they must go to sign
 	 * in; `status` is only how they are TOLD — 302 for a document navigation, 401 for anything else,
@@ -159,6 +178,12 @@ const FETCH_MODE_HEADER = 'Sec-Fetch-Mode'
 /** Fetch metadata the browser writes and page script cannot: `same-origin` only for a request from this origin. */
 const FETCH_SITE_HEADER = 'Sec-Fetch-Site'
 
+/** The origin a browser names on every CORS request; page script cannot set it. */
+const ORIGIN_HEADER = 'Origin'
+
+/** What makes an `OPTIONS` request a preflight: the method the page wants to send. */
+const PREFLIGHT_METHOD_HEADER = 'Access-Control-Request-Method'
+
 /** Why a session attempt failed — mirrors `mintToken`'s reasons. */
 type SessionFailureReason = 'no_session' | 'invalid_session' | 'unknown_principal' | 'disabled'
 
@@ -230,6 +255,10 @@ export class Authorizer {
 		table: CompiledEndpointTable<ManifestEndpointRow>,
 		request: ForwardedRequest,
 	): Promise<Decision> {
+		const preflight = this.decidePreflight(table, app, request)
+		if (preflight !== null) {
+			return preflight
+		}
 		const plan = planEndpoint(table, request.method, request.rawPath)
 		if (plan.outcome === 'non-canonical') {
 			return { outcome: 'deny', status: 400, reason: 'non_canonical_path' }
@@ -238,9 +267,41 @@ export class Authorizer {
 			return { outcome: 'deny', status: 403, reason: 'no_endpoint' }
 		}
 		const row = plan.endpoint
+		const origin = request.headers.get(ORIGIN_HEADER)
+		const crossOrigin = origin === null ? null : admittedOrigin(app, row, origin)
+		const decision = await this.decideRow(app, row, request, crossOrigin)
+		return crossOrigin === null || decision.outcome !== 'deny' ? decision : { ...decision, crossOrigin }
+	}
+
+	/**
+	 * A preflight is decided from the endpoint the REQUESTED method selects, before any credential: it carries none
+	 * (ADR-0022 "Cross-origin endpoints"). Only a contract application's: an installation row of method `*` serves
+	 * `OPTIONS` itself.
+	 */
+	private decidePreflight(table: CompiledEndpointTable<ManifestEndpointRow>, app: ProxyApp, request: ForwardedRequest): Decision | null {
+		const origin = request.headers.get(ORIGIN_HEADER)
+		const method = request.headers.get(PREFLIGHT_METHOD_HEADER)
+		if (!isApplicationEntry(app) || request.method !== 'OPTIONS' || origin === null || method === null) {
+			return null
+		}
+		const plan = planEndpoint(table, method, request.rawPath)
+		if (plan.outcome === 'non-canonical') {
+			return { outcome: 'deny', status: 400, reason: 'non_canonical_path' }
+		}
+		if (plan.outcome === 'no-endpoint') {
+			return { outcome: 'deny', status: 403, reason: 'no_endpoint' }
+		}
+		const allowOrigin = admittedOrigin(app, plan.endpoint, origin)
+		return allowOrigin === null
+			? { outcome: 'deny', status: 403, reason: 'cross_origin' }
+			: { outcome: 'preflight', allowOrigin, method: plan.endpoint.method }
+	}
+
+	/** The selected row's checks. `crossOrigin` is the admitted origin of a cross-origin request, `*` or none. */
+	private async decideRow(app: ProxyApp, row: ManifestEndpointRow, request: ForwardedRequest, crossOrigin: string | null): Promise<Decision> {
 		const endpoint = formatEndpointHeader(row.id, row.digest)
 		if (row.requirement === null) {
-			return admitBody(row, request.headers) ?? { outcome: 'allow', token: null, subject: null, endpoint, delegation: null }
+			return admitBody(row, request.headers) ?? { outcome: 'allow', token: null, subject: null, endpoint, delegation: null, crossOrigin }
 		}
 		const oauth = oauthBindingOf(app, row)
 		if (oauth === 'unregistered') {
@@ -248,7 +309,8 @@ export class Authorizer {
 			return { outcome: 'deny', status: 403, reason: 'internal_error' }
 		}
 		const callers: readonly TokenCaller[] = row.callers
-		const caller = await this.endpointCaller(app, oauth, callers, request)
+		// A listed origin's request is never session-authenticated: a session does not cross origins.
+		const caller = await this.endpointCaller(app, oauth, callers, request, crossOrigin !== null)
 		if (!caller.ok) {
 			return caller.decision
 		}
@@ -276,6 +338,7 @@ export class Authorizer {
 			subject: caller.claims.sub,
 			endpoint,
 			delegation: delegation?.grant ?? null,
+			crossOrigin,
 		}
 	}
 
@@ -288,6 +351,7 @@ export class Authorizer {
 		oauth: OAuthBinding | null,
 		callers: readonly TokenCaller[],
 		request: ForwardedRequest,
+		crossOrigin: boolean,
 	): Promise<EndpointCaller> {
 		const authorization = request.headers.get('Authorization')
 		if (authorization !== null && authorization.trim() !== '') {
@@ -301,8 +365,9 @@ export class Authorizer {
 				? { ok: true, token: key.token, claims: key.claims, session: false }
 				: { ok: false, decision: withBearerChallenge(key.denial, oauth) }
 		}
-		if (!callers.includes('human')) {
-			// No session reaches an endpoint a person may not call, so there is nothing to sign in to.
+		if (!callers.includes('human') || crossOrigin) {
+			// No session reaches an endpoint a person may not call, nor one called from another origin, so there is
+			// nothing to sign in to.
 			const denial: Denial = { outcome: 'deny', status: 401, reason: 'no_credential' }
 			return { ok: false, decision: oauth === null ? denial : { ...denial, challenge: { resource_metadata: oauth.resource.resourceMetadata } } }
 		}
@@ -549,6 +614,19 @@ export class Authorizer {
 	}
 }
 
+/**
+ * The `Access-Control-Allow-Origin` a request from `origin` gets on `row`: `*` on a row open to any origin, the origin
+ * itself when the row takes the environment's list and the entry lists it, and `null` otherwise. An installation row
+ * has no cross-origin form.
+ */
+function admittedOrigin(app: ProxyApp, row: ManifestEndpointRow, origin: string): string | null {
+	const form = 'crossOrigin' in row ? row.crossOrigin : undefined
+	if (form === 'any') {
+		return '*'
+	}
+	return form === 'environment' && isApplicationEntry(app) && (app.crossOrigins ?? []).includes(origin) ? origin : null
+}
+
 function invalidKey(): Denial {
 	return { outcome: 'deny', status: 401, reason: 'invalid_key' }
 }

package/src/constants.ts

@@ -21,6 +21,12 @@ export const REQUEST_ID_HEADER = 'X-Request-Id'
 
 /** The auth service's decision endpoint (Caddy's `uri` subdirective). */
 export const DEFAULT_VERIFY_PATH = '/verify'
+/**
+ * Set on the auth service's 2xx to a preflight it admitted (ADR-0022 "Cross-origin endpoints"). The answer is the
+ * preflight's whole answer: the composition returns it to the browser, without the marker, and never dials the app.
+ */
+export const PREFLIGHT_HEADER = 'X-Fabrika-Preflight'
+
 /** Liveness endpoint on the auth service itself — never routed publicly. */
 export const DEFAULT_HEALTH_PATH = '/healthz'
 /**

package/src/headers.ts

@@ -175,7 +175,62 @@ export function appFileTreatment(app: { readonly scheme: PublicScheme }): Header
  * Headers an application may not send at all: each names a reporting endpoint the policy never approved, and a
  * report-only CSP reports there whatever the enforced one says (`document-uri`, `blocked-uri`).
  */
-export const REMOVED_RESPONSE_HEADERS: readonly string[] = ['Content-Security-Policy-Report-Only', 'Report-To', 'Reporting-Endpoints', 'NEL']
+export const REMOVED_RESPONSE_HEADERS: readonly string[] = [
+	'Content-Security-Policy-Report-Only',
+	'Report-To',
+	'Reporting-Endpoints',
+	'NEL',
+	// Only the proxy opens an endpoint to another origin (ADR-0022 "Cross-origin endpoints"); a handler's own never passes.
+	'Access-Control-Allow-Origin',
+	'Access-Control-Allow-Credentials',
+	'Access-Control-Allow-Methods',
+	'Access-Control-Allow-Headers',
+	'Access-Control-Expose-Headers',
+	'Access-Control-Max-Age',
+]
+
+/** The most origins one environment may list for its cross-origin endpoints: Control and the manifest parser refuse more. */
+export const MAX_CROSS_ORIGINS = 16
+
+/**
+ * An origin an environment may list for its cross-origin endpoints: exact, a literal host, `https:` (or `http:`, which
+ * only a local host is served over). `null`, an opaque origin, never matches.
+ */
+export function isCrossOrigin(value: string): boolean {
+	return isPolicyOrigin(value, ['https:', 'http:'])
+}
+
+/** What a cross-origin page may send beside the safelisted headers: the key, and the JSON body's type. */
+export const CROSS_ORIGIN_REQUEST_HEADERS = 'Authorization, Content-Type'
+
+/** How long a browser may reuse an answered preflight, in seconds. */
+export const CROSS_ORIGIN_MAX_AGE = '600'
+
+/**
+ * The headers an answer to an admitted cross-origin request carries: the admitted origin, and `Vary: Origin` unless every
+ * origin is admitted. Never `Access-Control-Allow-Credentials`: a session does not cross origins.
+ */
+export function crossOriginHeaders(allowOrigin: string): HeaderPolicy {
+	return allowOrigin === '*' ? [['Access-Control-Allow-Origin', '*']] : [['Access-Control-Allow-Origin', allowOrigin], ['Vary', 'Origin']]
+}
+
+/** A preflight's answer on top of `crossOriginHeaders`: the endpoint's one method, the two headers, the cache lifetime. */
+export function preflightHeaders(allowOrigin: string, method: string): HeaderPolicy {
+	return [
+		...crossOriginHeaders(allowOrigin),
+		['Access-Control-Allow-Methods', method],
+		['Access-Control-Allow-Headers', CROSS_ORIGIN_REQUEST_HEADERS],
+		['Access-Control-Max-Age', CROSS_ORIGIN_MAX_AGE],
+	]
+}
+
+/** `crossOriginHeaders` over headers that already carry the answer's own policy; `Vary` is added to, never replaced. */
+export function applyCrossOriginHeaders(headers: Headers, policy: HeaderPolicy): void {
+	for (const [name, value] of policy) {
+		if (name === 'Vary') headers.append(name, value)
+		else headers.set(name, value)
+	}
+}
 
 /** `null` and anything but one allowlisted value is an attachment; `Headers` joins repeated fields with `, `, so two never match. */
 export function fileDisposition(contentType: string | null): 'inline' | 'attachment' {

package/src/index.ts

@@ -28,6 +28,7 @@ export {
 	FORWARDED_URI_HEADER,
 	JWKS_TTL_SECONDS,
 	LOGIN_REDIRECT_PARAM,
+	PREFLIGHT_HEADER,
 	PROXY_TOKEN_HEADER,
 	REQUEST_ID_HEADER,
 	UNTRUSTED_FORWARD_HEADERS,

package/src/manifest.ts

@@ -1,10 +1,13 @@
 import {
+	ANY_ORIGIN_KINDS,
 	APP_ENVIRONMENT_SEPARATOR,
 	type Caller,
 	compileEndpointTable,
 	type ContractArtifact,
 	contractDigest,
 	type CredentialedEndpoint,
+	CROSS_ORIGIN_KINDS,
+	type CrossOriginForm,
 	type EndpointDelegation,
 	endpointDelegation,
 	type EndpointRow,
@@ -16,7 +19,7 @@ import {
 	requirementDigest,
 } from '@fabrika/auth-core'
 import { z } from 'zod'
-import { type CspOrigins, cspOrigins, isPolicyOrigin, MAX_CSP_ORIGINS } from './headers'
+import { type CspOrigins, cspOrigins, isCrossOrigin, isPolicyOrigin, MAX_CROSS_ORIGINS, MAX_CSP_ORIGINS } from './headers'
 import { type OAuthProtectedResource, oauthProtectedResourceSchema, oauthScopesSchema } from './oauth-resource'
 
 export * from './oauth-resource'
@@ -46,6 +49,11 @@ export interface ContractProxyApp extends ProxyAppBase {
 	csp: CspOrigins
 	/** The installation's Operations ingest origin, admitted by `connect-src`; absent when the producer knows none. */
 	operationsOrigin?: string
+	/**
+	 * The origins the environment lists for its `crossOrigin: 'environment'` endpoints (ADR-0022 "Cross-origin
+	 * endpoints"), from Control's registry, never from the contract; absent when it lists none.
+	 */
+	crossOrigins?: string[]
 }
 
 /**
@@ -84,11 +92,14 @@ interface ProxyEndpointExtras {
 
 /** An endpoint row as the proxy applies it: the rules without the schemas, plus the digest and the delegation. */
 export type ProxyEndpointRow =
-	| (Pick<CredentialedEndpoint, 'id' | 'kind' | 'method' | 'path' | 'callers' | 'requirement' | 'admission'> & ProxyEndpointExtras)
-	| (Pick<Extract<EndpointRow, { requirement: null }>, 'id' | 'kind' | 'method' | 'path' | 'callers' | 'requirement' | 'admission'> & {
-		digest: string
-		delegation: null
-	})
+	| (Pick<CredentialedEndpoint, 'id' | 'kind' | 'method' | 'path' | 'callers' | 'requirement' | 'admission' | 'crossOrigin'> & ProxyEndpointExtras)
+	| (
+		& Pick<Extract<EndpointRow, { requirement: null }>, 'id' | 'kind' | 'method' | 'path' | 'callers' | 'requirement' | 'admission' | 'crossOrigin'>
+		& {
+			digest: string
+			delegation: null
+		}
+	)
 
 /** An installation row as the proxy applies it: the row with its digest and no delegation. */
 export type InstallationProxyEndpointRow = InstallationEndpointRow & { digest: string; delegation: null }
@@ -168,6 +179,7 @@ export const proxyEndpointRowSchema = z.union([
 		callers: z.array(callerSchema).nonempty(),
 		requirement: requirementSchema,
 		delegation: z.enum(['members', 'creates']).nullable(),
+		crossOrigin: z.literal('environment').optional(),
 	}).strict(),
 	z.object({
 		...endpointRuleFields,
@@ -175,6 +187,7 @@ export const proxyEndpointRowSchema = z.union([
 		callers: z.tuple([]),
 		requirement: z.null(),
 		delegation: z.null(),
+		crossOrigin: z.enum(['environment', 'any']).optional(),
 	}).strict(),
 	// A public SPA is a fixed static row: it serves GET only and admits no body.
 	z.object({
@@ -186,12 +199,32 @@ export const proxyEndpointRowSchema = z.union([
 		requirement: z.null(),
 		delegation: z.null(),
 	}).strict(),
-]).refine((row) => row.digest === requirementDigest(row), 'endpoint digest does not match its rules') satisfies z.ZodType<
+]).refine(
+	(row) => crossOriginAllowed(row.kind, 'crossOrigin' in row ? row.crossOrigin : undefined),
+	'this endpoint kind cannot be called cross-origin',
+).refine(
+	(row) => row.digest === requirementDigest(row),
+	'endpoint digest does not match its rules',
+) satisfies z.ZodType<
 	ProxyEndpointRow,
 	z.ZodTypeDef,
 	unknown
 >
 
+/** Only an RPC procedure and a form open to another origin, and only a form to any origin (ADR-0022). */
+function crossOriginAllowed(kind: ProxyEndpointRow['kind'], form: CrossOriginForm | undefined): boolean {
+	return form === undefined || (CROSS_ORIGIN_KINDS.includes(kind) && (form !== 'any' || ANY_ORIGIN_KINDS.includes(kind)))
+}
+
+/** Exact origins, each once, never one of the entry's own hosts: its own pages are not cross-origin. */
+function checkCrossOrigins(app: Pick<ContractProxyApp, 'hosts' | 'crossOrigins'>, ctx: z.RefinementCtx): void {
+	const origins = app.crossOrigins ?? []
+	// A refinement runs over an origin its element check already refused, so the host is read without throwing.
+	if (new Set(origins).size !== origins.length || origins.some((origin) => !isCrossOrigin(origin) || app.hosts.includes(new URL(origin).hostname))) {
+		ctx.addIssue({ code: 'custom', message: 'invalid cross-origin list' })
+	}
+}
+
 const cspOriginSchema = z.string().refine((value) => isPolicyOrigin(value))
 const cspDirectiveSchema = z.array(cspOriginSchema).max(MAX_CSP_ORIGINS)
 const cspOriginsSchema = z.object({
@@ -214,7 +247,9 @@ export const contractProxyAppSchema = z.object({
 	snapshot: z.string().refine(isDigest),
 	csp: cspOriginsSchema,
 	operationsOrigin: z.string().refine((value) => isPolicyOrigin(value, ['https:', 'http:'])).optional(),
+	crossOrigins: z.array(z.string().refine(isCrossOrigin)).nonempty().max(MAX_CROSS_ORIGINS).optional(),
 }).strict().superRefine((app, ctx) => {
+	checkCrossOrigins(app, ctx)
 	checkEndpointTable(app, ctx)
 }) satisfies z.ZodType<ContractProxyApp, z.ZodTypeDef, unknown>
 
@@ -308,7 +343,13 @@ export const proxyAppSchema = z.union([contractProxyAppSchema, installationProxy
 export function contractProxyTable(artifact: ContractArtifact): ContractProxyTable {
 	return {
 		endpoints: artifact.endpoints.map((row): ProxyEndpointRow => {
-			const rules = { id: row.id, method: row.method, path: row.path, admission: row.admission }
+			const rules = {
+				id: row.id,
+				method: row.method,
+				path: row.path,
+				admission: row.admission,
+				...(row.crossOrigin === undefined ? {} : { crossOrigin: row.crossOrigin }),
+			}
 			if (row.requirement === null) {
 				const anonymous = { ...rules, kind: row.kind, callers: row.callers, requirement: null, delegation: null }
 				return { ...anonymous, digest: requirementDigest(anonymous) }

package/src/service.ts

@@ -43,6 +43,7 @@ import {
 	FORWARDED_METHOD_HEADER,
 	FORWARDED_PROTO_HEADER,
 	FORWARDED_URI_HEADER,
+	PREFLIGHT_HEADER,
 	PROXY_TOKEN_HEADER,
 	REQUEST_ID_HEADER,
 } from './constants'
@@ -50,10 +51,13 @@ import { type HandoffAttempt, handoffCookieName } from './handoff'
 import {
 	appFileTreatment,
 	appHeaderPolicy,
+	applyCrossOriginHeaders,
 	applyFileTreatment,
 	applyHeaderPolicy,
 	BASE_HEADER_POLICY,
+	crossOriginHeaders,
 	type HeaderPolicy,
+	preflightHeaders,
 	transportPolicy,
 } from './headers'
 import type { DelegationIssuer, IamGateway } from './iam'
@@ -179,12 +183,26 @@ export function createVerifyService(config: VerifyServiceConfig): VerifyService
 				if (decision.delegation !== null) {
 					headers.set(DELEGATION_HEADER, decision.delegation)
 				}
+				// The composition writes it onto the application's answer, after the policy deleted the application's own.
+				if (decision.crossOrigin !== null) {
+					applyCrossOriginHeaders(headers, crossOriginHeaders(decision.crossOrigin))
+				}
 				return new Response(null, { status: 204, headers })
 			}
+			const policy = policies.get(resolved.app.id) ?? BASE_HEADER_POLICY
+			if (decision.outcome === 'preflight') {
+				logger.info('preflight', fields)
+				// A 2xx the composition answers as-is, so the preflight never reaches the application.
+				const answer = withPolicy(new Response(null, { status: 204, headers: { 'cache-control': 'no-store', [PREFLIGHT_HEADER]: '1' } }), policy)
+				applyCrossOriginHeaders(answer.headers, preflightHeaders(decision.allowOrigin, decision.method))
+				return answer
+			}
 			const answer = decision.outcome === 'handoff' ? handoff(logger, fields, decision) : denied(logger, fields, decision, isCallback)
-			return isDownload(resolved, forwarded)
-				? withFileTreatment(answer, appFileTreatment(resolved.app))
-				: withPolicy(answer, policies.get(resolved.app.id) ?? BASE_HEADER_POLICY)
+			const treated = isDownload(resolved, forwarded) ? withFileTreatment(answer, appFileTreatment(resolved.app)) : withPolicy(answer, policy)
+			if (decision.outcome === 'deny' && decision.crossOrigin !== undefined) {
+				applyCrossOriginHeaders(treated.headers, crossOriginHeaders(decision.crossOrigin))
+			}
+			return treated
 		} catch {
 			// The last line of the fail-closed guarantee. No `err` is inspected or logged: a caught
 			// error can stringify a URL, a header or a body, any of which may carry a credential.