@specific.dev/spectest 0.98.0 → 0.99.0

package/README.md

@@ -128,3 +128,35 @@ routes each stream by `:authority`, and preserves streaming bodies, metadata,
 trailers, and cancellation. HTTP/1.1 requests still use the existing HTTP proxy.
 Runtime services support the same option. HTTP/2 streams currently bypass
 `ctx.intercept` and HTTP request recording.
+
+### CORS at ingress
+
+Fake and service ingress default to `cors: "passthrough"`: OPTIONS requests
+reach the handler or upstream through `ctx.intercept`, and response CORS headers
+are preserved, including their absence on rejections or responses with no CORS
+policy. Allowed credentialed requests depend on the application's own headers.
+
+Automatic CORS is opt-in per fake or service hostname:
+
+```ts
+defineFake({ name: "api", hostnames: ["api.test"], cors: "permissive", handler });
+// On a boot or runtime service:
+tls: [{ hostname: "api.test", port: 3000, cors: "permissive" }]
+// On a Supabase gateway (including responses from interceptors):
+supabase({ hostname: "supabase.example.com", cors: "permissive" });
+// On a low-level component proxy:
+proxy("api.test", { service: "api", port: 3000, cors: "permissive" });
+```
+
+Permissive HTTP/1 ingress answers CORS preflights before interceptors and adds
+reflected allow-origin plus allow-credentials to responses without allow-origin,
+including errors. Ordinary OPTIONS still reaches the handler. Use passthrough
+when testing application CORS policies. HTTP/2 streams always pass CORS through.
+
+Prefer the application's production hostnames for the frontend and API inside
+the environment: Spectest resolves declared names to its test services and
+provides certificates trusted inside the environment. This preserves existing
+origin allowlists and cookie relationships. Different subdomains are still
+different origins; a synthetic response must still supply the intended CORS
+headers. Permissive mode is a convenience override and should not be used to
+verify application CORS restrictions.

package/dist/components/supabase.d.ts

@@ -1,4 +1,4 @@
-import { type ServiceDefinition, type ServiceGroup, type ServicesMap } from "../index.js";
+import { type CorsMode, type ServiceDefinition, type ServiceGroup, type ServicesMap } from "../index.js";
 import { type SqlClient } from "../sql.js";
 import { type EmailHelpers } from "./email.js";
 export type { MailTemplateId, MailTemplateSpec } from "./supabase-config.js";
@@ -63,6 +63,10 @@ export interface SupabaseOptions {
      * test hardcodes a Supabase URL it cannot be told to override.
      */
     hostname?: string;
+    /** CORS handling at the daemon ingress for `hostname`. Defaults to
+     * "passthrough", preserving gateway/interceptor policy. "permissive"
+     * restores automatic preflight replies and credentialed CORS headers. */
+    cors?: CorsMode;
     /**
      * Capture GoTrue's outgoing mail (signup confirmations, magic links, OTPs,
      * password recovery, invites) with the standard `email()` component. **On

package/dist/components/supabase.js

@@ -55,6 +55,7 @@ import { excludeAllBut, functionsReach } from "./supabase-functions-reach.js";
 import { readdir, stat } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { serviceGroup, } from "../index.js";
+import { validateCorsMode } from "../ingress.js";
 import { SQL } from "../sql.js";
 import { apple } from "./apple.js";
 import { email, emailHelpers } from "./email.js";
@@ -1211,6 +1212,7 @@ db) {
  * for hitting the REST/auth/storage APIs through the gateway.
  */
 export function supabase(opts = {}) {
+    validateCorsMode(opts.cors);
     const name = opts.name ?? "supabase";
     const dbPassword = opts.dbPassword ?? "postgres";
     const jwtSecret = opts.jwtSecret ?? DEFAULT_JWT_SECRET;
@@ -1866,7 +1868,7 @@ export function supabase(opts = {}) {
                     },
                 ],
                 ports: [8000, 8443],
-                ...(opts.hostname ? { tls: [{ hostname: opts.hostname, port: 8000 }] } : {}),
+                ...(opts.hostname ? { tls: [{ hostname: opts.hostname, port: 8000, ...(opts.cors ? { cors: opts.cors } : {}) }] } : {}),
                 readyCheck: { type: "exec", command: "kong health", timeoutSecs: 90 },
             };
             return parts;

package/dist/daemon.js

@@ -56,7 +56,7 @@ import { installFetchWrapper, isTransportError } from "./harness/fetch.js";
 import { bindInstrumentationScope, createInstrumentationScope, runInstrumented, runUninstrumented, } from "./harness/instrumentation-scope.js";
 import { encodeRegistry } from "./harness/names-registry.js";
 import { InterceptRegistry, parseTarget, runChain, } from "./harness/intercept.js";
-import { HOP_BY_HOP_HEADERS, augmentCorsResponse, corsPreflightResponse, isCorsPreflight, upstreamRequestHeaders, } from "./harness/http-proxy.js";
+import { HOP_BY_HOP_HEADERS, withIngressCors, upstreamRequestHeaders, } from "./harness/http-proxy.js";
 import { WS_BRIDGE_HANDLERS, openUpstreamWebSocket, parseSubprotocols, upstreamHandshakeHeaders, } from "./harness/ws-bridge.js";
 import { certCovers as hostmatchCertCovers, hostWithoutPort, matchRoute, selectCertName, wildcardSuffix, } from "./harness/hostmatch.js";
 import { INGRESS_HTTPS_PORT, INGRESS_HTTP_PORT, bindRoute, clearTables, emptyTables, planBind, registryTarget, routesFor, unbindRoute, } from "./harness/ingress-table.js";
@@ -1707,7 +1707,7 @@ async function startIngress() {
     if (LOWERED.proxies.length > 0) {
         const routes = ensurePort(INGRESS_HTTP_PORT);
         for (const p of LOWERED.proxies) {
-            routes.set(p.hostname, { kind: "proxy", service: p.service, port: p.port, ...(p.http2 ? { http2: true } : {}) });
+            routes.set(p.hostname, { kind: "proxy", service: p.service, port: p.port, ...(p.http2 ? { http2: true } : {}), ...(p.cors ? { cors: p.cors } : {}) });
         }
     }
     // The :443 route table mirrors every handler whose hostname a cert
@@ -1724,7 +1724,7 @@ async function startIngress() {
         }
         for (const p of LOWERED.proxies) {
             if (certCovers(p.hostname)) {
-                httpsRoutes.set(p.hostname, { kind: "proxy", service: p.service, port: p.port, ...(p.http2 ? { http2: true } : {}) });
+                httpsRoutes.set(p.hostname, { kind: "proxy", service: p.service, port: p.port, ...(p.http2 ? { http2: true } : {}), ...(p.cors ? { cors: p.cors } : {}) });
             }
         }
     }
@@ -1876,16 +1876,16 @@ function certCovers(hostname) {
  * per-test snapshot exactly like fake state — a `dependsOn` child inherits
  * it, siblings forked from an earlier snapshot never see it.
  */
-async function bindRuntimeTls(hostname, service, port, http2) {
+async function bindRuntimeTls(hostname, service, port, http2, cors) {
     // Reuse the boot primitives for validation + lowercasing; throws on a
     // malformed hostname / upstream just like a boot `tls` would at load.
-    const decl = makeProxyDecl(hostname, { service, port, http2 });
+    const decl = makeProxyDecl(hostname, { service, port, http2, cors });
     const host = decl.hostname;
     if (!existsSync(CA_PATH) || !existsSync(CA_KEY_PATH)) {
         throw new Error(`runtime tls for ${JSON.stringify(host)} requires the in-VM root CA at ${CA_PATH}`);
     }
     const Bun = requireBun();
-    const route = { kind: "proxy", service, port, http2 };
+    const route = { kind: "proxy", service, port, http2, cors };
     // Decide the cost before mutating anything: an already-covered hostname
     // (an exact duplicate, or one under a boot wildcard) needs only a route.
     const plan = planBind(INGRESS, host, {
@@ -2030,12 +2030,6 @@ server, byHost, listenerLabel, proto) {
     if (!route) {
         return new Response(`spectest-daemon: no ingress route bound to Host=${JSON.stringify(host)} on ${listenerLabel}\n`, { status: 404, headers: { "content-type": "text/plain" } });
     }
-    // Answer CORS preflights at the ingress (see corsPreflightResponse) so a
-    // cross-origin browser request carrying any header — Authorization,
-    // Cache-Control, Pragma, … — isn't rejected by whatever the upstream happens
-    // to list in Access-Control-Allow-Headers.
-    if (isCorsPreflight(req))
-        return corsPreflightResponse(req);
     // The real answer — a fake handled in-process, or the proxied container.
     const upstream = async (current) => {
         if (route.kind === "fake") {
@@ -2049,15 +2043,15 @@ server, byHost, listenerLabel, proto) {
         }
         return proxyToService(current, server, route.service, route.port, listenerLabel, proto);
     };
-    // `ctx.intercept` middleware runs first, in registration order, and reaches
-    // the upstream through `next()`. The CORS headers go on *after* the chain,
-    // so a forced 500 reaches the browser as a 500 and not as a CORS error —
-    // the trap `page.route`-style interception falls into.
-    const chain = INTERCEPTORS.chainFor(host, new URL(req.url).pathname);
-    const res = chain.length === 0
-        ? await upstream(req)
-        : await runChain(chain, req, upstream, recordInterceptedRequest);
-    return augmentCorsResponse(req, res);
+    // Passthrough (the default) lets middleware and the upstream handle every
+    // request and preserves their CORS policy, including absent headers.
+    const cors = route.kind === "fake" ? route.fake.def.cors : route.cors;
+    return withIngressCors(req, cors, async (current) => {
+        const chain = INTERCEPTORS.chainFor(host, new URL(current.url).pathname);
+        return chain.length === 0
+            ? upstream(current)
+            : runChain(chain, current, upstream, recordInterceptedRequest);
+    });
 }
 /**
  * The address to report as the client's in `X-Forwarded-For`.
@@ -2619,7 +2613,7 @@ async function startRuntimeService(spec) {
         // `tls` is the runtime twin of a boot service's: stand up a
         // TLS-terminating reverse proxy at https://<hostname>/ → this container.
         for (const entry of svc.tls ?? []) {
-            await bindRuntimeTls(entry.hostname, svc.name, entry.port, entry.http2);
+            await bindRuntimeTls(entry.hostname, svc.name, entry.port, entry.http2, entry.cors);
         }
         RUNTIME_SERVICES.set(svc.name, svc);
         recordEnv({

package/dist/harness/http-proxy.d.ts

@@ -1,3 +1,4 @@
+import type { CorsMode } from "../ingress.js";
 /**
  * HTTP semantics the ingress proxy has to get right: which headers must
  * not be forwarded, and how CORS is answered.
@@ -37,9 +38,8 @@ export declare function isCorsPreflight(req: {
     };
 }): boolean;
 /**
- * Answer a preflight permissively — the environment is hermetic, so
- * there is nothing here to protect from itself, and a test failing on
- * CORS teaches nothing about the app.
+ * Answer a preflight for explicitly permissive ingress only. Passthrough
+ * must let the application or interceptor decide, including rejecting it.
  *
  * The one rule that is not a matter of taste: the **specific** origin is
  * echoed rather than `*`. `Allow-Origin: *` together with
@@ -53,15 +53,15 @@ export declare function corsPreflightResponse(req: {
     };
 }): Response;
 /**
- * Add CORS headers to a proxied response, without overriding the
- * upstream's own.
- *
- * An app that already sets `Access-Control-Allow-Origin` has an opinion —
- * possibly a deliberately restrictive one that a test is checking — and
- * replacing it would make the environment lie about the app's behaviour.
+ * Add CORS headers only when permissive ingress was explicitly requested.
+ * An absent allow-origin can be a deliberate rejection; callers must never
+ * use this augmentation in passthrough mode. Existing allow-origin is kept.
  */
 export declare function augmentCorsResponse(req: {
     headers: {
         get(n: string): string | null;
     };
 }, res: Response): Response;
+/** Apply the same policy around the entire fake/proxy + interceptor chain.
+ * Passthrough forwards even preflights and preserves the response unchanged. */
+export declare function withIngressCors(req: Request, cors: CorsMode | undefined, handle: (req: Request) => Response | Promise<Response>): Promise<Response>;

package/dist/harness/http-proxy.js

@@ -64,9 +64,8 @@ export function isCorsPreflight(req) {
         req.headers.has("access-control-request-method"));
 }
 /**
- * Answer a preflight permissively — the environment is hermetic, so
- * there is nothing here to protect from itself, and a test failing on
- * CORS teaches nothing about the app.
+ * Answer a preflight for explicitly permissive ingress only. Passthrough
+ * must let the application or interceptor decide, including rejecting it.
  *
  * The one rule that is not a matter of taste: the **specific** origin is
  * echoed rather than `*`. `Allow-Origin: *` together with
@@ -88,15 +87,13 @@ export function corsPreflightResponse(req) {
     // one origin's preflight to another.
     headers.append("vary", "Origin");
     headers.append("vary", "Access-Control-Request-Headers");
+    headers.append("vary", "Access-Control-Request-Method");
     return new Response(null, { status: 204, headers });
 }
 /**
- * Add CORS headers to a proxied response, without overriding the
- * upstream's own.
- *
- * An app that already sets `Access-Control-Allow-Origin` has an opinion —
- * possibly a deliberately restrictive one that a test is checking — and
- * replacing it would make the environment lie about the app's behaviour.
+ * Add CORS headers only when permissive ingress was explicitly requested.
+ * An absent allow-origin can be a deliberate rejection; callers must never
+ * use this augmentation in passthrough mode. Existing allow-origin is kept.
  */
 export function augmentCorsResponse(req, res) {
     const origin = req.headers.get("origin");
@@ -116,3 +113,11 @@ export function augmentCorsResponse(req, res) {
     }
     return res;
 }
+/** Apply the same policy around the entire fake/proxy + interceptor chain.
+ * Passthrough forwards even preflights and preserves the response unchanged. */
+export async function withIngressCors(req, cors, handle) {
+    if (cors === "permissive" && isCorsPreflight(req))
+        return corsPreflightResponse(req);
+    const res = await handle(req);
+    return cors === "permissive" ? augmentCorsResponse(req, res) : res;
+}

package/dist/harness/ingress-table.d.ts

@@ -41,6 +41,7 @@
  * thing {@link planBind} still has to say is whether the listener exists
  * yet.
  */
+import type { CorsMode } from "../ingress.js";
 /**
  * One hostname's upstream: a fake handled in-process, or a container.
  *
@@ -56,6 +57,7 @@ export type Route<F = unknown> = {
     service: string;
     port: number;
     http2?: boolean;
+    cors?: CorsMode;
 };
 /** A PEM leaf + key, as handed to `Bun.serve`'s TLS config. */
 export interface Leaf {

package/dist/index.d.ts

@@ -29,8 +29,8 @@ export { type CoverageAdapter, type CoverageCaptureContext, type CoverageConfigu
 import { type ServiceCoverage } from "./coverage.js";
 export { ca } from "./environment-ca.js";
 export { certificate, dnsName, proxy, provides, lowerIngress, isWildcard, SELF_SERVICE_TOKEN, } from "./ingress.js";
-export type { CertificateDecl, DnsDecl, ProxyDecl, IngressDecl, DnsTarget, LoweredIngress, } from "./ingress.js";
-import type { DnsTarget } from "./ingress.js";
+export type { CorsMode, CertificateDecl, DnsDecl, ProxyDecl, IngressDecl, DnsTarget, LoweredIngress, } from "./ingress.js";
+import { type CorsMode, type DnsTarget } from "./ingress.js";
 import type { InterceptHandler, InterceptNext, InterceptedRequest } from "./harness/intercept.js";
 export type { InterceptHandler, InterceptNext, InterceptedRequest };
 /**
@@ -744,6 +744,9 @@ export interface ServiceTls {
     /** Accept HTTP/2 over TLS and forward it as plaintext HTTP/2 (h2c).
      * Required for gRPC. HTTP/1.1 continues to use the existing HTTP proxy. */
     http2?: boolean;
+    /** Preserve upstream CORS policy by default. "permissive" opts HTTP/1
+     * ingress into answering preflights and adding credentialed CORS headers. */
+    cors?: CorsMode;
 }
 /** @internal Normalized wire representation; legacy definitions remain accepted. */
 export type NormalizedServiceImage = {
@@ -1458,6 +1461,9 @@ export interface FakeDefinition<S = any, H extends Record<string, unknown> = Rec
     hostnames: readonly string[];
     /** TCP port the fake listens on. Default `80`. */
     port?: number;
+    /** Preserve handler/interceptor CORS policy by default. "permissive"
+     * answers preflights and adds credentialed CORS headers at ingress. */
+    cors?: CorsMode;
     /**
      * Build the fake's initial state. Called once when the project loads.
      * The returned value lives in daemon memory for the rest of the

package/dist/index.js

@@ -49,6 +49,7 @@ export { ca } from "./environment-ca.js";
 // `tls` / `hostnames` fields and `defineFake(...)` are built on. See
 // `ingress.ts`.
 export { certificate, dnsName, proxy, provides, lowerIngress, isWildcard, SELF_SERVICE_TOKEN, } from "./ingress.js";
+import { validateCorsMode } from "./ingress.js";
 import { isWildcard as isWildcardHost } from "./ingress.js";
 // ──────────────────────────────────────────────────────────────────────────
 // Service groups — one services-map entry that expands to several services.
@@ -363,6 +364,7 @@ function validateEnvironmentConfig(config) {
             }
             if (entry.http2 !== undefined && typeof entry.http2 !== "boolean")
                 throw new Error(`service "${name}" tls http2 must be a boolean`);
+            validateCorsMode(entry.cors);
             const h = entry.hostname.toLowerCase();
             if (!HOSTNAME_RE.test(hostPatternBody(h))) {
                 throw new Error(`service "${name}" tls hostname ${JSON.stringify(entry.hostname)} is not a multi-label DNS name or wildcard (e.g. "app.test", "*.us-east-1.amazonaws.com")`);
@@ -408,6 +410,7 @@ export function defineFake(opts) {
             throw new Error(`defineFake(${opts.name}): hostname ${JSON.stringify(h)} ends in reserved ".internal" TLD`);
         }
     }
+    validateCorsMode(opts.cors);
     if (typeof opts.handler !== "function") {
         throw new Error(`defineFake(${opts.name}): \`handler\` is required`);
     }

package/dist/ingress.d.ts

@@ -7,6 +7,11 @@ export type DnsTarget = {
 } | {
     service: string;
 };
+/** Passthrough preserves application CORS policy (the default). Permissive
+ * answers preflights and adds credentialed CORS headers at HTTP/1 ingress. */
+export type CorsMode = "passthrough" | "permissive";
+/** @internal Validate JavaScript config as well as TypeScript callers. */
+export declare function validateCorsMode(cors: unknown): void;
 export interface CertificateDecl {
     kind: "certificate";
     /** Hostnames the leaf cert's SANs cover. One cert is minted per decl. */
@@ -24,6 +29,7 @@ export interface ProxyDecl {
         service: string;
         port: number;
         http2?: boolean;
+        cors?: CorsMode;
     };
 }
 export type IngressDecl = CertificateDecl | DnsDecl | ProxyDecl;
@@ -71,6 +77,7 @@ export declare function proxy(hostname: string, upstream: {
     service: string;
     port: number;
     http2?: boolean;
+    cors?: CorsMode;
 }): ProxyDecl;
 /**
  * Attach low-level ingress decls to a service definition a component
@@ -100,6 +107,7 @@ export interface LoweredIngress {
         service: string;
         port: number;
         http2?: boolean;
+        cors?: CorsMode;
     }[];
     /** Hostnames that resolve to the daemon ingress gateway (DNS registry
      *  + `--add-host` on every container). Covers fakes, TLS proxies, and

package/dist/ingress.js

@@ -17,6 +17,12 @@
 // deserialises: the decls live on the `Project` (daemon-side only) and,
 // when attached to a service, ride on a Symbol key that `JSON.stringify`
 // drops — so Rust's `deny_unknown_fields` never sees them.
+/** @internal Validate JavaScript config as well as TypeScript callers. */
+export function validateCorsMode(cors) {
+    if (cors !== undefined && cors !== "passthrough" && cors !== "permissive") {
+        throw new Error('cors must be "passthrough" or "permissive"');
+    }
+}
 /** Token a component can use in a decl where it can't know its own
  *  services-map key yet — resolved to that key during `lowerIngress`.
  *  Mirrors the `{{SPECTEST_SERVICE}}` token honoured in `files`. */
@@ -101,6 +107,7 @@ export function proxy(hostname, upstream) {
     }
     if (upstream.http2 !== undefined && typeof upstream.http2 !== "boolean")
         throw new Error("proxy(): http2 must be a boolean");
+    validateCorsMode(upstream.cors);
     return { kind: "proxy", hostname: hostname.toLowerCase(), upstream };
 }
 /** Symbol key under which `provides(...)` stashes a component's ingress
@@ -165,7 +172,7 @@ export function lowerIngress(project) {
                 break;
             case "proxy": {
                 const service = resolveSelf(decl.upstream.service, selfKey);
-                proxies.push({ hostname: decl.hostname, service, port: decl.upstream.port, ...(decl.upstream.http2 ? { http2: true } : {}) });
+                proxies.push({ hostname: decl.hostname, service, port: decl.upstream.port, ...(decl.upstream.http2 ? { http2: true } : {}), ...(decl.upstream.cors ? { cors: decl.upstream.cors } : {}) });
                 // A proxied hostname must route to the daemon. A wildcard one can
                 // only be answered by the resolver (there is no `--add-host` for a
                 // pattern), so it goes in the wildcard table pointed at the ingress.
@@ -204,7 +211,7 @@ export function lowerIngress(project) {
         // `tls: [{ hostname, port }]` → cert + TLS-terminated reverse proxy.
         for (const entry of svc.tls ?? []) {
             applyDecl(certificate([entry.hostname]), name);
-            applyDecl(proxy(entry.hostname, { service: name, port: entry.port, ...(entry.http2 ? { http2: true } : {}) }), name);
+            applyDecl(proxy(entry.hostname, { service: name, port: entry.port, ...(entry.http2 ? { http2: true } : {}), ...(entry.cors ? { cors: entry.cors } : {}) }), name);
         }
         // `hostnames: [h]` → plain peer alias (no daemon hop).
         for (const h of svc.hostnames ?? []) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.98.0",
+  "version": "0.99.0",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/components/supabase.ts

@@ -58,11 +58,13 @@ import { dirname, join } from "node:path";
 
 import {
   serviceGroup,
+  type CorsMode,
   type ServiceDefinition,
   type ServiceGroup,
   type ServiceSetupContext,
   type ServicesMap,
 } from "../index.js";
+import { validateCorsMode } from "../ingress.js";
 import { SQL, type SqlClient } from "../sql.js";
 import { apple } from "./apple.js";
 import type { OAuthClient } from "./emulate/service.js";
@@ -280,6 +282,10 @@ export interface SupabaseOptions {
    * test hardcodes a Supabase URL it cannot be told to override.
    */
   hostname?: string;
+  /** CORS handling at the daemon ingress for `hostname`. Defaults to
+   * "passthrough", preserving gateway/interceptor policy. "permissive"
+   * restores automatic preflight replies and credentialed CORS headers. */
+  cors?: CorsMode;
 
   /**
    * Capture GoTrue's outgoing mail (signup confirmations, magic links, OTPs,
@@ -1640,6 +1646,7 @@ async function applyMigrations(
  * for hitting the REST/auth/storage APIs through the gateway.
  */
 export function supabase(opts: SupabaseOptions = {}): SupabaseStack {
+  validateCorsMode(opts.cors);
   const name = opts.name ?? "supabase";
   const dbPassword = opts.dbPassword ?? "postgres";
   const jwtSecret = opts.jwtSecret ?? DEFAULT_JWT_SECRET;
@@ -2366,7 +2373,7 @@ export function supabase(opts: SupabaseOptions = {}): SupabaseStack {
           },
         ],
         ports: [8000, 8443],
-        ...(opts.hostname ? { tls: [{ hostname: opts.hostname, port: 8000 }] } : {}),
+        ...(opts.hostname ? { tls: [{ hostname: opts.hostname, port: 8000, ...(opts.cors ? { cors: opts.cors } : {}) }] } : {}),
         readyCheck: { type: "exec", command: "kong health", timeoutSecs: 90 },
       };
 

package/src/daemon.ts

@@ -41,7 +41,7 @@ import {
   normalizeServiceImage,
   proxy as makeProxyDecl,
 } from "./index.js";
-import type { DnsTarget, LoweredIngress } from "./index.js";
+import type { CorsMode, DnsTarget, LoweredIngress } from "./index.js";
 import {
   COVERAGE_CONTAINER_DIR,
   coverageBundleRef,
@@ -127,9 +127,7 @@ import {
 } from "./harness/intercept.js";
 import {
   HOP_BY_HOP_HEADERS,
-  augmentCorsResponse,
-  corsPreflightResponse,
-  isCorsPreflight,
+  withIngressCors,
   upstreamRequestHeaders,
 } from "./harness/http-proxy.js";
 import {
@@ -2146,7 +2144,7 @@ async function startIngress(): Promise<void> {
   if (LOWERED.proxies.length > 0) {
     const routes = ensurePort(INGRESS_HTTP_PORT);
     for (const p of LOWERED.proxies) {
-      routes.set(p.hostname, { kind: "proxy", service: p.service, port: p.port, ...(p.http2 ? { http2: true } : {}) });
+      routes.set(p.hostname, { kind: "proxy", service: p.service, port: p.port, ...(p.http2 ? { http2: true } : {}), ...(p.cors ? { cors: p.cors } : {}) });
     }
   }
   // The :443 route table mirrors every handler whose hostname a cert
@@ -2162,7 +2160,7 @@ async function startIngress(): Promise<void> {
     }
     for (const p of LOWERED.proxies) {
       if (certCovers(p.hostname)) {
-        httpsRoutes.set(p.hostname, { kind: "proxy", service: p.service, port: p.port, ...(p.http2 ? { http2: true } : {}) });
+        httpsRoutes.set(p.hostname, { kind: "proxy", service: p.service, port: p.port, ...(p.http2 ? { http2: true } : {}), ...(p.cors ? { cors: p.cors } : {}) });
       }
     }
   }
@@ -2319,10 +2317,10 @@ function certCovers(hostname: string): boolean {
  * per-test snapshot exactly like fake state — a `dependsOn` child inherits
  * it, siblings forked from an earlier snapshot never see it.
  */
-async function bindRuntimeTls(hostname: string, service: string, port: number, http2?: boolean): Promise<void> {
+async function bindRuntimeTls(hostname: string, service: string, port: number, http2?: boolean, cors?: CorsMode): Promise<void> {
   // Reuse the boot primitives for validation + lowercasing; throws on a
   // malformed hostname / upstream just like a boot `tls` would at load.
-  const decl = makeProxyDecl(hostname, { service, port, http2 });
+  const decl = makeProxyDecl(hostname, { service, port, http2, cors });
   const host = decl.hostname;
   if (!existsSync(CA_PATH) || !existsSync(CA_KEY_PATH)) {
     throw new Error(
@@ -2330,7 +2328,7 @@ async function bindRuntimeTls(hostname: string, service: string, port: number, h
     );
   }
   const Bun = requireBun();
-  const route: Route = { kind: "proxy", service, port, http2 };
+  const route: Route = { kind: "proxy", service, port, http2, cors };
 
   // Decide the cost before mutating anything: an already-covered hostname
   // (an exact duplicate, or one under a boot wildcard) needs only a route.
@@ -2500,11 +2498,6 @@ async function dispatchIngress(
       { status: 404, headers: { "content-type": "text/plain" } },
     );
   }
-  // Answer CORS preflights at the ingress (see corsPreflightResponse) so a
-  // cross-origin browser request carrying any header — Authorization,
-  // Cache-Control, Pragma, … — isn't rejected by whatever the upstream happens
-  // to list in Access-Control-Allow-Headers.
-  if (isCorsPreflight(req)) return corsPreflightResponse(req);
   // The real answer — a fake handled in-process, or the proxied container.
   const upstream = async (current: Request): Promise<Response> => {
     if (route.kind === "fake") {
@@ -2522,16 +2515,15 @@ async function dispatchIngress(
     }
     return proxyToService(current, server, route.service, route.port, listenerLabel, proto);
   };
-  // `ctx.intercept` middleware runs first, in registration order, and reaches
-  // the upstream through `next()`. The CORS headers go on *after* the chain,
-  // so a forced 500 reaches the browser as a 500 and not as a CORS error —
-  // the trap `page.route`-style interception falls into.
-  const chain = INTERCEPTORS.chainFor(host, new URL(req.url).pathname);
-  const res =
-    chain.length === 0
-      ? await upstream(req)
-      : await runChain(chain, req, upstream, recordInterceptedRequest);
-  return augmentCorsResponse(req, res);
+  // Passthrough (the default) lets middleware and the upstream handle every
+  // request and preserves their CORS policy, including absent headers.
+  const cors = route.kind === "fake" ? route.fake.def.cors : route.cors;
+  return withIngressCors(req, cors, async (current) => {
+    const chain = INTERCEPTORS.chainFor(host, new URL(current.url).pathname);
+    return chain.length === 0
+      ? upstream(current)
+      : runChain(chain, current, upstream, recordInterceptedRequest);
+  });
 }
 
 /**
@@ -3152,7 +3144,7 @@ async function startRuntimeService(spec: RuntimeServiceSpec): Promise<RuntimeSer
     // `tls` is the runtime twin of a boot service's: stand up a
     // TLS-terminating reverse proxy at https://<hostname>/ → this container.
     for (const entry of svc.tls ?? []) {
-      await bindRuntimeTls(entry.hostname, svc.name, entry.port, entry.http2);
+      await bindRuntimeTls(entry.hostname, svc.name, entry.port, entry.http2, entry.cors);
     }
     RUNTIME_SERVICES.set(svc.name, svc);
     recordEnv({

package/src/harness/http-proxy.test.ts

@@ -176,11 +176,12 @@ describe("preflight response", () => {
   });
 
   /** Without Vary, a cache can serve one origin's preflight to another. */
-  test("varies on origin and requested headers", () => {
+  test("varies on origin, requested method and headers", () => {
     const res = preflight({ origin: "http://a.test", "access-control-request-method": "GET" });
     const vary = res.headers.get("vary") ?? "";
     expect(vary.toLowerCase()).toContain("origin");
     expect(vary.toLowerCase()).toContain("access-control-request-headers");
+    expect(vary.toLowerCase()).toContain("access-control-request-method");
   });
 });
 

package/src/harness/http-proxy.ts

@@ -1,3 +1,5 @@
+import type { CorsMode } from "../ingress.js";
+
 /**
  * HTTP semantics the ingress proxy has to get right: which headers must
  * not be forwarded, and how CORS is answered.
@@ -75,9 +77,8 @@ export function isCorsPreflight(req: {
 }
 
 /**
- * Answer a preflight permissively — the environment is hermetic, so
- * there is nothing here to protect from itself, and a test failing on
- * CORS teaches nothing about the app.
+ * Answer a preflight for explicitly permissive ingress only. Passthrough
+ * must let the application or interceptor decide, including rejecting it.
  *
  * The one rule that is not a matter of taste: the **specific** origin is
  * echoed rather than `*`. `Allow-Origin: *` together with
@@ -104,16 +105,14 @@ export function corsPreflightResponse(req: {
   // one origin's preflight to another.
   headers.append("vary", "Origin");
   headers.append("vary", "Access-Control-Request-Headers");
+  headers.append("vary", "Access-Control-Request-Method");
   return new Response(null, { status: 204, headers });
 }
 
 /**
- * Add CORS headers to a proxied response, without overriding the
- * upstream's own.
- *
- * An app that already sets `Access-Control-Allow-Origin` has an opinion —
- * possibly a deliberately restrictive one that a test is checking — and
- * replacing it would make the environment lie about the app's behaviour.
+ * Add CORS headers only when permissive ingress was explicitly requested.
+ * An absent allow-origin can be a deliberate rejection; callers must never
+ * use this augmentation in passthrough mode. Existing allow-origin is kept.
  */
 export function augmentCorsResponse(
   req: { headers: { get(n: string): string | null } },
@@ -133,3 +132,15 @@ export function augmentCorsResponse(
   }
   return res;
 }
+
+/** Apply the same policy around the entire fake/proxy + interceptor chain.
+ * Passthrough forwards even preflights and preserves the response unchanged. */
+export async function withIngressCors(
+  req: Request,
+  cors: CorsMode | undefined,
+  handle: (req: Request) => Response | Promise<Response>,
+): Promise<Response> {
+  if (cors === "permissive" && isCorsPreflight(req)) return corsPreflightResponse(req);
+  const res = await handle(req);
+  return cors === "permissive" ? augmentCorsResponse(req, res) : res;
+}

package/src/harness/ingress-cors.test.ts

@@ -0,0 +1,184 @@
+import { describe, expect, test } from "bun:test";
+import { defineEnvironment, defineFake, lowerIngress, provides, proxy, type CorsMode } from "../index.js";
+import { supabase } from "../components/supabase.js";
+import { withIngressCors, upstreamRequestHeaders } from "./http-proxy.js";
+import { InterceptRegistry, runChain } from "./intercept.js";
+
+const allowed = "https://app.tangent.test";
+const denied = "https://untrusted.test";
+const preflight = (origin: string, method = "PUT"): RequestInit => ({
+  method: "OPTIONS",
+  headers: { origin, "access-control-request-method": method, "access-control-request-headers": "authorization" },
+});
+
+for (const kind of ["fake", "service"] as const) {
+  for (const cors of [undefined, "passthrough"] as const) {
+    describe(`${kind} ingress, cors=${cors ?? "default"}`, () => {
+      test("preserves application CORS, rejections, range reads, OPTIONS and interceptor responses", async () => {
+        const seen: string[] = [];
+        const handler = async (req: Request): Promise<Response> => {
+          const path = new URL(req.url).pathname;
+          seen.push(`${req.method} ${path}`);
+          if (path === "/no-policy") return new Response("private", { headers: { vary: "Accept-Encoding" } });
+          if (req.method === "OPTIONS" && !req.headers.has("access-control-request-method")) {
+            return new Response("options", { status: 200, headers: { allow: "GET, PUT" } });
+          }
+          if (req.headers.get("origin") !== allowed) return new Response("origin denied", { status: 403 });
+          if (req.method === "OPTIONS" && req.headers.get("access-control-request-method") !== "PUT") {
+            return new Response("method denied", { status: 405, headers: { allow: "PUT" } });
+          }
+          const headers = {
+            "access-control-allow-origin": allowed,
+            "access-control-allow-credentials": "true",
+            "access-control-allow-methods": "PUT",
+            "access-control-allow-headers": "authorization",
+            "access-control-expose-headers": "Content-Range",
+            vary: "Origin, Accept-Encoding",
+          };
+          if (req.method === "OPTIONS") return new Response(null, { status: 204, headers });
+          if (req.headers.get("range")) return new Response("par", {
+            status: 206, headers: { ...headers, "content-range": "bytes 0-2/7" },
+          });
+          return new Response(req.headers.get("cookie"), { headers });
+        };
+        const upstream = Bun.serve({ port: 0, hostname: "127.0.0.1", fetch: handler });
+        const interceptors = new InterceptRegistry();
+        const pass = interceptors.register("bucket.test", undefined, (_req, next) => next());
+        const blocked = interceptors.register("bucket.test", "/intercepted", () =>
+          new Response("intercepted", { status: 418, headers: { vary: "Accept" } }));
+        const fake = defineFake({ name: "bucket", hostnames: ["bucket.test"], cors, handler });
+        const serviceRoute = lowerIngress(defineEnvironment({ name: "cors", services: {
+          web: { image: "nginx", tls: [{ hostname: "bucket.test", port: upstream.port!, cors }] },
+        } }).project([])).proxies[0];
+        const mode = kind === "fake" ? fake.cors : serviceRoute.cors;
+        const forward = kind === "fake" ? handler : async (req: Request) => fetch(
+          new URL(new URL(req.url).pathname, upstream.url), {
+            method: req.method, headers: upstreamRequestHeaders(req.headers, { proto: "https" }),
+            body: req.body, redirect: "manual",
+          });
+        const ingress = Bun.serve({ port: 0, hostname: "127.0.0.1", fetch: req =>
+          withIngressCors(req, mode, current => runChain(
+            interceptors.chainFor("bucket.test", new URL(current.url).pathname), current, forward)),
+        });
+        try {
+          const send = (path: string, init: RequestInit) => fetch(new URL(path, ingress.url), init);
+          const ok = await send("/probe", preflight(allowed));
+          expect(ok.status).toBe(204);
+          expect(ok.headers.get("access-control-allow-origin")).toBe(allowed);
+          expect(ok.headers.get("access-control-allow-credentials")).toBe("true");
+          expect(ok.headers.get("access-control-allow-methods")).toBe("PUT");
+          expect(ok.headers.get("access-control-allow-headers")).toBe("authorization");
+          expect(ok.headers.get("vary")).toBe("Origin, Accept-Encoding");
+          for (const [init, status, body] of [
+            [preflight(denied), 403, "origin denied"],
+            [preflight(allowed, "DELETE"), 405, "method denied"],
+            [{ headers: { origin: denied } }, 403, "origin denied"],
+          ] as const) {
+            const res = await send("/probe", init);
+            expect(res.status).toBe(status);
+            expect(await res.text()).toBe(body);
+            expect(res.headers.get("access-control-allow-origin")).toBeNull();
+            expect(res.headers.get("access-control-allow-credentials")).toBeNull();
+          }
+          const credentialed = await send("/probe", { method: "PUT", headers: { origin: allowed, cookie: "session=test" } });
+          expect(await credentialed.text()).toBe("session=test");
+          expect(credentialed.headers.get("access-control-allow-origin")).toBe(allowed);
+          expect(credentialed.headers.get("access-control-allow-credentials")).toBe("true");
+          const range = await send("/probe", { headers: { origin: allowed, range: "bytes=0-2" } });
+          expect(range.status).toBe(206);
+          expect(range.headers.get("content-range")).toBe("bytes 0-2/7");
+          expect(range.headers.get("access-control-expose-headers")).toBe("Content-Range");
+          expect(await range.text()).toBe("par");
+          const noPolicy = await send("/no-policy", { headers: { origin: allowed } });
+          expect(await noPolicy.text()).toBe("private");
+          expect(noPolicy.headers.get("access-control-allow-origin")).toBeNull();
+          expect(noPolicy.headers.get("access-control-allow-credentials")).toBeNull();
+          expect(noPolicy.headers.get("vary")).toBe("Accept-Encoding");
+          const options = await send("/probe", { method: "OPTIONS", headers: { origin: allowed } });
+          expect(options.status).toBe(200);
+          expect(options.headers.get("allow")).toBe("GET, PUT");
+          expect(options.headers.get("access-control-allow-origin")).toBeNull();
+          expect(await options.text()).toBe("options");
+          for (const init of [preflight(denied), { headers: { origin: denied } }]) {
+            const res = await send("/intercepted", init);
+            expect(res.status).toBe(418);
+            expect(await res.text()).toBe("intercepted");
+            expect(res.headers.get("access-control-allow-origin")).toBeNull();
+            expect(res.headers.get("vary")).toBe("Accept");
+          }
+          expect(pass.requests).toHaveLength(10);
+          expect(blocked.requests.map(r => r.method)).toEqual(["OPTIONS", "GET"]);
+          expect(seen.filter(s => s === "OPTIONS /probe")).toHaveLength(4);
+          expect(seen.some(s => s.endsWith("/intercepted"))).toBe(false);
+        } finally {
+          ingress.stop(true);
+          upstream.stop(true);
+        }
+      });
+    });
+  }
+}
+
+test("passthrough preserves the exact response, including interceptor CORS and repeated cookies", async () => {
+  const res = new Response("error", { status: 500, headers: {
+    "access-control-allow-origin": allowed, "access-control-allow-credentials": "false", vary: "Accept",
+  } });
+  res.headers.append("set-cookie", "a=1");
+  res.headers.append("set-cookie", "b=2");
+  const headers = [...res.headers];
+  expect(await withIngressCors(new Request("http://bucket.test", preflight(denied)), undefined, () => res)).toBe(res);
+  expect([...res.headers]).toEqual(headers);
+});
+
+test("permissive is opt-in for preflight interception and response augmentation", async () => {
+  let calls = 0;
+  const handle = () => { calls++; return new Response("denied", { status: 403 }); };
+  const pre = await withIngressCors(new Request("http://bucket.test", preflight(denied)), "permissive", handle);
+  expect(pre.status).toBe(204);
+  expect(pre.headers.get("access-control-allow-origin")).toBe(denied);
+  expect(pre.headers.get("access-control-allow-credentials")).toBe("true");
+  expect(calls).toBe(0);
+  const ordinary = await withIngressCors(new Request("http://bucket.test", { method: "OPTIONS" }), "permissive", handle);
+  expect(ordinary.status).toBe(403);
+  expect(calls).toBe(1);
+  const res = await withIngressCors(new Request("http://bucket.test", { headers: { origin: denied } }), "permissive", handle);
+  expect(res.status).toBe(403);
+  expect(res.headers.get("access-control-allow-origin")).toBe(denied);
+  expect(res.headers.get("access-control-allow-credentials")).toBe("true");
+  expect(calls).toBe(2);
+});
+
+test.each(["passthrough", "permissive"] as CorsMode[])("public config retains %s for fakes, TLS and component proxies", cors => {
+  const fake = defineFake({ name: "fake", hostnames: ["fake.test"], cors, handler: () => new Response() });
+  const env = defineEnvironment({ name: "cors", fakes: { fake }, services: {
+    web: provides({ image: "nginx", tls: [{ hostname: "web.test", port: 81, cors }] }, [
+      proxy("*.proxy.test", { service: "web", port: 81, cors }),
+    ]),
+  } });
+  const project = env.project([]);
+  expect(project.fakes?.fake.cors).toBe(cors);
+  expect(lowerIngress(project).proxies.map(p => p.cors)).toEqual([cors, cors]);
+});
+
+test("invalid CORS modes fail at configuration time", () => {
+  const cors = "typo" as CorsMode;
+  expect(() => defineFake({ name: "fake", hostnames: ["fake.test"], cors, handler: () => new Response() })).toThrow("cors must be");
+  expect(() => proxy("proxy.test", { service: "web", port: 81, cors })).toThrow("cors must be");
+  expect(() => defineEnvironment({ name: "cors", services: {
+    web: { image: "nginx", tls: [{ hostname: "web.test", port: 81, cors }] },
+  } })).toThrow("cors must be");
+});
+
+for (const cors of [undefined, "passthrough", "permissive"] as const) {
+  test(`Supabase gateway carries ${cors ?? "default"} CORS through group expansion`, () => {
+    const sb = supabase({ hostname: "supabase.test", cors });
+    const project = defineEnvironment({ name: "cors", services: { supabase: sb.group } }).project([]);
+    const gateway = lowerIngress(project).proxies.find(p => p.hostname === "supabase.test");
+    expect(gateway).toBeDefined();
+    expect(gateway?.cors).toBe(cors);
+  });
+}
+
+test("Supabase rejects an invalid CORS mode", () => {
+  expect(() => supabase({ hostname: "supabase.test", cors: "typo" as CorsMode })).toThrow("cors must be");
+});

package/src/harness/ingress-table.ts

@@ -42,6 +42,7 @@
  * yet.
  */
 
+import type { CorsMode } from "../ingress.js";
 import { certCovers, isWildcard, wildcardSuffix } from "./hostmatch";
 
 /**
@@ -53,7 +54,7 @@ import { certCovers, isWildcard, wildcardSuffix } from "./hostmatch";
  */
 export type Route<F = unknown> =
   | { kind: "fake"; fake: F }
-  | { kind: "proxy"; service: string; port: number; http2?: boolean };
+  | { kind: "proxy"; service: string; port: number; http2?: boolean; cors?: CorsMode };
 
 /** A PEM leaf + key, as handed to `Bun.serve`'s TLS config. */
 export interface Leaf {

package/src/index.ts

@@ -190,6 +190,7 @@ export {
   SELF_SERVICE_TOKEN,
 } from "./ingress.js";
 export type {
+  CorsMode,
   CertificateDecl,
   DnsDecl,
   ProxyDecl,
@@ -197,7 +198,7 @@ export type {
   DnsTarget,
   LoweredIngress,
 } from "./ingress.js";
-import type { DnsTarget } from "./ingress.js";
+import { validateCorsMode, type CorsMode, type DnsTarget } from "./ingress.js";
 import type {
   InterceptHandler,
   InterceptNext,
@@ -1164,6 +1165,9 @@ export interface ServiceTls {
   /** Accept HTTP/2 over TLS and forward it as plaintext HTTP/2 (h2c).
    * Required for gRPC. HTTP/1.1 continues to use the existing HTTP proxy. */
   http2?: boolean;
+  /** Preserve upstream CORS policy by default. "permissive" opts HTTP/1
+   * ingress into answering preflights and adding credentialed CORS headers. */
+  cors?: CorsMode;
 }
 
 /** @internal Normalized wire representation; legacy definitions remain accepted. */
@@ -1665,6 +1669,7 @@ function validateEnvironmentConfig<S extends ServicesMap>(
         );
       }
       if (entry.http2 !== undefined && typeof entry.http2 !== "boolean") throw new Error(`service "${name}" tls http2 must be a boolean`);
+      validateCorsMode(entry.cors);
       const h = entry.hostname.toLowerCase();
       if (!HOSTNAME_RE.test(hostPatternBody(h))) {
         throw new Error(
@@ -2144,6 +2149,9 @@ export interface FakeDefinition<
   hostnames: readonly string[];
   /** TCP port the fake listens on. Default `80`. */
   port?: number;
+  /** Preserve handler/interceptor CORS policy by default. "permissive"
+   * answers preflights and adds credentialed CORS headers at ingress. */
+  cors?: CorsMode;
   /**
    * Build the fake's initial state. Called once when the project loads.
    * The returned value lives in daemon memory for the rest of the
@@ -2227,6 +2235,7 @@ export function defineFake<
       );
     }
   }
+  validateCorsMode(opts.cors);
   if (typeof opts.handler !== "function") {
     throw new Error(`defineFake(${opts.name}): \`handler\` is required`);
   }

package/src/ingress.ts

@@ -25,6 +25,17 @@ import type { FakeDefinition, Project, ServiceConfig } from "./index.js";
  *  live IP on spectest-net (a plain peer alias, no daemon hop). */
 export type DnsTarget = { ingress: true } | { service: string };
 
+/** Passthrough preserves application CORS policy (the default). Permissive
+ * answers preflights and adds credentialed CORS headers at HTTP/1 ingress. */
+export type CorsMode = "passthrough" | "permissive";
+
+/** @internal Validate JavaScript config as well as TypeScript callers. */
+export function validateCorsMode(cors: unknown): void {
+  if (cors !== undefined && cors !== "passthrough" && cors !== "permissive") {
+    throw new Error('cors must be "passthrough" or "permissive"');
+  }
+}
+
 export interface CertificateDecl {
   kind: "certificate";
   /** Hostnames the leaf cert's SANs cover. One cert is minted per decl. */
@@ -40,7 +51,7 @@ export interface DnsDecl {
 export interface ProxyDecl {
   kind: "proxy";
   hostname: string;
-  upstream: { service: string; port: number; http2?: boolean };
+  upstream: { service: string; port: number; http2?: boolean; cors?: CorsMode };
 }
 
 export type IngressDecl = CertificateDecl | DnsDecl | ProxyDecl;
@@ -137,7 +148,7 @@ export function dnsName(hostname: string, target: DnsTarget): DnsDecl {
  */
 export function proxy(
   hostname: string,
-  upstream: { service: string; port: number; http2?: boolean },
+  upstream: { service: string; port: number; http2?: boolean; cors?: CorsMode },
 ): ProxyDecl {
   assertNameOrWildcard(hostname, "proxy()");
   if (!upstream || typeof upstream.service !== "string" || typeof upstream.port !== "number") {
@@ -146,6 +157,7 @@ export function proxy(
     );
   }
   if (upstream.http2 !== undefined && typeof upstream.http2 !== "boolean") throw new Error("proxy(): http2 must be a boolean");
+  validateCorsMode(upstream.cors);
   return { kind: "proxy", hostname: hostname.toLowerCase(), upstream };
 }
 
@@ -198,7 +210,7 @@ export interface LoweredIngress {
   /** One leaf cert per group; SANs = the group's hostnames. */
   certificates: { hostnames: string[] }[];
   /** Reverse-proxy routes: hostname → upstream service:port. */
-  proxies: { hostname: string; service: string; port: number; http2?: boolean }[];
+  proxies: { hostname: string; service: string; port: number; http2?: boolean; cors?: CorsMode }[];
   /** Hostnames that resolve to the daemon ingress gateway (DNS registry
    *  + `--add-host` on every container). Covers fakes, TLS proxies, and
    *  any `dnsName(h, { ingress: true })`. */
@@ -227,7 +239,7 @@ function resolveSelf(service: string, selfKey: string): string {
  */
 export function lowerIngress(project: Project): LoweredIngress {
   const certificates: { hostnames: string[] }[] = [];
-  const proxies: { hostname: string; service: string; port: number; http2?: boolean }[] = [];
+  const proxies: { hostname: string; service: string; port: number; http2?: boolean; cors?: CorsMode }[] = [];
   const ingressSet = new Set<string>();
   const aliasesByService: Record<string, string[]> = {};
   const wildcards: { pattern: string; target: DnsTarget }[] = [];
@@ -242,7 +254,7 @@ export function lowerIngress(project: Project): LoweredIngress {
         break;
       case "proxy": {
         const service = resolveSelf(decl.upstream.service, selfKey);
-        proxies.push({ hostname: decl.hostname, service, port: decl.upstream.port, ...(decl.upstream.http2 ? { http2: true } : {}) });
+        proxies.push({ hostname: decl.hostname, service, port: decl.upstream.port, ...(decl.upstream.http2 ? { http2: true } : {}), ...(decl.upstream.cors ? { cors: decl.upstream.cors } : {}) });
         // A proxied hostname must route to the daemon. A wildcard one can
         // only be answered by the resolver (there is no `--add-host` for a
         // pattern), so it goes in the wildcard table pointed at the ingress.
@@ -279,7 +291,7 @@ export function lowerIngress(project: Project): LoweredIngress {
     // `tls: [{ hostname, port }]` → cert + TLS-terminated reverse proxy.
     for (const entry of (svc as ServiceConfig).tls ?? []) {
       applyDecl(certificate([entry.hostname]), name);
-      applyDecl(proxy(entry.hostname, { service: name, port: entry.port, ...(entry.http2 ? { http2: true } : {}) }), name);
+      applyDecl(proxy(entry.hostname, { service: name, port: entry.port, ...(entry.http2 ? { http2: true } : {}), ...(entry.cors ? { cors: entry.cors } : {}) }), name);
     }
     // `hostnames: [h]` → plain peer alias (no daemon hop).
     for (const h of (svc as ServiceConfig).hostnames ?? []) {