Variable: PROTECTED\_HEADERS

const PROTECTED_HEADERS: readonly string[]

Headers the gate strips UNCONDITIONALLY, before the allow-list is consulted - the platform-shaped set documented in this module’s table.

These answer WHO a request is and WHERE it came from, and on tunnel traffic only the gate may answer that: it injects token.USER_ID_HEADER / token.USER_EMAIL_HEADER itself after verifying a session, and the proxy re-derives the transport headers from the real socket.

The identity names come from the shared token constants, so a renamed wire contract cannot leave a stale spelling here. x-forwarded-preferred-username has no constant because nothing in this repo READS it - it is listed precisely so a host app that does read it cannot be fed one.