I tried another approach, which was defining my protocol in my content security policy header:
Content-Security-Policy: connect-src myapp:; script-src 'unsafe-inline'
And then calling fetch() on "myapp://".
Safari shows an error on this:
Refused to connect to "myapp://rest of the url>" because it does not appear in the connect-src directive of the Content-Security-Policy
I've tried
Content-Security-Policy: connect-src myapp:; script-src 'unsafe-inline'
Content-Security-Policy: connect-src myapp:; script-src 'unsafe-inline'
Content-Security-Policy: connect-src myapp://; script-src 'unsafe-inline'
Content-Security-Policy: connect-src myapp://*; script-src 'unsafe-inline'
None of these work, but do produce different errors.