AddressPolicy

Defined in: packages/tools/src/web/address-policy.ts:46

Properties

allowedDomains?

optional allowedDomains?: readonly string[]

Defined in: packages/tools/src/web/address-policy.ts:61

Hostname allowlist, same pattern language as bash/ASRT allowedDomains. Omitted means no allowlist (any host, still subject to deniedDomains and the address checks). Empty denies every host. "*" allows any host. Applied to the initial URL and every redirect hop, before the private-address checks.

---

allowedUrls?

optional allowedUrls?: readonly UrlPattern[]

Defined in: packages/tools/src/web/address-policy.ts:54

URL patterns (glob strings and/or RegExps — see url-pattern.ts) that may bypass both address checks when the matching pattern names a concrete host. Host-unrestricted patterns (whole-pattern wildcards, host labels that are only wildcards, a broad RegExp) do not bypass — set allowPrivateNetwork for that. Empty by default. Matched per redirect hop against urlMatchCandidate.

---

allowPrivateNetwork?

optional allowPrivateNetwork?: boolean

Defined in: packages/tools/src/web/address-policy.ts:73

Disables both address checks entirely. Default false. Checked at the same decision point as a concrete-host allowedUrls match (not a second enforcement path) — see README.md’s “allowPrivateNetwork” section. Host/workflow-only, like allowedUrls; never exposed on fetchUrl’s input schema.

---

deniedDomains?

optional deniedDomains?: readonly string[]

Defined in: packages/tools/src/web/address-policy.ts:66

Hostname denylist, same pattern language as bash/ASRT deniedDomains. A match denies even when allowedDomains would have allowed the host.

---

resolver?

optional resolver?: HostnameResolver

Defined in: packages/tools/src/web/address-policy.ts:75

Hostname resolver, defaulting to node:dns’ lookup(..., { all: true }).