Wrap a fetch so every request — redirect hops included — must resolve to
an allowed host (exact or *.wildcard, the same matcher as the
networkEgress policy) over http(s), or the call throws before the base
fetch is invoked. An empty allowlist denies everything: no declared
egress means no network.
Wrap a fetch so every request — redirect hops included — must resolve to an allowed host (exact or
*.wildcard, the same matcher as the networkEgress policy) over http(s), or the call throws before the base fetch is invoked. An empty allowlist denies everything: no declared egress means no network.