columna API reference - v0.4.0
    Preparing search index...

    Type Alias IoPolicy

    Boundaries for network / filesystem loads. Set once for the process with setIoPolicy() and / or per call; a load must satisfy both (per-call options narrow, never widen).

    type IoPolicy = {
        allowedDirs?: string[];
        allowedHosts?: string[];
        allowedProtocols?: ("http:" | "https:")[];
        denyPrivateHosts?: boolean;
        fetch?: typeof fetch;
        maxBytes?: number;
        maxRedirects?: number;
        resolveHost?: (hostname: string) => Promise<string[] | null>;
        signal?: AbortSignal;
        timeoutMs?: number;
    }
    Index
    allowedDirs? allowedHosts? allowedProtocols? denyPrivateHosts? fetch? maxBytes? maxRedirects? resolveHost? signal? timeoutMs?
    allowedDirs?: string[]

    Directories a path may live in (real paths are compared, so symlinks cannot escape).

    allowedHosts?: string[]

    Hostnames a URL may point to: exact (api.example.com), with port (host:8443) or wildcard (*.example.com).

    allowedProtocols?: ("http:" | "https:")[]

    Default ['http:', 'https:']. file:// URLs are filesystem reads and follow allowedDirs instead.

    denyPrivateHosts?: boolean

    Reject loopback / RFC 1918 / link-local / ULA / cloud-metadata hosts. The name is checked first (literal IPs, localhost, *.internal, …); then, on Node, the hostname is resolved (dns.lookup, every address) before each request and every hop of a redirect, and a public name that resolves to a private address is refused too. What this does not do is pin the connection to the checked address — a server that answers with a public address first and a private one on the next lookup (DNS rebinding TOCTOU) needs fetch built on a pinned dispatcher (see SECURITY.md) or an egress proxy. Browsers cannot resolve names; there only the name check applies.

    fetch?: typeof fetch

    Custom fetch (proxy, DNS pinning, auth); receives (url, { redirect: 'manual', signal }).

    maxBytes?: number

    Maximum payload size in bytes; responses are read incrementally and cut off past the cap.

    maxRedirects?: number

    Maximum redirect hops for URL loads (default 5); every hop is checked against the policy.

    resolveHost?: (hostname: string) => Promise<string[] | null>

    Resolver used by denyPrivateHosts (default on Node: dns.promises.lookup(host, { all: true })). Return every address the connection may use; null skips the address check for that host.

    signal?: AbortSignal

    Caller-owned cancellation.

    timeoutMs?: number

    Abort the load after this many milliseconds.

    Settings
    Member Visibility

    On This Page
    Properties