@flowwright/outbound-network

The shared outbound-network transport for FlowWright — a proxy-aware fetch, Node http/https agents, and Git proxy env, so every piece of FlowWright-owned egress (GitHub, GitLab, Vault, S3, Git) routes through the configured outbound proxy the same way. The proxy is applied per request, never installed globally.

FlowWright · Server · Worker

Use it

import { createOutboundContext } from "@flowwright/outbound-network";

const outbound = createOutboundContext(resolvedProxy /* or null for direct */);

// Proxy-aware fetch — falls back to global fetch when no proxy is configured.
const res = await outbound.fetch("https://api.github.com/user");

// Ephemeral Git proxy env for a clone/fetch; {} when direct.
const env = outbound.gitProxyEnv(repoUrl);

// Isolated probe for the admin "test connection" route.
const probe = await outbound.testConnect("https://vault.internal");

Public surface

| Area | Main exports | |---|---| | Context | createOutboundContext, OutboundContext, OutboundContextOptions, ResolvedProxy | | Matching | matchesNoProxy | | Types | OutboundTestResult, OutboundFailureCategory |

An OutboundContext exposes fetch, nodeAgents(destination), gitProxyEnv(repoUrl), classifyError, testConnect, redactionSecrets, and shutdown.

Design boundary

• The single seam for FlowWright egress — callers ask the context for a route rather than reading proxy env themselves, so proxy behavior is consistent and fail-closed.
• Never mutates global fetch/agents; the proxy is scoped per request/destination.
• Registers known proxy secrets with the log redactor; they never surface in logs.
• Browser-safe: uses a regex IP check, not node:net, so it can be shared with api-contract.

Development

$ pnpm --filter @flowwright/outbound-network typecheck
$ pnpm --filter @flowwright/outbound-network test
$ pnpm --filter @flowwright/outbound-network build

Requires Node.js 24+. Licensed under MIT.