Interface DevtoolsRouteAccessOptions

Allow unauthenticated development requests whose URL uses a loopback hostname.

This is a deliberate local-development escape hatch, not peer authentication: a Fetch Request exposes the destination URL but not the network peer address. Only enable it when the HTTP listener is bound exclusively to loopback. It is ignored outside development.

Optional app-owned authorization check for exposed devtools routes.

Returning false hides devtools with a 404. Returning a Response lets the app provide a custom denial response. Browser requests that carry an Origin header must still be same-origin.

Whether the environment gate permits the devtools route. An access policy is still required before a request is served.