@foldrun/core 0.4.0 → 0.5.0

package/dist/src/tool-test.js

@@ -17,13 +17,15 @@
 import { spawn } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
-import { resolveSecrets } from "./secrets.js";
+import { resolveSecrets, materializeSecrets } from "./secrets.js";
 import { listAgents, workspaceDir } from "./store.js";
 import { libraryDir } from "./library.js";
 import { secretsUsedByApi } from "./api-tools.js";
+import { attachOperations, prefetchOpenApi } from "./openapi.js";
 import { commandFor, resolveRunPath } from "./script-tools.js";
 import { parseRuntime, prepareRuntime } from "./runtime.js";
 import { hostSafeEnv } from "./host-env.js";
+import { linkWorkspace, workspaceLinkEnv } from "./confine.js";
 const MAX_DETAIL = 4000;
 const TIMEOUT_MS = 15_000;
 // A tool test runs tenant-authored code directly on the host — real runs are
@@ -39,6 +41,26 @@ const hostSafeBaseEnv = () => hostSafeEnv();
 const clip = (s) => s.length > MAX_DETAIL ? `${s.slice(0, MAX_DETAIL)}\n… truncated` : s;
 /** `${NAME}` → value, for headers and query. Same rule the runtime uses. */
 const substitute = (v, env) => v.replace(/\$\{([A-Z0-9_]+)\}/g, (_, k) => env[k] ?? "");
+/**
+ * The secrets as a run would hand them over: an oauth2 or service-account
+ * secret swapped for a live access token. Without this the tester passed the
+ * stored `@oauth2 {…}` recipe itself, so every tool behind Google OAuth failed
+ * its Test button while working in every run (gbp-desk review_candidates,
+ * 2026-09-28). A refresh that fails is the tester's answer, not a throw.
+ */
+async function liveSecrets(env, ctx) {
+    try {
+        return { env: await materializeSecrets(env, ctx) };
+    }
+    catch (err) {
+        return { error: err instanceof Error ? err.message : String(err) };
+    }
+}
+/** Does a concrete path fit an operation's template (`/contacts/{id}`)? */
+function matchesTemplate(op, concrete) {
+    const re = new RegExp("^" + op.path.split(/\{[^/}]+\}/).map((part) => part.replace(/[.*+?^$()|[\]\\]/g, "\\$&")).join("[^/]+") + "$");
+    return re.test(concrete);
+}
 export async function testTool(tenant, workspace, def, input = {}) {
     const probePath = input.path ?? "";
     const started = Date.now();
@@ -46,9 +68,56 @@ export async function testTool(tenant, workspace, def, input = {}) {
     if (def.kind === "http") {
         const api = def.spec;
         const needed = secretsUsedByApi(api);
-        const { env, missing } = resolveSecrets(tenant, needed, workspace);
+        const { env: stored, missing } = resolveSecrets(tenant, needed, workspace);
+        const live = await liveSecrets(stored, { tenant, workspace });
+        if ("error" in live) {
+            return done({ ok: false, transport: "http", missingSecrets: missing, summary: "a secret could not be refreshed", detail: live.error });
+        }
+        const env = live.env;
         try {
-            const rel = probePath.startsWith("/") || probePath === "" ? probePath : `/${probePath}`;
+            let rel = probePath.startsWith("/") || probePath === "" ? probePath : `/${probePath}`;
+            let method = api.methods.includes("GET") ? "GET" : api.methods[0];
+            // An `operations:` allowlist binds the tester exactly as it binds a run:
+            // the probe may only be a GET to one of the listed operations, and an
+            // allowlist that resolves nothing is a failure, as it is in a run. A
+            // tester that reached the whole API would be the one door the allowlist
+            // left open, and would report "working" for a tool a run cannot use.
+            if (api.operations?.length) {
+                const fetched = await prefetchOpenApi(tenant, api.openapi ? [api.openapi] : []);
+                const { specs, warnings } = attachOperations([api], tenant, workspaceDir(tenant, workspace));
+                const ops = specs[0].resolvedOperations ?? [];
+                if (!ops.length) {
+                    return done({
+                        ok: false, transport: "http", missingSecrets: missing,
+                        summary: "its operations: allowlist resolved no operations, so a run gets no tools from it",
+                        detail: [...fetched, ...warnings].join("\n"),
+                    });
+                }
+                const listed = ops.map((o) => `${o.method} ${o.path}`).join("\n");
+                const gets = ops.filter((o) => o.method === "GET");
+                const pathOnly = rel.split("?")[0];
+                if (pathOnly === "") {
+                    const plain = gets.find((o) => !o.path.includes("{"));
+                    if (!plain) {
+                        return done({
+                            ok: false, transport: "http", missingSecrets: missing,
+                            summary: gets.length
+                                ? "every GET operation takes a parameter; give a path, like " + gets[0].path
+                                : "the allowlist has no GET operation, and the tester only sends GET: it will not probe a write",
+                            detail: `operations:\n${listed}`,
+                        });
+                    }
+                    rel = plain.path;
+                }
+                else if (!gets.some((o) => matchesTemplate(o, pathOnly))) {
+                    return done({
+                        ok: false, transport: "http", missingSecrets: missing,
+                        summary: "that path is not one of the tool's GET operations",
+                        detail: `path: ${pathOnly}\noperations:\n${listed}`,
+                    });
+                }
+                method = "GET";
+            }
             const url = new URL(api.base + rel);
             // Same confinement the agent gets: a probe can't reach another host.
             if (!url.href.startsWith(api.base)) {
@@ -63,7 +132,6 @@ export async function testTool(tenant, workspace, def, input = {}) {
             const headers = {};
             for (const [k, v] of Object.entries(api.headers))
                 headers[k] = substitute(v, env);
-            const method = api.methods.includes("GET") ? "GET" : api.methods[0];
             const res = await fetch(url, {
                 method,
                 headers,
@@ -162,7 +230,12 @@ export async function testTool(tenant, workspace, def, input = {}) {
             });
         }
         const names = Array.isArray(def.spec.secrets) ? def.spec.secrets.map(String) : [];
-        const { env, missing } = resolveSecrets(tenant, names, workspace);
+        const { env: stored, missing } = resolveSecrets(tenant, names, workspace);
+        const live = await liveSecrets(stored, { tenant, workspace });
+        if ("error" in live) {
+            return done({ ok: false, transport: "script", missingSecrets: missing, summary: "a secret could not be refreshed", detail: live.error });
+        }
+        const env = live.env;
         // The runtime's own choice of interpreter, not a second table beside it.
         const interpreter = typeof def.spec.interpreter === "string" ? def.spec.interpreter : undefined;
         // Declared args become long flags, exactly as the runtime passes them.
@@ -187,11 +260,25 @@ export async function testTool(tenant, workspace, def, input = {}) {
             });
         }
         const { cmd, args } = commandFor({ interpreter, run: run, name: "", description: "", args: {} }, file, toolRuntime.interpreters);
-        const { code, out } = await runOnce(cmd, [...args, ...flags], cwd, {
-            ...hostSafeBaseEnv(),
-            ...toolRuntime.env,
-            ...env,
-        });
+        // The `workspace` link a step holds, held for the test too — a tool
+        // whose code says `workspace/state/x` found nothing here while the same
+        // call worked in a flow. Only from an agent's folder: at the workspace
+        // root there is no depth for it to stand at (the note below says so).
+        const link = caller ? linkWorkspace(cwd, dir) : null;
+        let ran;
+        try {
+            ran = await runOnce(cmd, [...args, ...flags], cwd, workspaceLinkEnv({
+                ...hostSafeBaseEnv(),
+                ...toolRuntime.env,
+                ...env,
+            }, cwd));
+        }
+        finally {
+            link?.release();
+            // A private build (a concurrent one was wedged) is this test's alone.
+            toolRuntime.dispose?.();
+        }
+        const { code, out } = ran;
         // A script that needs arguments and got none has not failed — it has not
         // been tested. Saying "exited 2" would send someone looking for a bug.
         const untested = code !== 0 && declared.length > 0 && flags.length === 0;
@@ -204,7 +291,7 @@ export async function testTool(tenant, workspace, def, input = {}) {
                 : code === 0 ? "exited 0" : `exited ${code ?? "with an error"}`,
             detail: clip((caller
                 ? `ran from agents/${caller.name}/, where a run runs\n\n`
-                : `ran from the workspace root — there is no agent to stand in for, so a script that reaches ../../ will look one level too high\n\n`) +
+                : `ran from the workspace root — there is no agent to stand in for, so a script that reaches workspace/ or ../../ will not find the workspace there\n\n`) +
                 (out || "(no output)")),
         });
     }
@@ -241,7 +328,12 @@ export async function testTool(tenant, workspace, def, input = {}) {
     const named = Object.entries(spec.env ?? {})
         .map(([, v]) => String(v).match(/^\$\{([A-Z0-9_]+)\}$/)?.[1])
         .filter((n) => Boolean(n));
-    const { env, missing } = resolveSecrets(tenant, named, workspace);
+    const { env: stored, missing } = resolveSecrets(tenant, named, workspace);
+    const live = await liveSecrets(stored, { tenant, workspace });
+    if ("error" in live) {
+        return done({ ok: false, transport: "mcp", missingSecrets: missing, summary: "a secret could not be refreshed", detail: live.error });
+    }
+    const env = live.env;
     const childEnv = { ...hostSafeBaseEnv() };
     for (const [k, v] of Object.entries(spec.env ?? {}))
         childEnv[k] = substitute(String(v), env);

package/dist/src/translator.d.ts

@@ -22,6 +22,9 @@ export interface TranslatorSpec {
      *  upstream request goes through it, and `upstreamKey` is a placeholder
      *  the proxy fills. */
     egress?: string;
+    /** The step's own zone, from the clock cascade — what a reset time in a
+     *  refusal is told in. UTC when nothing said otherwise. */
+    timezone?: string;
 }
 export interface RunningTranslator {
     port: number;
@@ -81,7 +84,7 @@ export declare function toResponses(req: Json, opts: {
     params?: Record<string, unknown>;
 }, drop?: Dropped): Json;
 /** A finished Chat Completion as an Anthropic message. Pure. */
-export declare function fromChatCompletion(res: Json, requestedModel: string): Json;
+export declare function fromChatCompletion(res: Json, requestedModel: string, stopSequences?: unknown): Json;
 /**
  * The streaming half: Chat-Completions chunks in, Anthropic SSE events out.
  * A state machine because the two streams disagree about structure — one
@@ -95,11 +98,13 @@ export declare class StreamTranslator {
     private textIndex;
     /** Chat-Completions tool index → Anthropic block index. */
     private tools;
+    /** The last choice's stop fields: finish_reason and any matched stop. */
     private finish;
     private usage;
     private id;
     private readonly model;
-    constructor(model: string);
+    private readonly stops;
+    constructor(model: string, stopSequences?: unknown);
     private event;
     private start;
     private closeText;
@@ -125,6 +130,7 @@ export declare class ResponsesStreamTranslator {
     private usage;
     private incomplete;
     private sawTool;
+    private sawRefusal;
     private id;
     private readonly model;
     constructor(model: string);

package/dist/src/translator.js

@@ -30,6 +30,7 @@ import crypto from "node:crypto";
 import { PROTECTED_PARAMS } from "./providers.js";
 import { viaEgress } from "./egress.js";
 import { trimSlashes } from "./paths.js";
+import { captureRefusalHeaders, isRefusalStatus, refusalLine } from "./refusal.js";
 function dropped() {
     const seen = new Set();
     return {
@@ -391,17 +392,42 @@ export function toResponses(req, opts, drop = dropped()) {
     }
     return out;
 }
-// ------------------------------------------------------- response mapping
-function stopReason(finish) {
-    switch (finish) {
-        case "tool_calls":
-        case "function_call":
-            return "tool_use";
-        case "length":
-            return "max_tokens";
-        default:
-            return "end_turn";
-    }
+/**
+ * Why a Chat Completion stopped, in Anthropic's words. `content_filter`
+ * (OpenAI, Azure, Gemini's safety block) is a refusal; Mistral's
+ * `model_length` is the context window filling, not max_tokens. A stop
+ * sequence is named only where the provider says which one matched — vLLM
+ * as `stop_reason`, SGLang as `matched_stop` — and only when it is one the
+ * request asked for; plain OpenAI says `stop` either way, which reads as
+ * end_turn. pause_turn has no counterpart: server-side tools are dropped.
+ */
+function chatStop(choice, sawTool, stops) {
+    const finish = choice.finish_reason;
+    if (finish === "content_filter")
+        return { reason: "refusal", sequence: null };
+    if (finish === "length")
+        return { reason: "max_tokens", sequence: null };
+    if (finish === "model_length")
+        return { reason: "model_context_window_exceeded", sequence: null };
+    if (sawTool || finish === "tool_calls" || finish === "function_call")
+        return { reason: "tool_use", sequence: null };
+    const matched = typeof choice.stop_reason === "string" ? choice.stop_reason : choice.matched_stop;
+    if (typeof matched === "string" && stops.includes(matched))
+        return { reason: "stop_sequence", sequence: matched };
+    return { reason: "end_turn", sequence: null };
+}
+/** Why a Response stopped: a refusal part or a content filter is a refusal. */
+function responsesStop(incomplete, sawTool, sawRefusal) {
+    if (sawRefusal || incomplete === "content_filter")
+        return "refusal";
+    if (incomplete === "max_output_tokens")
+        return "max_tokens";
+    if (sawTool)
+        return "tool_use";
+    return "end_turn";
+}
+function stopList(stops) {
+    return Array.isArray(stops) ? stops.filter((s) => typeof s === "string") : [];
 }
 function parseArgs(raw) {
     if (typeof raw !== "string" || !raw.trim())
@@ -414,7 +440,7 @@ function parseArgs(raw) {
     }
 }
 /** A finished Chat Completion as an Anthropic message. Pure. */
-export function fromChatCompletion(res, requestedModel) {
+export function fromChatCompletion(res, requestedModel, stopSequences) {
     const choice = (res.choices ?? [])[0] ?? {};
     const msg = choice.message ?? {};
     const content = [];
@@ -431,14 +457,15 @@ export function fromChatCompletion(res, requestedModel) {
         });
     }
     const usage = res.usage ?? {};
+    const stop = chatStop(choice, content.some((c) => c.type === "tool_use"), stopList(stopSequences));
     return {
         id: String(res.id ?? `msg_${crypto.randomBytes(8).toString("hex")}`),
         type: "message",
         role: "assistant",
         model: String(res.model ?? requestedModel),
         content,
-        stop_reason: stopReason(choice.finish_reason),
-        stop_sequence: null,
+        stop_reason: stop.reason,
+        stop_sequence: stop.sequence,
         usage: {
             input_tokens: Number(usage.prompt_tokens ?? 0),
             output_tokens: Number(usage.completion_tokens ?? 0),
@@ -458,12 +485,15 @@ export class StreamTranslator {
     textIndex = null;
     /** Chat-Completions tool index → Anthropic block index. */
     tools = new Map();
-    finish = null;
+    /** The last choice's stop fields: finish_reason and any matched stop. */
+    finish = {};
     usage = null;
     id = `msg_${crypto.randomBytes(8).toString("hex")}`;
     model;
-    constructor(model) {
+    stops;
+    constructor(model, stopSequences) {
         this.model = model;
+        this.stops = stopList(stopSequences);
     }
     event(name, data) {
         return `event: ${name}\ndata: ${JSON.stringify(data)}\n\n`;
@@ -508,7 +538,7 @@ export class StreamTranslator {
         if (!choice)
             return out;
         if (choice.finish_reason)
-            this.finish = choice.finish_reason;
+            this.finish = { finish_reason: choice.finish_reason, stop_reason: choice.stop_reason, matched_stop: choice.matched_stop };
         const delta = choice.delta ?? {};
         const text = typeof delta.content === "string" ? delta.content : "";
         if (text) {
@@ -575,10 +605,10 @@ export class StreamTranslator {
             }
             out.push(this.event("content_block_stop", { type: "content_block_stop", index: entry.block }));
         }
-        const reason = this.tools.size && this.finish !== "length" ? "tool_use" : stopReason(this.finish);
+        const stop = chatStop(this.finish, this.tools.size > 0, this.stops);
         out.push(this.event("message_delta", {
             type: "message_delta",
-            delta: { stop_reason: reason, stop_sequence: null },
+            delta: { stop_reason: stop.reason, stop_sequence: stop.sequence },
             usage: { input_tokens: this.usage?.input ?? 0, output_tokens: this.usage?.output ?? 0 },
         }));
         out.push(this.event("message_stop", { type: "message_stop" }));
@@ -608,7 +638,8 @@ export function fromResponses(res, requestedModel) {
     }
     const usage = res.usage ?? {};
     const incomplete = res.incomplete_details?.reason;
-    const stop = content.some((c) => c.type === "tool_use") ? "tool_use" : incomplete === "max_output_tokens" ? "max_tokens" : "end_turn";
+    const refused = (Array.isArray(res.output) ? res.output : []).some((item) => item.type === "message" && Array.isArray(item.content) && item.content.some((c) => c.type === "refusal"));
+    const stop = responsesStop(incomplete, content.some((c) => c.type === "tool_use"), refused);
     return {
         id: String(res.id ?? `msg_${crypto.randomBytes(8).toString("hex")}`),
         type: "message",
@@ -638,6 +669,7 @@ export class ResponsesStreamTranslator {
     usage = null;
     incomplete = null;
     sawTool = false;
+    sawRefusal = false;
     id = `msg_${crypto.randomBytes(8).toString("hex")}`;
     model;
     constructor(model) {
@@ -700,6 +732,8 @@ export class ResponsesStreamTranslator {
         if (type === "response.output_text.delta" || type === "response.refusal.delta") {
             const entry = this.blocks.get(Number(ev.output_index));
             const text = String(ev.delta ?? "");
+            if (type === "response.refusal.delta")
+                this.sawRefusal = true;
             if (entry && entry.kind === "text" && text) {
                 out.push(this.event("content_block_delta", { type: "content_block_delta", index: entry.block, delta: { type: "text_delta", text } }));
             }
@@ -752,7 +786,7 @@ export class ResponsesStreamTranslator {
             }
             out.push(this.event("content_block_stop", { type: "content_block_stop", index: entry.block }));
         }
-        const reason = this.sawTool && this.incomplete !== "max_output_tokens" ? "tool_use" : this.incomplete === "max_output_tokens" ? "max_tokens" : "end_turn";
+        const reason = responsesStop(this.incomplete, this.sawTool, this.sawRefusal);
         out.push(this.event("message_delta", {
             type: "message_delta",
             delta: { stop_reason: reason, stop_sequence: null },
@@ -873,6 +907,18 @@ export async function startTranslator(spec) {
                 const text = await upstream.text();
                 const message = upstreamMessage(text, upstream.status);
                 log.push(`POST ${label} → ${upstream.status} (${Date.now() - started}ms): ${message.slice(0, 160)}`);
+                // The refusal in words, from the headers the response already
+                // carried. Only on a refusal, and only the allow-listed headers:
+                // a 400 about a malformed body is the work's problem, not the
+                // supply's, and explaining it as one would mislead.
+                if (isRefusalStatus(upstream.status)) {
+                    log.push(refusalLine({
+                        status: upstream.status,
+                        headers: captureRefusalHeaders(upstream.headers),
+                        timezone: spec.timezone,
+                        provider: label,
+                    }));
+                }
                 // The status crosses unchanged, so a 401 or 429 from the provider
                 // reads as one to the SDK — and to the fallback decision upstream.
                 return send(upstream.status, errorBody(upstream.status, message));
@@ -888,10 +934,10 @@ export async function startTranslator(spec) {
                     return send(502, errorBody(502, `translator: ${label} answered with something that is not JSON`));
                 }
                 log.push(`POST ${label} → 200 (${Date.now() - started}ms, ${model})`);
-                return send(200, JSON.stringify(responses ? fromResponses(parsed, model) : fromChatCompletion(parsed, model)));
+                return send(200, JSON.stringify(responses ? fromResponses(parsed, model) : fromChatCompletion(parsed, model, body.stop_sequences)));
             }
             res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", connection: "keep-alive" });
-            const machine = responses ? new ResponsesStreamTranslator(model) : new StreamTranslator(model);
+            const machine = responses ? new ResponsesStreamTranslator(model) : new StreamTranslator(model, body.stop_sequences);
             const reader = upstream.body?.getReader();
             if (!reader) {
                 for (const e of machine.finishStream())

package/dist/src/trigger-log.d.ts

@@ -1,7 +1,7 @@
 /** What became of one trigger firing. `started` is here too: without it the
  *  log answers "why did nothing run" and not "how often does anything",
  *  and the ratio is the whole point of the page. */
-export type TriggerOutcome = "started" | "duplicate" | "throttled" | "debounced" | "quarantined" | "overlap-skipped" | "missed" | "failed";
+export type TriggerOutcome = "started" | "duplicate" | "throttled" | "debounced" | "quarantined" | "paused" | "overlap-skipped" | "missed" | "failed";
 export interface TriggerEvent {
     t: string;
     flow: string;

package/dist/src/triggers.d.ts

@@ -1,6 +1,9 @@
 import { type FlowInfo, type FlowStep, type RunRecord } from "./store.ts";
 /** Staple a payload to the first step, the way the run route staples a task. */
 export declare function withTask(steps: FlowStep[], tag: string, body: string): FlowStep[];
+/** Which `on:` a settled run answers to: failed, blocked (completed, but
+ *  its work refused itself), or completed. */
+export declare function endingOf(run: RunRecord): "completed" | "failed" | "blocked";
 /** The flows a finished run should start, by this workspace's own files. */
 export declare function chainedFlows(tenant: string, workspace: string, finished: RunRecord): FlowInfo[];
 /**

package/dist/src/triggers.js

@@ -13,7 +13,7 @@
 // an agent reads it — the same rule as every other handoff in the format.
 import crypto from "node:crypto";
 import { platform } from "./platform.js";
-import { listFlows, readRun } from "./store.js";
+import { listFlows, readRun, runVerdict } from "./store.js";
 import { getSecret } from "./secrets.js";
 /** The last step's result — the same reading runner.ts makes, kept local so
  *  this module never imports the runner (the queue imports both). */
@@ -33,6 +33,13 @@ export function withTask(steps, tag, body) {
     return steps.map((s, i) => (i === 0 ? { ...s, instruction: `${s.instruction}\n\n<${tag}>\n${text}\n</${tag}>` } : s));
 }
 // ------------------------------------------------------------ trigger: flow
+/** Which `on:` a settled run answers to: failed, blocked (completed, but
+ *  its work refused itself), or completed. */
+export function endingOf(run) {
+    if (run.status === "failed")
+        return "failed";
+    return runVerdict(run) === "BLOCKED" ? "blocked" : "completed";
+}
 /** The flows a finished run should start, by this workspace's own files. */
 export function chainedFlows(tenant, workspace, finished) {
     if (finished.status !== "completed" && finished.status !== "failed")
@@ -45,7 +52,7 @@ export function chainedFlows(tenant, workspace, finished) {
         // A flow chained on itself is a loop with no bound — refused here and
         // by foldrun check, never started.
         f.name !== finished.flow &&
-        (f.on === "any" || f.on === finished.status));
+        (f.on === "any" || f.on === endingOf(finished)));
 }
 /**
  * Start every flow chained on a run that just settled. The finished run's
@@ -61,6 +68,7 @@ export async function fireChainedFlows(tenant, workspace, finished) {
     const started = [];
     const result = (runResult(finished) ?? "").slice(0, 20_000);
     const body = `run: ${finished.id}\nflow: ${finished.flow}\nstatus: ${finished.status}\n` +
+        (runVerdict(finished) ? `verdict: ${runVerdict(finished)}\n` : "") +
         (finished.summary ? `summary: ${finished.summary}\n` : "") +
         (result ? `\n${result}` : "");
     for (const flow of flows) {

package/dist/src/untrusted-fetch.d.ts

@@ -0,0 +1,11 @@
+/** How many redirects one request may follow. fetch's own limit is 20;
+ *  nothing a tenant points the platform at needs more than a couple. */
+export declare const MAX_REDIRECTS = 5;
+export declare class RedirectRefused extends Error {
+    constructor(message: string);
+}
+export declare function fetchUntrusted(url: string, init?: RequestInit, opts?: {
+    /** The request carries a credential (in its body or its headers):
+     *  follow a redirect only within the origin it was sent to. */
+    sameOrigin?: boolean;
+}): Promise<Response>;

package/dist/src/untrusted-fetch.js

@@ -0,0 +1,77 @@
+// fetch() for a URL a tenant chose, redirects included.
+//
+// platform.fetchUntrusted is the seam: on a platform it refuses private and
+// cluster addresses (by name, by IP literal, and at connect time through a
+// guarded DNS lookup). But it was handed fetch's default `redirect:
+// "follow"`, and a redirect is followed inside fetch, past the seam: a
+// public host answering `302 Location: http://169.254.169.254/…` sent the
+// platform to the metadata endpoint, because an IP literal never reaches the
+// DNS lookup the connect-time guard lives in. And the OAuth token POSTs
+// carried a client secret to wherever a 307 pointed.
+//
+// So redirects are followed here, one hop at a time, each hop through the
+// seam again — every address a request ends up at is checked the same way
+// the first one was. A hop to another origin keeps only the headers that
+// cannot carry a credential, and a caller whose request IS a credential
+// (a token exchange, a provider key in a header) follows none at all.
+import { platform } from "./platform.js";
+/** How many redirects one request may follow. fetch's own limit is 20;
+ *  nothing a tenant points the platform at needs more than a couple. */
+export const MAX_REDIRECTS = 5;
+const REDIRECT = new Set([301, 302, 303, 307, 308]);
+/** Headers that may cross to another origin: none of them can carry a
+ *  credential. Everything else — Authorization, a cookie, an x-api-key, a
+ *  webhook's signature — stays with the origin it was meant for. */
+const CROSS_ORIGIN_SAFE = new Set(["accept", "accept-language", "content-type", "user-agent"]);
+export class RedirectRefused extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "RedirectRefused";
+    }
+}
+export async function fetchUntrusted(url, init = {}, opts = {}) {
+    let current = url;
+    let req = { ...init };
+    for (let hop = 0;; hop++) {
+        const res = await platform.fetchUntrusted(current, { ...req, redirect: "manual" });
+        const location = REDIRECT.has(res.status) ? res.headers.get("location") : null;
+        if (!location)
+            return res;
+        // The body of a redirect is never read; free the socket.
+        await res.body?.cancel().catch(() => { });
+        if (hop >= MAX_REDIRECTS)
+            throw new RedirectRefused(`${url}: more than ${MAX_REDIRECTS} redirects — not followed`);
+        let next;
+        try {
+            next = new URL(location, current);
+        }
+        catch {
+            throw new RedirectRefused(`${current} redirected to "${location}", which is not a URL`);
+        }
+        if (next.protocol !== "https:" && next.protocol !== "http:") {
+            throw new RedirectRefused(`${current} redirected to a ${next.protocol} URL — not followed`);
+        }
+        const from = new URL(current);
+        const crossOrigin = next.origin !== from.origin;
+        if (crossOrigin && opts.sameOrigin) {
+            throw new RedirectRefused(`${from.origin} redirected to ${next.origin} — not followed: this request carries a credential, and it goes only where it was sent`);
+        }
+        // fetch's own rewrite: a 303, and a 301/302 answering a POST, is
+        // followed as a GET with no body; a 307/308 repeats the request as it was.
+        const method = (req.method ?? "GET").toUpperCase();
+        const headers = new Headers(req.headers);
+        if ((res.status === 303 && method !== "GET" && method !== "HEAD") || ((res.status === 301 || res.status === 302) && method === "POST")) {
+            req = { ...req, method: "GET", body: undefined };
+            headers.delete("content-type");
+        }
+        if (crossOrigin) {
+            const names = [];
+            headers.forEach((_, name) => names.push(name));
+            for (const name of names)
+                if (!CROSS_ORIGIN_SAFE.has(name))
+                    headers.delete(name);
+        }
+        req = { ...req, headers };
+        current = next.toString();
+    }
+}