deepline 0.1.109 → 0.1.110

package/dist/repo/shared_libs/play-runtime/run-ledger.ts

@@ -549,22 +549,17 @@ function appendLogLines(
 
 /**
  * Terminal-status precedence. Re-delivery of the same terminal status is a
- * benign no-op handled by the regular reduction. A terminal event that
- * disagrees with an already-terminal snapshot is ignored (keeping e.g. an
- * explicit user cancellation from being flipped to completed by a late
- * worker terminal), and the conflict is recorded as one anomaly log line —
- * with ONE exception: `run.failed` DEMOTES a `completed` snapshot. The
- * worker appends run.completed BEFORE awaiting post-completion accounting
- * (compute billing finalize), so a billing business denial there — e.g. the
- * per-run credit cap (maxCreditsPerRun) — arrives as a later run.failed
- * that MUST fail the run. Blanket first-terminal-wins silently completed
- * capped runs (regression pinned by
- * tests/v2-plays/plays/44-compute-billing-cap.play.ts). A cancelled run
- * stays cancelled, and a failed run can never be flipped to completed.
+ * benign no-op handled by the regular reduction. Conflicting terminal events
+ * use newest-terminal-wins by event time: older events are ignored and logged,
+ * newer events reconcile the snapshot. This is the idempotency model callers
+ * expect when duplicate/retried work completes out of order. It also preserves
+ * post-completion billing cap demotion because that denial arrives as a newer
+ * run.failed event.
  */
 function conflictingTerminalSnapshot(
   base: PlayRunLedgerSnapshot,
   eventType: keyof typeof TERMINAL_STATUS_BY_EVENT_TYPE,
+  occurredAt: number,
 ): PlayRunLedgerSnapshot | null {
   if (!isTerminalPlayRunLedgerStatus(base.status)) {
     return null;
@@ -572,14 +567,16 @@ function conflictingTerminalSnapshot(
   if (TERMINAL_STATUS_BY_EVENT_TYPE[eventType] === base.status) {
     return null;
   }
-  if (base.status === 'completed' && eventType === 'run.failed') {
-    // Post-completion accounting demotion (e.g. per-run billing cap denial):
-    // let the regular run.failed reduction flip the run to failed.
+  const terminalAt = base.finishedAt ?? base.updatedAt ?? 0;
+  if (occurredAt > terminalAt) {
+    // Newer terminal evidence reconciles the run. This covers replay/receipt
+    // races where an earlier attempt failed but a later attempt recovered and
+    // completed with the durable result.
     return null;
   }
   return withTiming(
     appendLogLines(base, [
-      `[ledger] conflicting terminal event ${eventType} ignored; status already ${base.status}`,
+      `[ledger] stale conflicting terminal event ${eventType} ignored; status already ${base.status}`,
     ]),
   );
 }
@@ -617,6 +614,23 @@ function settleRunningStepsOnTerminal(
   return changed ? { ...snapshot, stepsById } : snapshot;
 }
 
+function terminalFinishedAt(
+  base: PlayRunLedgerSnapshot,
+  eventType: keyof typeof TERMINAL_STATUS_BY_EVENT_TYPE,
+  occurredAt: number,
+): number {
+  const nextStatus = TERMINAL_STATUS_BY_EVENT_TYPE[eventType];
+  const terminalAt = base.finishedAt ?? base.updatedAt ?? 0;
+  if (
+    isTerminalPlayRunLedgerStatus(base.status) &&
+    nextStatus !== base.status &&
+    occurredAt > terminalAt
+  ) {
+    return occurredAt;
+  }
+  return base.finishedAt ?? occurredAt;
+}
+
 export function reducePlayRunLedgerEvent(
   snapshot: PlayRunLedgerSnapshot,
   event: PlayRunLedgerEvent,
@@ -654,52 +668,46 @@ export function reducePlayRunLedgerEvent(
       });
     case 'run.completed':
       return (
-        conflictingTerminalSnapshot(base, event.type) ??
-        withTiming(
-          {
-            ...settleRunningStepsOnTerminal(base, 'completed', occurredAt),
-            status: 'completed',
-            error: null,
-            startedAt: base.startedAt ?? occurredAt,
-            finishedAt: base.finishedAt ?? occurredAt,
-            activeStepId: null,
-            activeArtifactTableNamespace: null,
-            result: event.result ?? base.result,
-            resultSummary: event.resultSummary ?? base.resultSummary,
-          },
-        )
+        conflictingTerminalSnapshot(base, event.type, occurredAt) ??
+        withTiming({
+          ...settleRunningStepsOnTerminal(base, 'completed', occurredAt),
+          status: 'completed',
+          error: null,
+          startedAt: base.startedAt ?? occurredAt,
+          finishedAt: terminalFinishedAt(base, event.type, occurredAt),
+          activeStepId: null,
+          activeArtifactTableNamespace: null,
+          result: event.result ?? base.result,
+          resultSummary: event.resultSummary ?? base.resultSummary,
+        })
       );
     case 'run.failed':
       return (
-        conflictingTerminalSnapshot(base, event.type) ??
-        withTiming(
-          {
-            ...settleRunningStepsOnTerminal(base, 'failed', occurredAt),
-            status: 'failed',
-            error: event.error ?? base.error ?? null,
-            startedAt: base.startedAt ?? occurredAt,
-            finishedAt: base.finishedAt ?? occurredAt,
-            activeStepId: null,
-            activeArtifactTableNamespace: null,
-            result: event.result ?? base.result,
-          },
-        )
+        conflictingTerminalSnapshot(base, event.type, occurredAt) ??
+        withTiming({
+          ...settleRunningStepsOnTerminal(base, 'failed', occurredAt),
+          status: 'failed',
+          error: event.error ?? base.error ?? null,
+          startedAt: base.startedAt ?? occurredAt,
+          finishedAt: terminalFinishedAt(base, event.type, occurredAt),
+          activeStepId: null,
+          activeArtifactTableNamespace: null,
+          result: event.result ?? base.result,
+        })
       );
     case 'run.cancelled':
       return (
-        conflictingTerminalSnapshot(base, event.type) ??
-        withTiming(
-          {
-            ...settleRunningStepsOnTerminal(base, 'failed', occurredAt),
-            status: 'cancelled',
-            error: event.error ?? base.error ?? null,
-            startedAt: base.startedAt ?? occurredAt,
-            finishedAt: base.finishedAt ?? occurredAt,
-            activeStepId: null,
-            activeArtifactTableNamespace: null,
-            result: event.result ?? base.result,
-          },
-        )
+        conflictingTerminalSnapshot(base, event.type, occurredAt) ??
+        withTiming({
+          ...settleRunningStepsOnTerminal(base, 'failed', occurredAt),
+          status: 'cancelled',
+          error: event.error ?? base.error ?? null,
+          startedAt: base.startedAt ?? occurredAt,
+          finishedAt: terminalFinishedAt(base, event.type, occurredAt),
+          activeStepId: null,
+          activeArtifactTableNamespace: null,
+          result: event.result ?? base.result,
+        })
       );
     case 'log.appended':
       return withTiming(
@@ -927,6 +935,20 @@ export function slicePositionalLogLines(input: {
   return { lines: [...lines], channelOffset: sendFromOffset };
 }
 
+function terminalLogReplayChannelOffset(input: {
+  liveLogTotalCount?: number;
+  liveLogsLength: number;
+}): number | null {
+  if (
+    typeof input.liveLogTotalCount !== 'number' ||
+    !Number.isFinite(input.liveLogTotalCount) ||
+    input.liveLogTotalCount < input.liveLogsLength
+  ) {
+    return null;
+  }
+  return input.liveLogTotalCount - input.liveLogsLength;
+}
+
 /**
  * Forward producer log lines as one `log.appended` event.
  *
@@ -968,6 +990,35 @@ export function buildPlayRunLedgerEventsFromLogLines(input: {
   ];
 }
 
+/**
+ * Re-send a terminal retained log tail through terminal transport recovery.
+ *
+ * Live worker flushes use positional channel offsets. Terminal replay is a
+ * different transport: it replays the runner's retained output after terminal
+ * state is known. When the producer knows the retained tail's offset, Convex
+ * uses that offset only to bound occurrence-count reconciliation to the same
+ * tail window; it does not route the replay through the worker cursor.
+ */
+export function buildTerminalLogReplayEvents(input: {
+  runId: string;
+  lines: readonly string[];
+  source?: PlayRunLedgerEventSource;
+  occurredAt?: number;
+  liveLogTotalCount?: number;
+}): PlayRunLedgerEvent[] {
+  const channelOffset = terminalLogReplayChannelOffset({
+    liveLogTotalCount: input.liveLogTotalCount,
+    liveLogsLength: input.lines.length,
+  });
+  return buildPlayRunLedgerEventsFromLogLines({
+    runId: input.runId,
+    lines: input.lines,
+    source: 'coordinator',
+    occurredAt: input.occurredAt,
+    channelOffset,
+  });
+}
+
 export function buildPlayRunLedgerEventsFromStatusPatch(input: {
   patch: PlayRunLedgerStatusPatch;
   previousSnapshot: PlayRunLedgerSnapshot;

package/dist/repo/shared_libs/play-runtime/scheduler-backend.ts

@@ -4,8 +4,8 @@
  * One of three pluggable axes (alongside runner-backends and dedup-backends).
  * Selected per-run via PlayExecutionProfile.
  *
- * Temporal is the existing production scheduler. Cloudflare Workflows is the
- * edge scheduler used by the workers_edge profile.
+ * Cloudflare Workflows is the default production scheduler through the
+ * workers_edge profile. Hatchet is selected explicitly by the hatchet profile.
  *
  * Customer plays are unaffected — this is purely the orchestration layer.
  */
@@ -18,6 +18,7 @@ import type {
 import type { ExecutionPlan } from './execution-plan';
 import type { PlayRuntimeManifestMap } from '../plays/compiler-manifest';
 import type { PreloadedRuntimeDbSession } from './db-session';
+import type { PlayRunnerRuntimeTiming } from './protocol';
 
 export const PLAY_SCHEDULER_BACKENDS = {
   temporal: 'temporal',
@@ -195,6 +196,7 @@ export type PlaySchedulerResultEnvelope = {
   finalCheckpoint?: PlayCheckpoint;
   totalRows?: number;
   durationMs?: number;
+  runtimeTiming?: PlayRunnerRuntimeTiming;
 };
 
 export interface PlaySchedulerBackend {

package/dist/repo/shared_libs/play-runtime/secret-redaction.ts

@@ -7,8 +7,12 @@ const PRIVATE_KEY_RE =
   /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 const COMMON_SECRET_RE =
   /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs]|key|token|secret|api[_-]?key)[A-Za-z0-9_./+=:-]{12,}\b/gi;
+const URL_SECRET_VALUE_RE =
+  /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
 const HIGH_ENTROPY_ASSIGNMENT_RE =
   /\b(?:api[_-]?key|token|secret|password|authorization|access[_-]?token|refresh[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
+const SENSITIVE_URL_PARAM_RE =
+  /[?#&](?:\w*(?:key|token)|secret|password|authorization|credential|signature|sig)(?:=|$)/i;
 
 function escapeRegExp(value: string): string {
   return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -19,6 +23,17 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 }
 
 export function redactSecretLikeString(value: string): string {
+  const trimmed = value.trim();
+  if (/^https?:\/\/\S+$/i.test(trimmed)) {
+    if (
+      /^https?:\/\/[^/?#@]+@/i.test(trimmed) ||
+      SENSITIVE_URL_PARAM_RE.test(trimmed)
+    ) {
+      return SECRET_REDACTION_PLACEHOLDER;
+    }
+    if (!URL_SECRET_VALUE_RE.test(value)) return value;
+  }
+
   return value
     .replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER)
     .replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`)

package/dist/repo/shared_libs/play-runtime/work-receipts.ts

@@ -17,6 +17,7 @@ export type WorkReceiptCommand = {
   playName: string;
   runId: string;
   key: string;
+  reclaimRunning?: boolean;
 };
 
 export type WorkReceiptClaim =

package/dist/repo/shared_libs/plays/bundling/index.ts

@@ -96,6 +96,7 @@ export type PlayBundlingAdapter = {
   sdkWorkersEntryFile: string;
   workersHarnessEntryFile: string;
   workersHarnessFilesDir: string;
+  workersRuntimeFingerprintDirs?: string[];
   discoverPackagedLocalFiles(
     filePath: string,
   ): Promise<PlayLocalFileDiscoveryResult>;
@@ -1063,19 +1064,69 @@ async function analyzeSourceGraph(
 }
 
 /**
- * Fingerprint of every TypeScript file in the Workers harness source dir.
- * The harness gets bundled INTO every esm_workers play artifact, so any
- * harness edit must invalidate the bundle cache and force a fresh CF
- * deploy. Computed fresh on every bundle call so dev edits to entry.ts (or
- * its peer DO files) are picked up on the next `play run` without
- * restarting the dev server. (4 small files = sub-millisecond.) No
- * caching: that's deliberate — caching the fingerprint is exactly the
- * stale-state bug this exists to prevent.
+ * Fingerprint of Worker runtime sources bundled into every esm_workers play
+ * artifact. Harness, shared runtime, or provider-owned batching edits must
+ * invalidate the bundle cache and force a fresh CF deploy. Computed fresh on
+ * every bundle call so dev edits are picked up on the next `play run` without
+ * restarting the dev server. No caching: that's deliberate — caching the
+ * fingerprint is exactly the stale-state bug this exists to prevent.
  */
 async function computeWorkersHarnessFingerprintWithAdapter(
   adapter: PlayBundlingAdapter,
 ): Promise<string> {
   const { readdir } = await import('node:fs/promises');
+  const addFilePart = async (
+    parts: Array<{ name: string; hash: string }>,
+    rootDir: string,
+    filePath: string,
+  ) => {
+    const contents = await readFile(filePath, 'utf-8');
+    parts.push({
+      name: `${basename(rootDir)}:${filePath.slice(rootDir.length + 1)}`,
+      hash: sha256(contents),
+    });
+  };
+  const collectTopLevelTsFiles = async (
+    rootDir: string,
+    parts: Array<{ name: string; hash: string }>,
+  ) => {
+    if (!(await fileExists(rootDir))) return;
+    const entries = await readdir(rootDir, { withFileTypes: true });
+    const tsFiles = entries
+      .filter((entry) => entry.isFile() && /\.[cm]?ts$/.test(entry.name))
+      .map((entry) => entry.name)
+      .sort();
+    for (const name of tsFiles) {
+      await addFilePart(parts, rootDir, join(rootDir, name));
+    }
+  };
+  const collectIntegrationBatchingFiles = async (
+    rootDir: string,
+    parts: Array<{ name: string; hash: string }>,
+  ) => {
+    if (!(await fileExists(rootDir))) return;
+    const entries = await readdir(rootDir, { withFileTypes: true });
+    const filePaths: string[] = [];
+    for (const entry of entries) {
+      if (
+        entry.isFile() &&
+        (entry.name === 'play-runtime-batching-registry.ts' ||
+          /^batching.*\.ts$/.test(entry.name))
+      ) {
+        filePaths.push(join(rootDir, entry.name));
+      }
+      if (entry.isDirectory()) {
+        const batchingFile = join(rootDir, entry.name, 'batching.ts');
+        if (await fileExists(batchingFile)) {
+          filePaths.push(batchingFile);
+        }
+      }
+    }
+    for (const filePath of filePaths.sort()) {
+      await addFilePart(parts, rootDir, filePath);
+    }
+  };
+
   const entries = await readdir(adapter.workersHarnessFilesDir, {
     withFileTypes: true,
   });
@@ -1085,11 +1136,18 @@ async function computeWorkersHarnessFingerprintWithAdapter(
     .sort();
   const parts: Array<{ name: string; hash: string }> = [];
   for (const name of tsFiles) {
-    const contents = await readFile(
+    await addFilePart(
+      parts,
+      adapter.workersHarnessFilesDir,
       join(adapter.workersHarnessFilesDir, name),
-      'utf-8',
     );
-    parts.push({ name, hash: sha256(contents) });
+  }
+  for (const dir of adapter.workersRuntimeFingerprintDirs ?? []) {
+    if (basename(dir) === 'integrations') {
+      await collectIntegrationBatchingFiles(dir, parts);
+    } else {
+      await collectTopLevelTsFiles(dir, parts);
+    }
   }
   return sha256(JSON.stringify(parts));
 }

package/dist/repo/shared_libs/plays/static-pipeline.ts

@@ -911,9 +911,7 @@ export function compileSheetContract(pipeline: PlayStaticPipeline): {
     });
   };
 
-  const inputFields = pipeline.inputFields?.length
-    ? pipeline.inputFields
-    : [tableNamespace];
+  const inputFields = pipeline.inputFields?.length ? pipeline.inputFields : [];
   const rowKeyFieldSet = new Set(pipeline.rowKeyFields ?? []);
   for (const inputField of inputFields) {
     addColumn({

package/dist/repo/shared_libs/security/outbound-url-policy.ts

@@ -0,0 +1,238 @@
+const BLOCKED_HOSTNAMES = new Set(['localhost']);
+
+const BLOCKED_IPV4_CIDRS = [
+  ['0.0.0.0', 8],
+  ['10.0.0.0', 8],
+  ['100.64.0.0', 10],
+  ['127.0.0.0', 8],
+  ['169.254.0.0', 16],
+  ['172.16.0.0', 12],
+  ['192.0.0.0', 24],
+  ['192.0.2.0', 24],
+  ['192.168.0.0', 16],
+  ['198.18.0.0', 15],
+  ['198.51.100.0', 24],
+  ['203.0.113.0', 24],
+  ['224.0.0.0', 4],
+  ['240.0.0.0', 4],
+] as const;
+
+const BLOCKED_IPV6_CIDRS = [
+  ['64:ff9b::', 96],
+  ['64:ff9b:1::', 48],
+  ['100::', 64],
+  ['2001::', 23],
+  ['2001:db8::', 32],
+  ['2002::', 16],
+  ['fc00::', 7],
+  ['fe80::', 10],
+  ['fec0::', 10],
+  ['ff00::', 8],
+] as const;
+
+export class UnsafeOutboundUrlError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'UnsafeOutboundUrlError';
+  }
+}
+
+function ipv4ToInt(ip: string): number | null {
+  const parts = ip.split('.');
+  if (parts.length !== 4) return null;
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null;
+    const numeric = Number.parseInt(part, 10);
+    if (numeric < 0 || numeric > 255) return null;
+    value = (value << 8) + numeric;
+  }
+  return value >>> 0;
+}
+
+function isBlockedIpv4(ip: string): boolean {
+  const numericIp = ipv4ToInt(ip);
+  if (numericIp === null) return false;
+  return BLOCKED_IPV4_CIDRS.some(([network, prefix]) => {
+    const numericNetwork = ipv4ToInt(network);
+    if (numericNetwork === null) return false;
+    const mask = prefix >= 32 ? 0xffffffff : (~0 << (32 - prefix)) >>> 0;
+    return (numericIp & mask) === (numericNetwork & mask);
+  });
+}
+
+function ipv4IntToAddress(value: number): string {
+  return [
+    (value >>> 24) & 0xff,
+    (value >>> 16) & 0xff,
+    (value >>> 8) & 0xff,
+    value & 0xff,
+  ].join('.');
+}
+
+function parseIpv6Part(part: string): number[] | null {
+  if (!part) return [];
+  const groups: number[] = [];
+  for (const segment of part.split(':')) {
+    if (!segment) return null;
+    if (segment.includes('.')) {
+      const ipv4 = ipv4ToInt(segment);
+      if (ipv4 === null) return null;
+      groups.push((ipv4 >>> 16) & 0xffff, ipv4 & 0xffff);
+      continue;
+    }
+    if (!/^[0-9a-f]{1,4}$/i.test(segment)) return null;
+    groups.push(Number.parseInt(segment, 16));
+  }
+  return groups;
+}
+
+function expandIpv6(ip: string): number[] | null {
+  const normalized = normalizeUrlHostname(ip).toLowerCase();
+  const pieces = normalized.split('::');
+  if (pieces.length > 2) return null;
+
+  const left = parseIpv6Part(pieces[0] ?? '');
+  const right = parseIpv6Part(pieces[1] ?? '');
+  if (!left || !right) return null;
+
+  if (pieces.length === 1) {
+    return left.length === 8 ? left : null;
+  }
+
+  const zeroCount = 8 - left.length - right.length;
+  if (zeroCount < 1) return null;
+  return [...left, ...Array.from({ length: zeroCount }, () => 0), ...right];
+}
+
+function maybeIpv4MappedIpv6(ip: string): string | null {
+  const groups = expandIpv6(ip);
+  if (!groups) return null;
+
+  const ipv4Value = ((groups[6] ?? 0) << 16) + (groups[7] ?? 0);
+  const isIpv4Mapped =
+    groups.slice(0, 5).every((group) => group === 0) && groups[5] === 0xffff;
+  if (!isIpv4Mapped) return null;
+
+  return ipv4IntToAddress(ipv4Value >>> 0);
+}
+
+function isIpv4CompatibleIpv6(ip: string): boolean {
+  const groups = expandIpv6(ip);
+  if (!groups) return false;
+  return groups.slice(0, 6).every((group) => group === 0);
+}
+
+function ipv6InCidr(
+  groups: number[],
+  network: number[],
+  prefix: number,
+): boolean {
+  let remainingBits = prefix;
+  for (let index = 0; index < groups.length; index += 1) {
+    if (remainingBits <= 0) return true;
+    const bits = Math.min(16, remainingBits);
+    const mask = bits === 16 ? 0xffff : (0xffff << (16 - bits)) & 0xffff;
+    if ((groups[index]! & mask) !== (network[index]! & mask)) {
+      return false;
+    }
+    remainingBits -= bits;
+  }
+  return true;
+}
+
+function isBlockedIpv6(ip: string): boolean {
+  const normalized = normalizeUrlHostname(ip).toLowerCase();
+  if (isIpv4CompatibleIpv6(normalized)) return true;
+
+  const mappedIpv4 = maybeIpv4MappedIpv6(normalized);
+  if (mappedIpv4) return isBlockedIpv4(mappedIpv4);
+
+  const groups = expandIpv6(normalized);
+  if (!groups) return false;
+
+  const publicUnicast = expandIpv6('2000::');
+  if (!publicUnicast || !ipv6InCidr(groups, publicUnicast, 3)) {
+    return true;
+  }
+
+  return BLOCKED_IPV6_CIDRS.some(([network, prefix]) => {
+    const networkGroups = expandIpv6(network);
+    return networkGroups !== null && ipv6InCidr(groups, networkGroups, prefix);
+  });
+}
+
+export function normalizeUrlHostname(hostname: string): string {
+  return hostname
+    .trim()
+    .toLowerCase()
+    .replace(/^\[(.*)\]$/, '$1')
+    .replace(/\.$/, '');
+}
+
+export function isBlockedIpAddress(ip: string): boolean {
+  const normalized = normalizeUrlHostname(ip);
+  if (normalized.includes(':')) {
+    return isBlockedIpv6(normalized);
+  }
+  return isBlockedIpv4(normalized);
+}
+
+export function isIpAddressLiteral(hostname: string): boolean {
+  const normalized = normalizeUrlHostname(hostname);
+  return ipv4ToInt(normalized) !== null || expandIpv6(normalized) !== null;
+}
+
+export function isBlockedOutboundHostname(hostname: string): boolean {
+  const normalized = normalizeUrlHostname(hostname);
+  return (
+    !normalized ||
+    BLOCKED_HOSTNAMES.has(normalized) ||
+    normalized.endsWith('.localhost') ||
+    normalized.endsWith('.local') ||
+    isBlockedIpAddress(normalized)
+  );
+}
+
+export function assertPublicHttpUrl(rawUrl: string | URL): URL {
+  let url: URL;
+  try {
+    url = rawUrl instanceof URL ? new URL(rawUrl.toString()) : new URL(rawUrl);
+  } catch {
+    throw new UnsafeOutboundUrlError('url must be a valid absolute URL.');
+  }
+
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    throw new UnsafeOutboundUrlError('Only http and https URLs are allowed.');
+  }
+  if (url.username || url.password) {
+    throw new UnsafeOutboundUrlError(
+      'Credentials in URLs are not allowed. Use headers instead.',
+    );
+  }
+
+  const hostname = normalizeUrlHostname(url.hostname);
+  if (!hostname) {
+    throw new UnsafeOutboundUrlError('URL hostname is required.');
+  }
+  if (isBlockedOutboundHostname(hostname)) {
+    throw new UnsafeOutboundUrlError(
+      `Target host "${hostname}" is not allowed.`,
+    );
+  }
+
+  return url;
+}
+
+export function resolveRedirectUrl(location: string, currentUrl: URL): URL {
+  try {
+    return assertPublicHttpUrl(new URL(location, currentUrl));
+  } catch (error) {
+    if (error instanceof UnsafeOutboundUrlError) throw error;
+    throw new UnsafeOutboundUrlError('redirect location must be a valid URL.');
+  }
+}
+
+export function isRedirectStatus(status: number): boolean {
+  return [301, 302, 303, 307, 308].includes(status);
+}