deepline 0.1.109 → 0.1.111

package/dist/repo/shared_libs/play-runtime/secret-redaction.ts

@@ -7,8 +7,12 @@ const PRIVATE_KEY_RE =
   /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 const COMMON_SECRET_RE =
   /\b(?:sk|pk|rk|pat|ghp|github_pat|xox[baprs]|key|token|secret|api[_-]?key)[A-Za-z0-9_./+=:-]{12,}\b/gi;
+const URL_SECRET_VALUE_RE =
+  /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
 const HIGH_ENTROPY_ASSIGNMENT_RE =
   /\b(?:api[_-]?key|token|secret|password|authorization|access[_-]?token|refresh[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
+const SENSITIVE_URL_PARAM_RE =
+  /[?#&](?:\w*(?:key|token)|secret|password|authorization|credential|signature|sig)(?:=|$)/i;
 
 function escapeRegExp(value: string): string {
   return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -19,6 +23,17 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 }
 
 export function redactSecretLikeString(value: string): string {
+  const trimmed = value.trim();
+  if (/^https?:\/\/\S+$/i.test(trimmed)) {
+    if (
+      /^https?:\/\/[^/?#@]+@/i.test(trimmed) ||
+      SENSITIVE_URL_PARAM_RE.test(trimmed)
+    ) {
+      return SECRET_REDACTION_PLACEHOLDER;
+    }
+    if (!URL_SECRET_VALUE_RE.test(value)) return value;
+  }
+
   return value
     .replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER)
     .replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`)

package/dist/repo/shared_libs/play-runtime/work-receipts.ts

@@ -17,6 +17,7 @@ export type WorkReceiptCommand = {
   playName: string;
   runId: string;
   key: string;
+  reclaimRunning?: boolean;
 };
 
 export type WorkReceiptClaim =

package/dist/repo/shared_libs/plays/bundling/index.ts

@@ -8,6 +8,7 @@ import {
   extname,
   isAbsolute,
   join,
+  relative,
   resolve,
 } from 'node:path';
 import { builtinModules } from 'node:module';
@@ -96,6 +97,7 @@ export type PlayBundlingAdapter = {
   sdkWorkersEntryFile: string;
   workersHarnessEntryFile: string;
   workersHarnessFilesDir: string;
+  workersRuntimeFingerprintDirs?: string[];
   discoverPackagedLocalFiles(
     filePath: string,
   ): Promise<PlayLocalFileDiscoveryResult>;
@@ -415,6 +417,106 @@ export function extractDefinedPlayName(sourceCode: string): string | null {
   return null;
 }
 
+function canonicalizeRootPlayNameForWorkersRuntimeHash(
+  sourceCode: string,
+): string {
+  const source = stripCommentsToSpaces(sourceCode);
+  const callPattern =
+    /(?:\b[A-Za-z_$][\w$]*\s*\.\s*)?\b(?:definePlay|defineWorkflow)\s*\(/g;
+  const match = callPattern.exec(source);
+  if (!match) return sourceCode;
+
+  const openParen = match.index + match[0].length - 1;
+  const firstArgStart = openParen + 1;
+  const firstNonSpace = source.slice(firstArgStart).search(/\S/);
+  if (firstNonSpace < 0) return sourceCode;
+
+  const argIndex = firstArgStart + firstNonSpace;
+  const quote = source[argIndex];
+  if (quote === '"' || quote === "'") {
+    const literalMatch = source
+      .slice(argIndex)
+      .match(/^(['"])(?:\\.|(?!\1)[\s\S])*\1/);
+    if (!literalMatch) return sourceCode;
+    const replacement = `${quote}__deepline_runtime_play_name__${quote}`;
+    return `${sourceCode.slice(0, argIndex)}${replacement}${sourceCode.slice(argIndex + literalMatch[0].length)}`;
+  }
+
+  if (quote !== '{') return sourceCode;
+  const closeBrace = findMatchingBrace(source, argIndex);
+  if (closeBrace < 0) return sourceCode;
+  const objectSource = source.slice(argIndex + 1, closeBrace);
+  const idMatch = objectSource.match(
+    /(^|[,{\s])((?:id|['"]id['"])\s*:\s*)(['"])([\s\S]*?)\3/,
+  );
+  if (!idMatch || idMatch.index === undefined) return sourceCode;
+  const idValueStart =
+    argIndex +
+    1 +
+    idMatch.index +
+    idMatch[1]!.length +
+    idMatch[2]!.length +
+    idMatch[3]!.length;
+  return `${sourceCode.slice(0, idValueStart)}__deepline_runtime_play_name__${sourceCode.slice(idValueStart + idMatch[4]!.length)}`;
+}
+
+function workersRuntimeGraphFilePath(input: {
+  entryFile: string;
+  filePath: string;
+  adapter: PlayBundlingAdapter;
+}): string {
+  if (input.filePath === input.entryFile) return '<entry>';
+  const entryRelative = relative(dirname(input.entryFile), input.filePath);
+  if (entryRelative && !entryRelative.startsWith('..')) {
+    return entryRelative.replaceAll('\\', '/');
+  }
+  return `<project>/${relative(input.adapter.projectRoot, input.filePath).replaceAll('\\', '/')}`;
+}
+
+function buildWorkersRuntimeGraphHash(input: {
+  analysis: SourceGraphAnalysis;
+  entryFile: string;
+  adapter: PlayBundlingAdapter;
+  exportName: string;
+}): string {
+  const sourceFiles = Object.entries(input.analysis.sourceFiles)
+    .map(([filePath, contents]) => ({
+      filePath: workersRuntimeGraphFilePath({
+        entryFile: input.entryFile,
+        filePath,
+        adapter: input.adapter,
+      }),
+      hash: sha256(
+        filePath === input.entryFile
+          ? canonicalizeRootPlayNameForWorkersRuntimeHash(contents)
+          : contents,
+      ),
+    }))
+    .sort((left, right) => left.filePath.localeCompare(right.filePath));
+
+  return sha256(
+    JSON.stringify({
+      entryFile: '<entry>',
+      entryExport: input.exportName,
+      localFiles: sourceFiles,
+      nodeBuiltins: [...input.analysis.importPolicy.nodeBuiltins].sort(),
+      packages: input.analysis.importPolicy.packages
+        .map(({ name, version }) => ({ name, version }))
+        .sort((left, right) => left.name.localeCompare(right.name)),
+      importedPlayDependencies: input.analysis.importedPlayDependencies
+        .map((dependency) => ({
+          filePath: workersRuntimeGraphFilePath({
+            entryFile: input.entryFile,
+            filePath: dependency.filePath,
+            adapter: input.adapter,
+          }),
+          playName: dependency.playName,
+        }))
+        .sort((left, right) => left.filePath.localeCompare(right.filePath)),
+    }),
+  );
+}
+
 function readPackageVersionFromPackageJson(
   packageJsonPath: string,
   packageName: string,
@@ -1063,19 +1165,69 @@ async function analyzeSourceGraph(
 }
 
 /**
- * Fingerprint of every TypeScript file in the Workers harness source dir.
- * The harness gets bundled INTO every esm_workers play artifact, so any
- * harness edit must invalidate the bundle cache and force a fresh CF
- * deploy. Computed fresh on every bundle call so dev edits to entry.ts (or
- * its peer DO files) are picked up on the next `play run` without
- * restarting the dev server. (4 small files = sub-millisecond.) No
- * caching: that's deliberate — caching the fingerprint is exactly the
- * stale-state bug this exists to prevent.
+ * Fingerprint of Worker runtime sources bundled into every esm_workers play
+ * artifact. Harness, shared runtime, or provider-owned batching edits must
+ * invalidate the bundle cache and force a fresh CF deploy. Computed fresh on
+ * every bundle call so dev edits are picked up on the next `play run` without
+ * restarting the dev server. No caching: that's deliberate — caching the
+ * fingerprint is exactly the stale-state bug this exists to prevent.
  */
 async function computeWorkersHarnessFingerprintWithAdapter(
   adapter: PlayBundlingAdapter,
 ): Promise<string> {
   const { readdir } = await import('node:fs/promises');
+  const addFilePart = async (
+    parts: Array<{ name: string; hash: string }>,
+    rootDir: string,
+    filePath: string,
+  ) => {
+    const contents = await readFile(filePath, 'utf-8');
+    parts.push({
+      name: `${basename(rootDir)}:${filePath.slice(rootDir.length + 1)}`,
+      hash: sha256(contents),
+    });
+  };
+  const collectTopLevelTsFiles = async (
+    rootDir: string,
+    parts: Array<{ name: string; hash: string }>,
+  ) => {
+    if (!(await fileExists(rootDir))) return;
+    const entries = await readdir(rootDir, { withFileTypes: true });
+    const tsFiles = entries
+      .filter((entry) => entry.isFile() && /\.[cm]?ts$/.test(entry.name))
+      .map((entry) => entry.name)
+      .sort();
+    for (const name of tsFiles) {
+      await addFilePart(parts, rootDir, join(rootDir, name));
+    }
+  };
+  const collectIntegrationBatchingFiles = async (
+    rootDir: string,
+    parts: Array<{ name: string; hash: string }>,
+  ) => {
+    if (!(await fileExists(rootDir))) return;
+    const entries = await readdir(rootDir, { withFileTypes: true });
+    const filePaths: string[] = [];
+    for (const entry of entries) {
+      if (
+        entry.isFile() &&
+        (entry.name === 'play-runtime-batching-registry.ts' ||
+          /^batching.*\.ts$/.test(entry.name))
+      ) {
+        filePaths.push(join(rootDir, entry.name));
+      }
+      if (entry.isDirectory()) {
+        const batchingFile = join(rootDir, entry.name, 'batching.ts');
+        if (await fileExists(batchingFile)) {
+          filePaths.push(batchingFile);
+        }
+      }
+    }
+    for (const filePath of filePaths.sort()) {
+      await addFilePart(parts, rootDir, filePath);
+    }
+  };
+
   const entries = await readdir(adapter.workersHarnessFilesDir, {
     withFileTypes: true,
   });
@@ -1085,11 +1237,18 @@ async function computeWorkersHarnessFingerprintWithAdapter(
     .sort();
   const parts: Array<{ name: string; hash: string }> = [];
   for (const name of tsFiles) {
-    const contents = await readFile(
+    await addFilePart(
+      parts,
+      adapter.workersHarnessFilesDir,
       join(adapter.workersHarnessFilesDir, name),
-      'utf-8',
     );
-    parts.push({ name, hash: sha256(contents) });
+  }
+  for (const dir of adapter.workersRuntimeFingerprintDirs ?? []) {
+    if (basename(dir) === 'integrations') {
+      await collectIntegrationBatchingFiles(dir, parts);
+    } else {
+      await collectTopLevelTsFiles(dir, parts);
+    }
   }
   return sha256(JSON.stringify(parts));
 }
@@ -1430,9 +1589,15 @@ export async function bundlePlayFile(
 
   try {
     const analysis = await analyzeSourceGraph(absolutePath, adapter);
-    analysis.graphHash = sha256(
-      `${analysis.graphHash}\nentry-export:${exportName}`,
-    );
+    analysis.graphHash =
+      target === PLAY_ARTIFACT_KINDS.esmWorkers
+        ? buildWorkersRuntimeGraphHash({
+            analysis,
+            entryFile: absolutePath,
+            adapter,
+            exportName,
+          })
+        : sha256(`${analysis.graphHash}\nentry-export:${exportName}`);
     // For esm_workers builds, the harness source files (entry.ts +
     // peer DO/coordinator types it imports) are bundled INTO every play
     // artifact. So any harness edit must produce a different graphHash so
@@ -1479,11 +1644,10 @@ export async function bundlePlayFile(
     // Cache lookup happens after validation because a bundle cache hit is keyed
     // by source and target, while cloud descriptor typecheck results also depend
     // on generated tool metadata.
-    const cachedArtifact = await readArtifactCache(
-      analysis.graphHash,
-      target,
-      adapter,
-    );
+    const canUseArtifactCache = target !== PLAY_ARTIFACT_KINDS.esmWorkers;
+    const cachedArtifact = canUseArtifactCache
+      ? await readArtifactCache(analysis.graphHash, target, adapter)
+      : null;
     const discoveredFiles =
       await adapter.discoverPackagedLocalFiles(absolutePath);
     if (cachedArtifact) {
@@ -1502,7 +1666,13 @@ export async function bundlePlayFile(
 
       return {
         success: true,
-        artifact: { ...cachedArtifact, cacheHit: true },
+        artifact: {
+          ...cachedArtifact,
+          entryFile: absolutePath,
+          sourceHash: analysis.sourceHash,
+          importPolicy: analysis.importPolicy,
+          cacheHit: true,
+        },
         sourceCode: analysis.sourceCode,
         sourceFiles: analysis.sourceFiles,
         filePath: absolutePath,
@@ -1568,7 +1738,9 @@ export async function bundlePlayFile(
       cacheHit: false,
     };
 
-    await writeArtifactCache(artifact, adapter);
+    if (canUseArtifactCache) {
+      await writeArtifactCache(artifact, adapter);
+    }
 
     return {
       success: true,

package/dist/repo/shared_libs/plays/static-pipeline.ts

@@ -911,9 +911,7 @@ export function compileSheetContract(pipeline: PlayStaticPipeline): {
     });
   };
 
-  const inputFields = pipeline.inputFields?.length
-    ? pipeline.inputFields
-    : [tableNamespace];
+  const inputFields = pipeline.inputFields?.length ? pipeline.inputFields : [];
   const rowKeyFieldSet = new Set(pipeline.rowKeyFields ?? []);
   for (const inputField of inputFields) {
     addColumn({

package/dist/repo/shared_libs/security/outbound-url-policy.ts

@@ -0,0 +1,238 @@
+const BLOCKED_HOSTNAMES = new Set(['localhost']);
+
+const BLOCKED_IPV4_CIDRS = [
+  ['0.0.0.0', 8],
+  ['10.0.0.0', 8],
+  ['100.64.0.0', 10],
+  ['127.0.0.0', 8],
+  ['169.254.0.0', 16],
+  ['172.16.0.0', 12],
+  ['192.0.0.0', 24],
+  ['192.0.2.0', 24],
+  ['192.168.0.0', 16],
+  ['198.18.0.0', 15],
+  ['198.51.100.0', 24],
+  ['203.0.113.0', 24],
+  ['224.0.0.0', 4],
+  ['240.0.0.0', 4],
+] as const;
+
+const BLOCKED_IPV6_CIDRS = [
+  ['64:ff9b::', 96],
+  ['64:ff9b:1::', 48],
+  ['100::', 64],
+  ['2001::', 23],
+  ['2001:db8::', 32],
+  ['2002::', 16],
+  ['fc00::', 7],
+  ['fe80::', 10],
+  ['fec0::', 10],
+  ['ff00::', 8],
+] as const;
+
+export class UnsafeOutboundUrlError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'UnsafeOutboundUrlError';
+  }
+}
+
+function ipv4ToInt(ip: string): number | null {
+  const parts = ip.split('.');
+  if (parts.length !== 4) return null;
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null;
+    const numeric = Number.parseInt(part, 10);
+    if (numeric < 0 || numeric > 255) return null;
+    value = (value << 8) + numeric;
+  }
+  return value >>> 0;
+}
+
+function isBlockedIpv4(ip: string): boolean {
+  const numericIp = ipv4ToInt(ip);
+  if (numericIp === null) return false;
+  return BLOCKED_IPV4_CIDRS.some(([network, prefix]) => {
+    const numericNetwork = ipv4ToInt(network);
+    if (numericNetwork === null) return false;
+    const mask = prefix >= 32 ? 0xffffffff : (~0 << (32 - prefix)) >>> 0;
+    return (numericIp & mask) === (numericNetwork & mask);
+  });
+}
+
+function ipv4IntToAddress(value: number): string {
+  return [
+    (value >>> 24) & 0xff,
+    (value >>> 16) & 0xff,
+    (value >>> 8) & 0xff,
+    value & 0xff,
+  ].join('.');
+}
+
+function parseIpv6Part(part: string): number[] | null {
+  if (!part) return [];
+  const groups: number[] = [];
+  for (const segment of part.split(':')) {
+    if (!segment) return null;
+    if (segment.includes('.')) {
+      const ipv4 = ipv4ToInt(segment);
+      if (ipv4 === null) return null;
+      groups.push((ipv4 >>> 16) & 0xffff, ipv4 & 0xffff);
+      continue;
+    }
+    if (!/^[0-9a-f]{1,4}$/i.test(segment)) return null;
+    groups.push(Number.parseInt(segment, 16));
+  }
+  return groups;
+}
+
+function expandIpv6(ip: string): number[] | null {
+  const normalized = normalizeUrlHostname(ip).toLowerCase();
+  const pieces = normalized.split('::');
+  if (pieces.length > 2) return null;
+
+  const left = parseIpv6Part(pieces[0] ?? '');
+  const right = parseIpv6Part(pieces[1] ?? '');
+  if (!left || !right) return null;
+
+  if (pieces.length === 1) {
+    return left.length === 8 ? left : null;
+  }
+
+  const zeroCount = 8 - left.length - right.length;
+  if (zeroCount < 1) return null;
+  return [...left, ...Array.from({ length: zeroCount }, () => 0), ...right];
+}
+
+function maybeIpv4MappedIpv6(ip: string): string | null {
+  const groups = expandIpv6(ip);
+  if (!groups) return null;
+
+  const ipv4Value = ((groups[6] ?? 0) << 16) + (groups[7] ?? 0);
+  const isIpv4Mapped =
+    groups.slice(0, 5).every((group) => group === 0) && groups[5] === 0xffff;
+  if (!isIpv4Mapped) return null;
+
+  return ipv4IntToAddress(ipv4Value >>> 0);
+}
+
+function isIpv4CompatibleIpv6(ip: string): boolean {
+  const groups = expandIpv6(ip);
+  if (!groups) return false;
+  return groups.slice(0, 6).every((group) => group === 0);
+}
+
+function ipv6InCidr(
+  groups: number[],
+  network: number[],
+  prefix: number,
+): boolean {
+  let remainingBits = prefix;
+  for (let index = 0; index < groups.length; index += 1) {
+    if (remainingBits <= 0) return true;
+    const bits = Math.min(16, remainingBits);
+    const mask = bits === 16 ? 0xffff : (0xffff << (16 - bits)) & 0xffff;
+    if ((groups[index]! & mask) !== (network[index]! & mask)) {
+      return false;
+    }
+    remainingBits -= bits;
+  }
+  return true;
+}
+
+function isBlockedIpv6(ip: string): boolean {
+  const normalized = normalizeUrlHostname(ip).toLowerCase();
+  if (isIpv4CompatibleIpv6(normalized)) return true;
+
+  const mappedIpv4 = maybeIpv4MappedIpv6(normalized);
+  if (mappedIpv4) return isBlockedIpv4(mappedIpv4);
+
+  const groups = expandIpv6(normalized);
+  if (!groups) return false;
+
+  const publicUnicast = expandIpv6('2000::');
+  if (!publicUnicast || !ipv6InCidr(groups, publicUnicast, 3)) {
+    return true;
+  }
+
+  return BLOCKED_IPV6_CIDRS.some(([network, prefix]) => {
+    const networkGroups = expandIpv6(network);
+    return networkGroups !== null && ipv6InCidr(groups, networkGroups, prefix);
+  });
+}
+
+export function normalizeUrlHostname(hostname: string): string {
+  return hostname
+    .trim()
+    .toLowerCase()
+    .replace(/^\[(.*)\]$/, '$1')
+    .replace(/\.$/, '');
+}
+
+export function isBlockedIpAddress(ip: string): boolean {
+  const normalized = normalizeUrlHostname(ip);
+  if (normalized.includes(':')) {
+    return isBlockedIpv6(normalized);
+  }
+  return isBlockedIpv4(normalized);
+}
+
+export function isIpAddressLiteral(hostname: string): boolean {
+  const normalized = normalizeUrlHostname(hostname);
+  return ipv4ToInt(normalized) !== null || expandIpv6(normalized) !== null;
+}
+
+export function isBlockedOutboundHostname(hostname: string): boolean {
+  const normalized = normalizeUrlHostname(hostname);
+  return (
+    !normalized ||
+    BLOCKED_HOSTNAMES.has(normalized) ||
+    normalized.endsWith('.localhost') ||
+    normalized.endsWith('.local') ||
+    isBlockedIpAddress(normalized)
+  );
+}
+
+export function assertPublicHttpUrl(rawUrl: string | URL): URL {
+  let url: URL;
+  try {
+    url = rawUrl instanceof URL ? new URL(rawUrl.toString()) : new URL(rawUrl);
+  } catch {
+    throw new UnsafeOutboundUrlError('url must be a valid absolute URL.');
+  }
+
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    throw new UnsafeOutboundUrlError('Only http and https URLs are allowed.');
+  }
+  if (url.username || url.password) {
+    throw new UnsafeOutboundUrlError(
+      'Credentials in URLs are not allowed. Use headers instead.',
+    );
+  }
+
+  const hostname = normalizeUrlHostname(url.hostname);
+  if (!hostname) {
+    throw new UnsafeOutboundUrlError('URL hostname is required.');
+  }
+  if (isBlockedOutboundHostname(hostname)) {
+    throw new UnsafeOutboundUrlError(
+      `Target host "${hostname}" is not allowed.`,
+    );
+  }
+
+  return url;
+}
+
+export function resolveRedirectUrl(location: string, currentUrl: URL): URL {
+  try {
+    return assertPublicHttpUrl(new URL(location, currentUrl));
+  } catch (error) {
+    if (error instanceof UnsafeOutboundUrlError) throw error;
+    throw new UnsafeOutboundUrlError('redirect location must be a valid URL.');
+  }
+}
+
+export function isRedirectStatus(status: number): boolean {
+  return [301, 302, 303, 307, 308].includes(status);
+}

package/dist/repo/shared_libs/security/safe-fetch.ts

@@ -0,0 +1,118 @@
+import {
+  assertPublicHttpUrl,
+  isRedirectStatus,
+  resolveRedirectUrl,
+} from './outbound-url-policy';
+
+export type SafeFetchImplementation = (
+  input: string | URL,
+  init?: RequestInit,
+) => Promise<Response>;
+
+export type SafeFetchOptions = {
+  fetchImpl?: SafeFetchImplementation;
+  maxRedirects?: number;
+  sensitiveHeaders?: Iterable<string>;
+};
+
+function removeHeader(headers: Headers, name: string) {
+  if (headers.has(name)) headers.delete(name);
+}
+
+function requestInitForRedirect(
+  init: RequestInit,
+  from: URL,
+  to: URL,
+  status: number,
+  sensitiveHeaders: Iterable<string>,
+): RequestInit {
+  const headers = new Headers(init.headers);
+  let method = String(init.method ?? 'GET').toUpperCase();
+  let body = init.body;
+
+  if (
+    status === 303 ||
+    ((status === 301 || status === 302) && method === 'POST')
+  ) {
+    method = 'GET';
+    body = undefined;
+    removeHeader(headers, 'content-length');
+    removeHeader(headers, 'content-type');
+  }
+
+  if (from.origin !== to.origin) {
+    removeHeader(headers, 'authorization');
+    removeHeader(headers, 'cookie');
+    removeHeader(headers, 'proxy-authorization');
+    for (const header of sensitiveHeaders) {
+      removeHeader(headers, header);
+    }
+  }
+
+  return {
+    ...init,
+    method,
+    body,
+    headers,
+    redirect: 'manual',
+  };
+}
+
+export async function safePublicFetch(
+  input: string | URL,
+  init: RequestInit = {},
+  options: SafeFetchOptions = {},
+): Promise<Response> {
+  const redirectMode = init.redirect ?? 'follow';
+  const maxRedirects = options.maxRedirects ?? 10;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const sensitiveHeaders = options.sensitiveHeaders ?? [];
+  let currentUrl = assertPublicHttpUrl(input);
+  let currentInit: RequestInit = {
+    ...init,
+    redirect: 'manual',
+  };
+
+  for (
+    let redirectCount = 0;
+    redirectCount <= maxRedirects;
+    redirectCount += 1
+  ) {
+    const response = await fetchImpl(currentUrl, currentInit);
+    if (!isRedirectStatus(response.status)) {
+      return response;
+    }
+    if (redirectMode === 'error') {
+      throw new Error(
+        `Redirect blocked while fetching ${currentUrl.toString()}.`,
+      );
+    }
+    if (redirectMode !== 'follow') {
+      return response;
+    }
+
+    const location = response.headers.get('location');
+    if (!location) {
+      return response;
+    }
+    if (redirectCount === maxRedirects) {
+      throw new Error(
+        `Too many redirects while fetching ${currentUrl.toString()}.`,
+      );
+    }
+
+    const nextUrl = resolveRedirectUrl(location, currentUrl);
+    currentInit = requestInitForRedirect(
+      currentInit,
+      currentUrl,
+      nextUrl,
+      response.status,
+      sensitiveHeaders,
+    );
+    currentUrl = nextUrl;
+  }
+
+  throw new Error(
+    `Too many redirects while fetching ${currentUrl.toString()}.`,
+  );
+}