typesafe-sdk-ruby 0.6.0 → 0.7.0

data/lib/typesafe/sdk/client.rb

@@ -15,7 +15,7 @@ module Typesafe
     # Client for the TypeSafe AI API.
     class Client
       attr_reader :base_url, :default_model, :log_level, :logger, :retry, :timeout,
-                  :default_headers, :models
+                  :default_headers, :compression, :models
 
       # Create a client for the TypeSafe AI API.
       #
@@ -30,13 +30,16 @@ module Typesafe
       # @param retry_policy [Hash, nil] overrides for {Retry::DEFAULT_RETRY_POLICY}.
       # @param timeout [Float, nil] timeout per attempt in seconds. Default: 10.
       # @param default_headers [Hash, nil] additional request headers.
+      # @param compression [Symbol, false, nil] request body compression, sent as `Content-Encoding`.
+      #   Default: `:zstd` when the optional `zstd-ruby` gem can be loaded, otherwise `false`.
+      #   Bodies under 1 KiB are always sent uncompressed.
       # @param http [Object] HTTP adapter responding to `request`. Default: {HTTP}.
-      # @raise [TypeSafeError] the API key is missing or configuration is invalid.
+      # @raise [TypeSafeError] the API key is missing, configuration is invalid, or zstd
+      #   compression is requested without the `zstd-ruby` gem.
       def initialize(api_key: nil, base_url: nil, default_model: nil, log_level: nil,
                      logger: nil, retry_policy: nil, timeout: nil, default_headers: nil,
-                     http: nil, env: ::ENV)
-        @api_key = ENV.from_code_or_env(api_key, ENV::API_KEY, source: env)
-        raise TypeSafeError, missing_api_key_message if @api_key.nil? || @api_key.empty?
+                     compression: nil, http: nil, env: ::ENV)
+        @api_key = validate_api_key(api_key.nil? ? env[ENV::API_KEY] : api_key)
 
         @base_url = strip_trailing_slashes(
           ENV.from_code_or_env(base_url, ENV::BASE_URL, source: env) || DEFAULT_BASE_URL
@@ -49,20 +52,30 @@ module Typesafe
         @retry = resolve_retry_policy(Retry::DEFAULT_RETRY_POLICY, retry_policy)
         @timeout = assert_positive("timeout", timeout || Retry::DEFAULT_TIMEOUT_S)
         @default_headers = (default_headers || {}).dup.freeze
+        @compression = Compression.resolve(compression)
         @http = http || HTTP.new
         @models = Resources::Models.new(self)
         @request_count = 0
       end
 
-      # Answer named questions about text or structured state.
+      # Answer named questions about text, structured state, or images.
       #
-      # @param state [String, Hash, Array, nil] the content to evaluate.
+      # Images in `state`, question content, or {SDK.with_assets} text are sent under their
+      # references; requests with images are sent as `multipart/form-data`.
+      #
+      # @param state [String, Hash, Array, Image, TextWithAssets] the content to evaluate.
       # @param questions [Hash{Symbol, String => Hash}] nonempty questions keyed by name.
       # @param model [String, nil] model override; omitted values inherit `default_model`.
-      # @param options [Hash] per-call `timeout`, `retry`, `headers`, and `signal` settings.
-      # @return [SystemOneResult] answers keyed by question name, with model and token usage.
-      # @raise [TypeSafeError] questions are empty, or score criteria are not a list of at
-      #   least two entries.
+      # @param assets [Hash{String => Image}, nil] images keyed by names of your choice, matched
+      #   literally in strings within `state`, question instructions, or criteria. Every name must
+      #   appear in the request.
+      # @param extra_body [Hash] additional JSON fields; named request arguments take precedence.
+      # @param with_response [Boolean] return data with HTTP metadata and request ID.
+      # @param options [Hash] per-call `timeout`, `retry_policy`, `headers`, and `signal` settings.
+      # @return [SystemOneResult, WithResponse] answers keyed by question name, with model and token usage.
+      # @raise [TypeSafeError] state or questions violate the locally checked API constraints,
+      #   the request holds a cycle, a string holds the reference of an image not attached to the
+      #   request, a name in `assets` doesn't appear in the request, or an image can't be read.
       # @raise [APIError] the server returns a non-2xx response after retries.
       # @raise [APIConnectionError] the request cannot connect or times out after retries.
       # @raise [APIUserAbortError] the caller cancels the request.
@@ -72,17 +85,30 @@ module Typesafe
       #     state: "I was charged twice. Please help.",
       #     questions: { billing: Typesafe::SDK.noul("Is this about billing?") },
       #   )
-      #   response.answers[:billing].noul # => 0.93
-      def system_one(state:, questions:, model: nil, **options)
+      #   response[:billing].noul # => 0.93
+      def system_one(state:, questions:, model: nil, assets: nil, extra_body: {}, with_response: false,
+                     **options)
+        Questions.validate_state!(state)
         Questions.validate!(questions)
-        body = { state: state, questions: questions, model: model || @default_model }
+        named = Assets.normalize(assets)
+        request_body = extra_body.transform_keys(&:to_s).merge(
+          "state" => state, "questions" => questions, "model" => model || @default_model
+        )
+        # Serialized now, so changes to the request after this call don't change what is sent.
+        json, sent = Assets.serialize_request(request_body, named)
+        payload = JSON.parse(json)
+        body = sent.nil? ? payload : -> { Assets.encode(payload, sent) }
         response = request(:post, "/v1/systemone", body: body, **options)
-        SystemOneResult.new(response.body)
+        result = SystemOneResult.new(response.body)
+        with_response ? WithResponse.new(result, response) : result
       end
 
       # Send a request and parse its response body. Internal; used by API resources.
       #
-      # @return [Response] the parsed response, with `data`, `status`, `headers`, and `request_id`.
+      # `body` is a JSON-ready object, or a callable returning one or an {MultipartBody},
+      # called once before the first attempt.
+      #
+      # @return [Response] the parsed response, with `body`, `status`, `headers`, and `request_id`.
       def request(method, path, body: nil, headers: {}, timeout: nil, retry_policy: nil,
                   signal: nil)
         resolved = {
@@ -106,6 +132,21 @@ module Typesafe
 
       private
 
+      def validate_api_key(value)
+        raise TypeSafeError, missing_api_key_message if value.nil?
+        unless value.is_a?(String) && value.valid_encoding? && value.ascii_only?
+          raise TypeSafeError, "API key must be an ASCII string."
+        end
+
+        key = value.gsub(/\A[ \t\r\n]+|[ \t\r\n]+\z/, "")
+        raise TypeSafeError, missing_api_key_message if key.empty?
+        if key.match?(/[\x00-\x20\x7f]/)
+          raise TypeSafeError, "API key must not contain whitespace or control characters."
+        end
+
+        key.freeze
+      end
+
       def missing_api_key_message
         "No API key was provided. Pass `api_key:` to Typesafe::SDK::Client.new or set the " \
           "#{ENV::API_KEY} environment variable."
@@ -121,7 +162,7 @@ module Typesafe
       end
 
       def assert_positive(name, value)
-        unless value.is_a?(Numeric) && value.positive?
+        unless value.is_a?(Numeric) && value.real? && value.finite? && value.positive?
           raise TypeSafeError,
                 "`#{name}` must be a positive number, got #{value.inspect}."
         end
@@ -138,7 +179,7 @@ module Typesafe
       end
 
       def assert_non_negative(name, value)
-        unless value.is_a?(Numeric) && value >= 0
+        unless value.is_a?(Numeric) && value.real? && value.finite? && value >= 0
           raise TypeSafeError, "`#{name}` must be a non-negative number, got #{value.inspect}."
         end
 
@@ -146,7 +187,7 @@ module Typesafe
       end
 
       def assert_fraction(name, value)
-        unless value.is_a?(Numeric) && value >= 0 && value <= 1
+        unless value.is_a?(Numeric) && value.real? && value.finite? && value >= 0 && value <= 1
           raise TypeSafeError, "`#{name}` must be between 0 and 1, got #{value.inspect}."
         end
 
@@ -159,7 +200,7 @@ module Typesafe
             raise TypeSafeError, "`#{name}` must contain HTTP status codes, got #{status.inspect}."
           end
         end
-        statuses
+        statuses.freeze
       end
 
       # Merge and validate retry overrides, copying the status list to isolate later mutations.
@@ -196,18 +237,23 @@ module Typesafe
                          else
                            base[:http_statuses]
                          end,
-          respect_retry_after: o.fetch(:respect_retry_after, base[:respect_retry_after]),
+          respect_retry_after: resolve_retry_flag(base, o, :respect_retry_after),
           max_retry_after_ms: if o.key?(:max_retry_after_ms)
                                 assert_non_negative("retry.max_retry_after_ms",
                                                     o[:max_retry_after_ms])
                               else
                                 base[:max_retry_after_ms]
                               end,
-          api_connection_error: o.fetch(:api_connection_error, base[:api_connection_error]),
-          api_timeout_error: o.fetch(:api_timeout_error, base[:api_timeout_error])
+          api_connection_error: resolve_retry_flag(base, o, :api_connection_error),
+          api_timeout_error: resolve_retry_flag(base, o, :api_timeout_error)
         }.freeze
       end
 
+      # Like upstream's nullish fallback, nil inherits while false stays explicit.
+      def resolve_retry_flag(base, overrides, name)
+        overrides[name].nil? ? base[name] : overrides[name]
+      end
+
       # Last value wins regardless of casing; `nil` removes a protected header.
       def merge_headers(*sources)
         merged = {}
@@ -227,27 +273,29 @@ module Typesafe
       # Retry eligible failures, logging attempt summaries at `info` and details at `debug`.
       def fetch_with_retries(tag, req)
         url = "#{@base_url}#{req[:path]}"
-        # User-supplied headers go first so they can't clobber auth or the JSON content type.
+        multipart, payload, encoded, encoding, body = prepare_body(tag, req)
+        # User-supplied headers go first so they can't clobber auth, the content type, or the encoding.
         headers = merge_headers(req[:headers], {
                                   "Authorization" => "Bearer #{@api_key}",
                                   "Accept" => "application/json",
                                   "User-Agent" => "typesafe-sdk-ruby/#{VERSION}",
                                   "X-TypeSafe-SDK" => "typesafe-sdk-ruby/#{VERSION}",
                                   "X-TypeSafe-Runtime" => "ruby/#{RUBY_VERSION} (#{RUBY_PLATFORM})",
-                                  "Content-Type" => req[:body].nil? ? nil : "application/json",
+                                  "Content-Type" => multipart&.content_type ||
+                                                    (encoded.nil? ? nil : "application/json"),
+                                  "Content-Encoding" => (encoding.to_s if encoding),
                                   "X-TypeSafe-Retry-Count" => nil
                                 })
-        payload = req[:body].nil? ? nil : JSON.generate(req[:body])
 
         attempt = 0
         loop do
           retries_left = req[:retry][:max_retries] - attempt
           attempt_headers = attempt.zero? ? headers : headers.merge("X-TypeSafe-Retry-Count" => attempt.to_s)
-          @logger.debug("#{tag} -> #{url}", headers: Redaction.redact_headers(attempt_headers), body: req[:body])
+          @logger.debug("#{tag} -> #{url}", headers: Redaction.redact_headers(attempt_headers), body: payload)
 
           started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
           begin
-            response = attempt_request(tag, url, req[:method], attempt_headers, payload, req)
+            response = attempt_request(tag, url, req[:method], attempt_headers, body, req)
           rescue APIUserAbortError
             raise
           rescue APIConnectionError => e
@@ -272,6 +320,26 @@ module Typesafe
         end
       end
 
+      # Resolve, encode, and compress the body once; every attempt sends the same bytes.
+      # The logs show the uncompressed payload.
+      def prepare_body(tag, req)
+        resolved = req[:body]
+        if resolved.respond_to?(:call)
+          req[:signal]&.check!
+          resolved = resolved.call
+          if req[:signal]&.canceled?
+            @logger.info("#{tag} aborted by caller while reading assets")
+            raise APIUserAbortError
+          end
+        end
+        multipart = resolved.is_a?(MultipartBody) ? resolved : nil
+        payload = multipart ? multipart.payload : resolved
+        encoded = multipart&.content || (payload.nil? ? nil : JSON.generate(payload))
+        encoding = encoded && encoded.bytesize >= Compression::MIN_COMPRESSED_BODY_BYTES ? @compression : false
+        body = encoding ? Compression.compress(encoded) : encoded
+        [multipart, payload, encoded, encoding, body]
+      end
+
       def retryable_connection_error?(error, policy)
         return policy[:api_timeout_error] if error.is_a?(APITimeoutError)
 
@@ -312,9 +380,9 @@ module Typesafe
         sleep_with_signal(delay, req[:signal])
       end
 
-      def sleep_with_signal(seconds, signal)
+      def sleep_with_signal(milliseconds, signal)
         signal&.check!
-        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + (seconds / 1000.0)
+        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + (milliseconds / 1000.0)
         loop do
           if signal
             signal.check!

data/lib/typesafe/sdk/compression.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Typesafe
+  module SDK
+    # Request body compression with zstd, provided by the optional `zstd-ruby` gem.
+    module Compression
+      # Bodies below this many bytes fit in a single TCP segment, so they are sent uncompressed.
+      MIN_COMPRESSED_BODY_BYTES = 1024
+
+      module_function
+
+      # Whether the `zstd-ruby` gem can be loaded. Checked once per process.
+      def available?
+        return @available unless @available.nil?
+
+        @available = begin
+          require "zstd-ruby"
+          true
+        rescue LoadError
+          false
+        end
+      end
+
+      # Resolve the `compression:` option to the `Content-Encoding` request bodies are sent with:
+      # `:zstd` when the runtime has it, otherwise `false`.
+      #
+      # @raise [TypeSafeError] the value isn't a supported option, or zstd is unavailable.
+      def resolve(compression)
+        return available? ? :zstd : false if compression.nil?
+        return false if compression == false
+
+        unless [:zstd, "zstd"].include?(compression)
+          raise TypeSafeError, "`compression` must be :zstd or false, got #{compression.inspect}."
+        end
+        unless available?
+          raise TypeSafeError,
+                "zstd compression requires the zstd-ruby gem. Add it to your Gemfile or pass " \
+                "`compression: false` instead."
+        end
+
+        :zstd
+      end
+
+      # Compress a request body with zstd.
+      def compress(body)
+        Zstd.compress(body).b
+      end
+    end
+  end
+end

data/lib/typesafe/sdk/errors.rb

@@ -26,16 +26,19 @@ module Typesafe
       attr_reader :request_id
 
       def initialize(status, body, headers, message = nil)
-        super(message || APIError.describe(status, body))
+        super(message || APIError.describe(status, body, headers))
         @status = status
         @body = body
         @headers = headers
         @request_id = headers[Typesafe::SDK::REQUEST_ID_HEADER]
       end
 
-      def self.describe(status, body)
+      def self.describe(status, body, headers = nil)
+        edge = describe_edge_block(status, body, headers)
+        return edge if edge
+
         detail = extract_message(body)
-        return "#{status} #{detail}" if detail
+        return "#{status} #{detail}" if detail && !detail.empty?
         return "#{status} status code (no body)" if body.nil?
 
         raw = body.is_a?(String) ? body : JSON.generate(body)
@@ -56,8 +59,11 @@ module Typesafe
         @status_classes ||= {
           400 => Typesafe::SDK::BadRequestError,
           401 => Typesafe::SDK::AuthenticationError,
+          402 => Typesafe::SDK::PaymentRequiredError,
           403 => Typesafe::SDK::PermissionDeniedError,
           404 => Typesafe::SDK::NotFoundError,
+          409 => Typesafe::SDK::ConflictError,
+          413 => Typesafe::SDK::PayloadTooLargeError,
           422 => Typesafe::SDK::UnprocessableEntityError,
           429 => Typesafe::SDK::RateLimitError
         }.freeze
@@ -78,6 +84,20 @@ module Typesafe
         nil
       end
 
+      # Describe an HTML page from Cloudflare, which answers before the request reaches the API,
+      # for example when its firewall matches text such as shell commands in the request.
+      def self.describe_edge_block(status, body, headers)
+        return nil unless headers && body.is_a?(String) && body.match?(/\A\s*<(?:!doctype|html)/i)
+
+        ray = headers["cf-ray"]
+        return nil unless ray || headers["server"].to_s.match?(/cloudflare/i)
+
+        "#{status} The response is a Cloudflare HTML page, not a TypeSafe API error" \
+          "#{" (cf-ray #{ray})" if ray}. An edge firewall may have blocked the request before it " \
+          "reached the API; content such as shell commands in the request can trigger it. " \
+          "Report the ray ID to TypeSafe support if the request is valid."
+      end
+
       # Format validation errors as semicolon-separated `path: message` entries.
       def self.describe_validation_errors(errors)
         parts = errors.filter_map do |e|
@@ -94,18 +114,27 @@ module Typesafe
     class BadRequestError < APIError; end
     # HTTP 401: authentication failed.
     class AuthenticationError < APIError; end
+    # HTTP 402: payment is required.
+    class PaymentRequiredError < APIError; end
     # HTTP 403: access is denied.
     class PermissionDeniedError < APIError; end
     # HTTP 404: the resource was not found.
     class NotFoundError < APIError; end
+    # HTTP 409: the request conflicts with the current state.
+    class ConflictError < APIError; end
+    # HTTP 413: the request payload is too large.
+    class PayloadTooLargeError < APIError; end
     # HTTP 422: request validation failed.
     class UnprocessableEntityError < APIError; end
 
     # HTTP 429: the rate limit was exceeded.
     class RateLimitError < APIError
-      # Server retry delay in milliseconds, or `nil` when absent or invalid.
-      def retry_after_ms
-        Typesafe::SDK::Retry.parse_retry_after(@headers)
+      # Captured at response time, so HTTP-date delays do not change between reads.
+      attr_reader :retry_after_ms
+
+      def initialize(...)
+        super
+        @retry_after_ms = Typesafe::SDK::Retry.parse_retry_after(@headers)
       end
     end
 

data/lib/typesafe/sdk/http.rb

@@ -9,6 +9,7 @@ module Typesafe
       def initialize
         @mutex = Mutex.new
         @canceled = false
+        @condition = ConditionVariable.new
       end
 
       def canceled?
@@ -16,7 +17,10 @@ module Typesafe
       end
 
       def cancel
-        @mutex.synchronize { @canceled = true }
+        @mutex.synchronize do
+          @canceled = true
+          @condition.broadcast
+        end
       end
 
       # Raise {APIUserAbortError} if canceled.
@@ -27,8 +31,10 @@ module Typesafe
       # Wait up to `seconds`, returning early when canceled.
       def wait(seconds)
         deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + seconds
-        while !canceled? && (remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)).positive?
-          sleep([remaining, 0.05].min)
+        @mutex.synchronize do
+          while !@canceled && (remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)).positive?
+            @condition.wait(@mutex, remaining)
+          end
         end
       end
     end
@@ -60,7 +66,8 @@ module Typesafe
       # @param method [Symbol] `:get` or `:post`.
       # @param url [String] absolute URL.
       # @param headers [Hash{String => String}] request headers.
-      # @param body [String, nil] JSON-encoded request body.
+      # @param body [String, nil] encoded request body: JSON, or `multipart/form-data` when the
+      #   request has images, compressed when `Content-Encoding` is set. Send it as-is.
       # @param timeout [Numeric] timeout in seconds.
       # @param signal [Signal, nil] cancellation handle.
       # @return [Response]
@@ -69,6 +76,7 @@ module Typesafe
         check_signal!(signal)
         http = Net::HTTP.new(uri.host, uri.port)
         http.use_ssl = uri.scheme == "https"
+        http.max_retries = 0 # Only the SDK owns retries and retry-count headers.
         http.open_timeout = timeout
         http.read_timeout = timeout
         http.write_timeout = timeout if http.respond_to?(:write_timeout=)
@@ -78,9 +86,7 @@ module Typesafe
         headers.each { |name, value| req[name] = value }
         req.body = body if body
 
-        started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        raw = http.request(req)
-        ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1000).round
+        raw = perform(http, req, timeout, signal)
         body_text = raw.body.to_s
         parsed = parse_body(body_text, raw["content-type"])
         Response.new(
@@ -93,13 +99,56 @@ module Typesafe
         raise
       rescue Net::OpenTimeout, Net::ReadTimeout, Net::WriteTimeout => e
         raise APITimeoutError.new((timeout * 1000).round, cause: e)
-      rescue Errno::ECONNREFUSED, Errno::ECONNRESET, Errno::EHOSTUNREACH, Errno::ETIMEDOUT,
-             SocketError, OpenSSL::SSL::SSLError, EOFError, IOError => e
+      rescue SystemCallError, SocketError, OpenSSL::SSL::SSLError, EOFError, IOError,
+             Net::HTTPBadResponse, Net::ProtocolError, Zlib::Error => e
         raise APIConnectionError.new("Connection error: #{e.message}", cause: e)
       end
 
       private
 
+      # Net::HTTP's read timeout resets for every read. A private worker bounds the
+      # whole connection/upload/body lifecycle without interrupting the caller thread.
+      # Killing it runs Net::HTTP's ensure blocks; join completes socket cleanup before return.
+      def perform(http, request, timeout, signal)
+        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout
+        worker = Thread.new do
+          Thread.current.report_on_exception = false
+          begin
+            [read_response(http, request), nil]
+          rescue StandardError => e
+            [nil, e]
+          end
+        end
+        loop do
+          signal&.check!
+          remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          raise APITimeoutError, (timeout * 1000).round unless remaining.positive?
+          break if worker.join([remaining, 0.01].min)
+        end
+        signal&.check!
+        response, error = worker.value
+        raise error if error
+
+        response
+      ensure
+        worker&.kill&.join
+      end
+
+      def read_response(http, request)
+        http.start do
+          http.request(request) do |response|
+            response.ignore_eof = false if response.respond_to?(:ignore_eof=)
+            response.read_body
+            # Older Ruby releases silently accept short Content-Length bodies.
+            # Net::HTTP removes Content-Length when automatically decompressing.
+            length = response["content-length"]
+            if length && response.body && response.body.bytesize < length.to_i
+              raise EOFError, "Response body ended before Content-Length bytes arrived"
+            end
+          end
+        end
+      end
+
       def check_signal!(signal)
         signal&.check!
       end

data/lib/typesafe/sdk/logging.rb

@@ -64,7 +64,11 @@ module Typesafe
         define_method(severity) do |message, **data|
           return if LogLevel::RANK.fetch(severity) < @rank
 
-          @sink.public_send(severity, message, **data)
+          if data.empty? || @sink.method(severity).parameters.any? { |kind, _| %i[key keyreq keyrest].include?(kind) }
+            @sink.public_send(severity, message, **data)
+          else
+            @sink.public_send(severity, "#{message} #{data.map { |k, v| "#{k}=#{v.inspect}" }.join(' ')}")
+          end
         end
       end
     end
@@ -72,20 +76,28 @@ module Typesafe
     # Credential headers that retain a key suffix for identification.
     module Redaction
       KEY_HEADERS = %w[authorization proxy-authorization x-api-key].freeze
+      # Headers whose values may start with an authentication scheme such as `Bearer`.
+      SCHEME_HEADERS = %w[authorization proxy-authorization].freeze
       OPAQUE_HEADERS = %w[cookie set-cookie].freeze
+      # An alphabetic scheme followed by a nonempty credential (RFC 9110 §11.4).
+      SCHEMED = /\A([A-Za-z]+)[ \t]+(\S.*)\z/m
 
       module_function
 
-      # Mask a key, preserving its scheme and the last four characters of secrets longer than eight.
-      def redact_key(value)
-        scheme, secret = value.include?(" ") ? value.split(/\s+/, 2) : [nil, value]
-        tail = secret && secret.length > 8 ? secret[-4..] : ""
-        "#{"#{scheme} " if scheme}***#{tail}"
+      # Mask a key, keeping the last four characters of secrets longer than eight. An alphabetic
+      # leading scheme, such as `Bearer`, is kept only when `scheme` is true and a credential
+      # follows it; otherwise the whole value is masked, so a secret is never shown as a scheme.
+      def redact_key(value, scheme: true)
+        value = value.to_s
+        match = scheme ? SCHEMED.match(value) : nil
+        prefix, secret = match ? ["#{match[1]} ", match[2].strip] : ["", value.strip]
+        tail = secret.length > 8 ? secret[-4..] : ""
+        "#{prefix}***#{tail}"
       end
 
       def redact(name, value)
         lower = name.downcase
-        return redact_key(value) if KEY_HEADERS.include?(lower)
+        return redact_key(value, scheme: SCHEME_HEADERS.include?(lower)) if KEY_HEADERS.include?(lower)
         return "***" if OPAQUE_HEADERS.include?(lower)
 
         value