@apifuse/provider-sdk 2.2.0-beta.11 → 2.2.0-beta.13

package/src/fixture-sanitization.ts

@@ -0,0 +1,247 @@
+import type { JsonValue } from "./contract-json.js";
+
+export const REDACTED_FIXTURE_VALUE = "[REDACTED]";
+
+const OPAQUE_TOKEN = /^[A-Za-z0-9_+/=.:~-]+$/;
+const OPAQUE_TOKEN_RUN = /[A-Za-z0-9_+/=.:~-]{24,}/g;
+const URL_RUN = /https?:\/\/[^\s"'<>]+/gi;
+const PEM_PRIVATE_KEY =
+	/-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z0-9 ]+ )?PRIVATE KEY-----/g;
+
+/** Matches credential field names without treating benign prefixes such as `author` as `auth`. */
+export function isSensitiveFixtureKey(key: string): boolean {
+	const normalized = key.replace(/[-_\s]/g, "").toLowerCase();
+	const candidates = [normalized, normalized.replace(/(?:value|payload|header)$/, "")];
+	return candidates.some(
+		(candidate) =>
+			/^(?:authorization|authentication|auth|bearer|cookie|credential|password|passwd|privatekey|secret|session|sessionid|token)$/.test(
+				candidate,
+			) ||
+			/^(?:api|client|service|access|consumer)(?:key|secret|token)$/.test(candidate) ||
+			/(?:authorization|credential|password|passwd|privatekey|secret|sessionid|token)$/.test(
+				candidate,
+			),
+	);
+}
+
+/**
+ * Returns JSON fixture data with credential-bearing keys and heuristic-confirmed string secrets
+ * replaced. Ordinary short prose and identifiers are retained.
+ */
+export function sanitizeFixture(value: JsonValue): JsonValue {
+	if (Array.isArray(value)) {
+		return value.map((item) => sanitizeFixture(item));
+	}
+
+	if (typeof value === "string") return sanitizeFixtureString(value);
+	if (value === null || typeof value !== "object") return value;
+
+	return Object.fromEntries(
+		Object.entries(value).map(([key, entryValue]) => [
+			key,
+			isSensitiveFixtureKey(key) ? REDACTED_FIXTURE_VALUE : sanitizeFixture(entryValue),
+		]),
+	);
+}
+
+/** Applies the shared credential-key policy to ordinary JSON fixtures. */
+export function sanitizeOrdinaryFixture(value: JsonValue): JsonValue {
+	if (Array.isArray(value)) return value.map((item) => sanitizeOrdinaryFixture(item));
+	if (value === null || typeof value !== "object") return value;
+	return Object.fromEntries(
+		Object.entries(value).map(([key, entryValue]) => [
+			key,
+			isSensitiveFixtureKey(key) ? REDACTED_FIXTURE_VALUE : sanitizeOrdinaryFixture(entryValue),
+		]),
+	);
+}
+
+/** Sanitizes a primitive fixture string only when textual-secret heuristics match. */
+export function sanitizeFixtureString(value: string): string {
+	let sanitized = value.replace(PEM_PRIVATE_KEY, REDACTED_FIXTURE_VALUE);
+	const retainedUrls: string[] = [];
+	sanitized = sanitized.replace(URL_RUN, (url) => {
+		const index =
+			retainedUrls.push(isCredentialBearingUrl(url) ? sanitizeUrlForLogs(url) : url) - 1;
+		return `APIFUSEURL${index}X`;
+	});
+	sanitized = redactSensitiveAssignments(sanitized);
+	sanitized = sanitized.replace(OPAQUE_TOKEN_RUN, (candidate) =>
+		isSensitiveFixtureValue(candidate) ? REDACTED_FIXTURE_VALUE : candidate,
+	);
+	sanitized = sanitized.replace(
+		/APIFUSEURL(\d+)X/g,
+		(_match, index: string) => retainedUrls[Number(index)] ?? REDACTED_FIXTURE_VALUE,
+	);
+	return sanitized;
+}
+
+/** True for opaque values that are unsafe to retain in paths or unstructured text. */
+export function isSensitiveFixtureValue(value: string): boolean {
+	const candidate = decodePathSegment(value);
+	if (/^bot(?:\d{6,}:)?[A-Za-z0-9_-]{16,}$/i.test(candidate)) return true;
+	if (/^\d{6,}:[A-Za-z0-9_-]{20,}$/.test(candidate)) return true;
+	if (/^(?:gh[opusr]_|sk[-_]|xox[baprs]-)[A-Za-z0-9_-]{16,}$/i.test(candidate)) return true;
+	if (!OPAQUE_TOKEN.test(candidate) || candidate.length < 24) return false;
+	if (/^[a-f0-9]{32,}$/i.test(candidate)) return true;
+	return shannonEntropy(candidate) >= 3.5;
+}
+
+/** Sanitizes every path segment and values following a credential-like segment name. */
+export function sanitizePathname(pathname: string): string {
+	const segments = pathname.split("/");
+	return segments
+		.map((segment, index) => {
+			if (!segment) return segment;
+			const decoded = decodePathSegment(segment);
+			const previous = index > 0 ? decodePathSegment(segments[index - 1] as string) : "";
+			if (
+				isSensitivePathSegment(decoded) ||
+				isCredentialPathKey(previous) ||
+				isSensitiveFixtureValue(decoded)
+			) {
+				return REDACTED_FIXTURE_VALUE;
+			}
+			return segment;
+		})
+		.join("/");
+}
+
+function isCredentialPathKey(key: string): boolean {
+	const finalPathPart = key.split("/").at(-1) ?? "";
+	const baseSegment = finalPathPart.split(";", 1)[0] ?? "";
+	return isSensitiveFixtureKey(baseSegment.split(/[=:]/, 1)[0] ?? "");
+}
+
+function isSensitivePathSegment(segment: string): boolean {
+	return segment
+		.split(/[;/]/)
+		.some((part) => isSensitiveFixtureKey(part.split(/[=:]/, 1)[0] ?? ""));
+}
+
+/** Removes userinfo, query values, fragments, and credential-like path segments from log URLs. */
+export function sanitizeUrlForLogs(value: string): string {
+	try {
+		const parsed = new URL(value, "https://fixture.invalid");
+		const queryMarker = parsed.search ? `?${REDACTED_FIXTURE_VALUE}` : "";
+		const path = sanitizePathname(parsed.pathname);
+		if (parsed.origin === "https://fixture.invalid" && !hasExplicitOrigin(value)) {
+			return `${path}${queryMarker}`;
+		}
+		return `${parsed.origin}${path}${queryMarker}`;
+	} catch {
+		return sanitizePathname(value.split(/[?#]/, 1)[0]);
+	}
+}
+
+/**
+ * Returns query-free request provenance with each path segment scrubbed for credential-like values.
+ * Origins, URL userinfo, query values, and fragments are never persisted in request provenance.
+ */
+export function requestPathForFixture(value: string): string {
+	try {
+		return sanitizePathname(new URL(value, "https://fixture.invalid").pathname);
+	} catch {
+		const path = value.split(/[?#]/, 1)[0];
+		return sanitizePathname(path.startsWith("/") ? path : `/${path}`);
+	}
+}
+
+/** Scrubs secrets and terminal/log control characters before diagnostic text is emitted. */
+export function sanitizeDiagnosticText(value: string): string {
+	let sanitized = value
+		.replace(URL_RUN, (url) => sanitizeUrlForLogs(url))
+		.replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, `Bearer ${REDACTED_FIXTURE_VALUE}`);
+	sanitized = redactSensitiveAssignments(sanitized);
+	sanitized = sanitized.replace(OPAQUE_TOKEN_RUN, (candidate, offset: number, source: string) => {
+		if (/^(?:request|trace|correlation)[-_]?id[:=]/i.test(candidate)) return candidate;
+		const prefix = source.slice(Math.max(0, offset - 32), offset);
+		if (/(?:request|trace|correlation)[-_]?id\s*[:=]\s*$/i.test(prefix)) return candidate;
+		return isSensitiveFixtureValue(candidate) ? REDACTED_FIXTURE_VALUE : candidate;
+	});
+	return encodeDiagnosticControls(sanitized);
+}
+
+function redactSensitiveAssignments(value: string): string {
+	return value.replace(
+		/((["']?)([\w-]+)\2\s*[:=]\s*)("(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,;&]+)/gi,
+		(match, prefix: string, _quote: string, key: string, assignmentValue: string) => {
+			if (!isSensitiveFixtureKey(key) && key.toLowerCase() !== "key") return match;
+			const quote = assignmentValue.startsWith('"')
+				? '"'
+				: assignmentValue.startsWith("'")
+					? "'"
+					: "";
+			return `${prefix}${quote}${REDACTED_FIXTURE_VALUE}${quote}`;
+		},
+	);
+}
+
+function isCredentialBearingUrl(value: string): boolean {
+	try {
+		const parsed = new URL(value);
+		return (
+			parsed.username !== "" ||
+			parsed.password !== "" ||
+			parsed.hash !== "" ||
+			parsed.search !== "" ||
+			parsed.pathname.split("/").some((segment, index, segments) => {
+				const decoded = decodePathSegment(segment);
+				const previous = decodePathSegment(segments[index - 1] ?? "");
+				return (
+					isSensitiveFixtureKey(decoded) ||
+					isCredentialPathKey(previous) ||
+					isSensitiveFixtureValue(decoded)
+				);
+			})
+		);
+	} catch {
+		return false;
+	}
+}
+
+function encodeDiagnosticControls(value: string): string {
+	let result = "";
+	for (const character of value) {
+		const code = character.codePointAt(0) ?? 0;
+		if (code === 0x0a || code === 0x0d || code === 0x2028 || code === 0x2029) {
+			result += " ";
+		} else if (
+			(code >= 0 && code <= 0x1f) ||
+			(code >= 0x7f && code <= 0x9f) ||
+			code === 0x061c ||
+			code === 0x200e ||
+			code === 0x200f ||
+			(code >= 0x202a && code <= 0x202e) ||
+			(code >= 0x2066 && code <= 0x2069)
+		) {
+			result += `\\u${code.toString(16).padStart(4, "0")}`;
+		} else {
+			result += character;
+		}
+	}
+	return result;
+}
+
+function decodePathSegment(value: string): string {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return value;
+	}
+}
+
+function hasExplicitOrigin(value: string): boolean {
+	return /^[a-z][a-z\d+.-]*:\/\//i.test(value);
+}
+
+function shannonEntropy(value: string): number {
+	const counts = new Map<string, number>();
+	for (const character of value) counts.set(character, (counts.get(character) ?? 0) + 1);
+	let entropy = 0;
+	for (const count of counts.values()) {
+		const probability = count / value.length;
+		entropy -= probability * Math.log2(probability);
+	}
+	return entropy;
+}

package/src/index.ts

@@ -7,9 +7,14 @@ export type {
 	ApiFuseConfig,
 	BrowserConfig,
 	ProxyConfig,
+	ProxyProtocol,
+	ProxyResolutionOptions,
+	ProxyResolutionSource,
+	ProxyVendorName,
+	ResolvedProxyConfig,
 	SessionConfig,
 } from "./config/loader.js";
-export { defineConfig, loadApiFuseConfig } from "./config/loader.js";
+export { defineConfig, loadApiFuseConfig, resolveProxy } from "./config/loader.js";
 export {
 	canonicalJson,
 	digestProviderContract,
@@ -65,6 +70,20 @@ export {
 export { createEnvContext } from "./runtime/env.js";
 export { executeOperation } from "./runtime/executor.js";
 export { createHttpClient } from "./runtime/http.js";
+export {
+	createNativeNetworkClient,
+	deriveNativeCredentialAffinityKey,
+	NativeIdleTimeoutError,
+	NativeNetworkError,
+	NativeProxyExpiredError,
+	resolveNativeGatewayProxy,
+	type NativeGatewayProxy,
+	type NativeGatewayProxyResolutionInput,
+	type NativeGatewayProxySynthesizer,
+	type NativeGatewayProxySynthesisInput,
+	type NativeNetworkClientOptions,
+	type NativeNetworkErrorCode,
+} from "./runtime/native-network.js";
 export type { Insight, InsightSeverity } from "./runtime/insights.js";
 export { generateInsights } from "./runtime/insights.js";
 export {
@@ -174,6 +193,26 @@ export type {
 	Iso3166Alpha2CountryCode,
 	Iso4217CurrencyCode,
 	Iso8601Duration,
+	NativeContext,
+	NativeNetworkClient,
+	NativeNetworkCloseReason,
+	NativeNetworkConnection,
+	NativeNetworkConnectInput,
+	NativeNetworkConnectOptions,
+	NativeNetworkDynamicGrantOptions,
+	NativeNetworkEgressGrant,
+	NativeProviderConfig,
+	NativeProviderContext,
+	NativeProxyDrainHandler,
+	NativeProxyEgressInfo,
+	NativeProxyExpiringEvent,
+	NativeProxyExpiringReason,
+	NativeTcpDynamicEgressRule,
+	NativeTcpEgressGrant,
+	NativeTcpEgressRule,
+	NativeTcpPortRange,
+	NativeTcpTlsMode,
+	NativeTlsConnectOptions,
 	OperationAnnotations,
 	OperationApprovalPolicy,
 	OperationContractMetadata,
@@ -208,6 +247,8 @@ export type {
 	ProviderContext,
 	ProviderDefinition,
 	ProviderDeploymentOverrides,
+	ProviderFileRef,
+	ProviderFilesContext,
 	ProviderHealthMonitorConfig,
 	ProviderHealthProbeConfig,
 	ProviderLocale,
@@ -224,6 +265,7 @@ export type {
 	ProviderPublicConnectionMode,
 	ProviderPublicProfile,
 	ProviderReviewed,
+	ProviderResolvedFile,
 	ProviderRuntimeState,
 	ProviderSecretDeclaration,
 	ProviderStateDurationString,
@@ -245,6 +287,8 @@ export type {
 	StateValue,
 	StateWriteOptions,
 	StealthClient,
+	StealthCookieStore,
+	StealthCookieStoreV1,
 	StealthFetchOptions,
 	StealthPlatform,
 	StealthProfile,

package/src/provider.ts

@@ -94,6 +94,26 @@ export type {
 	HttpRetryOptions,
 	HttpRetrySummary,
 	InferSchemaOutput,
+	NativeContext,
+	NativeNetworkClient,
+	NativeNetworkCloseReason,
+	NativeNetworkConnection,
+	NativeNetworkConnectInput,
+	NativeNetworkConnectOptions,
+	NativeNetworkDynamicGrantOptions,
+	NativeNetworkEgressGrant,
+	NativeProviderConfig,
+	NativeProviderContext,
+	NativeProxyDrainHandler,
+	NativeProxyEgressInfo,
+	NativeProxyExpiringEvent,
+	NativeProxyExpiringReason,
+	NativeTcpDynamicEgressRule,
+	NativeTcpEgressGrant,
+	NativeTcpEgressRule,
+	NativeTcpPortRange,
+	NativeTcpTlsMode,
+	NativeTlsConnectOptions,
 	OperationApprovalPolicy,
 	OperationContractMetadata,
 	OperationDefinition,
@@ -116,6 +136,8 @@ export type {
 	ProviderContext,
 	ProviderDefinition,
 	ProviderDeploymentOverrides,
+	ProviderFileRef,
+	ProviderFilesContext,
 	ProviderLocale,
 	ProviderLocaleKey,
 	ProviderLocaleKeyInput,
@@ -123,6 +145,7 @@ export type {
 	ProviderProxyPolicy,
 	ProviderPublicConnectionMode,
 	ProviderPublicProfile,
+	ProviderResolvedFile,
 	ProviderRuntimeState,
 	ProviderStateDurationString,
 	ProviderStateNamespace,
@@ -135,6 +158,20 @@ export type {
 	StateValue,
 	StateWriteOptions,
 } from "./types.js";
+export {
+	createNativeNetworkClient,
+	deriveNativeCredentialAffinityKey,
+	NativeIdleTimeoutError,
+	NativeNetworkError,
+	NativeProxyExpiredError,
+	resolveNativeGatewayProxy,
+	type NativeGatewayProxy,
+	type NativeGatewayProxyResolutionInput,
+	type NativeGatewayProxySynthesizer,
+	type NativeGatewayProxySynthesisInput,
+	type NativeNetworkClientOptions,
+	type NativeNetworkErrorCode,
+} from "./runtime/native-network.js";
 export {
 	HttpRetryAfterPolicy,
 	HttpRetryDelayStrategy,

package/src/runtime/http.ts

@@ -28,7 +28,13 @@ import {
 	shouldRetryProxyTransportAttempt,
 	validateUnsafeProxyTransportRetryMethods,
 } from "./proxy-retry-policy.js";
-import { appendQueryParams, normalizeHttpRequestBody } from "./request-options.js";
+import {
+	normalizeHttpRequestBody,
+	redactSensitiveError,
+	redactSensitiveRequestError,
+	type SerializedRequestUrl,
+	serializeRequestUrl,
+} from "./request-options.js";
 
 const DEFAULT_HTTP_BASE_URL = "http://localhost";
 
@@ -208,9 +214,58 @@ function requireNativeResponseBody(response: Response): ReadableStream<Uint8Arra
 	return response.body;
 }
 
-function toNativeHttpStreamResponse(response: Response): HttpStreamResponse {
+function sanitizeStreamErrors(
+	body: ReadableStream<Uint8Array>,
+	serializedUrl: SerializedRequestUrl,
+): ReadableStream<Uint8Array> {
+	if (serializedUrl.sensitiveValues.length === 0) return body;
+
+	let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;
+	return new ReadableStream<Uint8Array>(
+		{
+			async pull(controller) {
+				try {
+					reader ??= body.getReader();
+					const chunk = await reader.read();
+					if (chunk.done) {
+						controller.close();
+						return;
+					}
+					controller.enqueue(chunk.value);
+				} catch (error) {
+					controller.error(
+						redactSensitiveError(
+							error,
+							serializedUrl.sensitiveValues,
+							serializedUrl.requestUrl,
+							serializedUrl.redactedUrl,
+						),
+					);
+				}
+			},
+			async cancel(reason) {
+				try {
+					await (reader ? reader.cancel(reason) : body.cancel(reason));
+				} catch (error) {
+					throw redactSensitiveError(
+						error,
+						serializedUrl.sensitiveValues,
+						serializedUrl.requestUrl,
+						serializedUrl.redactedUrl,
+					);
+				}
+			},
+		},
+		{ highWaterMark: 0 },
+	);
+}
+
+function toNativeHttpStreamResponse(
+	response: Response,
+	serializedUrl: SerializedRequestUrl,
+): HttpStreamResponse {
 	const headers = Object.fromEntries(response.headers.entries());
-	const body = requireNativeResponseBody(response);
+	const body = sanitizeStreamErrors(requireNativeResponseBody(response), serializedUrl);
 	return {
 		body,
 		headers,
@@ -305,6 +360,22 @@ function normalizeNativeFetchBody(body: unknown): string | ArrayBuffer | undefin
 	return copied.buffer;
 }
 
+function serializeHttpRequestUrl(
+	baseUrl: string | undefined,
+	url: string,
+	options: RequestOptions,
+): SerializedRequestUrl {
+	try {
+		return serializeRequestUrl(
+			resolveHttpUrl(baseUrl, url),
+			options.params,
+			options.sensitiveParams,
+		);
+	} catch (error) {
+		throw redactSensitiveRequestError(error, url, options.sensitiveParams);
+	}
+}
+
 async function fetchNativeHttp(
 	baseUrl: string | undefined,
 	url: string,
@@ -316,7 +387,8 @@ async function fetchNativeHttp(
 	proxyAttemptOffset = 0,
 	dedupe?: { attempted: Set<string> },
 ): Promise<NativeHttpAttemptOutcome> {
-	const requestUrl = appendQueryParams(resolveHttpUrl(baseUrl, url), options.params);
+	const serializedUrl = serializeHttpRequestUrl(baseUrl, url, options);
+	const { requestUrl } = serializedUrl;
 	const controller = options.timeout ? new AbortController() : undefined;
 	const timeoutHandle = options.timeout
 		? setTimeout(() => controller?.abort(), options.timeout)
@@ -374,9 +446,19 @@ async function fetchNativeHttp(
 		return toNativeHttpResponse(response);
 	} catch (error) {
 		if (error instanceof SyntaxError) {
-			throw error;
+			throw redactSensitiveError(
+				error,
+				serializedUrl.sensitiveValues,
+				serializedUrl.requestUrl,
+				serializedUrl.redactedUrl,
+			);
 		}
-		const transportError = toHttpTransportError(error) as NativeHttpAttemptError;
+		const transportError: NativeHttpAttemptError = redactSensitiveError(
+			toHttpTransportError(error),
+			serializedUrl.sensitiveValues,
+			serializedUrl.requestUrl,
+			serializedUrl.redactedUrl,
+		);
 		transportError.proxyUsed = Boolean(proxy);
 		throw transportError;
 	} finally {
@@ -392,7 +474,8 @@ async function fetchNativeHttpStream(
 	clientOptions: HttpClientOptions,
 	warn: (message: string) => void,
 ): Promise<HttpStreamResponse> {
-	const requestUrl = appendQueryParams(resolveHttpUrl(baseUrl, url), options.params);
+	const serializedUrl = serializeHttpRequestUrl(baseUrl, url, options);
+	const { requestUrl } = serializedUrl;
 	const controller = options.timeout ? new AbortController() : undefined;
 	const timeoutHandle = options.timeout
 		? setTimeout(() => controller?.abort(), options.timeout)
@@ -421,12 +504,22 @@ async function fetchNativeHttpStream(
 			});
 		}
 
-		return toNativeHttpStreamResponse(response);
+		return toNativeHttpStreamResponse(response, serializedUrl);
 	} catch (error) {
 		if (error instanceof SyntaxError) {
-			throw error;
+			throw redactSensitiveError(
+				error,
+				serializedUrl.sensitiveValues,
+				serializedUrl.requestUrl,
+				serializedUrl.redactedUrl,
+			);
 		}
-		throw toHttpTransportError(error);
+		throw redactSensitiveError(
+			toHttpTransportError(error),
+			serializedUrl.sensitiveValues,
+			serializedUrl.requestUrl,
+			serializedUrl.redactedUrl,
+		);
 	} finally {
 		if (timeoutHandle) clearTimeout(timeoutHandle);
 	}
@@ -451,22 +544,29 @@ export function createHttpClient(
 		method: string,
 		options: RequestOptions & { body?: unknown } = {},
 	): Promise<HttpResponse> {
-		if (!baseUrl && !isAbsoluteUrl(url)) {
-			throw new TransportError(
-				"ctx.http requires an absolute URL when provider.upstream.baseUrl is not declared",
-				{ code: "transport_invalid_url" },
-			);
-		}
-		assertNoHttpTransportOverrides(options);
-		const headersOptions = withClientHeaders(options, clientOptions, options.body);
-		const methodName = normalizeHttpMethod(method);
-		const explicitRetry = headersOptions.retry !== undefined;
-		const retryOptions =
-			normalizeProxyTransportRetryOptions(headersOptions.retry, {
-				label: "HTTP",
-			}) ??
-			(explicitRetry ? undefined : createDefaultProxyTransportRetryOptions({ label: "HTTP" }));
-		if (retryOptions) validateUnsafeProxyTransportRetryMethods(retryOptions, "HTTP");
+		const { explicitRetry, headersOptions, methodName, retryOptions } = (() => {
+			try {
+				if (!baseUrl && !isAbsoluteUrl(url)) {
+					throw new TransportError(
+						"ctx.http requires an absolute URL when provider.upstream.baseUrl is not declared",
+						{ code: "transport_invalid_url" },
+					);
+				}
+				assertNoHttpTransportOverrides(options);
+				const headersOptions = withClientHeaders(options, clientOptions, options.body);
+				const methodName = normalizeHttpMethod(method);
+				const explicitRetry = headersOptions.retry !== undefined;
+				const retryOptions =
+					normalizeProxyTransportRetryOptions(headersOptions.retry, {
+						label: "HTTP",
+					}) ??
+					(explicitRetry ? undefined : createDefaultProxyTransportRetryOptions({ label: "HTTP" }));
+				if (retryOptions) validateUnsafeProxyTransportRetryMethods(retryOptions, "HTTP");
+				return { explicitRetry, headersOptions, methodName, retryOptions };
+			} catch (error) {
+				throw redactSensitiveRequestError(error, url, options.sensitiveParams);
+			}
+		})();
 		const retryEnabled = Boolean(
 			retryOptions &&
 				retryOptions.attempts > 1 &&
@@ -531,9 +631,7 @@ export function createHttpClient(
 			explicitRetry,
 			method: methodName,
 		});
-		const dedupeContext = dedupeAllocatorEndpoints
-			? { attempted: new Set<string>() }
-			: undefined;
+		const dedupeContext = dedupeAllocatorEndpoints ? { attempted: new Set<string>() } : undefined;
 
 		const executeOnce = (proxyAttemptOffset = 0): Promise<NativeHttpAttemptOutcome> =>
 			fetchNativeHttp(
@@ -654,15 +752,23 @@ export function createHttpClient(
 		method: string,
 		options: RequestOptions & { body?: unknown } = {},
 	): Promise<HttpStreamResponse> {
-		if (!baseUrl && !isAbsoluteUrl(url)) {
-			throw new TransportError(
-				"ctx.http requires an absolute URL when provider.upstream.baseUrl is not declared",
-				{ code: "transport_invalid_url" },
-			);
-		}
-		assertNoHttpTransportOverrides(options);
-		const headersOptions = withClientHeaders(options, clientOptions, options.body);
-		const methodName = normalizeHttpMethod(method);
+		const { headersOptions, methodName } = (() => {
+			try {
+				if (!baseUrl && !isAbsoluteUrl(url)) {
+					throw new TransportError(
+						"ctx.http requires an absolute URL when provider.upstream.baseUrl is not declared",
+						{ code: "transport_invalid_url" },
+					);
+				}
+				assertNoHttpTransportOverrides(options);
+				return {
+					headersOptions: withClientHeaders(options, clientOptions, options.body),
+					methodName: normalizeHttpMethod(method),
+				};
+			} catch (error) {
+				throw redactSensitiveRequestError(error, url, options.sensitiveParams);
+			}
+		})();
 		return fetchNativeHttpStream(baseUrl, url, methodName, headersOptions, clientOptions, warnOnce);
 	}