@apifuse/provider-sdk 2.2.0-beta.2 → 2.2.0-beta.21

package/src/runtime/http.ts

@@ -1,17 +1,23 @@
-import type { ProxyResolutionOptions } from "../config/loader";
-import { resolveProxyConfigAsync } from "../config/loader";
-import { ProviderError, TransportError } from "../errors";
-import { parseSseStream, readableBytes, readableLines, readableTextChunks } from "../stream";
+import type { ProxyResolutionOptions } from "../config/loader.js";
+import {
+	policyRotatesTransportVendorChain,
+	resolvePolicyTransportAttemptCap,
+	resolveProxyConfigAsync,
+} from "../config/loader.js";
+import { HttpRedirectError, ProviderError, TransportError } from "../errors.js";
+import { parseSseStream, readableBytes, readableLines, readableTextChunks } from "../stream.js";
 import type {
 	HttpClient,
 	HttpMethod,
+	HttpRedirectPolicy,
 	HttpResponse,
 	HttpRetrySummary,
 	HttpStreamResponse,
+	ProviderProxyPolicy,
 	RequestOptions,
 	RequestWithMethodOptions,
 	SseMessage,
-} from "../types";
+} from "../types.js";
 import {
 	computeProxyAttemptIndex,
 	computeProxyTransportRetryDelayMs,
@@ -22,8 +28,15 @@ import {
 	proxyTransportRetryErrorStatus,
 	shouldRetryProxyTransportAttempt,
 	validateUnsafeProxyTransportRetryMethods,
-} from "./proxy-retry-policy";
-import { appendQueryParams, normalizeHttpRequestBody } from "./request-options";
+} from "./proxy-retry-policy.js";
+import { evaluateRedirectHop, isRedirectStatus, resolveRedirectUrl } from "./redirects.js";
+import {
+	normalizeHttpRequestBody,
+	redactSensitiveError,
+	redactSensitiveRequestError,
+	type SerializedRequestUrl,
+	serializeRequestUrl,
+} from "./request-options.js";
 
 const DEFAULT_HTTP_BASE_URL = "http://localhost";
 
@@ -41,16 +54,28 @@ type HttpStatusOutcome = {
 	proxyUsed: boolean;
 };
 
-type NativeHttpAttemptOutcome = HttpResponse | HttpStatusOutcome;
+/**
+ * Sentinel returned when a policy-allocator attempt resolved an endpoint that a
+ * prior attempt already tried (an under-filled pool repeats endpoints via the
+ * modulo mapping before the flat offset crosses into the next vendor). The retry
+ * loop advances to the next offset rather than re-issuing the request — but does
+ * NOT treat it as chain exhaustion, so the offset still walks into the fallback
+ * vendor's span.
+ */
+type NativeHttpSkipOutcome = { kind: "dedupe-skip" };
+
+type NativeHttpAttemptOutcome = HttpResponse | HttpStatusOutcome | NativeHttpSkipOutcome;
 
 type NativeHttpAttemptError = TransportError & { proxyUsed?: boolean };
 
-function isHttpStatusOutcome(
-	outcome: HttpResponse | HttpStatusOutcome,
-): outcome is HttpStatusOutcome {
+function isHttpStatusOutcome(outcome: NativeHttpAttemptOutcome): outcome is HttpStatusOutcome {
 	return "kind" in outcome && outcome.kind === "http-status";
 }
 
+function isDedupeSkipOutcome(outcome: NativeHttpAttemptOutcome): outcome is NativeHttpSkipOutcome {
+	return "kind" in outcome && outcome.kind === "dedupe-skip";
+}
+
 async function sleep(ms: number): Promise<void> {
 	if (ms <= 0) return;
 	await new Promise((resolve) => setTimeout(resolve, ms));
@@ -191,9 +216,58 @@ function requireNativeResponseBody(response: Response): ReadableStream<Uint8Arra
 	return response.body;
 }
 
-function toNativeHttpStreamResponse(response: Response): HttpStreamResponse {
+function sanitizeStreamErrors(
+	body: ReadableStream<Uint8Array>,
+	serializedUrl: SerializedRequestUrl,
+): ReadableStream<Uint8Array> {
+	if (serializedUrl.sensitiveValues.length === 0) return body;
+
+	let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;
+	return new ReadableStream<Uint8Array>(
+		{
+			async pull(controller) {
+				try {
+					reader ??= body.getReader();
+					const chunk = await reader.read();
+					if (chunk.done) {
+						controller.close();
+						return;
+					}
+					controller.enqueue(chunk.value);
+				} catch (error) {
+					controller.error(
+						redactSensitiveError(
+							error,
+							serializedUrl.sensitiveValues,
+							serializedUrl.requestUrl,
+							serializedUrl.redactedUrl,
+						),
+					);
+				}
+			},
+			async cancel(reason) {
+				try {
+					await (reader ? reader.cancel(reason) : body.cancel(reason));
+				} catch (error) {
+					throw redactSensitiveError(
+						error,
+						serializedUrl.sensitiveValues,
+						serializedUrl.requestUrl,
+						serializedUrl.redactedUrl,
+					);
+				}
+			},
+		},
+		{ highWaterMark: 0 },
+	);
+}
+
+function toNativeHttpStreamResponse(
+	response: Response,
+	serializedUrl: SerializedRequestUrl,
+): HttpStreamResponse {
 	const headers = Object.fromEntries(response.headers.entries());
-	const body = requireNativeResponseBody(response);
+	const body = sanitizeStreamErrors(requireNativeResponseBody(response), serializedUrl);
 	return {
 		body,
 		headers,
@@ -240,6 +314,200 @@ function resolveHttpUrl(baseUrl: string | undefined, url: string): string {
 
 type NativeFetchInit = RequestInit & { proxy?: string };
 
+const MAX_HTTP_REDIRECT_HOPS = 20;
+const HTTP_REDIRECT_POLICY_FIELDS = new Set(["mode", "maxHops"]);
+const REDIRECT_BODY_HEADERS = new Set([
+	"content-encoding",
+	"content-language",
+	"content-location",
+	"content-type",
+]);
+const MALFORMED_REDIRECT_TARGET = "[malformed redirect target]";
+
+function invalidHttpRedirectPolicy(message: string, cause?: Error): TransportError {
+	return new TransportError(`Invalid ctx.http redirectPolicy: ${message}`, {
+		code: "http_redirect_policy_invalid",
+		...(cause ? { cause } : {}),
+	});
+}
+
+/** Snapshot untrusted caller input synchronously, before proxy resolution or fetch. */
+function normalizeHttpRedirectPolicy(value: unknown): HttpRedirectPolicy | undefined {
+	if (value === undefined) return undefined;
+	if (value === null || typeof value !== "object" || Array.isArray(value)) {
+		throw invalidHttpRedirectPolicy("expected an object");
+	}
+
+	try {
+		const keys = Reflect.ownKeys(value);
+		for (const key of keys) {
+			if (typeof key !== "string" || !HTTP_REDIRECT_POLICY_FIELDS.has(key)) {
+				throw invalidHttpRedirectPolicy(`unknown field ${String(key)}`);
+			}
+		}
+		for (const field of HTTP_REDIRECT_POLICY_FIELDS) {
+			const descriptor = Object.getOwnPropertyDescriptor(value, field);
+			if (!descriptor || !("value" in descriptor)) {
+				throw invalidHttpRedirectPolicy(`${field} must be an own data property`);
+			}
+		}
+
+		const record = value as Record<string, unknown>;
+		if (record.mode !== "same-origin") {
+			throw invalidHttpRedirectPolicy('mode must be "same-origin"');
+		}
+		if (
+			typeof record.maxHops !== "number" ||
+			!Number.isInteger(record.maxHops) ||
+			record.maxHops < 0 ||
+			record.maxHops > MAX_HTTP_REDIRECT_HOPS
+		) {
+			throw invalidHttpRedirectPolicy(
+				`maxHops must be an integer from 0 to ${MAX_HTTP_REDIRECT_HOPS}`,
+			);
+		}
+
+		return { mode: "same-origin", maxHops: record.maxHops };
+	} catch (error) {
+		if (error instanceof TransportError) throw error;
+		throw invalidHttpRedirectPolicy(
+			"could not be inspected safely",
+			error instanceof Error ? error : undefined,
+		);
+	}
+}
+
+function snapshotHttpRedirectPolicy(options: RequestOptions): HttpRedirectPolicy | undefined {
+	try {
+		return normalizeHttpRedirectPolicy(options.redirectPolicy);
+	} catch (error) {
+		if (error instanceof TransportError) throw error;
+		throw invalidHttpRedirectPolicy(
+			"could not be read safely",
+			error instanceof Error ? error : undefined,
+		);
+	}
+}
+
+function withoutRedirectBodyHeaders(headers: HeadersInit | undefined): Headers {
+	const nextHeaders = new Headers(headers);
+	for (const name of REDIRECT_BODY_HEADERS) nextHeaders.delete(name);
+	return nextHeaders;
+}
+
+function redirectDiagnosticTarget(value: string): string {
+	try {
+		const parsed = new URL(value);
+		// Origin omits URL userinfo. Keeping only origin + path makes diagnostics
+		// useful while structurally excluding every query value and fragment,
+		// including attacker-chosen keys the provider did not declare sensitive.
+		const redactedQuery = parsed.search ? "?[REDACTED]" : "";
+		return parsed.origin === "null"
+			? `${parsed.protocol}<opaque-target>`
+			: `${parsed.origin}${parsed.pathname}${redactedQuery}`;
+	} catch {
+		return MALFORMED_REDIRECT_TARGET;
+	}
+}
+
+function discardRedirectResponseBody(response: Response): void {
+	try {
+		const cancellation = response.body?.cancel();
+		if (cancellation) void cancellation.catch(() => undefined);
+	} catch {
+		// The redirect decision is security-significant and must not be replaced
+		// or delayed by an upstream body's cancellation failure. Cancellation was
+		// attempted; redirect evaluation continues without awaiting its completion.
+	}
+}
+
+async function fetchWithHttpRedirectPolicy(
+	requestUrl: string,
+	requestInit: NativeFetchInit,
+	policy: HttpRedirectPolicy | undefined,
+): Promise<Response> {
+	if (!policy) return fetch(requestUrl, requestInit);
+
+	const initialUrl = new URL(requestUrl);
+	if (initialUrl.protocol !== "http:" && initialUrl.protocol !== "https:") {
+		throw new TransportError("ctx.http redirectPolicy requires an HTTP(S) origin", {
+			code: "transport_invalid_url",
+		});
+	}
+
+	const initialOrigin = initialUrl.origin;
+	let currentUrl = requestUrl;
+	let method = normalizeHttpMethod(requestInit.method ?? "GET");
+	let body = requestInit.body;
+	let headers = requestInit.headers;
+	let followedHops = 0;
+	const visitedRequests = new Set([`${method} ${currentUrl}`]);
+
+	while (true) {
+		const response = await fetch(currentUrl, {
+			...requestInit,
+			body,
+			headers,
+			method,
+			redirect: "manual",
+		});
+		if (!isRedirectStatus(response.status)) return response;
+
+		const location = response.headers.get("location");
+		discardRedirectResponseBody(response);
+		let nextUrlString: string | undefined;
+		try {
+			nextUrlString = resolveRedirectUrl(location || undefined, currentUrl);
+		} catch {
+			const target = MALFORMED_REDIRECT_TARGET;
+			throw new HttpRedirectError(`Redirect response has malformed Location target ${target}`, {
+				reason: "missing_location",
+				target,
+				status: response.status,
+			});
+		}
+
+		const decision = evaluateRedirectHop({
+			status: response.status,
+			method,
+			nextUrl: nextUrlString,
+			shouldStop: nextUrlString ? new URL(nextUrlString).origin !== initialOrigin : false,
+			redirectCount: followedHops + 1,
+			maxHops: policy.maxHops,
+			visitedRequests,
+		});
+		if (decision.kind === "stop") {
+			const target = decision.nextUrl ? redirectDiagnosticTarget(decision.nextUrl) : undefined;
+			const message = (() => {
+				switch (decision.reason) {
+					case "stopped":
+						return `Redirect policy refused cross-origin target ${target}`;
+					case "max_hops":
+						return `Redirect policy reached maxHops before target ${target}`;
+					case "loop":
+						return `Redirect loop refused target ${target}`;
+					case "missing_location":
+						return `Redirect response from ${redirectDiagnosticTarget(currentUrl)} is missing Location`;
+			}
+			})();
+			throw new HttpRedirectError(message, {
+				reason: decision.reason,
+				...(target ? { target } : {}),
+				status: response.status,
+			});
+		}
+		if (decision.nextMethod !== method) {
+			body = undefined;
+			headers = withoutRedirectBodyHeaders(headers);
+		}
+
+		method = decision.nextMethod;
+		currentUrl = decision.nextUrl;
+		followedHops += 1;
+		visitedRequests.add(`${method} ${currentUrl}`);
+	}
+}
+
 async function resolveNativeProxy(
 	options: RequestOptions,
 	clientOptions: HttpClientOptions,
@@ -256,6 +524,9 @@ async function resolveNativeProxy(
 			baseProxyAttempt: clientOptions.proxyAttempt,
 			retryAttemptOffset: proxyAttemptOffset,
 		}),
+		// Bun's native fetch proxy option tunnels HTTP CONNECT only; SOCKS5 is not
+		// supported here, so a socks5 policy fails loudly rather than downgrading.
+		transportProtocols: ["http"],
 		telemetry: clientOptions.telemetry,
 	});
 	if (resolvedProxy.shouldWarn) {
@@ -285,6 +556,22 @@ function normalizeNativeFetchBody(body: unknown): string | ArrayBuffer | undefin
 	return copied.buffer;
 }
 
+function serializeHttpRequestUrl(
+	baseUrl: string | undefined,
+	url: string,
+	options: RequestOptions,
+): SerializedRequestUrl {
+	try {
+		return serializeRequestUrl(
+			resolveHttpUrl(baseUrl, url),
+			options.params,
+			options.sensitiveParams,
+		);
+	} catch (error) {
+		throw redactSensitiveRequestError(error, url, options.sensitiveParams);
+	}
+}
+
 async function fetchNativeHttp(
 	baseUrl: string | undefined,
 	url: string,
@@ -294,8 +581,10 @@ async function fetchNativeHttp(
 	warn: (message: string) => void,
 	statusRetryCodes?: readonly number[],
 	proxyAttemptOffset = 0,
+	dedupe?: { attempted: Set<string> },
 ): Promise<NativeHttpAttemptOutcome> {
-	const requestUrl = appendQueryParams(resolveHttpUrl(baseUrl, url), options.params);
+	const serializedUrl = serializeHttpRequestUrl(baseUrl, url, options);
+	const { requestUrl } = serializedUrl;
 	const controller = options.timeout ? new AbortController() : undefined;
 	const timeoutHandle = options.timeout
 		? setTimeout(() => controller?.abort(), options.timeout)
@@ -303,7 +592,20 @@ async function fetchNativeHttp(
 
 	let proxy: string | undefined;
 	try {
+		// Resolve inside the try (and after the timeout is armed) so allocator
+		// failures are branded as TransportErrors and count against the request
+		// deadline, exactly as an inline resolve would.
 		proxy = await resolveNativeProxy(options, clientOptions, warn, proxyAttemptOffset);
+		// For a registry allocator chain, skip an endpoint a prior attempt already
+		// tried rather than re-issuing the same request. Returning the sentinel
+		// (instead of breaking) lets the loop keep advancing the flat offset until
+		// it crosses into the fallback vendor's pool span.
+		if (dedupe && proxy) {
+			if (dedupe.attempted.has(proxy)) {
+				return { kind: "dedupe-skip" };
+			}
+			dedupe.attempted.add(proxy);
+		}
 		const requestInit: NativeFetchInit = {
 			headers: options.headers,
 			method,
@@ -313,9 +615,11 @@ async function fetchNativeHttp(
 		if (options.body !== undefined) {
 			requestInit.body = normalizeNativeFetchBody(options.body);
 		}
-		const response = await fetch(requestUrl, {
-			...requestInit,
-		});
+		const response = await fetchWithHttpRedirectPolicy(
+			requestUrl,
+			requestInit,
+			options.redirectPolicy,
+		);
 		const headers = Object.fromEntries(response.headers.entries());
 
 		if (statusRetryCodes && response.status >= 400) {
@@ -340,9 +644,19 @@ async function fetchNativeHttp(
 		return toNativeHttpResponse(response);
 	} catch (error) {
 		if (error instanceof SyntaxError) {
-			throw error;
+			throw redactSensitiveError(
+				error,
+				serializedUrl.sensitiveValues,
+				serializedUrl.requestUrl,
+				serializedUrl.redactedUrl,
+			);
 		}
-		const transportError = toHttpTransportError(error) as NativeHttpAttemptError;
+		const transportError: NativeHttpAttemptError = redactSensitiveError(
+			toHttpTransportError(error),
+			serializedUrl.sensitiveValues,
+			serializedUrl.requestUrl,
+			serializedUrl.redactedUrl,
+		);
 		transportError.proxyUsed = Boolean(proxy);
 		throw transportError;
 	} finally {
@@ -358,7 +672,8 @@ async function fetchNativeHttpStream(
 	clientOptions: HttpClientOptions,
 	warn: (message: string) => void,
 ): Promise<HttpStreamResponse> {
-	const requestUrl = appendQueryParams(resolveHttpUrl(baseUrl, url), options.params);
+	const serializedUrl = serializeHttpRequestUrl(baseUrl, url, options);
+	const { requestUrl } = serializedUrl;
 	const controller = options.timeout ? new AbortController() : undefined;
 	const timeoutHandle = options.timeout
 		? setTimeout(() => controller?.abort(), options.timeout)
@@ -375,9 +690,11 @@ async function fetchNativeHttpStream(
 		if (options.body !== undefined) {
 			requestInit.body = normalizeNativeFetchBody(options.body);
 		}
-		const response = await fetch(requestUrl, {
-			...requestInit,
-		});
+		const response = await fetchWithHttpRedirectPolicy(
+			requestUrl,
+			requestInit,
+			options.redirectPolicy,
+		);
 
 		if (response.status >= 400 && options.throwOnHttpError !== false) {
 			await drainNativeResponseBody(response);
@@ -387,12 +704,22 @@ async function fetchNativeHttpStream(
 			});
 		}
 
-		return toNativeHttpStreamResponse(response);
+		return toNativeHttpStreamResponse(response, serializedUrl);
 	} catch (error) {
 		if (error instanceof SyntaxError) {
-			throw error;
+			throw redactSensitiveError(
+				error,
+				serializedUrl.sensitiveValues,
+				serializedUrl.requestUrl,
+				serializedUrl.redactedUrl,
+			);
 		}
-		throw toHttpTransportError(error);
+		throw redactSensitiveError(
+			toHttpTransportError(error),
+			serializedUrl.sensitiveValues,
+			serializedUrl.requestUrl,
+			serializedUrl.redactedUrl,
+		);
 	} finally {
 		if (timeoutHandle) clearTimeout(timeoutHandle);
 	}
@@ -417,22 +744,33 @@ export function createHttpClient(
 		method: string,
 		options: RequestOptions & { body?: unknown } = {},
 	): Promise<HttpResponse> {
-		if (!baseUrl && !isAbsoluteUrl(url)) {
-			throw new TransportError(
-				"ctx.http requires an absolute URL when provider.upstream.baseUrl is not declared",
-				{ code: "transport_invalid_url" },
-			);
-		}
-		assertNoHttpTransportOverrides(options);
-		const headersOptions = withClientHeaders(options, clientOptions, options.body);
-		const methodName = normalizeHttpMethod(method);
-		const explicitRetry = headersOptions.retry !== undefined;
-		const retryOptions =
-			normalizeProxyTransportRetryOptions(headersOptions.retry, {
-				label: "HTTP",
-			}) ??
-			(explicitRetry ? undefined : createDefaultProxyTransportRetryOptions({ label: "HTTP" }));
-		if (retryOptions) validateUnsafeProxyTransportRetryMethods(retryOptions, "HTTP");
+		const { explicitRetry, headersOptions, methodName, retryOptions } = (() => {
+			try {
+				if (!baseUrl && !isAbsoluteUrl(url)) {
+					throw new TransportError(
+						"ctx.http requires an absolute URL when provider.upstream.baseUrl is not declared",
+						{ code: "transport_invalid_url" },
+					);
+				}
+				assertNoHttpTransportOverrides(options);
+				const redirectPolicy = snapshotHttpRedirectPolicy(options);
+				const headersOptions = {
+					...withClientHeaders(options, clientOptions, options.body),
+					redirectPolicy,
+				};
+				const methodName = normalizeHttpMethod(method);
+				const explicitRetry = headersOptions.retry !== undefined;
+				const retryOptions =
+					normalizeProxyTransportRetryOptions(headersOptions.retry, {
+						label: "HTTP",
+					}) ??
+					(explicitRetry ? undefined : createDefaultProxyTransportRetryOptions({ label: "HTTP" }));
+				if (retryOptions) validateUnsafeProxyTransportRetryMethods(retryOptions, "HTTP");
+				return { explicitRetry, headersOptions, methodName, retryOptions };
+			} catch (error) {
+				throw redactSensitiveRequestError(error, url, options.sensitiveParams);
+			}
+		})();
 		const retryEnabled = Boolean(
 			retryOptions &&
 				retryOptions.attempts > 1 &&
@@ -449,6 +787,56 @@ export function createHttpClient(
 			? { ...headersOptions, throwOnHttpError: false }
 			: headersOptions;
 
+		// Span the whole vendor chain on transport failures. Like ctx.stealth, a
+		// policy-managed proxy resolves a *different* endpoint/vendor per attempt
+		// (the flat proxyAttemptOffset rotates across the concatenated vendor pool
+		// spans), so a transport failure should advance to the next endpoint —
+		// potentially crossing into the fallback vendor — rather than stopping at
+		// the per-endpoint retry budget and stranding the request on the primary
+		// vendor. resolvePolicyTransportAttemptCap widens the cap to the chain span
+		// only for implicit, safe-method allocator requests; explicit retry
+		// policies (their documented `attempts` ceiling), unsafe methods, and
+		// static/non-registry vendors keep the retry budget. Status-code retries
+		// stay bounded by the retry budget regardless; only transport rotation gets
+		// the full span.
+		const policyProxy: ProviderProxyPolicy | undefined = (() => {
+			const policy = clientOptions.proxyPolicy ?? clientOptions.upstream?.proxy;
+			return policy && typeof policy === "object" ? policy : undefined;
+		})();
+		const usesPolicyAllocator = Boolean(policyProxy) && !options.proxy && !clientOptions.proxy;
+		const transportAttemptCap = retryOptions
+			? resolvePolicyTransportAttemptCap({
+					policy: policyProxy,
+					usesPolicyAllocator,
+					retryAttempts: retryOptions.attempts,
+					explicitRetry,
+					method: methodName,
+				})
+			: 1;
+
+		// Track resolved endpoints across a policy-allocator chain. Successive
+		// attempts rotate the flat offset across the concatenated vendor pool
+		// spans, but an under-filled allocation (fewer live endpoints than the
+		// configured pool size) makes the modulo mapping repeat endpoints before
+		// the offset reaches the next vendor. Rather than re-hammering an
+		// already-tried endpoint under backoff, fetchNativeHttp returns a skip
+		// sentinel for a duplicate; the loop then advances the flat offset without
+		// issuing the request, so it keeps walking toward — and into — the fallback
+		// vendor's pool span instead of stalling on the primary vendor.
+		// De-duplication is gated on the SAME predicate that widens the attempt cap
+		// (implicit, safe-method, registry-chain rotation). It must NOT engage for
+		// an explicit retry policy: there the caller's `attempts` count is the
+		// contract and each attempt must issue against whatever endpoint it resolves
+		// — even a repeat — instead of being silently skipped (which would collapse
+		// a `poolSize: 1` + `attempts: 3` request to a single fetch).
+		const dedupeAllocatorEndpoints = policyRotatesTransportVendorChain({
+			policy: policyProxy,
+			usesPolicyAllocator,
+			explicitRetry,
+			method: methodName,
+		});
+		const dedupeContext = dedupeAllocatorEndpoints ? { attempted: new Set<string>() } : undefined;
+
 		const executeOnce = (proxyAttemptOffset = 0): Promise<NativeHttpAttemptOutcome> =>
 			fetchNativeHttp(
 				baseUrl,
@@ -459,24 +847,52 @@ export function createHttpClient(
 				warnOnce,
 				statusRetryEnabled ? retryOptions?.statusCodes : undefined,
 				proxyAttemptOffset,
+				dedupeContext,
 			);
 
 		if (!retryEnabled || !retryOptions) {
 			const outcome = await executeOnce();
+			if (isDedupeSkipOutcome(outcome)) {
+				// Single-shot path never de-duplicates (dedupeContext is undefined),
+				// but keep the union total.
+				throw new TransportError("HTTP request produced no terminal result", {
+					code: "retry_exhausted",
+				});
+			}
 			if (isHttpStatusOutcome(outcome)) {
 				throw toUpstreamHttpError(outcome.status);
 			}
 			return outcome;
 		}
 
+		let lastError: unknown;
 		let lastErrorCode: string | undefined;
 		let lastStatus: number | undefined;
-		for (let attempt = 1; attempt <= retryOptions.attempts; attempt += 1) {
+		// `attempt` walks the flat proxy offset across the full chain span; `issued`
+		// counts requests that were actually sent (skipped duplicate offsets do not
+		// increment it). Retry summaries and the status-retry budget must reflect
+		// issued requests, not the raw offset, so they stay accurate when partial
+		// allocations skip offsets.
+		let issued = 0;
+		for (let attempt = 1; attempt <= transportAttemptCap; attempt += 1) {
+			// Whether this offset actually issued a request (vs. a skipped duplicate),
+			// so the catch counts a thrown *transport* failure once without
+			// double-counting a status outcome that already incremented before it
+			// re-threw as an upstream HTTP error.
+			let issuedThisAttempt = false;
 			try {
 				const outcome = await executeOnce(attempt - 1);
+				if (isDedupeSkipOutcome(outcome)) {
+					// Duplicate endpoint from a partial allocation: advance the flat
+					// offset without issuing the request (no backoff, not a failure) so
+					// the loop keeps rotating toward the fallback vendor.
+					continue;
+				}
+				issued += 1;
+				issuedThisAttempt = true;
 				if (isHttpStatusOutcome(outcome)) {
 					lastStatus = outcome.status;
-					if (outcome.retryable && attempt < retryOptions.attempts) {
+					if (outcome.retryable && issued < retryOptions.attempts) {
 						await sleep(computeProxyTransportRetryDelayMs(retryOptions, attempt, outcome.headers));
 						continue;
 					}
@@ -488,10 +904,10 @@ export function createHttpClient(
 					throw toUpstreamHttpError(response.status);
 				}
 
-				if (attempt > 1) {
+				if (issued > 1) {
 					const summary: HttpRetrySummary = {
-						attempts: attempt,
-						retries: attempt - 1,
+						attempts: issued,
+						retries: issued - 1,
 						...(retryOptions.preset ? { preset: retryOptions.preset } : {}),
 						transport: "native",
 						...(lastErrorCode ? { lastErrorCode } : {}),
@@ -501,11 +917,13 @@ export function createHttpClient(
 				}
 				return response;
 			} catch (error) {
+				if (!issuedThisAttempt) issued += 1;
+				lastError = error;
 				lastErrorCode = proxyTransportRetryErrorCode(error);
 				lastStatus = proxyTransportRetryErrorStatus(error);
 				const proxyUsed = Boolean((error as NativeHttpAttemptError).proxyUsed);
 				if (
-					attempt < retryOptions.attempts &&
+					attempt < transportAttemptCap &&
 					shouldRetryProxyTransportAttempt({
 						error,
 						explicitRetry,
@@ -521,6 +939,13 @@ export function createHttpClient(
 			}
 		}
 
+		// Reached when the attempt cap is consumed without a terminal outcome —
+		// e.g. the final offsets of a partial allocation all resolved to
+		// already-tried endpoints and were skipped. Surface the last real transport
+		// failure rather than a synthetic exhaustion error.
+		if (lastError !== undefined) {
+			throw lastError;
+		}
 		throw new TransportError("HTTP retry exhausted without a terminal result", {
 			code: "retry_exhausted",
 		});
@@ -531,15 +956,27 @@ export function createHttpClient(
 		method: string,
 		options: RequestOptions & { body?: unknown } = {},
 	): Promise<HttpStreamResponse> {
-		if (!baseUrl && !isAbsoluteUrl(url)) {
-			throw new TransportError(
-				"ctx.http requires an absolute URL when provider.upstream.baseUrl is not declared",
-				{ code: "transport_invalid_url" },
-			);
-		}
-		assertNoHttpTransportOverrides(options);
-		const headersOptions = withClientHeaders(options, clientOptions, options.body);
-		const methodName = normalizeHttpMethod(method);
+		const { headersOptions, methodName } = (() => {
+			try {
+				if (!baseUrl && !isAbsoluteUrl(url)) {
+					throw new TransportError(
+						"ctx.http requires an absolute URL when provider.upstream.baseUrl is not declared",
+						{ code: "transport_invalid_url" },
+					);
+				}
+				assertNoHttpTransportOverrides(options);
+				const redirectPolicy = snapshotHttpRedirectPolicy(options);
+				return {
+					headersOptions: {
+						...withClientHeaders(options, clientOptions, options.body),
+						redirectPolicy,
+					},
+					methodName: normalizeHttpMethod(method),
+				};
+			} catch (error) {
+				throw redactSensitiveRequestError(error, url, options.sensitiveParams);
+			}
+		})();
 		return fetchNativeHttpStream(baseUrl, url, methodName, headersOptions, clientOptions, warnOnce);
 	}