@apifuse/provider-sdk 2.2.0-beta.5 → 2.2.0-beta.51

package/dist/runtime/http.js

@@ -1,16 +1,52 @@
-import { resolveProxyConfigAsync } from "../config/loader.js";
-import { ProviderError, TransportError } from "../errors.js";
+import { policyRotatesTransportVendorChain, resolvePolicyTransportAttemptCap, resolveProxyConfigAsync, } from "../config/loader.js";
+import { HttpRedirectError, ProviderError, TransportError } from "../errors.js";
 import { parseSseStream, readableBytes, readableLines, readableTextChunks } from "../stream.js";
 import { computeProxyAttemptIndex, computeProxyTransportRetryDelayMs, createDefaultProxyTransportRetryOptions, isProxyTransportRetryMethod, normalizeProxyTransportRetryOptions, proxyTransportRetryErrorCode, proxyTransportRetryErrorStatus, shouldRetryProxyTransportAttempt, validateUnsafeProxyTransportRetryMethods, } from "./proxy-retry-policy.js";
-import { appendQueryParams, normalizeHttpRequestBody } from "./request-options.js";
+import { evaluateRedirectHop, isRedirectStatus, resolveRedirectUrl } from "./redirects.js";
+import { normalizeHttpRequestBody, redactSensitiveError, redactSensitiveRequestError, serializeRequestUrl, } from "./request-options.js";
 const DEFAULT_HTTP_BASE_URL = "http://localhost";
 function isHttpStatusOutcome(outcome) {
     return "kind" in outcome && outcome.kind === "http-status";
 }
-async function sleep(ms) {
+function isDedupeSkipOutcome(outcome) {
+    return "kind" in outcome && outcome.kind === "dedupe-skip";
+}
+function toAmbientCancellationError(signal, error = signal.reason) {
+    if (error instanceof TransportError && error.code === "transport_cancelled") {
+        return error;
+    }
+    return new TransportError("Request cancelled", {
+        code: "transport_cancelled",
+        status: 0,
+        retryable: false,
+        ...(error !== undefined
+            ? { cause: error instanceof Error ? error : new Error(String(error)) }
+            : {}),
+    });
+}
+function throwIfAmbientAborted(signal) {
+    if (signal?.aborted)
+        throw toAmbientCancellationError(signal);
+}
+async function sleep(ms, signal) {
+    throwIfAmbientAborted(signal);
     if (ms <= 0)
         return;
-    await new Promise((resolve) => setTimeout(resolve, ms));
+    if (!signal) {
+        await new Promise((resolve) => setTimeout(resolve, ms));
+        return;
+    }
+    await new Promise((resolve, reject) => {
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(toAmbientCancellationError(signal));
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
 }
 function toUpstreamHttpError(status) {
     return new TransportError(`Upstream request failed with status ${status}`, {
@@ -49,7 +85,17 @@ function parseJson(body) {
 function isTimeoutMessage(message) {
     return /\b(timed out|timeout|deadline exceeded)\b/i.test(message);
 }
-function toHttpTransportError(error) {
+function toHttpTransportError(error, ambientSignal, timeoutSignal) {
+    if (ambientSignal?.aborted) {
+        return toAmbientCancellationError(ambientSignal, error);
+    }
+    if (timeoutSignal?.aborted) {
+        return new TransportError("Request timed out", {
+            code: "transport_timeout",
+            status: 0,
+            ...(error instanceof Error ? { cause: error } : {}),
+        });
+    }
     if (error instanceof TransportError) {
         if (error.code) {
             return error;
@@ -121,9 +167,108 @@ function requireNativeResponseBody(response) {
     }
     return response.body;
 }
-function toNativeHttpStreamResponse(response) {
+function mergeAbortSignals(...signals) {
+    const activeSignals = signals.filter((signal) => signal != null);
+    if (activeSignals.length === 0)
+        return undefined;
+    if (activeSignals.length === 1)
+        return activeSignals[0];
+    return AbortSignal.any(activeSignals);
+}
+function cancelStreamOnAbort(body, signal) {
+    if (!signal)
+        return body;
+    let reader;
+    let finished = false;
+    let streamController;
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    const onAbort = () => {
+        if (finished)
+            return;
+        finished = true;
+        cleanup();
+        const reason = toAmbientCancellationError(signal);
+        streamController?.error(reason);
+        const cancellation = reader ? reader.cancel(reason) : body.cancel(reason);
+        void cancellation.catch(() => undefined).finally(() => reader?.releaseLock());
+    };
+    return new ReadableStream({
+        start(controller) {
+            streamController = controller;
+            signal.addEventListener("abort", onAbort, { once: true });
+            if (signal.aborted)
+                onAbort();
+        },
+        async pull(controller) {
+            try {
+                reader ??= body.getReader();
+                const chunk = await reader.read();
+                if (finished)
+                    return;
+                if (chunk.done) {
+                    finished = true;
+                    cleanup();
+                    controller.close();
+                    reader.releaseLock();
+                    return;
+                }
+                controller.enqueue(chunk.value);
+            }
+            catch (error) {
+                if (finished)
+                    return;
+                finished = true;
+                cleanup();
+                controller.error(error);
+                reader?.releaseLock();
+            }
+        },
+        async cancel(reason) {
+            if (finished)
+                return;
+            finished = true;
+            cleanup();
+            try {
+                await (reader ? reader.cancel(reason) : body.cancel(reason));
+            }
+            finally {
+                reader?.releaseLock();
+            }
+        },
+    }, { highWaterMark: 0 });
+}
+function sanitizeStreamErrors(body, serializedUrl) {
+    if (serializedUrl.sensitiveValues.length === 0)
+        return body;
+    let reader;
+    return new ReadableStream({
+        async pull(controller) {
+            try {
+                reader ??= body.getReader();
+                const chunk = await reader.read();
+                if (chunk.done) {
+                    controller.close();
+                    return;
+                }
+                controller.enqueue(chunk.value);
+            }
+            catch (error) {
+                controller.error(redactSensitiveError(error, serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl));
+            }
+        },
+        async cancel(reason) {
+            try {
+                await (reader ? reader.cancel(reason) : body.cancel(reason));
+            }
+            catch (error) {
+                throw redactSensitiveError(error, serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl);
+            }
+        },
+    }, { highWaterMark: 0 });
+}
+function toNativeHttpStreamResponse(response, serializedUrl, signal) {
     const headers = Object.fromEntries(response.headers.entries());
-    const body = requireNativeResponseBody(response);
+    const body = sanitizeStreamErrors(cancelStreamOnAbort(requireNativeResponseBody(response), signal), serializedUrl);
     return {
         body,
         headers,
@@ -164,17 +309,194 @@ function isAbsoluteUrl(url) {
 function resolveHttpUrl(baseUrl, url) {
     return new URL(url, baseUrl ?? DEFAULT_HTTP_BASE_URL).toString();
 }
+const MAX_HTTP_REDIRECT_HOPS = 20;
+const HTTP_REDIRECT_POLICY_FIELDS = new Set(["mode", "maxHops"]);
+const REDIRECT_BODY_HEADERS = new Set([
+    "content-encoding",
+    "content-language",
+    "content-location",
+    "content-type",
+]);
+const MALFORMED_REDIRECT_TARGET = "[malformed redirect target]";
+function invalidHttpRedirectPolicy(message, cause) {
+    return new TransportError(`Invalid ctx.http redirectPolicy: ${message}`, {
+        code: "http_redirect_policy_invalid",
+        ...(cause ? { cause } : {}),
+    });
+}
+/** Snapshot untrusted caller input synchronously, before proxy resolution or fetch. */
+function normalizeHttpRedirectPolicy(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw invalidHttpRedirectPolicy("expected an object");
+    }
+    try {
+        const keys = Reflect.ownKeys(value);
+        for (const key of keys) {
+            if (typeof key !== "string" || !HTTP_REDIRECT_POLICY_FIELDS.has(key)) {
+                throw invalidHttpRedirectPolicy(`unknown field ${String(key)}`);
+            }
+        }
+        for (const field of HTTP_REDIRECT_POLICY_FIELDS) {
+            const descriptor = Object.getOwnPropertyDescriptor(value, field);
+            if (!descriptor || !("value" in descriptor)) {
+                throw invalidHttpRedirectPolicy(`${field} must be an own data property`);
+            }
+        }
+        const record = value;
+        if (record.mode !== "same-origin") {
+            throw invalidHttpRedirectPolicy('mode must be "same-origin"');
+        }
+        if (typeof record.maxHops !== "number" ||
+            !Number.isInteger(record.maxHops) ||
+            record.maxHops < 0 ||
+            record.maxHops > MAX_HTTP_REDIRECT_HOPS) {
+            throw invalidHttpRedirectPolicy(`maxHops must be an integer from 0 to ${MAX_HTTP_REDIRECT_HOPS}`);
+        }
+        return { mode: "same-origin", maxHops: record.maxHops };
+    }
+    catch (error) {
+        if (error instanceof TransportError)
+            throw error;
+        throw invalidHttpRedirectPolicy("could not be inspected safely", error instanceof Error ? error : undefined);
+    }
+}
+function snapshotHttpRedirectPolicy(options) {
+    try {
+        return normalizeHttpRedirectPolicy(options.redirectPolicy);
+    }
+    catch (error) {
+        if (error instanceof TransportError)
+            throw error;
+        throw invalidHttpRedirectPolicy("could not be read safely", error instanceof Error ? error : undefined);
+    }
+}
+function withoutRedirectBodyHeaders(headers) {
+    const nextHeaders = new Headers(headers);
+    for (const name of REDIRECT_BODY_HEADERS)
+        nextHeaders.delete(name);
+    return nextHeaders;
+}
+function redirectDiagnosticTarget(value) {
+    try {
+        const parsed = new URL(value);
+        // Origin omits URL userinfo. Keeping only origin + path makes diagnostics
+        // useful while structurally excluding every query value and fragment,
+        // including attacker-chosen keys the provider did not declare sensitive.
+        const redactedQuery = parsed.search ? "?[REDACTED]" : "";
+        return parsed.origin === "null"
+            ? `${parsed.protocol}<opaque-target>`
+            : `${parsed.origin}${parsed.pathname}${redactedQuery}`;
+    }
+    catch {
+        return MALFORMED_REDIRECT_TARGET;
+    }
+}
+function discardRedirectResponseBody(response) {
+    try {
+        const cancellation = response.body?.cancel();
+        if (cancellation)
+            void cancellation.catch(() => undefined);
+    }
+    catch {
+        // The redirect decision is security-significant and must not be replaced
+        // or delayed by an upstream body's cancellation failure. Cancellation was
+        // attempted; redirect evaluation continues without awaiting its completion.
+    }
+}
+async function fetchWithHttpRedirectPolicy(requestUrl, requestInit, policy) {
+    if (!policy)
+        return fetch(requestUrl, requestInit);
+    const initialUrl = new URL(requestUrl);
+    if (initialUrl.protocol !== "http:" && initialUrl.protocol !== "https:") {
+        throw new TransportError("ctx.http redirectPolicy requires an HTTP(S) origin", {
+            code: "transport_invalid_url",
+        });
+    }
+    const initialOrigin = initialUrl.origin;
+    let currentUrl = requestUrl;
+    let method = normalizeHttpMethod(requestInit.method ?? "GET");
+    let body = requestInit.body;
+    let headers = requestInit.headers;
+    let followedHops = 0;
+    const visitedRequests = new Set([`${method} ${currentUrl}`]);
+    while (true) {
+        const response = await fetch(currentUrl, {
+            ...requestInit,
+            body,
+            headers,
+            method,
+            redirect: "manual",
+        });
+        if (!isRedirectStatus(response.status))
+            return response;
+        const location = response.headers.get("location");
+        discardRedirectResponseBody(response);
+        let nextUrlString;
+        try {
+            nextUrlString = resolveRedirectUrl(location || undefined, currentUrl);
+        }
+        catch {
+            const target = MALFORMED_REDIRECT_TARGET;
+            throw new HttpRedirectError(`Redirect response has malformed Location target ${target}`, {
+                reason: "missing_location",
+                target,
+                status: response.status,
+            });
+        }
+        const decision = evaluateRedirectHop({
+            status: response.status,
+            method,
+            nextUrl: nextUrlString,
+            shouldStop: nextUrlString ? new URL(nextUrlString).origin !== initialOrigin : false,
+            redirectCount: followedHops + 1,
+            maxHops: policy.maxHops,
+            visitedRequests,
+        });
+        if (decision.kind === "stop") {
+            const target = decision.nextUrl ? redirectDiagnosticTarget(decision.nextUrl) : undefined;
+            const message = (() => {
+                switch (decision.reason) {
+                    case "stopped":
+                        return `Redirect policy refused cross-origin target ${target}`;
+                    case "max_hops":
+                        return `Redirect policy reached maxHops before target ${target}`;
+                    case "loop":
+                        return `Redirect loop refused target ${target}`;
+                    case "missing_location":
+                        return `Redirect response from ${redirectDiagnosticTarget(currentUrl)} is missing Location`;
+                }
+            })();
+            throw new HttpRedirectError(message, {
+                reason: decision.reason,
+                ...(target ? { target } : {}),
+                status: response.status,
+            });
+        }
+        if (decision.nextMethod !== method) {
+            body = undefined;
+            headers = withoutRedirectBodyHeaders(headers);
+        }
+        method = decision.nextMethod;
+        currentUrl = decision.nextUrl;
+        followedHops += 1;
+        visitedRequests.add(`${method} ${currentUrl}`);
+    }
+}
 async function resolveNativeProxy(options, clientOptions, warn, proxyAttemptOffset = 0) {
     const resolvedProxy = await resolveProxyConfigAsync({
         proxy: options.proxy ?? clientOptions.proxy,
         upstream: clientOptions.upstream,
-        apifuseConfig: clientOptions.apifuseConfig,
         proxyPolicy: clientOptions.proxyPolicy,
         affinityKey: clientOptions.affinityKey,
         proxyAttempt: computeProxyAttemptIndex({
             baseProxyAttempt: clientOptions.proxyAttempt,
             retryAttemptOffset: proxyAttemptOffset,
         }),
+        // Bun's native fetch proxy option tunnels HTTP CONNECT only; SOCKS5 is not
+        // supported here, so a socks5 policy fails loudly rather than downgrading.
+        transportProtocols: ["http"],
         telemetry: clientOptions.telemetry,
     });
     if (resolvedProxy.shouldWarn) {
@@ -196,27 +518,50 @@ function normalizeNativeFetchBody(body) {
     copied.set(normalized);
     return copied.buffer;
 }
-async function fetchNativeHttp(baseUrl, url, method, options, clientOptions, warn, statusRetryCodes, proxyAttemptOffset = 0) {
-    const requestUrl = appendQueryParams(resolveHttpUrl(baseUrl, url), options.params);
+function serializeHttpRequestUrl(baseUrl, url, options) {
+    try {
+        return serializeRequestUrl(resolveHttpUrl(baseUrl, url), options.params, options.sensitiveParams);
+    }
+    catch (error) {
+        throw redactSensitiveRequestError(error, url, options.sensitiveParams);
+    }
+}
+async function fetchNativeHttp(baseUrl, url, method, options, clientOptions, warn, statusRetryCodes, proxyAttemptOffset = 0, dedupe) {
+    const serializedUrl = serializeHttpRequestUrl(baseUrl, url, options);
+    const { requestUrl } = serializedUrl;
     const controller = options.timeout ? new AbortController() : undefined;
+    const signal = mergeAbortSignals(clientOptions.signal, controller?.signal);
     const timeoutHandle = options.timeout
         ? setTimeout(() => controller?.abort(), options.timeout)
         : undefined;
     let proxy;
     try {
+        throwIfAmbientAborted(clientOptions.signal);
+        // Resolve inside the try (and after the timeout is armed) so allocator
+        // failures are branded as TransportErrors and count against the request
+        // deadline, exactly as an inline resolve would.
         proxy = await resolveNativeProxy(options, clientOptions, warn, proxyAttemptOffset);
+        throwIfAmbientAborted(clientOptions.signal);
+        // For a registry allocator chain, skip an endpoint a prior attempt already
+        // tried rather than re-issuing the same request. Returning the sentinel
+        // (instead of breaking) lets the loop keep advancing the flat offset until
+        // it crosses into the fallback vendor's pool span.
+        if (dedupe && proxy) {
+            if (dedupe.attempted.has(proxy)) {
+                return { kind: "dedupe-skip" };
+            }
+            dedupe.attempted.add(proxy);
+        }
         const requestInit = {
             headers: options.headers,
             method,
             ...(proxy ? { proxy } : {}),
-            signal: controller?.signal,
+            ...(signal ? { signal } : {}),
         };
         if (options.body !== undefined) {
             requestInit.body = normalizeNativeFetchBody(options.body);
         }
-        const response = await fetch(requestUrl, {
-            ...requestInit,
-        });
+        const response = await fetchWithHttpRedirectPolicy(requestUrl, requestInit, options.redirectPolicy);
         const headers = Object.fromEntries(response.headers.entries());
         if (statusRetryCodes && response.status >= 400) {
             await drainNativeResponseBody(response);
@@ -239,9 +584,9 @@ async function fetchNativeHttp(baseUrl, url, method, options, clientOptions, war
     }
     catch (error) {
         if (error instanceof SyntaxError) {
-            throw error;
+            throw redactSensitiveError(error, serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl);
         }
-        const transportError = toHttpTransportError(error);
+        const transportError = redactSensitiveError(toHttpTransportError(error, clientOptions.signal, controller?.signal), serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl);
         transportError.proxyUsed = Boolean(proxy);
         throw transportError;
     }
@@ -251,25 +596,27 @@ async function fetchNativeHttp(baseUrl, url, method, options, clientOptions, war
     }
 }
 async function fetchNativeHttpStream(baseUrl, url, method, options, clientOptions, warn) {
-    const requestUrl = appendQueryParams(resolveHttpUrl(baseUrl, url), options.params);
+    const serializedUrl = serializeHttpRequestUrl(baseUrl, url, options);
+    const { requestUrl } = serializedUrl;
     const controller = options.timeout ? new AbortController() : undefined;
+    const signal = mergeAbortSignals(clientOptions.signal, controller?.signal);
     const timeoutHandle = options.timeout
         ? setTimeout(() => controller?.abort(), options.timeout)
         : undefined;
     try {
+        throwIfAmbientAborted(clientOptions.signal);
         const proxy = await resolveNativeProxy(options, clientOptions, warn);
+        throwIfAmbientAborted(clientOptions.signal);
         const requestInit = {
             headers: options.headers,
             method,
             ...(proxy ? { proxy } : {}),
-            signal: controller?.signal,
+            ...(signal ? { signal } : {}),
         };
         if (options.body !== undefined) {
             requestInit.body = normalizeNativeFetchBody(options.body);
         }
-        const response = await fetch(requestUrl, {
-            ...requestInit,
-        });
+        const response = await fetchWithHttpRedirectPolicy(requestUrl, requestInit, options.redirectPolicy);
         if (response.status >= 400 && options.throwOnHttpError !== false) {
             await drainNativeResponseBody(response);
             throw new TransportError(`Upstream request failed with status ${response.status}`, {
@@ -277,13 +624,15 @@ async function fetchNativeHttpStream(baseUrl, url, method, options, clientOption
                 status: response.status,
             });
         }
-        return toNativeHttpStreamResponse(response);
+        // Per-call timeout remains header-scoped, while the ambient request signal
+        // stays attached to the response body for its full consumption lifetime.
+        return toNativeHttpStreamResponse(response, serializedUrl, clientOptions.signal);
     }
     catch (error) {
         if (error instanceof SyntaxError) {
-            throw error;
+            throw redactSensitiveError(error, serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl);
         }
-        throw toHttpTransportError(error);
+        throw redactSensitiveError(toHttpTransportError(error, clientOptions.signal, controller?.signal), serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl);
     }
     finally {
         if (timeoutHandle)
@@ -301,19 +650,31 @@ export function createHttpClient(baseUrl, clientOptions = {}) {
         warn(message);
     };
     async function request(url, method, options = {}) {
-        if (!baseUrl && !isAbsoluteUrl(url)) {
-            throw new TransportError("ctx.http requires an absolute URL when provider.upstream.baseUrl is not declared", { code: "transport_invalid_url" });
-        }
-        assertNoHttpTransportOverrides(options);
-        const headersOptions = withClientHeaders(options, clientOptions, options.body);
-        const methodName = normalizeHttpMethod(method);
-        const explicitRetry = headersOptions.retry !== undefined;
-        const retryOptions = normalizeProxyTransportRetryOptions(headersOptions.retry, {
-            label: "HTTP",
-        }) ??
-            (explicitRetry ? undefined : createDefaultProxyTransportRetryOptions({ label: "HTTP" }));
-        if (retryOptions)
-            validateUnsafeProxyTransportRetryMethods(retryOptions, "HTTP");
+        const { explicitRetry, headersOptions, methodName, retryOptions } = (() => {
+            try {
+                if (!baseUrl && !isAbsoluteUrl(url)) {
+                    throw new TransportError("ctx.http requires an absolute URL when provider.upstream.baseUrl is not declared", { code: "transport_invalid_url" });
+                }
+                assertNoHttpTransportOverrides(options);
+                const redirectPolicy = snapshotHttpRedirectPolicy(options);
+                const headersOptions = {
+                    ...withClientHeaders(options, clientOptions, options.body),
+                    redirectPolicy,
+                };
+                const methodName = normalizeHttpMethod(method);
+                const explicitRetry = headersOptions.retry !== undefined;
+                const retryOptions = normalizeProxyTransportRetryOptions(headersOptions.retry, {
+                    label: "HTTP",
+                }) ??
+                    (explicitRetry ? undefined : createDefaultProxyTransportRetryOptions({ label: "HTTP" }));
+                if (retryOptions)
+                    validateUnsafeProxyTransportRetryMethods(retryOptions, "HTTP");
+                return { explicitRetry, headersOptions, methodName, retryOptions };
+            }
+            catch (error) {
+                throw redactSensitiveRequestError(error, url, options.sensitiveParams);
+            }
+        })();
         const retryEnabled = Boolean(retryOptions &&
             retryOptions.attempts > 1 &&
             isProxyTransportRetryMethod(methodName, retryOptions));
@@ -325,23 +686,100 @@ export function createHttpClient(baseUrl, clientOptions = {}) {
         const attemptOptions = statusRetryEnabled
             ? { ...headersOptions, throwOnHttpError: false }
             : headersOptions;
-        const executeOnce = (proxyAttemptOffset = 0) => fetchNativeHttp(baseUrl, url, methodName, attemptOptions, clientOptions, warnOnce, statusRetryEnabled ? retryOptions?.statusCodes : undefined, proxyAttemptOffset);
+        // Span the whole vendor chain on transport failures. Like ctx.stealth, a
+        // policy-managed proxy resolves a *different* endpoint/vendor per attempt
+        // (the flat proxyAttemptOffset rotates across the concatenated vendor pool
+        // spans), so a transport failure should advance to the next endpoint —
+        // potentially crossing into the fallback vendor — rather than stopping at
+        // the per-endpoint retry budget and stranding the request on the primary
+        // vendor. resolvePolicyTransportAttemptCap widens the cap to the chain span
+        // only for implicit, safe-method allocator requests; explicit retry
+        // policies (their documented `attempts` ceiling), unsafe methods, and
+        // static/non-registry vendors keep the retry budget. Status-code retries
+        // stay bounded by the retry budget regardless; only transport rotation gets
+        // the full span.
+        const policyProxy = (() => {
+            const policy = clientOptions.proxyPolicy ?? clientOptions.upstream?.proxy;
+            return policy && typeof policy === "object" ? policy : undefined;
+        })();
+        const usesPolicyAllocator = Boolean(policyProxy) && !options.proxy && !clientOptions.proxy;
+        const transportAttemptCap = retryOptions
+            ? resolvePolicyTransportAttemptCap({
+                policy: policyProxy,
+                usesPolicyAllocator,
+                retryAttempts: retryOptions.attempts,
+                explicitRetry,
+                method: methodName,
+            })
+            : 1;
+        // Track resolved endpoints across a policy-allocator chain. Successive
+        // attempts rotate the flat offset across the concatenated vendor pool
+        // spans, but an under-filled allocation (fewer live endpoints than the
+        // configured pool size) makes the modulo mapping repeat endpoints before
+        // the offset reaches the next vendor. Rather than re-hammering an
+        // already-tried endpoint under backoff, fetchNativeHttp returns a skip
+        // sentinel for a duplicate; the loop then advances the flat offset without
+        // issuing the request, so it keeps walking toward — and into — the fallback
+        // vendor's pool span instead of stalling on the primary vendor.
+        // De-duplication is gated on the SAME predicate that widens the attempt cap
+        // (implicit, safe-method, registry-chain rotation). It must NOT engage for
+        // an explicit retry policy: there the caller's `attempts` count is the
+        // contract and each attempt must issue against whatever endpoint it resolves
+        // — even a repeat — instead of being silently skipped (which would collapse
+        // a `poolSize: 1` + `attempts: 3` request to a single fetch).
+        const dedupeAllocatorEndpoints = policyRotatesTransportVendorChain({
+            policy: policyProxy,
+            usesPolicyAllocator,
+            explicitRetry,
+            method: methodName,
+        });
+        const dedupeContext = dedupeAllocatorEndpoints ? { attempted: new Set() } : undefined;
+        const executeOnce = (proxyAttemptOffset = 0) => fetchNativeHttp(baseUrl, url, methodName, attemptOptions, clientOptions, warnOnce, statusRetryEnabled ? retryOptions?.statusCodes : undefined, proxyAttemptOffset, dedupeContext);
         if (!retryEnabled || !retryOptions) {
+            throwIfAmbientAborted(clientOptions.signal);
             const outcome = await executeOnce();
+            if (isDedupeSkipOutcome(outcome)) {
+                // Single-shot path never de-duplicates (dedupeContext is undefined),
+                // but keep the union total.
+                throw new TransportError("HTTP request produced no terminal result", {
+                    code: "retry_exhausted",
+                });
+            }
             if (isHttpStatusOutcome(outcome)) {
                 throw toUpstreamHttpError(outcome.status);
             }
             return outcome;
         }
+        let lastError;
         let lastErrorCode;
         let lastStatus;
-        for (let attempt = 1; attempt <= retryOptions.attempts; attempt += 1) {
+        // `attempt` walks the flat proxy offset across the full chain span; `issued`
+        // counts requests that were actually sent (skipped duplicate offsets do not
+        // increment it). Retry summaries and the status-retry budget must reflect
+        // issued requests, not the raw offset, so they stay accurate when partial
+        // allocations skip offsets.
+        let issued = 0;
+        for (let attempt = 1; attempt <= transportAttemptCap; attempt += 1) {
+            throwIfAmbientAborted(clientOptions.signal);
+            // Whether this offset actually issued a request (vs. a skipped duplicate),
+            // so the catch counts a thrown *transport* failure once without
+            // double-counting a status outcome that already incremented before it
+            // re-threw as an upstream HTTP error.
+            let issuedThisAttempt = false;
             try {
                 const outcome = await executeOnce(attempt - 1);
+                if (isDedupeSkipOutcome(outcome)) {
+                    // Duplicate endpoint from a partial allocation: advance the flat
+                    // offset without issuing the request (no backoff, not a failure) so
+                    // the loop keeps rotating toward the fallback vendor.
+                    continue;
+                }
+                issued += 1;
+                issuedThisAttempt = true;
                 if (isHttpStatusOutcome(outcome)) {
                     lastStatus = outcome.status;
-                    if (outcome.retryable && attempt < retryOptions.attempts) {
-                        await sleep(computeProxyTransportRetryDelayMs(retryOptions, attempt, outcome.headers));
+                    if (outcome.retryable && issued < retryOptions.attempts) {
+                        await sleep(computeProxyTransportRetryDelayMs(retryOptions, attempt, outcome.headers), clientOptions.signal);
                         continue;
                     }
                     throw toUpstreamHttpError(outcome.status);
@@ -350,10 +788,10 @@ export function createHttpClient(baseUrl, clientOptions = {}) {
                 if (response.status >= 400 && headersOptions.throwOnHttpError !== false) {
                     throw toUpstreamHttpError(response.status);
                 }
-                if (attempt > 1) {
+                if (issued > 1) {
                     const summary = {
-                        attempts: attempt,
-                        retries: attempt - 1,
+                        attempts: issued,
+                        retries: issued - 1,
                         ...(retryOptions.preset ? { preset: retryOptions.preset } : {}),
                         transport: "native",
                         ...(lastErrorCode ? { lastErrorCode } : {}),
@@ -364,10 +802,14 @@ export function createHttpClient(baseUrl, clientOptions = {}) {
                 return response;
             }
             catch (error) {
+                throwIfAmbientAborted(clientOptions.signal);
+                if (!issuedThisAttempt)
+                    issued += 1;
+                lastError = error;
                 lastErrorCode = proxyTransportRetryErrorCode(error);
                 lastStatus = proxyTransportRetryErrorStatus(error);
                 const proxyUsed = Boolean(error.proxyUsed);
-                if (attempt < retryOptions.attempts &&
+                if (attempt < transportAttemptCap &&
                     shouldRetryProxyTransportAttempt({
                         error,
                         explicitRetry,
@@ -375,23 +817,43 @@ export function createHttpClient(baseUrl, clientOptions = {}) {
                         options: retryOptions,
                         proxyUsed,
                     })) {
-                    await sleep(computeProxyTransportRetryDelayMs(retryOptions, attempt));
+                    await sleep(computeProxyTransportRetryDelayMs(retryOptions, attempt), clientOptions.signal);
                     continue;
                 }
                 throw error;
             }
         }
+        // Reached when the attempt cap is consumed without a terminal outcome —
+        // e.g. the final offsets of a partial allocation all resolved to
+        // already-tried endpoints and were skipped. Surface the last real transport
+        // failure rather than a synthetic exhaustion error.
+        if (lastError !== undefined) {
+            throw lastError;
+        }
         throw new TransportError("HTTP retry exhausted without a terminal result", {
             code: "retry_exhausted",
         });
     }
     async function streamRequest(url, method, options = {}) {
-        if (!baseUrl && !isAbsoluteUrl(url)) {
-            throw new TransportError("ctx.http requires an absolute URL when provider.upstream.baseUrl is not declared", { code: "transport_invalid_url" });
-        }
-        assertNoHttpTransportOverrides(options);
-        const headersOptions = withClientHeaders(options, clientOptions, options.body);
-        const methodName = normalizeHttpMethod(method);
+        const { headersOptions, methodName } = (() => {
+            try {
+                if (!baseUrl && !isAbsoluteUrl(url)) {
+                    throw new TransportError("ctx.http requires an absolute URL when provider.upstream.baseUrl is not declared", { code: "transport_invalid_url" });
+                }
+                assertNoHttpTransportOverrides(options);
+                const redirectPolicy = snapshotHttpRedirectPolicy(options);
+                return {
+                    headersOptions: {
+                        ...withClientHeaders(options, clientOptions, options.body),
+                        redirectPolicy,
+                    },
+                    methodName: normalizeHttpMethod(method),
+                };
+            }
+            catch (error) {
+                throw redactSensitiveRequestError(error, url, options.sensitiveParams);
+            }
+        })();
         return fetchNativeHttpStream(baseUrl, url, methodName, headersOptions, clientOptions, warnOnce);
     }
     return {