@apifuse/provider-sdk 2.2.0-beta.7 → 2.2.0-beta.70

package/src/runtime/capability-response.ts

@@ -0,0 +1,53 @@
+export const CAPABILITY_BODY_UNAVAILABLE = "<body unavailable>";
+
+/** Read optional diagnostic response text without letting a body stall the request failure. */
+export async function readCapabilityErrorBody(
+	response: Response,
+	signal: AbortSignal,
+): Promise<string> {
+	if (signal.aborted) return CAPABILITY_BODY_UNAVAILABLE;
+
+	let timer: ReturnType<typeof setTimeout> | undefined;
+	let onAbort: (() => void) | undefined;
+	let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;
+	let unavailableWon = false;
+	const cancelBody = (reason: unknown) => {
+		const cancellation = reader ? reader.cancel(reason) : response.body?.cancel(reason);
+		if (cancellation) void cancellation.catch(() => {});
+	};
+	const unavailable = new Promise<string>((resolve) => {
+		onAbort = () => {
+			unavailableWon = true;
+			resolve(CAPABILITY_BODY_UNAVAILABLE);
+			cancelBody(signal.reason);
+		};
+		signal.addEventListener("abort", onAbort, { once: true });
+		timer = setTimeout(() => {
+			unavailableWon = true;
+			resolve(CAPABILITY_BODY_UNAVAILABLE);
+			cancelBody(new Error("capability error body read timeout"));
+		}, 250);
+	});
+	const body = Promise.resolve()
+		.then(async () => {
+			if (unavailableWon) return CAPABILITY_BODY_UNAVAILABLE;
+			if (!response.body) return response.text();
+			reader = response.body.getReader();
+			const decoder = new TextDecoder();
+			let text = "";
+			while (true) {
+				if (unavailableWon) return CAPABILITY_BODY_UNAVAILABLE;
+				const chunk = await reader.read();
+				if (chunk.done) return text + decoder.decode();
+				text += decoder.decode(chunk.value, { stream: true });
+			}
+		})
+		.catch(() => CAPABILITY_BODY_UNAVAILABLE);
+
+	try {
+		return await Promise.race([body, unavailable]);
+	} finally {
+		if (timer !== undefined) clearTimeout(timer);
+		if (onAbort) signal.removeEventListener("abort", onAbort);
+	}
+}

package/src/runtime/capability-telemetry.ts

@@ -0,0 +1,101 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { Buffer } from "node:buffer";
+import { registerDiagnosticValue } from "./diagnostic-env.js";
+import { redactDiagnosticText } from "./diagnostic-redactor.js";
+import { observeTelemetry } from "./http-telemetry-guard.js";
+import { boundedText } from "./resolver-telemetry.js";
+
+/** Internal capture facts, isolated across concurrent calls and never attached to caller results. */
+export type CapabilityFacts = { status?: number; finishReason?: string; diagnostics?: string };
+export const capabilityFacts = new AsyncLocalStorage<CapabilityFacts>();
+const metadata = new WeakMap<object, { backend: string; engine: string; model?: string }>();
+export function tagCapability<T extends object>(
+	context: T,
+	facts: { backend: string; engine: string; model?: string },
+): T {
+	metadata.set(context, facts);
+	return context;
+}
+export function capabilityMetadata(context: object) {
+	return metadata.get(context);
+}
+export function captureCapability(facts: CapabilityFacts): void {
+	const current = capabilityFacts.getStore();
+	if (current) Object.assign(current, facts);
+}
+export function registerCapabilityInput(input: {
+	kind: string;
+	data?: string;
+	url?: string;
+}): void {
+	// Payloads are measurements, never redaction needles. Only bounded URLs belong
+	// in the request inventory; structural stripping covers oversized URL echoes.
+	if (input.kind === "url" && input.url && Buffer.byteLength(input.url) <= 2048)
+		registerDiagnosticValue(input.url.trim());
+}
+/**
+ * Formats capability diagnostics after credential redaction.
+ * When `stripPayload` is enabled, long base64-shaped runs are replaced as a
+ * defence in depth; this may replace an unregistered long identifier, while
+ * protecting against the more likely case of payload data in an upstream body.
+ */
+export function capabilityText(
+	value: string,
+	redact?: (text: string) => string,
+	stripPayload = false,
+): string {
+	const stripped = value
+		.replace(
+			/(?:authorization|proxy-authorization|cookie|set-cookie)\s*["']?\s*[:=]\s*[^\r\n]+/gi,
+			"[REDACTED]",
+		)
+		.replace(/Bearer\s+[^\r\n]+/gi, "[REDACTED]")
+		.replace(/https?:\/\/[^\s"'<>]+/gi, "[REDACTED]")
+		.replace(/data:[^\s"']+/gi, "[BASE64_STRIPPED]");
+	return boundedText(
+		stripPayload ? stripped.replace(/[A-Za-z0-9+/=]{64,}/g, "[BASE64_STRIPPED]") : stripped,
+		(text) => redactDiagnosticText(text, redact),
+	);
+}
+export function capabilityErrorText(error: unknown): string {
+	if (!(error instanceof Error)) return String(error);
+	const details = "details" in error ? error.details : undefined;
+	const body =
+		details && typeof details === "object" && "body" in details ? details.body : undefined;
+	return `${error.message}${typeof body === "string" ? ` ${body}` : ""}`;
+}
+export const integer = (n: number | undefined) =>
+	Math.min(
+		Number.MAX_SAFE_INTEGER,
+		Math.max(0, Math.floor(Number.isFinite(n ?? 0) ? (n ?? 0) : 0)),
+	);
+export const add = (a: number, b: number) =>
+	Math.min(Number.MAX_SAFE_INTEGER, integer(a) + integer(b));
+export function inputBytes(input: { kind: string; data?: string }): number | undefined {
+	if (input.kind !== "base64" || input.data === undefined) return undefined;
+	return Buffer.byteLength(input.data.trim(), "base64");
+}
+/** All capability hooks use the HTTP observer guard, including failure reporting. */
+export function observeCapability(
+	sink: { markTelemetryFailed?(): void },
+	callback: () => unknown,
+): void {
+	observeTelemetry(callback, () => {
+		observeTelemetry(
+			() => sink.markTelemetryFailed?.(),
+			() => {},
+		);
+	});
+}
+
+// Only server-enrolled capability spans use the request root; standalone instrumentation
+// continues to use its caller's active span. No existing namespace changes parentage.
+type RootRunner = <T>(callback: () => Promise<T>) => Promise<T>;
+const roots = new WeakMap<object, RootRunner>();
+export function bindCapabilityRoot<T extends object>(context: T, run: RootRunner): T {
+	roots.set(context, run);
+	return context;
+}
+export function runCapabilitySpan<T>(context: object, callback: () => Promise<T>): Promise<T> {
+	return roots.get(context)?.(callback) ?? callback();
+}

package/src/runtime/chrome149-header-order.ts

@@ -0,0 +1,330 @@
+const U64_MASK = (1n << 64n) - 1n;
+const RAPID_SEED = 0xbdd89aa982704029n;
+const RAPID_SECRET = [0x2d358dccaa6c78a5n, 0x8bb84b93962eacc9n, 0x4b33a62ed433d4a3n] as const;
+
+interface HashReader {
+	readonly compressionFactor: number;
+	readonly expansionFactor: number;
+	read64(offset: number): bigint;
+	read32(offset: number): bigint;
+	readSmall(offset: number, length: number): bigint;
+}
+
+function latin1CaseFold(character: number): number {
+	if (character >= 0x41 && character <= 0x5a) return character + 0x20;
+	if (character === 0xb5) return 0x03bc;
+	if ((character >= 0xc0 && character <= 0xd6) || (character >= 0xd8 && character <= 0xde))
+		return character + 0x20;
+	return character;
+}
+
+function multiply128(a: bigint, b: bigint): [low: bigint, high: bigint] {
+	const product = (a & U64_MASK) * (b & U64_MASK);
+	return [product & U64_MASK, (product >> 64n) & U64_MASK];
+}
+
+function rapidMix(a: bigint, b: bigint): bigint {
+	const [low, high] = multiply128(a, b);
+	return low ^ high;
+}
+
+class PlainByteHashReader implements HashReader {
+	readonly compressionFactor = 1;
+	readonly expansionFactor = 1;
+
+	constructor(private readonly bytes: readonly number[]) {}
+
+	read64(offset: number): bigint {
+		let result = 0n;
+		for (let index = 0; index < 8; index += 1) {
+			result |= BigInt(this.bytes[offset + index] ?? 0) << BigInt(index * 8);
+		}
+		return result;
+	}
+
+	read32(offset: number): bigint {
+		let result = 0n;
+		for (let index = 0; index < 4; index += 1) {
+			result |= BigInt(this.bytes[offset + index] ?? 0) << BigInt(index * 8);
+		}
+		return result;
+	}
+
+	readSmall(offset: number, length: number): bigint {
+		return (
+			(BigInt(this.bytes[offset] ?? 0) << 56n) |
+			(BigInt(this.bytes[offset + (length >> 1)] ?? 0) << 32n) |
+			BigInt(this.bytes[offset + length - 1] ?? 0)
+		);
+	}
+}
+
+class CaseFoldingLatin1HashReader implements HashReader {
+	readonly compressionFactor = 1;
+	readonly expansionFactor = 2;
+
+	constructor(private readonly input: string) {}
+
+	private fold(offset: number): bigint {
+		return BigInt(latin1CaseFold(this.input.charCodeAt(offset)));
+	}
+
+	read64(offset: number): bigint {
+		return (
+			this.fold(offset) |
+			(this.fold(offset + 1) << 16n) |
+			(this.fold(offset + 2) << 32n) |
+			(this.fold(offset + 3) << 48n)
+		);
+	}
+
+	read32(offset: number): bigint {
+		return this.fold(offset) | (this.fold(offset + 1) << 16n);
+	}
+
+	readSmall(offset: number, length: number): bigint {
+		if (length !== 2) {
+			throw new Error(`CaseFoldingHashReader<LChar> received length ${length}; expected 2.`);
+		}
+		return this.fold(offset);
+	}
+}
+
+function rapidHash(reader: HashReader, producedLength: number): bigint {
+	const x = reader.compressionFactor;
+	const y = reader.expansionFactor;
+	if (producedLength % y !== 0) throw new Error("Invalid rapidhash reader length.");
+
+	let seed = RAPID_SEED;
+	seed ^= rapidMix(seed ^ RAPID_SECRET[0], RAPID_SECRET[1]) ^ BigInt(producedLength);
+	seed &= U64_MASK;
+	let offset = 0;
+	let a: bigint;
+	let b: bigint;
+
+	if (producedLength <= 16) {
+		if (producedLength >= 4) {
+			const last = offset + Math.trunc(((producedLength - 4) * x) / y);
+			a = (reader.read32(offset) << 32n) | reader.read32(last);
+			const delta = Math.trunc((((producedLength & 24) >> (producedLength >> 3)) * x) / y);
+			b = (reader.read32(offset + delta) << 32n) | reader.read32(last - delta);
+		} else if (producedLength > 0) {
+			a = reader.readSmall(offset, producedLength);
+			b = 0n;
+		} else {
+			a = 0n;
+			b = 0n;
+		}
+	} else {
+		let remaining = producedLength;
+		if (remaining > 48) {
+			let see1 = seed;
+			let see2 = seed;
+			do {
+				seed = rapidMix(
+					reader.read64(offset) ^ RAPID_SECRET[0],
+					reader.read64(offset + Math.trunc((8 * x) / y)) ^ seed,
+				);
+				see1 = rapidMix(
+					reader.read64(offset + Math.trunc((16 * x) / y)) ^ RAPID_SECRET[1],
+					reader.read64(offset + Math.trunc((24 * x) / y)) ^ see1,
+				);
+				see2 = rapidMix(
+					reader.read64(offset + Math.trunc((32 * x) / y)) ^ RAPID_SECRET[2],
+					reader.read64(offset + Math.trunc((40 * x) / y)) ^ see2,
+				);
+				offset += Math.trunc((48 * x) / y);
+				remaining -= 48;
+			} while (remaining >= 48);
+			seed ^= see1 ^ see2;
+		}
+		if (remaining > 16) {
+			seed = rapidMix(
+				reader.read64(offset) ^ RAPID_SECRET[2],
+				reader.read64(offset + Math.trunc((8 * x) / y)) ^ seed ^ RAPID_SECRET[1],
+			);
+			if (remaining > 32) {
+				seed = rapidMix(
+					reader.read64(offset + Math.trunc((16 * x) / y)) ^ RAPID_SECRET[2],
+					reader.read64(offset + Math.trunc((24 * x) / y)) ^ seed,
+				);
+			}
+		}
+		a = reader.read64(offset + Math.trunc(((remaining - 16) * x) / y));
+		b = reader.read64(offset + Math.trunc(((remaining - 8) * x) / y));
+	}
+
+	a ^= RAPID_SECRET[1];
+	b ^= seed;
+	[a, b] = multiply128(a, b);
+	return rapidMix(a ^ RAPID_SECRET[0] ^ BigInt(producedLength), b ^ RAPID_SECRET[1]);
+}
+
+function maskTopEightBits(hash: bigint): number {
+	const masked = Number(hash & 0xffffffn);
+	return masked === 0 ? 0x800000 : masked;
+}
+
+/** @internal Chromium 149 DeprecatedCaseFoldingHash for an LChar string. */
+export function chrome149CaseFoldingHash(name: string): number {
+	const reader = new CaseFoldingLatin1HashReader(name);
+	return maskTopEightBits(rapidHash(reader, name.length * reader.expansionFactor));
+}
+
+/** @internal Numeric rapidhash fixture from Chromium's string_hasher_test.cc. */
+export function chrome149RapidhashFixture(): { full: bigint; masked: number } {
+	const fixture = [0x41, 0x95, 0xff, 0x50, 0x01];
+	const full = rapidHash(new PlainByteHashReader(fixture), fixture.length);
+	return { full, masked: maskTopEightBits(full) };
+}
+
+function asciiCaseKey(name: string): string {
+	let result = "";
+	for (let index = 0; index < name.length; index += 1) {
+		const character = name.charCodeAt(index);
+		result += String.fromCharCode(
+			character >= 0x41 && character <= 0x5a ? character + 0x20 : character,
+		);
+	}
+	return result;
+}
+
+class WtfHeaderHashMap {
+	private table: Array<string | undefined> = [];
+	private keyCount = 0;
+
+	private insertWithoutExpansion(key: string): boolean {
+		const mask = this.table.length - 1;
+		let index = chrome149CaseFoldingHash(key) & mask;
+		let probeCount = 0;
+		const keyCaseFolded = asciiCaseKey(key);
+		for (;;) {
+			const stored = this.table[index];
+			if (stored === undefined) {
+				this.table[index] = key;
+				this.keyCount += 1;
+				return true;
+			}
+			if (asciiCaseKey(stored) === keyCaseFolded) return false;
+			probeCount += 1;
+			index = (index + probeCount) & mask;
+		}
+	}
+
+	private rehash(newSize: number): void {
+		const oldTable = this.table;
+		this.table = Array<string | undefined>(newSize);
+		this.keyCount = 0;
+		for (const key of oldTable) {
+			if (key !== undefined) this.insertWithoutExpansion(key);
+		}
+	}
+
+	insert(key: string): void {
+		if (this.table.length === 0) this.table = Array<string | undefined>(8);
+		if (!this.insertWithoutExpansion(key)) return;
+		if (this.keyCount * 2 >= this.table.length) this.rehash(this.table.length * 2);
+	}
+
+	iterationOrder(): string[] {
+		return this.table.filter((key): key is string => key !== undefined);
+	}
+}
+
+/**
+ * HTTPHeaderMap insertion sequence of the fixed headers in a real Chrome
+ * 149.0.7827.155 page fetch/XHR (insertion order, not bucket order). Caller
+ * headers precede all of these (core/fetch/fetch_manager.cc:1128-1130).
+ *
+ *   platform/loader/fetch/resource_request_utils.cc:146 UpgradeResourceRequestForLoader
+ *     :166 context.UpgradeResourceRequestForLoader
+ *          -> core/loader/frame_fetch_context.cc:1000 AddClientHintsIfNecessary
+ *             Set sec-ch-ua @737, sec-ch-ua-mobile @748, sec-ch-ua-platform @761
+ *          -> :1001 AddReducedAcceptLanguageIfNecessary is a no-op
+ *             (kReduceAcceptLanguage[HTTP] are FEATURE_DISABLED_BY_DEFAULT,
+ *             services/network/public/cpp/features.cc:204,214)
+ *     :214 context.PrepareRequest
+ *          -> core/loader/frame_fetch_context.cc:419 SetHTTPUserAgent
+ *          -> :455 probe::PrepareRequest, which only touches the map when a
+ *             DevTools session has set an Accept-Language override:
+ *             InspectorEmulationAgent::PrepareRequest (inspector_emulation_agent.cc
+ *             :626-636, Emulation.setUserAgentOverride acceptLanguage; skips a key
+ *             the page already set) or InspectorNetworkAgent::PrepareRequest
+ *             (inspector_network_agent.cc:1524-1547, Network.setExtraHTTPHeaders;
+ *             overwrites)
+ *
+ * Accept-Language is therefore NOT a map key in real Chrome. //net appends it
+ * in URLRequestHttpJob::AddExtraHeaders (net/url_request/url_request_http_job.cc
+ * :784-797) after Accept-Encoding, and only when the request does not already
+ * carry one (SetHeaderIfMissing), which is why a caller-supplied Accept-Language
+ * stays at its map bucket and is never emitted twice. al-placement-capture.json
+ * (B: no locale, C: --accept-lang=ja) confirms both the four-key map and the
+ * downstream slot.
+ *
+ * Every earlier corpus (placement-rule-sweep, expansion-sweep, holdout-capture,
+ * m1-capture) was captured through Playwright `newContext({ locale })`, which
+ * sets that override (Emulation.setUserAgentOverride acceptLanguage) and so
+ * inserts Accept-Language into the map as a fifth fixed key. Those fixtures still
+ * validate the hash and table mechanics;
+ * the tests interpret them through that harness insertion list. No production
+ * path uses it.
+ */
+export const CHROME149_FIXED_MAP_INSERTION = [
+	"sec-ch-ua",
+	"sec-ch-ua-mobile",
+	"sec-ch-ua-platform",
+	"User-Agent",
+] as const;
+
+/**
+ * Appended after PopulateResourceRequest has iterated the map: Fetch Metadata
+ * and Referer by the network service, then //net's Accept-Encoding and
+ * Accept-Language, then the HTTP/2 Priority header (net/spdy/spdy_http_utils.cc).
+ */
+const DOWNSTREAM_SUFFIX = [
+	"sec-fetch-site",
+	"sec-fetch-mode",
+	"sec-fetch-dest",
+	"referer",
+] as const;
+
+/**
+ * @internal Header-name order model parameterised by the fixed map insertion
+ * sequence. Production always passes {@link CHROME149_FIXED_MAP_INSERTION};
+ * tests pass the DevTools-harness sequence to validate corpora captured through
+ * Playwright's `locale` option.
+ */
+export function chrome149HeaderOrderForMapInsertion(
+	callerNames: Iterable<string>,
+	fixedMapInsertion: readonly string[],
+): string[] {
+	const unique = new Map<string, string>();
+	for (const name of callerNames) {
+		const key = asciiCaseKey(name);
+		if (!unique.has(key)) unique.set(key, name);
+	}
+
+	const headerMap = new WtfHeaderHashMap();
+	for (const key of [...unique.keys()].sort()) headerMap.insert(unique.get(key) as string);
+	for (const name of fixedMapInsertion) headerMap.insert(name);
+
+	const order = headerMap.iterationOrder().map((name) => name.toLowerCase());
+	// SetAcceptHeader adds */* only when the caller Accept was absent.
+	if (!order.includes("accept")) order.push("accept");
+	order.push(...DOWNSTREAM_SUFFIX);
+	// URLRequestHttpJob::AddExtraHeaders: Accept-Encoding, then Accept-Language,
+	// each only if the request does not already carry it.
+	if (!order.includes("accept-encoding")) order.push("accept-encoding");
+	if (!order.includes("accept-language")) order.push("accept-language");
+	// CreateSpdyHeadersFromHttpRequest appends the default Priority only if absent.
+	if (!order.includes("priority")) order.push("priority");
+	return order;
+}
+
+/**
+ * @internal Predict real Chrome 149's non-pseudo HTTP/2 fetch/XHR header-name
+ * order for the given caller header names (no DevTools session attached).
+ */
+export function chrome149HeaderOrder(callerNames: Iterable<string>): string[] {
+	return chrome149HeaderOrderForMapInsertion(callerNames, CHROME149_FIXED_MAP_INSERTION);
+}

package/src/runtime/diagnostic-env-values.ts

@@ -0,0 +1,56 @@
+export function resolvedStringVariants(value: string | undefined): string[] {
+	if (value === undefined) return [];
+	return [...new Set([value, value.trim()])].filter((candidate) => candidate.length > 0);
+}
+
+function decodedComponent(value: string): string {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return value;
+	}
+}
+
+export function urlCredentialComponents(
+	value: string,
+	options: { includePathAndQuery: boolean },
+): string[] {
+	let url: URL;
+	try {
+		url = new URL(value.trim());
+	} catch {
+		return [];
+	}
+	const username = decodedComponent(url.username);
+	const password = decodedComponent(url.password);
+	const components = [username, password, username && password ? `${username}:${password}` : ""];
+	if (options.includePathAndQuery) {
+		for (const segment of url.pathname.split("/")) {
+			if (segment) components.push(decodedComponent(segment));
+		}
+		for (const [key, entryValue] of url.searchParams) {
+			if (key) components.push(key);
+			if (entryValue) {
+				components.push(entryValue, `${key}=${entryValue}`);
+			}
+		}
+	}
+	return [...new Set(components.flatMap((component) => resolvedStringVariants(component)))];
+}
+
+export function otlpHeaderCredentialValues(value: string): string[] {
+	const variants = resolvedStringVariants(value);
+	for (const member of value.split(",")) {
+		const separator = member.indexOf("=");
+		if (separator <= 0) continue;
+		const headerValue = decodedComponent(member.slice(separator + 1).trim());
+		variants.push(...resolvedStringVariants(headerValue));
+		const headerName = decodedComponent(member.slice(0, separator).trim()).toLowerCase();
+		if (headerName === "authorization" || headerName === "proxy-authorization") {
+			// A transport may echo just the credential without its HTTP auth scheme.
+			const credential = /^(?:Bearer|Basic)\s+(.+)$/i.exec(headerValue)?.[1];
+			if (credential) variants.push(...resolvedStringVariants(credential));
+		}
+	}
+	return [...new Set(variants)];
+}

package/src/runtime/diagnostic-env.ts

@@ -0,0 +1,65 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+
+import {
+	otlpHeaderCredentialValues,
+	resolvedStringVariants,
+	urlCredentialComponents,
+} from "./diagnostic-env-values.js";
+import {
+	type CompiledDiagnosticSensitiveValues,
+	registerProcessDiagnosticValues,
+	suppressProcessDiagnosticValues,
+	withAppDiagnosticFallback,
+} from "./diagnostic-redactor.js";
+
+type EnvObserver = (name: string, value: string) => void;
+export interface DiagnosticEnvScope {
+	observe: EnvObserver;
+	finished: boolean;
+	staticValues?: CompiledDiagnosticSensitiveValues;
+	register?: (values: readonly string[]) => void;
+}
+const observers = new AsyncLocalStorage<DiagnosticEnvScope>();
+
+/** Resolve and register atomically, before any consumer can use a live env credential. */
+export function readDiagnosticEnv(
+	name: string,
+	env: Readonly<Record<string, string | undefined>> = process.env,
+): string | undefined {
+	const value = env[name];
+	if (value !== undefined) {
+		const scope = observers.getStore();
+		if (scope && !scope.finished) scope.observe(name, value);
+		else {
+			// ALS survives the response. Finished requests register into the app's
+			// inherited fallback lifetime, never a dead request's private inventory.
+			if (Buffer.byteLength(value) > 64 * 1024) suppressProcessDiagnosticValues();
+			else
+				registerProcessDiagnosticValues([
+					...resolvedStringVariants(value),
+					...urlCredentialComponents(value, {
+						includePathAndQuery: name === "APIFUSE__CDP_POOL__URL",
+					}),
+					...(name === "OTEL_EXPORTER_OTLP_HEADERS" || name === "OTEL_EXPORTER_OTLP_TRACES_HEADERS"
+						? otlpHeaderCredentialValues(value)
+						: []),
+				]);
+		}
+	}
+	return value;
+}
+
+/** Register a runtime-discovered sensitive value in the active request inventory. */
+export function registerDiagnosticValue(value: string): void {
+	if (value.length < 4) return;
+	const scope = observers.getStore();
+	if (scope && !scope.finished && scope.register) {
+		scope.register([value]);
+	}
+}
+
+export function withDiagnosticEnv<T>(observer: EnvObserver | DiagnosticEnvScope, fn: () => T): T {
+	const scope = typeof observer === "function" ? { observe: observer, finished: false } : observer;
+	const run = () => observers.run(scope, fn);
+	return scope.staticValues ? withAppDiagnosticFallback(scope.staticValues, run) : run();
+}