@h-ai/feedback 0.0.0-stage → 0.1.0-alpha.70

package/dist/index.js

@@ -0,0 +1,1396 @@
+import { HaiFeedbackError, feedbackM, redactFeedbackText } from './chunk-DYEK2FNM.js';
+export { HaiFeedbackError } from './chunk-DYEK2FNM.js';
+import { createFeedbackBundle } from './chunk-43AOXE4W.js';
+import { z } from 'zod';
+import { core, ok, err } from '@h-ai/core';
+import { reach } from '@h-ai/reach';
+import { reldb, BaseReldbCrudRepository } from '@h-ai/reldb';
+import { storage } from '@h-ai/storage';
+import { Buffer } from 'buffer';
+import { randomUUID, createHash } from 'crypto';
+import { totalmem, arch, release, platform } from 'os';
+import process from 'process';
+import { FeedbackReportSchema, FeedbackEvidenceInputSchema, FeedbackExportInputSchema, FeedbackCompleteInputSchema, FeedbackAppendEvidenceInputSchema, FeedbackSetStatusInputSchema, FeedbackEvidenceQuerySchema, FeedbackEvidenceSchema, FeedbackListInputSchema, FeedbackSubmitInputSchema, FeedbackJobSchema, FeedbackHistorySchema, FeedbackAttachmentSchema, FeedbackUploadInputSchema } from '@h-ai/api-contract/feedback';
+
+var FeedbackConfigSchema = z.strictObject({
+  /** 反馈所属应用标识；应与浏览器及 API 入口配置一致。 */
+  appId: z.string().min(1).max(128),
+  /** 当前应用版本，作为默认诊断信息保存。 */
+  appVersion: z.string().max(128).optional(),
+  /** 构建标识，帮助定位发布产物。 */
+  buildId: z.string().max(128).optional(),
+  /** 源码提交标识，帮助定位对应代码。 */
+  commit: z.string().max(128).optional(),
+  /** 接收待处理反馈通知的管理员邮件地址。 */
+  recipients: z.array(z.email()).min(1).max(20),
+  /** 已初始化 Reach 邮件 Provider 的唯一名称。 */
+  notificationProvider: z.string().min(1).default("email"),
+  /** 管理员通知中的反馈管理页面地址。 */
+  adminUrl: z.url().refine((value) => ["http:", "https:"].includes(new URL(value).protocol)),
+  /** 补充材料收集超时，单位毫秒；超时后冻结为完整或部分材料。 */
+  collectionTimeoutMs: z.number().int().min(0).max(3e5).default(6e4),
+  /** 持久任务扫描间隔，单位毫秒；零值由宿主手动运行任务。 */
+  workerIntervalMs: z.number().int().min(0).max(6e4).default(1e3),
+  /** 持久任务执行租约时长，单位毫秒；过期后允许其他实例接管。 */
+  leaseMs: z.number().int().min(1e3).max(3e5).default(3e4),
+  /** 汇集、通知和导出任务最大尝试次数；到期清理持续重试。 */
+  maxAttempts: z.number().int().min(1).max(20).default(5),
+  /** 已受理反馈及对象附件的保留天数。 */
+  retentionDays: z.number().int().min(1).max(3650).default(30),
+  /** 允许采集的服务端环境变量名；凭据类名称仍按敏感信息策略排除。 */
+  envAllowlist: z.array(z.string().min(1).max(128)).max(100).default([]),
+  /** 单个附件允许的最大字节数。 */
+  maxAttachmentBytes: z.number().int().min(1).max(5 * 1024 * 1024).default(5 * 1024 * 1024),
+  /** 单份反馈累计证据允许的最大字节数。 */
+  maxEvidenceBytes: z.number().int().min(1024).max(32 * 1024 * 1024).default(4 * 1024 * 1024),
+  /** 单份反馈累计证据允许的最大条数。 */
+  maxEvidenceCount: z.number().int().min(1).max(1e4).default(2e3)
+});
+var REPORTS = "hai_feedback_reports";
+var EVIDENCE = "hai_feedback_evidence";
+var ATTACHMENTS = "hai_feedback_attachments";
+var HISTORY = "hai_feedback_history";
+var JOBS = "hai_feedback_jobs";
+var identityColumns = ["id", "report_id", "scope_id", "app_id", "user_id", "source", "request_id", "error_id", "client_id"];
+function feedbackTextEquals(column, value, params) {
+  if (!identityColumns.includes(column))
+    throw new Error("Invalid feedback identity column");
+  params.push(value);
+  if (reldb.config?.type !== "mysql")
+    return `${column} = ?`;
+  params.push(value);
+  return `(${column} = ? AND CAST(${column} AS BINARY) = CAST(? AS BINARY))`;
+}
+var reportDef = {
+  id: { type: "TEXT", primaryKey: true },
+  scope_id: { type: "TEXT", notNull: true },
+  user_id: { type: "TEXT", notNull: true },
+  app_id: { type: "TEXT", notNull: true },
+  number: { type: "TEXT", notNull: true },
+  app_version: { type: "TEXT" },
+  summary: { type: "TEXT", notNull: true },
+  submission_key: { type: "TEXT", notNull: true, unique: true },
+  submission_hash: { type: "TEXT", notNull: true },
+  status: { type: "TEXT", notNull: true },
+  collection_status: { type: "TEXT", notNull: true },
+  notification_status: { type: "TEXT", notNull: true },
+  created_at: { type: "BIGINT", notNull: true },
+  updated_at: { type: "BIGINT", notNull: true },
+  version: { type: "INTEGER", notNull: true },
+  revision: { type: "INTEGER", notNull: true },
+  evidence_count: { type: "INTEGER", notNull: true },
+  evidence_bytes: { type: "BIGINT", notNull: true },
+  collect_deadline: { type: "BIGINT", notNull: true },
+  expires_at: { type: "BIGINT", notNull: true },
+  payload: { type: "JSON", notNull: true },
+  deleting: { type: "INTEGER", notNull: true }
+};
+function readFeedbackJson(value) {
+  return typeof value === "string" ? JSON.parse(value) : value;
+}
+var FeedbackReportRepository = class extends BaseReldbCrudRepository {
+  tables = { reports: REPORTS, evidence: EVIDENCE, attachments: ATTACHMENTS, history: HISTORY, jobs: JOBS };
+  constructor() {
+    super(reldb, {
+      table: REPORTS,
+      fields: Object.entries(reportDef).map(([name, def]) => ({ fieldName: name, columnName: name, def, select: true, create: true, update: name !== "id" }))
+    });
+  }
+  async ready() {
+    const report = await this.ensureReady();
+    if (!report.success)
+      return report;
+    const definitions = [
+      [EVIDENCE, {
+        id: { type: "TEXT", primaryKey: true },
+        report_id: { type: "TEXT" },
+        scope_id: { type: "TEXT", notNull: true },
+        user_id: { type: "TEXT", notNull: true },
+        app_id: { type: "TEXT", notNull: true },
+        source: { type: "TEXT", notNull: true },
+        sequence: { type: "BIGINT", notNull: true },
+        kind: { type: "TEXT", notNull: true },
+        timestamp: { type: "BIGINT", notNull: true },
+        request_id: { type: "TEXT" },
+        error_id: { type: "TEXT" },
+        revision: { type: "INTEGER", notNull: true },
+        bytes: { type: "INTEGER", notNull: true },
+        expires_at: { type: "BIGINT", notNull: true },
+        payload: { type: "JSON", notNull: true }
+      }],
+      [ATTACHMENTS, {
+        id: { type: "TEXT", primaryKey: true },
+        client_id: { type: "TEXT", notNull: true },
+        report_id: { type: "TEXT", notNull: true },
+        scope_id: { type: "TEXT", notNull: true },
+        object_key: { type: "TEXT", notNull: true },
+        status: { type: "TEXT", notNull: true },
+        size: { type: "BIGINT", notNull: true },
+        checksum: { type: "TEXT", notNull: true },
+        updated_at: { type: "BIGINT", notNull: true },
+        payload: { type: "JSON", notNull: true }
+      }],
+      [HISTORY, { id: { type: "TEXT", primaryKey: true }, report_id: { type: "TEXT", notNull: true }, payload: { type: "JSON", notNull: true } }],
+      [JOBS, {
+        id: { type: "TEXT", primaryKey: true },
+        app_id: { type: "TEXT", notNull: true },
+        snapshot_revision: { type: "INTEGER" },
+        snapshot_version: { type: "INTEGER" },
+        report_id: { type: "TEXT", notNull: true },
+        scope_id: { type: "TEXT", notNull: true },
+        kind: { type: "TEXT", notNull: true },
+        status: { type: "TEXT", notNull: true },
+        token: { type: "TEXT" },
+        lease_until: { type: "BIGINT", notNull: true },
+        attempts: { type: "INTEGER", notNull: true },
+        next_run_at: { type: "BIGINT", notNull: true },
+        created_at: { type: "BIGINT", notNull: true },
+        updated_at: { type: "BIGINT", notNull: true },
+        last_error: { type: "TEXT" },
+        payload: { type: "JSON", notNull: true },
+        result: { type: "JSON" }
+      }]
+    ];
+    for (const [table, definition] of definitions) {
+      const created = await reldb.ddl.createTable(table, definition);
+      if (!created.success)
+        return created;
+    }
+    const indexes = [
+      { table: REPORTS, name: "hai_feedback_reports_scope_time", columns: ["scope_id", "created_at"] },
+      { table: REPORTS, name: "hai_feedback_reports_scope_status", columns: ["scope_id", "status", "created_at"] },
+      { table: EVIDENCE, name: "hai_feedback_evidence_report_seq", columns: ["report_id", "source", "sequence"] },
+      { table: EVIDENCE, name: "hai_feedback_evidence_temp_scope", columns: ["scope_id", "user_id", "timestamp"] },
+      { table: ATTACHMENTS, name: "hai_feedback_attachments_report", columns: ["report_id"] },
+      { table: HISTORY, name: "hai_feedback_history_report", columns: ["report_id"] },
+      { table: JOBS, name: "hai_feedback_jobs_pending", columns: ["app_id", "status", "next_run_at"] },
+      { table: JOBS, name: "hai_feedback_jobs_snapshot", columns: ["report_id", "snapshot_revision", "snapshot_version"] }
+    ];
+    for (const index of indexes) {
+      const inspect = async () => {
+        const found = await reldb.sql.query("SELECT COLUMN_NAME AS column_name, NON_UNIQUE AS non_unique FROM information_schema.STATISTICS WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = ? AND INDEX_NAME = ? ORDER BY SEQ_IN_INDEX", [index.table, index.name]);
+        if (!found.success)
+          return found;
+        if (!found.data.length)
+          return ok(false);
+        const matches = found.data.length === index.columns.length && found.data.every((column, position) => column.column_name === index.columns[position] && Number(column.non_unique) === 1);
+        return matches ? ok(true) : err(HaiFeedbackError.CONFIG_ERROR, feedbackM("feedback_configError"));
+      };
+      if (reldb.config?.type === "mysql") {
+        const existing = await inspect();
+        if (!existing.success)
+          return existing;
+        if (existing.data)
+          continue;
+      }
+      const result = await reldb.ddl.createIndex(index.table, index.name, { columns: index.columns });
+      if (!result.success) {
+        if (reldb.config?.type === "mysql") {
+          const concurrent = await inspect();
+          if (concurrent.success && concurrent.data)
+            continue;
+        }
+        return result;
+      }
+    }
+    return ok(void 0);
+  }
+  async find(id, scope, sql = reldb.sql) {
+    const lock = sql !== reldb.sql && reldb.config?.type !== "sqlite" ? " FOR UPDATE" : "";
+    const params = [];
+    const condition = `${feedbackTextEquals("id", id, params)} AND ${feedbackTextEquals("scope_id", scope, params)}`;
+    const result = await sql.get(`SELECT * FROM ${REPORTS} WHERE ${condition}${lock}`, params);
+    return result.success && result.data && (result.data.id !== id || result.data.scope_id !== scope) ? ok(null) : result;
+  }
+  report(row) {
+    return FeedbackReportSchema.parse({
+      ...FeedbackReportSchema.parse(readFeedbackJson(row.payload)),
+      status: row.status,
+      collectionStatus: row.collection_status,
+      notificationStatus: row.notification_status,
+      updatedAt: Number(row.updated_at),
+      version: Number(row.version),
+      evidenceRevision: Number(row.revision)
+    });
+  }
+  /** 显式事务逐步检查 HaiResult；业务失败也执行 rollback。 */
+  async transaction(work) {
+    const begun = await reldb.tx.begin();
+    if (!begun.success)
+      return begun;
+    try {
+      const result = await work(begun.data);
+      if (!result.success) {
+        const rollback = await begun.data.rollback();
+        return rollback.success ? result : rollback;
+      }
+      const committed = await begun.data.commit();
+      return committed.success ? result : committed;
+    } catch {
+      await begun.data.rollback();
+      return err(HaiFeedbackError.OPERATION_FAILED, feedbackM("feedback_operationFailed"));
+    }
+  }
+};
+function sanitizeFeedbackValue(value) {
+  const sanitized = core.sanitize.sanitizeSensitiveFields(value);
+  return JSON.parse(JSON.stringify(sanitized, (_key, item) => {
+    if (typeof item === "bigint")
+      return item.toString();
+    if (typeof item === "string") {
+      if (/^https?:\/\//i.test(item))
+        return core.sanitize.sanitizeUrl(item);
+      return redactFeedbackText(item);
+    }
+    return item;
+  }));
+}
+function canonicalFeedbackJson(value) {
+  if (Array.isArray(value))
+    return `[${value.map(canonicalFeedbackJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).filter(([, item]) => item !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => `${JSON.stringify(key)}:${canonicalFeedbackJson(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}
+
+// src/feedback-capture.ts
+function createFeedbackCapture(appId, envAllowlist, service) {
+  const source = `server:${randomUUID()}`;
+  const buffer = [];
+  const pending = /* @__PURE__ */ new Map();
+  const windows = /* @__PURE__ */ new Map();
+  const losses = /* @__PURE__ */ new Map();
+  let capacityLoss;
+  let sequence = 0;
+  let totalBytes = 0;
+  let stopped = false;
+  let flushing = null;
+  async function flush() {
+    if (flushing)
+      return flushing;
+    flushing = core.context.run({ suppressLogObservers: true }, async () => {
+      for (const [key, item] of [...pending]) {
+        const current2 = await reldb.sql.get("SELECT id FROM hai_feedback_evidence WHERE id = ?", [key]);
+        if (!current2.success) {
+          rememberLoss(item, "server_temporary_evidence_write_failed");
+          return;
+        }
+        if (!current2.data) {
+          const event = item.event;
+          const result = await reldb.sql.execute("INSERT INTO hai_feedback_evidence (id, report_id, scope_id, user_id, app_id, source, sequence, kind, timestamp, request_id, error_id, revision, bytes, expires_at, payload) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)", [key, null, item.scopeId, item.userId, appId, event.source, event.sequence, event.kind, event.timestamp, event.requestId ?? null, event.errorId ?? null, 1, item.bytes, Date.now() + 5 * 6e4, JSON.stringify(event)]);
+          if (!result.success) {
+            rememberLoss(item, "server_temporary_evidence_write_failed");
+            return;
+          }
+        }
+        pending.delete(key);
+      }
+    }).finally(() => {
+      flushing = null;
+    });
+    return flushing;
+  }
+  function rememberLoss(item, reason) {
+    for (const [key2, previous] of losses) {
+      if (previous.event.timestamp < Date.now() - 5 * 6e4) {
+        losses.delete(key2);
+        pending.delete(createHash("sha256").update(`${source}:${previous.event.sequence}`).digest("hex"));
+      }
+    }
+    if (capacityLoss && capacityLoss.timestamp < Date.now() - 5 * 6e4)
+      capacityLoss = void 0;
+    const requestId = item.requestId ?? item.event?.requestId;
+    const key = JSON.stringify([item.scopeId, item.userId, requestId, reason]);
+    if (losses.has(key))
+      return;
+    const event = { id: randomUUID(), source, sequence: sequence++, kind: "missing", timestamp: Date.now(), requestId, data: { source: "server_logs" }, missingReason: reason };
+    if (losses.size >= 200) {
+      capacityLoss ??= { ...event, requestId: void 0, missingReason: "server_capture_capacity_exceeded" };
+      return;
+    }
+    const entry = { event, scopeId: item.scopeId, userId: item.userId, bytes: Buffer.byteLength(JSON.stringify(event)) };
+    losses.set(key, entry);
+    pending.set(createHash("sha256").update(`${source}:${event.sequence}`).digest("hex"), entry);
+  }
+  function pin(item, errorId) {
+    if (item.event.kind === "error")
+      item.event.errorId = item.event.id;
+    else item.event.errorId ??= errorId;
+    const key = createHash("sha256").update(`${source}:${item.event.sequence}`).digest("hex");
+    if (pending.has(key))
+      return;
+    if (pending.size >= 3e3) {
+      rememberLoss(item, "server_pending_evidence_overflow");
+      return;
+    }
+    const event = { ...item.event };
+    pending.set(key, { ...item, event });
+  }
+  function observe(record) {
+    if (stopped || record.context.module === "feedback")
+      return;
+    const { scopeId, userId, requestId } = record.context;
+    if (typeof scopeId !== "string" || typeof userId !== "string" || typeof requestId !== "string")
+      return;
+    const value = sanitizeFeedbackValue({ message: record.message, level: record.level, context: record.context });
+    const event = FeedbackEvidenceInputSchema.parse({ id: randomUUID(), source, sequence: sequence++, kind: record.level === "error" || record.level === "fatal" ? "error" : "log", timestamp: record.timestamp, requestId, data: value });
+    const bytes = Buffer.byteLength(JSON.stringify(event));
+    if (bytes > 65536) {
+      rememberLoss({ scopeId, userId, requestId }, "server_log_record_too_large");
+      return;
+    }
+    const item = { event, scopeId, userId, bytes };
+    const key = JSON.stringify([scopeId, userId, requestId]);
+    const previous = windows.get(key);
+    if (previous) {
+      if (previous.deadline >= Date.now() && previous.after < 100) {
+        pin(item, previous.errorId);
+        previous.after++;
+      } else {
+        windows.delete(key);
+      }
+    }
+    if (event.kind === "error") {
+      for (const [windowKey, window] of windows) {
+        if (window.deadline < Date.now())
+          windows.delete(windowKey);
+      }
+      for (const before of buffer.filter((entry) => entry.scopeId === scopeId && entry.userId === userId && entry.event.requestId === requestId).slice(-100)) pin(before, event.id);
+      pin(item, event.id);
+      if (windows.has(key) || windows.size < 100)
+        windows.set(key, { errorId: event.id, after: 0, deadline: Date.now() + 3e4 });
+      else rememberLoss(item, "server_error_window_overflow");
+    }
+    buffer.push(item);
+    totalBytes += bytes;
+    while (buffer.length > 1e4 || totalBytes > 16 * 1024 * 1024 || (buffer[0]?.event.timestamp ?? Date.now()) < Date.now() - 5 * 6e4) {
+      const removed = buffer.shift();
+      totalBytes -= removed?.bytes ?? 0;
+      if (removed && removed.event.timestamp >= Date.now() - 5 * 6e4)
+        rememberLoss(removed, "server_log_buffer_overflow");
+    }
+  }
+  const stop = core.logger.observe(observe);
+  const timer = setInterval(() => {
+    void flush().catch(() => void 0);
+  }, 250);
+  timer.unref();
+  return {
+    async collect(scopeId, userId, anchor) {
+      await flush();
+      const params = [];
+      const identity = `${feedbackTextEquals("app_id", appId, params)} AND ${feedbackTextEquals("scope_id", scopeId, params)} AND ${feedbackTextEquals("user_id", userId, params)}`;
+      params.push(anchor - 5 * 6e4, anchor + 3e4);
+      const persisted = await reldb.sql.query(`SELECT payload FROM hai_feedback_evidence WHERE report_id IS NULL AND ${identity} AND timestamp >= ? AND timestamp <= ? ORDER BY timestamp DESC, source DESC, sequence DESC LIMIT 1001`, params);
+      if (!persisted.success)
+        rememberLoss({ scopeId, userId }, "server_temporary_evidence_read_failed");
+      else if (persisted.data.length > 1e3)
+        rememberLoss({ scopeId, userId }, "server_evidence_truncated");
+      const events = /* @__PURE__ */ new Map();
+      const saved = persisted.success ? persisted.data.slice(0, 1e3).reverse().flatMap((row) => {
+        try {
+          const parsed = FeedbackEvidenceInputSchema.safeParse(readFeedbackJson(row.payload));
+          if (parsed.success)
+            return [parsed.data];
+        } catch {
+        }
+        rememberLoss({ scopeId, userId }, "server_temporary_evidence_invalid");
+        return [];
+      }) : [];
+      for (const event of saved) {
+        const key = `${event.source}:${event.sequence}`;
+        if (!events.has(key))
+          events.set(key, event.kind === "error" ? { ...event, errorId: event.id } : event);
+      }
+      const pinnedRequests = new Set([...events.values()].filter((item) => item.errorId).map((item) => item.requestId));
+      const local = buffer.filter((item) => item.scopeId === scopeId && item.userId === userId && item.event.timestamp >= anchor - 5 * 6e4 && item.event.timestamp <= anchor + 3e4);
+      const before = local.filter((item) => item.event.timestamp <= anchor).slice(-100);
+      const after = local.filter((item) => item.event.timestamp > anchor).slice(0, 100);
+      for (const item of [...before, ...after]) {
+        if (!pinnedRequests.has(item.event.requestId))
+          events.set(`${item.event.source}:${item.event.sequence}`, item.event);
+      }
+      for (const [key, item] of losses) {
+        if (item.event.timestamp < Date.now() - 5 * 6e4) {
+          losses.delete(key);
+          continue;
+        }
+        if (item.scopeId === scopeId && item.userId === userId && item.event.timestamp >= anchor - 5 * 6e4)
+          events.set(`${item.event.source}:${item.event.sequence}`, item.event);
+      }
+      if (capacityLoss && capacityLoss.timestamp >= anchor - 5 * 6e4)
+        events.set(`${capacityLoss.source}:${capacityLoss.sequence}`, capacityLoss);
+      if (events.size > 1e3) {
+        rememberLoss({ scopeId, userId }, "server_evidence_truncated");
+        const marker = losses.get(JSON.stringify([scopeId, userId, void 0, "server_evidence_truncated"]))?.event;
+        if (marker)
+          events.set(`${marker.source}:${marker.sequence}`, marker);
+      }
+      const missing2 = [...events.values()].filter((item) => item.kind === "missing").slice(-1e3);
+      const logs = [...events.values()].filter((item) => item.kind !== "missing").sort((a, b) => a.timestamp - b.timestamp);
+      const allowance = 1e3 - missing2.length;
+      return [...allowance > 0 ? logs.slice(-allowance) : [], ...missing2].sort((a, b) => a.timestamp - b.timestamp);
+    },
+    environment() {
+      const env = Object.fromEntries(envAllowlist.filter((key) => !core.sanitize.defaultSensitiveKeyRegex.test(key.replace(/([a-z])([A-Z])/g, "$1_$2"))).map((key) => [key, process.env[key] ?? null]));
+      return FeedbackEvidenceInputSchema.parse({ id: randomUUID(), source, sequence: sequence++, kind: "environment", timestamp: Date.now(), data: sanitizeFeedbackValue({ appId, service, os: { platform: platform(), release: release(), arch: arch() }, runtime: { name: "node", version: process.version, uptimeSeconds: Math.floor(process.uptime()), memoryBytes: process.memoryUsage().rss, totalMemoryBytes: totalmem() }, environment: env }) });
+    },
+    async close() {
+      stopped = true;
+      stop();
+      clearInterval(timer);
+      await flush();
+    }
+  };
+}
+function feedbackClockSql() {
+  if (reldb.config?.type === "postgresql")
+    return "(FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint)";
+  if (reldb.config?.type === "mysql")
+    return "(CAST(UNIX_TIMESTAMP(SYSDATE(3)) * 1000 AS UNSIGNED))";
+  return "(CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER))";
+}
+
+// src/feedback-functions.ts
+function failed() {
+  return err(HaiFeedbackError.OPERATION_FAILED, feedbackM("feedback_operationFailed"));
+}
+function invalid() {
+  return err(HaiFeedbackError.INVALID_INPUT, feedbackM("feedback_invalidInput"));
+}
+function conflict() {
+  return err(HaiFeedbackError.CONFLICT, feedbackM("feedback_conflict"));
+}
+function forbidden() {
+  return err(HaiFeedbackError.FORBIDDEN, feedbackM("feedback_forbidden"));
+}
+function missing() {
+  return err(HaiFeedbackError.NOT_FOUND, feedbackM("feedback_notFound"));
+}
+function limited() {
+  return err(HaiFeedbackError.LIMIT_EXCEEDED, feedbackM("feedback_limitExceeded"));
+}
+function hash(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function permitted(actor, permission) {
+  return actor.permissions?.includes("feedback:*") || actor.permissions?.includes(permission);
+}
+function validActor(actor) {
+  return !!actor && typeof actor.scopeId === "string" && actor.scopeId.length > 0 && actor.scopeId.length <= 128 && typeof actor.userId === "string" && actor.userId.length > 0 && actor.userId.length <= 128;
+}
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (character) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[character] ?? character);
+}
+function createFeedbackOperations(repo, config, capture) {
+  const table = repo.tables;
+  const clock = feedbackClockSql();
+  let stopped = false;
+  let timer;
+  let running = null;
+  async function access(id, actor, permission, sql = reldb.sql) {
+    if (!validActor(actor))
+      return forbidden();
+    const result = await repo.find(id, actor.scopeId, sql);
+    if (!result.success)
+      return result;
+    if (!result.data || result.data.id !== id || result.data.scope_id !== actor.scopeId || result.data.app_id !== config.appId || Number(result.data.deleting))
+      return missing();
+    if (permission ? !permitted(actor, permission) : result.data.user_id !== actor.userId && !permitted(actor, "feedback:read"))
+      return forbidden();
+    return ok(result.data);
+  }
+  async function accessWrite(id, actor, sql = reldb.sql) {
+    const result = await access(id, actor, permitted(actor, "feedback:process") ? "feedback:process" : void 0, sql);
+    if (!result.success)
+      return result;
+    return result.data.user_id === actor.userId || permitted(actor, "feedback:process") ? result : forbidden();
+  }
+  async function insertJob(tx, report, kind, suffix, payload, nextRun) {
+    const id = hash(`${report.id}:${kind}:${suffix}`);
+    const previous = await tx.get(`SELECT * FROM ${table.jobs} WHERE id = ?`, [id]);
+    if (!previous.success)
+      return previous;
+    if (previous.data)
+      return ok(id);
+    const now = Date.now();
+    const inserted = await tx.execute(`INSERT INTO ${table.jobs} (id, app_id, snapshot_revision, snapshot_version, report_id, scope_id, kind, status, token, lease_until, attempts, next_run_at, created_at, updated_at, last_error, payload, result) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ${clock} + ?, ?, ?, ?, ?, ?)`, [id, config.appId, kind === "export" ? report.evidenceRevision : null, kind === "export" ? report.version : null, report.id, report.scopeId, kind, "pending", null, 0, 0, Math.max(0, nextRun - now), now, now, null, JSON.stringify(payload), null]);
+    return inserted.success ? ok(id) : inserted;
+  }
+  function jobData(row) {
+    const result = readFeedbackJson(row.result);
+    return FeedbackJobSchema.parse({ id: row.id, feedbackId: row.report_id, type: row.kind, status: row.status, attempts: Number(row.attempts), createdAt: Number(row.created_at), updatedAt: Number(row.updated_at), nextRunAt: Number(row.next_run_at), lastError: row.last_error ?? void 0, result: result && typeof result === "object" ? { available: true } : void 0 });
+  }
+  function attachmentData(row) {
+    return FeedbackAttachmentSchema.parse({ ...FeedbackAttachmentSchema.parse(readFeedbackJson(row.payload)), status: row.status });
+  }
+  async function appendInside(tx, row, events, internal = false) {
+    const acknowledged = [];
+    const additions = [];
+    for (const input of events) {
+      if (!internal && input.source.startsWith("server:"))
+        return invalid();
+      const event = FeedbackEvidenceInputSchema.parse(sanitizeFeedbackValue(input));
+      const key = hash(`${row.id}:${event.source}:${event.sequence}`);
+      const previous = await tx.get(`SELECT * FROM ${table.evidence} WHERE id = ?`, [key]);
+      if (!previous.success)
+        return previous;
+      if (previous.data) {
+        if (canonicalFeedbackJson(readFeedbackJson(previous.data.payload)) !== canonicalFeedbackJson(event))
+          return conflict();
+      } else {
+        const bytes2 = Buffer.byteLength(JSON.stringify(event));
+        if (bytes2 > 1024 * 1024)
+          return limited();
+        const staged = additions.find((item) => item.key === key);
+        if (staged && canonicalFeedbackJson(staged.event) !== canonicalFeedbackJson(event))
+          return conflict();
+        if (!staged)
+          additions.push({ key, event, bytes: bytes2 });
+      }
+      acknowledged.push(event.id);
+    }
+    if (!additions.length)
+      return ok({ acknowledged, evidenceRevision: Number(row.revision) });
+    const bytes = additions.reduce((total, item) => total + item.bytes, 0);
+    const revision = Number(row.revision) + 1;
+    const params = [additions.length, bytes, revision, Date.now()];
+    const identity = `${feedbackTextEquals("id", row.id, params)} AND ${feedbackTextEquals("scope_id", row.scope_id, params)}`;
+    params.push(row.revision, additions.length, config.maxEvidenceCount, bytes, config.maxEvidenceBytes);
+    const changed = await tx.execute(`UPDATE ${table.reports} SET evidence_count = evidence_count + ?, evidence_bytes = evidence_bytes + ?, revision = ?, updated_at = ? WHERE ${identity} AND revision = ? AND deleting = 0 AND evidence_count + ? <= ? AND evidence_bytes + ? <= ?`, params);
+    if (!changed.success)
+      return changed;
+    if (!changed.data.changes)
+      return Number(row.evidence_count) + additions.length > config.maxEvidenceCount || Number(row.evidence_bytes) + bytes > config.maxEvidenceBytes ? limited() : conflict();
+    for (const { key, event, bytes: itemBytes } of additions) {
+      const inserted = await tx.execute(`INSERT INTO ${table.evidence} (id, report_id, scope_id, user_id, app_id, source, sequence, kind, timestamp, request_id, error_id, revision, bytes, expires_at, payload) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [key, row.id, row.scope_id, row.user_id, row.app_id, event.source, event.sequence, event.kind, event.timestamp, event.requestId ?? null, event.errorId ?? null, revision, itemBytes, row.expires_at, JSON.stringify(event)]);
+      if (!inserted.success)
+        return inserted;
+    }
+    return ok({ acknowledged, evidenceRevision: revision });
+  }
+  async function appendInternal(id, actor, events) {
+    return repo.transaction(async (tx) => {
+      const row = await access(id, actor, void 0, tx);
+      return row.success ? appendInside(tx, row.data, events, true) : row;
+    });
+  }
+  async function attachments(id, sql = reldb.sql) {
+    return sql.query(`SELECT * FROM ${table.attachments} WHERE report_id = ? ORDER BY id`, [id]);
+  }
+  async function withLease(job, work) {
+    return repo.transaction(async (tx) => {
+      const lock = reldb.config?.type === "sqlite" ? "" : " FOR UPDATE";
+      const owned = await tx.get(`SELECT id FROM ${table.jobs} WHERE id = ? AND token = ? AND status = 'running' AND lease_until > ${clock}${lock}`, [job.id, job.token]);
+      if (!owned.success)
+        return owned;
+      if (!owned.data)
+        return conflict();
+      const result = await work(tx);
+      if (!result.success)
+        return result;
+      const stillOwned = await tx.get(`SELECT id FROM ${table.jobs} WHERE id = ? AND token = ? AND status = 'running' AND lease_until > ${clock}`, [job.id, job.token]);
+      return stillOwned.success && stillOwned.data ? result : conflict();
+    });
+  }
+  async function notificationSummary(id) {
+    return reldb.sql.execute(`UPDATE ${table.reports} SET notification_status = CASE
+      WHEN EXISTS (SELECT 1 FROM ${table.jobs} WHERE report_id = ? AND kind = 'notify' AND (status = 'failed' OR last_error IS NOT NULL)) THEN 'failed'
+      WHEN NOT EXISTS (SELECT 1 FROM ${table.jobs} WHERE report_id = ? AND kind = 'notify' AND status <> 'succeeded') THEN 'sent'
+      WHEN EXISTS (SELECT 1 FROM ${table.jobs} WHERE report_id = ? AND kind = 'notify' AND status = 'running') THEN 'sending'
+      ELSE 'pending' END WHERE id = ?`, [id, id, id, id]);
+  }
+  async function history(id, sql = reldb.sql) {
+    const result = await sql.query(`SELECT payload FROM ${table.history} WHERE report_id = ? ORDER BY id`, [id]);
+    return result.success ? ok(result.data.map((row) => FeedbackHistorySchema.parse(readFeedbackJson(row.payload)))) : result;
+  }
+  async function evidence(id, revision, sql = reldb.sql) {
+    const result = await sql.query(`SELECT * FROM ${table.evidence} WHERE report_id = ? AND revision <= ? ORDER BY timestamp, source, sequence`, [id, revision]);
+    return result.success ? ok(result.data.map((row) => FeedbackEvidenceSchema.parse({ ...FeedbackEvidenceInputSchema.parse(readFeedbackJson(row.payload)), feedbackId: id, revision: Number(row.revision) }))) : result;
+  }
+  const operations = {
+    start() {
+      if (!config.workerIntervalMs || stopped)
+        return;
+      const tick = async () => {
+        if (stopped)
+          return;
+        await operations.runJobs();
+        if (!stopped) {
+          timer = setTimeout(() => {
+            void tick();
+          }, config.workerIntervalMs);
+          timer.unref();
+        }
+      };
+      timer = setTimeout(() => {
+        void tick();
+      }, config.workerIntervalMs);
+      timer.unref();
+    },
+    async close() {
+      stopped = true;
+      if (timer)
+        clearTimeout(timer);
+      await running;
+    },
+    async submit(input, actor) {
+      if (!validActor(actor))
+        return forbidden();
+      if (actor.permissions !== void 0 && !permitted(actor, "feedback:create"))
+        return forbidden();
+      const parsed = FeedbackSubmitInputSchema.safeParse(input);
+      if (!parsed.success || parsed.data.appId !== config.appId)
+        return invalid();
+      const sanitized = FeedbackSubmitInputSchema.parse(sanitizeFeedbackValue(parsed.data));
+      const submissionKey = hash(JSON.stringify([actor.scopeId, actor.userId, config.appId, sanitized.submissionId]));
+      const digest = hash(canonicalFeedbackJson(sanitized));
+      const existing = await reldb.sql.get(`SELECT * FROM ${table.reports} WHERE submission_key = ?`, [submissionKey]);
+      if (!existing.success)
+        return existing;
+      if (existing.data && (existing.data.scope_id !== actor.scopeId || existing.data.user_id !== actor.userId || existing.data.app_id !== config.appId))
+        return conflict();
+      if (existing.data && Number(existing.data.deleting))
+        return missing();
+      if (existing.data)
+        return existing.data.submission_hash === digest ? ok(repo.report(existing.data)) : conflict();
+      const now = Date.now();
+      const id = `fb_${randomUUID()}`;
+      const report = {
+        id,
+        number: `FB-${new Date(now).toISOString().slice(0, 10).replaceAll("-", "")}-${id.slice(-8).toUpperCase()}`,
+        appId: config.appId,
+        scopeId: actor.scopeId,
+        userId: actor.userId,
+        description: sanitized.description,
+        category: sanitized.category,
+        contact: sanitized.contact,
+        url: sanitized.url,
+        summary: (sanitized.description?.trim() || sanitized.url || feedbackM("feedback_defaultSummary")).slice(0, 200),
+        appVersion: sanitized.appVersion ?? config.appVersion,
+        buildId: sanitized.buildId ?? config.buildId,
+        commit: sanitized.commit ?? config.commit,
+        status: "pending",
+        collectionStatus: "collecting",
+        notificationStatus: "pending",
+        createdAt: now,
+        updatedAt: now,
+        version: 1,
+        evidenceRevision: 1
+      };
+      const row = { id, scope_id: actor.scopeId, user_id: actor.userId, app_id: config.appId, number: report.number, app_version: report.appVersion ?? null, summary: report.summary ?? "", submission_key: submissionKey, submission_hash: digest, status: "pending", collection_status: "collecting", notification_status: "pending", created_at: now, updated_at: now, version: 1, revision: 1, evidence_count: 0, evidence_bytes: 0, collect_deadline: now + config.collectionTimeoutMs, expires_at: now + config.retentionDays * 864e5, payload: report, deleting: 0 };
+      const result = await repo.transaction(async (tx) => {
+        const inserted = await repo.create({ ...row }, tx);
+        if (!inserted.success)
+          return inserted;
+        const initial = await appendInside(tx, row, sanitized.evidence ?? []);
+        if (!initial.success)
+          return initial;
+        for (const attachment of sanitized.attachments ?? []) {
+          if (attachment.size > config.maxAttachmentBytes || !allowedContentType(attachment.contentType))
+            return invalid();
+          const attachmentId = hash(`${id}:${attachment.id}`);
+          const data = { ...attachment, feedbackId: id, status: "pending" };
+          const saved = await tx.execute(`INSERT INTO ${table.attachments} (id, client_id, report_id, scope_id, object_key, status, size, checksum, updated_at, payload) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [attachmentId, attachment.id, id, actor.scopeId, `feedback/${hash(actor.scopeId).slice(0, 16)}/${id}/${attachmentId}`, "pending", attachment.size, attachment.checksum, now, JSON.stringify(data)]);
+          if (!saved.success)
+            return saved;
+        }
+        for (const recipient of config.recipients) {
+          const saved = await insertJob(tx, report, "notify", recipient, { recipient }, row.collect_deadline);
+          if (!saved.success)
+            return saved;
+        }
+        const collected = await insertJob(tx, report, "collect", "initial", { anchor: sanitized.anchor?.timestamp ?? now }, row.collect_deadline);
+        if (!collected.success)
+          return collected;
+        const cleanup = await insertJob(tx, report, "cleanup", "expiry", {}, row.expires_at);
+        if (!cleanup.success)
+          return cleanup;
+        return ok({ ...report, evidenceRevision: initial.data.evidenceRevision });
+      });
+      if (!result.success) {
+        const duplicate = await reldb.sql.get(`SELECT * FROM ${table.reports} WHERE submission_key = ?`, [submissionKey]);
+        if (!duplicate.success || !duplicate.data)
+          return result;
+        if (duplicate.data.scope_id !== actor.scopeId || duplicate.data.user_id !== actor.userId || duplicate.data.app_id !== config.appId)
+          return conflict();
+        if (Number(duplicate.data.deleting))
+          return missing();
+        return duplicate.data.submission_hash === digest ? ok(repo.report(duplicate.data)) : conflict();
+      }
+      const environment = await appendInternal(id, actor, [capture.environment()]);
+      if (!environment.success)
+        core.logger.warn("Feedback environment collection deferred", { module: "feedback", feedbackId: id });
+      const current2 = await repo.find(id, actor.scopeId);
+      return current2.success && current2.data ? ok(repo.report(current2.data)) : result;
+    },
+    async list(input, actor) {
+      if (!validActor(actor) || !permitted(actor, "feedback:read"))
+        return forbidden();
+      const parsed = FeedbackListInputSchema.safeParse(input);
+      if (!parsed.success)
+        return invalid();
+      const query = parsed.data;
+      if (query.from !== void 0 && query.to !== void 0 && query.from > query.to)
+        return invalid();
+      const params = [];
+      const conditions = [feedbackTextEquals("scope_id", actor.scopeId, params), feedbackTextEquals("app_id", config.appId, params), "deleting = 0"];
+      for (const [column, value] of [["status", query.status], ["collection_status", query.collectionStatus], ["notification_status", query.notificationStatus], ["app_id", query.appId]]) {
+        if (value) {
+          if (column === "app_id") {
+            conditions.push(feedbackTextEquals(column, value, params));
+          } else {
+            conditions.push(`${column} = ?`);
+            params.push(value);
+          }
+        }
+      }
+      if (query.from !== void 0) {
+        conditions.push("created_at >= ?");
+        params.push(query.from);
+      }
+      if (query.to !== void 0) {
+        conditions.push("created_at <= ?");
+        params.push(query.to);
+      }
+      if (query.search) {
+        conditions.push("(number LIKE ? ESCAPE '!' OR summary LIKE ? ESCAPE '!')");
+        const search = `%${query.search.replaceAll("!", "!!").replaceAll("%", "!%").replaceAll("_", "!_")}%`;
+        params.push(search, search);
+      }
+      if (query.appVersion) {
+        conditions.push("app_version = ?");
+        params.push(query.appVersion);
+      }
+      const direction = query.sortDirection === "asc" ? "ASC" : "DESC";
+      const page = await reldb.sql.queryPage({ sql: `SELECT * FROM ${table.reports} WHERE ${conditions.join(" AND ")} ORDER BY created_at ${direction}, id ${direction}`, params, pagination: { page: query.page, pageSize: query.pageSize } });
+      return page.success ? ok({ ...page.data, items: page.data.items.map((row) => repo.report(row)) }) : page;
+    },
+    async get(id, actor) {
+      const report = await access(id, actor);
+      if (!report.success)
+        return report;
+      const files = await attachments(id);
+      if (!files.success)
+        return files;
+      const changes = await history(id);
+      if (!changes.success)
+        return changes;
+      const jobs = await reldb.sql.query(`SELECT * FROM ${table.jobs} WHERE report_id = ? ORDER BY created_at, id`, [id]);
+      return jobs.success ? ok({ report: repo.report(report.data), attachments: files.data.map(attachmentData), history: changes.data, jobs: jobs.data.map(jobData) }) : jobs;
+    },
+    async getEvidence(input, actor) {
+      const parsed = FeedbackEvidenceQuerySchema.safeParse(input);
+      if (!parsed.success)
+        return invalid();
+      const accessResult = await access(parsed.data.id, actor);
+      if (!accessResult.success)
+        return accessResult;
+      const query = parsed.data;
+      const params = [];
+      const conditions = [feedbackTextEquals("report_id", query.id, params), feedbackTextEquals("scope_id", actor.scopeId, params)];
+      for (const [column, value] of [["source", query.source], ["kind", query.kind], ["request_id", query.requestId]]) {
+        if (value) {
+          if (column === "kind") {
+            conditions.push(`${column} = ?`);
+            params.push(value);
+          } else {
+            conditions.push(feedbackTextEquals(column, value, params));
+          }
+        }
+      }
+      if (query.errorId) {
+        const anchorParams = [];
+        const anchorIdentity = `${feedbackTextEquals("report_id", query.id, anchorParams)} AND ${feedbackTextEquals("error_id", query.errorId, anchorParams)}`;
+        const anchor = await reldb.sql.get(`SELECT * FROM ${table.evidence} WHERE ${anchorIdentity} AND kind = 'error'`, anchorParams);
+        if (!anchor.success)
+          return anchor;
+        if (!anchor.data)
+          return ok({ items: [], total: 0, page: query.page ?? 1, pageSize: query.pageSize ?? 20 });
+        const contextParams = [];
+        const contextIdentity = `${feedbackTextEquals("report_id", query.id, contextParams)} AND ${feedbackTextEquals("source", anchor.data.source, contextParams)}`;
+        const request = anchor.data.request_id ? feedbackTextEquals("request_id", anchor.data.request_id, contextParams) : "request_id IS NULL";
+        const before = await reldb.sql.query(`SELECT id FROM ${table.evidence} WHERE ${contextIdentity} AND ${request} AND kind IN ('log', 'error') AND sequence <= ? ORDER BY sequence DESC LIMIT 101`, [...contextParams, anchor.data.sequence]);
+        if (!before.success)
+          return before;
+        const after = await reldb.sql.query(`SELECT id FROM ${table.evidence} WHERE ${contextIdentity} AND ${request} AND kind IN ('log', 'error') AND sequence > ? ORDER BY sequence ASC LIMIT 100`, [...contextParams, anchor.data.sequence]);
+        if (!after.success)
+          return after;
+        const ids = [...before.data, ...after.data].map((row) => row.id);
+        conditions.push(`id IN (${ids.map(() => "?").join(",")})`);
+        params.push(...ids);
+      }
+      if (query.from !== void 0) {
+        conditions.push("timestamp >= ?");
+        params.push(query.from);
+      }
+      if (query.to !== void 0) {
+        conditions.push("timestamp <= ?");
+        params.push(query.to);
+      }
+      const page = await reldb.sql.queryPage({ sql: `SELECT * FROM ${table.evidence} WHERE ${conditions.join(" AND ")} ORDER BY timestamp, source, sequence`, params, pagination: { page: query.page, pageSize: query.pageSize } });
+      return page.success ? ok({ ...page.data, items: page.data.items.map((row) => FeedbackEvidenceSchema.parse({ ...FeedbackEvidenceInputSchema.parse(readFeedbackJson(row.payload)), feedbackId: query.id, revision: Number(row.revision) })) }) : page;
+    },
+    async setStatus(input, actor) {
+      const parsed = FeedbackSetStatusInputSchema.safeParse(input);
+      if (!parsed.success)
+        return invalid();
+      return repo.transaction(async (tx) => {
+        const row = await access(input.id, actor, input.status === "handled" ? "feedback:process" : "feedback:reopen", tx);
+        if (!row.success)
+          return row;
+        if (Number(row.data.version) !== parsed.data.expectedVersion)
+          return conflict();
+        if (row.data.status === parsed.data.status)
+          return ok(repo.report(row.data));
+        const now = Date.now();
+        const params = [parsed.data.status, now];
+        const identity = `${feedbackTextEquals("id", input.id, params)} AND ${feedbackTextEquals("scope_id", actor.scopeId, params)}`;
+        params.push(parsed.data.expectedVersion);
+        const updated = await tx.execute(`UPDATE ${table.reports} SET status = ?, version = version + 1, updated_at = ? WHERE ${identity} AND version = ?`, params);
+        if (!updated.success)
+          return updated;
+        if (!updated.data.changes)
+          return conflict();
+        const change = { id: randomUUID(), feedbackId: input.id, userId: actor.userId, from: repo.report(row.data).status, to: parsed.data.status, timestamp: now, note: parsed.data.note ? redactFeedbackText(parsed.data.note) : void 0 };
+        const saved = await tx.execute(`INSERT INTO ${table.history} (id, report_id, payload) VALUES (?, ?, ?)`, [change.id, input.id, JSON.stringify(change)]);
+        return saved.success ? ok({ ...repo.report(row.data), status: parsed.data.status, version: parsed.data.expectedVersion + 1, updatedAt: now }) : saved;
+      });
+    },
+    async appendEvidence(input, actor) {
+      const parsed = FeedbackAppendEvidenceInputSchema.safeParse(input);
+      if (!parsed.success)
+        return invalid();
+      return repo.transaction(async (tx) => {
+        const row = await accessWrite(input.id, actor, tx);
+        if (!row.success)
+          return row;
+        if (Number(row.data.collect_deadline) + 5 * 6e4 < Date.now())
+          return conflict();
+        return appendInside(tx, row.data, parsed.data.evidence);
+      });
+    },
+    async completeCollection(input, actor) {
+      const parsed = FeedbackCompleteInputSchema.safeParse(input);
+      if (!parsed.success)
+        return invalid();
+      const row = await accessWrite(input.id, actor);
+      if (!row.success)
+        return row;
+      if (parsed.data.missing?.length) {
+        const saved = await appendInternal(input.id, actor, [{ id: randomUUID(), source: "collection", sequence: Date.now(), kind: "missing", timestamp: Date.now(), data: { missing: parsed.data.missing }, missingReason: "collection_incomplete" }]);
+        if (!saved.success)
+          return saved;
+      }
+      const next = await reldb.sql.execute(`UPDATE ${table.jobs} SET next_run_at = ${clock}, updated_at = ${clock} WHERE report_id = ? AND kind IN ('collect', 'notify') AND status = 'pending'`, [input.id]);
+      return next.success ? ok(repo.report(row.data)) : next;
+    },
+    async uploadAttachment(input, actor) {
+      return upload(input, actor);
+    },
+    async getAttachment(input, actor) {
+      const row = await access(input.id, actor);
+      if (!row.success)
+        return row;
+      const params = [];
+      const identity = `${feedbackTextEquals("report_id", input.id, params)} AND ${feedbackTextEquals("client_id", input.attachmentId, params)} AND ${feedbackTextEquals("scope_id", actor.scopeId, params)}`;
+      const found = await reldb.sql.get(`SELECT * FROM ${table.attachments} WHERE ${identity}`, params);
+      if (!found.success)
+        return found;
+      if (!found.data || found.data.report_id !== input.id || found.data.scope_id !== actor.scopeId || found.data.client_id !== input.attachmentId || found.data.status !== "available")
+        return missing();
+      const bytes = await storage.file.get(found.data.object_key);
+      if (!bytes.success)
+        return bytes;
+      if (hash(bytes.data) !== found.data.checksum)
+        return err(HaiFeedbackError.CHECKSUM_MISMATCH, feedbackM("feedback_checksumMismatch"));
+      const metadata = attachmentData(found.data);
+      return ok({ name: metadata.name, contentType: metadata.contentType, dataBase64: bytes.data.toString("base64") });
+    },
+    async retry(input, actor) {
+      const permission = input.target === "export" ? "feedback:export" : "feedback:process";
+      const row = await access(input.id, actor, permission);
+      if (!row.success)
+        return row;
+      if (input.target === "attachment") {
+        const params = [Date.now()];
+        const identity = `${feedbackTextEquals("report_id", input.id, params)} AND ${feedbackTextEquals("client_id", input.targetId ?? "", params)} AND ${feedbackTextEquals("scope_id", actor.scopeId, params)}`;
+        const updated2 = await reldb.sql.execute(`UPDATE ${table.attachments} SET status = 'pending', updated_at = ? WHERE ${identity} AND status = 'failed'`, params);
+        return updated2.success ? ok(void 0) : updated2;
+      }
+      const updated = await reldb.sql.execute(`UPDATE ${table.jobs} SET status = 'pending', attempts = 0, next_run_at = ${clock}, last_error = NULL WHERE report_id = ? AND kind = ? AND status IN ('failed', 'pending')`, [input.id, input.target]);
+      if (updated.success && input.target === "collect") {
+        const resumed = await reldb.sql.execute(`UPDATE ${table.reports} SET collection_status = 'collecting' WHERE id = ? AND deleting = 0 AND EXISTS (SELECT 1 FROM ${table.jobs} WHERE report_id = ? AND kind = 'collect' AND status = 'pending')`, [input.id, input.id]);
+        if (!resumed.success)
+          return resumed;
+      }
+      return updated.success ? ok(void 0) : updated;
+    },
+    async export(input, actor) {
+      const parsed = FeedbackExportInputSchema.safeParse(input);
+      if (!parsed.success)
+        return invalid();
+      return repo.transaction(async (tx) => {
+        const row = await access(input.id, actor, "feedback:export", tx);
+        if (!row.success)
+          return row;
+        const revision = parsed.data.evidenceRevision ?? Number(row.data.revision);
+        if (revision > Number(row.data.revision))
+          return conflict();
+        const snapshotVersion = revision === Number(row.data.revision) ? " AND snapshot_version = ?" : "";
+        const previous = await tx.get(`SELECT * FROM ${table.jobs} WHERE report_id = ? AND kind = 'export' AND snapshot_revision = ?${snapshotVersion} ORDER BY created_at DESC, id DESC LIMIT 1`, [input.id, revision, ...snapshotVersion ? [row.data.version] : []]);
+        if (!previous.success)
+          return previous;
+        if (previous.data) {
+          const snapshot = readFeedbackJson(previous.data.payload);
+          const live = snapshot && typeof snapshot === "object" && "snapshotExpiresAt" in snapshot && typeof snapshot.snapshotExpiresAt === "number" && snapshot.snapshotExpiresAt > Date.now();
+          if (previous.data.status === "succeeded" || live)
+            return ok(jobData(previous.data));
+        }
+        if (revision < Number(row.data.revision)) {
+          return missing();
+        }
+        const events = await evidence(input.id, revision, tx);
+        if (!events.success)
+          return events;
+        const files = await attachments(input.id, tx);
+        if (!files.success)
+          return files;
+        const changes = await history(input.id, tx);
+        if (!changes.success)
+          return changes;
+        const suffix = `${revision}:${row.data.version}${previous.data ? `:${previous.data.id}` : ""}`;
+        const added = await insertJob(tx, repo.report(row.data), "export", suffix, { report: repo.report(row.data), evidence: events.data, attachments: files.data, history: changes.data, snapshotExpiresAt: Date.now() + 36e5 }, Date.now());
+        if (!added.success)
+          return added;
+        const job = await tx.get(`SELECT * FROM ${table.jobs} WHERE id = ?`, [added.data]);
+        return job.success && job.data ? ok(jobData(job.data)) : missing();
+      });
+    },
+    async getExport(input, actor) {
+      const row = await access(input.id, actor, "feedback:export");
+      if (!row.success)
+        return row;
+      const params = [];
+      const identity = `${feedbackTextEquals("id", input.jobId, params)} AND ${feedbackTextEquals("report_id", input.id, params)} AND ${feedbackTextEquals("scope_id", actor.scopeId, params)} AND ${feedbackTextEquals("app_id", config.appId, params)}`;
+      const job = await reldb.sql.get(`SELECT * FROM ${table.jobs} WHERE ${identity} AND kind = 'export'`, params);
+      if (!job.success)
+        return job;
+      if (!job.data)
+        return missing();
+      if (job.data.status === "pending" || job.data.status === "running") {
+        const snapshot = readFeedbackJson(job.data.payload);
+        if (!snapshot || typeof snapshot !== "object" || !("snapshotExpiresAt" in snapshot) || typeof snapshot.snapshotExpiresAt !== "number")
+          return failed();
+        if (snapshot.snapshotExpiresAt < Date.now())
+          return missing();
+        return err(HaiFeedbackError.CONFLICT, feedbackM("feedback_exportPending"));
+      }
+      if (job.data.status === "failed")
+        return failed();
+      const data = readFeedbackJson(job.data.result);
+      if (!data || typeof data !== "object" || !("key" in data) || typeof data.key !== "string")
+        return missing();
+      const bytes = await storage.file.get(data.key);
+      if (!bytes.success)
+        return bytes;
+      if (!("checksum" in data) || typeof data.checksum !== "string" || hash(bytes.data) !== data.checksum)
+        return err(HaiFeedbackError.CHECKSUM_MISMATCH, feedbackM("feedback_checksumMismatch"));
+      return ok({ name: `${repo.report(row.data).number}.zip`, contentType: "application/zip", dataBase64: bytes.data.toString("base64") });
+    },
+    async runJobs() {
+      if (stopped)
+        return err(HaiFeedbackError.NOT_INITIALIZED, feedbackM("feedback_notInitialized"));
+      if (running)
+        return running;
+      running = core.context.run({ suppressLogObservers: true }, processJobs).catch(failed).finally(() => {
+        running = null;
+      });
+      return running;
+    }
+  };
+  async function upload(input, actor) {
+    const parsed = FeedbackUploadInputSchema.safeParse(input);
+    if (!parsed.success)
+      return invalid();
+    const row = await accessWrite(input.id, actor);
+    if (!row.success)
+      return row;
+    const params = [];
+    const identity = `${feedbackTextEquals("report_id", input.id, params)} AND ${feedbackTextEquals("client_id", input.attachmentId, params)} AND ${feedbackTextEquals("scope_id", actor.scopeId, params)}`;
+    const found = await reldb.sql.get(`SELECT * FROM ${table.attachments} WHERE ${identity}`, params);
+    if (!found.success)
+      return found;
+    if (!found.data || found.data.report_id !== input.id || found.data.scope_id !== actor.scopeId || found.data.client_id !== input.attachmentId)
+      return missing();
+    const attachment = found.data;
+    const metadata = attachmentData(attachment);
+    const bytes = Buffer.from(parsed.data.dataBase64, "base64");
+    if (bytes.length !== Number(attachment.size) || bytes.length > config.maxAttachmentBytes || !matchesContentType(bytes, metadata.contentType))
+      return invalid();
+    if (hash(bytes) !== attachment.checksum)
+      return err(HaiFeedbackError.CHECKSUM_MISMATCH, feedbackM("feedback_checksumMismatch"));
+    const stored = await storage.file.put(attachment.object_key, bytes, { contentType: metadata.contentType, ifNoneMatch: "*", signal: AbortSignal.timeout(3e4) });
+    if (!stored.success) {
+      const existing = await storage.file.get(attachment.object_key);
+      if (!existing.success || hash(existing.data) !== attachment.checksum) {
+        await reldb.sql.execute(`UPDATE ${table.attachments} SET status = 'failed', updated_at = ? WHERE id = ? AND status <> 'available'`, [Date.now(), attachment.id]);
+        return stored;
+      }
+    }
+    const updated = await repo.transaction(async (tx) => {
+      const live = await accessWrite(input.id, actor, tx);
+      if (!live.success)
+        return live;
+      const currentParams = [];
+      const currentIdentity = `${feedbackTextEquals("id", attachment.id, currentParams)} AND ${feedbackTextEquals("scope_id", actor.scopeId, currentParams)}`;
+      const currentFile = await tx.get(`SELECT * FROM ${table.attachments} WHERE ${currentIdentity}`, currentParams);
+      if (!currentFile.success)
+        return currentFile;
+      if (!currentFile.data || currentFile.data.id !== attachment.id || currentFile.data.report_id !== input.id || currentFile.data.scope_id !== actor.scopeId || currentFile.data.client_id !== input.attachmentId)
+        return missing();
+      if (currentFile.data.status === "available")
+        return ok(void 0);
+      const confirmed = await tx.execute(`UPDATE ${table.attachments} SET status = 'available', updated_at = ${clock} WHERE ${currentIdentity}`, currentParams);
+      if (!confirmed.success)
+        return confirmed;
+      if (!confirmed.data.changes)
+        return conflict();
+      const revised = await tx.execute(`UPDATE ${table.reports} SET revision = revision + 1, updated_at = ${clock} WHERE id = ? AND deleting = 0`, [input.id]);
+      return revised.success && revised.data.changes ? ok(void 0) : conflict();
+    });
+    if (!updated.success) {
+      if (updated.error.code === HaiFeedbackError.NOT_FOUND.code)
+        await storage.file.delete(attachment.object_key);
+      return updated;
+    }
+    return ok({ ...metadata, status: "available" });
+  }
+  async function processJobs() {
+    let processed = 0;
+    const candidateParams = [];
+    const appIdentity = feedbackTextEquals("app_id", config.appId, candidateParams);
+    const candidates = await reldb.sql.query(`SELECT * FROM ${table.jobs} WHERE ${appIdentity} AND ((status = 'pending' AND next_run_at <= ${clock}) OR (status = 'running' AND lease_until < ${clock})) ORDER BY next_run_at, id LIMIT 20`, candidateParams);
+    if (!candidates.success)
+      return candidates;
+    for (const job of candidates.data) {
+      if (stopped)
+        break;
+      if (job.app_id !== config.appId)
+        continue;
+      const token = randomUUID();
+      const claimParams = [token, config.leaseMs, job.id];
+      const claimIdentity = feedbackTextEquals("app_id", config.appId, claimParams);
+      const claimed = await reldb.sql.execute(`UPDATE ${table.jobs} SET status = 'running', token = ?, lease_until = ${clock} + ?, attempts = attempts + 1, updated_at = ${clock} WHERE id = ? AND ${claimIdentity} AND ((status = 'pending' AND next_run_at <= ${clock}) OR (status = 'running' AND lease_until < ${clock}))`, claimParams);
+      if (!claimed.success)
+        return claimed;
+      if (!claimed.data.changes)
+        continue;
+      if (job.kind === "notify")
+        await notificationSummary(job.report_id);
+      const renewal = setInterval(() => {
+        void reldb.sql.execute(`UPDATE ${table.jobs} SET lease_until = ${clock} + ? WHERE id = ? AND token = ? AND status = 'running' AND lease_until > ${clock}`, [config.leaseMs, job.id, token]);
+      }, Math.max(250, Math.floor(config.leaseMs / 3)));
+      renewal.unref();
+      try {
+        const result = await executeJob({ ...job, token, attempts: Number(job.attempts) + 1 });
+        const pendingReceipt = result.success && !!result.data && typeof result.data === "object" && "pending" in result.data && result.data.pending === true;
+        const purged = result.success && !!result.data && typeof result.data === "object" && "purged" in result.data && result.data.purged === true;
+        const status = result.success ? pendingReceipt ? "pending" : "succeeded" : job.kind !== "cleanup" && Number(job.attempts) + 1 >= config.maxAttempts ? "failed" : "pending";
+        const saved = purged ? await reldb.sql.execute(`DELETE FROM ${table.jobs} WHERE id = ? AND token = ? AND status = 'running' AND lease_until > ${clock}`, [job.id, token]) : await reldb.sql.execute(`UPDATE ${table.jobs} SET status = ?, token = NULL, lease_until = 0, next_run_at = ${clock} + ?, updated_at = ${clock}, last_error = ?, result = CASE WHEN ? = 1 THEN ? ELSE result END WHERE id = ? AND token = ? AND status = 'running' AND lease_until > ${clock}`, [status, Math.min(6e4, 1e3 * 2 ** Math.min(Number(job.attempts), 6)), result.success ? null : result.error.code, result.success ? 1 : 0, result.success ? JSON.stringify(result.data) : null, job.id, token]);
+        if (!saved.success)
+          return saved;
+        if (saved.data.changes && status === "failed" && job.kind === "collect") {
+          const terminal = await reldb.sql.execute(`UPDATE ${table.reports} SET collection_status = 'failed', updated_at = ${clock} WHERE id = ? AND deleting = 0 AND EXISTS (SELECT 1 FROM ${table.jobs} WHERE id = ? AND status = 'failed')`, [job.report_id, job.id]);
+          if (!terminal.success)
+            return terminal;
+        }
+        if (!saved.data.changes && job.kind === "export" && result.success && result.data && typeof result.data === "object" && "key" in result.data && typeof result.data.key === "string")
+          await storage.file.delete(result.data.key);
+        if (job.kind === "notify")
+          await notificationSummary(job.report_id);
+        processed++;
+      } catch {
+        await reldb.sql.execute(`UPDATE ${table.jobs} SET status = ?, next_run_at = ${clock} + 60000, last_error = ?, token = NULL, lease_until = 0 WHERE id = ? AND token = ? AND lease_until > ${clock}`, [job.kind === "cleanup" ? "pending" : "failed", HaiFeedbackError.OPERATION_FAILED.code, job.id, token]);
+        if (job.kind === "collect")
+          await reldb.sql.execute(`UPDATE ${table.reports} SET collection_status = 'failed', updated_at = ${clock} WHERE id = ? AND deleting = 0 AND EXISTS (SELECT 1 FROM ${table.jobs} WHERE id = ? AND status = 'failed')`, [job.report_id, job.id]);
+      } finally {
+        clearInterval(renewal);
+      }
+    }
+    const expired = await reldb.sql.execute(`DELETE FROM ${table.evidence} WHERE report_id IS NULL AND expires_at < ?`, [Date.now()]);
+    return expired.success ? ok({ processed }) : expired;
+  }
+  async function executeJob(job) {
+    if (job.app_id !== config.appId)
+      return missing();
+    const owned = await reldb.sql.get(`SELECT id FROM ${table.jobs} WHERE id = ? AND token = ? AND status = 'running' AND lease_until > ${clock}`, [job.id, job.token]);
+    if (!owned.success)
+      return owned;
+    if (!owned.data)
+      return conflict();
+    const raw = readFeedbackJson(job.payload);
+    const payload = raw && typeof raw === "object" ? raw : {};
+    const prefix = `feedback/${hash(job.scope_id).slice(0, 16)}/${job.report_id}/`;
+    if (job.kind === "cleanup" && "tombstone" in payload && payload.tombstone === true) {
+      const cleared2 = await storage.dir.delete(prefix);
+      if (!cleared2.success)
+        return cleared2;
+      return "until" in payload && typeof payload.until === "number" && payload.until <= Date.now() ? ok({ purged: true }) : ok({ pending: true });
+    }
+    const row = await repo.find(job.report_id, job.scope_id);
+    if (!row.success)
+      return row;
+    if (!row.data || row.data.id !== job.report_id || row.data.scope_id !== job.scope_id || row.data.app_id !== config.appId)
+      return missing();
+    if (Number(row.data.deleting) && job.kind !== "cleanup")
+      return missing();
+    const report = repo.report(row.data);
+    const actor = { scopeId: report.scopeId, userId: report.userId, permissions: ["feedback:*"] };
+    if (job.kind === "collect") {
+      const anchor = "anchor" in payload && typeof payload.anchor === "number" ? payload.anchor : report.createdAt;
+      const captured = await capture.collect(report.scopeId, report.userId, anchor);
+      const saved = await withLease(job, async (tx) => {
+        const fresh = await access(report.id, actor, void 0, tx);
+        return fresh.success ? appendInside(tx, fresh.data, captured.length ? captured : [{ id: `missing-server-${report.id}`, source: "collection", sequence: 0, kind: "missing", timestamp: report.createdAt, data: { source: "server_logs" }, missingReason: "no_correlated_server_logs" }], true) : fresh;
+      });
+      if (!saved.success)
+        return saved;
+      const files = await attachments(report.id);
+      if (!files.success)
+        return files;
+      const reasons = await reldb.sql.get(`SELECT COUNT(*) AS count FROM ${table.evidence} WHERE report_id = ? AND kind = 'missing'`, [report.id]);
+      if (!reasons.success)
+        return reasons;
+      const partial = Number(reasons.data?.count ?? 0) > 0 || files.data.some((item) => item.status !== "available");
+      const updated = await withLease(job, (tx) => tx.execute(`UPDATE ${table.reports} SET collection_status = ?, updated_at = ${clock} WHERE id = ?`, [partial ? "partial" : "complete", report.id]));
+      return updated.success ? ok({ collected: captured.length }) : updated;
+    }
+    if (job.kind === "notify") {
+      const recipient = "recipient" in payload && typeof payload.recipient === "string" ? payload.recipient : "";
+      if (!config.recipients.includes(recipient))
+        return invalid();
+      if (reach.config?.dnd?.enabled)
+        return err(HaiFeedbackError.CONFIG_ERROR, feedbackM("feedback_configError"));
+      const live = await withLease(job, (tx) => access(report.id, actor, void 0, tx));
+      if (!live.success)
+        return live;
+      const current2 = repo.report(live.data);
+      const materialStatus = {
+        collecting: feedbackM("feedback_materialCollecting"),
+        complete: feedbackM("feedback_materialComplete"),
+        partial: feedbackM("feedback_materialPartial"),
+        failed: feedbackM("feedback_materialFailed")
+      }[current2.collectionStatus];
+      const detailUrl = new URL(config.adminUrl);
+      detailUrl.searchParams.set("feedback", report.id);
+      const sent = await reach.send({ provider: config.notificationProvider, to: recipient, subject: `${feedbackM("feedback_received")} ${current2.number}`, body: `<p>${escapeHtml(current2.number)}</p><p>${escapeHtml(current2.appId)} ${escapeHtml(current2.appVersion ?? "")}</p><p>${escapeHtml(feedbackM("feedback_submittedAt"))}: ${escapeHtml(new Date(current2.createdAt).toISOString())}</p><p>${escapeHtml(feedbackM("feedback_materialStatus"))}: ${escapeHtml(materialStatus)}</p><p>${escapeHtml(current2.summary ?? "")}</p><p><a href="${escapeHtml(detailUrl.href)}">${escapeHtml(current2.number)}</a></p>`, idempotencyKey: job.id });
+      if (!sent.success)
+        return sent;
+      if (!sent.data.success)
+        return failed();
+      if (sent.data.deferred) {
+        return err(HaiFeedbackError.CONFIG_ERROR, feedbackM("feedback_configError"));
+      }
+      return ok({ messageId: sent.data.messageId ?? "" });
+    }
+    if (job.kind === "export") {
+      if (!("report" in payload) || !("evidence" in payload) || !("attachments" in payload))
+        return invalid();
+      const fixed = payload;
+      if (fixed.snapshotExpiresAt < Date.now())
+        return missing();
+      const files = [];
+      const unavailable2 = fixed.attachments.filter((file) => file.status !== "available").map((file) => `attachment:${file.client_id}:${file.status}`).sort();
+      let total = Buffer.byteLength(JSON.stringify(fixed.evidence));
+      for (const file of fixed.attachments) {
+        if (file.status !== "available")
+          continue;
+        const stored2 = await storage.file.get(file.object_key);
+        if (!stored2.success)
+          return stored2;
+        if (hash(stored2.data) !== file.checksum)
+          return err(HaiFeedbackError.CHECKSUM_MISMATCH, feedbackM("feedback_checksumMismatch"));
+        total += stored2.data.length;
+        if (total > 64 * 1024 * 1024)
+          return limited();
+        const info = attachmentData(file);
+        files.push({ id: info.id, name: info.name, contentType: info.contentType, checksum: info.checksum, bytes: stored2.data });
+      }
+      const bundle = await createFeedbackBundle({ report: fixed.report, evidence: fixed.evidence, history: fixed.history, attachments: files, missing: unavailable2 });
+      if (!bundle.success)
+        return bundle;
+      const key = `feedback/${hash(report.scopeId).slice(0, 16)}/${report.id}/exports/${job.id}-${job.token}.zip`;
+      const stored = await storage.file.put(key, bundle.data, { contentType: "application/zip", ifNoneMatch: "*" });
+      return stored.success ? ok({ key, checksum: hash(bundle.data), size: bundle.data.length }) : stored;
+    }
+    const marked = await withLease(job, async (tx) => {
+      const locked = await repo.find(report.id, report.scopeId, tx);
+      if (!locked.success)
+        return locked;
+      if (!locked.data)
+        return missing();
+      const active = await tx.get(`SELECT COUNT(*) AS count FROM ${table.jobs} WHERE report_id = ? AND kind = 'export' AND status IN ('pending', 'running')`, [report.id]);
+      if (!active.success)
+        return active;
+      if (Number(active.data?.count ?? 0) > 0)
+        return conflict();
+      const updated = await tx.execute(`UPDATE ${table.reports} SET deleting = 1 WHERE id = ? AND expires_at <= ${clock}`, [report.id]);
+      if (!updated.success)
+        return updated;
+      return updated.data.changes || Number(locked.data.deleting) ? ok(void 0) : conflict();
+    });
+    if (!marked.success)
+      return marked;
+    const cleared = await storage.dir.delete(prefix);
+    if (!cleared.success)
+      return cleared;
+    const deleted = await withLease(job, async (tx) => {
+      for (const name of [table.evidence, table.attachments, table.history]) {
+        const removed2 = await tx.execute(`DELETE FROM ${name} WHERE report_id = ?`, [report.id]);
+        if (!removed2.success)
+          return removed2;
+      }
+      const removedJobs = await tx.execute(`DELETE FROM ${table.jobs} WHERE report_id = ? AND id <> ?`, [report.id, job.id]);
+      if (!removedJobs.success)
+        return removedJobs;
+      const tombstone = await tx.execute(`UPDATE ${table.jobs} SET payload = ?, result = NULL WHERE id = ? AND token = ?`, [JSON.stringify({ tombstone: true, prefix, until: Date.now() + 864e5 }), job.id, job.token]);
+      if (!tombstone.success)
+        return tombstone;
+      const params = [];
+      const identity = `${feedbackTextEquals("id", report.id, params)} AND ${feedbackTextEquals("scope_id", actor.scopeId, params)}`;
+      const removed = await tx.execute(`DELETE FROM ${table.reports} WHERE ${identity} AND expires_at <= ${clock}`, params);
+      return removed.success ? ok({ pending: true }) : removed;
+    });
+    return deleted;
+  }
+  return operations;
+}
+function allowedContentType(type) {
+  return ["image/png", "image/jpeg", "image/webp", "text/plain", "application/json", "application/pdf"].includes(type);
+}
+function matchesContentType(bytes, type) {
+  if (type === "image/png")
+    return bytes.length >= 24 && bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10])) && bytes.readUInt32BE(16) * bytes.readUInt32BE(20) <= 32 * 1024 * 1024;
+  if (type === "image/jpeg")
+    return bytes.length >= 3 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255;
+  if (type === "image/webp")
+    return bytes.subarray(0, 4).toString() === "RIFF" && bytes.subarray(8, 12).toString() === "WEBP";
+  if (type === "application/pdf")
+    return bytes.subarray(0, 5).toString() === "%PDF-";
+  if (type === "application/json") {
+    try {
+      JSON.parse(bytes.toString("utf8"));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  return type === "text/plain" && !bytes.includes(0);
+}
+
+// src/feedback-main.ts
+var notInitialized = core.module.createNotInitializedKit(HaiFeedbackError.NOT_INITIALIZED, () => feedbackM("feedback_notInitialized"));
+var unavailable = notInitialized.proxy();
+var current = null;
+var generation = 0;
+var initializing = false;
+var inFlight = /* @__PURE__ */ new Set();
+var feedback = {
+  async init(config) {
+    if (initializing)
+      return err(HaiFeedbackError.INIT_IN_PROGRESS, feedbackM("feedback_initInProgress"));
+    initializing = true;
+    const epoch = ++generation;
+    let candidateCapture;
+    try {
+      const parsed = FeedbackConfigSchema.safeParse(config);
+      if (!parsed.success || !reldb.isInitialized || !storage.isInitialized || !reach.isInitialized)
+        return err(HaiFeedbackError.CONFIG_ERROR, feedbackM("feedback_configError"));
+      if (reach.config?.dnd?.enabled)
+        return err(HaiFeedbackError.CONFIG_ERROR, feedbackM("feedback_configError"));
+      if (!reach.config?.providers.some((provider) => provider.name === parsed.data.notificationProvider))
+        return err(HaiFeedbackError.CONFIG_ERROR, feedbackM("feedback_configError"));
+      if (current) {
+        const previous = current;
+        current = null;
+        await Promise.allSettled([...inFlight]);
+        await previous.operations.close();
+        await previous.capture.close();
+      }
+      const repository = new FeedbackReportRepository();
+      const ready = await repository.ready();
+      if (!ready.success)
+        return ready;
+      if (epoch !== generation)
+        return notInitialized.result();
+      candidateCapture = createFeedbackCapture(parsed.data.appId, parsed.data.envAllowlist, { appVersion: parsed.data.appVersion, buildId: parsed.data.buildId, commit: parsed.data.commit });
+      const operations = createFeedbackOperations(repository, parsed.data, candidateCapture);
+      if (epoch !== generation) {
+        await operations.close();
+        await candidateCapture.close();
+        return notInitialized.result();
+      }
+      current = { operations, capture: candidateCapture, config: parsed.data };
+      operations.start();
+      core.logger.info("Feedback module initialized", { module: "feedback", appId: parsed.data.appId });
+      return ok(void 0);
+    } catch {
+      if (candidateCapture)
+        await candidateCapture.close();
+      return err(HaiFeedbackError.CONFIG_ERROR, feedbackM("feedback_configError"));
+    } finally {
+      initializing = false;
+    }
+  },
+  async close() {
+    generation++;
+    const previous = current;
+    current = null;
+    await Promise.allSettled([...inFlight]);
+    if (!previous)
+      return ok(void 0);
+    try {
+      await previous.operations.close();
+      await previous.capture.close();
+      return ok(void 0);
+    } catch {
+      return err(HaiFeedbackError.OPERATION_FAILED, feedbackM("feedback_operationFailed"));
+    }
+  },
+  get isInitialized() {
+    return current !== null;
+  },
+  get config() {
+    return current ? { ...current.config, recipients: [...current.config.recipients], envAllowlist: [...current.config.envAllowlist] } : null;
+  },
+  submit: (input, actor) => guarded(() => (current?.operations ?? unavailable).submit(input, actor)),
+  list: (input, actor) => guarded(() => (current?.operations ?? unavailable).list(input, actor)),
+  get: (id, actor) => guarded(() => (current?.operations ?? unavailable).get(id, actor)),
+  getEvidence: (input, actor) => guarded(() => (current?.operations ?? unavailable).getEvidence(input, actor)),
+  setStatus: (input, actor) => guarded(() => (current?.operations ?? unavailable).setStatus(input, actor)),
+  appendEvidence: (input, actor) => guarded(() => (current?.operations ?? unavailable).appendEvidence(input, actor)),
+  completeCollection: (input, actor) => guarded(() => (current?.operations ?? unavailable).completeCollection(input, actor)),
+  uploadAttachment: (input, actor) => guarded(() => (current?.operations ?? unavailable).uploadAttachment(input, actor)),
+  getAttachment: (input, actor) => guarded(() => (current?.operations ?? unavailable).getAttachment(input, actor)),
+  retry: (input, actor) => guarded(() => (current?.operations ?? unavailable).retry(input, actor)),
+  export: (input, actor) => guarded(() => (current?.operations ?? unavailable).export(input, actor)),
+  getExport: (input, actor) => guarded(() => (current?.operations ?? unavailable).getExport(input, actor)),
+  runJobs: () => guarded(() => (current?.operations ?? unavailable).runJobs())
+};
+async function guarded(work) {
+  const promise = core.context.run({ suppressLogObservers: true }, work);
+  inFlight.add(promise);
+  try {
+    return await promise;
+  } catch {
+    return err(HaiFeedbackError.OPERATION_FAILED, feedbackM("feedback_operationFailed"));
+  } finally {
+    inFlight.delete(promise);
+  }
+}
+
+export { FeedbackConfigSchema, feedback };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map