# SPDX-License-Identifier: GPL-3.0-or-later
#
# netdata-support-bundle - collect a diagnostic bundle for Netdata support tickets.
# Windows counterpart of netdata-support-bundle. Same bundle layout, same MANIFEST
# schema (netdata-support-bundle/v2), same sanitization rules.
#
# Standard captures redact secrets except the streaming API key in stream.conf
# (netdata/netdata#23448). -IncludeSnmpDiagnostics adds raw SNMP files with neither
# secret redaction nor PII obfuscation. Standard collected files
# keep their original bytes - BOM, line terminators and a missing final newline
# all survive redaction - and what was observed is recorded per file in
# MANIFEST.json, so encoding faults stay diagnosable.
#
# What is collected and WHY each item is included is documented in
# packaging/installer/SUPPORT-BUNDLE.md - read it before adding or changing
# a collection item, and keep it in sync with this script.
#
# Usage (run in an elevated PowerShell):
#   powershell -ExecutionPolicy Bypass -File netdata-support-bundle.ps1 [-Output DIR]
#              [-SinceHours 24] [-NoObfuscate] [-IncludeSnmpDiagnostics] [-KeepStaging] [-SelfTest]
#
# Requires Windows PowerShell 5.1+ (ships with Windows Server 2016+) or
# PowerShell 7. Output: netdata-support-bundle-<timestamp>.zip

[CmdletBinding()]
param(
    [string]$Output = $(if ($env:TEMP) { $env:TEMP } elseif ($env:TMPDIR) { $env:TMPDIR } else { [System.IO.Path]::GetTempPath() }),
    [int]$SinceHours = 24,
    [int]$TimeoutSeconds = 10,
    [switch]$NoObfuscate,
    [switch]$IncludeSnmpDiagnostics,
    [switch]$KeepStaging,
    [switch]$SelfTest,
    [switch]$Version
)

Set-StrictMode -Version 2.0
$ErrorActionPreference = 'SilentlyContinue'

$ToolVersion = '1.3.0'
$script:SnmpFiles = 0
$script:SnmpStatus = 'not_requested'
if ($Version) { Write-Output "netdata-support-bundle $ToolVersion"; exit 0 }

$Obfuscate = -not $NoObfuscate
$LogCap = 5MB
$FileCap = 1MB
$GlobalDeadline = (Get-Date).AddSeconds(240)

# --- run at lowest priority: never compete with real workloads ---------------
try {
    $proc = Get-Process -Id $PID
    $proc.PriorityClass = [System.Diagnostics.ProcessPriorityClass]::Idle
} catch { Write-Verbose "could not lower process priority: $_" }

$StartTime = Get-Date
$Stamp = (Get-Date).ToUniversalTime().ToString('yyyyMMdd-HHmmss')
$BundleName = "netdata-support-bundle-$Stamp-$PID"
$TempBase = if ($env:TEMP) { $env:TEMP } elseif ($env:TMPDIR) { $env:TMPDIR } else { [System.IO.Path]::GetTempPath() }
$Staging = Join-Path $TempBase ("netdata-support-bundle-staging-" + [System.IO.Path]::GetRandomFileName())
$Work = Join-Path $Staging $BundleName
New-Item -ItemType Directory -Path $Work -Force | Out-Null
$script:ManifestRows = New-Object System.Collections.ArrayList
$script:PseudoMap = @{}   # original -> pseudonym
$script:IpCount = 0
$script:Ip6Count = 0
$script:FqdnCount = 0
$script:DomainCount = 0
$script:SeededHosts = @() # child/mirrored hostnames pre-seeded from the local API
# byte-exact encoding preservation reads the whole file into one string; the
# Windows perflib dump can be tens of MB, where fidelity is irrelevant (we
# generated it) and the memory cost is not. Above this, use the line path.
$script:ByteExactMax = 8MB

function Show-Info([string]$msg) { Write-Host " [*] $msg" }

# PS 5.1 Set-Content writes UTF-16LE by default; every bundle file must be UTF-8
$script:Utf8NoBom = New-Object System.Text.UTF8Encoding($false)
# ISO-8859-1 maps bytes 0x00-0xFF one-to-one onto U+0000-U+00FF, so decoding and
# re-encoding with it reproduces the ORIGINAL bytes exactly. The byte-exact
# sanitize path uses it instead of UTF-8, whose replacement fallback would turn
# every invalid sequence in a Latin-1 config into U+FFFD and corrupt the copy.
# Every sanitizer pattern is ASCII, which this mapping leaves unchanged.
$script:BytePreserving = [System.Text.Encoding]::GetEncoding(28591)
function Write-Utf8([string]$path, [string]$text) {
    [System.IO.File]::WriteAllText($path, $text, $script:Utf8NoBom)
}

function Test-Deadline { return ((Get-Date) -gt $GlobalDeadline) }

# Invoke-WebRequest wrapper: -UseBasicParsing is needed on Windows PowerShell 5.1
# (avoids the IE-engine dependency) but is a deprecated no-op on PowerShell 7+;
# gate it on the major version so the same call works everywhere.
function Invoke-LocalApi([string]$url, [int]$timeoutSec) {
    $iwrArgs = @{ Uri = $url; TimeoutSec = $timeoutSec }
    if ($PSVersionTable.PSVersion.Major -lt 6) { $iwrArgs["UseBasicParsing"] = $true }
    return Invoke-WebRequest @iwrArgs
}

# --- sanitizer ----------------------------------------------------------------
# pass 1 (always): credential-bearing key values, URL/DSN creds, JWT,
#                  Bearer/Basic values, private keys, UUID section headers
# pass 2 (default): emails, MACs, IPv4 pseudonyms, this host's names,
#                   private-TLD FQDNs
$SecretKeyWords = @(
    # substring-matched, so only unambiguous secret tokens belong here:
    # e.g. 'pat' is excluded because it matches 'path' (kept in sync with the .sh list)
    'api key','apikey','token','password','passwd','pwd','secret','community',
    'bearer','webhook','license key','auth','credential','cookie','passphrase',
    'proxy user','proxy pass','username','dsn','private key','access key',
    'session','recipient','account sid','priv key'
)
$HostShort = $env:COMPUTERNAME
$HostFqdn = try { [System.Net.Dns]::GetHostEntry('').HostName } catch { Write-Verbose "no FQDN: $_"; '' }
$RunUser = $env:USERNAME
if ($RunUser -in @('SYSTEM', 'Administrator') -or -not $RunUser -or $RunUser.Length -lt 3) { $RunUser = '' }
# An Active Directory domain name is a corporate identifier, and the new
# 09-permissions ACL captures print DOMAIN\user everywhere. Pseudonymize the
# machine's OWN domain by exact value - the same approach used for the hostname
# and the invoking user - rather than by pattern: a generic DOMAIN\user regex
# cannot be told apart from a Windows path segment (C:\Users\Public).
# POSIX has no counterpart: getfacl there yields local accounts only.
$UserDomain = $env:USERDOMAIN
if (-not $UserDomain -or $UserDomain -eq $HostShort -or $UserDomain.Length -lt 3) { $UserDomain = '' }
$DnsDomain = ''
try {
    $cs = Get-CimInstance Win32_ComputerSystem -ErrorAction SilentlyContinue
    if ($cs -and $cs.PartOfDomain -and $cs.Domain) { $DnsDomain = [string]$cs.Domain }
} catch { Write-Verbose "could not read the computer domain: $_" }
if ($DnsDomain -in @('WORKGROUP', $HostShort, $HostFqdn) -or $DnsDomain.Length -lt 4) { $DnsDomain = '' }
# set per file by Invoke-SanitizeLine; "stream" marks stream.conf, the one file
# whose streaming API key is kept verbatim (netdata/netdata#23448)
$script:SanCtx = ''

function Test-SecretKey([string]$key) {
    $k = ($key -replace '[-_]', ' ').ToLower().Trim(' ', '#', "`t")
    foreach ($w in $SecretKeyWords) { if ($k.Contains($w)) { return $true } }
    return $false
}

function Test-DiagnosticKey([string]$key) {
    # keys that DESCRIBE secrets rather than hold them ("bearer token protection",
    # "netdata management api key file") end in a diagnostic noun; their values are
    # settings, not credentials. Exemption is KEY-based on purpose: a value like
    # "false" or "/root/x" attached to a real secret key must still be redacted.
    $k = ($key -replace '[-_]', ' ').ToLower().Trim(' ', '#', "`t")
    foreach ($w in @('file', 'path', 'dir', 'directory', 'protection', 'support', 'mode',
                     'level', 'port', 'timeout', 'cookies', 'secure', 'log', 'size', 'options')) {
        if ($k -eq $w -or $k.EndsWith(" $w")) { return $true }
    }
    return $false
}

function Test-KeyExempt([string]$key) {
    # the two reasons a key that LOOKS secret is left alone: it names or
    # describes a secret rather than holding one, or it is the streaming api key
    return ((Test-DiagnosticKey $key) -or (Test-StreamingApiKey $key))
}

function Test-StreamingApiKey([string]$key) {
    # netdata/netdata#23448: the STREAMING api key is not treated as a secret -
    # support needs its value to tell whether a child and its parent agree.
    # Scoped to stream.conf ($script:SanCtx) and to an EXACT key match, so a
    # third-party "api key" in any other file, and any other secret key inside
    # stream.conf, is still redacted. Deliberately NOT applied to access logs,
    # where the same value also appears (stream-receiver-connection.c logs it,
    # and children send it as a "key=" query parameter).
    if ($script:SanCtx -ne 'stream') { return $false }
    $k = ($key -replace '[-_]', ' ').ToLower().Trim(' ', '#', "`t")
    return ($k -eq 'api key' -or $k -eq 'proxy api key')
}

function Get-Pseudonym([string]$orig, [string]$prefix) {
    if (-not $script:PseudoMap.ContainsKey($orig)) {
        # cap: past 4096 mappings, use a constant non-correlating placeholder
        if ($script:PseudoMap.Count -ge 4096) { return "redacted-$prefix" }
        if ($prefix -eq 'ip') { $script:IpCount++; $script:PseudoMap[$orig] = "ip-$($script:IpCount)" }
        elseif ($prefix -eq 'ip6') { $script:Ip6Count++; $script:PseudoMap[$orig] = "ip6-$($script:Ip6Count)" }
        elseif ($prefix -eq 'fqdn') { $script:FqdnCount++; $script:PseudoMap[$orig] = "private-host-$($script:FqdnCount)" }
        else { $script:PseudoMap[$orig] = 'redacted-host' }
    }
    return $script:PseudoMap[$orig]
}

function Invoke-RedactSecretLine([string]$line) {
    # pass 1 (always on): credential redaction
    # [<uuid>] section headers are api keys (or machine GUIDs). In stream.conf
    # they are KEPT: support needs to see which key each section configures, and
    # collapsing them all to one placeholder also made per-key settings
    # unattributable. Everywhere else they are still withheld.
    if ($script:SanCtx -ne 'stream' -and
        $line -match '^\s*\[[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\]\s*$') {
        return '[REDACTED-KEY-SECTION]'
    }
    # ini/yaml/env key = value | key: value
    # (JSON-shaped lines are owned by the json rule below, which preserves quoting)
    # only plausible config keys: short, no sentence/shell punctuation, no path
    # separators (command lines with paths belong to the argv rule below)
    if ($line -notmatch '^\s*"' -and $line -match '^([^=:]{1,64})([=:])(.+)$' -and $Matches[1] -notmatch '["`;|()/]') {
        if ((Test-SecretKey $Matches[1]) -and $Matches[3].Trim() -ne '' -and
            -not (Test-DiagnosticKey $Matches[1]) -and -not (Test-StreamingApiKey $Matches[1])) {
            $line = $Matches[1] + $Matches[2] + ' [REDACTED]'
        }
    }
    # json "key": "value" pairs (possibly several per line)
    $line = [regex]::Replace($line, '"([^"]+)"\s*:\s*"(?:[^"\\]|\\.)*"', {
        param($m)
        if ((Test-SecretKey $m.Groups[1].Value) -and -not (Test-DiagnosticKey $m.Groups[1].Value)) { '"' + $m.Groups[1].Value + '": "[REDACTED]"' }
        else { $m.Value }
    })
    # scalar (unquoted) JSON values under secret keys: "key": 12345 / true / null
    $line = [regex]::Replace($line, '"([^"]+)"\s*:\s*(-?\d[\d.eE+-]*|true|false|null)', {
        param($m)
        if ((Test-SecretKey $m.Groups[1].Value) -and -not (Test-DiagnosticKey $m.Groups[1].Value)) { '"' + $m.Groups[1].Value + '": "[REDACTED]"' }
        else { $m.Value }
    })
    # NOTE (scope): nested JSON arrays/objects under secret keys are not
    # deep-parsed - see the matching note in netdata-support-bundle and the
    # "Redaction philosophy" section of SUPPORT-BUNDLE.md. Collected agent JSON
    # keeps credentials in string/scalar fields (handled above), not structures.
    # URL creds and Go-style DSN creds
    $line = $line -replace '://[^:/@\s]+:[^@\s]+@', '://[REDACTED]@'
    $line = $line -replace '\b[\w]+:[^@\s]+@(tcp|unix)\(', '[REDACTED]@$1('
    # JWTs, HTTP auth header values
    $line = $line -replace 'eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]+', '[REDACTED-JWT]'
    # Bearer value must contain a digit: real tokens do, prose after "bearer" does not
    $line = $line -replace '[Bb]earer\s+[A-Za-z._~+/=-]*\d[A-Za-z0-9._~+/=-]*', 'Bearer [REDACTED]'
    $line = $line -replace '[Bb]asic\s+[A-Za-z0-9+/=]{8,}', 'Basic [REDACTED]'
    # secrets passed as URL query parameters (access-log request lines etc.)
    $line = $line -replace '([?&][\w.-]*(token|apikey|api_key|access_key|private_key|secret_key|password|passwd|secret|bearer|claim_token|claim_rooms|key|auth)=)[^&"\s]+', '$1[REDACTED]'
    # argv/env-style secrets mid-line (process command lines: -token=X, CLAIM_TOKEN=X),
    # incl. two-word keys ("api key = X"); diagnostic-noun keys are kept
    $line = [regex]::Replace($line, '(?i)(([\w.-]*(token|password|passwd|secret|apikey|api_key|community|bearer)|(api|license|auth|access) key|proxy (user|pass|password)) ?[=:] ?)([^&"\s\[]+)', {
        param($m)
        if ((Test-DiagnosticKey $m.Groups[2].Value) -or (Test-StreamingApiKey $m.Groups[2].Value)) { $m.Value }
        else { $m.Groups[1].Value + '[REDACTED]' }
    })
    # NOTE: multiline PEM private-key blocks are handled by Invoke-SanitizeFile,
    # which tracks BEGIN/END state across lines and withholds the whole block.
    return $line
}

function Invoke-RedactDestinationLine([string]$line) {
    # stream.conf destination hosts are user infrastructure regardless of TLD.
    # Token syntax: [PROTOCOL:]HOST[%IFACE][:PORT][:SSL]. Runs BEFORE the IP
    # rules (pure-IP tokens are skipped and left to them).
    $eq = $line.IndexOf('=')
    $head = $line.Substring(0, $eq + 1)
    $rebuilt = foreach ($tok in ($line.Substring($eq + 1) -split '\s+')) {
        if (-not $tok) { continue }
        $work = $tok; $prefix = ''; $suffix = ''
        if ($work -match '^(tcp:|udp:|unix:)(.*)$') { $prefix = $Matches[1]; $work = $Matches[2] }
        if (-not $work.StartsWith('[') -and -not $work.StartsWith('/')) {
            $cut = $work.IndexOfAny([char[]]('%', ':'))
            if ($cut -ge 0) { $suffix = $work.Substring($cut); $work = $work.Substring(0, $cut) }
            if ($work.Length -ge 4 -and
                $work -notmatch '^(ip6?-\d+|private-host-\d+)$' -and
                $work -notmatch '^\d{1,3}(\.\d{1,3}){3}$' -and
                $work -notmatch '^[0-9A-Fa-f:]+$') {
                $work = Get-Pseudonym $work 'fqdn'
            }
        }
        $prefix + $work + $suffix
    }
    return $head + ' ' + ($rebuilt -join ' ')
}

function Invoke-ReplaceAddressText([string]$line) {
    # emails, MACs, IPv4, IPv6
    $line = $line -replace '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}', '[EMAIL]'
    $line = $line -replace '\b([0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b', '[MAC]'
    # IPv4 (keep loopback/wildcard/broadcast)
    $line = [regex]::Replace($line, '\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b', {
        param($m)
        $ip = $m.Value
        if ($ip -like '127.*' -or $ip -eq '0.0.0.0' -or $ip -like '255.*') { return $ip }
        return (Get-Pseudonym $ip 'ip')
    })
    # IPv6: hex-and-colon runs, validated to skip timestamps/:: tokens/loopback.
    # 6+ colons is always accepted: numeric-only uncompressed IPv6 has 7,
    # timestamps never have more than 2.
    $line = [regex]::Replace($line, '(?<![\w.-])[0-9A-Fa-f:]{5,}', {
        param($m)
        $c = $m.Value
        $nc = [regex]::Matches($c, ':').Count
        if ($nc -eq 0 -or $c -eq '::1' -or
            ($nc -lt 3 -and $c -notmatch '::') -or
            $c.EndsWith(':') -or
            ($nc -lt 6 -and $c -notmatch '[A-Fa-f]' -and $c -notmatch '::')) { return $c }
        return (Get-Pseudonym $c 'ip6')
    })
    return $line
}

function Invoke-ObfuscatePiiLine([string]$line) {
    # pass 2 (default on): PII pseudonymization
    if ($line -match '^[\s#]*(proxy )?destination\s*=') { $line = Invoke-RedactDestinationLine $line }
    $line = Invoke-ReplaceAddressText $line
    # clearly-private FQDNs
    $line = [regex]::Replace($line, '\b[A-Za-z0-9][A-Za-z0-9.-]*\.(internal|local|lan|corp|intranet|localdomain)\b', {
        param($m); return (Get-Pseudonym $m.Value 'fqdn')
    })
    # child/mirrored hostnames pre-seeded from the local API (longest first,
    # word-boundary guarded so "host1" never corrupts "host10")
    foreach ($k in $script:SeededHosts) {
        if ($line.IndexOf($k, [System.StringComparison]::OrdinalIgnoreCase) -ge 0) {
            $line = [regex]::Replace($line, "(?<![\w.-])$([regex]::Escape($k))(?![\w.-])",
                $script:PseudoMap[$k], [System.Text.RegularExpressions.RegexOptions]::IgnoreCase)
        }
    }
    # this host's names
    if ($HostFqdn -and $HostFqdn.Length -ge 4) { $line = $line.Replace($HostFqdn, (Get-Pseudonym $HostFqdn 'host')) }
    if ($HostShort -and $HostShort.Length -ge 4 -and $HostShort -ne $HostFqdn) {
        $line = $line -ireplace [regex]::Escape($HostShort), (Get-Pseudonym $HostShort 'host')
    }
    if ($RunUser) {
        if (-not $script:PseudoMap.ContainsKey($RunUser)) { $script:PseudoMap[$RunUser] = 'redacted-user' }
        $line = $line -ireplace [regex]::Escape($RunUser), 'redacted-user'
    }
    # the machine's own AD domain (DOMAIN\user in ACL output, and the DNS domain)
    if ($DnsDomain) {
        if (-not $script:PseudoMap.ContainsKey($DnsDomain)) { $script:PseudoMap[$DnsDomain] = 'redacted-domain' }
        $line = $line -ireplace [regex]::Escape($DnsDomain), 'redacted-domain'
    }
    if ($UserDomain) {
        if (-not $script:PseudoMap.ContainsKey($UserDomain)) { $script:PseudoMap[$UserDomain] = 'redacted-domain' }
        $line = $line -ireplace [regex]::Escape($UserDomain), 'redacted-domain'
    }
    return $line
}

function Invoke-SanitizeLine([string]$line, [bool]$secretScan = $true, [string]$ctx = '') {
    $script:SanCtx = $ctx
    # $secretScan can be disabled for content that structurally cannot hold
    # credentials (the Windows perflib dump: counter/instance metadata only), so
    # the expensive per-"key":"value" credential regexes are not run millions of
    # times over a ~60 MB blob. PII obfuscation (host/IP names) is always applied.
    if ($secretScan) { $line = Invoke-RedactSecretLine $line }
    if ($Obfuscate) { $line = Invoke-ObfuscatePiiLine $line }
    return $line
}

function Get-FileEncodingFacts([string]$path) {
    # What the sanitizer must preserve: where the BOM ends, whether the body is
    # valid UTF-8 (which decides the round-trip encoding), and whether it holds
    # a NUL. The old ReadAllLines/WriteAllLines pair normalized the BOM and the
    # line endings away silently - netdata/netdata#23448.
    $len = (Get-Item $path -Force).Length
    if ($len -gt $script:ByteExactMax) {
        # a large GENERATED capture (the perflib dump): scanning tens of MB in a
        # scalar loop would eat the global deadline, so probe a prefix for NUL
        # only and let the caller take the line-based path
        $probeLen = [int][Math]::Min($len, 1MB)
        $probe = New-Object byte[] $probeLen
        $fs = [System.IO.File]::OpenRead($path)
        try { [void]$fs.Read($probe, 0, $probeLen) } finally { $fs.Close() }
        return [pscustomobject]@{
            size = $len; bomLen = 0; utf8Valid = $true
            nul = ([Array]::IndexOf($probe, [byte]0) -ge 0)
        }
    }
    $bytes = [System.IO.File]::ReadAllBytes($path)
    $bomLen = 0
    if ($bytes.Length -ge 3 -and $bytes[0] -eq 0xEF -and $bytes[1] -eq 0xBB -and $bytes[2] -eq 0xBF) { $bomLen = 3 }
    elseif ($bytes.Length -ge 4 -and $bytes[0] -eq 0xFF -and $bytes[1] -eq 0xFE -and $bytes[2] -eq 0 -and $bytes[3] -eq 0) { $bomLen = 4 }
    elseif ($bytes.Length -ge 4 -and $bytes[0] -eq 0 -and $bytes[1] -eq 0 -and $bytes[2] -eq 0xFE -and $bytes[3] -eq 0xFF) { $bomLen = 4 }
    elseif ($bytes.Length -ge 2 -and $bytes[0] -eq 0xFF -and $bytes[1] -eq 0xFE) { $bomLen = 2 }
    elseif ($bytes.Length -ge 2 -and $bytes[0] -eq 0xFE -and $bytes[1] -eq 0xFF) { $bomLen = 2 }
    # a strict decoder is the cheapest UTF-8 validator available here
    $utf8Valid = $true
    try {
        $strict = New-Object System.Text.UTF8Encoding($false, $true)
        [void]$strict.GetString($bytes, $bomLen, $bytes.Length - $bomLen)
    } catch { $utf8Valid = $false }
    return [pscustomobject]@{
        size = $bytes.Length; bomLen = $bomLen; utf8Valid = $utf8Valid
        nul = ([Array]::IndexOf($bytes, [byte]0) -ge 0)
    }
}

function Convert-SanitizedText([string[]]$lines, [bool]$secretScan = $true, [string]$ctx = '') {
    # per-line redaction, plus whole-block withholding for PEM private keys
    # (clear BEGIN/END markers). Multi-line YAML block scalars are NOT specially
    # withheld - their indentation-based boundary can't be detected robustly by
    # a line tool, and inline "secret: value" is the common form (redacted by
    # the key/value rules). See SUPPORT-BUNDLE.md "Redaction philosophy".
    $out = New-Object System.Collections.ArrayList
    $inPem = $false
    foreach ($l in $lines) {
        # PEM private key: withhold BEGIN..END; fail closed if END never comes
        if ($inPem) {
            if ($l -match '-----END [A-Z0-9 ]*PRIVATE KEY') { $inPem = $false }
            continue
        }
        if ($l -match '-----BEGIN [A-Z0-9 ]*PRIVATE KEY') {
            $inPem = $true
            [void]$out.Add('[REDACTED PRIVATE KEY BLOCK]')
            continue
        }
        [void]$out.Add((Invoke-SanitizeLine $l $secretScan $ctx))
    }
    return $out
}

function Invoke-SanitizeFile([string]$path, [bool]$secretScan = $true, [string]$ctx = '') {
    if (-not (Test-Path $path)) { return }
    $facts = Get-FileEncodingFacts $path
    if ($facts.nul) {
        # a NUL means binary/UTF-16: line-based redaction would be byte-unsafe
        Write-Utf8 $path '[content withheld: file contains NUL bytes (binary or UTF-16?)]'
        return
    }
    if ($facts.size -gt $script:ByteExactMax) {
        # large GENERATED capture (the perflib dump): there is no source encoding
        # to preserve, and holding tens of MB twice is not worth it
        $out = Convert-SanitizedText ([System.IO.File]::ReadAllLines($path)) $secretScan $ctx
        [System.IO.File]::WriteAllLines($path, $out, $script:Utf8NoBom)
        return
    }
    # byte-exact path: keep the BOM bytes, keep every line's OWN terminator, and
    # never invent a final newline the source did not have
    $bytes = [System.IO.File]::ReadAllBytes($path)
    # Valid UTF-8 is decoded AS UTF-8: it re-encodes to the same bytes, and the
    # PII rules compare against real .NET strings, so a non-ASCII hostname or
    # username must not be reduced to Latin-1 mojibake - the replacement would
    # miss it and the real value would ship. ISO-8859-1 is only the fallback for
    # sources that are not valid UTF-8, where it is the byte-preserving choice.
    $enc = if ($facts.utf8Valid) { $script:Utf8NoBom } else { $script:BytePreserving }
    $text = $enc.GetString($bytes, $facts.bomLen, $bytes.Length - $facts.bomLen)
    $sb = New-Object System.Text.StringBuilder
    $inPem = $false
    $pos = 0
    $breaks = [char[]]@("`r", "`n")
    while ($pos -lt $text.Length) {
        $nl = $text.IndexOfAny($breaks, $pos)
        if ($nl -lt 0) {
            $lineText = $text.Substring($pos); $term = ''; $pos = $text.Length
        } else {
            $lineText = $text.Substring($pos, $nl - $pos)
            if ($text[$nl] -eq "`r" -and ($nl + 1) -lt $text.Length -and $text[$nl + 1] -eq "`n") {
                $term = "`r`n"; $pos = $nl + 2
            } else {
                $term = [string]$text[$nl]; $pos = $nl + 1
            }
        }
        # PEM private key: withhold BEGIN..END; fail closed if END never comes
        if ($inPem) {
            if ($lineText -match '-----END [A-Z0-9 ]*PRIVATE KEY') { $inPem = $false }
            continue
        }
        if ($lineText -match '-----BEGIN [A-Z0-9 ]*PRIVATE KEY') {
            $inPem = $true
            [void]$sb.Append('[REDACTED PRIVATE KEY BLOCK]').Append($term)
            continue
        }
        [void]$sb.Append((Invoke-SanitizeLine $lineText $secretScan $ctx)).Append($term)
    }
    $body = $enc.GetBytes($sb.ToString())
    if ($facts.bomLen -gt 0) {
        $outBytes = New-Object byte[] ($facts.bomLen + $body.Length)
        [System.Array]::Copy($bytes, 0, $outBytes, 0, $facts.bomLen)
        [System.Array]::Copy($body, 0, $outBytes, $facts.bomLen, $body.Length)
    } else {
        $outBytes = $body
    }
    [System.IO.File]::WriteAllBytes($path, $outBytes)
}

# --- sanitizer self-test (-SelfTest) ----------------------------------------------
# Table-driven regression suite for the redaction rules. Run it after ANY change
# to the sanitizer, and keep it in parity with the POSIX script's --selftest.
if ($SelfTest) {
    $HostShort = 'testhost99'
    $HostFqdn = 'testhost99.example.com'
    $RunUser = 'testuser9'
    $UserDomain = 'TESTDOM'
    $DnsDomain = 'testdom.example.com'
    $vectors = @(
        @{ in = 'api key = SENTINEL-1';                                            mustNot = @('SENTINEL');            must = @('[REDACTED]') }
        # assembled at runtime so secret scanners do not flag the source
        @{ in = ('    Authorization: ' + ('Bea' + 'rer') + ' SENTINEL-2abc123');    mustNot = @('SENTINEL');            must = @('[REDACTED]') }
        @{ in = 'password: SENTINEL-3';                                            mustNot = @('SENTINEL');            must = @('[REDACTED]') }
        @{ in = '"claim_token": "SENTINEL-4"';                                     mustNot = @('SENTINEL');            must = @('[REDACTED]') }
        @{ in = '"api_token": -98765';                                            mustNot = @('98765');               must = @('[REDACTED]') }
        @{ in = 'url: https://admin:SENTINEL-5@app.example.com/x';                 mustNot = @('SENTINEL');            must = @('[REDACTED]@') }
        @{ in = 'dsn: user:SENTINEL-6@tcp(10.1.2.3:3306)/db';                      mustNot = @('SENTINEL');            must = @('[REDACTED]') }
        @{ in = 'TELEGRAM_BOT_TOKEN="SENTINEL-7"';                                 mustNot = @('SENTINEL');            must = @('[REDACTED]') }
        @{ in = 'DEFAULT_RECIPIENT_SLACK="SENTINEL-8"';                            mustNot = @('SENTINEL');            must = @('[REDACTED]') }
        @{ in = '[11111111-2222-3333-4444-555555555555]';                          mustNot = @('11111111');            must = @('[REDACTED-KEY-SECTION]') }
        @{ in = 'destination = parent.example.internal:19999';                     mustNot = @('parent.example');      must = @('private-host') }
        @{ in = 'server at 10.1.2.3 talked to 192.168.5.7 then 10.1.2.3 again';    mustNot = @('10.1.2.3', '192.168'); must = @('ip-') }
        @{ in = 'admin email is ops@customer-corp.com on host testhost99';         mustNot = @('customer-corp', 'testhost99'); must = @('[EMAIL]', 'redacted-host') }
        @{ in = 'GET /api/v1/data?chart=x&token=SENTINEL-9&after=-60';             mustNot = @('SENTINEL');            must = @('[REDACTED]', 'after=-60') }
        @{ in = 'netdata 1234 /usr/sbin/netdata-claim.sh -token=SENTINEL-10 -rooms=abc'; mustNot = @('SENTINEL');      must = @('[REDACTED]', '-rooms=abc') }
        @{ in = 'Environment: NETDATA_CLAIM_TOKEN=SENTINEL-11 PATH=/usr/bin';      mustNot = @('SENTINEL');            must = @('[REDACTED]') }
        @{ in = 'IPv6: 2606:4700:10::ac42:aad8 and fe80::1ff:fe23:4567:890a';      mustNot = @('2606:4700', 'fe80::1ff'); must = @('ip6-') }
        @{ in = 'peer 2001:470:26:307:0:0:0:1 connected';                          mustNot = @('2001:470');            must = @('ip6-') }
        @{ in = 'captured: 2026-07-16T13:38:34Z listening on ::1 and file.c:123';  mustNot = @();                      must = @('13:38:34Z', '::1', 'file.c:123') }
        @{ in = '# bearer token protection = no';                                  mustNot = @('[REDACTED]');          must = @('bearer token protection = no') }
        @{ in = '# TCP SYN cookies = auto';                                        mustNot = @('[REDACTED]');          must = @('auto') }
        @{ in = '# netdata management api key file = /var/lib/netdata/netdata.api.key'; mustNot = @('[REDACTED]');     must = @('/var/lib/netdata/netdata.api.key') }
        @{ in = 'cmdline: /x/claim.sh api key = SENTINEL-12 end';                  mustNot = @('SENTINEL');            must = @('[REDACTED]', 'end') }
        @{ in = 'TOKEN=false';                                                     mustNot = @('false');               must = @('[REDACTED]') }
        @{ in = 'PASSWORD=/root/x';                                                mustNot = @('/root/x');             must = @('[REDACTED]') }
        @{ in = 'destination = tcp:parent.example.com:19999';                      mustNot = @('parent.example.com');  must = @('tcp:', 'private-host', ':19999') }
        @{ in = 'tcp LISTEN 0 4096 *:19999';                                       mustNot = @('private-host');        must = @('tcp LISTEN') }
        @{ in = '# destination = old-parent.example.org:19999';                    mustNot = @('old-parent.example');  must = @('private-host', ':19999') }
        @{ in = 'connect user:SENTINEL-13@unix(/run/x)/db ok';                     mustNot = @('SENTINEL');            must = @('[REDACTED]@unix(/run/x)/db', 'ok') }
        @{ in = '/etc/netdata/claim_token: SENTINEL-14';                           mustNot = @('SENTINEL');            must = @('[REDACTED]') }
        @{ in = 'destination = [2001:db8::77]:19999 unix:/run/nd.sock';            mustNot = @('2001:db8::77');        must = @('ip6-', ']:19999', 'unix:/run/nd.sock') }
        @{ in = 'password: q';                                                     mustNot = @(': q');                 must = @('[REDACTED]') }
        @{ in = '"api_token": 731942';                                             mustNot = @('731942');              must = @('[REDACTED]') }
        # 09-permissions ACL output: the machine's own AD domain is a corporate
        # identifier, built-in authorities are not
        @{ in = 'BUILTIN\Administrators and TESTDOM\svc_netdata have Modify';       mustNot = @('TESTDOM');             must = @('redacted-domain', 'BUILTIN\Administrators') }
        # stream.conf context (netdata/netdata#23448): the STREAMING api key is
        # kept verbatim, while every other secret in the same file is redacted
        @{ ctx = 'stream'; in = '    api key = 11111111-2222-3333-4444-555555555555';       mustNot = @('REDACTED'); must = @('api key = 11111111-2222-3333-4444-555555555555') }
        @{ ctx = 'stream'; in = '    proxy api key = 99999999-8888-7777-6666-555555555555'; mustNot = @('REDACTED'); must = @('proxy api key = 99999999-8888-7777-6666-555555555555') }
        @{ ctx = 'stream'; in = '[aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee]';                   mustNot = @('REDACTED'); must = @('[aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee]') }
        @{ ctx = 'stream'; in = '    password = SENTINEL-STREAM-PW';                        mustNot = @('SENTINEL'); must = @('[REDACTED]') }
        # PII obfuscation is NOT disabled by the stream context
        @{ ctx = 'stream'; in = '    destination = parent.example.internal:19999';          mustNot = @('parent.example'); must = @('private-host') }
        # the SAME lines with NO context must still be redacted
        @{ in = '    api key = 11111111-2222-3333-4444-555555555555'; mustNot = @('11111111'); must = @('[REDACTED]') }
        @{ in = '[aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee]';             mustNot = @('aaaaaaaa'); must = @('[REDACTED-KEY-SECTION]') }
    )
    $fails = 0
    foreach ($v in $vectors) {
        $ctx = if ($v.ContainsKey('ctx')) { [string]$v.ctx } else { '' }
        $label = if ($ctx) { "[$ctx] " } else { '' }
        $result = Invoke-SanitizeLine $v.in $true $ctx
        $ok = $true
        foreach ($p in $v.mustNot) { if ($result.IndexOf($p, [System.StringComparison]::OrdinalIgnoreCase) -ge 0) { $ok = $false } }
        foreach ($p in $v.must) { if ($result.IndexOf($p, [System.StringComparison]::OrdinalIgnoreCase) -lt 0) { $ok = $false } }
        if ($ok) { Write-Output "ok:   $label$result" } else { Write-Output "FAIL: $label'$($v.in)' -> '$result'"; $fails++ }
    }

    # --- encoding fidelity (netdata/netdata#23448): a BOM, CRLF endings and a
    # --- missing final newline must all survive redaction, and a BOM must NOT
    # --- shift the ^-anchored rules (it used to defeat the section redaction)
    $encTmp = Join-Path $Staging 'enc-test.conf'
    $encText = "[11111111-2222-3333-4444-555555555555]`r`npassword = SENTINEL-ENC`r`nlast line without newline"
    [System.IO.File]::WriteAllBytes($encTmp,
        [byte[]](@(0xEF, 0xBB, 0xBF) + $script:Utf8NoBom.GetBytes($encText)))
    Invoke-SanitizeFile $encTmp
    $encOut = [System.IO.File]::ReadAllBytes($encTmp)
    $encStr = $script:Utf8NoBom.GetString($encOut)
    $encFails = @()
    if (-not ($encOut.Length -ge 3 -and $encOut[0] -eq 0xEF -and $encOut[1] -eq 0xBB -and $encOut[2] -eq 0xBF)) {
        $encFails += 'the UTF-8 BOM was stripped by sanitization'
    }
    if ($encStr.IndexOf('[REDACTED-KEY-SECTION]') -lt 0) { $encFails += 'a BOM defeated the [<UUID>] section redaction' }
    if ($encStr.IndexOf('11111111-2222') -ge 0) { $encFails += 'the BOM-prefixed api key section survived' }
    if ($encStr.IndexOf('SENTINEL-ENC') -ge 0) { $encFails += 'a secret survived in the encoding vector' }
    if (@([regex]::Matches($encStr, "`r`n")).Count -lt 2) { $encFails += 'CRLF line endings were lost (including on the redacted line)' }
    if ($encOut[$encOut.Length - 1] -eq 10) { $encFails += 'a final newline was added to a source that had none' }
    if ($encFails.Count -gt 0) { foreach ($e in $encFails) { Write-Output "FAIL: $e"; $fails++ } }
    else { Write-Output 'ok:   encoding preserved (BOM + CRLF + no trailing newline) and the BOM did not defeat redaction' }

    # multiline PEM block must be withheld end-to-end by the file-level sanitizer
    $pemTmp = Join-Path $Staging 'pem-test.txt'
    @('before line',
      '-----BEGIN RSA PRIVATE KEY-----',
      'MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQ',
      'aGVsbG8gd29ybGQgdGhpcyBpcyBrZXkgbWF0ZXJpYWw=',
      '-----END RSA PRIVATE KEY-----',
      'after line') | Out-String | ForEach-Object { Write-Utf8 $pemTmp $_ }
    Invoke-SanitizeFile $pemTmp
    $pem = Get-Content $pemTmp -Raw
    if ($pem -match 'MIIEvQ' -or $pem -match 'aGVsbG8' -or $pem -notmatch '\[REDACTED PRIVATE KEY BLOCK\]' -or
        $pem -notmatch 'before line' -or $pem -notmatch 'after line') {
        Write-Output 'FAIL: PEM block not fully withheld'; $fails++
    } else { Write-Output 'ok:   PEM block withheld (begin/body/end gone, surrounding lines kept)' }
    Remove-Item $Staging -Recurse -Force
    if ($fails -gt 0) { Write-Output "SELF TEST: $fails FAILURES"; exit 1 }
    Write-Output 'SELF TEST: ALL PASS'
    exit 0
}

# --- manifest -------------------------------------------------------------------
function Add-Manifest([string]$rel, [string]$kind, [string]$origin, [string]$title, [bool]$raw = $false) {
    $full = Join-Path $Work $rel
    $bytes = 0
    if (Test-Path $full) { $bytes = (Get-Item $full).Length }
    $row = [ordered]@{
        path = $rel.Replace('\', '/'); kind = $kind; origin = $origin; title = $title
        bytes = [long]$bytes; pii_obfuscated = [bool]($Obfuscate -and -not $raw); sanitized = -not $raw
    }
    [void]$script:ManifestRows.Add($row)
}


# --- SNMP diagnostics ----------------------------------------------------------
function Add-SnmpNote([string]$message) {
    [System.IO.File]::AppendAllText((Join-Path $Work '06-state\snmp-diagnostics-status.txt'), "$message`n", $script:Utf8NoBom)
}

function Test-SnmpDirectory([string]$path) {
    try {
        $item = Get-Item -LiteralPath $path -Force -ErrorAction Stop
        return ($item.PSIsContainer -and -not ($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint))
    } catch { return $false }
}

function Save-SnmpFile([string]$src, [string]$rel) {
    $full = Join-Path $Work ("06-state\snmp-diagnostics\" + $rel)
    $inputStream = $null; $outputStream = $null
    try {
        if (Test-Deadline) { throw 'deadline reached' }
        $item = Get-Item -LiteralPath $src -Force -ErrorAction Stop
        if ($item.PSIsContainer -or ($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint)) {
            throw 'source is not a regular file'
        }
        New-Item -ItemType Directory -Path (Split-Path $full) -Force -ErrorAction Stop | Out-Null
        # Delete sharing lets the Agent atomically replace a file while it is read.
        $sharing = [System.IO.FileShare]::ReadWrite -bor [System.IO.FileShare]::Delete
        $inputStream = [System.IO.File]::Open($src, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, $sharing)
        $outputStream = [System.IO.File]::Open("$full.tmp", [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None)
        $buffer = New-Object byte[] 65536
        $copyDeadline = (Get-Date).AddSeconds($TimeoutSeconds)
        while (($count = $inputStream.Read($buffer, 0, $buffer.Length)) -gt 0) {
            if ((Test-Deadline) -or (Get-Date) -gt $copyDeadline) { throw 'copy deadline reached' }
            $outputStream.Write($buffer, 0, $count)
        }
        $outputStream.Dispose(); $outputStream = $null
        $inputStream.Dispose(); $inputStream = $null
        [System.IO.File]::Move("$full.tmp", $full)
        $script:SnmpFiles++
        Add-Manifest ("06-state\snmp-diagnostics\" + $rel) 'file' ("snmp/diagnostics/" + $rel.Replace('\', '/')) 'Original SNMP evidence (UNSANITIZED)' $true
        Add-SnmpNote ($rel.Replace('\', '/') + ': copied')
        return $true
    } catch {
        # Error text can contain machine-specific paths. Keep raw-copy status safe.
        $script:SnmpStatus = 'partial'
        Add-SnmpNote ($rel.Replace('\', '/') + ': unavailable or copy failed (withheld)')
        return $false
    } finally {
        if ($outputStream) { $outputStream.Dispose() }
        if ($inputStream) { $inputStream.Dispose() }
        if (Test-Path -LiteralPath "$full.tmp") { Remove-Item -LiteralPath "$full.tmp" -Force }
    }
}

function Get-SnmpRuns([string]$path) {
    # Match the fixed Agent-written index, not arbitrary JSON/path expressions.
    $uuid = '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
    $pattern = '\A\s*\{\s*"current"\s*:\s*"(?<current>' + $uuid + ')"(?:\s*,\s*"previous"\s*:\s*"(?<previous>' + $uuid + ')")?\s*\}\s*\z'
    $match = [regex]::Match([System.IO.File]::ReadAllText($path), $pattern)
    if (-not $match.Success) { throw 'invalid normal run index' }
    $current = $match.Groups['current'].Value
    $previous = $match.Groups['previous'].Value
    if ($current -eq $previous) { throw 'duplicate normal run identity' }
    $current
    if ($previous) { $previous }
}

function Save-SnmpDirectoryFiles([string]$root, [string]$relative, [string]$pattern) {
    $directory = Join-Path $root $relative
    if (-not (Test-SnmpDirectory $directory)) {
        $script:SnmpStatus = 'partial'
        Add-SnmpNote ($relative.Replace('\', '/') + ': directory unavailable or reparse point (withheld)')
        return
    }
    try {
        $files = @(Get-ChildItem -LiteralPath $directory -Force -ErrorAction Stop)
        foreach ($file in $files) {
            if ($file.Name -cmatch $pattern) {
                Save-SnmpFile $file.FullName (Join-Path $relative $file.Name) | Out-Null
            }
        }
    } catch {
        $script:SnmpStatus = 'partial'
        Add-SnmpNote ($relative.Replace('\', '/') + ': listing failed')
    }
}

function Collect-SnmpDiagnostics {
    New-Item -ItemType Directory -Path (Join-Path $Work '06-state') -Force | Out-Null
    Write-Utf8 (Join-Path $Work '06-state\snmp-diagnostics-status.txt') ''
    if (-not $IncludeSnmpDiagnostics) {
        Add-SnmpNote 'Not requested. Use -IncludeSnmpDiagnostics to include original, UNSANITIZED evidence.'
    } elseif (-not $LibDir -or -not (Test-Path -LiteralPath (Join-Path $LibDir 'snmp\diagnostics'))) {
        $script:SnmpStatus = 'unavailable'
        Add-SnmpNote 'No SNMP diagnostic directory found.'
    } else {
        $script:SnmpStatus = 'complete'
        $root = Join-Path $LibDir 'snmp\diagnostics'
        Add-SnmpNote 'Raw SNMP evidence requested: no secret redaction or PII obfuscation. Share privately.'
        if (-not (Test-SnmpDirectory (Join-Path $LibDir 'snmp')) -or -not (Test-SnmpDirectory $root)) {
            $script:SnmpStatus = 'partial'
            Add-SnmpNote 'Diagnostic directory unavailable or reparse point (withheld).'
        } else {
            $lifecycleMissing = $false
            if (Test-Path -LiteralPath (Join-Path $root 'lifecycle.zst')) {
                Save-SnmpFile (Join-Path $root 'lifecycle.zst') 'lifecycle.zst' | Out-Null
            } else {
                $lifecycleMissing = $true
                Add-SnmpNote 'lifecycle.zst: missing'
            }
            if (Test-Path -LiteralPath (Join-Path $root 'topology')) {
                Save-SnmpDirectoryFiles $root 'topology' '^checkpoint-[0-9]{20}\.zst$'
            }
            if (Test-Path -LiteralPath (Join-Path $root 'normal')) {
                if ((Test-SnmpDirectory (Join-Path $root 'normal')) -and
                    (Save-SnmpFile (Join-Path $root 'normal\runs.json') 'normal\runs.json')) {
                    try {
                        $runs = @(Get-SnmpRuns (Join-Path $Work '06-state\snmp-diagnostics\normal\runs.json'))
                        foreach ($run in $runs) {
                            Save-SnmpDirectoryFiles $root ("normal\" + $run) '^device-[0-9]{20}\.zst$'
                        }
                    } catch {
                        $script:SnmpStatus = 'partial'
                        Add-SnmpNote 'normal/runs.json: invalid index; normal device files withheld.'
                    }
                } else {
                    $script:SnmpStatus = 'partial'
                    Add-SnmpNote 'normal: directory or run index unavailable (device files withheld).'
                }
            }
            if ($script:SnmpFiles -gt 0 -and $lifecycleMissing) {
                $script:SnmpStatus = 'partial'
            }
            if ($script:SnmpFiles -eq 0 -and $script:SnmpStatus -eq 'complete') {
                $script:SnmpStatus = 'unavailable'
                Add-SnmpNote 'No completed SNMP diagnostic files found.'
            }
        }
    }
    Add-SnmpNote "Result: $script:SnmpStatus; complete files copied: $script:SnmpFiles."
    Add-Manifest '06-state\snmp-diagnostics-status.txt' 'file' 'generated' 'SNMP evidence collection status'
}
# --- end SNMP diagnostics ------------------------------------------------------

# --- collectors -------------------------------------------------------------------
# Launch a native netdata binary (netdata.exe / netdatacli.exe) DIRECTLY as a
# foreground process. These MUST NOT go through Start-Job: they are MSYS2
# binaries whose runtime does not initialize inside a PowerShell background-job
# runspace, so they exit non-zero with no output (an empty dump / empty stdout).
# A foreground child with an inherited console works. Notes:
#  - System.Diagnostics.Process, not Start-Process: Start-Process -PassThru does
#    not expose a reliable .ExitCode on Windows PowerShell 5.1 (it reads back
#    empty even for `cmd /c exit 7`).
#  - CreateNoWindow stays $false: detaching from the console reproduces the same
#    empty-output failure. The bundle runs from a console PowerShell, so the
#    child inherits it and no extra window appears.
#  - both pipes are decoded as UTF-8 (see below) and drained asynchronously so a full buffer cannot deadlock the
#    wait, which is bounded by WaitForExit (kill on timeout).
function Invoke-NativeProcess([string]$exe, [string[]]$argList, [int]$timeoutSec) {
    $r = [pscustomobject]@{ StdOut = ''; StdErr = ''; ExitCode = $null; TimedOut = $false; LaunchError = '' }
    $p = $null
    try {
        $psi = New-Object System.Diagnostics.ProcessStartInfo
        $psi.FileName = $exe
        # PS 5.1 ProcessStartInfo has no ArgumentList; quote args containing spaces
        $psi.Arguments = ($argList | ForEach-Object { if ($_ -match '\s') { '"' + $_ + '"' } else { $_ } }) -join ' '
        $psi.UseShellExecute = $false
        $psi.RedirectStandardOutput = $true
        $psi.RedirectStandardError = $true
        # the MSYS2 binaries write UTF-8; without this .NET decodes the pipes
        # with the console code page and non-ASCII text (dyncfg names, labels)
        # is mangled before it is re-written as UTF-8
        $psi.StandardOutputEncoding = New-Object System.Text.UTF8Encoding $false
        $psi.StandardErrorEncoding = New-Object System.Text.UTF8Encoding $false
        $psi.CreateNoWindow = $false
        $p = New-Object System.Diagnostics.Process
        $p.StartInfo = $psi
        [void]$p.Start()
        $outTask = $p.StandardOutput.ReadToEndAsync()
        $errTask = $p.StandardError.ReadToEndAsync()
        if ($p.WaitForExit($timeoutSec * 1000)) {
            $r.ExitCode = $p.ExitCode
            $r.StdOut = $outTask.Result
            $r.StdErr = $errTask.Result
        } else {
            try { $p.Kill() } catch { Write-Verbose "could not kill ${exe}: $_" }
            $r.TimedOut = $true
        }
    } catch {
        $r.LaunchError = "$_"
    } finally {
        if ($p) { $p.Dispose() }
    }
    return $r
}

function Save-Cmd([string]$rel, [string]$title, [scriptblock]$cmd, [string]$originText, [string]$nativeExe = '', [string[]]$nativeArgs = @(), [long]$cap = 0, [int]$timeoutFloor = 0) {
    # $cap mirrors the POSIX "collect_cmd --cap": journal/event-log captures are
    # documented at 5 MiB while command output defaults to 2 MiB
    if ($cap -le 0) { $cap = 2MB }
    # a capture that legitimately needs longer than the per-command default can
    # raise the floor; without it the job is killed and its WHOLE output is
    # replaced by "TIMEOUT after Ns", losing everything it had already gathered
    $timeout = if ($timeoutFloor -gt 0) { [Math]::Max($TimeoutSeconds, $timeoutFloor) } else { $TimeoutSeconds }
    if (Test-Deadline) { return }
    $full = Join-Path $Work $rel
    New-Item -ItemType Directory -Path (Split-Path $full) -Force | Out-Null
    $header = "# netdata-support-bundle v$ToolVersion | command: $originText | captured: $((Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ'))"
    if ($nativeExe) {
        # MSYS2 binary: direct launch, never Start-Job (see Invoke-NativeProcess).
        # Text file, so merge stdout+stderr like the old `2>&1`; never silent.
        $np = Invoke-NativeProcess $nativeExe $nativeArgs $timeout
        if ($np.LaunchError) { $result = "ERROR: could not launch: $($np.LaunchError)" }
        elseif ($np.TimedOut) { $result = "TIMEOUT after ${timeout}s" }
        elseif ($np.ExitCode -ne 0) { $result = "ERROR: exit $($np.ExitCode)`r`n$($np.StdErr)$($np.StdOut)" }
        else { $result = "$($np.StdOut)$($np.StdErr)" }
    } else {
        try {
            $job = Start-Job -ScriptBlock $cmd
            $done = Wait-Job $job -Timeout $timeout
            if ($done) { $result = Receive-Job $job 2>&1 | Select-Object -First 50000 | Out-String } else { $result = "TIMEOUT after ${timeout}s" }
            Stop-Job $job -ErrorAction SilentlyContinue
            Remove-Job $job -Force
        } catch { $result = "ERROR: $_" }
    }
    if ($result.Length -gt $cap) {
        # truncate at a LINE boundary so a secret cannot straddle the cut
        $cut = $result.LastIndexOf("`n", [int]$cap)
        if ($cut -lt 0) { $result = '[content withheld: output exceeds the cap without a line break]' }
        else { $result = $result.Substring(0, $cut + 1) + ("### TRUNCATED at {0} bytes (line-aligned) ###" -f $cap) }
    }
    Write-Utf8 $full ($header + "`r`n" + $result)
    Invoke-SanitizeFile $full
    Add-Manifest $rel 'cmd' $originText $title
}

function Get-RawCmdOutput([scriptblock]$cmd, [string]$nativeExe, [string[]]$nativeArgs) {
    if ($nativeExe) {
        # MSYS2 binary: direct launch, never Start-Job (see Invoke-NativeProcess).
        # JSON output, so keep stdout ONLY (merging stderr would corrupt it); a
        # failed/empty run returns nothing.
        $np = Invoke-NativeProcess $nativeExe $nativeArgs $TimeoutSeconds
        if (-not $np.TimedOut -and -not $np.LaunchError -and $np.ExitCode -eq 0) { return $np.StdOut }
        return ''
    }
    $result = ''
    try {
        $job = Start-Job -ScriptBlock $cmd
        $done = Wait-Job $job -Timeout $TimeoutSeconds
        if ($done) { $result = Receive-Job $job 2>&1 | Select-Object -First 50000 | Out-String }
        Stop-Job $job -ErrorAction SilentlyContinue
        Remove-Job $job -Force
    } catch { Write-Verbose "collector failed: $_" }
    return $result
}

function Limit-RawCmdOutput([string]$result, [bool]$dropOverCap) {
    # a truncated JSON document is worse than none: fail closed
    # measure the UTF-8 bytes written, not UTF-16 code units (see Save-Api)
    if ([System.Text.Encoding]::UTF8.GetByteCount($result) -le 2MB) { return $result }
    if ($dropOverCap) { return '' }
    return '{"error":"output exceeded the cap and was withheld"}'
}

function Save-CmdRaw([string]$rel, [string]$title, [scriptblock]$cmd, [string]$originText, [string]$nativeExe = '', [string[]]$nativeArgs = @(), [switch]$dropOverCap) {
    # like Save-Cmd but with NO header/trailer, for commands whose output must
    # stay parseable (JSON). Provenance lives in MANIFEST.json only. The file is
    # removed if the command produced nothing, and with -dropOverCap also if the
    # output exceeds the cap, so a caller with a fallback source can still try it.
    if (Test-Deadline) { return }
    $full = Join-Path $Work $rel
    New-Item -ItemType Directory -Path (Split-Path $full) -Force | Out-Null
    $result = Get-RawCmdOutput $cmd $nativeExe $nativeArgs
    if ($result -and $result.Trim().Length -gt 0) { $result = Limit-RawCmdOutput $result $dropOverCap.IsPresent }
    if ($result -and $result.Trim().Length -gt 0) {
        Write-Utf8 $full $result
        Invoke-SanitizeFile $full
        Add-Manifest $rel 'cmd' $originText $title
    } elseif (Test-Path $full) {
        Remove-Item $full -Force
    }
}

function Save-File([string]$rel, [string]$title, [string]$src, [long]$cap = 0) {
    if (Test-Deadline) { return }
    if ($cap -eq 0) { $cap = $FileCap }
    if (-not (Test-Path $src -PathType Leaf)) { return }
    # stream.conf is the one file whose streaming API key is kept verbatim; the
    # context is keyed on the SOURCE name, never on the bundle path
    $ctx = if ((Split-Path -Leaf $src) -eq 'stream.conf') { 'stream' } else { '' }
    $full = Join-Path $Work $rel
    New-Item -ItemType Directory -Path (Split-Path $full) -Force | Out-Null
    $item = Get-Item $src -Force
    if ($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) {
        # reparse points can silently retarget: fail closed rather than follow
        Write-Utf8 $full '[content withheld: source is a symlink/reparse point]'
        Add-Manifest $rel 'file' "$src (reparse point - withheld)" $title
        return
    }
    $size = $item.Length
    $origin = $src
    if ($size -gt $cap) {
        # keep the tail at a LINE boundary (drop the first, possibly partial,
        # line) so a secret can never straddle the cut and dodge the
        # line-based sanitizer; a tail with no line break at all is withheld
        $fs = [System.IO.File]::OpenRead($src)
        try {
            $slack = [Math]::Min($size, $cap + 4096)
            $fs.Seek(-$slack, [System.IO.SeekOrigin]::End) | Out-Null
            $buf = New-Object byte[] $slack
            $read = $fs.Read($buf, 0, $slack)
            $text = $script:Utf8NoBom.GetString($buf, 0, $read)
            $nl = $text.IndexOf("`n")
            if ($nl -lt 0) {
                Write-Utf8 $full '[content withheld: file tail exceeds the cap without a line break]'
            } else {
                Write-Utf8 $full $text.Substring($nl + 1)
            }
        } finally { $fs.Close() }
        $origin = "$src (last ~$cap of $size bytes, line-aligned)"
    } else {
        try { Copy-Item $src $full -Force -ErrorAction Stop }
        catch {
            Write-Utf8 $full "[content withheld: could not read source ($_)]"
            $origin = "$src (unreadable - withheld)"
        }
    }
    Invoke-SanitizeFile $full $true $ctx
    Add-Manifest $rel 'file' $origin $title
}

$NdPort = 19999
$CloudHost = 'app.netdata.cloud'   # reachability probe target
function Save-Api([string]$rel, [string]$title, [string]$urlPath) {
    if (Test-Deadline) { return }
    $full = Join-Path $Work $rel
    New-Item -ItemType Directory -Path (Split-Path $full) -Force | Out-Null
    try {
        $resp = Invoke-LocalApi "http://127.0.0.1:$NdPort$urlPath" $TimeoutSeconds
        $content = $resp.Content
        # a JSON body cut at any point is malformed, so overflow is withheld whole.
        # Measure the UTF-8 bytes actually written, not the string's UTF-16 code
        # units: a non-ASCII body can be several times longer on disk than in
        # characters and would otherwise sail past the cap.
        if ([System.Text.Encoding]::UTF8.GetByteCount($content) -gt 2MB) { $content = '{"error":"response exceeded the cap and was withheld"}' }
        Write-Utf8 $full $content
        Invoke-SanitizeFile $full
        Add-Manifest $rel 'api' $urlPath $title
    } catch {
        if (Test-Path $full) { Remove-Item $full -Force }
    }
}

# --- environment detection --------------------------------------------------------
$NetdataPrefix = 'C:\Program Files\Netdata'
$ConfDir = Join-Path $NetdataPrefix 'etc\netdata'
$LibDir = Join-Path $NetdataPrefix 'var\lib\netdata'
$CacheDir = Join-Path $NetdataPrefix 'var\cache\netdata'
$LogDir = Join-Path $NetdataPrefix 'var\log\netdata'
$NetdataExe = Join-Path $NetdataPrefix 'usr\bin\netdata.exe'
$NetdataCli = Join-Path $NetdataPrefix 'usr\bin\netdatacli.exe'

$NetdataSvc = Get-Service -Name 'Netdata' -ErrorAction SilentlyContinue
$NetdataProc = Get-Process -Name 'netdata' -ErrorAction SilentlyContinue | Select-Object -First 1
$NetdataProcessIds = @()
if ($NetdataProc) {
    # Walk descendants so sockets opened by plugin processes remain in scope
    # without relying on a brittle fixed process-name list.
    $allProcesses = @(Get-CimInstance Win32_Process -Property ProcessId, ParentProcessId -ErrorAction SilentlyContinue)
    $ids = New-Object 'System.Collections.Generic.HashSet[int]'
    [void]$ids.Add([int]$NetdataProc.Id)
    $changed = $true
    while ($changed) {
        $changed = $false
        foreach ($child in $allProcesses) {
            if ($ids.Contains([int]$child.ParentProcessId) -and $ids.Add([int]$child.ProcessId)) { $changed = $true }
        }
    }
    $NetdataProcessIds = @($ids | Sort-Object)
}
$ApiOk = $false
try {
    # /api/v3/info stays reachable under bearer protection (v1 is locked)
    foreach ($probe in @('/api/v3/info', '/api/v1/info')) {
        try { Invoke-LocalApi "http://127.0.0.1:$NdPort$probe" 3 | Out-Null; $ApiOk = $true; break }
        catch { Write-Verbose "probe $probe failed: $_" }
    }
} catch { Write-Verbose "agent API not reachable: $_" }

# pre-seed pseudonyms for child/mirrored hostnames, so a parent's children are
# obfuscated consistently in every file (node_instances, stream configs, logs)
if ($ApiOk -and $Obfuscate) {
    try {
        $names = @()
        $ni = (Invoke-LocalApi "http://127.0.0.1:$NdPort/api/v2/node_instances" $TimeoutSeconds).Content | ConvertFrom-Json
        if ($ni -and $ni.PSObject.Properties['nodes']) { $names += @($ni.nodes | ForEach-Object { $_.nm }) }
        $v1 = (Invoke-LocalApi "http://127.0.0.1:$NdPort/api/v1/info" $TimeoutSeconds).Content | ConvertFrom-Json
        if ($v1 -and $v1.PSObject.Properties['mirrored_hosts']) { $names += @($v1.mirrored_hosts) }
        foreach ($n in ($names | Sort-Object -Unique)) {
            if (-not $n -or $n.Length -lt 4 -or $n -eq 'localhost' -or $n -eq $HostShort -or $n -eq $HostFqdn) { continue }
            if (-not $script:PseudoMap.ContainsKey($n)) {
                if ($script:PseudoMap.Count -ge 4096) { break }  # honor the map cap
                $script:FqdnCount++
                $script:PseudoMap[$n] = "private-host-$($script:FqdnCount)"
            }
        }
        # longest first so overlapping names (host, host-2) replace correctly
        $script:SeededHosts = @($script:PseudoMap.Keys |
            Where-Object { $script:PseudoMap[$_] -like 'private-host*' } |
            Sort-Object { $_.Length } -Descending)
    } catch { Write-Verbose "child hostname pre-seed failed: $_" }
}

Show-Info "netdata-support-bundle $ToolVersion (Windows)"
Show-Info ("service: {0} | process: {1} | api: {2}" -f `
    $(if ($NetdataSvc) { $NetdataSvc.Status } else { 'not installed' }), `
    $(if ($NetdataProc) { "pid $($NetdataProc.Id)" } else { 'not running' }), `
    $(if ($ApiOk) { 'up' } else { 'unreachable' }))

# ============================================================================
# 01-system
# ============================================================================
Show-Info 'collecting: system'
Save-Cmd '01-system\os-version.txt' 'OS version and build' { Get-CimInstance Win32_OperatingSystem | Format-List Caption, Version, BuildNumber, OSArchitecture, LastBootUpTime, TotalVisibleMemorySize, FreePhysicalMemory } 'Get-CimInstance Win32_OperatingSystem'
Save-Cmd '01-system\computer-info.txt' 'Hardware, domain role, virtualization' { Get-CimInstance Win32_ComputerSystem | Format-List Manufacturer, Model, SystemType, NumberOfProcessors, NumberOfLogicalProcessors, TotalPhysicalMemory, DomainRole, HypervisorPresent } 'Get-CimInstance Win32_ComputerSystem'
Save-Cmd '01-system\disk-usage.txt' 'Volume usage' { Get-CimInstance Win32_LogicalDisk | Format-Table DeviceID, @{n='SizeGB';e={[math]::Round($_.Size/1GB,1)}}, @{n='FreeGB';e={[math]::Round($_.FreeSpace/1GB,1)}}, FileSystem -AutoSize } 'Get-CimInstance Win32_LogicalDisk'
Save-Cmd '01-system\clock-timesync.txt' 'Clock and time sync (drift breaks streaming/cloud)' { Get-Date -Format o; w32tm /query /status 2>&1 } 'Get-Date; w32tm /query /status'
Save-Cmd '01-system\uptime.txt' 'System uptime' { (Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime | Format-List Days, Hours, Minutes } 'uptime via Win32_OperatingSystem'

# ============================================================================
# 02-install
# ============================================================================
Show-Info 'collecting: install'
# NOTE: never use Win32_Product here - querying it triggers MSI reconfiguration
# of every installed package. The uninstall registry keys are the safe source.
Save-Cmd '02-install\msi-info.txt' 'Installed Netdata MSI package info (from uninstall registry)' {
    foreach ($root in @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall',
                        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall')) {
        Get-ItemProperty "$root\*" -ErrorAction SilentlyContinue |
            Where-Object { $_.DisplayName -like '*Netdata*' } |
            Format-List DisplayName, DisplayVersion, InstallDate, InstallLocation, Publisher
    }
} 'registry uninstall keys (Netdata)'
Save-Cmd '02-install\install-tree.txt' 'Install dir layout (top level)' { Get-ChildItem $using:NetdataPrefix | Format-Table Mode, LastWriteTime, Length, Name -AutoSize } "Get-ChildItem $NetdataPrefix (top level; -Depth is PS6+)"
if (Test-Path (Join-Path $ConfDir '.install-type')) {
    Save-File '02-install\install-type.file.txt' 'Install type marker' (Join-Path $ConfDir '.install-type')
}

# ============================================================================
# 03-process
# ============================================================================
Show-Info 'collecting: process'
Save-Cmd '03-process\netdata-processes.txt' 'Netdata process tree with CPU/memory' { Get-Process | Where-Object { $_.ProcessName -match 'netdata|go.d|ebpf|windows.plugin' } | Format-Table Id, ProcessName, CPU, WorkingSet64, HandleCount, Threads -AutoSize } 'Get-Process (netdata family)'
Save-Cmd '03-process\service-status.txt' 'Netdata service state and config' { Get-Service Netdata | Format-List *; (Get-CimInstance Win32_Service -Filter "Name='Netdata'") | Format-List StartMode, StartName, PathName, State, ExitCode } 'Get-Service Netdata + Win32_Service'

# ============================================================================
# 04-config
# ============================================================================
Show-Info 'collecting: config'
if ($ApiOk) {
    Save-Api '04-config\effective-netdata.conf' 'EFFECTIVE running config (merged, annotated) - authoritative over on-disk file' '/netdata.conf'
}
if (Test-Path $ConfDir) {
    Save-Cmd '04-config\config-tree.txt' 'User config dir tree (files here = user-customized; ssl and key material excluded)' { Get-ChildItem $using:ConfDir -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.FullName -notmatch '[\\/]ssl([\\/]|$)' -and $_.Extension -notin @('.pem', '.key') } | Select-Object -First 2000 | Format-Table Mode, LastWriteTime, Length, FullName -AutoSize } "Get-ChildItem $ConfDir -Recurse (ssl/key material excluded)"
    Save-File '04-config\netdata.conf' 'On-disk main config' (Join-Path $ConfDir 'netdata.conf')
    Save-File '04-config\stream.conf' 'Streaming config (parent/child; the streaming api key is KEPT VERBATIM - see README.md)' (Join-Path $ConfDir 'stream.conf')
    Save-File '04-config\claim.conf' 'Cloud claim config (token redacted)' (Join-Path $ConfDir 'claim.conf')
    Save-File '04-config\go.d.conf' 'go.d orchestrator config' (Join-Path $ConfDir 'go.d.conf')
    # every user-customized collector/health config, keeping subdirectory
    # structure (go.d\sd\*.conf must not collide with go.d\*.conf); ssl dirs
    # and key material are never collected. Capped at 200 files.
    $script:ConfCollected = 0
    foreach ($sub in @('go.d', 'health.d', 'python.d', 'charts.d', 'statsd.d')) {
        $subDir = Join-Path $ConfDir $sub
        if (-not (Test-Path $subDir)) { continue }
        Get-ChildItem $subDir -File -Recurse -Include '*.conf', '*.yml', '*.yaml' -ErrorAction SilentlyContinue |
            Where-Object { $_.FullName -notmatch '\\ssl\\' -and $_.Extension -notin @('.pem', '.key') } |
            ForEach-Object {
                if ($script:ConfCollected -ge 200) { return }
                $relSub = $_.FullName.Substring($subDir.Length).TrimStart('\')
                Save-File "04-config\$sub\$relSub" "User-customized $sub config (secrets redacted)" $_.FullName 256KB
                $script:ConfCollected++
            }
    }
}

# ============================================================================
# 05-logs (Windows: Event Log is the primary destination)
# ============================================================================
Show-Info "collecting: logs (last ${SinceHours}h, Event Log + files)"
# Windows builds are ALWAYS compiled with ETW (CMakeLists.txt sets HAVE_ETW
# unconditionally for OS_WINDOWS) and netdata-conf-logs.c then selects "etw" as
# the default log method, so the daemon logs into five manifest-declared
# Operational channels - Netdata/Daemon, /Collectors, /Access, /Health, /Aclk
# (wevt_netdata_mc_generate.c). Querying only NetdataWEL therefore returned NO
# daemon logs at all on a default install (netdata/netdata#23448).
#
# One merged file, ordered for triage: channel/provider state first, then Daemon
# and Collectors (what you read first), and Access LAST with the smallest event
# budget because it is by far the highest volume.
Save-Cmd '05-logs\eventlog-netdata.txt' 'Netdata events from the Windows Event Log: ETW channels (Netdata/*) + NetdataWEL + Application, plus channel and provider registration state' {
    # capture $using: into locals once: the $using: modifier is resolved when the
    # job scriptblock is serialized and must not be relied on inside strings
    $sinceHours = [int]$using:SinceHours
    $since = (Get-Date).AddHours(-$sinceHours)
    '===== channel state (a disabled or full channel loses events) ====='
    Get-WinEvent -ListLog 'Netdata/*', 'NetdataWEL' -ErrorAction SilentlyContinue |
        Select-Object LogName, IsEnabled, RecordCount, FileSize | Format-Table -AutoSize
    # per-channel event budgets: Daemon/Collectors carry the diagnosis, Access is
    # request noise, so it gets the smallest share of the file
    $channels = @(
        @{ Log = 'Netdata/Daemon';     Max = 3000 }
        @{ Log = 'Netdata/Collectors'; Max = 3000 }
        @{ Log = 'Netdata/Health';     Max = 1000 }
        @{ Log = 'Netdata/Aclk';       Max = 1000 }
        @{ Log = 'NetdataWEL';         Max = 2000 }
        @{ Log = 'Application';        Max = 2000 }
        @{ Log = 'Netdata/Access';     Max = 500 }
    )
    foreach ($ch in $channels) {
        "===== channel: $($ch.Log) (max $($ch.Max) events, last ${sinceHours}h) ====="
        $events = Get-WinEvent -FilterHashtable @{ LogName = $ch.Log; StartTime = $since } `
                               -MaxEvents $ch.Max -ErrorAction SilentlyContinue
        # Application is a shared channel: keep only Netdata's own records. The
        # dedicated channels are already Netdata-only, so filtering them would
        # drop records whose ProviderName resolves differently under ETW.
        if ($ch.Log -eq 'Application') { $events = $events | Where-Object { $_.ProviderName -match 'Netdata' } }
        if ($events) {
            $events | Select-Object TimeCreated, ProviderName, LevelDisplayName, Message | Format-List
        } else {
            '(no events in this window, or the channel does not exist on this system)'
        }
    }
} "Get-WinEvent: Netdata/* ETW channels + NetdataWEL + Application (last ${SinceHours}h)" -cap $LogCap -timeoutFloor 30
if (Test-Path $LogDir) {
    Get-ChildItem $LogDir -File -Filter '*.log' | ForEach-Object {
        Save-File "05-logs\$($_.Name)" "Agent log file: $($_.Name)" $_.FullName $LogCap
    }
}

# ============================================================================
# 06-state
# ============================================================================
Show-Info 'collecting: state'
Collect-SnmpDiagnostics
$StatusFile = Join-Path $LibDir 'status-netdata.json'
if (Test-Path $StatusFile) {
    Save-File '06-state\status-file.json' 'Daemon status file: LAST EXIT/CRASH RECORD incl. fatal stack trace (read this first for crashes)' $StatusFile
}
if (Test-Path $LibDir) {
    # bearer_tokens FILENAMES are live API tokens - list only their count
    Save-Cmd '06-state\state-tree.txt' 'State dir listing (bearer token filenames withheld - they are live tokens)' {
        $items = Get-ChildItem $using:LibDir -Recurse -ErrorAction SilentlyContinue | Select-Object -First 2000
        $tokenCount = @($items | Where-Object { $_.FullName -match '\\bearer_tokens\\' }).Count
        $items | Where-Object { $_.FullName -notmatch '\\bearer_tokens\\' } |
            Format-Table Mode, LastWriteTime, Length, FullName -AutoSize
        "[$tokenCount token file(s) - names withheld, they ARE the tokens]"
    } "Get-ChildItem $LibDir -Recurse (bearer_tokens contents withheld)"
    $CloudDir = Join-Path $LibDir 'cloud.d'
    if (Test-Path (Join-Path $CloudDir 'claimed_id')) {
        Save-File '06-state\claimed-id.txt' 'Cloud claim id (safe identifier; token/private.pem never collected)' (Join-Path $CloudDir 'claimed_id')
    }
}
if (Test-Path $CacheDir) {
    Save-Cmd '06-state\db-disk-usage.txt' 'Database disk usage per tier + sqlite sizes' { Get-ChildItem $using:CacheDir -Directory | ForEach-Object { $s = (Get-ChildItem $_.FullName -Recurse -File | Measure-Object Length -Sum).Sum; '{0}  {1:N1} MB' -f $_.Name, ($s/1MB) }; Get-ChildItem $using:CacheDir -File -Filter '*.db*' | Format-Table Name, Length -AutoSize } "du of $CacheDir"
}

# ============================================================================
# 07-runtime
# ============================================================================
# The dyncfg tree through the local command pipe: the agent answers it as a
# member of its own space, which the web API needs and the bundle cannot be.
# It does not need the web API, so it is tried whatever $ApiOk says - but at the
# tree's own place in the order: sanitizing a large tree can take minutes, and
# done first it would spend the deadline the smaller runtime captures need.
# With -dropOverCap Save-CmdRaw leaves no file on any failure, so the API
# fallback can use the same path.
$DyncfgTreeTitle = 'Dynamic configuration tree: go.d/scripts.d job states (accepted/running/failed/disabled/orphan/incomplete/none), service discovery, vnodes, secret stores, alert prototypes - THE source of collector job state'
function Save-DyncfgTreeCli {
    if ((Test-Path $NetdataCli) -and $NetdataProc) {
        # netdatacli.exe is MSYS2: native direct-launch, not Start-Job
        Save-CmdRaw '07-runtime\dyncfg-tree.json' $DyncfgTreeTitle $null 'netdatacli.exe dyncfg-tree' -nativeExe $NetdataCli -nativeArgs 'dyncfg-tree' -dropOverCap
    }
}
if ($ApiOk) {
    Show-Info 'collecting: runtime (agent is up)'
    Save-Api '07-runtime\info-v3.json' 'BEST SINGLE CALL: buildinfo, features, cloud status, per-tier retention' '/api/v3/info'
    Save-Api '07-runtime\info-v1.json' 'Agent info v1' '/api/v1/info'
    Save-Api '07-runtime\node-instances.json' 'Node instances: children, streaming state, db_size, metric counts' '/api/v2/node_instances'
    Save-Api '07-runtime\stream-info.json' 'Streaming diagnostics' '/api/v3/stream_info'
    Save-Api '07-runtime\aclk.json' 'Cloud/ACLK connection state' '/api/v1/aclk'
    Save-Api '07-runtime\alerts-active.json' 'Currently raised alerts' '/api/v3/alerts?options=active'
    Save-Api '07-runtime\alerts-all.json' 'All alert instances (summary)' '/api/v1/alarms?all'
    Save-Api '07-runtime\functions.json' 'Registered functions' '/api/v1/functions'
    Save-DyncfgTreeCli
    # Agents that predate `netdatacli dyncfg-tree` (tried just above), or a bundle run
    # by a user who cannot reach the command pipe, fall back to the API.
    $dyncfgPath = Join-Path $Work '07-runtime\dyncfg-tree.json'
    if (-not (Test-Path $dyncfgPath)) {
        Save-Api '07-runtime\dyncfg-tree.json' $DyncfgTreeTitle '/api/v3/config?action=tree'
    }
    # /api/v3/info answers without any access check, so $ApiOk can be true while
    # this endpoint - behind the dyncfg ACL - refuses us, and Save-Api deletes the
    # file on failure leaving no trace at all. The bundle cannot authenticate:
    # bearer token FILENAMES are themselves live tokens and are never collected.
    if (-not (Test-Path $dyncfgPath)) {
        # Every Save-Api in this block returns early once the deadline is past,
        # so 07-runtime may not exist yet and WriteAllText would throw.
        $dyncfgDir = Split-Path $dyncfgPath -Parent
        if (-not (Test-Path $dyncfgDir)) { New-Item -ItemType Directory -Path $dyncfgDir -Force | Out-Null }
        # State what was observed, not a cause: a refusal, a timeout, a transport
        # error and a deadline all reach this point identically.
        $marker = '{"error":"dyncfg tree was not collected","hint":"netdatacli dyncfg-tree was not usable (the agent predates it, the bundle could not reach the command pipe, or the call failed), so the bundle fell back to /api/v3/config, which only signed-in members of the agent''s space may list on current agents, and which a bearer-protected API refuses on older ones - a timeout, transport error, HTTP failure or an exceeded collection deadline is indistinguishable here. The bundle never collects bearer tokens and cannot authenticate. Run netdatacli.exe dyncfg-tree as an administrator, or ask for the collector job state separately.","means":"NOT evidence that no collector jobs exist"}'
        Write-Utf8 $dyncfgPath $marker
        Add-Manifest '07-runtime\dyncfg-tree.json' 'file' 'generated' 'Collector job state was unavailable (see hint in the file)'
    }
    Save-Api '07-runtime\ml-info.json' 'Machine learning status' '/api/v1/ml_info'
    Save-Api '07-runtime\self-cpu.csv' 'Netdata CPU last 10min (csv)' '/api/v1/data?chart=netdata.server_cpu&after=-600&points=60&format=csv'
    Save-Api '07-runtime\self-memory.csv' 'Netdata memory last 10min (csv)' '/api/v1/data?chart=netdata.memory&after=-600&points=60&format=csv'
    Save-Api '07-runtime\self-api-clients.csv' 'Netdata API clients last 10min (csv)' '/api/v1/data?chart=netdata.clients&after=-600&points=60&format=csv'
} else {
    Show-Info 'agent API unreachable - skipping runtime section'
    $marker = Join-Path $Work '07-runtime'
    New-Item -ItemType Directory -Path $marker -Force | Out-Null
    Write-Utf8 (Join-Path $marker 'AGENT-WAS-DOWN.txt') "Agent API at 127.0.0.1:$NdPort was unreachable when this bundle was created. See 05-logs and 06-state\status-file.json for why."
    Add-Manifest '07-runtime\AGENT-WAS-DOWN.txt' 'file' 'generated' 'Marker: agent was not running'
    Save-DyncfgTreeCli
}
# Elevation state: the perflib dump needs an elevated session, and the summary
# reports it too. Computed once here (after the self-test path has already
# exited) so it is never evaluated on non-Windows self-test runs.
$IsElevated = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (Test-Path $NetdataExe) {
    # these MSYS2 netdata.exe invocations use the native direct-launch path, not
    # Start-Job (which yields empty output for MSYS2 binaries - see Invoke-NativeProcess)
    Save-Cmd '07-runtime\buildinfo.txt' 'netdata -W buildinfo (verbatim; works with daemon down)' $null 'netdata.exe -W buildinfo' -nativeExe $NetdataExe -nativeArgs '-W', 'buildinfo'
    Save-CmdRaw '07-runtime\buildinfo.json' 'netdata -W buildinfojson (machine-readable; no header so it parses as JSON)' $null 'netdata.exe -W buildinfojson' -nativeExe $NetdataExe -nativeArgs '-W', 'buildinfojson'
    Save-Cmd '07-runtime\cmakecache.txt' 'netdata -W cmakecache: authoritative build config (flags, plugins, paths) - superset of buildinfo' $null 'netdata.exe -W cmakecache' -nativeExe $NetdataExe -nativeArgs '-W', 'cmakecache'
    # Windows performance-library dump: counter/instance metadata used to
    # diagnose Windows collector issues (e.g. PerflibSMB). Written to a file via
    # -perflibfile (not a capped stdout capture) so a large dump is not
    # truncated; sanitized like any other file (instance names can include
    # share/host names). The dump reads HKEY_PERFORMANCE_DATA and needs an
    # elevated session, and enumerating every counter can exceed the default
    # per-command timeout, so perflib gets an elevation pre-check and a 30s
    # floor. A failure is never silent: a JSON marker records why (incl. the
    # exit code and captured stderr/stdout), mirroring the never-omit behaviour
    # of Save-Cmd.
    #
    # Launched via Invoke-NativeProcess (direct foreground child, never
    # Start-Job) since netdata.exe is an MSYS2 binary; the dump itself goes to
    # -perflibfile, so stdout is normally empty and stderr carries the
    # "written to" confirmation or the failure reason.
    $perfPath = Join-Path $Work '07-runtime\perflib.json'
    New-Item -ItemType Directory -Path (Split-Path $perfPath) -Force | Out-Null
    $perfOrigin = 'netdata.exe -W perflibdump -perflibfile'
    $perfTitle = 'Windows performance-library dump: counter/instance metadata for Windows collector diagnosis (e.g. PerflibSMB)'
    if (-not $IsElevated) {
        Write-Utf8 $perfPath (@{ error = 'perflib dump skipped: not running elevated'; hint = 'Re-run the bundle in an elevated (Run as Administrator) PowerShell to collect it.' } | ConvertTo-Json -Compress)
    } else {
        $perfTimeout = [Math]::Max($TimeoutSeconds, 30)
        $np = Invoke-NativeProcess $NetdataExe @('-W', 'perflibdump', '-perflibfile', $perfPath) $perfTimeout
        $perfExit = $np.ExitCode
        $perfReason = if ($np.LaunchError) { "could not launch netdata.exe: $($np.LaunchError)" }
                      elseif ($np.TimedOut) { "TIMEOUT after ${perfTimeout}s" }
                      else { '' }
        if (($perfExit -eq 0) -and (Test-Path $perfPath) -and ((Get-Item $perfPath).Length -gt 0)) {
            # a full counter dump is legitimately large (~60 MB on a typical host,
            # more on busy servers); it compresses ~10-20x in the zip. The ceiling
            # only guards against a pathological runaway.
            if ((Get-Item $perfPath).Length -gt 128MB) { Write-Utf8 $perfPath '{"error":"perflib dump exceeded 128 MB and was withheld"}' }
        } else {
            # never silently drop it: record the exit code and both captured streams
            if (-not $perfReason) {
                $perfReason = (@($np.StdErr, $np.StdOut) | Where-Object { $_ -and $_.Trim() } | ForEach-Object { $_.Trim() }) -join ' | '
                if (-not $perfReason) { $perfReason = 'perflib dump produced no output file and no error text' }
            }
            Write-Utf8 $perfPath (@{
                    error    = 'perflib dump was not collected'
                    exitcode = $perfExit
                    reason   = $perfReason
                    hint     = 'If this timed out, re-run with a larger -TimeoutSeconds. If it reported an access error, ensure the bundle runs in an elevated PowerShell. Requires a netdata.exe build new enough to support -perflibfile.'
                } | ConvertTo-Json -Compress)
        }
    }
    # PII obfuscation only: the dump is counter/instance metadata with no
    # credential fields, and the full per-key credential scan over a ~60 MB blob
    # would blow the global deadline and starve later sections.
    Invoke-SanitizeFile $perfPath $false
    Add-Manifest '07-runtime\perflib.json' 'cmd' $perfOrigin $perfTitle
}
if ((Test-Path $NetdataCli) -and $NetdataProc) {
    # netdatacli.exe is also MSYS2: native direct-launch, not Start-Job
    Save-CmdRaw '07-runtime\aclk-state.json' 'Cloud connectivity state (netdatacli aclk-state json; no header so it parses as JSON)' $null 'netdatacli.exe aclk-state json' -nativeExe $NetdataCli -nativeArgs 'aclk-state', 'json'
}

# ============================================================================
# 08-network
# ============================================================================
Show-Info 'collecting: network'
Save-Cmd '08-network\netdata-sockets.txt' 'All sockets owned by the Netdata process tree' {
    $pids = @($using:NetdataProcessIds)
    if (-not $pids) { 'unavailable: Netdata process not found'; return }
    $rows = @()
    try {
        $rows += @(Get-NetTCPConnection -ErrorAction Stop | Where-Object { $pids -contains $_.OwningProcess } | ForEach-Object {
            $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
            [pscustomobject]@{ Protocol = 'TCP'; LocalAddress = $_.LocalAddress; LocalPort = $_.LocalPort; RemoteAddress = $_.RemoteAddress; RemotePort = $_.RemotePort; State = $_.State; OwningProcess = $_.OwningProcess; ProcessName = if ($p) { $p.ProcessName } else { '-' } }
        })
    } catch { $rows += [pscustomobject]@{ Protocol = 'TCP'; State = "unavailable: $($_.Exception.Message)" } }
    try {
        $rows += @(Get-NetUDPEndpoint -ErrorAction Stop | Where-Object { $pids -contains $_.OwningProcess } | ForEach-Object {
            $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
            [pscustomobject]@{ Protocol = 'UDP'; LocalAddress = $_.LocalAddress; LocalPort = $_.LocalPort; RemoteAddress = '*'; RemotePort = '*'; State = '-'; OwningProcess = $_.OwningProcess; ProcessName = if ($p) { $p.ProcessName } else { '-' } }
        })
    } catch { $rows += [pscustomobject]@{ Protocol = 'UDP'; State = "unavailable: $($_.Exception.Message)" } }
    if ($rows.Count -eq 0) { 'No Netdata-owned TCP or UDP sockets found.' } else { $rows | Format-Table Protocol, LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess, ProcessName -AutoSize }
} 'Get-NetTCPConnection/Get-NetUDPEndpoint (Netdata process tree)'
Save-Cmd '08-network\dns-config.txt' 'DNS resolver config' { Get-DnsClientServerAddress | Where-Object { $_.ServerAddresses } | Format-Table InterfaceAlias, ServerAddresses -AutoSize } 'Get-DnsClientServerAddress'
Save-Cmd '08-network\proxy-config.txt' 'System proxy configuration' { netsh winhttp show proxy 2>&1; Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' | Format-List ProxyEnable, ProxyServer, AutoConfigURL } 'netsh winhttp show proxy + registry'
Save-Cmd '08-network\cloud-connectivity.txt' 'Reachability of Netdata Cloud (TCP/TLS only, no data sent)' { Test-NetConnection -ComputerName $using:CloudHost -Port 443 -WarningAction SilentlyContinue | Format-List ComputerName, RemotePort, TcpTestSucceeded, PingSucceeded } "Test-NetConnection ${CloudHost}:443"

# ============================================================================
# 09-permissions
# ============================================================================
Show-Info 'collecting: permissions'
$PluginsDir = Join-Path $NetdataPrefix 'usr\libexec\netdata\plugins.d'
Save-Cmd '09-permissions\plugins-d.txt' 'plugins.d: ACLs, ownership, inheritance and integrity-level state for every plugin (a broken ACL here stops a collector dead)' {
    $d = $using:PluginsDir
    if (-not (Test-Path $d)) { "(plugins.d not found at $d)"; return }
    "===== $d ====="
    Get-Acl $d | Format-List Owner, Group, Access
    '-- contents --'
    Get-ChildItem $d -Force -ErrorAction SilentlyContinue |
        Select-Object Mode, LastWriteTime, Length, Name | Format-Table -AutoSize
    '-- per-file owner and access (non-inherited entries are the interesting ones) --'
    Get-ChildItem $d -File -Force -ErrorAction SilentlyContinue | Select-Object -First 120 | ForEach-Object {
        $acl = Get-Acl $_.FullName -ErrorAction SilentlyContinue
        if ($acl) {
            $explicit = @($acl.Access | Where-Object { -not $_.IsInherited })
            "{0}`n    owner={1}" -f $_.Name, $acl.Owner
            if ($explicit.Count -gt 0) {
                foreach ($a in $explicit) {
                    "    explicit: {0} {1} {2}" -f $a.IdentityReference, $a.AccessControlType, $a.FileSystemRights
                }
            } else {
                '    explicit: (none - all access inherited)'
            }
        }
    }
    '-- alternate data streams (a Zone.Identifier marks a file as downloaded/blocked) --'
    $ads = Get-ChildItem $d -File -Force -ErrorAction SilentlyContinue |
        Select-Object -First 120 |
        ForEach-Object { Get-Item $_.FullName -Stream * -ErrorAction SilentlyContinue } |
        Where-Object { $_.Stream -ne ':$DATA' }
    if ($ads) { $ads | Select-Object FileName, Stream, Length | Format-Table -AutoSize }
    else { '(no alternate data streams)' }
} "Get-Acl + Get-ChildItem -Stream on $PluginsDir"

$PermPaths = @($NetdataPrefix, $ConfDir, (Join-Path $ConfDir 'netdata.conf'), (Join-Path $ConfDir 'stream.conf'),
               (Join-Path $ConfDir 'ssl'), $LogDir, $LibDir, (Join-Path $LibDir 'cloud.d'), $CacheDir,
               $PluginsDir, $NetdataExe) | Where-Object { $_ } | Select-Object -Unique
Save-Cmd '09-permissions\netdata-paths.txt' 'Ownership, ACLs, inheritance and integrity levels for netdata directories, configs and the binary' {
    foreach ($p in $using:PermPaths) {
        if (-not (Test-Path $p)) { continue }
        "===== $p ====="
        $acl = Get-Acl $p -ErrorAction SilentlyContinue
        if ($acl) {
            "owner: $($acl.Owner)"
            "group: $($acl.Group)"
            'access:'
            $acl.Access | ForEach-Object {
                "    {0} {1} {2} (inherited={3})" -f $_.IdentityReference, $_.AccessControlType, $_.FileSystemRights, $_.IsInherited
            }
            if ($acl.AreAccessRulesProtected) { 'NOTE: ACL inheritance is DISABLED on this path' }
        } else {
            '(could not read the ACL - insufficient privilege?)'
        }
        # mandatory integrity level, when one is explicitly set
        $il = (icacls $p 2>$null | Select-String -SimpleMatch 'Mandatory Label') -join '; '
        if ($il) { "integrity: $il" }
    }
} 'Get-Acl + icacls for netdata paths'

# ============================================================================
# summary + manifest + README
# ============================================================================
Show-Info 'writing summary and manifest'
$AgentVersion = ''
$infoV1 = Join-Path $Work '07-runtime\info-v1.json'
if (Test-Path $infoV1) {
    try { $AgentVersion = (Get-Content $infoV1 -Raw | ConvertFrom-Json).version } catch { Write-Verbose "info-v1.json unparsable: $_" }
}
$CrashHint = ''
$sfPath = Join-Path $Work '06-state\status-file.json'
if (Test-Path $sfPath) {
    try {
        $sf = Get-Content $sfPath -Raw | ConvertFrom-Json
        if ($sf.agent -and $sf.agent.exit_reason) { $CrashHint = ($sf.agent.exit_reason -join ',') }
    } catch { Write-Verbose "status-file.json unparsable: $_" }
}
$RuntimeSecs = [int]((Get-Date) - $StartTime).TotalSeconds
$StreamNote = ''
if (Test-Path (Join-Path $Work '04-config\stream.conf')) {
    $StreamNote = 'streaming key:    PRESENT VERBATIM in 04-config\stream.conf (by design - see README.md)'
}

$summary = @"
NETDATA SUPPORT BUNDLE SUMMARY
generated:        $((Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ'))
tool version:     $ToolVersion (windows)
runtime seconds:  $RuntimeSecs
ran elevated:     $IsElevated
pii obfuscation:  $(if ($Obfuscate) { 'on' } else { 'OFF' })
$StreamNote
agent version:    $(if ($AgentVersion) { $AgentVersion } else { 'unknown' })
service status:   $(if ($NetdataSvc) { $NetdataSvc.Status } else { 'NOT INSTALLED' })
agent process:    $(if ($NetdataProc) { "yes (pid $($NetdataProc.Id))" } else { 'NOT RUNNING' })
agent api:        $(if ($ApiOk) { 'reachable' } else { 'UNREACHABLE' })
$(if ($CrashHint) { "last exit reason: $CrashHint   <-- check 06-state\status-file.json" })

SNMP diagnostics: $script:SnmpStatus ($script:SnmpFiles raw files; UNSANITIZED when included)

READ ORDER FOR TRIAGE:
  SNMP issues         -> 06-state\snmp-diagnostics-status.txt, 06-state\snmp-diagnostics\
  crashes/won't start -> 06-state\status-file.json, 05-logs\eventlog-netdata.txt
  collector issues    -> 07-runtime\dyncfg-tree.json (job states), 04-config\go.d*, 05-logs\, 09-permissions\plugins-d.txt
  streaming issues    -> 04-config\stream.conf, 07-runtime\node-instances.json, 01-system\clock-timesync.txt
  cloud/claiming      -> 06-state\claimed-id.txt, 07-runtime\aclk.json, 08-network\
  performance         -> 03-process\netdata-processes.txt, 06-state\db-disk-usage.txt
  access denied       -> 09-permissions\ (ACLs, ownership, inheritance, service account)
"@
Write-Utf8 (Join-Path $Work 'summary.txt') $summary
Add-Manifest 'summary.txt' 'file' 'generated' 'Human summary'

$readme = @"
# Netdata Support Bundle (Windows)

Generated by ``netdata-support-bundle.ps1``. Standard captures are SANITIZED: secrets (tokens, api
keys, passwords) are redacted; by default IPs, MACs, emails and
hostnames are replaced with stable pseudonyms - consistent across all files.
The pseudonym map stays on this machine, next to the zip - it is NOT in this
bundle.

**Streaming-key exception:** the **streaming API key** is kept VERBATIM in
``04-config\stream.conf`` (both ``api key`` values and ``[<API_KEY>]`` section
headers). It is the value support needs to tell whether a child and its parent
agree, so it is not treated as a secret. If your threat model differs, remove or
mask it before sending the bundle. The same key IS still redacted where it
appears in the Access event-log channel.

**Optional raw SNMP evidence:** ``06-state/snmp-diagnostics/``, when included,
is UNSANITIZED: no secret redaction or PII obfuscation. It preserves device
responses, inventory and metric values. Share this bundle through a restricted
support channel, never a public issue. See ``06-state/snmp-diagnostics-status.txt`` for
missing files or copy failures; the directory is not one simultaneous snapshot.

Collected text files keep their original bytes: a byte-order mark, CRLF or CR line
endings and a missing final newline all survive redaction, so an encoding fault
in a config file is still visible here.

Layout matches the POSIX bundle (see MANIFEST.json for every file):
01-system, 02-install, 03-process, 04-config, 05-logs (Windows Event Log:
Netdata/* ETW channels + NetdataWEL), 06-state, 07-runtime, 08-network,
09-permissions (ACLs, ownership, inheritance, service account).
Start with summary.txt.
"@
Write-Utf8 (Join-Path $Work 'README.md') $readme
Add-Manifest 'README.md' 'file' 'generated' 'Bundle documentation'

# emit MANIFEST.json LAST so every file (incl. summary.txt and README.md) is indexed
$manifest = [ordered]@{
    schema = 'netdata-support-bundle/v2'
    tool_version = "$ToolVersion-windows"
    generated_utc = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
    runtime_seconds = $RuntimeSecs
    pii_obfuscated = [bool]($Obfuscate -and $script:SnmpFiles -eq 0)
    secrets_redacted = ($script:SnmpFiles -eq 0)
    snmp_diagnostics = [ordered]@{ requested = [bool]$IncludeSnmpDiagnostics; status = $script:SnmpStatus; files = $script:SnmpFiles }
    # the standard-capture exception to secrets_redacted (netdata/netdata#23448)
    streaming_api_key_redacted = $false
    agent_running = [bool]$NetdataProc
    agent_api_reachable = [bool]$ApiOk
    is_container = $false
    files = $script:ManifestRows
}
Write-Utf8 (Join-Path $Work 'MANIFEST.json') (($manifest | ConvertTo-Json -Depth 4) + "`n")

# ============================================================================
# zip
# ============================================================================
New-Item -ItemType Directory -Path $Output -Force | Out-Null
$ZipPath = Join-Path $Output "$BundleName.zip"
# build the zip inside the owner-only staging dir, then publish without
# overwrite: Move-Item without -Force fails if the destination exists
$StagingZip = Join-Path $Staging "$BundleName.zip"
try {
    # Create mode streams entries; Compress-Archive uses Update mode and buffers
    # the complete evidence payload in memory until the archive is closed.
    Add-Type -AssemblyName System.IO.Compression.FileSystem -ErrorAction Stop
    [System.IO.Compression.ZipFile]::CreateFromDirectory(
        $Work, $StagingZip, [System.IO.Compression.CompressionLevel]::Optimal, $true)
    Move-Item -Path $StagingZip -Destination $ZipPath -ErrorAction Stop
} catch {
    # Write-Error would be swallowed by $ErrorActionPreference='SilentlyContinue'
    Show-Info "ERROR: could not create or publish $ZipPath ($_)"
    if (-not $KeepStaging) { Remove-Item $Staging -Recurse -Force -ErrorAction SilentlyContinue }
    exit 1
}

$MapPath = Join-Path $Output "$BundleName.pseudonym-map.tsv"
if ($Obfuscate -and $script:PseudoMap.Count -gt 0) {
    # same format as the POSIX script: type<TAB>original<TAB>pseudonym
    $mapText = ($script:PseudoMap.GetEnumerator() | ForEach-Object {
        $type = 'other'
        if ($_.Value -match '^ip6-\d+$') { $type = 'ip6' }
        elseif ($_.Value -match '^ip-\d+$') { $type = 'ip' }
        elseif ($_.Value -match '^private-host-\d+$') { $type = 'fqdn' }
        elseif ($_.Value -eq 'redacted-host') { $type = 'host' }
        elseif ($_.Value -eq 'redacted-user') { $type = 'user' }
        "$type`t$($_.Key)`t$($_.Value)"
    }) -join "`n"
    # build in the private staging dir, then move without -Force so a
    # pre-existing file or symlink in a shared output dir is never followed
    $mapStaged = Join-Path $Staging 'pseudonym-map.tsv'
    Write-Utf8 $mapStaged ($mapText + "`n")
    try { Move-Item -Path $mapStaged -Destination $MapPath -ErrorAction Stop }
    catch { Show-Info "could not publish pseudonym map to $MapPath ($_) - left in staging"; $MapPath = $mapStaged; $KeepStaging = $true }
}

if (-not $KeepStaging) { Remove-Item $Staging -Recurse -Force }

Show-Info ''
Show-Info ("done in {0}s" -f [int]((Get-Date) - $StartTime).TotalSeconds)
Show-Info "bundle:  $ZipPath"
if ($Obfuscate -and $script:PseudoMap.Count -gt 0) {
    Show-Info "pseudonym map (KEEP PRIVATE, do not send): $MapPath"
}
Show-Info 'attach the bundle to your support ticket.'