stage-bundled-bins.ts

#!/usr/bin/env bun
/**
 * Default: syncs prebuilt CLIs into resources/bin for Electrobun build.copy.
 * Resolution order: (1) manifest `assets` URL+SHA256 → download to resources/bundled-cli/.cache/; (2) local
 * resources/bundled-cli/<platform>/ (maintainer checkout); (3) PROMETHEUS_LEGACY_STAGING=1 upstream downloads.
 * On Windows, .zip archives: **7-Zip** extract first (`7z x`); fallback: PowerShell 7 `Expand-Archive`, then
 * `powershell.exe`. Override 7z path: `PROMETHEUS_7Z`; override PowerShell: `PROMETHEUS_PWSH`.
 * 7-Zip is also used for Ghostscript Inno extract + ImageMagick `.7z`.
 * Skip entirely: PROMETHEUS_SKIP_STAGE_BINS=1. Invoked from run-electrobun-with-build-at.ts before build.
 *
 * macOS: pack key follows **hardware** (Apple Silicon → `darwin-arm64`, Intel → `darwin-x64`), not `process.arch`,
 * so a Rosetta-translated `bun` still stages arm64 CLIs on M-series Macs.
 */
import { createHash } from "node:crypto";
import {
  chmodSync,
  copyFileSync,
  cpSync,
  existsSync,
  lstatSync,
  mkdirSync,
  mkdtempSync,
  readdirSync,
  readFileSync,
  readlinkSync,
  rmSync,
  statSync,
  symlinkSync,
  unlinkSync,
  writeFileSync,
} from "node:fs";
import { tmpdir } from "node:os";
import path from "node:path";
import {
  windows_7z_extract_zip_sync,
  windows_7z_output_dir_flag,
  windows_resolve_7z_exe,
} from "../src/bun/utils/windows_7zip";
import { spawnSync } from "node:child_process";
import {
  lfs_probe_relative_path_for_kind,
  pack_kind_from_process,
  required_staged_paths_present_at,
} from "./bundled-cli/pack_layout";
import { read_yt_dlp_lock, yt_dlp_entry_for_host_platform_key } from "./bundled-cli/yt_dlp_lock";
import { asset_for_platform, read_bundled_cli_manifest } from "./bundled_cli_manifest";

const project_root = path.join(import.meta.dir, "..");
const out_dir = path.join(project_root, "resources", "bin");
const bundled_cli_root = path.join(project_root, "resources", "bundled-cli");
const manifest_path = path.join(bundled_cli_root, "manifest.json");
const marker_file = ".prometheus-bundled-bins";
const fingerprint_file = ".prometheus-stage-fingerprint";

const EVERMEET_FFMPEG_URL = "https://evermeet.cx/ffmpeg/ffmpeg-7.1.1.zip";
const EVERMEET_FFMPEG_SHA256 = "8d7917c1cebd7a29e68c0a0a6cc4ecc3fe05c7fffed958636c7018b319afdda4";
const EVERMEET_FFPROBE_URL = "https://evermeet.cx/ffmpeg/ffprobe-7.1.1.zip";
const EVERMEET_FFPROBE_SHA256 = "5a0a77d5e0c689f7b577788e286dd46b2c6120babd14301cce7a79fcfd3f7d28";

const QPDF_VERSION = "12.3.2";
const QPDF_LINUX_ZIP =
  "https://github.com/qpdf/qpdf/releases/download/v12.3.2/qpdf-12.3.2-bin-linux-x86_64.zip";
const QPDF_LINUX_SHA256 = "44f2c53bf784c0143128d80d2b9946e9793962c5bb403b75c0024cb4d8e346b9";
const QPDF_WIN_ZIP =
  "https://github.com/qpdf/qpdf/releases/download/v12.3.2/qpdf-12.3.2-mingw64.zip";
const QPDF_WIN_SHA256 = "ebeb4692434a8cb8a27f876584c0c2b402b6251dc6c8ed4b39cf2304cada10e0";

const GS_WIN_INSTALLER =
  "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs10070/gs10070w64.exe";
const GS_WIN_SHA256 = "8af854e2d62f9a3a674331321b347118a83928a3726631e458194121cf3bbeec";

const IM_WIN_7Z =
  "https://github.com/ImageMagick/ImageMagick/releases/download/7.1.2-18/ImageMagick-7.1.2-18-portable-Q16-x64.7z";
const IM_WIN_7Z_SHA256 = "88377fcb78f26763fcffa2aa1959574f32f6de45dbc3b1e662df0bbd5869d301";

const IM_LINUX_APPIMAGE =
  "https://github.com/ImageMagick/ImageMagick/releases/download/7.1.2-18/ImageMagick-d4e4b2b-gcc-x86_64.AppImage";
const IM_LINUX_APPIMAGE_SHA256 = "9cd43df019ca6ee3361360cd2c2a5c951fe55b9e8c85d76932168e64e871f786";

/**
 * Homebrew bottles for Ghostscript/ImageMagick list these as separate kegs; their dylibs are not
 * inside the ghostscript/imagemagick prefix but gs/magick still reference @@HOMEBREW_PREFIX@@/opt/....
 * Merge them into bundled lib dirs so dyld can resolve libltdl (libtool), libjbig2dec, liblcms2, etc.
 * next to our shipped bins.
 */
/**
 * Homebrew Ghostscript links these kegs (see `otool -L` on `ghostscript/bin/gs`). Merge all so
 * `@@HOMEBREW_PREFIX@@/opt/...` resolves via DYLD_LIBRARY_PATH into bundled lib dirs.
 */
const MACOS_GS_IM_KEG_DEPENDENCY_FORMULAS = [
  "libtool",
  "jbig2dec",
  "little-cms2",
  "libtiff",
  "libpng",
  "jpeg-turbo",
  "libidn",
  "fontconfig",
  "freetype",
  "openjpeg",
  "tesseract",
  "libarchive",
  "leptonica",
  "giflib",
  "webp",
  "xz",
  "zstd",
  "lz4",
  "libb2",
  "gettext",
] as const;

function sha256_file(file_path: string): string {
  const hash = createHash("sha256");
  hash.update(readFileSync(file_path));
  return hash.digest("hex");
}

function stage_script_sha256(): string {
  const script_path = path.join(project_root, "scripts", "stage-bundled-bins.ts");
  return sha256_file(script_path);
}

function darwin_bundled_cli_platform_key(): "darwin-arm64" | "darwin-x64" {
  const out = spawnSync("sysctl", ["-n", "hw.optional.arm64"], { encoding: "utf8" });
  if (out.status === 0 && out.stdout.trim() === "1") {
    return "darwin-arm64";
  }
  return "darwin-x64";
}

function host_platform_key(): string {
  if (process.platform === "darwin") {
    return darwin_bundled_cli_platform_key();
  }
  const arch = process.arch;
  if (process.platform === "linux" && arch === "x64") {
    return "linux-x64";
  }
  if (process.platform === "win32" && arch === "x64") {
    return "win32-x64";
  }
  throw new Error(`Unsupported host for bundled CLI sync: ${process.platform} ${arch}`);
}

function expected_prebuilt_fingerprint(): string {
  const raw = readFileSync(manifest_path, "utf8");
  const parsed = JSON.parse(raw) as { pack_version?: number };
  const v = typeof parsed.pack_version === "number" ? parsed.pack_version : 0;
  const pk = host_platform_key();
  const h = createHash("sha256")
    .update(raw)
    .update("\0")
    .update(pk)
    .update("\0")
    .update(String(v))
    .digest("hex");
  return `prebuilt-${v}-${h}`;
}

function expected_legacy_fingerprint(): string {
  return `legacy-${stage_script_sha256()}`;
}

function required_staged_paths_present(): boolean {
  return required_staged_paths_present_at(out_dir);
}

function looks_like_git_lfs_pointer(peek: string): boolean {
  return peek.startsWith("version https://git-lfs.github.com/spec/v1");
}

function assert_pack_binary_not_pointer(file_path: string, label: string): void {
  if (!existsSync(file_path)) {
    return;
  }
  try {
    const st = statSync(file_path);
    if (st.size > 2048) {
      return;
    }
    const peek = readFileSync(file_path, "utf8");
    if (looks_like_git_lfs_pointer(peek)) {
      throw new Error(
        `${label} looks like a Git LFS pointer stub (${file_path}). Replace with real binaries or use manifest assets / legacy staging.`,
      );
    }
  } catch (e) {
    if (e instanceof Error && e.message.includes("Git LFS pointer")) {
      throw e;
    }
  }
}

function clear_output_dir_preserving_readme(): void {
  mkdirSync(out_dir, { recursive: true });
  const keep = new Set(["README.md"]);
  let names: string[];
  try {
    names = readdirSync(out_dir);
  } catch {
    return;
  }
  for (const name of names) {
    if (keep.has(name)) {
      continue;
    }
    rmSync(path.join(out_dir, name), { recursive: true, force: true });
  }
}

function apply_unix_exec_bits(bin_root: string): void {
  if (process.platform === "win32") {
    return;
  }
  const maybe_chmod = (p: string): void => {
    if (existsSync(p)) {
      chmodSync(p, 0o755);
    }
  };
  maybe_chmod(path.join(bin_root, "ffmpeg"));
  maybe_chmod(path.join(bin_root, "ffprobe"));
  maybe_chmod(path.join(bin_root, "yt-dlp"));
  maybe_chmod(path.join(bin_root, "qpdf"));
  maybe_chmod(path.join(bin_root, "gs"));
  maybe_chmod(path.join(bin_root, "magick"));
  maybe_chmod(path.join(bin_root, "imagemagick", "usr", "bin", "magick"));
  maybe_chmod(path.join(bin_root, "ghostscript", "bin", "gs"));
}

function sync_prebuilt_from_pack_dir(src: string, label: string): void {
  if (!existsSync(src)) {
    throw new Error(`Missing prebuilt CLI pack: ${src}`);
  }
  if (!required_staged_paths_present_at(src)) {
    throw new Error(
      `Prebuilt pack at ${src} is incomplete (required tools missing).\n` +
        `Refresh the tree or run PROMETHEUS_LEGACY_STAGING=1 bun run stage-bins on this platform.`,
    );
  }
  const probe = path.join(src, lfs_probe_relative_path_for_kind(pack_kind_from_process()));
  assert_pack_binary_not_pointer(probe, "ffmpeg");

  clear_output_dir_preserving_readme();
  const names = readdirSync(src);
  for (const name of names) {
    if (name === ".prometheus-pack-ok") {
      continue;
    }
    const from = path.join(src, name);
    const to = path.join(out_dir, name);
    cpSync(from, to, { recursive: true });
  }
  apply_unix_exec_bits(out_dir);
  console.info(`[stage-bins] Synced prebuilt pack (${label}) → ${out_dir}`);
}

function extract_tar_gz_archive(archive_abs: string, dest_dir_abs: string): void {
  mkdirSync(dest_dir_abs, { recursive: true });
  run("tar", ["-xzf", archive_abs, "-C", dest_dir_abs]);
}

async function download_remote_pack_to_cache(
  platform_key: string,
  asset: { url: string; sha256: string },
  pack_version: number,
): Promise<string> {
  const dest_root = path.join(bundled_cli_root, ".cache", `${platform_key}-v${String(pack_version)}`);
  const marker = path.join(dest_root, ".prometheus-pack-ok");
  const want_hash = asset.sha256.toLowerCase();
  if (existsSync(marker) && existsSync(dest_root)) {
    try {
      const prev = readFileSync(marker, "utf8").trim();
      if (prev === want_hash && required_staged_paths_present_at(dest_root)) {
        console.info(`[stage-bins] Using cached pack ${dest_root}`);
        return dest_root;
      }
    } catch {
      /* re-download */
    }
  }
  rmSync(dest_root, { recursive: true, force: true });
  mkdirSync(path.join(bundled_cli_root, ".cache"), { recursive: true });
  const archive = path.join(bundled_cli_root, ".cache", `_download-${platform_key}-${String(pack_version)}.tar.gz`);
  await fetch_verified(asset.url, archive, want_hash);
  mkdirSync(dest_root, { recursive: true });
  extract_tar_gz_archive(path.resolve(archive), path.resolve(dest_root));
  rmSync(archive, { force: true });
  writeFileSync(marker, `${want_hash}\n`);
  return dest_root;
}

function sync_already_current(): boolean {
  const marker_path = path.join(out_dir, marker_file);
  const fp_path = path.join(out_dir, fingerprint_file);
  if (!existsSync(marker_path) || !existsSync(fp_path)) {
    return false;
  }
  let got: string;
  try {
    got = readFileSync(fp_path, "utf8").trim();
  } catch {
    return false;
  }
  const expected = got.startsWith("legacy-")
    ? expected_legacy_fingerprint()
    : expected_prebuilt_fingerprint();
  if (got !== expected) {
    return false;
  }
  return required_staged_paths_present();
}

async function stage_legacy_downloads(): Promise<void> {
  console.info(`[stage-bins] PROMETHEUS_LEGACY_STAGING=1 — downloading upstream CLIs into ${out_dir}`);
  clear_output_dir_preserving_readme();
  await stage_ffmpeg_ffprobe();
  await stage_yt_dlp();
  await stage_qpdf();
  await stage_ghostscript();
  await stage_imagemagick();
  if (process.platform === "darwin") {
    stage_macos_merge_keg_dylibs_into_gs_im_libs();
  }
}

async function fetch_to_file(url: string, dest: string): Promise<void> {
  const response = await fetch(url, { redirect: "follow" });
  if (!response.ok) {
    throw new Error(`Download failed ${String(response.status)}: ${url}`);
  }
  const buf = Buffer.from(await response.arrayBuffer());
  mkdirSync(path.dirname(dest), { recursive: true });
  writeFileSync(dest, buf);
}

async function fetch_verified(url: string, dest: string, expected_sha256: string): Promise<void> {
  await fetch_to_file(url, dest);
  const got = sha256_file(dest);
  if (got !== expected_sha256) {
    throw new Error(`SHA256 mismatch for ${url}\nexpected ${expected_sha256}\n     got ${got}`);
  }
}

function run(cmd: string, args: string[], cwd?: string): void {
  console.log(`[stage-bins] Running: ${cmd} ${args.join(" ")}`);
  const r = spawnSync(cmd, args, { stdio: "inherit", cwd, shell: false });
  const code = spawn_sync_exit_code(r);
  if (code !== 0) {
    throw new Error(`${cmd} ${args.join(" ")} failed with code ${String(code ?? "unknown")}`);
  }
}

/** Escape for PowerShell single-quoted strings. */
function powershell_escape_single_quoted(s: string): string {
  return s.replace(/'/g, "''");
}

/**
 * PowerShell to use for Expand-Archive on Windows: PS 7 first (reliable module), then 5.1.
 * Set `PROMETHEUS_PWSH` to a full path if discovery fails (e.g. non-default install).
 */
function resolve_windows_powershell_for_expand(): string {
  const from_env = process.env.PROMETHEUS_PWSH?.trim();
  if (from_env && existsSync(from_env)) {
    return from_env;
  }
  const pf = process.env["ProgramFiles"] || "C:\\Program Files";
  for (const p of [
    path.join(pf, "PowerShell", "7", "pwsh.exe"),
    path.join(pf, "PowerShell", "7-preview", "pwsh.exe"),
  ]) {
    if (existsSync(p)) {
      return p;
    }
  }
  const where_exe = path.join(process.env.SystemRoot || "C:\\Windows", "System32", "where.exe");
  const w = spawnSync(where_exe, ["pwsh"], { encoding: "utf8", shell: false });
  if (spawn_sync_exit_code(w) === 0 && w.stdout?.trim()) {
    const first = w.stdout
      .trim()
      .split(/\r?\n/)
      .map((line) => line.trim())
      .find((line) => line.length > 0);
    if (first !== undefined && existsSync(first)) {
      return first;
    }
  }
  return "powershell.exe";
}

/** Extract a .zip on Windows: 7-Zip first; fallback pwsh Expand-Archive, then powershell.exe (no Git Bash / MSYS). */
function run_windows_expand_archive(archive: string, dest_dir: string, step_label: string): void {
  const zip = path.win32.resolve(archive);
  const dest = path.win32.resolve(dest_dir);
  mkdirSync(dest, { recursive: true });

  try {
    console.log(`[stage-bins] ${step_label}: 7-Zip extract → ${dest}`);
    windows_7z_extract_zip_sync(zip, dest);
    return;
  } catch (first) {
    console.warn(
      `[stage-bins] ${step_label}: 7-Zip failed (${first instanceof Error ? first.message : String(first)}); retrying Expand-Archive`,
    );
  }

  const cmd = [
    "$ErrorActionPreference = 'Stop'",
    `Expand-Archive -LiteralPath '${powershell_escape_single_quoted(zip)}' -DestinationPath '${powershell_escape_single_quoted(dest)}' -Force`,
  ].join("; ");

  const try_expand = (ps_exe: string): ReturnType<typeof spawnSync> =>
    spawnSync(ps_exe, ["-NoProfile", "-NonInteractive", "-Command", cmd], {
      stdio: "inherit",
      shell: false,
    });

  const preferred = resolve_windows_powershell_for_expand();
  console.log(`[stage-bins] ${step_label}: Expand-Archive → ${dest} (via ${preferred})`);
  let r = try_expand(preferred);
  if (r.error) {
    throw new Error(`${step_label}: failed to spawn ${preferred}: ${r.error.message}`);
  }
  if (spawn_sync_exit_code(r) !== 0 && path.basename(preferred).toLowerCase() !== "powershell.exe") {
    console.warn(`[stage-bins] ${step_label}: ${path.basename(preferred)} failed; retrying with powershell.exe`);
    r = try_expand("powershell.exe");
  }
  if (spawn_sync_exit_code(r) === 0) {
    return;
  }

  throw new Error(
    `${step_label}: 7-Zip and Expand-Archive both failed (last exit ${String(spawn_sync_exit_code(r) ?? "unknown")}). ` +
      "Install 7-Zip, PowerShell 7 (pwsh), or repair Microsoft.PowerShell.Archive. " +
      "Optional: PROMETHEUS_7Z, PROMETHEUS_PWSH.",
  );
}

function spawn_sync_exit_code(r: ReturnType<typeof spawnSync>): number | null | undefined {
  if (typeof r.status === "number") {
    return r.status;
  }
  const alt = r as { exitCode?: number | null };
  if (typeof alt.exitCode === "number") {
    return alt.exitCode;
  }
  if (alt.exitCode === null) {
    return null;
  }
  return undefined;
}

async function btb_n_ffmpeg_digest(asset: string): Promise<string> {
  const url = "https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/checksums.sha256";
  const response = await fetch(url);
  if (!response.ok) {
    throw new Error(`Failed to fetch BtbN checksums: ${String(response.status)}`);
  }
  const text = await response.text();
  const line = text.split(/\r?\n/).find((l) => l.trim().endsWith(asset));
  if (!line) {
    throw new Error(`No checksum line for ${asset} in BtbN checksums.sha256`);
  }
  const hash = line.trim().split(/\s+/)[0];
  if (hash === undefined || !/^[a-f0-9]{64}$/i.test(hash)) {
    throw new Error(`Bad checksum parse for ${asset}: ${line}`);
  }
  return hash.toLowerCase();
}

async function stage_ffmpeg_ffprobe(): Promise<void> {
  if (process.platform === "darwin") {
    const ffmpeg_zip = path.join(out_dir, "_ffmpeg_mac.zip");
    const ffprobe_zip = path.join(out_dir, "_ffprobe_mac.zip");
    await fetch_verified(EVERMEET_FFMPEG_URL, ffmpeg_zip, EVERMEET_FFMPEG_SHA256);
    await fetch_verified(EVERMEET_FFPROBE_URL, ffprobe_zip, EVERMEET_FFPROBE_SHA256);
    const tmp_ffmpeg = mkdtempSync(path.join(tmpdir(), "prometheus-ff-"));
    const tmp_ffprobe = mkdtempSync(path.join(tmpdir(), "prometheus-fb-"));
    run("unzip", ["-o", "-q", ffmpeg_zip, "-d", tmp_ffmpeg]);
    run("unzip", ["-o", "-q", ffprobe_zip, "-d", tmp_ffprobe]);
    const ffmpeg_src = path.join(tmp_ffmpeg, "ffmpeg");
    const ffprobe_src = path.join(tmp_ffprobe, "ffprobe");
    if (!existsSync(ffmpeg_src) || !existsSync(ffprobe_src)) {
      throw new Error("evermeet zip missing ffmpeg or ffprobe at archive root");
    }
    copyFileSync(ffmpeg_src, path.join(out_dir, "ffmpeg"));
    copyFileSync(ffprobe_src, path.join(out_dir, "ffprobe"));
    chmodSync(path.join(out_dir, "ffmpeg"), 0o755);
    chmodSync(path.join(out_dir, "ffprobe"), 0o755);
    rmSync(ffmpeg_zip);
    rmSync(ffprobe_zip);
    rmSync(tmp_ffmpeg, { recursive: true });
    rmSync(tmp_ffprobe, { recursive: true });
    return;
  }

  const win_asset = "ffmpeg-n7.1-latest-win64-gpl-7.1.zip";
  const linux_asset = "ffmpeg-n7.1-latest-linux64-gpl-7.1.tar.xz";
  const asset = process.platform === "win32" ? win_asset : linux_asset;
  const digest = await btb_n_ffmpeg_digest(asset);
  const url = `https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/${asset}`;
  const archive = path.join(out_dir, `_${asset}`);
  await fetch_verified(url, archive, digest);

  const tmp = mkdtempSync(path.join(tmpdir(), "prometheus-ff-"));
  if (asset.endsWith(".zip")) {
    if (process.platform === "win32") {
      run_windows_expand_archive(archive, tmp, "FFmpeg zip extract");
    } else {
      run("unzip", ["-o", "-q", archive, "-d", tmp]);
    }
  } else {
    run("tar", ["-xf", archive, "-C", tmp]);
  }
  const entries = readdirSync(tmp);
  const root = entries.length === 1 ? path.join(tmp, entries[0]!) : tmp;
  const bin_dir = path.join(root, "bin");
  const ffmpeg_src = path.join(bin_dir, process.platform === "win32" ? "ffmpeg.exe" : "ffmpeg");
  const ffprobe_src = path.join(bin_dir, process.platform === "win32" ? "ffprobe.exe" : "ffprobe");
  if (!existsSync(ffmpeg_src) || !existsSync(ffprobe_src)) {
    throw new Error(`FFmpeg extract layout unexpected under ${bin_dir}`);
  }
  const dest_ff = path.join(out_dir, process.platform === "win32" ? "ffmpeg.exe" : "ffmpeg");
  const dest_fb = path.join(out_dir, process.platform === "win32" ? "ffprobe.exe" : "ffprobe");
  copyFileSync(ffmpeg_src, dest_ff);
  copyFileSync(ffprobe_src, dest_fb);
  if (process.platform !== "win32") {
    chmodSync(dest_ff, 0o755);
    chmodSync(dest_fb, 0o755);
  }
  rmSync(archive);
  rmSync(tmp, { recursive: true });
}

async function stage_yt_dlp(): Promise<void> {
  const lock = read_yt_dlp_lock(project_root);
  const pk = host_platform_key();
  const spec = yt_dlp_entry_for_host_platform_key(lock, pk);
  const url = `https://github.com/yt-dlp/yt-dlp/releases/download/${lock.tag}/${spec.release_asset_name}`;
  const dest = path.join(out_dir, spec.pack_relative_path);
  await fetch_verified(url, dest, spec.sha256);
  if (process.platform !== "win32") {
    chmodSync(dest, 0o755);
  }
}

async function stage_qpdf(): Promise<void> {
  if (process.platform === "darwin") {
    stage_macos_homebrew_bottle_qpdf_with_libs();
    /** libqpdf links to Homebrew openssl (@@HOMEBREW_PREFIX@@); ship those dylibs next to qpdf. */
    stage_macos_merge_formula_lib_into_destinations("openssl@3", [path.join(out_dir, "qpdf-lib")]);
    return;
  }
  if (process.platform === "linux") {
    const z = path.join(out_dir, "_qpdf.zip");
    await fetch_verified(QPDF_LINUX_ZIP, z, QPDF_LINUX_SHA256);
    const tmp = mkdtempSync(path.join(tmpdir(), "prometheus-qpdf-"));
    run("unzip", ["-o", "-q", z, "-d", tmp]);
    const bin = path.join(tmp, "bin", "qpdf");
    if (!existsSync(bin)) {
      throw new Error("qpdf linux zip missing bin/qpdf");
    }
    copyFileSync(bin, path.join(out_dir, "qpdf"));
    chmodSync(path.join(out_dir, "qpdf"), 0o755);
    const lib_src = path.join(tmp, "lib");
    const lib_dest = path.join(out_dir, "qpdf-lib");
    if (existsSync(lib_src)) {
      rmSync(lib_dest, { recursive: true, force: true });
      /** Follow symlinks so `libqpdf.so.30` is a real file in the bundle (Electrobun copy / loaders). */
      cpSync(lib_src, lib_dest, { recursive: true, dereference: true });
    } else {
      throw new Error("qpdf linux zip missing lib/ (libqpdf.so required at runtime)");
    }
    rmSync(z);
    rmSync(tmp, { recursive: true });
    return;
  }
  const z = path.join(out_dir, "_qpdf.zip");
  await fetch_verified(QPDF_WIN_ZIP, z, QPDF_WIN_SHA256);
  const tmp = mkdtempSync(path.join(tmpdir(), "prometheus-qpdf-"));
  run_windows_expand_archive(z, tmp, "qpdf zip extract");
  const bin_src = path.join(tmp, `qpdf-${QPDF_VERSION}-mingw64`, "bin");
  if (!existsSync(path.join(bin_src, "qpdf.exe"))) {
    throw new Error(`qpdf windows zip missing ${bin_src}/qpdf.exe`);
  }
  const dest_bin = path.join(out_dir, "qpdf-mingw64-bin");
  rmSync(dest_bin, { recursive: true, force: true });
  cpSync(bin_src, dest_bin, { recursive: true });
  rmSync(z);
  rmSync(tmp, { recursive: true });
}

/**
 * Uses local Homebrew to fetch a bottle tarball and copies one binary out (macOS only).
 */
function stage_macos_homebrew_bottle_prefix(formula: string, dest_subdir: string): void {
  const bottle_path = macos_resolve_latest_bottle_tarball(formula);
  const tmp = mkdtempSync(path.join(tmpdir(), `prometheus-${formula}-prefix-`));
  try {
    run("tar", ["-xzf", bottle_path, "-C", tmp]);
    const formula_root = path.join(tmp, formula);
    if (!existsSync(formula_root)) {
      throw new Error(`Bottle extract missing ${formula}/ (formula root)`);
    }
    const versions = readdirSync(formula_root);
    if (versions.length < 1) {
      throw new Error(`Empty version list for ${formula} bottle`);
    }
    const prefix = path.join(formula_root, versions[0]!);
    const dest = path.join(out_dir, dest_subdir);
    rmSync(dest, { recursive: true, force: true });
    cpSync(prefix, dest, { recursive: true });
  } finally {
    rmSync(tmp, { recursive: true, force: true });
  }
}

function macos_resolve_latest_bottle_tarball(formula: string): string {
  const brew = spawnSync("which", ["brew"], { encoding: "utf8" });
  if (brew.status !== 0 || !brew.stdout.trim()) {
    throw new Error(`Homebrew is required on macOS to stage ${formula}.`);
  }
  run("brew", ["fetch", "--force-bottle", formula]);
  const cache_r = spawnSync("brew", ["--cache"], { encoding: "utf8" });
  if (cache_r.status !== 0) {
    throw new Error("brew --cache failed");
  }
  const cache = cache_r.stdout.trim();
  const downloads_dir = path.join(cache, "downloads");
  const names = readdirSync(downloads_dir);
  const needle = `--${formula}-`;
  const bottles = names
    .filter((n) => n.includes(needle) && n.endsWith(".tar.gz"))
    .map((n) => ({ n, t: stat_mtime(path.join(downloads_dir, n)) }))
    .sort((a, b) => b.t - a.t);
  const bottle = bottles[0]?.n;
  if (!bottle) {
    throw new Error(`No Homebrew bottle tarball found for ${formula}`);
  }
  return path.join(downloads_dir, bottle);
}

/**
 * qpdf binary plus libqpdf dylibs for a relocatable bundle (dyld / @rpath).
 */
function stage_macos_homebrew_bottle_qpdf_with_libs(): void {
  const bottle_path = macos_resolve_latest_bottle_tarball("qpdf");
  const tmp = mkdtempSync(path.join(tmpdir(), "prometheus-qpdf-prefix-"));
  try {
    run("tar", ["-xzf", bottle_path, "-C", tmp]);
    const formula_root = path.join(tmp, "qpdf");
    if (!existsSync(formula_root)) {
      throw new Error("Bottle extract missing qpdf/ (formula root)");
    }
    const versions = readdirSync(formula_root);
    if (versions.length < 1) {
      throw new Error("Empty version list for qpdf bottle");
    }
    const prefix = path.join(formula_root, versions[0]!);
    const bin_src = path.join(prefix, "bin", "qpdf");
    if (!existsSync(bin_src)) {
      throw new Error("qpdf bottle missing bin/qpdf");
    }
    const dest_bin = path.join(out_dir, "qpdf");
    copyFileSync(bin_src, dest_bin);
    chmodSync(dest_bin, 0o755);
    const lib_src = path.join(prefix, "lib");
    const lib_dest = path.join(out_dir, "qpdf-lib");
    if (!existsSync(lib_src)) {
      throw new Error("qpdf bottle missing lib/ (libqpdf dylibs required at runtime)");
    }
    rmSync(lib_dest, { recursive: true, force: true });
    cpSync(lib_src, lib_dest, { recursive: true, dereference: true });
  } finally {
    rmSync(tmp, { recursive: true, force: true });
  }
}

/**
 * Copy dylibs from jbig2dec / little-cms2 bottles into Ghostscript and ImageMagick lib folders.
 * See MACOS_GS_IM_KEG_DEPENDENCY_FORMULAS.
 */
function stage_macos_merge_keg_dylibs_into_gs_im_libs(): void {
  const gs_lib = path.join(out_dir, "ghostscript", "lib");
  const im_lib = path.join(out_dir, "imagemagick", "lib");
  for (const formula of MACOS_GS_IM_KEG_DEPENDENCY_FORMULAS) {
    stage_macos_merge_formula_lib_into_destinations(formula, [gs_lib, im_lib]);
  }
}

function stage_macos_merge_formula_lib_into_destinations(formula: string, dest_libs: string[]): void {
  const bottle_path = macos_resolve_latest_bottle_tarball(formula);
  const tmp = mkdtempSync(path.join(tmpdir(), `prometheus-merge-${formula}-`));
  try {
    run("tar", ["-xzf", bottle_path, "-C", tmp]);
    const formula_root = path.join(tmp, formula);
    if (!existsSync(formula_root)) {
      console.warn(`[stage-bins] macOS merge: ${formula} bottle missing ${formula}/ root`);
      return;
    }
    const versions = readdirSync(formula_root);
    if (versions.length < 1) {
      return;
    }
    const prefix = path.join(formula_root, versions[0]!);
    const src_lib = path.join(prefix, "lib");
    if (!existsSync(src_lib)) {
      console.warn(`[stage-bins] macOS merge: ${formula} has no lib/`);
      return;
    }
    const names = readdirSync(src_lib);
    for (const dest_lib of dest_libs) {
      mkdirSync(dest_lib, { recursive: true });
    }
    const copy_dylib_files = (): void => {
      for (const dest_lib of dest_libs) {
        for (const name of names) {
          const from = path.join(src_lib, name);
          let st: ReturnType<typeof lstatSync>;
          try {
            st = lstatSync(from);
          } catch {
            continue;
          }
          if (!st.isFile()) {
            continue;
          }
          if (!name.includes(".dylib")) {
            continue;
          }
          const to = path.join(dest_lib, name);
          if (existsSync(to)) {
            continue;
          }
          copyFileSync(from, to);
        }
      }
    };
    const copy_dylib_symlinks = (): void => {
      for (const dest_lib of dest_libs) {
        for (const name of names) {
          const from = path.join(src_lib, name);
          let st: ReturnType<typeof lstatSync>;
          try {
            st = lstatSync(from);
          } catch {
            continue;
          }
          if (!st.isSymbolicLink()) {
            continue;
          }
          if (!name.includes(".dylib")) {
            continue;
          }
          const to = path.join(dest_lib, name);
          if (existsSync(to)) {
            continue;
          }
          symlinkSync(readlinkSync(from), to);
        }
      }
    };
    copy_dylib_files();
    copy_dylib_symlinks();
    console.log(`[stage-bins] macOS merge: ${formula} dylibs → ghostscript/lib + imagemagick/lib`);
  } finally {
    rmSync(tmp, { recursive: true, force: true });
  }
}

function stat_mtime(p: string): number {
  try {
    return statSync(p).mtimeMs;
  } catch {
    return 0;
  }
}

function find_file_by_basename(root: string, base: string): string | null {
  const stack = [root];
  while (stack.length > 0) {
    const dir = stack.pop()!;
    let entries: { name: string; isDirectory: () => boolean }[];
    try {
      entries = readdirSync(dir, { withFileTypes: true });
    } catch {
      continue;
    }
    for (const e of entries) {
      const full = path.join(dir, e.name);
      if (e.isDirectory()) {
        stack.push(full);
      } else if (e.name === base) {
        return full;
      }
    }
  }
  return null;
}

function path_is_inside(parent_resolved: string, child_resolved: string): boolean {
  if (child_resolved === parent_resolved) {
    return true;
  }
  const prefix = parent_resolved.endsWith(path.sep) ? parent_resolved : parent_resolved + path.sep;
  return child_resolved.startsWith(prefix);
}

/**
 * Debian ghostscript trees include symlinks to /usr/... that exist on the staging host but must
 * not ship (and Electrobun's copy can still hit ENOENT on odd doc symlinks). Remove any symlink
 * whose target does not resolve inside this tree, plus dangling links.
 */
function remove_unbundlable_symlinks_under(tree_root: string): void {
  const root_resolved = path.resolve(tree_root);
  const walk = (dir: string): void => {
    let entries: import("node:fs").Dirent[];
    try {
      entries = readdirSync(dir, { withFileTypes: true });
    } catch {
      return;
    }
    for (const e of entries) {
      const full = path.join(dir, e.name);
      if (e.isSymbolicLink()) {
        let target: string;
        try {
          target = readlinkSync(full);
        } catch {
          try {
            unlinkSync(full);
          } catch {
            /* ignore */
          }
          continue;
        }
        const resolved = path.resolve(path.dirname(full), target);
        const inside = path_is_inside(root_resolved, resolved);
        let keep = false;
        if (inside) {
          try {
            statSync(resolved);
            keep = true;
          } catch {
            keep = false;
          }
        }
        if (!keep) {
          try {
            unlinkSync(full);
          } catch {
            /* ignore */
          }
        }
        continue;
      }
      if (e.isDirectory()) {
        walk(full);
      }
    }
  };
  walk(tree_root);
}

function stage_linux_ghostscript_runtime(): void {
  const work = mkdtempSync(path.join(tmpdir(), "prometheus-gs-"));
  try {
    run("bash", [
      "-lc",
      `set -euo pipefail
cd "${work}"
apt-get download -q ghostscript libgs10 libgs10-common 2>/dev/null || apt-get download -q ghostscript
mkdir -p merged
for deb in *.deb; do
  dpkg-deb -x "$deb" merged
done
`,
    ]);
    const dest = path.join(out_dir, "ghostscript-runtime");
    rmSync(dest, { recursive: true, force: true });
    if (!existsSync(path.join(work, "merged", "usr", "bin", "gs"))) {
      throw new Error("apt-get download ghostscript did not produce usr/bin/gs (need Debian/Ubuntu with apt)");
    }
    cpSync(path.join(work, "merged", "usr"), path.join(dest, "usr"), { recursive: true });
    const doc_dir = path.join(dest, "usr", "share", "doc");
    if (existsSync(doc_dir)) {
      rmSync(doc_dir, { recursive: true, force: true });
    }
    remove_unbundlable_symlinks_under(dest);
    copyFileSync(path.join(dest, "usr", "bin", "gs"), path.join(out_dir, "gs"));
    chmodSync(path.join(out_dir, "gs"), 0o755);
  } finally {
    rmSync(work, { recursive: true, force: true });
  }
}

async function stage_linux_imagemagick_appimage(): Promise<void> {
  const ai = path.join(out_dir, "_im.AppImage");
  await fetch_verified(IM_LINUX_APPIMAGE, ai, IM_LINUX_APPIMAGE_SHA256);
  chmodSync(ai, 0o755);
  const tmp = mkdtempSync(path.join(tmpdir(), "prometheus-im-"));
  try {
    run(ai, ["--appimage-extract"], tmp);
    const root = path.join(tmp, "squashfs-root");
    const magick = path.join(root, "usr", "bin", "magick");
    if (!existsSync(magick)) {
      throw new Error("AppImage extract missing squashfs-root/usr/bin/magick");
    }
    const dest_rt = path.join(out_dir, "imagemagick");
    rmSync(dest_rt, { recursive: true, force: true });
    cpSync(path.join(root, "usr"), path.join(dest_rt, "usr"), { recursive: true });
    const im_doc = path.join(dest_rt, "usr", "share", "doc");
    if (existsSync(im_doc)) {
      rmSync(im_doc, { recursive: true, force: true });
    }
    const im_man = path.join(dest_rt, "usr", "share", "man");
    if (existsSync(im_man)) {
      rmSync(im_man, { recursive: true, force: true });
    }
    remove_unbundlable_symlinks_under(dest_rt);
  } finally {
    rmSync(ai, { force: true });
    rmSync(tmp, { recursive: true, force: true });
  }
}

async function stage_windows_ghostscript(): Promise<void> {
  const seven = windows_resolve_7z_exe();
  const installer = path.join(tmpdir(), `prometheus-gs-inst-${String(process.pid)}-${String(Date.now())}.exe`);
  await fetch_verified(GS_WIN_INSTALLER, installer, GS_WIN_SHA256);
  const tmp = mkdtempSync(path.join(tmpdir(), "prometheus-gs-"));
  const o_flag = windows_7z_output_dir_flag(tmp);
  try {
    console.log(
      "[stage-bins] Ghostscript: extracting Inno installer with 7-Zip (no GUI — avoids uninstall/reinstall prompts and /DIR= issues)",
    );
    const r = spawnSync(seven, ["x", "-y", o_flag, installer], { stdio: "inherit", shell: false });
    if (spawn_sync_exit_code(r) !== 0) {
      throw new Error(
        `Ghostscript: 7-Zip extract failed (exit ${String(spawn_sync_exit_code(r) ?? "unknown")}).`,
      );
    }
    const gsw = find_file_by_basename(tmp, "gswin64c.exe");
    if (!gsw) {
      throw new Error(
        "gswin64c.exe not found after 7-Zip extract of the Ghostscript installer. Update 7-Zip or report an issue.",
      );
    }
    const bin_dir = path.dirname(gsw);
    const dest_rt = path.join(out_dir, "ghostscript-win");
    rmSync(dest_rt, { recursive: true, force: true });
    cpSync(bin_dir, dest_rt, { recursive: true });
    console.log(`[stage-bins] Ghostscript: copied bin directory → ${dest_rt}`);
  } finally {
    try {
      rmSync(installer, { force: true });
    } catch {
      /* ignore */
    }
    try {
      rmSync(tmp, { recursive: true, force: true });
    } catch {
      /* ignore */
    }
  }
}

async function stage_windows_imagemagick(): Promise<void> {
  const seven = windows_resolve_7z_exe();
  const archive = path.join(out_dir, "_im.7z");
  await fetch_verified(IM_WIN_7Z, archive, IM_WIN_7Z_SHA256);
  const tmp = mkdtempSync(path.join(tmpdir(), "prometheus-im-"));
  const o_flag = windows_7z_output_dir_flag(tmp);
  console.log(`[stage-bins] ImageMagick: extracting with 7-Zip → ${tmp}`);
  const r = spawnSync(seven, ["x", "-y", o_flag, archive], { stdio: "inherit", shell: false });
  if (spawn_sync_exit_code(r) !== 0) {
    throw new Error(`ImageMagick 7z extract failed with code ${String(spawn_sync_exit_code(r) ?? "unknown")}`);
  }
  const magick = find_file_by_basename(tmp, "magick.exe");
  if (!magick) {
    throw new Error("magick.exe not found in ImageMagick portable 7z");
  }
  const portable_root = path.dirname(magick);
  const dest_rt = path.join(out_dir, "imagemagick-win");
  rmSync(dest_rt, { recursive: true, force: true });
  cpSync(portable_root, dest_rt, { recursive: true });
  rmSync(archive, { force: true });
  rmSync(tmp, { recursive: true, force: true });
}

async function stage_ghostscript(): Promise<void> {
  if (process.platform === "darwin") {
    stage_macos_homebrew_bottle_prefix("ghostscript", "ghostscript");
    return;
  }
  if (process.platform === "linux") {
    stage_linux_ghostscript_runtime();
    return;
  }
  await stage_windows_ghostscript();
}

async function stage_imagemagick(): Promise<void> {
  if (process.platform === "darwin") {
    stage_macos_homebrew_bottle_prefix("imagemagick", "imagemagick");
    return;
  }
  if (process.platform === "linux") {
    await stage_linux_imagemagick_appimage();
    return;
  }
  await stage_windows_imagemagick();
}

function write_licenses_readme(): void {
  const dir = path.join(out_dir, "licenses");
  mkdirSync(dir, { recursive: true });
  const text = `Third-party CLI binaries (prebuilt under resources/bundled-cli/ or legacy staging in scripts/stage-bundled-bins.ts):

- FFmpeg (GPL): https://ffmpeg.org/legal.html
- yt-dlp (Unlicense): https://github.com/yt-dlp/yt-dlp
- qpdf (Apache-2.0): https://github.com/qpdf/qpdf
- Ghostscript (AGPL): https://www.ghostscript.com/licensing/index.html
- ImageMagick (ImageMagick License): https://imagemagick.org/script/license.php
`;
  writeFileSync(path.join(dir, "README.txt"), text);
}

async function main(): Promise<void> {
  if (process.env.PROMETHEUS_SKIP_STAGE_BINS === "1") {
    console.info("[stage-bins] PROMETHEUS_SKIP_STAGE_BINS=1 — skipping.");
    return;
  }
  mkdirSync(out_dir, { recursive: true });
  mkdirSync(bundled_cli_root, { recursive: true });

  if (sync_already_current()) {
    console.info("[stage-bins] resources/bin already matches current fingerprint — skipping.");
    return;
  }
  rmSync(path.join(out_dir, marker_file), { force: true });
  rmSync(path.join(out_dir, fingerprint_file), { force: true });

  let use_legacy = process.env.PROMETHEUS_LEGACY_STAGING === "1";
  const pk = host_platform_key();
  const manifest = read_bundled_cli_manifest(project_root);
  const remote_asset = asset_for_platform(manifest, pk);
  const prebuilt_src = path.join(bundled_cli_root, pk);

  if (!use_legacy && remote_asset) {
    console.info(`[stage-bins] Downloading prebuilt pack for ${pk} from manifest assets`);
    const cache_root = await download_remote_pack_to_cache(pk, remote_asset, manifest.pack_version);
    sync_prebuilt_from_pack_dir(cache_root, `remote ${pk}`);
  } else if (
    !use_legacy &&
    existsSync(prebuilt_src) &&
    required_staged_paths_present_at(prebuilt_src)
  ) {
    console.info(`[stage-bins] Syncing prebuilt CLIs from ${prebuilt_src}`);
    sync_prebuilt_from_pack_dir(prebuilt_src, `local ${pk}`);
  } else if (!use_legacy) {
    if (process.env.GITHUB_ACTIONS === "true") {
      throw new Error(
        `Missing prebuilt CLI pack for ${pk}: set resources/bundled-cli/manifest.json assets (url+sha256), ` +
          `populate resources/bundled-cli/${pk}/ from legacy staging, or set PROMETHEUS_LEGACY_STAGING=1 on the workflow (slow on Windows).`,
      );
    }
    console.warn(
      `[stage-bins] No manifest URL or complete local pack at ${prebuilt_src}; using legacy download staging.`,
    );
    use_legacy = true;
  }

  if (use_legacy) {
    await stage_legacy_downloads();
  }

  write_licenses_readme();
  writeFileSync(path.join(out_dir, marker_file), "ok\n");
  writeFileSync(
    path.join(out_dir, fingerprint_file),
    `${use_legacy ? expected_legacy_fingerprint() : expected_prebuilt_fingerprint()}\n`,
  );
  console.info("[stage-bins] Done.");
}

void main().catch((error) => {
  console.error("[stage-bins] Failed:", error);
  process.exit(1);
});