@solaqua/gji 0.12.0 → 0.12.2

package/dist/dependency-bootstrap.js

@@ -1,13 +1,16 @@
 import { execFile } from "node:child_process";
-import { lstat, readFile, realpath, rm } from "node:fs/promises";
-import { join, relative, resolve, sep } from "node:path";
+import { constants } from "node:fs";
+import { lstat, open, readdir, readFile, realpath, rm } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep, } from "node:path";
 import { promisify } from "node:util";
-import { cloneFailureScope, defaultCloneFailureStore, } from "./clone-failure-store.js";
 import { runCommand } from "./command-runner.js";
-import { cloneDir, isCloneDestinationExistsError, isCloneInProgressError, isCloneUnsupportedError, } from "./dir-clone.js";
-import { pathExists } from "./fs-utils.js";
+import { cloneDir, isCloneDestinationExistsError, isCloneInProgressError, } from "./dir-clone.js";
+import { isNotFoundError, pathExists } from "./fs-utils.js";
 import { inspectDestination } from "./safe-destination.js";
 const execFileAsync = promisify(execFile);
+const UV_VALIDATION_MAX_ENTRIES = 10_000;
+const UV_VALIDATION_MAX_FILE_BYTES = 1024 * 1024;
+const UV_VALIDATION_MAX_TOTAL_BYTES = 16 * 1024 * 1024;
 export async function prepareDependencyBootstrap(mode, context) {
     if (mode === "off")
         return { mode, targets: [] };
@@ -26,7 +29,7 @@ export async function prepareDependencyBootstrap(mode, context) {
     for (const adapter of adapters) {
         if (plannedRelativePaths.has(adapter.relativePath))
             continue;
-        let fallback;
+        let firstDetected;
         let selected;
         for (const sourceRoot of sourceRoots) {
             const target = await adapter.detect({
@@ -37,14 +40,14 @@ export async function prepareDependencyBootstrap(mode, context) {
             if (!target)
                 continue;
             const seedable = mode !== "install-only" && (await adapter.canSeed(target));
-            const candidate = { adapter, target, seedable };
-            fallback ??= candidate;
+            const candidate = { target, seedable };
+            firstDetected ??= candidate;
             if (mode === "install-only" || seedable) {
                 selected = candidate;
                 break;
             }
         }
-        const plannedTarget = selected ?? fallback;
+        const plannedTarget = selected ?? firstDetected;
         if (plannedTarget) {
             targets.push(plannedTarget);
             plannedRelativePaths.add(adapter.relativePath);
@@ -58,9 +61,9 @@ export async function detectDependencyBootstrapCandidate(context) {
     if (!planned)
         return null;
     return {
-        adapter: planned.adapter.name,
-        kind: planned.adapter.kind,
-        lockfile: planned.adapter.lockfile,
+        adapter: planned.target.adapter,
+        kind: planned.target.kind,
+        lockfile: adapterForTarget(planned.target).lockfile,
         target: planned.target.relativePath,
         repairCommand: planned.target.repairCommand,
         seedable: planned.seedable,
@@ -69,10 +72,10 @@ export async function detectDependencyBootstrapCandidate(context) {
 export function previewDependencyBootstrap(plan) {
     return {
         mode: plan.mode,
-        targets: plan.targets.map(({ adapter, target, seedable }) => ({
-            adapter: adapter.output(target).adapter,
-            kind: adapter.kind,
-            target: adapter.output(target).target,
+        targets: plan.targets.map(({ target, seedable }) => ({
+            adapter: target.adapter,
+            kind: target.kind,
+            target: target.relativePath,
             repairCommand: target.repairCommand,
             seedable,
             strategy: bootstrapStrategy(plan.mode, target, seedable),
@@ -83,7 +86,6 @@ export async function executeDependencyBootstrap(plan, options) {
     if (plan.mode === "off")
         return { mode: plan.mode, ready: true, events: [] };
     const events = [];
-    const failureStore = options.failureStore ?? defaultCloneFailureStore;
     const cloneDirectory = options.cloneDirectory ?? cloneDir;
     const execution = {
         runCommand: options.runCommand ?? runCommand,
@@ -102,8 +104,9 @@ export async function executeDependencyBootstrap(plan, options) {
         });
         return { mode: plan.mode, ready: true, events };
     }
-    for (const { adapter, target, seedable } of plan.targets) {
-        await executeBootstrapTarget(adapter, target, seedable, plan.mode, cloneDirectory, failureStore, execution, seededDirectories.has(target.relativePath), events, options.reporter, options.repoRoot);
+    for (const { target, seedable } of plan.targets) {
+        const adapter = adapterForTarget(target);
+        await executeBootstrapTarget(adapter, target, seedable, plan.mode, cloneDirectory, execution, seededDirectories.has(target.relativePath), events, options.reporter);
     }
     return {
         mode: plan.mode,
@@ -111,25 +114,19 @@ export async function executeDependencyBootstrap(plan, options) {
         events,
     };
 }
-async function executeBootstrapTarget(adapter, target, seedable, mode, cloneDirectory, failureStore, execution, seededBySyncDirs, events, reporter, repoRoot) {
+async function executeBootstrapTarget(adapter, target, seedable, mode, cloneDirectory, execution, seededBySyncDirs, events, reporter) {
     const destinationInspection = await inspectDestination(target.worktreePath, target.targetPath);
     if (destinationInspection.kind === "unsafe") {
         recordBootstrapFailure(events, reporter, adapter, target, destinationInspection.reason, "destination-unsafe");
         return;
     }
     if (mode === "install-only") {
-        await repairTarget(adapter, target, execution, false, target.existingBeforeBootstrap ? "preserve" : "empty", events, reporter);
+        await repairTarget(adapter, target, execution, destinationInspection.kind === "exists" ? "preserve" : "clean", events, reporter);
         return;
     }
-    let seeded = false;
-    const failureScope = seedable
-        ? await cloneFailureScope(adapter.seedPath(target), target.targetPath)
-        : undefined;
-    let ownership = target.existingBeforeBootstrap
-        ? "preserve"
-        : "empty";
+    let input = destinationInspection.kind === "exists" ? "preserve" : "clean";
     const destinationExistsNow = destinationInspection.kind === "exists";
-    if (target.existingBeforeBootstrap) {
+    if (target.initialInput === "preserve" && destinationExistsNow) {
         recordBootstrapEvent(events, reporter, {
             adapter: adapter.name,
             kind: adapter.kind,
@@ -141,8 +138,7 @@ async function executeBootstrapTarget(adapter, target, seedable, mode, cloneDire
     }
     else if (seededBySyncDirs && destinationExistsNow) {
         if (seedable) {
-            seeded = true;
-            ownership = "syncDirs";
+            input = "seed";
             recordBootstrapEvent(events, reporter, {
                 adapter: adapter.name,
                 kind: adapter.kind,
@@ -153,19 +149,19 @@ async function executeBootstrapTarget(adapter, target, seedable, mode, cloneDire
             });
         }
         else {
-            ownership = "preserve";
+            input = "preserve";
             recordBootstrapEvent(events, reporter, {
                 adapter: adapter.name,
                 kind: adapter.kind,
                 reason: "generic-seed",
-                state: "fallback",
+                state: "repair-only",
                 target: target.relativePath,
                 message: "syncDirs created a generic target; this adapter uses repair without CoW",
             });
         }
     }
     else if (destinationExistsNow) {
-        ownership = "preserve";
+        input = "preserve";
         recordBootstrapEvent(events, reporter, {
             adapter: adapter.name,
             kind: adapter.kind,
@@ -175,26 +171,13 @@ async function executeBootstrapTarget(adapter, target, seedable, mode, cloneDire
             message: "target appeared during bootstrap; preserving it as the repair input",
         });
     }
-    else if (seedable &&
-        (await failureStore.isCached(repoRoot, target.relativePath, failureScope))) {
-        recordBootstrapEvent(events, reporter, {
-            adapter: adapter.name,
-            kind: adapter.kind,
-            reason: "cow-failure-cached",
-            state: "fallback",
-            target: target.relativePath,
-            message: "previous CoW failure is cached; repairing from an empty target",
-        });
-    }
     else if (seedable) {
         try {
             await cloneDirectory(adapter.seedPath(target), target.targetPath, {
                 destinationRoot: target.worktreePath,
                 measureBytes: reporter.measureCloneSize,
             });
-            await failureStore.clear(repoRoot, target.relativePath, failureScope);
-            seeded = true;
-            ownership = "adapter";
+            input = "seed";
             recordBootstrapEvent(events, reporter, {
                 adapter: adapter.name,
                 kind: adapter.kind,
@@ -205,7 +188,7 @@ async function executeBootstrapTarget(adapter, target, seedable, mode, cloneDire
         }
         catch (error) {
             if (isCloneDestinationExistsError(error)) {
-                ownership = "preserve";
+                input = "preserve";
                 recordBootstrapEvent(events, reporter, {
                     adapter: adapter.name,
                     kind: adapter.kind,
@@ -213,23 +196,27 @@ async function executeBootstrapTarget(adapter, target, seedable, mode, cloneDire
                     target: target.relativePath,
                     message: "target appeared during CoW seeding; preserving it as the repair input",
                 });
-                await repairTarget(adapter, target, execution, false, ownership, events, reporter);
+                await repairTarget(adapter, target, execution, input, events, reporter);
                 return;
             }
             if (isCloneInProgressError(error)) {
                 recordBootstrapFailure(events, reporter, adapter, target, `CoW seed is already in progress: ${toErrorMessage(error)}`, "clone-in-progress");
                 return;
             }
-            if (isCloneUnsupportedError(error)) {
-                await failureStore.cache(repoRoot, target.relativePath, toErrorMessage(error), failureScope);
+            const failedCloneInspection = await inspectDestination(target.worktreePath, target.targetPath);
+            if (failedCloneInspection.kind === "unsafe") {
+                recordBootstrapFailure(events, reporter, adapter, target, failedCloneInspection.reason, "destination-unsafe");
+                return;
             }
+            input = failedCloneInspection.kind === "exists" ? "preserve" : "clean";
+            const repairInput = input === "preserve" ? "the preserved target" : "an empty target";
             recordBootstrapEvent(events, reporter, {
                 adapter: adapter.name,
                 kind: adapter.kind,
-                reason: "cow-unsupported",
-                state: "fallback",
+                reason: "cow-seed-failed",
+                state: "repair-only",
                 target: target.relativePath,
-                message: `CoW seed failed; repairing from an empty target (${toErrorMessage(error)})`,
+                message: `CoW seed failed; repairing from ${repairInput} (${toErrorMessage(error)})`,
             });
         }
     }
@@ -238,37 +225,38 @@ async function executeBootstrapTarget(adapter, target, seedable, mode, cloneDire
             adapter: adapter.name,
             kind: adapter.kind,
             reason: "seed-unavailable",
-            state: "fallback",
+            state: "repair-only",
             target: target.relativePath,
             message: "CoW seed is unavailable; repairing from an empty target",
         });
     }
-    await repairTarget(adapter, target, execution, seeded, ownership, events, reporter);
+    await repairTarget(adapter, target, execution, input, events, reporter);
 }
-async function repairTarget(adapter, target, execution, seeded, ownership, events, reporter) {
+async function repairTarget(adapter, target, execution, input, events, reporter) {
     const beforeRepairInspection = await inspectDestination(target.worktreePath, target.targetPath);
     if (beforeRepairInspection.kind === "unsafe") {
         recordBootstrapFailure(events, reporter, adapter, target, beforeRepairInspection.reason, "destination-unsafe");
         return;
     }
-    const presentBeforeRepair = beforeRepairInspection.kind === "exists";
+    const effectiveInput = beforeRepairInspection.kind === "exists"
+        ? input === "seed"
+            ? "seed"
+            : "preserve"
+        : "clean";
     try {
-        await adapter.repair(target, execution);
+        await adapter.repair(target, { ...execution, input: effectiveInput });
         recordBootstrapEvent(events, reporter, {
             adapter: adapter.name,
             kind: adapter.kind,
             state: target.repairState,
             target: target.relativePath,
-            message: seeded
-                ? "reused and repaired"
-                : "installed or repaired from a clean target",
+            message: repairSuccessMessage(target, effectiveInput),
         });
     }
     catch (firstError) {
         const firstFailureContext = {
+            input: effectiveInput,
             target,
-            ownership,
-            targetExistedBeforeRepair: presentBeforeRepair,
         };
         const cleanupError = await adapter
             .cleanupAfterRepairFailure(firstFailureContext)
@@ -286,7 +274,7 @@ async function repairTarget(adapter, target, execution, seeded, ownership, event
             adapter: adapter.name,
             kind: adapter.kind,
             reason: "seed-repair-failed",
-            state: "fallback",
+            state: "repair-only",
             target: target.relativePath,
             message: `seed repair failed; removed the seed and retrying clean (${toErrorMessage(firstError)})`,
         });
@@ -295,24 +283,23 @@ async function repairTarget(adapter, target, execution, seeded, ownership, event
             recordBootstrapFailure(events, reporter, adapter, target, beforeRetryInspection.reason, "destination-unsafe");
             return;
         }
-        const presentBeforeRetry = beforeRetryInspection.kind === "exists";
+        const retryInput = beforeRetryInspection.kind === "exists" ? "preserve" : "clean";
         try {
-            await adapter.repair(target, execution);
+            await adapter.repair(target, { ...execution, input: retryInput });
             recordBootstrapEvent(events, reporter, {
                 adapter: adapter.name,
                 kind: adapter.kind,
                 reason: "repair-retry",
                 state: target.repairState,
                 target: target.relativePath,
-                message: "installed or repaired from a clean target",
+                message: repairSuccessMessage(target, retryInput),
             });
         }
         catch (secondError) {
             const cleanupError = await adapter
                 .cleanupAfterRepairFailure({
+                input: retryInput,
                 target,
-                ownership,
-                targetExistedBeforeRepair: presentBeforeRetry,
             })
                 .then(() => undefined)
                 .catch((error) => toErrorMessage(error));
@@ -320,6 +307,15 @@ async function repairTarget(adapter, target, execution, seeded, ownership, event
         }
     }
 }
+function repairSuccessMessage(target, input) {
+    if (input === "seed")
+        return "reused and repaired";
+    if (input === "preserve")
+        return "repaired the existing target";
+    return target.repairState === "installed"
+        ? "installed from a clean target"
+        : "repaired from a clean target";
+}
 function recordBootstrapFailure(events, reporter, adapter, target, message, reason) {
     recordBootstrapEvent(events, reporter, {
         adapter: adapter.name,
@@ -344,6 +340,12 @@ function bootstrapStrategy(mode, target, seedable) {
     }
     return seedable ? "cow-then-repair" : "repair-only";
 }
+function adapterForTarget(target) {
+    const adapter = createBootstrapAdapters(defaultCheckUvRuntime).find((candidate) => candidate.name === target.adapter);
+    if (!adapter)
+        throw new Error(`unsupported bootstrap adapter: ${target.adapter}`);
+    return adapter;
+}
 function createBootstrapAdapters(checkUvRuntime, cargoBuildCommand) {
     return [
         new LockfileBootstrapAdapter({
@@ -353,8 +355,8 @@ function createBootstrapAdapters(checkUvRuntime, cargoBuildCommand) {
             relativePath: "node_modules",
             repairCommand: "pnpm install --frozen-lockfile",
             shell: false,
-            beforeRepair: async (target) => {
-                if (!target.existingBeforeBootstrap) {
+            beforeRepair: async (target, context) => {
+                if (context.input === "seed") {
                     await rm(join(target.targetPath, ".modules.yaml"), {
                         force: true,
                     });
@@ -368,6 +370,13 @@ function createBootstrapAdapters(checkUvRuntime, cargoBuildCommand) {
             relativePath: "node_modules",
             repairCommand: "yarn install --immutable",
             shell: false,
+            beforeRepair: async (target, context) => {
+                if (context.input === "seed") {
+                    await rm(join(target.targetPath, ".yarn-state.yml"), {
+                        force: true,
+                    });
+                }
+            },
         }),
         new LockfileBootstrapAdapter({
             name: "npm",
@@ -377,7 +386,7 @@ function createBootstrapAdapters(checkUvRuntime, cargoBuildCommand) {
             repairCommand: "npm ci",
             shell: false,
             seedPolicy: "never",
-            repairCommandOverride: (target) => target.existingBeforeBootstrap ? "npm install" : "npm ci",
+            selectRepairCommand: (_target, input) => input === "preserve" ? "npm install" : "npm ci",
             repairState: "installed",
         }),
         new LockfileBootstrapAdapter({
@@ -390,6 +399,11 @@ function createBootstrapAdapters(checkUvRuntime, cargoBuildCommand) {
             commandOptions: () => ({
                 env: { BUNDLE_PATH: "vendor/bundle" },
             }),
+            beforeRepair: async (target, context) => {
+                if (context.input === "seed") {
+                    await removeBundlerExtensionMarkers(target.targetPath);
+                }
+            },
         }),
         new LockfileBootstrapAdapter({
             name: "uv",
@@ -399,6 +413,8 @@ function createBootstrapAdapters(checkUvRuntime, cargoBuildCommand) {
             repairCommand: "uv sync --locked",
             shell: false,
             canSeedOverride: checkUvRuntime,
+            beforeRepair: validateUvStructure,
+            afterRepair: validateUvRelocation,
         }),
         new LockfileBootstrapAdapter({
             name: "cargo",
@@ -406,7 +422,7 @@ function createBootstrapAdapters(checkUvRuntime, cargoBuildCommand) {
             lockfile: "Cargo.lock",
             relativePath: "target",
             repairCommand: cargoBuildCommand?.trim() || "cargo check",
-            shell: cargoBuildCommand ? undefined : false,
+            shell: Boolean(cargoBuildCommand),
         }),
     ];
 }
@@ -420,8 +436,9 @@ class LockfileBootstrapAdapter {
     seedPolicy;
     canSeedOverride;
     beforeRepair;
+    afterRepair;
     commandOptions;
-    repairCommandOverride;
+    selectRepairCommand;
     repairState;
     constructor(spec) {
         this.name = spec.name;
@@ -433,8 +450,9 @@ class LockfileBootstrapAdapter {
         this.seedPolicy = spec.seedPolicy ?? "always";
         this.canSeedOverride = spec.canSeedOverride;
         this.beforeRepair = spec.beforeRepair;
+        this.afterRepair = spec.afterRepair;
         this.commandOptions = spec.commandOptions;
-        this.repairCommandOverride = spec.repairCommandOverride;
+        this.selectRepairCommand = spec.selectRepairCommand;
         this.repairState = spec.repairState ?? "repaired";
     }
     async detect(context) {
@@ -444,6 +462,7 @@ class LockfileBootstrapAdapter {
         const sourcePath = join(context.sourceRoot, this.relativePath);
         const targetPath = join(context.worktreePath, this.relativePath);
         const destinationInspection = await inspectDestination(context.worktreePath, targetPath);
+        const initialInput = destinationInspection.kind === "exists" ? "preserve" : "clean";
         const target = {
             adapter: this.name,
             kind: this.kind,
@@ -454,22 +473,26 @@ class LockfileBootstrapAdapter {
             targetPath,
             repairCommand: this.defaultRepairCommand,
             repairState: this.repairState,
-            existingBeforeBootstrap: destinationInspection.kind === "exists",
+            shell: this.shell,
+            initialInput,
         };
         return {
             ...target,
-            repairCommand: this.repairCommandOverride?.(target) ?? target.repairCommand,
+            repairCommand: this.selectRepairCommand?.(target, initialInput) ??
+                target.repairCommand,
         };
     }
     seedPath(target) {
         return target.sourcePath;
     }
     async repair(target, context) {
-        await this.beforeRepair?.(target);
-        await context.runCommand(target.repairCommand, target.worktreePath, context.stderr, context.stdout, {
+        await this.beforeRepair?.(target, context);
+        const repairCommand = this.selectRepairCommand?.(target, context.input) ?? target.repairCommand;
+        await context.runCommand(repairCommand, target.worktreePath, context.stderr, context.stdout, {
             ...this.commandOptions?.(target),
-            shell: this.shell,
+            shell: target.shell,
         });
+        await this.afterRepair?.(target, context);
     }
     async canSeed(target) {
         if (this.seedPolicy === "never")
@@ -478,28 +501,13 @@ class LockfileBootstrapAdapter {
             return false;
         return (await this.canSeedOverride?.(target)) ?? true;
     }
-    output(target) {
-        return {
-            adapter: this.name,
-            kind: this.kind,
-            target: target.relativePath,
-            repairCommand: target.repairCommand,
-        };
-    }
     shouldRetryAfterRepairFailure(context) {
-        return context.ownership === "adapter" || context.ownership === "syncDirs";
+        return context.input === "seed";
     }
     async cleanupAfterRepairFailure(context) {
-        if (context.target.existingBeforeBootstrap) {
+        if (context.input !== "seed")
             return;
-        }
-        if (context.ownership === "adapter" || context.ownership === "syncDirs") {
-            await rm(context.target.targetPath, { force: true, recursive: true });
-            return;
-        }
-        if (context.ownership === "empty" && !context.targetExistedBeforeRepair) {
-            await rm(context.target.targetPath, { force: true, recursive: true });
-        }
+        await rm(context.target.targetPath, { force: true, recursive: true });
     }
 }
 async function safeSourceDirectory(target) {
@@ -518,24 +526,251 @@ async function safeSourceDirectory(target) {
 async function defaultCheckUvRuntime(target) {
     try {
         const config = await readFile(join(target.sourcePath, "pyvenv.cfg"), "utf8");
-        const expected = config.match(/^version\s*=\s*(\d+\.\d+)/mu)?.[1];
+        const expected = config.match(/^version(?:_info)?\s*=\s*(\d+\.\d+)/mu)?.[1];
         if (!expected)
             return false;
+        const expectedImplementation = config
+            .match(/^implementation\s*=\s*([^\s#]+)/imu)?.[1]
+            ?.toLowerCase();
         const sourceInterpreter = join(target.sourcePath, process.platform === "win32" ? "Scripts/python.exe" : "bin/python");
-        const fingerprintScript = "import platform, sys; print(f'{sys.version_info.major}.{sys.version_info.minor}|{platform.machine()}|{sys.implementation.cache_tag}')";
-        const [source, current] = await Promise.all([
-            execFileAsync(sourceInterpreter, ["-c", fingerprintScript]),
-            execFileAsync("python3", ["-c", fingerprintScript]),
+        const fingerprintScript = "import platform, sys; print(f'{sys.version_info.major}.{sys.version_info.minor}|{platform.machine()}|{sys.implementation.name}')";
+        const source = await execFileAsync(sourceInterpreter, [
+            "-c",
+            fingerprintScript,
         ]);
         const sourceFingerprint = source.stdout.trim();
-        const currentFingerprint = current.stdout.trim();
-        return (sourceFingerprint === currentFingerprint &&
-            sourceFingerprint.startsWith(`${expected}|`));
+        const [sourceVersion, sourceMachine, sourceImplementation, extra] = sourceFingerprint.split("|");
+        return (extra === undefined &&
+            sourceVersion === expected &&
+            Boolean(sourceMachine) &&
+            Boolean(sourceImplementation) &&
+            (expectedImplementation === undefined ||
+                sourceImplementation.toLowerCase() === expectedImplementation));
     }
     catch {
         return false;
     }
 }
+function virtualEnvironmentPrefixes(text) {
+    const prefixes = [];
+    for (const line of text.split(/\r?\n/u)) {
+        if (!/\bVIRTUAL_ENV\b/u.test(line))
+            continue;
+        const quotedAssignment = line.match(/\bVIRTUAL_ENV(?:\s*=|\s+)\s*(?:"([^"]+)"|'([^']+)')/u);
+        const quotedPrefix = quotedAssignment?.[1] ?? quotedAssignment?.[2];
+        if (quotedPrefix && isAbsolute(quotedPrefix))
+            prefixes.push(quotedPrefix);
+        const unquoted = line.match(/\bVIRTUAL_ENV(?:\s*=|\s+)\s*([^\s"']+)/u)?.[1];
+        if (unquoted && isAbsolute(unquoted))
+            prefixes.push(unquoted);
+    }
+    return uniquePaths(prefixes);
+}
+function pythonPrefixFromShebang(text) {
+    const command = text
+        .match(/^#!\s*([^\r\n]+)/u)?.[1]
+        ?.trim()
+        .split(/\s+/u)[0];
+    if (!command || !isAbsolute(command))
+        return undefined;
+    if (!/^python(?:\d+(?:\.\d+)?)?(?:\.exe)?$/iu.test(command.split(sep).at(-1) ?? "")) {
+        return undefined;
+    }
+    return dirname(dirname(command));
+}
+function pythonPrefixesFromText(text) {
+    const interpreters = [];
+    for (const match of text.matchAll(/["'](\/[^"']+)["']/gu)) {
+        if (match[1])
+            interpreters.push(match[1]);
+    }
+    for (const match of text.matchAll(/(?:^|\s)(\/[^\s"']+)/gmu)) {
+        if (match[1])
+            interpreters.push(match[1]);
+    }
+    return uniquePaths(interpreters.flatMap((interpreter) => {
+        const name = interpreter.split(sep).at(-1) ?? "";
+        return /^python(?:\d+(?:\.\d+)?)?(?:\.exe)?$/iu.test(name)
+            ? [dirname(dirname(interpreter))]
+            : [];
+    }));
+}
+async function validateUvRelocation(target, context) {
+    if (context.input === "preserve")
+        return;
+    const scriptsDirectory = join(target.targetPath, process.platform === "win32" ? "Scripts" : "bin");
+    const interpreter = join(scriptsDirectory, process.platform === "win32" ? "python.exe" : "python");
+    const { stdout } = await execFileAsync(interpreter, [
+        "-c",
+        "import os, sys; print(os.path.realpath(sys.prefix))",
+    ]);
+    const [actualPrefix, expectedPrefix] = await Promise.all([
+        realpath(stdout.trim()),
+        realpath(target.targetPath),
+    ]);
+    if (actualPrefix !== expectedPrefix) {
+        throw new Error(`uv environment still points to its source prefix: ${actualPrefix}`);
+    }
+    const sourcePaths = uniquePaths([
+        target.sourcePath,
+        await realpath(target.sourcePath).catch(() => undefined),
+    ]);
+    const entries = await readdir(scriptsDirectory, { withFileTypes: true });
+    assertSafeUvScriptEntries(entries);
+    const environmentName = basename(target.targetPath);
+    const acceptedPrefixes = new Set([
+        resolve(target.targetPath),
+        await realpath(target.targetPath),
+    ]);
+    let validatedBytes = 0;
+    for (const path of [
+        join(target.targetPath, "pyvenv.cfg"),
+        ...entries
+            .filter((entry) => entry.isFile())
+            .map((entry) => join(scriptsDirectory, entry.name)),
+    ]) {
+        const validated = await readBoundedUvTextFile(path, UV_VALIDATION_MAX_TOTAL_BYTES - validatedBytes);
+        if (!validated)
+            continue;
+        validatedBytes += validated.bytes;
+        if (validated.text === undefined)
+            continue;
+        const { text } = validated;
+        if (sourcePaths.some((sourcePath) => text.includes(sourcePath))) {
+            throw new Error(`uv environment contains a stale source path: ${path}`);
+        }
+        const shebangPrefix = pythonPrefixFromShebang(text);
+        if (shebangPrefix &&
+            basename(shebangPrefix) === environmentName &&
+            !acceptedPrefixes.has(resolve(shebangPrefix))) {
+            throw new Error(`uv launcher points outside its environment: ${path}`);
+        }
+        if (pythonPrefixesFromText(text)
+            .filter((prefix) => basename(prefix) === environmentName)
+            .some((prefix) => !acceptedPrefixes.has(resolve(prefix)))) {
+            throw new Error(`uv launcher points outside its environment: ${path}`);
+        }
+        if (virtualEnvironmentPrefixes(text).some((prefix) => !acceptedPrefixes.has(resolve(prefix)))) {
+            throw new Error(`uv activation script points outside its environment: ${path}`);
+        }
+    }
+}
+async function validateUvStructure(target, context) {
+    if (context.input === "preserve")
+        return;
+    const targetStats = await lstat(target.targetPath).catch(() => undefined);
+    if (!targetStats)
+        return;
+    if (!targetStats.isDirectory() || targetStats.isSymbolicLink()) {
+        throw new Error("uv environment must be a real directory");
+    }
+    const configStats = await lstat(join(target.targetPath, "pyvenv.cfg")).catch(() => undefined);
+    if (configStats && (!configStats.isFile() || configStats.isSymbolicLink())) {
+        throw new Error("uv pyvenv.cfg must be a regular file");
+    }
+    const scriptsDirectory = join(target.targetPath, process.platform === "win32" ? "Scripts" : "bin");
+    const scriptsStats = await lstat(scriptsDirectory).catch(() => undefined);
+    if (!scriptsStats)
+        return;
+    if (!scriptsStats.isDirectory() || scriptsStats.isSymbolicLink()) {
+        throw new Error("uv scripts path must be a real directory");
+    }
+    assertSafeUvScriptEntries(await readdir(scriptsDirectory, { withFileTypes: true }));
+}
+function assertSafeUvScriptEntries(entries) {
+    if (entries.length > UV_VALIDATION_MAX_ENTRIES) {
+        throw new Error("uv scripts directory exceeds the validation entry limit");
+    }
+    for (const entry of entries) {
+        if (entry.isSymbolicLink() && !isUvInterpreterName(entry.name)) {
+            throw new Error(`uv script must not be a symbolic link: ${entry.name}`);
+        }
+    }
+}
+async function readBoundedUvTextFile(path, remainingBytes) {
+    let handle;
+    try {
+        handle = await open(path, constants.O_RDONLY |
+            (process.platform === "win32" ? 0 : constants.O_NOFOLLOW));
+    }
+    catch (error) {
+        if (isNotFoundError(error))
+            return undefined;
+        throw error;
+    }
+    try {
+        const stats = await handle.stat();
+        if (!stats.isFile())
+            return undefined;
+        if (stats.size > UV_VALIDATION_MAX_FILE_BYTES) {
+            throw new Error(`uv launcher exceeds the validation size limit: ${path}`);
+        }
+        if (stats.size > remainingBytes) {
+            throw new Error("uv launchers exceed the total validation size limit");
+        }
+        const readLimit = Math.min(UV_VALIDATION_MAX_FILE_BYTES, remainingBytes);
+        const contents = await readFilePrefix(handle, readLimit + 1);
+        if (contents.byteLength > UV_VALIDATION_MAX_FILE_BYTES) {
+            throw new Error(`uv launcher exceeds the validation size limit: ${path}`);
+        }
+        if (contents.byteLength > remainingBytes) {
+            throw new Error("uv launchers exceed the total validation size limit");
+        }
+        const text = contents.toString("utf8");
+        return Buffer.from(text, "utf8").equals(contents)
+            ? { bytes: contents.byteLength, text }
+            : { bytes: contents.byteLength };
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function readFilePrefix(handle, maxBytes) {
+    const contents = Buffer.allocUnsafe(maxBytes);
+    let offset = 0;
+    while (offset < contents.byteLength) {
+        const { bytesRead } = await handle.read(contents, offset, contents.byteLength - offset, offset);
+        if (bytesRead === 0)
+            break;
+        offset += bytesRead;
+    }
+    return contents.subarray(0, offset);
+}
+function isUvInterpreterName(name) {
+    return /^python(?:\d+(?:\.\d+)?)?(?:\.exe)?$/iu.test(name);
+}
+async function removeBundlerExtensionMarkers(root) {
+    const pending = [root];
+    while (pending.length > 0) {
+        const current = pending.pop();
+        if (!current)
+            continue;
+        let entries;
+        try {
+            entries = await readdir(current, { withFileTypes: true });
+        }
+        catch (error) {
+            if (isNotFoundError(error))
+                continue;
+            throw error;
+        }
+        for (const entry of entries) {
+            const path = join(current, entry.name);
+            if (entry.isDirectory())
+                pending.push(path);
+            else if (entry.isFile() && isBundlerExtensionMarker(root, path)) {
+                await rm(path, { force: true });
+            }
+        }
+    }
+}
+function isBundlerExtensionMarker(root, path) {
+    const segments = relative(root, path).split(sep);
+    return (segments.length >= 7 &&
+        segments[0] === "ruby" &&
+        segments[2] === "extensions" &&
+        segments.at(-1) === "gem.build_complete");
+}
 function uniquePaths(paths) {
     return [...new Set(paths.filter((path) => Boolean(path)))];
 }