pyfig 0.3.1 → 0.5.0

package/dist/provision.js

@@ -1,217 +1,257 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { createReadStream, createWriteStream } from 'node:fs';
-import { chmod, copyFile, mkdir, mkdtemp, readdir, rename, rm, } from 'node:fs/promises';
+import { chmod, copyFile, mkdir, mkdtemp, readFile, readdir, rename, rm, writeFile, } from 'node:fs/promises';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
-import extractZip from 'extract-zip';
+import { unzipSync } from 'fflate';
 import * as tar from 'tar';
 import { EnvHttpProxyAgent, fetch } from 'undici';
-import { configurationFingerprint, resolveOptions, uvEnvironment, } from './config.js';
-import { cacheLockTarget, withProvisioningLock } from './coordination.js';
-import { findPip, findPython, findUv, probePython, probeUv, pythonSatisfiesRequirements, } from './probes.js';
+import { resolveOptions, uvEnvironment, } from './config.js';
+import { withProvisioningLock } from './provision-lock.js';
+import { sanitizeUvEnvironment, uvCommandEnvironment } from './package-target.js';
+import { findUv, probePython, probeUv, pythonSatisfiesPolicy, } from './probes.js';
 import { runAsync } from './process.js';
-import { memoizeAsync } from './state.js';
-import { canonicalPath, pathsEqual, virtualEnvironmentDirectory, virtualEnvironmentPythonExecutable, } from './virtual-environment.js';
-export async function ensurePython(options = {}) {
-    const resolved = resolveOptions(options);
-    return memoizeAsync('python', configurationFingerprint(resolved), resolved.cacheTtlMs, pythonIsPresent, () => ensurePythonResolved(resolved));
-}
-export async function ensurePip(options = {}, python) {
-    const resolved = resolveOptions(options);
-    const selectedPython = python?.virtualEnvironment
-        ? python
-        : await ensureVirtualEnvironmentResolved(resolved);
-    return ensurePipResolved(selectedPython, resolved);
-}
-export async function ensureVirtualEnvironment(options = {}) {
-    const resolved = resolveOptions(options);
-    return memoizeAsync('venv', configurationFingerprint(resolved), resolved.cacheTtlMs, (python) => pythonIsPresent(python) &&
-        Boolean(python.virtualEnvironment) &&
-        pathsEqual(python.virtualEnvironment, virtualEnvironmentDirectory(resolved.projectRoot)), () => ensureVirtualEnvironmentResolved(resolved));
-}
+import { canonicalPath, externalVirtualEnvironmentDirectories, pathsEqual, virtualEnvironmentDirectory, virtualEnvironmentPythonExecutable, } from './virtual-environment.js';
+/** Ensure a compatible uv executable, preferring an existing installation. */
 export async function ensureUv(options = {}) {
-    const resolved = resolveOptions(options);
-    return memoizeAsync('uv', configurationFingerprint(resolved), resolved.cacheTtlMs, (uv) => fs.existsSync(uv.executable), () => ensureUvResolved(resolved));
+    return ensureUvResolved(resolveOptions(options));
 }
-export async function ensureEnvironment(options = {}) {
+/**
+ * Select a compatible environment and optionally add runtime dependencies.
+ * Project dependency files are inputs only and are never changed.
+ */
+export async function ensureEnvironment(options = {}, dependencies = [], dependencyOptions = {}) {
     const resolved = resolveOptions(options);
-    return memoizeAsync('environment', configurationFingerprint(resolved), resolved.cacheTtlMs, environmentIsPresent, async () => {
-        const python = await ensureVirtualEnvironmentResolved(resolved);
-        const packageManager = await ensurePipResolved(python, resolved);
-        return { python, packageManager };
-    });
+    const normalized = normalizeDependencies(dependencies);
+    const selections = normalizeDependencyOptions(dependencyOptions);
+    const uv = await ensureUvResolved(resolved);
+    const python = await ensureVirtualEnvironmentResolved(resolved, uv);
+    if (normalized.length > 0 || selections.extras.length > 0 ||
+        selections.groups.length > 0 || selections.allExtras) {
+        await installRuntimeDependencies(uv, python, normalized, selections, resolved);
+    }
+    return {
+        python,
+        uv,
+        managed: isManagedEnvironment(python, resolved),
+    };
 }
-async function ensureVirtualEnvironmentResolved(options) {
+async function ensureVirtualEnvironmentResolved(options, uv) {
+    const existing = await findReusableEnvironment(options);
+    if (existing)
+        return existing;
     const directory = virtualEnvironmentDirectory(options.projectRoot);
     const check = async () => {
-        const existing = await inspectVirtualEnvironment(directory, options);
-        if (!existing)
-            return null;
-        if (pythonSatisfiesRequirements(existing, options) &&
-            await virtualEnvironmentMatchesConfiguredPython(existing, options)) {
-            return existing;
-        }
-        throw incompatibleVirtualEnvironmentError(directory, existing, options);
+        const candidate = await inspectVirtualEnvironment(directory, options);
+        return candidate && pythonSatisfiesPolicy(candidate, options) &&
+            await virtualEnvironmentMatchesConfiguredPython(candidate, options)
+            ? candidate
+            : null;
     };
-    const existing = await check();
-    if (existing)
-        return existing;
     if (!options.createVirtualEnvironment) {
-        throw new Error(`No virtual environment at ${directory} satisfies the Python requirements; ` +
-            'virtual-environment creation is disabled.');
+        throw new Error(`No compatible environment is available and creation is disabled. ` +
+            `Pyfig would create ${directory}.`);
     }
-    // Base discovery happens before taking the venv lock, keeping the global lock
-    // order Python -> uv -> venv consistent across callers.
-    const basePython = await ensurePythonResolved(options);
-    const preferredUv = await findAvailableUv(options) ??
-        (options.installUv ? await ensureUvResolved(options) : null);
+    const basePython = await ensureBasePythonResolved(uv, options);
     return withProvisioningLock({
         key: `venv:${canonicalPath(directory)}`,
-        target: directory,
         timeoutMs: options.coordinationTimeoutMs,
-        env: options.env,
         check,
-        mutate: async (signal) => {
-            const entries = await readdir(directory);
-            const hasVenvConfiguration = fs.existsSync(path.join(directory, 'pyvenv.cfg'));
-            if (entries.length > 0 && !hasVenvConfiguration) {
-                throw new Error(`Refusing to replace non-virtual-environment contents at ${directory}.`);
-            }
-            await createVirtualEnvironment(directory, basePython, preferredUv, options, signal);
-            const installed = await inspectVirtualEnvironment(directory, options);
-            if (!installed || !pythonSatisfiesRequirements(installed, options)) {
-                throw new Error(`Python created ${directory}, but it does not satisfy the requested runtime capabilities.`);
+        mutate: async () => {
+            // Only Pyfig's private path is replaceable. Active and repository-root
+            // environments are preserved when incompatible.
+            await rm(directory, { recursive: true, force: true });
+            await mkdir(path.dirname(directory), { recursive: true });
+            await runAsync(uv.executable, [
+                'venv',
+                '--no-project',
+                '--no-config',
+                '--no-python-downloads',
+                '--python',
+                basePython.executable,
+                directory,
+            ], isolatedUvEnvironment(options), options.installTimeoutMs);
+            const installed = await check();
+            if (!installed) {
+                throw new Error(`uv created ${directory}, but its Python does not satisfy the requested capabilities.`);
             }
             return installed;
         },
     });
 }
-async function createVirtualEnvironment(directory, basePython, preferredUv, options, signal) {
-    if (preferredUv) {
-        try {
-            await createVirtualEnvironmentWithUv(preferredUv, directory, basePython, options, signal);
-            return;
-        }
-        catch {
-            // A usable Python may still provide its standard-library venv module.
+async function findReusableEnvironment(options) {
+    if (options.python) {
+        const configured = await probePython({ executable: options.python, args: [] }, options);
+        if (!configured || !pythonSatisfiesPolicy(configured, options)) {
+            throw incompatibleConfiguredPython(options);
         }
+        if (configured.virtualEnvironment)
+            return configured;
     }
-    try {
-        await runAsync(basePython.executable, ['-m', 'venv', directory], withoutActiveVirtualEnvironment(options.env), options.installTimeoutMs, signal);
-        return;
-    }
-    catch (systemVenvError) {
-        if (preferredUv || !options.installUv)
-            throw systemVenvError;
+    for (const directory of [
+        ...externalVirtualEnvironmentDirectories(options.projectRoot, options.env),
+        virtualEnvironmentDirectory(options.projectRoot),
+    ]) {
+        const info = await inspectVirtualEnvironment(directory, options);
+        if (info && pythonSatisfiesPolicy(info, options) &&
+            await virtualEnvironmentMatchesConfiguredPython(info, options)) {
+            return info;
+        }
     }
-    throw new Error('Python could not create a virtual environment and uv installation is disabled.');
-}
-async function createVirtualEnvironmentWithUv(uv, directory, basePython, options, signal) {
-    await runAsync(uv.executable, [
-        'venv',
-        '--no-project',
-        '--no-config',
-        '--no-python-downloads',
-        '--allow-existing',
-        '--python',
-        basePython.executable,
-        directory,
-    ], uvEnvironment(options), options.installTimeoutMs, signal);
-}
-async function inspectVirtualEnvironment(directory, options) {
-    const executable = virtualEnvironmentPythonExecutable(directory);
-    const info = await probePython({ executable, args: [] }, options);
-    return info?.virtualEnvironment && pathsEqual(info.virtualEnvironment, directory) ? info : null;
+    return null;
 }
-async function ensurePythonResolved(options) {
-    const existing = await discoverPython(options);
-    if (existing)
-        return existing;
+async function ensureBasePythonResolved(uv, options) {
+    if (options.python) {
+        const configured = await probePython({ executable: options.python, args: [] }, options);
+        if (!configured || !pythonSatisfiesPolicy(configured, options)) {
+            throw incompatibleConfiguredPython(options);
+        }
+        if (!configured.virtualEnvironment)
+            return configured;
+        const base = await probePython({ executable: configured.baseExecutable, args: [] }, options);
+        if (base && pythonSatisfiesPolicy(base, options))
+            return base;
+        throw incompatibleConfiguredPython(options);
+    }
+    // Corporate and offline hosts get a strict system-only pass before Pyfig
+    // considers any already-managed interpreter or network installation.
+    const system = await findPythonWithUv(uv, options, 'system');
+    if (system)
+        return system;
+    const cachedManaged = await findPythonWithUv(uv, options, 'managed');
+    if (cachedManaged)
+        return cachedManaged;
     if (!options.installPython) {
-        const capability = options.requireEmbedding
-            ? ' with compatible CPython development headers, architecture, and a linkable library'
-            : '';
-        throw new Error(`No Python interpreter satisfies ${options.pythonRange}${capability}; ` +
-            'managed Python installation is disabled.');
+        throw new Error(missingPythonMessage(options, 'managed Python installation is disabled'));
     }
-    const lockTarget = cacheLockTarget(options.cacheDir, 'python');
     return withProvisioningLock({
-        key: `python:${canonicalPath(lockTarget)}`,
-        target: lockTarget,
+        key: `python:${canonicalPath(path.join(options.cacheDir, 'python'))}`,
         timeoutMs: options.coordinationTimeoutMs,
-        env: options.env,
-        check: () => discoverPython(options),
-        mutate: async (signal) => {
-            const uv = await ensureUvResolved(options);
-            const uvEnv = uvEnvironment(options);
-            await runAsync(uv.executable, ['python', 'install', '--no-config', options.managedPython], uvEnv, options.installTimeoutMs, signal);
-            const installed = await findPythonWithUv(uv, options, signal);
+        check: () => findPythonWithUv(uv, options, 'managed'),
+        mutate: async () => {
+            await runAsync(uv.executable, ['python', 'install', '--no-config', options.managedPython], isolatedUvEnvironment(options), options.installTimeoutMs);
+            const installed = await findPythonWithUv(uv, options, 'managed');
             if (!installed) {
-                throw new Error(`uv installed Python ${options.managedPython}, but it does not satisfy the requested ` +
-                    'runtime capabilities.');
+                throw new Error(missingPythonMessage(options, `uv installed ${options.managedPython}, but it remains incompatible`));
             }
             return installed;
         },
     });
 }
-async function discoverPython(options) {
-    if (options.python) {
-        const configured = await probePython({ executable: options.python, args: [] }, options);
-        if (configured && pythonSatisfiesRequirements(configured, options))
-            return configured;
-        throw new Error(`Configured Python ${options.python} is unavailable or does not satisfy ${options.pythonRange}.`);
-    }
-    const existingUv = await findAvailableUv(options);
-    if (existingUv) {
-        const uvPython = await findPythonWithUv(existingUv, options);
-        if (uvPython)
-            return uvPython;
-    }
-    return findPython({ ...options, python: '' });
-}
-async function findPythonWithUv(uv, options, signal) {
-    const requests = [undefined, options.managedPython];
-    for (const requestedPython of requests) {
+async function findPythonWithUv(uv, options, source) {
+    for (const request of ['', options.managedPython]) {
         const args = [
             'python',
             'find',
             '--no-project',
             '--no-config',
-            '--managed-python',
             '--no-python-downloads',
+            source === 'system' ? '--system' : '--managed-python',
         ];
-        if (requestedPython)
-            args.push(requestedPython);
+        if (request)
+            args.push(request);
         try {
-            const { stdout } = await runAsync(uv.executable, args, uvEnvironment(options), options.probeTimeoutMs, signal);
+            const { stdout } = await runAsync(uv.executable, args, explicitPythonSourceEnvironment(options), options.probeTimeoutMs);
             const info = await probePython({ executable: stdout.trim(), args: [] }, options);
-            if (info && pythonSatisfiesRequirements(info, options))
+            if (info && pythonSatisfiesPolicy(info, options))
                 return info;
         }
-        catch (error) {
-            if (signal?.aborted)
-                throw signal.reason ?? error;
-            // Continue through the configured request and then normal system discovery.
+        catch {
+            // Continue through the generic and configured version requests.
         }
     }
+    // `uv python find` returns one match. That match can lack development
+    // headers even when another installed interpreter satisfies every requested
+    // capability, so inspect uv's complete installed-only inventory before
+    // moving from system Python to managed Python or from cache to download.
+    try {
+        const { stdout } = await runAsync(uv.executable, [
+            'python',
+            'list',
+            '--no-config',
+            '--no-python-downloads',
+            '--only-installed',
+            '--output-format',
+            'json',
+            source === 'system' ? '--no-managed-python' : '--managed-python',
+        ], explicitPythonSourceEnvironment(options), options.probeTimeoutMs);
+        const candidates = installedPythonPaths(stdout);
+        for (const executable of candidates) {
+            const info = await probePython({ executable, args: [] }, options);
+            if (info && !info.virtualEnvironment && pythonSatisfiesPolicy(info, options)) {
+                return info;
+            }
+        }
+    }
+    catch {
+        // Older compatible uv releases can still use the find-based fallback.
+    }
     return null;
 }
-async function ensurePipResolved(python, options) {
-    const existingUv = await findAvailableUv(options);
-    if (existingUv)
-        return uvPackageManager(existingUv, python);
-    // Default package operations always use uv, which supplies its own robust
-    // target-venv lock. python -m pip remains a read-only fallback for check-only setups.
-    if (options.installUv)
-        return uvPackageManager(await ensureUvResolved(options), python);
-    const existingPip = await findPip(python, options);
-    if (existingPip)
-        return existingPip;
-    throw new Error(`The virtual environment's python -m pip does not satisfy ${options.pipRange}; ` +
-        'uv installation is disabled.');
+function installedPythonPaths(output) {
+    const parsed = JSON.parse(output);
+    if (!Array.isArray(parsed))
+        return [];
+    const paths = parsed.flatMap((entry) => {
+        if (!entry || typeof entry !== 'object' || !('path' in entry))
+            return [];
+        const candidate = entry.path;
+        return typeof candidate === 'string' && candidate ? [candidate] : [];
+    });
+    return [...new Map(paths.map((candidate) => [canonicalPath(candidate), candidate])).values()];
+}
+async function inspectVirtualEnvironment(directory, options) {
+    const executable = virtualEnvironmentPythonExecutable(directory);
+    const info = await probePython({ executable, args: [] }, options);
+    return info?.virtualEnvironment && pathsEqual(info.virtualEnvironment, directory) ? info : null;
+}
+async function installRuntimeDependencies(uv, python, dependencies, dependencyOptions, options) {
+    if (!python.virtualEnvironment) {
+        throw new Error('Runtime dependency installation requires a virtual environment.');
+    }
+    await withProvisioningLock({
+        key: `dependencies:${canonicalPath(python.virtualEnvironment)}`,
+        timeoutMs: options.coordinationTimeoutMs,
+        check: async () => null,
+        mutate: async () => {
+            const temporary = await mkdtemp(path.join(os.tmpdir(), 'pyfig-dependencies-'));
+            try {
+                const additions = path.join(temporary, 'runtime-dependencies.txt');
+                const resolved = path.join(temporary, 'resolved-dependencies.txt');
+                const pyproject = path.join(options.projectRoot, 'pyproject.toml');
+                const hasPyproject = fs.existsSync(pyproject);
+                if (!hasPyproject && (dependencyOptions.extras.length > 0 ||
+                    dependencyOptions.groups.length > 0 ||
+                    dependencyOptions.allExtras)) {
+                    throw new Error('Runtime extras and groups require an existing pyproject.toml.');
+                }
+                const sources = hasPyproject ? [pyproject] : [];
+                if (dependencies.length > 0) {
+                    await writeFile(additions, `${dependencies.join('\n')}\n`, 'utf8');
+                    sources.push(additions);
+                }
+                const selectionArgs = [
+                    ...dependencyOptions.extras.flatMap((extra) => ['--extra', extra]),
+                    ...dependencyOptions.groups.flatMap((group) => ['--group', group]),
+                    ...(dependencyOptions.allExtras ? ['--all-extras'] : []),
+                ];
+                await runAsync(uv.executable, [
+                    'pip', 'compile', '--no-config', '--python', python.executable, ...selectionArgs,
+                    ...sources, '--output-file', resolved,
+                ], targetUvEnvironment(options, python), options.installTimeoutMs, undefined, options.projectRoot);
+                // install preserves unrelated packages; sync would remove anything not
+                // represented in this temporary resolution.
+                await runAsync(uv.executable, ['pip', 'install', '--no-config', '--python', python.executable, '-r', resolved], targetUvEnvironment(options, python), options.installTimeoutMs, undefined, options.projectRoot);
+            }
+            finally {
+                await rm(temporary, { recursive: true, force: true });
+            }
+            return true;
+        },
+    });
 }
 async function ensureUvResolved(options) {
     const existing = await findAvailableUv(options);
@@ -222,15 +262,12 @@ async function ensureUvResolved(options) {
     }
     const installDir = uvInstallDirectory(options);
     const executable = uvExecutable(options);
-    const lockTarget = cacheLockTarget(options.cacheDir, 'uv');
     return withProvisioningLock({
-        key: `uv:${canonicalPath(lockTarget)}`,
-        target: lockTarget,
+        key: `uv:${canonicalPath(installDir)}`,
         timeoutMs: options.coordinationTimeoutMs,
-        env: options.env,
         check: () => findAvailableUv(options),
-        mutate: async (signal) => {
-            await installUv(installDir, options, signal);
+        mutate: async () => {
+            await installUv(installDir, options);
             const result = probeUv(executable, options);
             if (!result || result.version !== options.uvVersion) {
                 throw new Error(`Expected managed uv ${options.uvVersion}, but the installed executable did not match.`);
@@ -240,64 +277,100 @@ async function ensureUvResolved(options) {
     });
 }
 async function findAvailableUv(options) {
-    const system = await findUv(options);
-    if (system)
-        return system;
+    const external = await findUv(options);
+    if (external)
+        return external;
     const managed = probeUv(uvExecutable(options), options);
     return managed?.version === options.uvVersion ? managed : null;
 }
-function uvInstallDirectory(options) {
-    return path.join(options.cacheDir, 'tools', 'uv', options.uvVersion);
-}
-function uvExecutable(options) {
-    return path.join(uvInstallDirectory(options), process.platform === 'win32' ? 'uv.exe' : 'uv');
+function normalizeDependencies(dependencies) {
+    const normalized = dependencies.map((dependency) => dependency.trim());
+    for (const dependency of normalized) {
+        if (!dependency || /[\0\r\n]/u.test(dependency)) {
+            throw new TypeError(`Invalid runtime dependency: ${JSON.stringify(dependency)}`);
+        }
+    }
+    return [...new Set(normalized)];
 }
-function uvPackageManager(uv, python) {
-    if (!python.virtualEnvironment) {
-        throw new Error('uv pip commands require a virtual-environment Python interpreter.');
+function normalizeDependencyOptions(options) {
+    const extras = normalizeNames('extra', options.extras ?? []);
+    const groups = normalizeNames('dependency group', options.groups ?? []);
+    if (options.allExtras && extras.length > 0) {
+        throw new TypeError('allExtras cannot be combined with explicit extras.');
     }
-    return {
-        kind: 'uv',
-        executable: uv.executable,
-        prefixArgs: ['pip'],
-        version: uv.version,
-        pythonExecutable: python.executable,
-        virtualEnvironment: python.virtualEnvironment,
-    };
+    return { extras, groups, allExtras: options.allExtras ?? false };
 }
-function withoutActiveVirtualEnvironment(env) {
-    const result = { ...env };
-    for (const key of Object.keys(result)) {
-        const normalized = key.toUpperCase();
-        if (normalized === 'CONDA_PREFIX' || normalized === 'VIRTUAL_ENV' ||
-            normalized === 'PYTHONHOME') {
-            delete result[key];
+function normalizeNames(kind, names) {
+    const normalized = names.map((name) => name.trim());
+    for (const name of normalized) {
+        if (!name || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(name)) {
+            throw new TypeError(`Invalid ${kind}: ${JSON.stringify(name)}`);
         }
     }
-    return result;
+    return [...new Set(normalized)];
+}
+function isManagedEnvironment(python, options) {
+    return Boolean(python.virtualEnvironment) && pathsEqual(python.virtualEnvironment, virtualEnvironmentDirectory(options.projectRoot));
+}
+function isolatedUvEnvironment(options) {
+    return sanitizeUvEnvironment(uvEnvironment(options));
+}
+/** Explicit --system/--managed-python selectors cannot be combined with uv's preference setting. */
+function explicitPythonSourceEnvironment(options) {
+    const env = isolatedUvEnvironment(options);
+    delete env['UV_PYTHON_PREFERENCE'];
+    return env;
+}
+function targetUvEnvironment(options, python) {
+    return uvCommandEnvironment(uvEnvironment(options), python);
+}
+function incompatibleConfiguredPython(options) {
+    return new Error(`Configured Python ${options.python} is unavailable or does not satisfy ` +
+        `requires-python ${options.requiresPython}` +
+        `${options.requireEmbedding ? ' with CPython embedding files' : ''}.`);
+}
+function missingPythonMessage(options, reason) {
+    const embedding = options.requireEmbedding
+        ? ' with compatible CPython headers, library, architecture, and GIL ABI'
+        : '';
+    return `No Python satisfies requires-python ${options.requiresPython}${embedding}; ${reason}.`;
+}
+async function virtualEnvironmentMatchesConfiguredPython(virtualEnvironment, options) {
+    if (!options.python)
+        return true;
+    const configured = await probePython({ executable: options.python, args: [] }, options);
+    if (!configured || !pythonSatisfiesPolicy(configured, options))
+        return false;
+    if (configured.virtualEnvironment && pathsEqual(configured.executable, virtualEnvironment.executable)) {
+        return true;
+    }
+    const configuredBase = configured.virtualEnvironment
+        ? configured.baseExecutable
+        : configured.executable;
+    return pathsEqual(configuredBase, virtualEnvironment.baseExecutable);
+}
+function uvInstallDirectory(options) {
+    return path.join(options.cacheDir, 'tools', 'uv', options.uvVersion);
 }
-async function installUv(installDir, options, signal) {
+function uvExecutable(options) {
+    return path.join(uvInstallDirectory(options), process.platform === 'win32' ? 'uv.exe' : 'uv');
+}
+async function installUv(installDir, options) {
     const asset = uvAsset();
     const baseUrl = `https://github.com/astral-sh/uv/releases/download/${options.uvVersion}`;
     const temporary = await mkdtemp(path.join(os.tmpdir(), 'pyfig-uv-'));
     const dispatcher = proxyDispatcher(options.env);
     try {
         const archive = path.join(temporary, asset);
-        await download(`${baseUrl}/${asset}`, archive, options.downloadTimeoutMs, signal, dispatcher);
-        const expected = (await downloadText(`${baseUrl}/${asset}.sha256`, options.downloadTimeoutMs, signal, dispatcher)).trim().split(/\s+/u)[0];
+        await download(`${baseUrl}/${asset}`, archive, options.downloadTimeoutMs, dispatcher);
+        const expected = (await downloadText(`${baseUrl}/${asset}.sha256`, options.downloadTimeoutMs, dispatcher)).trim().split(/\s+/u)[0];
         const actual = await sha256File(archive);
         if (!expected || expected.toLowerCase() !== actual.toLowerCase()) {
             throw new Error(`uv archive checksum mismatch for ${asset}`);
         }
         const extracted = path.join(temporary, 'extracted');
         await mkdir(extracted, { recursive: true });
-        signal.throwIfAborted();
-        if (asset.endsWith('.zip'))
-            await extractZip(archive, { dir: extracted });
-        else
-            await tar.x({ file: archive, cwd: extracted, strict: true });
-        signal.throwIfAborted();
-        const source = await findFile(extracted, process.platform === 'win32' ? 'uv.exe' : 'uv');
+        const source = await extractUvExecutable(archive, asset, extracted);
         if (!source)
             throw new Error(`uv archive did not contain the expected executable: ${asset}`);
         await publishUvAtomically(source, installDir, options);
@@ -307,6 +380,26 @@ async function installUv(installDir, options, signal) {
         await rm(temporary, { recursive: true, force: true });
     }
 }
+async function extractUvExecutable(archive, asset, destination) {
+    const executableName = process.platform === 'win32' ? 'uv.exe' : 'uv';
+    if (!asset.endsWith('.zip')) {
+        await tar.x({ file: archive, cwd: destination, strict: true });
+        return findFile(destination, executableName);
+    }
+    // ZIP entry paths are never written to disk. Extract only uv's bytes and
+    // publish them at a path controlled by Pyfig, which prevents Zip Slip and
+    // symlink entries from redirecting writes outside the temporary directory.
+    const entries = unzipSync(await readFile(archive), {
+        filter: ({ name }) => path.posix.basename(name.replaceAll('\\', '/')) === executableName,
+    });
+    const matches = Object.entries(entries)
+        .filter(([name]) => path.posix.basename(name.replaceAll('\\', '/')) === executableName);
+    if (matches.length !== 1 || !matches[0])
+        return null;
+    const source = path.join(destination, executableName);
+    await writeFile(source, matches[0][1], { flag: 'wx' });
+    return source;
+}
 async function publishUvAtomically(source, installDir, options) {
     await mkdir(installDir, { recursive: true });
     const executable = uvExecutable(options);
@@ -339,16 +432,15 @@ function uvAsset() {
         return `uv-${architecture}-pc-windows-msvc.zip`;
     if (process.platform === 'darwin')
         return `uv-${architecture}-apple-darwin.tar.gz`;
-    // Astral's musl artifacts are fully static and run on both musl and glibc Linux.
     if (process.platform === 'linux')
         return `uv-${architecture}-unknown-linux-musl.tar.gz`;
     throw new Error(`uv bootstrap does not support platform ${process.platform}.`);
 }
-async function download(url, destination, timeoutMs, externalSignal, dispatcher) {
+async function download(url, destination, timeoutMs, dispatcher) {
     const response = await fetch(url, {
         dispatcher,
         redirect: 'follow',
-        signal: combinedSignal(timeoutMs, externalSignal),
+        signal: AbortSignal.timeout(timeoutMs),
     });
     if (!response.ok || !response.body) {
         await response.body?.cancel();
@@ -356,11 +448,11 @@ async function download(url, destination, timeoutMs, externalSignal, dispatcher)
     }
     await pipeline(Readable.fromWeb(response.body), createWriteStream(destination, { flags: 'wx' }));
 }
-async function downloadText(url, timeoutMs, externalSignal, dispatcher) {
+async function downloadText(url, timeoutMs, dispatcher) {
     const response = await fetch(url, {
         dispatcher,
         redirect: 'follow',
-        signal: combinedSignal(timeoutMs, externalSignal),
+        signal: AbortSignal.timeout(timeoutMs),
     });
     if (!response.ok) {
         await response.body?.cancel();
@@ -382,9 +474,6 @@ function proxyDispatcher(env) {
 function environmentValue(env, lowercase, uppercase) {
     return env[lowercase] ?? env[uppercase];
 }
-function combinedSignal(timeoutMs, externalSignal) {
-    return AbortSignal.any([externalSignal, AbortSignal.timeout(timeoutMs)]);
-}
 async function sha256File(file) {
     const hash = createHash('sha256');
     for await (const chunk of createReadStream(file))
@@ -404,31 +493,4 @@ async function findFile(directory, name) {
     }
     return null;
 }
-function incompatibleVirtualEnvironmentError(directory, python, options) {
-    const capabilities = options.requireEmbedding
-        ? ' or lacks compatible CPython embedding headers, library, or architecture'
-        : '';
-    return new Error(`The existing virtual environment at ${directory} uses Python ${python.version}, ` +
-        `which does not satisfy ${options.pythonRange}${capabilities}.`);
-}
-async function virtualEnvironmentMatchesConfiguredPython(virtualEnvironment, options) {
-    if (!options.python)
-        return true;
-    const configured = await probePython({ executable: options.python, args: [] }, options);
-    if (!configured || !pythonSatisfiesRequirements(configured, options))
-        return false;
-    if (configured.virtualEnvironment && pathsEqual(configured.executable, virtualEnvironment.executable)) {
-        return true;
-    }
-    const configuredBase = configured.virtualEnvironment
-        ? configured.baseExecutable
-        : configured.executable;
-    return pathsEqual(configuredBase, virtualEnvironment.baseExecutable);
-}
-function pythonIsPresent(python) {
-    return fs.existsSync(python.executable);
-}
-function environmentIsPresent(environment) {
-    return pythonIsPresent(environment.python) && fs.existsSync(environment.packageManager.executable);
-}
 //# sourceMappingURL=provision.js.map