pyfig 0.4.0 → 0.6.0

package/dist/cjs/sync-resolver.js

@@ -74,14 +74,28 @@ var import_node_os = __toESM(require("node:os"), 1);
 var import_node_path5 = __toESM(require("node:path"), 1);
 var import_node_stream = require("node:stream");
 var import_promises2 = require("node:stream/promises");
-var import_extract_zip = __toESM(require("extract-zip"), 1);
+var import_fflate = require("fflate");
 var tar = __toESM(require("tar"), 1);
 var import_undici = require("undici");
 
 // src/config.ts
 var import_node_path2 = __toESM(require("node:path"), 1);
 var envPaths = __toESM(require("env-paths"), 1);
-var import_semver = __toESM(require("semver"), 1);
+
+// src/pep440.ts
+var import_pep440 = require("@renovatebot/pep440");
+function isValidPep440Specifier(specifier) {
+  return import_pep440.validRange(specifier);
+}
+function normalizePep440Version(version) {
+  return import_pep440.valid(version);
+}
+function pep440VersionSatisfies(version, specifier) {
+  return import_pep440.filter([version], specifier).length === 1;
+}
+function maxPep440Version(versions, specifier) {
+  return import_pep440.maxSatisfying([...versions], specifier);
+}
 
 // src/project-root.ts
 var import_node_fs = __toESM(require("node:fs"), 1);
@@ -106,10 +120,9 @@ function* ancestors(startDirectory) {
 }
 
 // src/config.ts
-var DEFAULT_PYTHON_RANGE = ">=3.10.0 <4.0.0";
+var DEFAULT_REQUIRES_PYTHON = ">=3.10,<4";
 var DEFAULT_MANAGED_PYTHON = "3.12";
-var DEFAULT_UV_VERSION = "0.13.6";
-var DEFAULT_UV_RANGE = ">=0.10.0 <1.0.0";
+var DEFAULT_REQUIRES_UV = ">=0.10,<1";
 var DEFAULT_PROBE_TIMEOUT_MS = 1e4;
 var DEFAULT_INSTALL_TIMEOUT_MS = 10 * 60000;
 var DEFAULT_DOWNLOAD_TIMEOUT_MS = 5 * 60000;
@@ -122,14 +135,12 @@ var envPathsFunction = (() => {
 })();
 function resolveOptions(options = {}) {
   const env = { ...options.env ?? process.env };
-  const pythonRange = options.pythonRange ?? env["PYFIG_PYTHON_RANGE"] ?? DEFAULT_PYTHON_RANGE;
-  const uvRange = options.uvRange ?? env["PYFIG_UV_RANGE"] ?? DEFAULT_UV_RANGE;
-  assertRange("Python", pythonRange);
-  assertRange("uv", uvRange);
+  const requiresPython = options.requiresPython ?? env["PYFIG_REQUIRES_PYTHON"] ?? DEFAULT_REQUIRES_PYTHON;
+  const requiresUv = options.requiresUv ?? env["PYFIG_REQUIRES_UV"] ?? DEFAULT_REQUIRES_UV;
+  assertPep440Specifier("requires-python", requiresPython);
+  assertPep440Specifier("requires-uv", requiresUv);
   const managedPython = options.managedPython ?? env["PYFIG_MANAGED_PYTHON"] ?? DEFAULT_MANAGED_PYTHON;
-  const uvVersion = options.uvVersion ?? env["PYFIG_UV_VERSION"] ?? DEFAULT_UV_VERSION;
-  assertManagedPythonRequest(managedPython, pythonRange);
-  assertUvVersion(uvVersion, uvRange);
+  assertManagedPythonRequest(managedPython, requiresPython);
   const probeTimeoutMs = resolveDuration("probeTimeoutMs", options.probeTimeoutMs, env["PYFIG_PROBE_TIMEOUT_MS"], DEFAULT_PROBE_TIMEOUT_MS);
   const installTimeoutMs = resolveDuration("installTimeoutMs", options.installTimeoutMs, env["PYFIG_INSTALL_TIMEOUT_MS"], DEFAULT_INSTALL_TIMEOUT_MS);
   const downloadTimeoutMs = resolveDuration("downloadTimeoutMs", options.downloadTimeoutMs, env["PYFIG_DOWNLOAD_TIMEOUT_MS"], DEFAULT_DOWNLOAD_TIMEOUT_MS);
@@ -141,10 +152,9 @@ function resolveOptions(options = {}) {
   const autoInstall = options.autoInstall ?? parseBoolean(env["PYFIG_AUTO_INSTALL"], true);
   return {
     python: options.python ?? env["PYFIG_PYTHON"] ?? "",
-    pythonRange,
+    requiresPython,
     managedPython,
-    uvVersion,
-    uvRange,
+    requiresUv,
     requireEmbedding: options.requireEmbedding ?? parseBoolean(env["PYFIG_REQUIRE_EMBEDDING"], false),
     requireGil: options.requireGil ?? parseBoolean(env["PYFIG_REQUIRE_GIL"], false),
     autoInstall,
@@ -169,27 +179,19 @@ function uvEnvironment(options) {
     UV_NO_CONFIG: "1"
   };
 }
-function assertRange(tool, range) {
-  if (!import_semver.default.validRange(range)) {
-    throw new TypeError(`Invalid ${tool} SemVer range: ${range}`);
+function assertPep440Specifier(name, specifier) {
+  if (!isValidPep440Specifier(specifier)) {
+    throw new TypeError(`Invalid ${name} PEP 440 specifier: ${specifier}`);
   }
 }
-function assertUvVersion(version, range) {
-  if (!import_semver.default.valid(version)) {
-    throw new TypeError(`Invalid exact uv version: ${version}`);
-  }
-  if (!import_semver.default.satisfies(version, range)) {
-    throw new TypeError(`Pinned uv ${version} does not satisfy supported range ${range}.`);
-  }
-}
-function assertManagedPythonRequest(request, pythonRange) {
+function assertManagedPythonRequest(request, requiresPython) {
   if (!request || /[\\/\0\r\n]/u.test(request) || request.includes("..")) {
     throw new TypeError(`Invalid managed Python request: ${request}`);
   }
   if (/^\d+\.\d+(?:\.\d+)?$/u.test(request)) {
     const normalized = request.split(".").length === 2 ? `${request}.0` : request;
-    if (!import_semver.default.satisfies(normalized, pythonRange)) {
-      throw new TypeError(`Managed Python ${request} cannot satisfy configured range ${pythonRange}.`);
+    if (!pep440VersionSatisfies(normalized, requiresPython)) {
+      throw new TypeError(`Managed Python ${request} cannot satisfy requires-python ${requiresPython}.`);
     }
   }
 }
@@ -354,9 +356,6 @@ function assertNoTargetOverride(args) {
   }
 }
 
-// src/probes.ts
-var import_semver2 = __toESM(require("semver"), 1);
-
 // src/process.ts
 var import_node_child_process = require("node:child_process");
 var import_node_path4 = __toESM(require("node:path"), 1);
@@ -497,7 +496,15 @@ if os.path.isfile(header_path) and library_path:
     }
 
 release_level = sys.version_info.releaselevel
-release_suffix = "" if release_level == "final" else f"-{release_level}.{sys.version_info.serial}"
+release_suffixes = {
+    "alpha": "a",
+    "beta": "b",
+    "candidate": "rc",
+    "final": "",
+}
+release_suffix = release_suffixes[release_level]
+if release_suffix:
+    release_suffix += str(sys.version_info.serial)
 
 print(json.dumps({
     "executable": sys.executable,
@@ -517,8 +524,8 @@ print(json.dumps({
     "embedding": embedding,
 }))
 `;
-function pythonSatisfiesRequirements(python, options) {
-  return import_semver2.default.satisfies(python.version, options.pythonRange) && (!options.requireEmbedding || python.implementation === "cpython" && python.embedding !== null && pythonArchitectureMatchesRuntime(python)) && (!options.requireGil || !python.gilDisabled);
+function pythonSatisfiesPolicy(python, options) {
+  return pep440VersionSatisfies(python.version, options.requiresPython) && (!options.requireEmbedding || python.implementation === "cpython" && python.embedding !== null && pythonArchitectureMatchesRuntime(python)) && (!options.requireGil || !python.gilDisabled);
 }
 async function probePython(candidate, options) {
   const executable = await resolveExecutable(candidate.executable, options.env);
@@ -527,7 +534,7 @@ async function probePython(candidate, options) {
   try {
     const { stdout } = run(executable, [...candidate.args, "-c", PYTHON_PROBE], options.env, options.probeTimeoutMs);
     const info = JSON.parse(stdout.trim());
-    return import_semver2.default.valid(info.version) ? info : null;
+    return normalizePep440Version(info.version) ? info : null;
   } catch {
     return null;
   }
@@ -536,7 +543,7 @@ async function findUv(options) {
   const configured = options.env["PYFIG_UV"] ?? "uv";
   const executable = await resolveExecutable(configured, options.env);
   const uv = executable ? probeUv(executable, options) : null;
-  return uv && import_semver2.default.satisfies(uv.version, options.uvRange) ? uv : null;
+  return uv && pep440VersionSatisfies(uv.version, options.requiresUv) ? uv : null;
 }
 function probeUv(executable, options) {
   try {
@@ -550,7 +557,7 @@ function probeUv(executable, options) {
 function normalizeVersion(value) {
   if (!value)
     return null;
-  return import_semver2.default.valid(value) ?? import_semver2.default.coerce(value)?.version ?? null;
+  return normalizePep440Version(value);
 }
 function pythonArchitectureMatchesRuntime(python) {
   const architecture = python.architecture.toLowerCase();
@@ -570,14 +577,14 @@ function pythonArchitectureMatchesRuntime(python) {
 async function ensureUv(options = {}) {
   return ensureUvResolved(resolveOptions(options));
 }
-async function ensureEnvironment(options = {}, requirements = [], dependencyOptions = {}) {
+async function ensureEnvironment(options = {}, dependencies = [], dependencyOptions = {}) {
   const resolved = resolveOptions(options);
-  const normalized = normalizeRequirements(requirements);
+  const normalized = normalizeDependencies(dependencies);
   const selections = normalizeDependencyOptions(dependencyOptions);
   const uv = await ensureUvResolved(resolved);
   const python = await ensureVirtualEnvironmentResolved(resolved, uv);
   if (normalized.length > 0 || selections.extras.length > 0 || selections.groups.length > 0 || selections.allExtras) {
-    await installRuntimeRequirements(uv, python, normalized, selections, resolved);
+    await installRuntimeDependencies(uv, python, normalized, selections, resolved);
   }
   return {
     python,
@@ -592,7 +599,7 @@ async function ensureVirtualEnvironmentResolved(options, uv) {
   const directory = virtualEnvironmentDirectory(options.projectRoot);
   const check = async () => {
     const candidate = await inspectVirtualEnvironment(directory, options);
-    return candidate && pythonSatisfiesRequirements(candidate, options) && await virtualEnvironmentMatchesConfiguredPython(candidate, options) ? candidate : null;
+    return candidate && pythonSatisfiesPolicy(candidate, options) && await virtualEnvironmentMatchesConfiguredPython(candidate, options) ? candidate : null;
   };
   if (!options.createVirtualEnvironment) {
     throw new Error(`No compatible environment is available and creation is disabled. ` + `Pyfig would create ${directory}.`);
@@ -625,7 +632,7 @@ async function ensureVirtualEnvironmentResolved(options, uv) {
 async function findReusableEnvironment(options) {
   if (options.python) {
     const configured = await probePython({ executable: options.python, args: [] }, options);
-    if (!configured || !pythonSatisfiesRequirements(configured, options)) {
+    if (!configured || !pythonSatisfiesPolicy(configured, options)) {
       throw incompatibleConfiguredPython(options);
     }
     if (configured.virtualEnvironment)
@@ -636,7 +643,7 @@ async function findReusableEnvironment(options) {
     virtualEnvironmentDirectory(options.projectRoot)
   ]) {
     const info = await inspectVirtualEnvironment(directory, options);
-    if (info && pythonSatisfiesRequirements(info, options) && await virtualEnvironmentMatchesConfiguredPython(info, options)) {
+    if (info && pythonSatisfiesPolicy(info, options) && await virtualEnvironmentMatchesConfiguredPython(info, options)) {
       return info;
     }
   }
@@ -645,13 +652,13 @@ async function findReusableEnvironment(options) {
 async function ensureBasePythonResolved(uv, options) {
   if (options.python) {
     const configured = await probePython({ executable: options.python, args: [] }, options);
-    if (!configured || !pythonSatisfiesRequirements(configured, options)) {
+    if (!configured || !pythonSatisfiesPolicy(configured, options)) {
       throw incompatibleConfiguredPython(options);
     }
     if (!configured.virtualEnvironment)
       return configured;
     const base = await probePython({ executable: configured.baseExecutable, args: [] }, options);
-    if (base && pythonSatisfiesRequirements(base, options))
+    if (base && pythonSatisfiesPolicy(base, options))
       return base;
     throw incompatibleConfiguredPython(options);
   }
@@ -693,7 +700,7 @@ async function findPythonWithUv(uv, options, source) {
     try {
       const { stdout } = await runAsync(uv.executable, args, explicitPythonSourceEnvironment(options), options.probeTimeoutMs);
       const info = await probePython({ executable: stdout.trim(), args: [] }, options);
-      if (info && pythonSatisfiesRequirements(info, options))
+      if (info && pythonSatisfiesPolicy(info, options))
         return info;
     } catch {}
   }
@@ -711,7 +718,7 @@ async function findPythonWithUv(uv, options, source) {
     const candidates = installedPythonPaths(stdout);
     for (const executable of candidates) {
       const info = await probePython({ executable, args: [] }, options);
-      if (info && !info.virtualEnvironment && pythonSatisfiesRequirements(info, options)) {
+      if (info && !info.virtualEnvironment && pythonSatisfiesPolicy(info, options)) {
         return info;
       }
     }
@@ -735,7 +742,7 @@ async function inspectVirtualEnvironment(directory, options) {
   const info = await probePython({ executable, args: [] }, options);
   return info?.virtualEnvironment && pathsEqual(info.virtualEnvironment, directory) ? info : null;
 }
-async function installRuntimeRequirements(uv, python, requirements, dependencyOptions, options) {
+async function installRuntimeDependencies(uv, python, dependencies, dependencyOptions, options) {
   if (!python.virtualEnvironment) {
     throw new Error("Runtime dependency installation requires a virtual environment.");
   }
@@ -744,18 +751,18 @@ async function installRuntimeRequirements(uv, python, requirements, dependencyOp
     timeoutMs: options.coordinationTimeoutMs,
     check: async () => null,
     mutate: async () => {
-      const temporary = await import_promises.mkdtemp(import_node_path5.default.join(import_node_os.default.tmpdir(), "pyfig-requirements-"));
+      const temporary = await import_promises.mkdtemp(import_node_path5.default.join(import_node_os.default.tmpdir(), "pyfig-dependencies-"));
       try {
-        const additions = import_node_path5.default.join(temporary, "runtime-requirements.txt");
-        const resolved = import_node_path5.default.join(temporary, "resolved-requirements.txt");
+        const additions = import_node_path5.default.join(temporary, "runtime-dependencies.txt");
+        const resolved = import_node_path5.default.join(temporary, "resolved-dependencies.txt");
         const pyproject = import_node_path5.default.join(options.projectRoot, "pyproject.toml");
         const hasPyproject = import_node_fs4.default.existsSync(pyproject);
         if (!hasPyproject && (dependencyOptions.extras.length > 0 || dependencyOptions.groups.length > 0 || dependencyOptions.allExtras)) {
           throw new Error("Runtime extras and groups require an existing pyproject.toml.");
         }
         const sources = hasPyproject ? [pyproject] : [];
-        if (requirements.length > 0) {
-          await import_promises.writeFile(additions, `${requirements.join(`
+        if (dependencies.length > 0) {
+          await import_promises.writeFile(additions, `${dependencies.join(`
 `)}
 `, "utf8");
           sources.push(additions);
@@ -789,21 +796,30 @@ async function ensureUvResolved(options) {
   if (existing)
     return existing;
   if (!options.installUv) {
-    throw new Error(`Compatible uv is unavailable (required ${options.uvRange}), and uv installation is disabled.`);
+    throw new Error(`Compatible uv is unavailable (requires-uv ${options.requiresUv}), and uv installation is disabled.`);
   }
-  const installDir = uvInstallDirectory(options);
-  const executable = uvExecutable(options);
+  const policyKey = import_node_crypto.createHash("sha256").update(options.requiresUv).digest("hex");
   return withProvisioningLock({
-    key: `uv:${canonicalPath(installDir)}`,
+    key: `uv-policy:${canonicalPath(uvInstallRoot(options))}:${policyKey}`,
     timeoutMs: options.coordinationTimeoutMs,
     check: () => findAvailableUv(options),
     mutate: async () => {
-      await installUv(installDir, options);
-      const result = probeUv(executable, options);
-      if (!result || result.version !== options.uvVersion) {
-        throw new Error(`Expected managed uv ${options.uvVersion}, but the installed executable did not match.`);
-      }
-      return result;
+      const release = await resolveUvRelease(options);
+      const installDir = uvInstallDirectory(options, release.version);
+      const executable = uvExecutable(options, release.version);
+      return withProvisioningLock({
+        key: `uv-release:${canonicalPath(installDir)}`,
+        timeoutMs: options.coordinationTimeoutMs,
+        check: () => findAvailableUv(options),
+        mutate: async () => {
+          await installUv(installDir, release, options);
+          const result = probeUv(executable, options);
+          if (!result || result.version !== release.version) {
+            throw new Error(`Expected managed uv ${release.version}, but the installed executable did not match.`);
+          }
+          return result;
+        }
+      });
     }
   });
 }
@@ -811,14 +827,27 @@ async function findAvailableUv(options) {
   const external = await findUv(options);
   if (external)
     return external;
-  const managed = probeUv(uvExecutable(options), options);
-  return managed?.version === options.uvVersion ? managed : null;
-}
-function normalizeRequirements(requirements) {
-  const normalized = requirements.map((requirement) => requirement.trim());
-  for (const requirement of normalized) {
-    if (!requirement || /[\0\r\n]/u.test(requirement)) {
-      throw new TypeError(`Invalid runtime requirement: ${JSON.stringify(requirement)}`);
+  return findManagedUv(options);
+}
+async function findManagedUv(options) {
+  const entries = await import_promises.readdir(uvInstallRoot(options), { withFileTypes: true }).catch(() => []);
+  let versions = entries.filter((entry) => entry.isDirectory() && normalizePep440Version(entry.name) === entry.name).map((entry) => entry.name);
+  while (versions.length > 0) {
+    const selected = maxPep440Version(versions, options.requiresUv);
+    if (!selected)
+      return null;
+    const candidate = probeUv(uvExecutable(options, selected), options);
+    if (candidate?.version === selected)
+      return candidate;
+    versions = versions.filter((version) => version !== selected);
+  }
+  return null;
+}
+function normalizeDependencies(dependencies) {
+  const normalized = dependencies.map((dependency) => dependency.trim());
+  for (const dependency of normalized) {
+    if (!dependency || /[\0\r\n]/u.test(dependency)) {
+      throw new TypeError(`Invalid runtime dependency: ${JSON.stringify(dependency)}`);
     }
   }
   return [...new Set(normalized)];
@@ -855,17 +884,17 @@ function targetUvEnvironment(options, python) {
   return uvCommandEnvironment(uvEnvironment(options), python);
 }
 function incompatibleConfiguredPython(options) {
-  return new Error(`Configured Python ${options.python} is unavailable or does not satisfy ` + `${options.pythonRange}${options.requireEmbedding ? " with CPython embedding files" : ""}.`);
+  return new Error(`Configured Python ${options.python} is unavailable or does not satisfy ` + `requires-python ${options.requiresPython}` + `${options.requireEmbedding ? " with CPython embedding files" : ""}.`);
 }
 function missingPythonMessage(options, reason) {
   const embedding = options.requireEmbedding ? " with compatible CPython headers, library, architecture, and GIL ABI" : "";
-  return `No Python satisfies ${options.pythonRange}${embedding}; ${reason}.`;
+  return `No Python satisfies requires-python ${options.requiresPython}${embedding}; ${reason}.`;
 }
 async function virtualEnvironmentMatchesConfiguredPython(virtualEnvironment, options) {
   if (!options.python)
     return true;
   const configured = await probePython({ executable: options.python, args: [] }, options);
-  if (!configured || !pythonSatisfiesRequirements(configured, options))
+  if (!configured || !pythonSatisfiesPolicy(configured, options))
     return false;
   if (configured.virtualEnvironment && pathsEqual(configured.executable, virtualEnvironment.executable)) {
     return true;
@@ -873,15 +902,159 @@ async function virtualEnvironmentMatchesConfiguredPython(virtualEnvironment, opt
   const configuredBase = configured.virtualEnvironment ? configured.baseExecutable : configured.executable;
   return pathsEqual(configuredBase, virtualEnvironment.baseExecutable);
 }
-function uvInstallDirectory(options) {
-  return import_node_path5.default.join(options.cacheDir, "tools", "uv", options.uvVersion);
+var UV_RELEASE_PAGE_SIZE = 100;
+var UV_RELEASE_MAX_PAGES = 20;
+var UV_RELEASE_METADATA_TTL_MS = 24 * 60 * 60000;
+async function resolveUvRelease(options) {
+  const catalog = await ensureUvReleaseCatalog(options);
+  const asset = uvAsset();
+  const releases = catalog.releases.filter((release) => release.assets.includes(asset) && release.assets.includes(`${asset}.sha256`));
+  const version = maxPep440Version(releases.map((release) => release.version), options.requiresUv);
+  const release = releases.find((candidate) => candidate.version === version);
+  if (!release) {
+    throw new Error(`No published uv release satisfies requires-uv ${options.requiresUv}.`);
+  }
+  return release;
+}
+async function ensureUvReleaseCatalog(options) {
+  const file = uvReleaseMetadataFile(options);
+  const stale = await readUvReleaseCatalog(file);
+  try {
+    return await withProvisioningLock({
+      key: `uv-metadata:${canonicalPath(file)}`,
+      timeoutMs: options.coordinationTimeoutMs,
+      check: () => readFreshUvReleaseCatalog(file),
+      mutate: async () => {
+        const catalog = await fetchUvReleaseCatalog(options);
+        await writeUvReleaseCatalog(file, catalog);
+        return catalog;
+      }
+    });
+  } catch (error) {
+    const fallback = await readUvReleaseCatalog(file) ?? stale;
+    if (fallback)
+      return fallback;
+    throw error;
+  }
 }
-function uvExecutable(options) {
-  return import_node_path5.default.join(uvInstallDirectory(options), process.platform === "win32" ? "uv.exe" : "uv");
+async function fetchUvReleaseCatalog(options) {
+  const dispatcher = proxyDispatcher(options.env);
+  const releases = new Map;
+  let exhausted = false;
+  try {
+    for (let page = 1;page <= UV_RELEASE_MAX_PAGES; page += 1) {
+      const text = await downloadText(`https://api.github.com/repos/astral-sh/uv/releases?per_page=${UV_RELEASE_PAGE_SIZE}&page=${page}`, options.downloadTimeoutMs, dispatcher, {
+        Accept: "application/vnd.github+json",
+        "User-Agent": "pyfig",
+        "X-GitHub-Api-Version": "2022-11-28"
+      });
+      const payload = JSON.parse(text);
+      if (!Array.isArray(payload)) {
+        throw new Error("GitHub returned invalid uv release metadata.");
+      }
+      for (const candidate of payload) {
+        if (!candidate || typeof candidate !== "object")
+          continue;
+        const release = candidate;
+        if (release.draft === true || typeof release.tag_name !== "string")
+          continue;
+        const assetNames = releaseAssetNames(release.assets);
+        const version = normalizePep440Version(release.tag_name);
+        if (version) {
+          releases.set(version, { assets: assetNames, tag: release.tag_name, version });
+        }
+      }
+      if (payload.length < UV_RELEASE_PAGE_SIZE) {
+        exhausted = true;
+        break;
+      }
+    }
+  } finally {
+    await dispatcher?.close();
+  }
+  if (!exhausted) {
+    throw new Error(`uv release catalog exceeded ${UV_RELEASE_MAX_PAGES} pages.`);
+  }
+  if (releases.size === 0) {
+    throw new Error("GitHub returned no usable uv releases.");
+  }
+  return { fetchedAt: Date.now(), releases: [...releases.values()] };
 }
-async function installUv(installDir, options) {
+async function readFreshUvReleaseCatalog(file) {
+  const catalog = await readUvReleaseCatalog(file);
+  if (!catalog)
+    return null;
+  const age = Date.now() - catalog.fetchedAt;
+  return age >= 0 && age < UV_RELEASE_METADATA_TTL_MS ? catalog : null;
+}
+async function readUvReleaseCatalog(file) {
+  try {
+    return parseUvReleaseCatalog(JSON.parse(await import_promises.readFile(file, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function parseUvReleaseCatalog(value) {
+  if (!value || typeof value !== "object")
+    return null;
+  const catalog = value;
+  if (!Number.isSafeInteger(catalog.fetchedAt) || catalog.fetchedAt < 0 || !Array.isArray(catalog.releases)) {
+    return null;
+  }
+  const releases = [];
+  for (const value of catalog.releases) {
+    if (!value || typeof value !== "object")
+      return null;
+    const release = value;
+    if (!Array.isArray(release.assets) || !release.assets.every((asset) => typeof asset === "string") || typeof release.tag !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._+-]*$/u.test(release.tag) || typeof release.version !== "string" || normalizePep440Version(release.version) !== release.version) {
+      return null;
+    }
+    releases.push({
+      assets: release.assets,
+      tag: release.tag,
+      version: release.version
+    });
+  }
+  return { fetchedAt: catalog.fetchedAt, releases };
+}
+async function writeUvReleaseCatalog(file, catalog) {
+  await import_promises.mkdir(import_node_path5.default.dirname(file), { recursive: true });
+  const staged = import_node_path5.default.join(import_node_path5.default.dirname(file), `.${import_node_path5.default.basename(file)}.${process.pid}.${import_node_crypto.randomUUID()}.tmp`);
+  try {
+    await import_promises.writeFile(staged, `${JSON.stringify(catalog)}
+`, { encoding: "utf8", flag: "wx" });
+    if (process.platform === "win32")
+      await import_promises.rm(file, { force: true });
+    await import_promises.rename(staged, file);
+  } finally {
+    await import_promises.rm(staged, { force: true });
+  }
+}
+function uvReleaseMetadataFile(options) {
+  return import_node_path5.default.join(options.cacheDir, "metadata", "uv-releases.json");
+}
+function releaseAssetNames(value) {
+  if (!Array.isArray(value))
+    return [];
+  return value.flatMap((entry) => {
+    if (!entry || typeof entry !== "object")
+      return [];
+    const name = entry.name;
+    return typeof name === "string" ? [name] : [];
+  });
+}
+function uvInstallRoot(options) {
+  return import_node_path5.default.join(options.cacheDir, "tools", "uv");
+}
+function uvInstallDirectory(options, version) {
+  return import_node_path5.default.join(uvInstallRoot(options), version);
+}
+function uvExecutable(options, version) {
+  return import_node_path5.default.join(uvInstallDirectory(options, version), process.platform === "win32" ? "uv.exe" : "uv");
+}
+async function installUv(installDir, release, options) {
   const asset = uvAsset();
-  const baseUrl = `https://github.com/astral-sh/uv/releases/download/${options.uvVersion}`;
+  const baseUrl = `https://github.com/astral-sh/uv/releases/download/${release.tag}`;
   const temporary = await import_promises.mkdtemp(import_node_path5.default.join(import_node_os.default.tmpdir(), "pyfig-uv-"));
   const dispatcher = proxyDispatcher(options.env);
   try {
@@ -894,30 +1067,42 @@ async function installUv(installDir, options) {
     }
     const extracted = import_node_path5.default.join(temporary, "extracted");
     await import_promises.mkdir(extracted, { recursive: true });
-    if (asset.endsWith(".zip"))
-      await import_extract_zip.default(archive, { dir: extracted });
-    else
-      await tar.x({ file: archive, cwd: extracted, strict: true });
-    const source = await findFile(extracted, process.platform === "win32" ? "uv.exe" : "uv");
+    const source = await extractUvExecutable(archive, asset, extracted);
     if (!source)
       throw new Error(`uv archive did not contain the expected executable: ${asset}`);
-    await publishUvAtomically(source, installDir, options);
+    await publishUvAtomically(source, installDir, release.version, options);
   } finally {
     await dispatcher?.close();
     await import_promises.rm(temporary, { recursive: true, force: true });
   }
 }
-async function publishUvAtomically(source, installDir, options) {
+async function extractUvExecutable(archive, asset, destination) {
+  const executableName = process.platform === "win32" ? "uv.exe" : "uv";
+  if (!asset.endsWith(".zip")) {
+    await tar.x({ file: archive, cwd: destination, strict: true });
+    return findFile(destination, executableName);
+  }
+  const entries = import_fflate.unzipSync(await import_promises.readFile(archive), {
+    filter: ({ name }) => import_node_path5.default.posix.basename(name.replaceAll("\\", "/")) === executableName
+  });
+  const matches = Object.entries(entries).filter(([name]) => import_node_path5.default.posix.basename(name.replaceAll("\\", "/")) === executableName);
+  if (matches.length !== 1 || !matches[0])
+    return null;
+  const source = import_node_path5.default.join(destination, executableName);
+  await import_promises.writeFile(source, matches[0][1], { flag: "wx" });
+  return source;
+}
+async function publishUvAtomically(source, installDir, version, options) {
   await import_promises.mkdir(installDir, { recursive: true });
-  const executable = uvExecutable(options);
+  const executable = uvExecutable(options, version);
   const staged = import_node_path5.default.join(installDir, `.${import_node_path5.default.basename(executable)}.${process.pid}.${import_node_crypto.randomUUID()}.tmp`);
   try {
     await import_promises.copyFile(source, staged);
     if (process.platform !== "win32")
       await import_promises.chmod(staged, 493);
     const stagedUv = probeUv(staged, options);
-    if (!stagedUv || stagedUv.version !== options.uvVersion) {
-      throw new Error(`Downloaded uv executable is not version ${options.uvVersion}.`);
+    if (!stagedUv || stagedUv.version !== version) {
+      throw new Error(`Downloaded uv executable is not version ${version}.`);
     }
     if (process.platform === "win32")
       await import_promises.rm(executable, { force: true });
@@ -950,9 +1135,10 @@ async function download(url, destination, timeoutMs, dispatcher) {
   }
   await import_promises2.pipeline(import_node_stream.Readable.fromWeb(response.body), import_node_fs3.createWriteStream(destination, { flags: "wx" }));
 }
-async function downloadText(url, timeoutMs, dispatcher) {
+async function downloadText(url, timeoutMs, dispatcher, headers) {
   const response = await import_undici.fetch(url, {
     dispatcher,
+    headers,
     redirect: "follow",
     signal: AbortSignal.timeout(timeoutMs)
   });
@@ -1008,4 +1194,4 @@ main().catch((error) => {
   process.exitCode = 1;
 });
 
-//# debugId=450BD20294AA111B64756E2164756E21
+//# debugId=D02BE720BF896D6864756E2164756E21