pyfig 0.5.0 → 0.6.1

package/README.md

@@ -17,6 +17,7 @@ import { createPyfig } from 'pyfig';
 
 const pyfig = createPyfig({
   requiresPython: '>=3.11,<4',
+  requiresUv: '>=0.10,<1',
   requireEmbedding: true,
   requireGil: true,
 });
@@ -136,15 +137,14 @@ The package exposes matching ESM and CommonJS entry points. Probe, download, loc
 
 Precedence is API or CLI option, environment variable, then default.
 
-`requiresPython` uses the same PEP 440 specifier syntax as `[project].requires-python` in `pyproject.toml`. Comma-separated clauses, compatible releases (`~=`), exclusions (`!=`), wildcard equality (`==3.12.*`), arbitrary equality (`===`), and pre-release versions are supported. For example: `>=3.10,!=3.12.*,<4`.
+`requiresPython` and `requiresUv` use PEP 440 specifiers. Comma-separated clauses, compatible releases (`~=`), exclusions (`!=`), wildcard equality, arbitrary equality (`===`), and pre-release versions are supported. For example: `requiresPython: '>=3.10,!=3.12.*,<4'` and `requiresUv: '==0.13.*'`. Pyfig reuses a compatible installed or cached uv first. When installation is necessary, it resolves the greatest published uv release satisfying `requiresUv` and containing the required platform assets.
 
 | API option | Environment variable | Default |
 | --- | --- | --- |
 | `python` | `PYFIG_PYTHON` | uv discovery |
 | `requiresPython` | `PYFIG_REQUIRES_PYTHON` | `>=3.10,<4` |
 | `managedPython` | `PYFIG_MANAGED_PYTHON` | `3.12` |
-| `uvVersion` | `PYFIG_UV_VERSION` | `0.13.6` |
-| `uvRange` | `PYFIG_UV_RANGE` | `>=0.10.0 <1.0.0` |
+| `requiresUv` | `PYFIG_REQUIRES_UV` | `>=0.10,<1` |
 | `cacheDir` | `PYFIG_HOME` | OS cache directory |
 | `projectRoot` | `PYFIG_PROJECT_ROOT` | `INIT_CWD`, Git root, or current directory |
 | `requireEmbedding` | `PYFIG_REQUIRE_EMBEDDING` | `false` |
@@ -166,6 +166,7 @@ Set `PYFIG_UV` to choose an explicit uv executable. Set `PYFIG_AUTO_INSTALL=0` o
 bunx --bun pyfig
 bunx --bun pyfig --check
 bunx --bun pyfig --requires-python '>=3.12,<3.14'
+bunx --bun pyfig --requires-uv '>=0.12,<1'
 bunx --bun pyfig --require-embedding --require-gil
 bunx --bun pyfig --project-root /path/to/repository
 bunx --bun pyfig --json
@@ -175,9 +176,9 @@ bunx --bun pyfig --json
 
 ## Concurrency and installation safety
 
-Pyfig downloads an exact uv release archive over HTTPS, verifies its adjacent SHA-256 checksum, validates the staged executable version, and atomically publishes it in Pyfig's cache. It does not execute installer scripts or modify shell profiles.
+Pyfig resolves a compatible uv release from Astral's GitHub releases, downloads that exact archive over HTTPS, verifies its adjacent SHA-256 checksum, validates the staged executable version, and atomically publishes it in Pyfig's cache. A compatible cached executable is probed locally without a network request. Release metadata is cached on disk for 24 hours; stale metadata is refreshed under a Loqkit lock and remains available as a fallback when GitHub's API is temporarily unavailable. Pyfig does not execute installer scripts or modify shell profiles.
 
-Provisioning mutations use Loqkit's layered in-memory, worker, native-file-lock-when-available, and portable-file coordination with capability checks before and after acquisition. uv supplies its own target-environment lock for installs. Base client preparation is memoized; dependency preparation is intentionally rerun so uv can cheaply verify current inputs through its shared cache.
+Provisioning mutations use Loqkit's layered in-memory, worker, native-file-lock-when-available, and portable-file coordination with capability checks before and after acquisition. Compatible managed uv executables are cached by resolved version; Loqkit coordinates both the `requiresUv` policy lookup and exact release publication. uv supplies its own target-environment lock for installs. Base client preparation is memoized; dependency preparation is intentionally rerun so uv can cheaply verify current inputs through its shared cache.
 
 ## Platform support
 

package/SECURITY.md

@@ -2,7 +2,7 @@
 
 Pyfig can download Astral uv release archives and can ask uv to download Python distributions. Automatic installation is enabled by default; set `autoInstall: false`, pass `--check`, or set `PYFIG_AUTO_INSTALL=0` when downloads are not allowed.
 
-The uv release URL is pinned to an exact validated version and fetched over HTTPS with bounded redirects and timeouts. Pyfig verifies the adjacent SHA-256 checksum, validates the staged executable's reported version, and atomically publishes it into its cache. It never executes an installer script or modifies shell profiles or the host `PATH`. Proxy variables are honored through a per-request dispatcher without logging proxy credentials.
+Pyfig resolves a uv release allowed by `requiresUv`, then fetches that exact release URL over HTTPS with bounded redirects and timeouts. GitHub release metadata is cached for 24 hours under Loqkit coordination, with validated stale metadata available if refresh fails. Pyfig verifies the adjacent SHA-256 checksum, validates the staged executable's reported version, and atomically publishes it into its cache. It never executes an installer script or modifies shell profiles or the host `PATH`. Proxy variables are honored through a per-request dispatcher without logging proxy credentials.
 
 Provisioning uses in-process, worker, optional native advisory, and portable filesystem coordination followed by a post-lock capability check. Runtime dependency mutation uses uv's target-environment lock. Pyfig pins uv commands to the selected venv and removes configuration values that could redirect them. It reads an existing `pyproject.toml` only as a resolver input and never writes project manifests or requirements files.
 

package/dist/cjs/index.js

@@ -67,8 +67,7 @@ var exports_src = {};
 __export(exports_src, {
   DEFAULT_MANAGED_PYTHON: () => DEFAULT_MANAGED_PYTHON,
   DEFAULT_REQUIRES_PYTHON: () => DEFAULT_REQUIRES_PYTHON,
-  DEFAULT_UV_RANGE: () => DEFAULT_UV_RANGE,
-  DEFAULT_UV_VERSION: () => DEFAULT_UV_VERSION,
+  DEFAULT_REQUIRES_UV: () => DEFAULT_REQUIRES_UV,
   createPyfig: () => createPyfig,
   ensureEnvironment: () => ensureEnvironment,
   ensureUv: () => ensureUv,
@@ -81,7 +80,21 @@ module.exports = __toCommonJS(exports_src);
 // src/config.ts
 var import_node_path2 = __toESM(require("node:path"), 1);
 var envPaths = __toESM(require("env-paths"), 1);
-var import_semver = __toESM(require("semver"), 1);
+
+// src/pep440.ts
+var import_pep440 = require("@renovatebot/pep440");
+function isValidPep440Specifier(specifier) {
+  return import_pep440.validRange(specifier);
+}
+function normalizePep440Version(version) {
+  return import_pep440.valid(version);
+}
+function pep440VersionSatisfies(version, specifier) {
+  return import_pep440.filter([version], specifier).length === 1;
+}
+function maxPep440Version(versions, specifier) {
+  return import_pep440.maxSatisfying([...versions], specifier);
+}
 
 // src/project-root.ts
 var import_node_fs = __toESM(require("node:fs"), 1);
@@ -105,23 +118,10 @@ function* ancestors(startDirectory) {
   }
 }
 
-// src/python-version.ts
-var import_pep440 = require("@renovatebot/pep440");
-function isValidPythonSpecifier(specifier) {
-  return import_pep440.validRange(specifier);
-}
-function isValidPythonVersion(version) {
-  return import_pep440.valid(version) !== null;
-}
-function pythonVersionSatisfies(version, specifier) {
-  return import_pep440.filter([version], specifier).length === 1;
-}
-
 // src/config.ts
 var DEFAULT_REQUIRES_PYTHON = ">=3.10,<4";
 var DEFAULT_MANAGED_PYTHON = "3.12";
-var DEFAULT_UV_VERSION = "0.13.6";
-var DEFAULT_UV_RANGE = ">=0.10.0 <1.0.0";
+var DEFAULT_REQUIRES_UV = ">=0.10,<1";
 var DEFAULT_PROBE_TIMEOUT_MS = 1e4;
 var DEFAULT_INSTALL_TIMEOUT_MS = 10 * 60000;
 var DEFAULT_DOWNLOAD_TIMEOUT_MS = 5 * 60000;
@@ -135,13 +135,11 @@ var envPathsFunction = (() => {
 function resolveOptions(options = {}) {
   const env = { ...options.env ?? process.env };
   const requiresPython = options.requiresPython ?? env["PYFIG_REQUIRES_PYTHON"] ?? DEFAULT_REQUIRES_PYTHON;
-  const uvRange = options.uvRange ?? env["PYFIG_UV_RANGE"] ?? DEFAULT_UV_RANGE;
-  assertPythonSpecifier(requiresPython);
-  assertRange("uv", uvRange);
+  const requiresUv = options.requiresUv ?? env["PYFIG_REQUIRES_UV"] ?? DEFAULT_REQUIRES_UV;
+  assertPep440Specifier("requires-python", requiresPython);
+  assertPep440Specifier("requires-uv", requiresUv);
   const managedPython = options.managedPython ?? env["PYFIG_MANAGED_PYTHON"] ?? DEFAULT_MANAGED_PYTHON;
-  const uvVersion = options.uvVersion ?? env["PYFIG_UV_VERSION"] ?? DEFAULT_UV_VERSION;
   assertManagedPythonRequest(managedPython, requiresPython);
-  assertUvVersion(uvVersion, uvRange);
   const probeTimeoutMs = resolveDuration("probeTimeoutMs", options.probeTimeoutMs, env["PYFIG_PROBE_TIMEOUT_MS"], DEFAULT_PROBE_TIMEOUT_MS);
   const installTimeoutMs = resolveDuration("installTimeoutMs", options.installTimeoutMs, env["PYFIG_INSTALL_TIMEOUT_MS"], DEFAULT_INSTALL_TIMEOUT_MS);
   const downloadTimeoutMs = resolveDuration("downloadTimeoutMs", options.downloadTimeoutMs, env["PYFIG_DOWNLOAD_TIMEOUT_MS"], DEFAULT_DOWNLOAD_TIMEOUT_MS);
@@ -155,8 +153,7 @@ function resolveOptions(options = {}) {
     python: options.python ?? env["PYFIG_PYTHON"] ?? "",
     requiresPython,
     managedPython,
-    uvVersion,
-    uvRange,
+    requiresUv,
     requireEmbedding: options.requireEmbedding ?? parseBoolean(env["PYFIG_REQUIRE_EMBEDDING"], false),
     requireGil: options.requireGil ?? parseBoolean(env["PYFIG_REQUIRE_GIL"], false),
     autoInstall,
@@ -181,22 +178,9 @@ function uvEnvironment(options) {
     UV_NO_CONFIG: "1"
   };
 }
-function assertRange(tool, range) {
-  if (!import_semver.default.validRange(range)) {
-    throw new TypeError(`Invalid ${tool} SemVer range: ${range}`);
-  }
-}
-function assertUvVersion(version, range) {
-  if (!import_semver.default.valid(version)) {
-    throw new TypeError(`Invalid exact uv version: ${version}`);
-  }
-  if (!import_semver.default.satisfies(version, range)) {
-    throw new TypeError(`Pinned uv ${version} does not satisfy supported range ${range}.`);
-  }
-}
-function assertPythonSpecifier(specifier) {
-  if (!isValidPythonSpecifier(specifier)) {
-    throw new TypeError(`Invalid requires-python PEP 440 specifier: ${specifier}`);
+function assertPep440Specifier(name, specifier) {
+  if (!isValidPep440Specifier(specifier)) {
+    throw new TypeError(`Invalid ${name} PEP 440 specifier: ${specifier}`);
   }
 }
 function assertManagedPythonRequest(request, requiresPython) {
@@ -205,7 +189,7 @@ function assertManagedPythonRequest(request, requiresPython) {
   }
   if (/^\d+\.\d+(?:\.\d+)?$/u.test(request)) {
     const normalized = request.split(".").length === 2 ? `${request}.0` : request;
-    if (!pythonVersionSatisfies(normalized, requiresPython)) {
+    if (!pep440VersionSatisfies(normalized, requiresPython)) {
       throw new TypeError(`Managed Python ${request} cannot satisfy requires-python ${requiresPython}.`);
     }
   }
@@ -386,9 +370,6 @@ function assertNoTargetOverride(args) {
   }
 }
 
-// src/probes.ts
-var import_semver2 = __toESM(require("semver"), 1);
-
 // src/process.ts
 var import_node_child_process = require("node:child_process");
 var import_node_path4 = __toESM(require("node:path"), 1);
@@ -558,7 +539,7 @@ print(json.dumps({
 }))
 `;
 function pythonSatisfiesPolicy(python, options) {
-  return pythonVersionSatisfies(python.version, options.requiresPython) && (!options.requireEmbedding || python.implementation === "cpython" && python.embedding !== null && pythonArchitectureMatchesRuntime(python)) && (!options.requireGil || !python.gilDisabled);
+  return pep440VersionSatisfies(python.version, options.requiresPython) && (!options.requireEmbedding || python.implementation === "cpython" && python.embedding !== null && pythonArchitectureMatchesRuntime(python)) && (!options.requireGil || !python.gilDisabled);
 }
 async function probePython(candidate, options) {
   const executable = await resolveExecutable(candidate.executable, options.env);
@@ -567,7 +548,7 @@ async function probePython(candidate, options) {
   try {
     const { stdout } = run(executable, [...candidate.args, "-c", PYTHON_PROBE], options.env, options.probeTimeoutMs);
     const info = JSON.parse(stdout.trim());
-    return isValidPythonVersion(info.version) ? info : null;
+    return normalizePep440Version(info.version) ? info : null;
   } catch {
     return null;
   }
@@ -576,7 +557,7 @@ async function findUv(options) {
   const configured = options.env["PYFIG_UV"] ?? "uv";
   const executable = await resolveExecutable(configured, options.env);
   const uv = executable ? probeUv(executable, options) : null;
-  return uv && import_semver2.default.satisfies(uv.version, options.uvRange) ? uv : null;
+  return uv && pep440VersionSatisfies(uv.version, options.requiresUv) ? uv : null;
 }
 function probeUv(executable, options) {
   try {
@@ -590,7 +571,7 @@ function probeUv(executable, options) {
 function normalizeVersion(value) {
   if (!value)
     return null;
-  return import_semver2.default.valid(value) ?? import_semver2.default.coerce(value)?.version ?? null;
+  return normalizePep440Version(value);
 }
 function pythonArchitectureMatchesRuntime(python) {
   const architecture = python.architecture.toLowerCase();
@@ -829,21 +810,30 @@ async function ensureUvResolved(options) {
   if (existing)
     return existing;
   if (!options.installUv) {
-    throw new Error(`Compatible uv is unavailable (required ${options.uvRange}), and uv installation is disabled.`);
+    throw new Error(`Compatible uv is unavailable (requires-uv ${options.requiresUv}), and uv installation is disabled.`);
   }
-  const installDir = uvInstallDirectory(options);
-  const executable = uvExecutable(options);
+  const policyKey = import_node_crypto.createHash("sha256").update(options.requiresUv).digest("hex");
   return withProvisioningLock({
-    key: `uv:${canonicalPath(installDir)}`,
+    key: `uv-policy:${canonicalPath(uvInstallRoot(options))}:${policyKey}`,
     timeoutMs: options.coordinationTimeoutMs,
     check: () => findAvailableUv(options),
     mutate: async () => {
-      await installUv(installDir, options);
-      const result = probeUv(executable, options);
-      if (!result || result.version !== options.uvVersion) {
-        throw new Error(`Expected managed uv ${options.uvVersion}, but the installed executable did not match.`);
-      }
-      return result;
+      const release = await resolveUvRelease(options);
+      const installDir = uvInstallDirectory(options, release.version);
+      const executable = uvExecutable(options, release.version);
+      return withProvisioningLock({
+        key: `uv-release:${canonicalPath(installDir)}`,
+        timeoutMs: options.coordinationTimeoutMs,
+        check: () => findAvailableUv(options),
+        mutate: async () => {
+          await installUv(installDir, release, options);
+          const result = probeUv(executable, options);
+          if (!result || result.version !== release.version) {
+            throw new Error(`Expected managed uv ${release.version}, but the installed executable did not match.`);
+          }
+          return result;
+        }
+      });
     }
   });
 }
@@ -851,8 +841,21 @@ async function findAvailableUv(options) {
   const external = await findUv(options);
   if (external)
     return external;
-  const managed = probeUv(uvExecutable(options), options);
-  return managed?.version === options.uvVersion ? managed : null;
+  return findManagedUv(options);
+}
+async function findManagedUv(options) {
+  const entries = await import_promises.readdir(uvInstallRoot(options), { withFileTypes: true }).catch(() => []);
+  let versions = entries.filter((entry) => entry.isDirectory() && normalizePep440Version(entry.name) === entry.name).map((entry) => entry.name);
+  while (versions.length > 0) {
+    const selected = maxPep440Version(versions, options.requiresUv);
+    if (!selected)
+      return null;
+    const candidate = probeUv(uvExecutable(options, selected), options);
+    if (candidate?.version === selected)
+      return candidate;
+    versions = versions.filter((version) => version !== selected);
+  }
+  return null;
 }
 function normalizeDependencies(dependencies) {
   const normalized = dependencies.map((dependency) => dependency.trim());
@@ -913,15 +916,159 @@ async function virtualEnvironmentMatchesConfiguredPython(virtualEnvironment, opt
   const configuredBase = configured.virtualEnvironment ? configured.baseExecutable : configured.executable;
   return pathsEqual(configuredBase, virtualEnvironment.baseExecutable);
 }
-function uvInstallDirectory(options) {
-  return import_node_path5.default.join(options.cacheDir, "tools", "uv", options.uvVersion);
+var UV_RELEASE_PAGE_SIZE = 100;
+var UV_RELEASE_MAX_PAGES = 20;
+var UV_RELEASE_METADATA_TTL_MS = 24 * 60 * 60000;
+async function resolveUvRelease(options) {
+  const catalog = await ensureUvReleaseCatalog(options);
+  const asset = uvAsset();
+  const releases = catalog.releases.filter((release) => release.assets.includes(asset) && release.assets.includes(`${asset}.sha256`));
+  const version = maxPep440Version(releases.map((release) => release.version), options.requiresUv);
+  const release = releases.find((candidate) => candidate.version === version);
+  if (!release) {
+    throw new Error(`No published uv release satisfies requires-uv ${options.requiresUv}.`);
+  }
+  return release;
+}
+async function ensureUvReleaseCatalog(options) {
+  const file = uvReleaseMetadataFile(options);
+  const stale = await readUvReleaseCatalog(file);
+  try {
+    return await withProvisioningLock({
+      key: `uv-metadata:${canonicalPath(file)}`,
+      timeoutMs: options.coordinationTimeoutMs,
+      check: () => readFreshUvReleaseCatalog(file),
+      mutate: async () => {
+        const catalog = await fetchUvReleaseCatalog(options);
+        await writeUvReleaseCatalog(file, catalog);
+        return catalog;
+      }
+    });
+  } catch (error) {
+    const fallback = await readUvReleaseCatalog(file) ?? stale;
+    if (fallback)
+      return fallback;
+    throw error;
+  }
+}
+async function fetchUvReleaseCatalog(options) {
+  const dispatcher = proxyDispatcher(options.env);
+  const releases = new Map;
+  let exhausted = false;
+  try {
+    for (let page = 1;page <= UV_RELEASE_MAX_PAGES; page += 1) {
+      const text = await downloadText(`https://api.github.com/repos/astral-sh/uv/releases?per_page=${UV_RELEASE_PAGE_SIZE}&page=${page}`, options.downloadTimeoutMs, dispatcher, {
+        Accept: "application/vnd.github+json",
+        "User-Agent": "pyfig",
+        "X-GitHub-Api-Version": "2022-11-28"
+      });
+      const payload = JSON.parse(text);
+      if (!Array.isArray(payload)) {
+        throw new Error("GitHub returned invalid uv release metadata.");
+      }
+      for (const candidate of payload) {
+        if (!candidate || typeof candidate !== "object")
+          continue;
+        const release = candidate;
+        if (release.draft === true || typeof release.tag_name !== "string")
+          continue;
+        const assetNames = releaseAssetNames(release.assets);
+        const version = normalizePep440Version(release.tag_name);
+        if (version) {
+          releases.set(version, { assets: assetNames, tag: release.tag_name, version });
+        }
+      }
+      if (payload.length < UV_RELEASE_PAGE_SIZE) {
+        exhausted = true;
+        break;
+      }
+    }
+  } finally {
+    await dispatcher?.close();
+  }
+  if (!exhausted) {
+    throw new Error(`uv release catalog exceeded ${UV_RELEASE_MAX_PAGES} pages.`);
+  }
+  if (releases.size === 0) {
+    throw new Error("GitHub returned no usable uv releases.");
+  }
+  return { fetchedAt: Date.now(), releases: [...releases.values()] };
+}
+async function readFreshUvReleaseCatalog(file) {
+  const catalog = await readUvReleaseCatalog(file);
+  if (!catalog)
+    return null;
+  const age = Date.now() - catalog.fetchedAt;
+  return age >= 0 && age < UV_RELEASE_METADATA_TTL_MS ? catalog : null;
+}
+async function readUvReleaseCatalog(file) {
+  try {
+    return parseUvReleaseCatalog(JSON.parse(await import_promises.readFile(file, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function parseUvReleaseCatalog(value) {
+  if (!value || typeof value !== "object")
+    return null;
+  const catalog = value;
+  if (!Number.isSafeInteger(catalog.fetchedAt) || catalog.fetchedAt < 0 || !Array.isArray(catalog.releases)) {
+    return null;
+  }
+  const releases = [];
+  for (const value of catalog.releases) {
+    if (!value || typeof value !== "object")
+      return null;
+    const release = value;
+    if (!Array.isArray(release.assets) || !release.assets.every((asset) => typeof asset === "string") || typeof release.tag !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._+-]*$/u.test(release.tag) || typeof release.version !== "string" || normalizePep440Version(release.version) !== release.version) {
+      return null;
+    }
+    releases.push({
+      assets: release.assets,
+      tag: release.tag,
+      version: release.version
+    });
+  }
+  return { fetchedAt: catalog.fetchedAt, releases };
+}
+async function writeUvReleaseCatalog(file, catalog) {
+  await import_promises.mkdir(import_node_path5.default.dirname(file), { recursive: true });
+  const staged = import_node_path5.default.join(import_node_path5.default.dirname(file), `.${import_node_path5.default.basename(file)}.${process.pid}.${import_node_crypto.randomUUID()}.tmp`);
+  try {
+    await import_promises.writeFile(staged, `${JSON.stringify(catalog)}
+`, { encoding: "utf8", flag: "wx" });
+    if (process.platform === "win32")
+      await import_promises.rm(file, { force: true });
+    await import_promises.rename(staged, file);
+  } finally {
+    await import_promises.rm(staged, { force: true });
+  }
+}
+function uvReleaseMetadataFile(options) {
+  return import_node_path5.default.join(options.cacheDir, "metadata", "uv-releases.json");
+}
+function releaseAssetNames(value) {
+  if (!Array.isArray(value))
+    return [];
+  return value.flatMap((entry) => {
+    if (!entry || typeof entry !== "object")
+      return [];
+    const name = entry.name;
+    return typeof name === "string" ? [name] : [];
+  });
+}
+function uvInstallRoot(options) {
+  return import_node_path5.default.join(options.cacheDir, "tools", "uv");
+}
+function uvInstallDirectory(options, version) {
+  return import_node_path5.default.join(uvInstallRoot(options), version);
 }
-function uvExecutable(options) {
-  return import_node_path5.default.join(uvInstallDirectory(options), process.platform === "win32" ? "uv.exe" : "uv");
+function uvExecutable(options, version) {
+  return import_node_path5.default.join(uvInstallDirectory(options, version), process.platform === "win32" ? "uv.exe" : "uv");
 }
-async function installUv(installDir, options) {
+async function installUv(installDir, release, options) {
   const asset = uvAsset();
-  const baseUrl = `https://github.com/astral-sh/uv/releases/download/${options.uvVersion}`;
+  const baseUrl = `https://github.com/astral-sh/uv/releases/download/${release.tag}`;
   const temporary = await import_promises.mkdtemp(import_node_path5.default.join(import_node_os.default.tmpdir(), "pyfig-uv-"));
   const dispatcher = proxyDispatcher(options.env);
   try {
@@ -937,7 +1084,7 @@ async function installUv(installDir, options) {
     const source = await extractUvExecutable(archive, asset, extracted);
     if (!source)
       throw new Error(`uv archive did not contain the expected executable: ${asset}`);
-    await publishUvAtomically(source, installDir, options);
+    await publishUvAtomically(source, installDir, release.version, options);
   } finally {
     await dispatcher?.close();
     await import_promises.rm(temporary, { recursive: true, force: true });
@@ -959,17 +1106,17 @@ async function extractUvExecutable(archive, asset, destination) {
   await import_promises.writeFile(source, matches[0][1], { flag: "wx" });
   return source;
 }
-async function publishUvAtomically(source, installDir, options) {
+async function publishUvAtomically(source, installDir, version, options) {
   await import_promises.mkdir(installDir, { recursive: true });
-  const executable = uvExecutable(options);
+  const executable = uvExecutable(options, version);
   const staged = import_node_path5.default.join(installDir, `.${import_node_path5.default.basename(executable)}.${process.pid}.${import_node_crypto.randomUUID()}.tmp`);
   try {
     await import_promises.copyFile(source, staged);
     if (process.platform !== "win32")
       await import_promises.chmod(staged, 493);
     const stagedUv = probeUv(staged, options);
-    if (!stagedUv || stagedUv.version !== options.uvVersion) {
-      throw new Error(`Downloaded uv executable is not version ${options.uvVersion}.`);
+    if (!stagedUv || stagedUv.version !== version) {
+      throw new Error(`Downloaded uv executable is not version ${version}.`);
     }
     if (process.platform === "win32")
       await import_promises.rm(executable, { force: true });
@@ -1002,9 +1149,10 @@ async function download(url, destination, timeoutMs, dispatcher) {
   }
   await import_promises2.pipeline(import_node_stream.Readable.fromWeb(response.body), import_node_fs3.createWriteStream(destination, { flags: "wx" }));
 }
-async function downloadText(url, timeoutMs, dispatcher) {
+async function downloadText(url, timeoutMs, dispatcher, headers) {
   const response = await import_undici.fetch(url, {
     dispatcher,
+    headers,
     redirect: "follow",
     signal: AbortSignal.timeout(timeoutMs)
   });
@@ -1136,4 +1284,4 @@ function createPyfig(options = {}) {
   };
 }
 
-//# debugId=5564427996CDDBA964756E2164756E21
+//# debugId=25C05D1900A6412264756E2164756E21