pyfig 0.5.0 → 0.6.1

package/dist/cjs/sync-resolver.js

@@ -81,7 +81,21 @@ var import_undici = require("undici");
 // src/config.ts
 var import_node_path2 = __toESM(require("node:path"), 1);
 var envPaths = __toESM(require("env-paths"), 1);
-var import_semver = __toESM(require("semver"), 1);
+
+// src/pep440.ts
+var import_pep440 = require("@renovatebot/pep440");
+function isValidPep440Specifier(specifier) {
+  return import_pep440.validRange(specifier);
+}
+function normalizePep440Version(version) {
+  return import_pep440.valid(version);
+}
+function pep440VersionSatisfies(version, specifier) {
+  return import_pep440.filter([version], specifier).length === 1;
+}
+function maxPep440Version(versions, specifier) {
+  return import_pep440.maxSatisfying([...versions], specifier);
+}
 
 // src/project-root.ts
 var import_node_fs = __toESM(require("node:fs"), 1);
@@ -105,23 +119,10 @@ function* ancestors(startDirectory) {
   }
 }
 
-// src/python-version.ts
-var import_pep440 = require("@renovatebot/pep440");
-function isValidPythonSpecifier(specifier) {
-  return import_pep440.validRange(specifier);
-}
-function isValidPythonVersion(version) {
-  return import_pep440.valid(version) !== null;
-}
-function pythonVersionSatisfies(version, specifier) {
-  return import_pep440.filter([version], specifier).length === 1;
-}
-
 // src/config.ts
 var DEFAULT_REQUIRES_PYTHON = ">=3.10,<4";
 var DEFAULT_MANAGED_PYTHON = "3.12";
-var DEFAULT_UV_VERSION = "0.13.6";
-var DEFAULT_UV_RANGE = ">=0.10.0 <1.0.0";
+var DEFAULT_REQUIRES_UV = ">=0.10,<1";
 var DEFAULT_PROBE_TIMEOUT_MS = 1e4;
 var DEFAULT_INSTALL_TIMEOUT_MS = 10 * 60000;
 var DEFAULT_DOWNLOAD_TIMEOUT_MS = 5 * 60000;
@@ -135,13 +136,11 @@ var envPathsFunction = (() => {
 function resolveOptions(options = {}) {
   const env = { ...options.env ?? process.env };
   const requiresPython = options.requiresPython ?? env["PYFIG_REQUIRES_PYTHON"] ?? DEFAULT_REQUIRES_PYTHON;
-  const uvRange = options.uvRange ?? env["PYFIG_UV_RANGE"] ?? DEFAULT_UV_RANGE;
-  assertPythonSpecifier(requiresPython);
-  assertRange("uv", uvRange);
+  const requiresUv = options.requiresUv ?? env["PYFIG_REQUIRES_UV"] ?? DEFAULT_REQUIRES_UV;
+  assertPep440Specifier("requires-python", requiresPython);
+  assertPep440Specifier("requires-uv", requiresUv);
   const managedPython = options.managedPython ?? env["PYFIG_MANAGED_PYTHON"] ?? DEFAULT_MANAGED_PYTHON;
-  const uvVersion = options.uvVersion ?? env["PYFIG_UV_VERSION"] ?? DEFAULT_UV_VERSION;
   assertManagedPythonRequest(managedPython, requiresPython);
-  assertUvVersion(uvVersion, uvRange);
   const probeTimeoutMs = resolveDuration("probeTimeoutMs", options.probeTimeoutMs, env["PYFIG_PROBE_TIMEOUT_MS"], DEFAULT_PROBE_TIMEOUT_MS);
   const installTimeoutMs = resolveDuration("installTimeoutMs", options.installTimeoutMs, env["PYFIG_INSTALL_TIMEOUT_MS"], DEFAULT_INSTALL_TIMEOUT_MS);
   const downloadTimeoutMs = resolveDuration("downloadTimeoutMs", options.downloadTimeoutMs, env["PYFIG_DOWNLOAD_TIMEOUT_MS"], DEFAULT_DOWNLOAD_TIMEOUT_MS);
@@ -155,8 +154,7 @@ function resolveOptions(options = {}) {
     python: options.python ?? env["PYFIG_PYTHON"] ?? "",
     requiresPython,
     managedPython,
-    uvVersion,
-    uvRange,
+    requiresUv,
     requireEmbedding: options.requireEmbedding ?? parseBoolean(env["PYFIG_REQUIRE_EMBEDDING"], false),
     requireGil: options.requireGil ?? parseBoolean(env["PYFIG_REQUIRE_GIL"], false),
     autoInstall,
@@ -181,22 +179,9 @@ function uvEnvironment(options) {
     UV_NO_CONFIG: "1"
   };
 }
-function assertRange(tool, range) {
-  if (!import_semver.default.validRange(range)) {
-    throw new TypeError(`Invalid ${tool} SemVer range: ${range}`);
-  }
-}
-function assertUvVersion(version, range) {
-  if (!import_semver.default.valid(version)) {
-    throw new TypeError(`Invalid exact uv version: ${version}`);
-  }
-  if (!import_semver.default.satisfies(version, range)) {
-    throw new TypeError(`Pinned uv ${version} does not satisfy supported range ${range}.`);
-  }
-}
-function assertPythonSpecifier(specifier) {
-  if (!isValidPythonSpecifier(specifier)) {
-    throw new TypeError(`Invalid requires-python PEP 440 specifier: ${specifier}`);
+function assertPep440Specifier(name, specifier) {
+  if (!isValidPep440Specifier(specifier)) {
+    throw new TypeError(`Invalid ${name} PEP 440 specifier: ${specifier}`);
   }
 }
 function assertManagedPythonRequest(request, requiresPython) {
@@ -205,7 +190,7 @@ function assertManagedPythonRequest(request, requiresPython) {
   }
   if (/^\d+\.\d+(?:\.\d+)?$/u.test(request)) {
     const normalized = request.split(".").length === 2 ? `${request}.0` : request;
-    if (!pythonVersionSatisfies(normalized, requiresPython)) {
+    if (!pep440VersionSatisfies(normalized, requiresPython)) {
       throw new TypeError(`Managed Python ${request} cannot satisfy requires-python ${requiresPython}.`);
     }
   }
@@ -371,9 +356,6 @@ function assertNoTargetOverride(args) {
   }
 }
 
-// src/probes.ts
-var import_semver2 = __toESM(require("semver"), 1);
-
 // src/process.ts
 var import_node_child_process = require("node:child_process");
 var import_node_path4 = __toESM(require("node:path"), 1);
@@ -543,7 +525,7 @@ print(json.dumps({
 }))
 `;
 function pythonSatisfiesPolicy(python, options) {
-  return pythonVersionSatisfies(python.version, options.requiresPython) && (!options.requireEmbedding || python.implementation === "cpython" && python.embedding !== null && pythonArchitectureMatchesRuntime(python)) && (!options.requireGil || !python.gilDisabled);
+  return pep440VersionSatisfies(python.version, options.requiresPython) && (!options.requireEmbedding || python.implementation === "cpython" && python.embedding !== null && pythonArchitectureMatchesRuntime(python)) && (!options.requireGil || !python.gilDisabled);
 }
 async function probePython(candidate, options) {
   const executable = await resolveExecutable(candidate.executable, options.env);
@@ -552,7 +534,7 @@ async function probePython(candidate, options) {
   try {
     const { stdout } = run(executable, [...candidate.args, "-c", PYTHON_PROBE], options.env, options.probeTimeoutMs);
     const info = JSON.parse(stdout.trim());
-    return isValidPythonVersion(info.version) ? info : null;
+    return normalizePep440Version(info.version) ? info : null;
   } catch {
     return null;
   }
@@ -561,7 +543,7 @@ async function findUv(options) {
   const configured = options.env["PYFIG_UV"] ?? "uv";
   const executable = await resolveExecutable(configured, options.env);
   const uv = executable ? probeUv(executable, options) : null;
-  return uv && import_semver2.default.satisfies(uv.version, options.uvRange) ? uv : null;
+  return uv && pep440VersionSatisfies(uv.version, options.requiresUv) ? uv : null;
 }
 function probeUv(executable, options) {
   try {
@@ -575,7 +557,7 @@ function probeUv(executable, options) {
 function normalizeVersion(value) {
   if (!value)
     return null;
-  return import_semver2.default.valid(value) ?? import_semver2.default.coerce(value)?.version ?? null;
+  return normalizePep440Version(value);
 }
 function pythonArchitectureMatchesRuntime(python) {
   const architecture = python.architecture.toLowerCase();
@@ -814,21 +796,30 @@ async function ensureUvResolved(options) {
   if (existing)
     return existing;
   if (!options.installUv) {
-    throw new Error(`Compatible uv is unavailable (required ${options.uvRange}), and uv installation is disabled.`);
+    throw new Error(`Compatible uv is unavailable (requires-uv ${options.requiresUv}), and uv installation is disabled.`);
   }
-  const installDir = uvInstallDirectory(options);
-  const executable = uvExecutable(options);
+  const policyKey = import_node_crypto.createHash("sha256").update(options.requiresUv).digest("hex");
   return withProvisioningLock({
-    key: `uv:${canonicalPath(installDir)}`,
+    key: `uv-policy:${canonicalPath(uvInstallRoot(options))}:${policyKey}`,
     timeoutMs: options.coordinationTimeoutMs,
     check: () => findAvailableUv(options),
     mutate: async () => {
-      await installUv(installDir, options);
-      const result = probeUv(executable, options);
-      if (!result || result.version !== options.uvVersion) {
-        throw new Error(`Expected managed uv ${options.uvVersion}, but the installed executable did not match.`);
-      }
-      return result;
+      const release = await resolveUvRelease(options);
+      const installDir = uvInstallDirectory(options, release.version);
+      const executable = uvExecutable(options, release.version);
+      return withProvisioningLock({
+        key: `uv-release:${canonicalPath(installDir)}`,
+        timeoutMs: options.coordinationTimeoutMs,
+        check: () => findAvailableUv(options),
+        mutate: async () => {
+          await installUv(installDir, release, options);
+          const result = probeUv(executable, options);
+          if (!result || result.version !== release.version) {
+            throw new Error(`Expected managed uv ${release.version}, but the installed executable did not match.`);
+          }
+          return result;
+        }
+      });
     }
   });
 }
@@ -836,8 +827,21 @@ async function findAvailableUv(options) {
   const external = await findUv(options);
   if (external)
     return external;
-  const managed = probeUv(uvExecutable(options), options);
-  return managed?.version === options.uvVersion ? managed : null;
+  return findManagedUv(options);
+}
+async function findManagedUv(options) {
+  const entries = await import_promises.readdir(uvInstallRoot(options), { withFileTypes: true }).catch(() => []);
+  let versions = entries.filter((entry) => entry.isDirectory() && normalizePep440Version(entry.name) === entry.name).map((entry) => entry.name);
+  while (versions.length > 0) {
+    const selected = maxPep440Version(versions, options.requiresUv);
+    if (!selected)
+      return null;
+    const candidate = probeUv(uvExecutable(options, selected), options);
+    if (candidate?.version === selected)
+      return candidate;
+    versions = versions.filter((version) => version !== selected);
+  }
+  return null;
 }
 function normalizeDependencies(dependencies) {
   const normalized = dependencies.map((dependency) => dependency.trim());
@@ -898,15 +902,159 @@ async function virtualEnvironmentMatchesConfiguredPython(virtualEnvironment, opt
   const configuredBase = configured.virtualEnvironment ? configured.baseExecutable : configured.executable;
   return pathsEqual(configuredBase, virtualEnvironment.baseExecutable);
 }
-function uvInstallDirectory(options) {
-  return import_node_path5.default.join(options.cacheDir, "tools", "uv", options.uvVersion);
+var UV_RELEASE_PAGE_SIZE = 100;
+var UV_RELEASE_MAX_PAGES = 20;
+var UV_RELEASE_METADATA_TTL_MS = 24 * 60 * 60000;
+async function resolveUvRelease(options) {
+  const catalog = await ensureUvReleaseCatalog(options);
+  const asset = uvAsset();
+  const releases = catalog.releases.filter((release) => release.assets.includes(asset) && release.assets.includes(`${asset}.sha256`));
+  const version = maxPep440Version(releases.map((release) => release.version), options.requiresUv);
+  const release = releases.find((candidate) => candidate.version === version);
+  if (!release) {
+    throw new Error(`No published uv release satisfies requires-uv ${options.requiresUv}.`);
+  }
+  return release;
+}
+async function ensureUvReleaseCatalog(options) {
+  const file = uvReleaseMetadataFile(options);
+  const stale = await readUvReleaseCatalog(file);
+  try {
+    return await withProvisioningLock({
+      key: `uv-metadata:${canonicalPath(file)}`,
+      timeoutMs: options.coordinationTimeoutMs,
+      check: () => readFreshUvReleaseCatalog(file),
+      mutate: async () => {
+        const catalog = await fetchUvReleaseCatalog(options);
+        await writeUvReleaseCatalog(file, catalog);
+        return catalog;
+      }
+    });
+  } catch (error) {
+    const fallback = await readUvReleaseCatalog(file) ?? stale;
+    if (fallback)
+      return fallback;
+    throw error;
+  }
+}
+async function fetchUvReleaseCatalog(options) {
+  const dispatcher = proxyDispatcher(options.env);
+  const releases = new Map;
+  let exhausted = false;
+  try {
+    for (let page = 1;page <= UV_RELEASE_MAX_PAGES; page += 1) {
+      const text = await downloadText(`https://api.github.com/repos/astral-sh/uv/releases?per_page=${UV_RELEASE_PAGE_SIZE}&page=${page}`, options.downloadTimeoutMs, dispatcher, {
+        Accept: "application/vnd.github+json",
+        "User-Agent": "pyfig",
+        "X-GitHub-Api-Version": "2022-11-28"
+      });
+      const payload = JSON.parse(text);
+      if (!Array.isArray(payload)) {
+        throw new Error("GitHub returned invalid uv release metadata.");
+      }
+      for (const candidate of payload) {
+        if (!candidate || typeof candidate !== "object")
+          continue;
+        const release = candidate;
+        if (release.draft === true || typeof release.tag_name !== "string")
+          continue;
+        const assetNames = releaseAssetNames(release.assets);
+        const version = normalizePep440Version(release.tag_name);
+        if (version) {
+          releases.set(version, { assets: assetNames, tag: release.tag_name, version });
+        }
+      }
+      if (payload.length < UV_RELEASE_PAGE_SIZE) {
+        exhausted = true;
+        break;
+      }
+    }
+  } finally {
+    await dispatcher?.close();
+  }
+  if (!exhausted) {
+    throw new Error(`uv release catalog exceeded ${UV_RELEASE_MAX_PAGES} pages.`);
+  }
+  if (releases.size === 0) {
+    throw new Error("GitHub returned no usable uv releases.");
+  }
+  return { fetchedAt: Date.now(), releases: [...releases.values()] };
+}
+async function readFreshUvReleaseCatalog(file) {
+  const catalog = await readUvReleaseCatalog(file);
+  if (!catalog)
+    return null;
+  const age = Date.now() - catalog.fetchedAt;
+  return age >= 0 && age < UV_RELEASE_METADATA_TTL_MS ? catalog : null;
+}
+async function readUvReleaseCatalog(file) {
+  try {
+    return parseUvReleaseCatalog(JSON.parse(await import_promises.readFile(file, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function parseUvReleaseCatalog(value) {
+  if (!value || typeof value !== "object")
+    return null;
+  const catalog = value;
+  if (!Number.isSafeInteger(catalog.fetchedAt) || catalog.fetchedAt < 0 || !Array.isArray(catalog.releases)) {
+    return null;
+  }
+  const releases = [];
+  for (const value of catalog.releases) {
+    if (!value || typeof value !== "object")
+      return null;
+    const release = value;
+    if (!Array.isArray(release.assets) || !release.assets.every((asset) => typeof asset === "string") || typeof release.tag !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._+-]*$/u.test(release.tag) || typeof release.version !== "string" || normalizePep440Version(release.version) !== release.version) {
+      return null;
+    }
+    releases.push({
+      assets: release.assets,
+      tag: release.tag,
+      version: release.version
+    });
+  }
+  return { fetchedAt: catalog.fetchedAt, releases };
+}
+async function writeUvReleaseCatalog(file, catalog) {
+  await import_promises.mkdir(import_node_path5.default.dirname(file), { recursive: true });
+  const staged = import_node_path5.default.join(import_node_path5.default.dirname(file), `.${import_node_path5.default.basename(file)}.${process.pid}.${import_node_crypto.randomUUID()}.tmp`);
+  try {
+    await import_promises.writeFile(staged, `${JSON.stringify(catalog)}
+`, { encoding: "utf8", flag: "wx" });
+    if (process.platform === "win32")
+      await import_promises.rm(file, { force: true });
+    await import_promises.rename(staged, file);
+  } finally {
+    await import_promises.rm(staged, { force: true });
+  }
+}
+function uvReleaseMetadataFile(options) {
+  return import_node_path5.default.join(options.cacheDir, "metadata", "uv-releases.json");
+}
+function releaseAssetNames(value) {
+  if (!Array.isArray(value))
+    return [];
+  return value.flatMap((entry) => {
+    if (!entry || typeof entry !== "object")
+      return [];
+    const name = entry.name;
+    return typeof name === "string" ? [name] : [];
+  });
+}
+function uvInstallRoot(options) {
+  return import_node_path5.default.join(options.cacheDir, "tools", "uv");
+}
+function uvInstallDirectory(options, version) {
+  return import_node_path5.default.join(uvInstallRoot(options), version);
 }
-function uvExecutable(options) {
-  return import_node_path5.default.join(uvInstallDirectory(options), process.platform === "win32" ? "uv.exe" : "uv");
+function uvExecutable(options, version) {
+  return import_node_path5.default.join(uvInstallDirectory(options, version), process.platform === "win32" ? "uv.exe" : "uv");
 }
-async function installUv(installDir, options) {
+async function installUv(installDir, release, options) {
   const asset = uvAsset();
-  const baseUrl = `https://github.com/astral-sh/uv/releases/download/${options.uvVersion}`;
+  const baseUrl = `https://github.com/astral-sh/uv/releases/download/${release.tag}`;
   const temporary = await import_promises.mkdtemp(import_node_path5.default.join(import_node_os.default.tmpdir(), "pyfig-uv-"));
   const dispatcher = proxyDispatcher(options.env);
   try {
@@ -922,7 +1070,7 @@ async function installUv(installDir, options) {
     const source = await extractUvExecutable(archive, asset, extracted);
     if (!source)
       throw new Error(`uv archive did not contain the expected executable: ${asset}`);
-    await publishUvAtomically(source, installDir, options);
+    await publishUvAtomically(source, installDir, release.version, options);
   } finally {
     await dispatcher?.close();
     await import_promises.rm(temporary, { recursive: true, force: true });
@@ -944,17 +1092,17 @@ async function extractUvExecutable(archive, asset, destination) {
   await import_promises.writeFile(source, matches[0][1], { flag: "wx" });
   return source;
 }
-async function publishUvAtomically(source, installDir, options) {
+async function publishUvAtomically(source, installDir, version, options) {
   await import_promises.mkdir(installDir, { recursive: true });
-  const executable = uvExecutable(options);
+  const executable = uvExecutable(options, version);
   const staged = import_node_path5.default.join(installDir, `.${import_node_path5.default.basename(executable)}.${process.pid}.${import_node_crypto.randomUUID()}.tmp`);
   try {
     await import_promises.copyFile(source, staged);
     if (process.platform !== "win32")
       await import_promises.chmod(staged, 493);
     const stagedUv = probeUv(staged, options);
-    if (!stagedUv || stagedUv.version !== options.uvVersion) {
-      throw new Error(`Downloaded uv executable is not version ${options.uvVersion}.`);
+    if (!stagedUv || stagedUv.version !== version) {
+      throw new Error(`Downloaded uv executable is not version ${version}.`);
     }
     if (process.platform === "win32")
       await import_promises.rm(executable, { force: true });
@@ -987,9 +1135,10 @@ async function download(url, destination, timeoutMs, dispatcher) {
   }
   await import_promises2.pipeline(import_node_stream.Readable.fromWeb(response.body), import_node_fs3.createWriteStream(destination, { flags: "wx" }));
 }
-async function downloadText(url, timeoutMs, dispatcher) {
+async function downloadText(url, timeoutMs, dispatcher, headers) {
   const response = await import_undici.fetch(url, {
     dispatcher,
+    headers,
     redirect: "follow",
     signal: AbortSignal.timeout(timeoutMs)
   });
@@ -1045,4 +1194,4 @@ main().catch((error) => {
   process.exitCode = 1;
 });
 
-//# debugId=8D6E1E9C1BFA227064756E2164756E21
+//# debugId=D02BE720BF896D6864756E2164756E21