pyfig 0.6.2 → 0.7.0

package/dist/cjs/sync-resolver.js

@@ -63,17 +63,16 @@ var __export = (target, all) => {
 };
 
 // src/sync-resolver.ts
-var import_node_fs5 = require("node:fs");
+var import_node_fs4 = require("node:fs");
 
 // src/provision.ts
-var import_node_crypto = require("node:crypto");
+var import_node_crypto2 = require("node:crypto");
 var import_node_fs3 = require("node:fs");
-var import_promises = require("node:fs/promises");
-var import_node_fs4 = __toESM(require("node:fs"), 1);
+var import_promises2 = require("node:fs/promises");
 var import_node_os = __toESM(require("node:os"), 1);
-var import_node_path5 = __toESM(require("node:path"), 1);
+var import_node_path6 = __toESM(require("node:path"), 1);
 var import_node_stream = require("node:stream");
-var import_promises2 = require("node:stream/promises");
+var import_promises3 = require("node:stream/promises");
 var import_fflate = require("fflate");
 var tar = __toESM(require("tar"), 1);
 var import_undici = require("undici");
@@ -150,7 +149,11 @@ function resolveOptions(options = {}) {
   const configuredProjectRoot = options.projectRoot ?? env["PYFIG_PROJECT_ROOT"];
   const projectRoot = configuredProjectRoot ? import_node_path2.default.resolve(configuredProjectRoot) : resolveProjectRoot(env["INIT_CWD"] ?? process.cwd());
   const autoInstall = options.autoInstall ?? parseBoolean(env["PYFIG_AUTO_INSTALL"], true);
+  const dependencies = normalizeDependencies(options.dependencies ?? []);
+  const requirements = normalizeRequirements(options.requirements ?? [], projectRoot);
   return {
+    dependencies,
+    requirements,
     python: options.python ?? env["PYFIG_PYTHON"] ?? "",
     requiresPython,
     managedPython,
@@ -170,7 +173,10 @@ function resolveOptions(options = {}) {
     env
   };
 }
-function uvEnvironment(options) {
+function hasRuntimeRequirements(options) {
+  return options.dependencies.length > 0 || options.requirements.length > 0;
+}
+function uvProcessEnvironment(options) {
   return {
     ...options.env,
     UV_PYTHON_INSTALL_DIR: import_node_path2.default.join(options.cacheDir, "python"),
@@ -212,46 +218,68 @@ function parseBoolean(value, fallback) {
     return false;
   throw new TypeError(`Invalid boolean value: ${value}`);
 }
-
-// src/provision-lock.ts
-var import_loqkit = require("loqkit");
-async function withProvisioningLock(options) {
-  let existing;
-  const result = await import_loqkit.withLock({ resource: options.key }, options.mutate, {
-    key: options.key,
-    name: "Pyfig provisioning",
-    namespace: "pyfig",
-    timeout: options.timeoutMs,
-    predicate: async () => {
-      const value = await options.check();
-      if (value === null)
-        return true;
-      existing = { value };
-      return false;
+function normalizeDependencies(dependencies) {
+  const normalized = dependencies.map((dependency) => dependency.trim());
+  for (const dependency of normalized) {
+    if (!dependency || /[\0\r\n]/u.test(dependency)) {
+      throw new TypeError(`Invalid runtime dependency: ${JSON.stringify(dependency)}`);
     }
-  });
-  if (result.context.state === "executed")
-    return result.value;
-  if (existing)
-    return existing.value;
-  throw new Error(`Provisioning check for ${options.key} did not produce a resource.`);
+  }
+  return normalized;
+}
+function normalizeRequirements(requirements, projectRoot) {
+  const normalized = [];
+  for (const requirement of requirements) {
+    const candidate = requirement.trim();
+    if (!candidate || /[\0\r\n]/u.test(candidate)) {
+      throw new TypeError(`Invalid requirements file path: ${JSON.stringify(candidate)}`);
+    }
+    const absolute = import_node_path2.default.resolve(projectRoot, candidate);
+    const basename = import_node_path2.default.basename(absolute).toLowerCase();
+    if (isPythonProjectFile(basename)) {
+      throw new TypeError(`Expected a requirements file, not Python project metadata: ${absolute}`);
+    }
+    normalized.push(absolute);
+  }
+  return normalized;
+}
+var PYTHON_PROJECT_FILES = new Set([
+  "pdm.lock",
+  "pipfile",
+  "pipfile.lock",
+  "poetry.lock",
+  "pyproject.toml",
+  "setup.cfg",
+  "setup.py",
+  "uv.lock"
+]);
+function isPythonProjectFile(basename) {
+  return PYTHON_PROJECT_FILES.has(basename) || /^pylock(?:\.[^.]+)?\.toml$/u.test(basename);
 }
 
-// src/virtual-environment.ts
+// src/venv-identity.ts
+var import_node_crypto = require("node:crypto");
+var import_promises = require("node:fs/promises");
+var import_node_path4 = __toESM(require("node:path"), 1);
+
+// src/python-venv.ts
 var import_node_fs2 = __toESM(require("node:fs"), 1);
 var import_node_path3 = __toESM(require("node:path"), 1);
-var VIRTUAL_ENV_DIRECTORY_NAME = import_node_path3.default.join("node_modules", ".pyfig", "venv");
-function virtualEnvironmentDirectory(projectRoot) {
-  return import_node_path3.default.join(projectRoot, VIRTUAL_ENV_DIRECTORY_NAME);
+var VIRTUAL_ENV_ROOT_NAME = import_node_path3.default.join("node_modules", ".pyfig", "venvs");
+function pythonVenvRoot(projectRoot) {
+  return import_node_path3.default.join(projectRoot, VIRTUAL_ENV_ROOT_NAME);
 }
-function externalVirtualEnvironmentDirectories(projectRoot, env) {
+function pythonVenvDirectory(projectRoot, venvDirectory) {
+  return import_node_path3.default.join(pythonVenvRoot(projectRoot), venvDirectory);
+}
+function externalPythonVenvDirectories(projectRoot, env) {
   const candidates = [env["VIRTUAL_ENV"], import_node_path3.default.join(projectRoot, ".venv")].filter((value) => Boolean(value)).map((value) => import_node_path3.default.resolve(value));
   return [...new Map(candidates.map((value) => [canonicalPath(value), value])).values()];
 }
-function virtualEnvironmentPythonExecutable(virtualEnvironment) {
-  return import_node_path3.default.join(virtualEnvironment, process.platform === "win32" ? "Scripts" : "bin", process.platform === "win32" ? "python.exe" : "python");
+function pythonVenvExecutable(pythonVenv) {
+  return import_node_path3.default.join(pythonVenv, process.platform === "win32" ? "Scripts" : "bin", process.platform === "win32" ? "python.exe" : "python");
 }
-function activateVirtualEnvironment(env, virtualEnvironment, pythonExecutable) {
+function activatePythonVenv(env, pythonVenv, pythonExecutable) {
   const activated = { ...env };
   const pathEntry = Object.keys(activated).find((key) => key.toUpperCase() === "PATH");
   const existingPath = pathEntry ? activated[pathEntry] : undefined;
@@ -262,7 +290,7 @@ function activateVirtualEnvironment(env, virtualEnvironment, pythonExecutable) {
     }
   }
   activated["PATH"] = [import_node_path3.default.dirname(pythonExecutable), existingPath].filter((value) => Boolean(value)).join(import_node_path3.default.delimiter);
-  activated["VIRTUAL_ENV"] = virtualEnvironment;
+  activated["VIRTUAL_ENV"] = pythonVenv;
   return activated;
 }
 function pathsEqual(left, right) {
@@ -277,6 +305,102 @@ function canonicalPath(value) {
   return process.platform === "win32" ? canonical.toLowerCase() : canonical;
 }
 
+// src/venv-identity.ts
+var VENV_SCHEMA = 1;
+var VENV_METADATA = ".pyfig-venv.json";
+function createVenvIdentity(python, requirementsSha256) {
+  const contract = {
+    schema: VENV_SCHEMA,
+    runtime: {
+      architecture: process.arch,
+      platform: process.platform
+    },
+    python: {
+      architecture: python.architecture,
+      baseExecutable: canonicalPath(python.executable),
+      basePrefix: canonicalPath(python.basePrefix),
+      embeddingHeader: python.embedding ? canonicalPath(python.embedding.headerPath) : null,
+      embeddingLibrary: python.embedding ? canonicalPath(python.embedding.libraryPath) : null,
+      gilDisabled: python.gilDisabled,
+      implementation: python.implementation,
+      pointerBits: python.pointerBits,
+      version: python.version
+    },
+    requirementsSha256
+  };
+  const id = sha256(JSON.stringify(contract));
+  const implementation = safePathSegment(python.implementation);
+  const version = safePathSegment(python.version);
+  return {
+    contract,
+    directoryName: `${implementation}-${version}-${id.slice(0, 20)}`,
+    id
+  };
+}
+function requirementsDigest(content) {
+  return sha256(content);
+}
+function venvMetadataFile(directory) {
+  return import_node_path4.default.join(directory, VENV_METADATA);
+}
+async function venvMatches(directory, venv) {
+  try {
+    const parsed = JSON.parse(await import_promises.readFile(venvMetadataFile(directory), "utf8"));
+    return parsed.venvId === venv.id && JSON.stringify(parsed.contract) === JSON.stringify(venv.contract);
+  } catch {
+    return false;
+  }
+}
+async function writeVenvMetadata(directory, venv) {
+  await import_promises.mkdir(directory, { recursive: true });
+  const file = venvMetadataFile(directory);
+  const staged = `${file}.${process.pid}.${import_node_crypto.randomUUID()}.tmp`;
+  const metadata = {
+    contract: venv.contract,
+    venvId: venv.id
+  };
+  try {
+    await import_promises.writeFile(staged, `${JSON.stringify(metadata, null, 2)}
+`, {
+      encoding: "utf8",
+      flag: "wx"
+    });
+    await import_promises.rename(staged, file);
+  } finally {
+    await import_promises.rm(staged, { force: true });
+  }
+}
+function safePathSegment(value) {
+  return value.toLowerCase().replace(/[^a-z0-9.-]+/gu, "-").replace(/^-+|-+$/gu, "") || "python";
+}
+function sha256(value) {
+  return import_node_crypto.createHash("sha256").update(value).digest("hex");
+}
+
+// src/provision-lock.ts
+var import_loqkit = require("loqkit");
+async function withProvisioningLock(options) {
+  let existing;
+  const result = await import_loqkit.withLock({ resource: options.key }, options.mutate, {
+    key: options.key,
+    name: "Pyfig provisioning",
+    namespace: "pyfig",
+    timeout: options.timeoutMs,
+    predicate: async () => {
+      const value = await options.check();
+      if (value === null)
+        return true;
+      existing = { value };
+      return false;
+    }
+  });
+  if (result.context.state === "executed")
+    return result.value;
+  if (existing)
+    return existing.value;
+  throw new Error(`Provisioning check for ${options.key} did not produce a resource.`);
+}
+
 // src/package-target.ts
 var TARGET_OPTIONS = new Set([
   "--active",
@@ -309,7 +433,7 @@ var TARGET_ENVIRONMENT_VARIABLES = new Set([
   "UV_SYSTEM_PYTHON",
   "UV_TARGET"
 ]);
-function uvCommandNeedsEnvironment(args) {
+function uvCommandNeedsPython(args) {
   return args[0] === "pip" || args[0] === "run";
 }
 function targetUvArguments(args, python) {
@@ -325,16 +449,16 @@ function targetUvArguments(args, python) {
   }
   return [...args];
 }
-function uvCommandEnvironment(env, python) {
-  const sanitized = sanitizeUvEnvironment(env);
+function uvCommandProcessEnvironment(env, python) {
+  const sanitized = sanitizeUvProcessEnvironment(env);
   if (!python?.virtualEnvironment)
     return sanitized;
   return {
-    ...activateVirtualEnvironment(sanitized, python.virtualEnvironment, python.executable),
+    ...activatePythonVenv(sanitized, python.virtualEnvironment, python.executable),
     UV_PYTHON: python.executable
   };
 }
-function sanitizeUvEnvironment(env) {
+function sanitizeUvProcessEnvironment(env) {
   const sanitized = { ...env };
   for (const key of Object.keys(sanitized)) {
     if (TARGET_ENVIRONMENT_VARIABLES.has(key.toUpperCase()))
@@ -358,12 +482,12 @@ function assertNoTargetOverride(args) {
 
 // src/process.ts
 var import_node_child_process = require("node:child_process");
-var import_node_path4 = __toESM(require("node:path"), 1);
+var import_node_path5 = __toESM(require("node:path"), 1);
 var import_which = __toESM(require("which"), 1);
 async function resolveExecutable(value, env) {
   if (!value)
     return null;
-  if (import_node_path4.default.isAbsolute(value)) {
+  if (import_node_path5.default.isAbsolute(value)) {
     return await import_which.default(value, { nothrow: true, path: env["PATH"], pathExt: env["PATHEXT"] });
   }
   if (!/^[A-Za-z0-9_.-]+$/u.test(value))
@@ -380,7 +504,7 @@ function run(executable, args, env, timeoutMs) {
   });
   if (result.status !== 0 || result.error) {
     const detail = result.stderr?.trim() || result.error?.message || `exit ${result.status}`;
-    throw new Error(`${import_node_path4.default.basename(executable)} ${args.slice(0, 3).join(" ")} failed: ${detail}`);
+    throw new Error(`${import_node_path5.default.basename(executable)} ${args.slice(0, 3).join(" ")} failed: ${detail}`);
   }
   return { stdout: result.stdout, stderr: result.stderr };
 }
@@ -409,11 +533,11 @@ async function runAsync(executable, args, env, timeoutMs, signal, cwd) {
     const abort = () => {
       child.kill();
       const reason = signal?.reason;
-      finish(reason instanceof Error ? reason : new Error(`${import_node_path4.default.basename(executable)} was aborted.`));
+      finish(reason instanceof Error ? reason : new Error(`${import_node_path5.default.basename(executable)} was aborted.`));
     };
     const timer = setTimeout(() => {
       child.kill();
-      finish(new Error(`${import_node_path4.default.basename(executable)} timed out after ${timeoutMs}ms.`));
+      finish(new Error(`${import_node_path5.default.basename(executable)} timed out after ${timeoutMs}ms.`));
     }, timeoutMs);
     child.stdout.setEncoding("utf8");
     child.stderr.setEncoding("utf8");
@@ -421,21 +545,21 @@ async function runAsync(executable, args, env, timeoutMs, signal, cwd) {
       stdout += chunk;
       if (stdout.length > 4 * 1024 * 1024) {
         child.kill();
-        finish(new Error(`${import_node_path4.default.basename(executable)} exceeded the output limit.`));
+        finish(new Error(`${import_node_path5.default.basename(executable)} exceeded the output limit.`));
       }
     });
     child.stderr.on("data", (chunk) => {
       stderr += chunk;
       if (stderr.length > 4 * 1024 * 1024) {
         child.kill();
-        finish(new Error(`${import_node_path4.default.basename(executable)} exceeded the error-output limit.`));
+        finish(new Error(`${import_node_path5.default.basename(executable)} exceeded the error-output limit.`));
       }
     });
     child.once("error", (error) => finish(error));
     child.once("close", (code, childSignal) => {
       if (code !== 0) {
         const detail = stderr.trim() || (childSignal ? `signal ${childSignal}` : `exit ${code}`);
-        finish(new Error(`${import_node_path4.default.basename(executable)} ${args.slice(0, 3).join(" ")} failed: ${detail}`));
+        finish(new Error(`${import_node_path5.default.basename(executable)} ${args.slice(0, 3).join(" ")} failed: ${detail}`));
         return;
       }
       finish(undefined, { stdout, stderr });
@@ -589,59 +713,71 @@ function pythonArchitectureMatchesRuntime(python) {
 async function ensureUv(options = {}) {
   return ensureUvResolved(resolveOptions(options));
 }
-async function ensureEnvironment(options = {}, dependencies = [], dependencyOptions = {}) {
+async function ensurePython(options = {}) {
   const resolved = resolveOptions(options);
-  const normalized = normalizeDependencies(dependencies);
-  const selections = normalizeDependencyOptions(dependencyOptions);
+  await validateRequirementsFiles(resolved.requirements);
   const uv = await ensureUvResolved(resolved);
-  const python = await ensureVirtualEnvironmentResolved(resolved, uv);
-  if (normalized.length > 0 || selections.extras.length > 0 || selections.groups.length > 0 || selections.allExtras) {
-    await installRuntimeDependencies(uv, python, normalized, selections, resolved);
+  if (!hasRuntimeRequirements(resolved)) {
+    const external = await findReusableExternalPythonVenv(resolved);
+    if (external) {
+      return { managed: false, python: external, uv, venvId: null };
+    }
   }
-  return {
-    python,
-    uv,
-    managed: isManagedEnvironment(python, resolved)
+  const basePython = await ensureBasePythonResolved(uv, resolved);
+  const resolution = await resolveRuntimeDependencies(uv, basePython, resolved);
+  const venv = createVenvIdentity(basePython, resolution.sha256);
+  const python = await ensureManagedPythonVenv(uv, basePython, venv, resolution, resolved);
+  return { managed: true, python, uv, venvId: venv.id };
+}
+async function ensureManagedPythonVenv(uv, basePython, venv, resolution, options) {
+  const directory = pythonVenvDirectory(options.projectRoot, venv.directoryName);
+  const check = async () => {
+    if (!await venvMatches(directory, venv))
+      return null;
+    const candidate = await inspectPythonVenv(directory, options);
+    return candidate && pythonSatisfiesPolicy(candidate, options) ? candidate : null;
   };
-}
-async function ensureVirtualEnvironmentResolved(options, uv) {
-  const existing = await findReusableEnvironment(options);
+  const existing = await check();
   if (existing)
     return existing;
-  const directory = virtualEnvironmentDirectory(options.projectRoot);
-  const check = async () => {
-    const candidate = await inspectVirtualEnvironment(directory, options);
-    return candidate && pythonSatisfiesPolicy(candidate, options) && await virtualEnvironmentMatchesConfiguredPython(candidate, options) ? candidate : null;
-  };
   if (!options.createVirtualEnvironment) {
     throw new Error(`No compatible environment is available and creation is disabled. ` + `Pyfig would create ${directory}.`);
   }
-  const basePython = await ensureBasePythonResolved(uv, options);
   return withProvisioningLock({
     key: `venv:${canonicalPath(directory)}`,
     timeoutMs: options.coordinationTimeoutMs,
     check,
     mutate: async () => {
-      await import_promises.rm(directory, { recursive: true, force: true });
-      await import_promises.mkdir(import_node_path5.default.dirname(directory), { recursive: true });
-      await runAsync(uv.executable, [
-        "venv",
-        "--no-project",
-        "--no-config",
-        "--no-python-downloads",
-        "--python",
-        basePython.executable,
-        directory
-      ], isolatedUvEnvironment(options), options.installTimeoutMs);
-      const installed = await check();
-      if (!installed) {
-        throw new Error(`uv created ${directory}, but its Python does not satisfy the requested capabilities.`);
+      await import_promises2.rm(directory, { recursive: true, force: true });
+      await import_promises2.mkdir(import_node_path6.default.dirname(directory), { recursive: true });
+      try {
+        await runAsync(uv.executable, [
+          "venv",
+          "--no-project",
+          "--no-config",
+          "--no-python-downloads",
+          "--python",
+          basePython.executable,
+          directory
+        ], isolatedUvProcessEnvironment(options), options.installTimeoutMs);
+        const created = await inspectPythonVenv(directory, options);
+        if (!created || !pythonSatisfiesPolicy(created, options)) {
+          throw new Error(`uv created ${directory}, but its Python does not satisfy the requested capabilities.`);
+        }
+        await installResolvedDependencies(uv, created, resolution, options);
+        await writeVenvMetadata(directory, venv);
+        const installed = await check();
+        if (!installed)
+          throw new Error(`Pyfig could not validate environment ${directory}.`);
+        return installed;
+      } catch (error) {
+        await import_promises2.rm(directory, { recursive: true, force: true });
+        throw error;
       }
-      return installed;
     }
   });
 }
-async function findReusableEnvironment(options) {
+async function findReusableExternalPythonVenv(options) {
   if (options.python) {
     const configured = await probePython({ executable: options.python, args: [] }, options);
     if (!configured || !pythonSatisfiesPolicy(configured, options)) {
@@ -650,14 +786,10 @@ async function findReusableEnvironment(options) {
     if (configured.virtualEnvironment)
       return configured;
   }
-  for (const directory of [
-    ...externalVirtualEnvironmentDirectories(options.projectRoot, options.env),
-    virtualEnvironmentDirectory(options.projectRoot)
-  ]) {
-    const info = await inspectVirtualEnvironment(directory, options);
-    if (info && pythonSatisfiesPolicy(info, options) && await virtualEnvironmentMatchesConfiguredPython(info, options)) {
+  for (const directory of externalPythonVenvDirectories(options.projectRoot, options.env)) {
+    const info = await inspectPythonVenv(directory, options);
+    if (info && pythonSatisfiesPolicy(info, options))
       return info;
-    }
   }
   return null;
 }
@@ -674,6 +806,9 @@ async function ensureBasePythonResolved(uv, options) {
       return base;
     throw incompatibleConfiguredPython(options);
   }
+  const externalBase = await findExternalBasePython(options);
+  if (externalBase)
+    return externalBase;
   const system = await findPythonWithUv(uv, options, "system");
   if (system)
     return system;
@@ -684,11 +819,11 @@ async function ensureBasePythonResolved(uv, options) {
     throw new Error(missingPythonMessage(options, "managed Python installation is disabled"));
   }
   return withProvisioningLock({
-    key: `python:${canonicalPath(import_node_path5.default.join(options.cacheDir, "python"))}`,
+    key: `python:${canonicalPath(import_node_path6.default.join(options.cacheDir, "python"))}`,
     timeoutMs: options.coordinationTimeoutMs,
     check: () => findPythonWithUv(uv, options, "managed"),
     mutate: async () => {
-      await runAsync(uv.executable, ["python", "install", "--no-config", options.managedPython], isolatedUvEnvironment(options), options.installTimeoutMs);
+      await runAsync(uv.executable, ["python", "install", "--no-config", options.managedPython], isolatedUvProcessEnvironment(options), options.installTimeoutMs);
       const installed = await findPythonWithUv(uv, options, "managed");
       if (!installed) {
         throw new Error(missingPythonMessage(options, `uv installed ${options.managedPython}, but it remains incompatible`));
@@ -697,6 +832,17 @@ async function ensureBasePythonResolved(uv, options) {
     }
   });
 }
+async function findExternalBasePython(options) {
+  for (const directory of externalPythonVenvDirectories(options.projectRoot, options.env)) {
+    const environment = await inspectPythonVenv(directory, options);
+    if (!environment || !pythonSatisfiesPolicy(environment, options))
+      continue;
+    const base = await probePython({ executable: environment.baseExecutable, args: [] }, options);
+    if (base && !base.virtualEnvironment && pythonSatisfiesPolicy(base, options))
+      return base;
+  }
+  return null;
+}
 async function findPythonWithUv(uv, options, source) {
   for (const request of ["", options.managedPython]) {
     const args = [
@@ -710,7 +856,7 @@ async function findPythonWithUv(uv, options, source) {
     if (request)
       args.push(request);
     try {
-      const { stdout } = await runAsync(uv.executable, args, explicitPythonSourceEnvironment(options), options.probeTimeoutMs);
+      const { stdout } = await runAsync(uv.executable, args, explicitPythonSourceProcessEnvironment(options), options.probeTimeoutMs);
       const info = await probePython({ executable: stdout.trim(), args: [] }, options);
       if (info && pythonSatisfiesPolicy(info, options))
         return info;
@@ -726,7 +872,7 @@ async function findPythonWithUv(uv, options, source) {
       "--output-format",
       "json",
       source === "system" ? "--no-managed-python" : "--managed-python"
-    ], explicitPythonSourceEnvironment(options), options.probeTimeoutMs);
+    ], explicitPythonSourceProcessEnvironment(options), options.probeTimeoutMs);
     const candidates = installedPythonPaths(stdout);
     for (const executable of candidates) {
       const info = await probePython({ executable, args: [] }, options);
@@ -749,59 +895,79 @@ function installedPythonPaths(output) {
   });
   return [...new Map(paths.map((candidate) => [canonicalPath(candidate), candidate])).values()];
 }
-async function inspectVirtualEnvironment(directory, options) {
-  const executable = virtualEnvironmentPythonExecutable(directory);
+async function inspectPythonVenv(directory, options) {
+  const executable = pythonVenvExecutable(directory);
   const info = await probePython({ executable, args: [] }, options);
   return info?.virtualEnvironment && pathsEqual(info.virtualEnvironment, directory) ? info : null;
 }
-async function installRuntimeDependencies(uv, python, dependencies, dependencyOptions, options) {
-  if (!python.virtualEnvironment) {
-    throw new Error("Runtime dependency installation requires a virtual environment.");
+async function resolveRuntimeDependencies(uv, python, options) {
+  if (!hasRuntimeRequirements(options)) {
+    return { content: "", sha256: requirementsDigest("") };
   }
-  await withProvisioningLock({
-    key: `dependencies:${canonicalPath(python.virtualEnvironment)}`,
-    timeoutMs: options.coordinationTimeoutMs,
-    check: async () => null,
-    mutate: async () => {
-      const temporary = await import_promises.mkdtemp(import_node_path5.default.join(import_node_os.default.tmpdir(), "pyfig-dependencies-"));
-      try {
-        const additions = import_node_path5.default.join(temporary, "runtime-dependencies.txt");
-        const resolved = import_node_path5.default.join(temporary, "resolved-dependencies.txt");
-        const pyproject = import_node_path5.default.join(options.projectRoot, "pyproject.toml");
-        const hasPyproject = import_node_fs4.default.existsSync(pyproject);
-        if (!hasPyproject && (dependencyOptions.extras.length > 0 || dependencyOptions.groups.length > 0 || dependencyOptions.allExtras)) {
-          throw new Error("Runtime extras and groups require an existing pyproject.toml.");
-        }
-        const sources = hasPyproject ? [pyproject] : [];
-        if (dependencies.length > 0) {
-          await import_promises.writeFile(additions, `${dependencies.join(`
+  const temporary = await import_promises2.mkdtemp(import_node_path6.default.join(import_node_os.default.tmpdir(), "pyfig-resolution-"));
+  try {
+    const additions = import_node_path6.default.join(temporary, "runtime-dependencies.txt");
+    const output = import_node_path6.default.join(temporary, "resolved-dependencies.txt");
+    const sources = [...options.requirements];
+    if (options.dependencies.length > 0) {
+      await import_promises2.writeFile(additions, `${options.dependencies.join(`
 `)}
 `, "utf8");
-          sources.push(additions);
-        }
-        const selectionArgs = [
-          ...dependencyOptions.extras.flatMap((extra) => ["--extra", extra]),
-          ...dependencyOptions.groups.flatMap((group) => ["--group", group]),
-          ...dependencyOptions.allExtras ? ["--all-extras"] : []
-        ];
-        await runAsync(uv.executable, [
-          "pip",
-          "compile",
-          "--no-config",
-          "--python",
-          python.executable,
-          ...selectionArgs,
-          ...sources,
-          "--output-file",
-          resolved
-        ], targetUvEnvironment(options, python), options.installTimeoutMs, undefined, options.projectRoot);
-        await runAsync(uv.executable, ["pip", "install", "--no-config", "--python", python.executable, "-r", resolved], targetUvEnvironment(options, python), options.installTimeoutMs, undefined, options.projectRoot);
-      } finally {
-        await import_promises.rm(temporary, { recursive: true, force: true });
-      }
-      return true;
+      sources.push(additions);
     }
-  });
+    await runAsync(uv.executable, [
+      "pip",
+      "compile",
+      "--no-config",
+      "--no-header",
+      "--no-annotate",
+      "--generate-hashes",
+      "--python",
+      python.executable,
+      ...sources,
+      "--output-file",
+      output
+    ], isolatedUvProcessEnvironment(options), options.installTimeoutMs, undefined, options.projectRoot);
+    const content = normalizeResolution(await import_promises2.readFile(output, "utf8"));
+    return { content, sha256: requirementsDigest(content) };
+  } finally {
+    await import_promises2.rm(temporary, { recursive: true, force: true });
+  }
+}
+async function validateRequirementsFiles(requirements) {
+  for (const requirement of requirements) {
+    let information;
+    try {
+      information = await import_promises2.stat(requirement);
+    } catch (error) {
+      throw new Error(`Requirements file is unavailable: ${requirement}`, { cause: error });
+    }
+    if (!information.isFile()) {
+      throw new Error(`Requirements path is not a file: ${requirement}`);
+    }
+  }
+}
+async function installResolvedDependencies(uv, python, resolution, options) {
+  if (!resolution.content)
+    return;
+  if (!python.virtualEnvironment) {
+    throw new Error("Runtime dependency installation requires a virtual environment.");
+  }
+  const temporary = await import_promises2.mkdtemp(import_node_path6.default.join(import_node_os.default.tmpdir(), "pyfig-install-"));
+  try {
+    const requirements = import_node_path6.default.join(temporary, "resolved-dependencies.txt");
+    await import_promises2.writeFile(requirements, resolution.content, { encoding: "utf8", flag: "wx" });
+    await runAsync(uv.executable, ["pip", "install", "--no-config", "--python", python.executable, "-r", requirements], targetUvProcessEnvironment(options, python), options.installTimeoutMs, undefined, options.projectRoot);
+    await runAsync(uv.executable, ["pip", "check", "--no-config", "--python", python.executable], targetUvProcessEnvironment(options, python), options.installTimeoutMs, undefined, options.projectRoot);
+  } finally {
+    await import_promises2.rm(temporary, { recursive: true, force: true });
+  }
+}
+function normalizeResolution(content) {
+  const normalized = content.replace(/\r\n/gu, `
+`).trimEnd();
+  return normalized ? `${normalized}
+` : "";
 }
 async function ensureUvResolved(options) {
   const existing = await findAvailableUv(options);
@@ -810,7 +976,7 @@ async function ensureUvResolved(options) {
   if (!options.installUv) {
     throw new Error(`Compatible uv is unavailable (requires-uv ${options.requiresUv}), and uv installation is disabled.`);
   }
-  const policyKey = import_node_crypto.createHash("sha256").update(options.requiresUv).digest("hex");
+  const policyKey = import_node_crypto2.createHash("sha256").update(options.requiresUv).digest("hex");
   return withProvisioningLock({
     key: `uv-policy:${canonicalPath(uvInstallRoot(options))}:${policyKey}`,
     timeoutMs: options.coordinationTimeoutMs,
@@ -842,7 +1008,7 @@ async function findAvailableUv(options) {
   return findManagedUv(options);
 }
 async function findManagedUv(options) {
-  const entries = await import_promises.readdir(uvInstallRoot(options), { withFileTypes: true }).catch(() => []);
+  const entries = await import_promises2.readdir(uvInstallRoot(options), { withFileTypes: true }).catch(() => []);
   let versions = entries.filter((entry) => entry.isDirectory() && normalizePep440Version(entry.name) === entry.name).map((entry) => entry.name);
   while (versions.length > 0) {
     const selected = maxPep440Version(versions, options.requiresUv);
@@ -855,45 +1021,16 @@ async function findManagedUv(options) {
   }
   return null;
 }
-function normalizeDependencies(dependencies) {
-  const normalized = dependencies.map((dependency) => dependency.trim());
-  for (const dependency of normalized) {
-    if (!dependency || /[\0\r\n]/u.test(dependency)) {
-      throw new TypeError(`Invalid runtime dependency: ${JSON.stringify(dependency)}`);
-    }
-  }
-  return [...new Set(normalized)];
+function isolatedUvProcessEnvironment(options) {
+  return sanitizeUvProcessEnvironment(uvProcessEnvironment(options));
 }
-function normalizeDependencyOptions(options) {
-  const extras = normalizeNames("extra", options.extras ?? []);
-  const groups = normalizeNames("dependency group", options.groups ?? []);
-  if (options.allExtras && extras.length > 0) {
-    throw new TypeError("allExtras cannot be combined with explicit extras.");
-  }
-  return { extras, groups, allExtras: options.allExtras ?? false };
-}
-function normalizeNames(kind, names) {
-  const normalized = names.map((name) => name.trim());
-  for (const name of normalized) {
-    if (!name || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(name)) {
-      throw new TypeError(`Invalid ${kind}: ${JSON.stringify(name)}`);
-    }
-  }
-  return [...new Set(normalized)];
-}
-function isManagedEnvironment(python, options) {
-  return Boolean(python.virtualEnvironment) && pathsEqual(python.virtualEnvironment, virtualEnvironmentDirectory(options.projectRoot));
-}
-function isolatedUvEnvironment(options) {
-  return sanitizeUvEnvironment(uvEnvironment(options));
-}
-function explicitPythonSourceEnvironment(options) {
-  const env = isolatedUvEnvironment(options);
+function explicitPythonSourceProcessEnvironment(options) {
+  const env = isolatedUvProcessEnvironment(options);
   delete env["UV_PYTHON_PREFERENCE"];
   return env;
 }
-function targetUvEnvironment(options, python) {
-  return uvCommandEnvironment(uvEnvironment(options), python);
+function targetUvProcessEnvironment(options, python) {
+  return uvCommandProcessEnvironment(uvProcessEnvironment(options), python);
 }
 function incompatibleConfiguredPython(options) {
   return new Error(`Configured Python ${options.python} is unavailable or does not satisfy ` + `requires-python ${options.requiresPython}` + `${options.requireEmbedding ? " with CPython embedding files" : ""}.`);
@@ -902,18 +1039,6 @@ function missingPythonMessage(options, reason) {
   const embedding = options.requireEmbedding ? " with compatible CPython headers, library, architecture, and GIL ABI" : "";
   return `No Python satisfies requires-python ${options.requiresPython}${embedding}; ${reason}.`;
 }
-async function virtualEnvironmentMatchesConfiguredPython(virtualEnvironment, options) {
-  if (!options.python)
-    return true;
-  const configured = await probePython({ executable: options.python, args: [] }, options);
-  if (!configured || !pythonSatisfiesPolicy(configured, options))
-    return false;
-  if (configured.virtualEnvironment && pathsEqual(configured.executable, virtualEnvironment.executable)) {
-    return true;
-  }
-  const configuredBase = configured.virtualEnvironment ? configured.baseExecutable : configured.executable;
-  return pathsEqual(configuredBase, virtualEnvironment.baseExecutable);
-}
 var UV_RELEASE_PAGE_SIZE = 100;
 var UV_RELEASE_MAX_PAGES = 20;
 var UV_RELEASE_METADATA_TTL_MS = 24 * 60 * 60000;
@@ -955,11 +1080,7 @@ async function fetchUvReleaseCatalog(options) {
   let exhausted = false;
   try {
     for (let page = 1;page <= UV_RELEASE_MAX_PAGES; page += 1) {
-      const text = await downloadText(`https://api.github.com/repos/astral-sh/uv/releases?per_page=${UV_RELEASE_PAGE_SIZE}&page=${page}`, options.downloadTimeoutMs, dispatcher, {
-        Accept: "application/vnd.github+json",
-        "User-Agent": "pyfig",
-        "X-GitHub-Api-Version": "2022-11-28"
-      });
+      const text = await downloadText(`https://api.github.com/repos/astral-sh/uv/releases?per_page=${UV_RELEASE_PAGE_SIZE}&page=${page}`, options.downloadTimeoutMs, dispatcher, githubApiHeaders(options.env));
       const payload = JSON.parse(text);
       if (!Array.isArray(payload)) {
         throw new Error("GitHub returned invalid uv release metadata.");
@@ -992,6 +1113,18 @@ async function fetchUvReleaseCatalog(options) {
   }
   return { fetchedAt: Date.now(), releases: [...releases.values()] };
 }
+function githubApiHeaders(env) {
+  const token = [env["GITHUB_TOKEN"], env["GH_TOKEN"]].find((value) => typeof value === "string" && value.trim().length > 0);
+  if (token && /[\r\n]/u.test(token)) {
+    throw new TypeError("GitHub API token must not contain line breaks.");
+  }
+  return {
+    Accept: "application/vnd.github+json",
+    "User-Agent": "pyfig",
+    "X-GitHub-Api-Version": "2022-11-28",
+    ...token ? { Authorization: `Bearer ${token}` } : {}
+  };
+}
 async function readFreshUvReleaseCatalog(file) {
   const catalog = await readUvReleaseCatalog(file);
   if (!catalog)
@@ -1001,7 +1134,7 @@ async function readFreshUvReleaseCatalog(file) {
 }
 async function readUvReleaseCatalog(file) {
   try {
-    return parseUvReleaseCatalog(JSON.parse(await import_promises.readFile(file, "utf8")));
+    return parseUvReleaseCatalog(JSON.parse(await import_promises2.readFile(file, "utf8")));
   } catch {
     return null;
   }
@@ -1030,20 +1163,20 @@ function parseUvReleaseCatalog(value) {
   return { fetchedAt: catalog.fetchedAt, releases };
 }
 async function writeUvReleaseCatalog(file, catalog) {
-  await import_promises.mkdir(import_node_path5.default.dirname(file), { recursive: true });
-  const staged = import_node_path5.default.join(import_node_path5.default.dirname(file), `.${import_node_path5.default.basename(file)}.${process.pid}.${import_node_crypto.randomUUID()}.tmp`);
+  await import_promises2.mkdir(import_node_path6.default.dirname(file), { recursive: true });
+  const staged = import_node_path6.default.join(import_node_path6.default.dirname(file), `.${import_node_path6.default.basename(file)}.${process.pid}.${import_node_crypto2.randomUUID()}.tmp`);
   try {
-    await import_promises.writeFile(staged, `${JSON.stringify(catalog)}
+    await import_promises2.writeFile(staged, `${JSON.stringify(catalog)}
 `, { encoding: "utf8", flag: "wx" });
     if (process.platform === "win32")
-      await import_promises.rm(file, { force: true });
-    await import_promises.rename(staged, file);
+      await import_promises2.rm(file, { force: true });
+    await import_promises2.rename(staged, file);
   } finally {
-    await import_promises.rm(staged, { force: true });
+    await import_promises2.rm(staged, { force: true });
   }
 }
 function uvReleaseMetadataFile(options) {
-  return import_node_path5.default.join(options.cacheDir, "metadata", "uv-releases.json");
+  return import_node_path6.default.join(options.cacheDir, "metadata", "uv-releases.json");
 }
 function releaseAssetNames(value) {
   if (!Array.isArray(value))
@@ -1056,36 +1189,36 @@ function releaseAssetNames(value) {
   });
 }
 function uvInstallRoot(options) {
-  return import_node_path5.default.join(options.cacheDir, "tools", "uv");
+  return import_node_path6.default.join(options.cacheDir, "tools", "uv");
 }
 function uvInstallDirectory(options, version) {
-  return import_node_path5.default.join(uvInstallRoot(options), version);
+  return import_node_path6.default.join(uvInstallRoot(options), version);
 }
 function uvExecutable(options, version) {
-  return import_node_path5.default.join(uvInstallDirectory(options, version), process.platform === "win32" ? "uv.exe" : "uv");
+  return import_node_path6.default.join(uvInstallDirectory(options, version), process.platform === "win32" ? "uv.exe" : "uv");
 }
 async function installUv(installDir, release, options) {
   const asset = uvAsset();
   const baseUrl = `https://github.com/astral-sh/uv/releases/download/${release.tag}`;
-  const temporary = await import_promises.mkdtemp(import_node_path5.default.join(import_node_os.default.tmpdir(), "pyfig-uv-"));
+  const temporary = await import_promises2.mkdtemp(import_node_path6.default.join(import_node_os.default.tmpdir(), "pyfig-uv-"));
   const dispatcher = proxyDispatcher(options.env);
   try {
-    const archive = import_node_path5.default.join(temporary, asset);
+    const archive = import_node_path6.default.join(temporary, asset);
     await download(`${baseUrl}/${asset}`, archive, options.downloadTimeoutMs, dispatcher);
     const expected = (await downloadText(`${baseUrl}/${asset}.sha256`, options.downloadTimeoutMs, dispatcher)).trim().split(/\s+/u)[0];
     const actual = await sha256File(archive);
     if (!expected || expected.toLowerCase() !== actual.toLowerCase()) {
       throw new Error(`uv archive checksum mismatch for ${asset}`);
     }
-    const extracted = import_node_path5.default.join(temporary, "extracted");
-    await import_promises.mkdir(extracted, { recursive: true });
+    const extracted = import_node_path6.default.join(temporary, "extracted");
+    await import_promises2.mkdir(extracted, { recursive: true });
     const source = await extractUvExecutable(archive, asset, extracted);
     if (!source)
       throw new Error(`uv archive did not contain the expected executable: ${asset}`);
     await publishUvAtomically(source, installDir, release.version, options);
   } finally {
     await dispatcher?.close();
-    await import_promises.rm(temporary, { recursive: true, force: true });
+    await import_promises2.rm(temporary, { recursive: true, force: true });
   }
 }
 async function extractUvExecutable(archive, asset, destination) {
@@ -1094,33 +1227,33 @@ async function extractUvExecutable(archive, asset, destination) {
     await tar.x({ file: archive, cwd: destination, strict: true });
     return findFile(destination, executableName);
   }
-  const entries = import_fflate.unzipSync(await import_promises.readFile(archive), {
-    filter: ({ name }) => import_node_path5.default.posix.basename(name.replaceAll("\\", "/")) === executableName
+  const entries = import_fflate.unzipSync(await import_promises2.readFile(archive), {
+    filter: ({ name }) => import_node_path6.default.posix.basename(name.replaceAll("\\", "/")) === executableName
   });
-  const matches = Object.entries(entries).filter(([name]) => import_node_path5.default.posix.basename(name.replaceAll("\\", "/")) === executableName);
+  const matches = Object.entries(entries).filter(([name]) => import_node_path6.default.posix.basename(name.replaceAll("\\", "/")) === executableName);
   if (matches.length !== 1 || !matches[0])
     return null;
-  const source = import_node_path5.default.join(destination, executableName);
-  await import_promises.writeFile(source, matches[0][1], { flag: "wx" });
+  const source = import_node_path6.default.join(destination, executableName);
+  await import_promises2.writeFile(source, matches[0][1], { flag: "wx" });
   return source;
 }
 async function publishUvAtomically(source, installDir, version, options) {
-  await import_promises.mkdir(installDir, { recursive: true });
+  await import_promises2.mkdir(installDir, { recursive: true });
   const executable = uvExecutable(options, version);
-  const staged = import_node_path5.default.join(installDir, `.${import_node_path5.default.basename(executable)}.${process.pid}.${import_node_crypto.randomUUID()}.tmp`);
+  const staged = import_node_path6.default.join(installDir, `.${import_node_path6.default.basename(executable)}.${process.pid}.${import_node_crypto2.randomUUID()}.tmp`);
   try {
-    await import_promises.copyFile(source, staged);
+    await import_promises2.copyFile(source, staged);
     if (process.platform !== "win32")
-      await import_promises.chmod(staged, 493);
+      await import_promises2.chmod(staged, 493);
     const stagedUv = probeUv(staged, options);
     if (!stagedUv || stagedUv.version !== version) {
       throw new Error(`Downloaded uv executable is not version ${version}.`);
     }
     if (process.platform === "win32")
-      await import_promises.rm(executable, { force: true });
-    await import_promises.rename(staged, executable);
+      await import_promises2.rm(executable, { force: true });
+    await import_promises2.rename(staged, executable);
   } finally {
-    await import_promises.rm(staged, { force: true });
+    await import_promises2.rm(staged, { force: true });
   }
 }
 function uvAsset() {
@@ -1145,7 +1278,7 @@ async function download(url, destination, timeoutMs, dispatcher) {
     await response.body?.cancel();
     throw new Error(`Could not download ${url}: HTTP ${response.status}`);
   }
-  await import_promises2.pipeline(import_node_stream.Readable.fromWeb(response.body), import_node_fs3.createWriteStream(destination, { flags: "wx" }));
+  await import_promises3.pipeline(import_node_stream.Readable.fromWeb(response.body), import_node_fs3.createWriteStream(destination, { flags: "wx" }));
 }
 async function downloadText(url, timeoutMs, dispatcher, headers) {
   const response = await import_undici.fetch(url, {
@@ -1161,28 +1294,28 @@ async function downloadText(url, timeoutMs, dispatcher, headers) {
   return response.text();
 }
 function proxyDispatcher(env) {
-  const httpProxy = environmentValue(env, "http_proxy", "HTTP_PROXY");
-  const httpsProxy = environmentValue(env, "https_proxy", "HTTPS_PROXY");
+  const httpProxy = processEnvironmentValue(env, "http_proxy", "HTTP_PROXY");
+  const httpsProxy = processEnvironmentValue(env, "https_proxy", "HTTPS_PROXY");
   if (!httpProxy && !httpsProxy)
     return;
   return new import_undici.EnvHttpProxyAgent({
     httpProxy,
     httpsProxy,
-    noProxy: environmentValue(env, "no_proxy", "NO_PROXY")
+    noProxy: processEnvironmentValue(env, "no_proxy", "NO_PROXY")
   });
 }
-function environmentValue(env, lowercase, uppercase) {
+function processEnvironmentValue(env, lowercase, uppercase) {
   return env[lowercase] ?? env[uppercase];
 }
 async function sha256File(file) {
-  const hash = import_node_crypto.createHash("sha256");
+  const hash = import_node_crypto2.createHash("sha256");
   for await (const chunk of import_node_fs3.createReadStream(file))
     hash.update(chunk);
   return hash.digest("hex");
 }
 async function findFile(directory, name) {
-  for (const entry of await import_promises.readdir(directory, { withFileTypes: true })) {
-    const target = import_node_path5.default.join(directory, entry.name);
+  for (const entry of await import_promises2.readdir(directory, { withFileTypes: true })) {
+    const target = import_node_path6.default.join(directory, entry.name);
     if (entry.isFile() && entry.name === name)
       return target;
     if (entry.isDirectory()) {
@@ -1196,8 +1329,8 @@ async function findFile(directory, name) {
 
 // src/sync-resolver.ts
 async function main() {
-  const request = JSON.parse(import_node_fs5.readFileSync(0, "utf8"));
-  const result = request.target === "uv" ? await ensureUv(request.options) : await ensureEnvironment(request.options);
+  const request = JSON.parse(import_node_fs4.readFileSync(0, "utf8"));
+  const result = request.target === "uv" ? await ensureUv(request.options) : await ensurePython(request.options);
   process.stdout.write(JSON.stringify(result));
 }
 main().catch((error) => {
@@ -1206,4 +1339,4 @@ main().catch((error) => {
   process.exitCode = 1;
 });
 
-//# debugId=DD5BE52110A7FDFA64756E2164756E21
+//# debugId=0726BCDBF58AF5C064756E2164756E21