@defrex/autobuild 0.8.0 → 0.10.0

package/packages/core/src/ports/tickets/operations.ts

@@ -44,7 +44,7 @@ export async function requirePostMutationTicket(
 export function ticketListCriteria(
   config: Config,
   filters: { state?: string; labels?: string[] },
-): { state?: string; labels?: string[] } {
+): { state?: string; labels?: string[]; assignee?: string } {
   return filters.state === undefined && filters.labels === undefined
     ? readyCriteria(config)
     : filters

package/packages/core/src/ports/tickets/remote.ts

@@ -86,7 +86,14 @@ export class HostedTicketSource implements TicketSource {
     return schema.parse(await response.json())
   }
 
-  async listReady(criteria: { labels?: string[]; state?: string }): Promise<TicketListing> {
+  async listReady(criteria: {
+    labels?: string[]
+    state?: string
+    assignee?: string
+  }): Promise<TicketListing> {
+    if (criteria.assignee !== undefined) {
+      throw new Error('the hosted ticket source does not support an assignee gate')
+    }
     const listing = await this.request('list-ready', criteria, ticketListingWireSchema)
     return { ...listing, tickets: listing.tickets.map((ticket) => this.project(ticket)) }
   }

package/packages/core/src/ports/types.ts

@@ -122,12 +122,27 @@ export interface TicketUpdate {
   labels?: string[]
 }
 
+/** One workflow state of a source that can enumerate them. */
+export interface TicketStateInfo {
+  name: string
+  /** Tickets currently in the state. */
+  tickets: number
+  /** One-line purpose recorded when the state was created, if any. */
+  about?: string
+}
+
 export interface TicketSource {
   readonly name: string
   /** Ready tickets matching the dispatch criteria (label/state — §3.3), plus
    * actionable diagnostics for individual source records excluded as invalid.
    * Fatal source failures and invariants still reject the call. */
-  listReady(criteria: { labels?: string[]; state?: string }): Promise<TicketListing>
+  listReady(criteria: {
+    labels?: string[]
+    state?: string
+    /** `me` (the API key's owner) or a user's email; only sources that can honour it
+     * accept it — others reject `[tickets].readyAssignee` at config parse. */
+    assignee?: string
+  }): Promise<TicketListing>
   get(id: string): Promise<Ticket | null>
   /** Claim-before-launch (§12): acquires nonterminal work and returns true.
    * Returns false for an unknown, already-claimed/contested, or terminal ticket.
@@ -154,6 +169,22 @@ export interface TicketSource {
    * are initiation, so §13's "never consulted mid-build" is untouched.
    */
   dependencyStates(ids: string[]): Promise<DependencyState[]>
+  /**
+   * Optional state discovery (`ab ticket states`): every state the source has,
+   * lifecycle states first in workflow order, then the rest alphabetically.
+   * Sources that cannot enumerate their states omit it.
+   */
+  listStates?(): Promise<TicketStateInfo[]>
+  /**
+   * Optional state creation (`ab ticket state create`). Idempotent: an existing
+   * state is reported with `created: false`, and a supplied `about` replaces its
+   * purpose. Rejects a malformed or case-colliding name without creating anything.
+   * Named `addState` because adapters already hold a `createState` option field.
+   */
+  addState?(
+    name: string,
+    opts?: { about?: string },
+  ): Promise<{ state: TicketStateInfo; created: boolean }>
 }
 
 // ── Workspace (SPEC §3.2, §7) ────────────────────────────────────────────────
@@ -177,8 +208,11 @@ export interface WorkspaceProvisionResult extends WorkspaceHandle {
 
 export interface WorkspacePublication {
   /** Observe whether the exact requested commit already reached the durable
-   * remote branch after an interrupted acknowledgement. */
-  isPublished?(input: { sha: string; branch: string }): Promise<boolean>
+   * remote branch after an interrupted acknowledgement. `ref` optionally
+   * names the workspace whose git database the probe runs against — used by
+   * the operator-sandbox publication path, whose provider probes from the
+   * sandbox checkout; the build-path callers omit it. */
+  isPublished?(input: { ref?: string; sha: string; branch: string }): Promise<boolean>
   /** Publish exactly one commit to exactly one branch; no arbitrary command
    * surface is exposed to the dispatcher or build child. */
   publish(input: { ref: string; sha: string; branch: string }): Promise<void>
@@ -221,6 +255,14 @@ export interface WorkspaceProvider {
   readonly orchestratorSandbox?: OperatorSandboxExecution
   /** Trusted dispatcher-only publication capability for remote workspaces. */
   readonly publication?: WorkspacePublication
+  /** Publication capability for the operator sandbox (PR-only publication):
+   * deliberately distinct from `publication`, which is the dispatcher's
+   * remote-workspace discriminator — its presence reclassifies every build
+   * workspace as remote and reroutes build publication. `sandboxPublication`
+   * is never consulted by the dispatcher; it is consumed only by the
+   * operator-sandbox publish service, and present only on providers that can
+   * host operator sandboxes. */
+  readonly sandboxPublication?: WorkspacePublication
   /** Optional only for remote/disposable providers. */
   readonly recovery?: WorkspaceRecovery
   provision(opts: {
@@ -424,6 +466,10 @@ export interface AgentTurnFailure {
   /** Additive structured routing cause. Legacy plugin runners may omit it;
    * their existing permanent bit then supplies the conservative behavior. */
   cause?: AgentFailureCause
+  /** Set with cause 'configuration' when the runtime's CLI executable is not
+   * installed. This is the one configuration failure a configured alternate
+   * may serve; every other configuration failure still stops the chain. */
+  missingExecutable?: true
 }
 
 /** A turn that reached a provider/runtime-declared failure while retaining an

package/packages/core/src/ports/workspace/builtin-capabilities.ts

@@ -0,0 +1,114 @@
+/**
+ * The full capability objects for the builtin workspace providers (AUT-516).
+ * The parse-time subset lives in `config/schema.ts`'s
+ * `BUILTIN_WORKSPACE_PROVIDER_CONFIG` because config validation must be
+ * statically reachable without the registry; this module assembles the FULL
+ * declarations — including the registry-seam behaviors — and is attached to
+ * the builtin registrations by `plugins/registry.ts`.
+ *
+ * Import graph discipline: this module imports `config/schema.ts`,
+ * `git-worktree.ts`, `vercel-sandbox.ts`, and the shared vercel capability
+ * module; nothing imports it from `schema.ts`, so no cycle exists. The
+ * `vercel-sandbox` entry's capabilities are the shared
+ * `VERCEL_SANDBOX_CAPABILITIES` object (AUT-517) — the plugin package
+ * references the same object, so the declarations cannot drift. The
+ * construction-site `configRefusal` for git-worktree is set EXPLICITLY here,
+ * not copied from the table's parse-site `configRefusalMessage` — the two
+ * strings differ by design (the parse-site message adds the remediation
+ * clause; the construction-site one does not).
+ *
+ * This `BUILTINS` record is the single source of truth for which builtins
+ * exist: `plugins/registry.ts` derives its builtin workspace-provider set
+ * from `builtinWorkspaceProviderNames()` (AUT-579), so adding an entry here
+ * (plus the config-table half that AUT-573's parity tests pin) completes
+ * the registration step — no registry edit is required.
+ */
+import { join, resolve } from 'node:path'
+import type { VercelSandboxConfig, WorkspaceConfig } from '../../config/schema'
+import type { WorkspaceProviderCapabilities } from './provider-capabilities'
+import type { CreateWorkspaceProviderOptions } from './create'
+import { GitWorktreeProvider } from './git-worktree'
+import { VercelSandboxProvider } from './vercel-sandbox'
+import { VERCEL_SANDBOX_CAPABILITIES } from './vercel-capabilities'
+import type { WorkspaceProvider } from '../types'
+
+/** The git-worktree construction-site refusal: no remediation clause, unlike
+ * the parse-site message in the config table. */
+const GIT_WORKTREE_CONSTRUCTION_REFUSAL =
+  '[workspace.config] is not supported by the builtin "git-worktree" provider'
+
+interface BuiltinWorkspaceProviderDeclaration {
+  capabilities: WorkspaceProviderCapabilities
+  builtinFactory: (
+    config: WorkspaceConfig,
+    opts: CreateWorkspaceProviderOptions,
+    parsed: unknown,
+  ) => WorkspaceProvider | Promise<WorkspaceProvider>
+}
+
+const BUILTINS: Record<string, BuiltinWorkspaceProviderDeclaration> = {
+  'git-worktree': {
+    capabilities: {
+      configRefusal: GIT_WORKTREE_CONSTRUCTION_REFUSAL,
+    },
+    builtinFactory(_config, opts) {
+      // Its provider config is always `{}`: the refusal (parse site and
+      // construction site alike) has already rejected anything else.
+      return new GitWorktreeProvider({
+        root: resolve(opts.worktreeRoot),
+        sandboxRoot:
+          opts.sandboxRoot ?? resolve(join(opts.worktreeRoot, '..', 'orchestrator-sandboxes')),
+        setupCommand: opts.sandboxSetupCommand,
+        sandboxEnvironmentVariables: opts.sandboxEnvironmentVariables,
+        envSource: opts.env,
+      })
+    },
+  },
+  'vercel-sandbox': {
+    capabilities: VERCEL_SANDBOX_CAPABILITIES,
+    builtinFactory(_config, opts, parsed) {
+      // storeRef/storeToken are guaranteed present: the pre-split
+      // storeRequirements check in createWorkspaceProvider ran before
+      // construction.
+      return new VercelSandboxProvider({
+        config: parsed as VercelSandboxConfig,
+        env: opts.env,
+        storeRef: opts.storeRef!,
+        storeToken: opts.storeToken!,
+        repo: resolve(opts.repoRoot),
+        runtimeReferences: opts.runtimeReferences ?? [],
+        setupCommand: opts.sandboxSetupCommand,
+        sandboxEnvironmentVariables: opts.sandboxEnvironmentVariables,
+        ...(opts.origin !== undefined ? { origin: opts.origin } : {}),
+        ...(opts.remoteBranchHead !== undefined ? { remoteBranchHead: opts.remoteBranchHead } : {}),
+      })
+    },
+  },
+}
+
+/** Every builtin provider name, for parity checks over the declaration
+ * tables (AUT-573): the parse-time table in `config/schema.ts` and the FULL
+ * declarations here must cover the same provider set. */
+export function builtinWorkspaceProviderNames(): readonly string[] {
+  return Object.keys(BUILTINS)
+}
+
+/** The FULL capability object of a builtin workspace provider, `undefined`
+ * for any other name. Used by pre-registry seams (guest probe, init
+ * preflight) that cannot consult the plugin registry. */
+export function builtinWorkspaceProviderCapabilities(
+  name: string,
+): WorkspaceProviderCapabilities | undefined {
+  return BUILTINS[name]?.capabilities
+}
+
+/** The builtin registration extras for `plugins/registry.ts`: the capability
+ * object plus the host-owned construction closure. */
+export function builtinWorkspaceProviderRegistration(
+  name: string,
+): BuiltinWorkspaceProviderDeclaration | undefined {
+  const builtin = BUILTINS[name]
+  return builtin === undefined
+    ? undefined
+    : { capabilities: builtin.capabilities, builtinFactory: builtin.builtinFactory }
+}

package/packages/core/src/ports/workspace/create.ts

@@ -1,11 +1,17 @@
-import { join, resolve } from 'node:path'
-import { vercelSandboxConfigSchema, type WorkspaceConfig } from '../../config/schema'
+import { resolve } from 'node:path'
+import { SANDBOX_FORBIDDEN_ENV } from './operator-sandbox'
+import type { WorkspaceConfig } from '../../config/schema'
 import type { PluginRegistry } from '../../plugins/registry'
 import type { WorkspaceProvider } from '../types'
 import type { BuildExecution } from './build-execution'
-import { GitWorktreeProvider } from './git-worktree'
+import {
+  currentRuntimeReferences,
+  runtimeProvisioningMap,
+  runtimeProvisioningMissingMessage,
+  sandboxForbiddenEnvMessage,
+} from './provider-capabilities'
 import { LocalBuildExecution } from './local-build-execution'
-import { type RuntimeReferencesSource, VercelSandboxProvider } from './vercel-sandbox'
+import type { RuntimeReferencesSource } from './vercel-sandbox'
 
 export interface CreateWorkspaceProviderOptions {
   registry: PluginRegistry
@@ -31,6 +37,11 @@ export interface CreateWorkspaceProviderOptions {
   sandboxSetupCommand?: string
   sandboxRoot?: string
   sandboxEnvironmentVariables?: readonly string[]
+  /** Whether `[orchestrator].enabled` is set at the call site. Gates the
+   * construction-site `sandboxForbiddenEnv` check so the parse-time rule is
+   * reproduced exactly (the config validation only runs when the orchestrator
+   * is enabled). */
+  orchestratorSandboxEnabled?: boolean
 }
 
 export interface WorkspaceRuntime {
@@ -53,44 +64,56 @@ export async function createWorkspaceProvider(
     )
   }
 
-  if (registration.owner.kind === 'builtin') {
-    if (config.provider === 'git-worktree') {
-      if (Object.keys(config.config).length > 0) {
-        throw new Error(
-          '[workspace.config] is not supported by the builtin "git-worktree" provider',
-        )
-      }
-      return new GitWorktreeProvider({
-        root: resolve(opts.worktreeRoot),
-        sandboxRoot:
-          opts.sandboxRoot ?? resolve(join(opts.worktreeRoot, '..', 'orchestrator-sandboxes')),
-        setupCommand: opts.sandboxSetupCommand,
-        sandboxEnvironmentVariables: opts.sandboxEnvironmentVariables,
-        envSource: opts.env,
-      })
+  // Uniform capability enforcement (AUT-516): every declaration that needs
+  // the registry is honoured here, before the builtin/plugin split, where
+  // `registration.capabilities`, `opts.storeRef`, and `opts.storeToken` are
+  // already in hand — a plugin declaring any of them is enforced too, never
+  // accepted by manifest parsing and silently ignored. Order preserves the
+  // builtin failure precedence.
+  const capabilities = registration.capabilities
+  const hasConfig = Object.keys(config.config).length > 0
+  if (capabilities?.configRefusal !== undefined && hasConfig) {
+    throw new Error(capabilities.configRefusal)
+  }
+  let parsed: { data: unknown } | undefined
+  if (capabilities?.configSchema !== undefined) {
+    const result = capabilities.configSchema.safeParse(config.config)
+    if (!result.success) {
+      throw new Error(`invalid ${config.provider} config: ${result.error.message}`)
     }
-    if (config.provider === 'vercel-sandbox') {
-      const parsed = vercelSandboxConfigSchema.safeParse(config.config)
-      if (!parsed.success) throw new Error(`invalid vercel-sandbox config: ${parsed.error.message}`)
-      if (opts.storeRef === undefined || opts.storeToken === undefined) {
-        throw new Error('vercel-sandbox requires an HTTPS BuildStore and scoped AB_TOKEN authority')
+    parsed = result as { data: unknown }
+  }
+  if (capabilities?.requireRuntimeProvisioning === true && opts.runtimeReferences !== undefined) {
+    // `mcp.ts` passes no `runtimeReferences` because it references no runtimes;
+    // dispatch and init validation always do.
+    const provisioning = runtimeProvisioningMap(parsed !== undefined ? parsed.data : config.config)
+    for (const group of currentRuntimeReferences(opts.runtimeReferences)) {
+      if (Object.hasOwn(provisioning, group.runtime)) continue
+      throw new Error(runtimeProvisioningMissingMessage(group))
+    }
+  }
+  if (opts.orchestratorSandboxEnabled === true && capabilities?.sandboxForbiddenEnv !== undefined) {
+    for (const name of opts.sandboxEnvironmentVariables ?? []) {
+      if (SANDBOX_FORBIDDEN_ENV.includes(name) || capabilities.sandboxForbiddenEnv.includes(name)) {
+        throw new Error(sandboxForbiddenEnvMessage(name))
       }
-      return new VercelSandboxProvider({
-        config: parsed.data,
-        env: opts.env,
-        storeRef: opts.storeRef,
-        storeToken: opts.storeToken,
-        repo: resolve(opts.repoRoot),
-        runtimeReferences: opts.runtimeReferences ?? [],
-        setupCommand: opts.sandboxSetupCommand,
-        sandboxEnvironmentVariables: opts.sandboxEnvironmentVariables,
-        ...(opts.origin !== undefined ? { origin: opts.origin } : {}),
-        ...(opts.remoteBranchHead !== undefined ? { remoteBranchHead: opts.remoteBranchHead } : {}),
-      })
     }
-    throw new Error(
-      `workspace provider "${config.provider}" is registered as a builtin but has no constructor`,
-    )
+  }
+  if (
+    capabilities?.storeRequirements !== undefined &&
+    (opts.storeRef === undefined || opts.storeToken === undefined)
+  ) {
+    throw new Error(capabilities.storeRequirements.constructionMessage)
+  }
+
+  if (registration.owner.kind === 'builtin') {
+    const builtinFactory = registration.builtinFactory
+    if (builtinFactory === undefined) {
+      throw new Error(
+        `workspace provider "${config.provider}" is registered as a builtin but has no constructor`,
+      )
+    }
+    return builtinFactory(config, opts, parsed !== undefined ? parsed.data : config.config)
   }
 
   const factory = registration.factory
@@ -101,10 +124,22 @@ export async function createWorkspaceProvider(
   }
 
   try {
+    // Conditional spreads keep the existing exactness guarantee: a call site
+    // that supplies no seams constructs exactly `{ config, env, repoRoot }`,
+    // so plugin factories see no `undefined`-valued additions. With seams,
+    // the context widens in place (AUT-560) — the seams the builtin factory
+    // receives through `opts` reach the plugin factory through the context.
     return await factory({
       config: config.config,
       env: opts.env,
       repoRoot: resolve(opts.repoRoot),
+      ...(opts.storeRef !== undefined ? { storeRef: opts.storeRef } : {}),
+      ...(opts.storeToken !== undefined ? { storeToken: opts.storeToken } : {}),
+      ...(opts.runtimeReferences !== undefined
+        ? { runtimeReferences: opts.runtimeReferences }
+        : {}),
+      ...(opts.origin !== undefined ? { origin: opts.origin } : {}),
+      ...(opts.remoteBranchHead !== undefined ? { remoteBranchHead: opts.remoteBranchHead } : {}),
     })
   } catch (error) {
     throw new Error(

package/packages/core/src/ports/workspace/distribution-archive.ts

@@ -19,17 +19,29 @@
  * version by construction, and source mode packs `distributionRoot()`, whose
  * package.json is the same file `readDistributionIdentity()` reads. The hosted
  * remote store enforces exact version lockstep — a client whose
- * `x-autobuild-version` differs from the server's is rejected (409) — so
- * guest, store, and dispatcher versions must move together through a release
- * cut (`tools/release.ts`) plus store/dispatcher upgrades; there is no code
- * path that safely mixes versions. Provisioning records the installed version
- * in the guest's `.distribution-version` marker and reinstalls the archive on
- * a later mismatch, so an upgraded dispatcher retrofits its persistent guests
- * (see `vercel-sandbox.ts`).
+ * `x-autobuild-version` or `x-autobuild-protocol-version` differs from the
+ * server's is rejected (409) — so guest, store, and dispatcher versions must
+ * move together through a release cut (`tools/release.ts`) plus
+ * store/dispatcher upgrades; there is no code path that safely mixes versions.
+ * Provisioning records the installed distribution's identity stamp
+ * (`readDistributionIdentityStamp()`) in the guest's `.distribution-version`
+ * marker and reinstalls the archive on a later mismatch, so an upgraded
+ * dispatcher retrofits its persistent guests (see `vercel-sandbox.ts`).
+ *
+ * The stamp carries the sha256 digest of the packed archive alongside the
+ * version and protocol, so a deploy that changes guest-visible code or
+ * formats without bumping either one still mismatches every marker computed
+ * over the previous archive (AUT-600). The archive and its digest are
+ * resolved together once per process (`resolveDistributionArchive()`) and
+ * the install paths reuse those same bytes, so the marker names exactly the
+ * bytes installed and resolution never adds a second pack per tick.
  */
-import { access, mkdir, readdir, readFile, writeFile } from 'node:fs/promises'
-import { join, resolve } from 'node:path'
+import { createHash } from 'node:crypto'
+import { access, cp, mkdir, mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
 import { distributionRoot, distributionPath } from '../../distribution'
+import { REMOTE_STORE_PROTOCOL_VERSION } from '../../store/remote/version'
 import { registryBaseUrl, registryVersionUrl } from '../../registry'
 import { parseRepoCoordinates } from '../forge/github'
 import {
@@ -38,19 +50,28 @@ import {
   githubTokenFromEnv,
   type GitHubRequest,
 } from '../forge/github-transport'
-import { packageAutobuildDistribution } from './vercel-sandbox'
+import { spawnExec } from './git-worktree'
 
 /** The canonical repository the release assets are published to. Shared with
  * `tools/release.ts`, which uploads them. */
 export const CANONICAL_REPOSITORY_URL = 'https://github.com/defrex/autobuild'
 
+/** The shipped manifest `readDistributionPackage()` reads. A bundled
+ * deployment must carry this exact file into its function bundle; the hosted
+ * service's post-build trace step appends it to the dispatch route's trace. */
+export { distributionPath, distributionRoot } from '../../distribution'
+
+export function distributionManifestPath(): string {
+  return distributionPath('package.json')
+}
+
 /** The running distribution's package name and version, from the shipped
  * package.json. Deployed distributions must ship `package.json` — a
  * deployment requirement the hosted entry point owns. Absence is a hard,
  * actionable error. */
 export async function readDistributionPackage(): Promise<{ name: string; version: string }> {
   try {
-    const manifest = JSON.parse(await Bun.file(distributionPath('package.json')).text()) as {
+    const manifest = JSON.parse(await Bun.file(distributionManifestPath()).text()) as {
       name?: unknown
       version?: unknown
     }
@@ -85,6 +106,59 @@ export async function readDistributionIdentity(): Promise<string> {
   return (await readDistributionPackage()).version
 }
 
+/** The distribution identity stamp the guest marker records: everything the
+ * hosted store's skew check compares — the package version
+ * (`x-autobuild-version`) *and* the remote-store protocol version
+ * (`x-autobuild-protocol-version`; either mismatch is a 409 at handshake) —
+ * plus the sha256 digest of the exact packed archive the dispatcher would
+ * install, combined into one opaque string. A protocol-only bump, a
+ * version-only release, or a code-only deploy that changes the archive bytes
+ * without touching either (AUT-600) each count as a mismatch against a guest
+ * whose marker carries the older stamp, and any future skew dimension the
+ * store's handshake gains must be folded into this stamp the same way or the
+ * marker comparison misses it. */
+export async function distributionStampFor(archive: Uint8Array): Promise<string> {
+  const digest = createHash('sha256').update(archive).digest('hex')
+  return `${await readDistributionIdentity()}+protocol${REMOTE_STORE_PROTOCOL_VERSION}+sha256-${digest}`
+}
+
+/** Per-process memo of the running distribution's archive and its digest.
+ * Holds the fulfilled promise so concurrent first callers share one
+ * resolution; a rejected resolution clears itself so the next call retries
+ * instead of a transient fetch/pack failure poisoning a long-lived process. */
+let distributionArchiveMemo: Promise<{ archive: Uint8Array; digest: string }> | undefined
+
+/** Resolve the archive the dispatcher would install together with its sha256
+ * digest, at most once per process: the memoized resolution wraps
+ * `defaultDistributionArchive()` (see the module docs for the source
+ * precedence), so repeated stamp reads and installs cost no second pack. */
+export function resolveDistributionArchive(): Promise<{ archive: Uint8Array; digest: string }> {
+  if (distributionArchiveMemo === undefined) {
+    const pending = defaultDistributionArchive().then((archive) => ({
+      archive,
+      digest: createHash('sha256').update(archive).digest('hex'),
+    }))
+    distributionArchiveMemo = pending
+    pending.catch(() => {
+      if (distributionArchiveMemo === pending) distributionArchiveMemo = undefined
+    })
+  }
+  return distributionArchiveMemo
+}
+
+/** Test-only: drop the per-process archive memo so each test resolves its own
+ * source. The memo otherwise outlives a single test. */
+export function resetDistributionArchiveCacheForTest(): void {
+  distributionArchiveMemo = undefined
+}
+
+/** The identity stamp of the running distribution: the version + protocol
+ * skew stamp extended with the digest of the memoized running archive. */
+export async function readDistributionIdentityStamp(): Promise<string> {
+  const { archive } = await resolveDistributionArchive()
+  return distributionStampFor(archive)
+}
+
 /** The release asset a version's distribution ships under. */
 export function distributionAssetName(version: string): string {
   return `autobuild-${version}.tgz`
@@ -211,7 +285,7 @@ export async function fetchDistributionReleaseAsset(
 }
 
 /** Directory, relative to a distribution root, where a deployment ships the
- * archive it packed at build time (`ab-hosted-store pack-distribution`). A
+ * archive it packed at build time (`ab-hosted-dispatcher pack-distribution`). A
  * bundled deployment — the hosted service on Vercel — has neither `bun` nor a
  * source tree at runtime, so the archive must be produced while both exist
  * and carried into the function bundle. */
@@ -221,6 +295,91 @@ export const PREBUILT_DISTRIBUTION_DIR = '.autobuild-dist'
  * that place it somewhere other than `PREBUILT_DISTRIBUTION_DIR`. */
 export const DISTRIBUTION_ARCHIVE_ENV = 'AB_DISTRIBUTION_ARCHIVE'
 
+async function execOrThrow(cmd: string[], cwd: string): Promise<string> {
+  const result = await spawnExec(cmd, { cwd })
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `${cmd.join(' ')} exited ${result.exitCode}: ${result.stderr.trim() || result.stdout.trim()}`,
+    )
+  }
+  return result.stdout.trim()
+}
+
+/** Manifest fields that name repo-local packaging state and must never reach
+ * the packed distribution manifest. `patchedDependencies` entries are resolved
+ * by bun against the consuming project's root, and bun 1.4.0 panics
+ * (`Option::unwrap`, exit 134) when a consumed manifest declares a patch for a
+ * package the consumer tree contains — so a packed manifest carrying the
+ * repo's better-auth patch declaration breaks any consumer that installs
+ * autobuild next to better-auth. The packed artifact ships no patched
+ * package, so the declaration is stripped from the packed manifest while the
+ * repo manifest keeps it for workspace installs. The strip is an enforced
+ * invariant, not a local detail: the `patchedDependencies` rule in
+ * `tools/workspace-manifest-check.ts` rejects a root manifest whose packed
+ * dependency set contains a patched package, and the negative control in
+ * `packages/core/src/plugin-sdk/package.test.ts` (the packed-distribution
+ * better-auth canary) pins the consumed-manifest failure shape this strip
+ * guards, so removing the field from this list fails the suite loudly.
+ *
+ * `devDependencies` is stripped for two reasons. First, the workspace link
+ * specifiers it may carry (for example the root's
+ * `@defrex/autobuild-postgres-store: workspace:*`) cannot be resolved in the
+ * staging tree — it stages only the manifest's `files` set, with no
+ * `bun.lock`, no `node_modules`, and no workspace packages — so `bun pm pack`
+ * fails there with "Failed to resolve workspace version". Second, the guest
+ * installs the distribution with `bun install --production --ignore-scripts`,
+ * which ignores devDependencies entirely; the packed artifact ships no
+ * dev-only tooling, so the declaration is dead weight in the packed manifest
+ * while the repo manifest keeps it for workspace installs. */
+const packedManifestOmittedFields = ['patchedDependencies', 'devDependencies'] as const
+
+export async function packageAutobuildDistribution(): Promise<Uint8Array> {
+  const staging = await mkdtemp(join(tmpdir(), 'autobuild-pack-staging-'))
+  const destination = await mkdtemp(join(tmpdir(), 'autobuild-pack-'))
+  try {
+    // Pack from a staging copy of the repo's `files` set rather than the repo
+    // root: the packed manifest must differ from the repo manifest (above), and
+    // rewriting the repo manifest in place would leave a window where tracked
+    // files are dirty.
+    const manifestPath = join(distributionRoot(), 'package.json')
+    const manifest = JSON.parse(await readFile(manifestPath, 'utf8')) as Record<string, unknown>
+    const files = manifest.files
+    if (!Array.isArray(files) || files.some((entry) => typeof entry !== 'string')) {
+      throw new Error(
+        'Autobuild packaging requires the root package.json to list its files as an array of paths',
+      )
+    }
+    for (const entry of files as string[]) {
+      // npm `files` entries may be negated globs (for example
+      // `!packages/core/src/**/*.test.ts`, which keeps test files out of the
+      // published package). Only positive entries name a path to stage: the
+      // negations stay in the staged manifest and `bun pm pack` applies them,
+      // so the packed set still excludes those paths.
+      if (entry.startsWith('!')) continue
+      const target = join(staging, entry)
+      await mkdir(dirname(target), { recursive: true })
+      await cp(join(distributionRoot(), entry), target, {
+        recursive: true,
+        errorOnExist: true,
+        force: false,
+      })
+    }
+    for (const field of packedManifestOmittedFields) delete manifest[field]
+    await writeFile(join(staging, 'package.json'), `${JSON.stringify(manifest, null, 2)}\n`)
+    await execOrThrow(
+      ['bun', 'pm', 'pack', '--ignore-scripts', '--destination', destination],
+      staging,
+    )
+    const archives = (await readdir(destination)).filter((name) => name.endsWith('.tgz'))
+    if (archives.length !== 1)
+      throw new Error('Autobuild packaging did not produce exactly one archive')
+    return new Uint8Array(await readFile(join(destination, archives[0]!)))
+  } finally {
+    await rm(staging, { recursive: true, force: true })
+    await rm(destination, { recursive: true, force: true })
+  }
+}
+
 /** Pack the running distribution into `<root>/.autobuild-dist/autobuild-<version>.tgz`
  * (the same bytes `bun pm pack` produces) and return the archive path. Meant
  * for a deployment's build step, where `bun` and the source tree exist. */