@defrex/autobuild 0.8.0

package/packages/core/src/ports/workspace/contract.ts

@@ -0,0 +1,136 @@
+import { describe, expect, test } from 'bun:test'
+import { readFile, rm, stat, writeFile } from 'node:fs/promises'
+import { isAbsolute, join } from 'node:path'
+import type { WorkspaceBase } from '../../ontology'
+import type { WorkspaceProvider } from '../types'
+
+export interface WorkspaceProviderContractHarness {
+  provider: WorkspaceProvider
+  provision: Parameters<WorkspaceProvider['provision']>[0]
+  /** The exact commit-selection evidence the first provision must return. */
+  expectedBase: WorkspaceBase
+  fixture: { relativePath: string; content: string }
+  cleanup?: () => Promise<void>
+}
+
+export type WorkspaceProviderContractFactory = () => Promise<WorkspaceProviderContractHarness>
+
+async function withWorkspace(
+  factory: WorkspaceProviderContractFactory,
+  run: (harness: WorkspaceProviderContractHarness) => Promise<void>,
+): Promise<void> {
+  const harness = await factory()
+  let failure: unknown
+  try {
+    await run(harness)
+  } catch (error) {
+    failure = error
+  }
+
+  try {
+    await harness.cleanup?.()
+  } catch (cleanupError) {
+    if (failure !== undefined) {
+      throw new AggregateError(
+        [failure, cleanupError],
+        'WorkspaceProvider contract assertion and cleanup both failed',
+      )
+    }
+    throw cleanupError
+  }
+  if (failure !== undefined) throw failure
+}
+
+async function exists(path: string): Promise<boolean> {
+  try {
+    await stat(path)
+    return true
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false
+    throw error
+  }
+}
+
+/** Common working-copy semantics for both the fake and git-worktree adapter. */
+export function describeWorkspaceProviderContract(
+  name: string,
+  factory: WorkspaceProviderContractFactory,
+): void {
+  describe(`WorkspaceProvider contract: ${name}`, () => {
+    test('provision returns a usable requested-branch working copy and selected base', async () => {
+      await withWorkspace(factory, async (harness) => {
+        const result = await harness.provider.provision(harness.provision)
+        expect(result.provider).toBe(harness.provider.name)
+        expect(result.branch).toBe(harness.provision.branch)
+        expect(result.ref).not.toBe('')
+        expect(isAbsolute(result.path)).toBe(true)
+        expect((await stat(result.path)).isDirectory()).toBe(true)
+        expect(await readFile(join(result.path, harness.fixture.relativePath), 'utf8')).toBe(
+          harness.fixture.content,
+        )
+        expect(result.base).toEqual(harness.expectedBase)
+
+        const writeProbe = join(result.path, 'contract-write-probe.txt')
+        await writeFile(writeProbe, 'workspace is writable\n')
+        expect(await readFile(writeProbe, 'utf8')).toBe('workspace is writable\n')
+        await harness.provider.release(result)
+      })
+    })
+
+    test('intact reprovision is non-destructive and reports the existing branch base', async () => {
+      await withWorkspace(factory, async (harness) => {
+        const first = await harness.provider.provision(harness.provision)
+        const writeProbe = join(first.path, 'contract-reprovision-probe.txt')
+        await writeFile(writeProbe, 'preserve in-progress work\n')
+
+        const reprovisioned = await harness.provider.provision(harness.provision)
+        expect(reprovisioned.path).toBe(first.path)
+        expect(reprovisioned.branch).toBe(harness.provision.branch)
+        expect(reprovisioned.base).toEqual({
+          source: 'existing',
+          sha: first.base.sha,
+        })
+        expect(await readFile(writeProbe, 'utf8')).toBe('preserve in-progress work\n')
+
+        await harness.provider.release(reprovisioned)
+      })
+    })
+
+    test('reprovision rematerializes a working copy deleted out of band', async () => {
+      await withWorkspace(factory, async (harness) => {
+        const first = await harness.provider.provision(harness.provision)
+        await rm(first.path, { recursive: true, force: true })
+        expect(await exists(first.path)).toBe(false)
+
+        const reprovisioned = await harness.provider.provision(harness.provision)
+        expect(reprovisioned.path).toBe(first.path)
+        expect(reprovisioned.branch).toBe(harness.provision.branch)
+        expect((await stat(reprovisioned.path)).isDirectory()).toBe(true)
+        expect(await readFile(join(reprovisioned.path, harness.fixture.relativePath), 'utf8')).toBe(
+          harness.fixture.content,
+        )
+        expect(reprovisioned.base).toEqual({
+          source: 'existing',
+          sha: first.base.sha,
+        })
+
+        const writeProbe = join(reprovisioned.path, 'contract-recovery-probe.txt')
+        await writeFile(writeProbe, 'recovered workspace is writable\n')
+        expect(await readFile(writeProbe, 'utf8')).toBe('recovered workspace is writable\n')
+        await harness.provider.release(reprovisioned)
+      })
+    })
+
+    test('release removes/releases the handle and is safe to call twice', async () => {
+      await withWorkspace(factory, async (harness) => {
+        const result = await harness.provider.provision(harness.provision)
+        expect(await exists(result.path)).toBe(true)
+
+        await harness.provider.release(result)
+        expect(await exists(result.path)).toBe(false)
+        await harness.provider.release(result)
+        expect(await exists(result.path)).toBe(false)
+      })
+    })
+  })
+}

package/packages/core/src/ports/workspace/create.ts

@@ -0,0 +1,132 @@
+import { join, resolve } from 'node:path'
+import { vercelSandboxConfigSchema, type WorkspaceConfig } from '../../config/schema'
+import type { PluginRegistry } from '../../plugins/registry'
+import type { WorkspaceProvider } from '../types'
+import type { BuildExecution } from './build-execution'
+import { GitWorktreeProvider } from './git-worktree'
+import { LocalBuildExecution } from './local-build-execution'
+import { type RuntimeReferencesSource, VercelSandboxProvider } from './vercel-sandbox'
+
+export interface CreateWorkspaceProviderOptions {
+  registry: PluginRegistry
+  /** Selected local scratch root. Remote stores pass the repository default. */
+  worktreeRoot: string
+  /** Absolute repository root supplied to plugin factories. */
+  repoRoot: string
+  env: Record<string, string | undefined>
+  /** Required only by remote builtins. */
+  storeRef?: string
+  storeToken?: string
+  /** Host-derived effective routes; consumed only by the built-in sandbox. */
+  runtimeReferences?: RuntimeReferencesSource
+  /** Checkout-less seams for the built-in sandbox: the repository's HTTPS
+   * origin, and a remote branch-head reader returning `undefined` for an
+   * absent branch. Absent seams fall back to host `git` from `repoRoot`. */
+  origin?: () => Promise<string>
+  remoteBranchHead?: (branch: string) => Promise<string | undefined>
+  /** Operator-sandbox options (AUT-340), set once at construction: the raw
+   * `[commands].setup` shell string, the local-state-tree sandbox root, and
+   * the forwarded non-secret variable names. The service never re-receives
+   * setup, root, or variables. */
+  sandboxSetupCommand?: string
+  sandboxRoot?: string
+  sandboxEnvironmentVariables?: readonly string[]
+}
+
+export interface WorkspaceRuntime {
+  provider: WorkspaceProvider
+  execution: BuildExecution
+}
+
+/** Resolve and lazily construct the configured WorkspaceProvider. Builtin
+ * construction remains host-owned because its scratch root comes from store
+ * selection rather than plugin configuration. */
+export async function createWorkspaceProvider(
+  config: WorkspaceConfig,
+  opts: CreateWorkspaceProviderOptions,
+): Promise<WorkspaceProvider> {
+  const available = [...opts.registry.workspaceProviders.keys()].sort()
+  const registration = opts.registry.workspaceProviders.get(config.provider)
+  if (registration === undefined) {
+    throw new Error(
+      `unknown workspace provider "${config.provider}"; available providers: ${available.join(', ')}`,
+    )
+  }
+
+  if (registration.owner.kind === 'builtin') {
+    if (config.provider === 'git-worktree') {
+      if (Object.keys(config.config).length > 0) {
+        throw new Error(
+          '[workspace.config] is not supported by the builtin "git-worktree" provider',
+        )
+      }
+      return new GitWorktreeProvider({
+        root: resolve(opts.worktreeRoot),
+        sandboxRoot:
+          opts.sandboxRoot ?? resolve(join(opts.worktreeRoot, '..', 'orchestrator-sandboxes')),
+        setupCommand: opts.sandboxSetupCommand,
+        sandboxEnvironmentVariables: opts.sandboxEnvironmentVariables,
+        envSource: opts.env,
+      })
+    }
+    if (config.provider === 'vercel-sandbox') {
+      const parsed = vercelSandboxConfigSchema.safeParse(config.config)
+      if (!parsed.success) throw new Error(`invalid vercel-sandbox config: ${parsed.error.message}`)
+      if (opts.storeRef === undefined || opts.storeToken === undefined) {
+        throw new Error('vercel-sandbox requires an HTTPS BuildStore and scoped AB_TOKEN authority')
+      }
+      return new VercelSandboxProvider({
+        config: parsed.data,
+        env: opts.env,
+        storeRef: opts.storeRef,
+        storeToken: opts.storeToken,
+        repo: resolve(opts.repoRoot),
+        runtimeReferences: opts.runtimeReferences ?? [],
+        setupCommand: opts.sandboxSetupCommand,
+        sandboxEnvironmentVariables: opts.sandboxEnvironmentVariables,
+        ...(opts.origin !== undefined ? { origin: opts.origin } : {}),
+        ...(opts.remoteBranchHead !== undefined ? { remoteBranchHead: opts.remoteBranchHead } : {}),
+      })
+    }
+    throw new Error(
+      `workspace provider "${config.provider}" is registered as a builtin but has no constructor`,
+    )
+  }
+
+  const factory = registration.factory
+  if (factory === undefined) {
+    throw new Error(
+      `workspace provider "${config.provider}" from plugin "${registration.owner.name}" has no factory`,
+    )
+  }
+
+  try {
+    return await factory({
+      config: config.config,
+      env: opts.env,
+      repoRoot: resolve(opts.repoRoot),
+    })
+  } catch (error) {
+    throw new Error(
+      `workspace provider "${config.provider}" failed to initialize: ${
+        error instanceof Error ? error.message : String(error)
+      }`,
+      { cause: error },
+    )
+  }
+}
+
+/** Resolve provisioning and execution as one workspace-owned runtime. Existing
+ * providers remain source-compatible: locally reachable implementations that
+ * omit execution receive the shipped child-process capability, while a future
+ * sandbox provider can replace it without a local proxy process. */
+export async function createWorkspaceRuntime(
+  config: WorkspaceConfig,
+  opts: CreateWorkspaceProviderOptions,
+): Promise<WorkspaceRuntime> {
+  const provider = await createWorkspaceProvider(config, opts)
+  return {
+    provider,
+    execution: provider.buildExecution ?? new LocalBuildExecution({ env: opts.env }),
+  }
+}

package/packages/core/src/ports/workspace/distribution-archive.ts

@@ -0,0 +1,317 @@
+/**
+ * The Autobuild distribution archive installed into guests.
+ *
+ * Two sources, one archive layout (`autobuild-<version>.tgz`, the same bytes
+ * `bun pm pack` produces and the guest bootstrap extracts):
+ *
+ * - Usable source checkout: `bun pm pack` from the host tree (local-git
+ *   consumers, and any dispatcher running from a checkout with a `bun`
+ *   executable on `PATH` — byte-identical to today). A checkout without `bun`
+ *   cannot be packed, so a vestigial `.git` directory in a bundled deployment
+ *   routes to the release asset instead of attempting a pack it cannot run.
+ * - Checkout-less origin mode: the dispatcher's own published release asset,
+ *   fetched from GitHub by the running version, so the guest installs exactly
+ *   the version the launching dispatcher reports even when no source tree
+ *   exists on disk.
+ *
+ * The guest's installed version therefore equals the running distribution's
+ * version in both modes: origin mode's release-asset tag is the running
+ * version by construction, and source mode packs `distributionRoot()`, whose
+ * package.json is the same file `readDistributionIdentity()` reads. The hosted
+ * remote store enforces exact version lockstep — a client whose
+ * `x-autobuild-version` differs from the server's is rejected (409) — so
+ * guest, store, and dispatcher versions must move together through a release
+ * cut (`tools/release.ts`) plus store/dispatcher upgrades; there is no code
+ * path that safely mixes versions. Provisioning records the installed version
+ * in the guest's `.distribution-version` marker and reinstalls the archive on
+ * a later mismatch, so an upgraded dispatcher retrofits its persistent guests
+ * (see `vercel-sandbox.ts`).
+ */
+import { access, mkdir, readdir, readFile, writeFile } from 'node:fs/promises'
+import { join, resolve } from 'node:path'
+import { distributionRoot, distributionPath } from '../../distribution'
+import { registryBaseUrl, registryVersionUrl } from '../../registry'
+import { parseRepoCoordinates } from '../forge/github'
+import {
+  createGitHubFetchTransport,
+  GitHubApiError,
+  githubTokenFromEnv,
+  type GitHubRequest,
+} from '../forge/github-transport'
+import { packageAutobuildDistribution } from './vercel-sandbox'
+
+/** The canonical repository the release assets are published to. Shared with
+ * `tools/release.ts`, which uploads them. */
+export const CANONICAL_REPOSITORY_URL = 'https://github.com/defrex/autobuild'
+
+/** The running distribution's package name and version, from the shipped
+ * package.json. Deployed distributions must ship `package.json` — a
+ * deployment requirement the hosted entry point owns. Absence is a hard,
+ * actionable error. */
+export async function readDistributionPackage(): Promise<{ name: string; version: string }> {
+  try {
+    const manifest = JSON.parse(await Bun.file(distributionPath('package.json')).text()) as {
+      name?: unknown
+      version?: unknown
+    }
+    if (typeof manifest.version !== 'string' || manifest.version === '') {
+      throw new Error('the distribution package.json has no usable version field')
+    }
+    if (typeof manifest.name !== 'string' || manifest.name === '') {
+      throw new Error('the distribution package.json has no usable name field')
+    }
+    return { name: manifest.name, version: manifest.version }
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error)
+    throw new Error(
+      `could not read the running Autobuild version from the distribution package.json: ${detail}; ` +
+        'a deployed distribution must ship package.json — install Autobuild from its packed archive or release',
+      { cause: error },
+    )
+  }
+}
+
+async function fileExists(path: string): Promise<boolean> {
+  try {
+    await access(path)
+    return true
+  } catch {
+    return false
+  }
+}
+
+/** The running distribution's version alone. */
+export async function readDistributionIdentity(): Promise<string> {
+  return (await readDistributionPackage()).version
+}
+
+/** The release asset a version's distribution ships under. */
+export function distributionAssetName(version: string): string {
+  return `autobuild-${version}.tgz`
+}
+
+/** Minimal fetch seam for registry reads: the global `fetch` in production. */
+export type RegistryFetch = (
+  url: string,
+  init: { headers: Record<string, string> },
+) => Promise<{ status: number; text(): Promise<string>; arrayBuffer(): Promise<ArrayBuffer> }>
+
+const registryFetch: RegistryFetch = (url, init) => fetch(url, init)
+
+/** Fetch the published npm tarball for `packageName@version`: read the
+ * registry's version document, follow its `dist.tarball`, and return the
+ * bytes. The tarball roots at `package/`, exactly like `bun pm pack`, so the
+ * guest bootstrap extracts it unchanged. Honors `NPM_CONFIG_REGISTRY`. */
+export async function fetchDistributionRegistryTarball(
+  packageName: string,
+  version: string,
+  env: Readonly<Record<string, string | undefined>> = process.env,
+  fetchImpl: RegistryFetch = registryFetch,
+): Promise<Uint8Array> {
+  const url = registryVersionUrl(registryBaseUrl(env), packageName, version)
+  const document = await fetchImpl(url, { headers: { accept: 'application/json' } })
+  if (document.status !== 200) {
+    throw new Error(
+      `npm registry has no ${packageName}@${version} (HTTP ${document.status} from ${url}); ` +
+        'publish the release first',
+    )
+  }
+  let tarball: unknown
+  try {
+    tarball = (JSON.parse(await document.text()) as { dist?: { tarball?: unknown } }).dist?.tarball
+  } catch (error) {
+    throw new Error(`npm registry returned an unreadable document for ${packageName}@${version}`, {
+      cause: error,
+    })
+  }
+  if (typeof tarball !== 'string' || tarball === '') {
+    throw new Error(`npm registry document for ${packageName}@${version} names no dist.tarball`)
+  }
+  const download = await fetchImpl(tarball, { headers: { accept: 'application/octet-stream' } })
+  if (download.status !== 200) {
+    throw new Error(`downloading ${tarball} failed with HTTP ${download.status}`)
+  }
+  const bytes = new Uint8Array(await download.arrayBuffer())
+  if (bytes.byteLength === 0) throw new Error(`${tarball} downloaded no bytes`)
+  return bytes
+}
+
+/** The published distribution for the running version: the npm registry
+ * tarball first, then the GitHub release asset (the route a fork or an
+ * unpublished channel still has). A failure names both sources. */
+async function fetchPublishedDistribution(
+  env: Readonly<Record<string, string | undefined>>,
+  transport: GitHubRequest | undefined,
+  fetchImpl: RegistryFetch,
+): Promise<Uint8Array> {
+  const { name, version } = await readDistributionPackage()
+  try {
+    return await fetchDistributionRegistryTarball(name, version, env, fetchImpl)
+  } catch (registryError) {
+    try {
+      return await fetchDistributionReleaseAsset(version, env, transport)
+    } catch (releaseError) {
+      const detail = (error: unknown): string =>
+        error instanceof Error ? error.message : String(error)
+      throw new Error(
+        `no published Autobuild ${version} distribution: npm registry — ${detail(registryError)}; ` +
+          `GitHub release asset — ${detail(releaseError)}`,
+        { cause: releaseError },
+      )
+    }
+  }
+}
+
+/** Fetch the published `autobuild-<version>.tgz` release asset for the
+ * running version. Uses the dispatcher's GitHub credentials when present
+ * (required for a private canonical repository). */
+export async function fetchDistributionReleaseAsset(
+  version: string,
+  env: Readonly<Record<string, string | undefined>> = process.env,
+  transport: GitHubRequest = createGitHubFetchTransport({
+    token: githubTokenFromEnv(env),
+  }),
+): Promise<Uint8Array> {
+  const coordinates = parseRepoCoordinates(CANONICAL_REPOSITORY_URL)
+  if (coordinates === null) {
+    throw new Error(`the canonical repository URL is not parseable: ${CANONICAL_REPOSITORY_URL}`)
+  }
+  const repo = `repos/${encodeURIComponent(coordinates.owner)}/${encodeURIComponent(coordinates.name)}`
+  const tag = `v${version}`
+  const release = await transport('GET', `${repo}/releases/tags/${tag}`).catch((error: unknown) => {
+    if (error instanceof GitHubApiError && error.status === 404) {
+      throw new Error(
+        `Autobuild release ${tag} has no published GitHub release; origin-mode dispatch ` +
+          'installs the guest distribution from the release asset autobuild-' +
+          `${version}.tgz — cut a release with tools/release.ts first`,
+        { cause: error },
+      )
+    }
+    throw error
+  })
+  const assets = (
+    release.json as { assets?: { name?: unknown; browser_download_url?: unknown }[] } | undefined
+  )?.assets
+  const assetName = distributionAssetName(version)
+  const asset = (assets ?? []).find((candidate) => candidate.name === assetName)
+  if (asset === undefined || typeof asset.browser_download_url !== 'string') {
+    throw new Error(
+      `Autobuild release ${tag} does not carry the ${assetName} distribution asset; ` +
+        'origin-mode dispatch cannot install a guest distribution without it — ' +
+        'cut a release with tools/release.ts first',
+    )
+  }
+  const download = await transport('GET', asset.browser_download_url, {
+    headers: { Accept: 'application/octet-stream' },
+  })
+  if (download.bytes === undefined) {
+    throw new Error(`the ${assetName} release asset downloaded no bytes`)
+  }
+  return download.bytes
+}
+
+/** Directory, relative to a distribution root, where a deployment ships the
+ * archive it packed at build time (`ab-hosted-store pack-distribution`). A
+ * bundled deployment — the hosted service on Vercel — has neither `bun` nor a
+ * source tree at runtime, so the archive must be produced while both exist
+ * and carried into the function bundle. */
+export const PREBUILT_DISTRIBUTION_DIR = '.autobuild-dist'
+
+/** The environment variable naming an explicit archive file, for deployments
+ * that place it somewhere other than `PREBUILT_DISTRIBUTION_DIR`. */
+export const DISTRIBUTION_ARCHIVE_ENV = 'AB_DISTRIBUTION_ARCHIVE'
+
+/** Pack the running distribution into `<root>/.autobuild-dist/autobuild-<version>.tgz`
+ * (the same bytes `bun pm pack` produces) and return the archive path. Meant
+ * for a deployment's build step, where `bun` and the source tree exist. */
+export async function writePrebuiltDistributionArchive(
+  root: string = distributionRoot(),
+): Promise<string> {
+  const version = await readDistributionIdentity()
+  const archive = await packageAutobuildDistribution()
+  const dir = join(root, PREBUILT_DISTRIBUTION_DIR)
+  await mkdir(dir, { recursive: true })
+  const path = join(dir, distributionAssetName(version))
+  await writeFile(path, archive)
+  return path
+}
+
+/** Locate a prebuilt archive: `AB_DISTRIBUTION_ARCHIVE` when set, else the
+ * single `autobuild-*.tgz` under `.autobuild-dist/` of the distribution root
+ * or the working directory (a bundled function's root). Null when none. */
+export async function findPrebuiltDistributionArchive(
+  env: Readonly<Record<string, string | undefined>> = process.env,
+  roots: readonly string[] = [distributionRoot(), process.cwd()],
+): Promise<string | null> {
+  const explicit = env[DISTRIBUTION_ARCHIVE_ENV]?.trim()
+  if (explicit) {
+    const path = resolve(explicit)
+    if (!(await fileExists(path))) {
+      throw new Error(`${DISTRIBUTION_ARCHIVE_ENV} names a file that does not exist: ${path}`)
+    }
+    return path
+  }
+  for (const root of [...new Set(roots)]) {
+    const dir = join(root, PREBUILT_DISTRIBUTION_DIR)
+    let names: string[]
+    try {
+      names = (await readdir(dir)).filter(
+        (name) => name.startsWith('autobuild-') && name.endsWith('.tgz'),
+      )
+    } catch {
+      continue
+    }
+    if (names.length === 0) continue
+    if (names.length > 1) {
+      throw new Error(
+        `${dir} holds more than one distribution archive (${names.sort().join(', ')}); ` +
+          'a deployment ships exactly one',
+      )
+    }
+    return join(dir, names[0]!)
+  }
+  return null
+}
+
+/** Whether a `bun` executable is available to pack a source checkout with.
+ * Injectable in tests via `defaultDistributionArchive`. */
+const hasBunExecutable = (): boolean => Bun.which('bun') !== null
+
+/**
+ * The default guest distribution source, in precedence order: an archive
+ * prebuilt for this deployment (`AB_DISTRIBUTION_ARCHIVE` or
+ * `.autobuild-dist/`), then a usable source checkout — a `.git` directory
+ * *and* a `bun` executable to pack with — then the running version's
+ * published distribution: the npm registry tarball, else the GitHub release
+ * asset (see module docs). The prebuilt archive comes first because a
+ * bundled deployment can carry a vestigial `.git` directory without a `bun`
+ * executable to pack with; in that case the published distribution is the
+ * route, and when it too is missing the error names the prebuilt archive the
+ * deployment should have shipped.
+ */
+export async function defaultDistributionArchive(
+  env: Readonly<Record<string, string | undefined>> = process.env,
+  transport?: GitHubRequest,
+  hasBun: () => boolean = hasBunExecutable,
+  fetchImpl: RegistryFetch = registryFetch,
+): Promise<Uint8Array> {
+  const prebuilt = await findPrebuiltDistributionArchive(env)
+  if (prebuilt !== null) return new Uint8Array(await readFile(prebuilt))
+  if (await fileExists(join(distributionRoot(), '.git'))) {
+    if (hasBun()) return packageAutobuildDistribution()
+    // Vestigial `.git` in a bundled deployment: there is no usable source
+    // checkout to pack, so fall through to the release asset — and when that
+    // also fails, name the prebuilt archive the deployment should ship
+    // instead of leaving an unactionable failure behind.
+    const version = await readDistributionIdentity()
+    return fetchPublishedDistribution(env, transport, fetchImpl).catch((error: unknown) => {
+      throw new Error(
+        `no usable source checkout to pack and no prebuilt distribution archive for this deployment; ` +
+          `ship .autobuild-dist/autobuild-${version}.tgz with the deployment or point ` +
+          `${DISTRIBUTION_ARCHIVE_ENV} at one (see the deployment pack step)`,
+        { cause: error },
+      )
+    })
+  }
+  return fetchPublishedDistribution(env, transport, fetchImpl)
+}