@nomac/cli 0.13.3 → 0.13.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nomac/cli",
-  "version": "0.13.3",
+  "version": "0.13.4",
   "description": "A real cloud Mac for AI agents: Xcode, the iOS Simulator, signing, TestFlight and App Store publishing, by the minute, over MCP, SSH and HTTPS.",
   "license": "UNLICENSED",
   "type": "module",
@@ -22,7 +22,6 @@
     "https-proxy-agent": "^9.1.0",
     "ignore": "^7.0.0",
     "proxy-from-env": "^2.1.0",
-    "tar": "^7.4.0",
     "ws": "^8.21.3"
   },
   "devDependencies": {

package/skill/SKILL.md

@@ -160,13 +160,6 @@ A step only a person can take (creating the app in App Store Connect,
 agreements, an App Group) comes back as needs_human with its link: give it to
 the human, then call again.
 
-## Builder (existing subscribers only)
-
-The separate iOS Builder publishing product is closed to new subscriptions.
-If `get_billing_status` shows a Builder plan, its tools are listed and
-https://nomac.app/llms-legacy.txt describes them. Otherwise use the cloud Mac
-above.
-
 ## When stuck
 
 `report_issue` with the failing `ref_id` files a support ticket with full

package/src/cli.mjs

@@ -1,8 +1,5 @@
-import { basename } from "node:path";
 import { api, CliError } from "./api.mjs";
-import { loadProjectState, saveApiKey, saveProjectState } from "./config.mjs";
-import { packTarball } from "./pack.mjs";
-import { uploadSourceSnapshot } from "./upload.mjs";
+import { saveApiKey } from "./config.mjs";
 
 const HELP = `nomac: a cloud Mac for you and your agents ($0.80 an hour, by the minute)
 
@@ -46,27 +43,12 @@ Agents:
 More: nomac start --help, nomac whoami, nomac --version, nomac update, nomac start --host user@mac (a Mac you own)
 Environment: NOMAC_API_KEY, NOMAC_API_URL, NOMAC_NO_AUTO_UPDATE=1 (the CLI updates itself otherwise)`;
 
-// The Builder commands act at once (a release build uses one of the plan's builds),
-// so they take only their own flags and print usage for --help instead of running.
-const LEGACY_HELP = {
-  push: "Usage: nomac push\n  Upload this folder as a project snapshot (respects .gitignore; secrets are excluded).",
-  build: "Usage: nomac build [--smoke] [--testflight | --wait]\n  Start a signed release build for TestFlight (uses one build from your plan).\n  --smoke       unsigned compile check instead\n  --testflight  wait until the build is on TestFlight (--wait for a smoke build)",
-  status: "Usage: nomac status [build-id]\n  Show a build's state as JSON (the last build in this folder by default).",
-  logs: "Usage: nomac logs [build-id]\n  Show a build's steps and failure excerpt (the last build in this folder by default).",
+const COMMAND_HELP = {
   mcp: "Usage: nomac mcp\n  Run the NoMac MCP server on stdin/stdout. Add it to your agent's MCP settings as the command `nomac mcp`.",
 };
 const isHelp = (args) => args.some((a) => a === "--help" || a === "-h" || a === "help");
-function onlyFlags(args, allowed, command) {
-  const unknown = args.find((a) => !allowed.includes(a));
-  if (unknown !== undefined) throw new CliError(`unknown option: ${unknown}`, `Unknown option "${unknown}" for nomac ${command}.\n\n${LEGACY_HELP[command]}`);
-}
-/** A build ID argument: bld_..., or none for the folder's last build. Never a flag. */
-function buildIdArg(args, command) {
-  const [first, ...more] = args.filter((a) => a !== "--json");
-  if (first === undefined) return undefined;
-  if (!/^bld_[A-Za-z0-9]+$/.test(first) || more.length) throw new CliError(`not a build id: ${first}`, `"${[first, ...more].join(" ")}" is not a build ID (bld_...).\n\n${LEGACY_HELP[command]}`);
-  return first;
-}
+/** The Builder's commands, removed with it (October 2026). */
+const RETIRED = "was removed with the Builder, retired in October 2026. Build on a NoMac Mac instead: nomac start, nomac sync, nomac exec -- xcodebuild ..., then nomac sign, nomac testflight App.ipa and nomac publish.";
 
 export async function main(argv) {
   const [cmd, ...rest] = argv;
@@ -99,12 +81,6 @@ export async function main(argv) {
       return hostedSessionCommand(cmd, rest, { store: sessionStore() });
     }
     case "status":
-      // A legacy build ID, or a folder that only ever built with the old pipeline, keeps build status.
-      if (/^bld_/.test(rest[0] ?? "") || (loadProjectState().last_build && !(await import("./session-store.mjs")).sessionStore().load())) {
-        if (isHelp(rest)) return console.log(LEGACY_HELP.status);
-        return status(buildIdArg(rest, "status"));
-      }
-    // falls through: everyone else sees their Mac
     case "start":
     case "attach":
     case "extend":
@@ -178,19 +154,12 @@ export async function main(argv) {
       return deviceLogin();
     }
     case "push":
-      if (isHelp(rest)) return console.log(LEGACY_HELP.push);
-      onlyFlags(rest, [], "push");
-      return push();
     case "build":
-      if (isHelp(rest)) return console.log(LEGACY_HELP.build);
-      onlyFlags(rest, ["--smoke", "--testflight", "--wait"], "build");
-      return build(rest);
     case "logs":
-      if (isHelp(rest)) return console.log(LEGACY_HELP.logs);
-      return logs(buildIdArg(rest, "logs"));
+      throw new CliError("retired", `nomac ${cmd} ${RETIRED}`);
     case "mcp": {
       // Agents start this as a stdio server; --help must not start it and wait on stdin.
-      if (isHelp(rest)) return console.log(LEGACY_HELP.mcp);
+      if (isHelp(rest)) return console.log(COMMAND_HELP.mcp);
       const { runMcpServer } = await import("./mcp.mjs");
       return runMcpServer();
     }
@@ -252,129 +221,3 @@ export function describeApple(view) {
   return lines.join("\n");
 }
 
-async function ensureProject() {
-  const state = loadProjectState();
-  if (state.project_id) return state;
-  const name = basename(process.cwd());
-  const created = await api("POST", "/api/v1/projects", { body: { name } });
-  const next = { project_id: created.id, name };
-  saveProjectState(next);
-  console.log(`created project ${created.id} ("${name}")`);
-  return next;
-}
-
-async function push() {
-  const state = await ensureProject();
-  console.log("packing working tree (respecting .gitignore, secrets excluded)…");
-  const { tarball, files } = await packTarball(process.cwd());
-  console.log(`${files.length} files, ${(tarball.length / 1024).toFixed(0)} KB compressed`);
-
-  const res = await uploadSourceSnapshot(state.project_id, tarball);
-  console.log(`✅ snapshot ${res.snapshot_id} (commit ${res.commit.slice(0, 8)})`);
-  const d = res.detected ?? {};
-  const framework = d.project_kind
-    ? ` · ${d.project_kind}${d.flutter_sdk_version ? ` ${d.flutter_sdk_version}` : ""}`
-    : "";
-  console.log(
-    `   detected: ${d.xcodeproj ?? "?"} · scheme ${d.scheme ?? "?"} · ${d.bundle_id ?? "no bundle id"}${d.marketing_version ? ` · v${d.marketing_version}` : ""}${framework}`,
-  );
-  if (res.lint) {
-    const icon = res.lint.grade === "green" ? "🟢" : res.lint.grade === "yellow" ? "🟡" : "🔴";
-    const n = res.lint.findings ?? 0;
-    console.log(
-      `   review lint: ${icon} ${res.lint.grade}${n ? ` · ${n} finding${n === 1 ? "" : "s"}` : ""}`,
-    );
-    if (res.lint.grade === "red") {
-      console.log("   ⚠  red findings will block publish: fix them before `nomac build`/publish.");
-    }
-  }
-  if (res.warning) console.log(`⚠  ${res.warning}`);
-  saveProjectState({ ...state, last_snapshot: res.snapshot_id });
-}
-
-async function build(rest) {
-  const state = loadProjectState();
-  if (!state.project_id) {
-    throw new CliError("no project", "No project here. Run `nomac push` first.");
-  }
-  const smoke = rest.includes("--smoke");
-  const wait = rest.includes("--testflight") || rest.includes("--wait");
-  const res = await api("POST", "/api/v1/builds", {
-    body: { project_id: state.project_id, workflow: smoke ? "smoke" : "release" },
-    idempotencyKey: `cli-${Date.now()}-${Math.random().toString(36).slice(2)}`,
-  });
-  console.log(`✅ build ${res.id} started (${res.workflow}, #${res.build_number})`);
-  saveProjectState({ ...state, last_build: res.id });
-  if (!wait) {
-    console.log(`   follow with: nomac status ${res.id}`);
-    return;
-  }
-  await waitForBuild(res.id);
-}
-
-const SPINNER_STATES = {
-  queued: "queued",
-  mirrored: "mirrored",
-  dispatched: "runner starting",
-  building: "building on macOS",
-  uploading: "uploading to Apple",
-  processing: "Apple is processing",
-};
-
-async function waitForBuild(id) {
-  const started = Date.now();
-  let last = "";
-  let lastNotice = "";
-  for (;;) {
-    const b = await api("GET", `/api/v1/builds/${id}`);
-    if (b.state !== last) {
-      const t = Math.round((Date.now() - started) / 1000);
-      console.log(`   [${t}s] ${SPINNER_STATES[b.state] ?? b.state}`);
-      last = b.state;
-    }
-    const notice = b.error?.stage === "testflight" ? b.error.raw : "";
-    if (notice && notice !== lastNotice) {
-      console.log(`   ${notice}`);
-      if (b.error.url) console.log(`   ${b.error.url}`);
-    }
-    lastNotice = notice;
-    if (b.state === "ready") {
-      console.log(
-        b.workflow === "smoke"
-          ? "\n🎉 smoke build passed: the project compiles clean on macOS."
-          : "\n🎉 build ready: open TestFlight on your phone, the new build is live.",
-      );
-      return;
-    }
-    if (b.state === "failed") {
-      const err = b.error ?? {};
-      console.log(`\n❌ build failed (${err.code ?? "unknown"})`);
-      if (err.raw) console.log(`   ${err.raw}`);
-      console.log(`   details: nomac logs ${id}`);
-      const e = new CliError("build failed", "");
-      e.friendly = "";
-      throw e;
-    }
-    await new Promise((r) => setTimeout(r, 10_000));
-  }
-}
-
-async function status(buildId) {
-  const state = loadProjectState();
-  const id = buildId ?? state.last_build;
-  if (!id) throw new CliError("no build", "No build id. Usage: nomac status <build-id>");
-  const b = await api("GET", `/api/v1/builds/${id}`);
-  console.log(JSON.stringify(b, null, 2));
-}
-
-async function logs(buildId) {
-  const state = loadProjectState();
-  const id = buildId ?? state.last_build;
-  if (!id) throw new CliError("no build", "No build id. Usage: nomac logs <build-id>");
-  const res = await api("GET", `/api/v1/builds/${id}/logs`);
-  for (const step of res.steps ?? []) {
-    console.log(`\n═══ ${step.name} [${step.status ?? "?"}] ═══`);
-    if (step.log) console.log(step.log);
-  }
-  if (res.excerpt) console.log(`\n═══ failure excerpt ═══\n${res.excerpt}`);
-}

package/src/mcp.mjs

@@ -9,9 +9,7 @@ import { createInterface } from "node:readline";
 import { api } from "./api.mjs";
 import { CLI_VERSION, mcpClientName, mcpContext, toolScope } from "./client-info.mjs";
 import { argumentProblem } from "./mcp-args.mjs";
-import { loadProjectState, saveProjectState } from "./config.mjs";
-import { packTarball } from "./pack.mjs";
-import { uploadSourceSnapshot } from "./upload.mjs";
+import { loadProjectState } from "./config.mjs";
 import { uploadStoreAsset } from "./store-upload.mjs";
 import { MAC_TOOLS } from "./mac-tools.mjs";
 
@@ -44,26 +42,11 @@ async function resolveProjectId(args) {
   if (args?.project_id) return args.project_id;
   const state = loadProjectState(args?.directory ?? process.cwd());
   if (state.project_id) return state.project_id;
-  throw new Error("no project here: run push_project first (or pass project_id)");
+  throw new Error("no project here: pass project_id (send_to_testflight answers with it, and connect_status lists the account's projects)");
 }
 
 export const TOOLS = [
   ...MAC_TOOLS,
-  {
-    name: "check_project", description: "Free source-readiness check of the latest uploaded snapshot. No Apple credentials or paid compute. Run push_project first or after code changes; this does not prove compilation or TestFlight delivery.",
-    inputSchema: { type: "object", properties: { project_id: { type: "string" } }, additionalProperties: false },
-    handler: async args => text(await api("POST", "/api/v1/check-project", { body: { project_id: await resolveProjectId(args) } })),
-  },
-  {
-    name: "get_billing_status", description: "Read confirmed payment, contracted prices, quota/reset, renewal and first-purchase refund eligibility. After payment, resume a blocked build once with a fresh request_key only if the earlier response said build_started:false. Reconcile unknown outcomes first.",
-    inputSchema: { type: "object", properties: {}, additionalProperties: false },
-    handler: async () => text(await api("GET", "/api/v1/billing/status")),
-  },
-  {
-    name: "get_refund_status", description: "Read the progress of a refund the account owner requested at nomac.app/usage. Agents cannot request refunds; point the human to that page. Does not submit a refund or cancel anything.",
-    inputSchema: { type: "object", properties: { request_id: { type: "string" } }, required: ["request_id"], additionalProperties: false },
-    handler: async args => text(await api("GET", `/api/v1/billing/refund?request_id=${encodeURIComponent(args.request_id)}`)),
-  },
   {
     name: "upload_store_asset",
     description: "Upload a new Apple screenshot, preview, purchase image, supplemental reviewer attachment or encryption document from file_path (up to 500 MiB, subject to Apple limits) or data_base64 (2 MiB). Discover the createInstance operation/body and parent scope with get_store_capabilities/read_store. Preview by default; confirm:true reserves, uploads and commits. Preserve request_key and identical bytes/body to resume. ready:true requires Apple processing COMPLETE. Message attachments require App Store Connect.",
@@ -117,97 +100,6 @@ export const TOOLS = [
     },
     handler: async args => text(await api("PATCH", `/api/v1/projects/${await resolveProjectId(args)}`, { body: { connection_id: args.connection_id } })),
   },
-  {
-    name: "push_project",
-    description:
-      "Pack the project directory (respects .gitignore; secrets never leave the machine) and upload a snapshot. Auto-detects the Xcode project, scheme and bundle id, runs source-level review lint, and links the App Store Connect app record. Run after every code change, before build.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        directory: { type: "string", description: "project directory (default: cwd)" },
-      },
-      additionalProperties: false,
-    },
-    handler: async (args) => {
-      const dir = args?.directory ?? process.cwd();
-      let state = loadProjectState(dir);
-      if (!state.project_id) {
-        const name = dir.split("/").filter(Boolean).pop() ?? "app";
-        const created = await api("POST", "/api/v1/projects", { body: { name } });
-        state = { project_id: created.id, name };
-        saveProjectState(state, dir);
-      }
-      const { tarball, files } = await packTarball(dir);
-      const res = await uploadSourceSnapshot(state.project_id, tarball);
-      saveProjectState({ ...state, last_snapshot: res.snapshot_id }, dir);
-      return text({ project_id: state.project_id, files_packed: files.length, ...res });
-    },
-  },
-  {
-    name: "build",
-    description:
-      "Start a build. workflow=release (signed, uploads to TestFlight; costs one build from the plan quota) or smoke (unsigned compile check, fastest way to verify the project builds on macOS). Returns a build_id; poll it with status.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        project_id: { type: "string" },
-        workflow: { type: "string", enum: ["release", "smoke"], default: "release" },
-        request_key: { type: "string", description: "Reuse this key to reconcile an unknown response. Use a fresh key after a confirmed build_started:false and payment/setup completion." },
-      },
-      additionalProperties: false,
-    },
-    handler: async (args) => {
-      const project_id = await resolveProjectId(args);
-      const res = await api("POST", "/api/v1/builds", {
-        body: { project_id, workflow: args?.workflow ?? "release" },
-        idempotencyKey: args?.request_key ?? `mcp-${randomUUID()}`,
-      });
-      let warning;
-      try {
-        const state = loadProjectState();
-        if (state?.project_id === project_id) {
-          saveProjectState({ ...state, last_build: res.id });
-        } else {
-          warning = "Build started for a project outside this directory's saved project. Pass build_id to status.";
-        }
-      } catch {
-        // The paid attempt already exists. Return its ID even when the local
-        // directory is read-only, so the agent can poll without starting again.
-        warning = "Build started, but its ID could not be saved locally. Pass build_id to status.";
-      }
-      return text({
-        ...res,
-        ...(warning ? { warning } : {}),
-        note: "poll `status` every ~30s; a release build reaching `ready` means the phone can install it from TestFlight",
-      });
-    },
-  },
-  {
-    name: "status",
-    description: "Build status (state machine position). States: queued→mirrored→dispatched→building→uploading→processing→ready|failed.",
-    inputSchema: {
-      type: "object",
-      properties: { build_id: { type: "string", description: "defaults to the last build started here" } },
-      additionalProperties: false,
-    },
-    handler: async (args) => {
-      const id = args?.build_id ?? loadProjectState().last_build;
-      if (!id) return errText("no build_id given and no build started from this directory");
-      return text(await api("GET", `/api/v1/builds/${id}`));
-    },
-  },
-  {
-    name: "get_failure",
-    description:
-      "Structured failure detail for a failed build: {stage, code, kind, error_lines, hints, raw_excerpt}. kind=project → you fix the source and re-push; kind=account → relay the deep link to your human.",
-    inputSchema: {
-      type: "object",
-      properties: { build_id: { type: "string" } },
-      required: ["build_id"],
-      additionalProperties: false,
-    },
-    handler: async (args) => text(await api("GET", `/api/v1/builds/${args.build_id}/failure`)),
-  },
   {
     name: "review_lint",
     description:
@@ -403,18 +295,15 @@ export const TOOLS = [
   },
 ];
 
-/** The Builder's own tools: its plans are closed, so they are listed only for accounts that still have one. */
-const BUILDER_TOOLS = new Set(["check_project", "get_billing_status", "get_refund_status", "push_project", "build", "status", "get_failure"]);
-let subscriber;
+/** The Builder's tools, removed with it (October 2026): a call to one says what does its job now. */
+export const RETIRED_TOOLS = Object.fromEntries(["check_project", "push_project", "build", "status", "get_failure", "get_billing_status", "get_refund_status"].map(name => [name,
+  name === "get_billing_status" ? "get_billing_status was removed with the Builder, retired in October 2026: get_mac_credits shows the account's Mac credit."
+    : name === "get_refund_status" ? "get_refund_status was removed: refunds are the account owner's to ask, at support@nomac.app."
+    : `${name} was removed with the Builder, retired in October 2026: build and ship on a NoMac Mac instead. start_mac, build with exec_mac (xcodebuild), then set_up_signing, send_to_testflight and publish.`]));
 
-/**
- * Everyone gets the Mac, App Store and support tools (publish follows send_to_testflight for
- * every account); the Builder's own tools are listed only for its remaining subscribers.
- * Hidden tools still answer when called, so existing subscribers' agents keep working.
- */
-export async function listedTools(isSubscriber = () => (subscriber ??= api("GET", "/api/v1/billing/status").then(s => Boolean(s?.tier) && s.tier !== "none", () => false))) {
-  const legacy = await isSubscriber();
-  return TOOLS.filter(t => legacy || !BUILDER_TOOLS.has(t.name));
+/** Every tool is listed for every account. */
+export async function listedTools() {
+  return TOOLS;
 }
 
 export async function runMcpServer() {
@@ -457,6 +346,10 @@ export async function runMcpServer() {
           break;
         case "tools/call": {
           const tool = TOOLS.find((t) => t.name === params?.name);
+          if (!tool && Object.hasOwn(RETIRED_TOOLS, params?.name ?? "")) {
+            reply({ content: [{ type: "text", text: JSON.stringify({ error: { code: "tool_moved", message: RETIRED_TOOLS[params.name] } }, null, 2) }], isError: true });
+            break;
+          }
           if (!tool) return fail(-32602, `unknown tool: ${params?.name}`);
           const problem = argumentProblem(tool.inputSchema, params?.arguments ?? {});
           if (problem) {

package/src/pack.mjs

@@ -1,77 +0,0 @@
-import { readFileSync, readdirSync, statSync } from "node:fs";
-import { join, relative, sep } from "node:path";
-import ignoreFactory from "ignore";
-import * as tar from "tar";
-
-// Pack the working tree: respect .gitignore, always exclude the deny-list
-// (secrets never leave the machine), gzip in memory.
-
-const ALWAYS_IGNORE = [
-  ".git/",
-  "node_modules/",
-  ".nomac.json",
-  "*.p8",
-  "*.p12",
-  "*.mobileprovision",
-  "*.pem",
-  ".env",
-  ".env.*",
-  ".DS_Store",
-  "build/",
-  "DerivedData/",
-  "*.ipa",
-  "*.xcarchive",
-];
-
-export function collectFiles(dir) {
-  const denied = ignoreFactory().add(ALWAYS_IGNORE);
-  const relativePath = (base, path) => relative(base, path).split(sep).join("/");
-  const files = [];
-  const walk = (current, inherited = []) => {
-    let scopes = inherited;
-    try {
-      const rules = readFileSync(join(current, ".gitignore"), "utf8");
-      scopes = [...inherited, { base: current, ignore: ignoreFactory().add(rules) }];
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-    }
-    for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const full = join(current, entry.name);
-      const rel = relativePath(dir, full);
-      const relForIgnore = entry.isDirectory() ? `${rel}/` : rel;
-      if (denied.ignores(relForIgnore)) continue;
-      let ignored = false;
-      for (const scope of scopes) {
-        const scoped = relativePath(scope.base, full) + (entry.isDirectory() ? "/" : "");
-        const result = scope.ignore.test(scoped);
-        if (result.ignored) ignored = true;
-        else if (result.unignored) ignored = false;
-      }
-      if (ignored) continue;
-      if (entry.isDirectory()) walk(full, scopes);
-      else if (entry.isFile()) files.push(rel);
-    }
-  };
-  walk(dir);
-  return files.sort();
-}
-
-export async function packTarball(dir) {
-  const files = collectFiles(dir);
-  if (files.length === 0) {
-    throw new Error("nothing to pack (is this the right directory?)");
-  }
-  const chunks = [];
-  await new Promise((resolve, reject) => {
-    tar
-      .create({ gzip: true, cwd: dir, portable: true }, files)
-      .on("data", (c) => chunks.push(c))
-      .on("end", resolve)
-      .on("error", reject);
-  });
-  return { tarball: Buffer.concat(chunks), files };
-}
-
-export function totalSize(dir, files) {
-  return files.reduce((n, f) => n + statSync(join(dir, f)).size, 0);
-}

package/src/upload.mjs

@@ -1,36 +0,0 @@
-import { api, CliError } from "./api.mjs";
-
-/** Shared by the CLI and stdio MCP so both bypass the API's 4 MiB body limit. */
-export async function uploadSourceSnapshot(projectId, tarball) {
-  const path = `/api/v1/projects/${projectId}/snapshots`;
-  let grant;
-  try {
-    grant = await api("POST", `${path}/uploads`);
-  } catch (error) {
-    // Older servers have no grant route. Outages and authorization failures
-    // should remain actionable, not silently retry through another transport.
-    if (!(error instanceof CliError) || error.status !== 404 || (error.code && error.code !== "bad_response")) throw error;
-    if (tarball.length > 4 * 1024 * 1024) {
-      throw new CliError("direct uploads unavailable", "This server does not support direct source uploads. Update the server or reduce the compressed archive to 4 MiB.");
-    }
-    return api("POST", path, { raw: tarball });
-  }
-  if (typeof grant.upload_url !== "string" || typeof grant.upload_key !== "string" ||
-    !Number.isSafeInteger(grant.max_bytes) || grant.max_bytes <= 0) {
-    throw new CliError("invalid source upload grant");
-  }
-  if (tarball.length > grant.max_bytes) {
-    throw new CliError(
-      "tarball too large",
-      `Packed source is ${(tarball.length / 1048576).toFixed(1)} MiB; the limit is ${(grant.max_bytes / 1048576).toFixed(0)} MiB. Check .gitignore: build artifacts are recreated on the build VM.`,
-    );
-  }
-  const uploaded = await fetch(grant.upload_url, {
-    method: "PUT",
-    headers: { "content-type": "application/gzip", "content-length": String(tarball.length) },
-    body: tarball,
-  });
-  await uploaded.body?.cancel();
-  if (!uploaded.ok) throw new CliError(`upload failed (HTTP ${uploaded.status})`);
-  return api("POST", path, { body: { upload_key: grant.upload_key } });
-}