@glash/cli 0.2.38 → 0.2.40

package/README.md

@@ -4,7 +4,7 @@ The official command-line interface for [glashDB](https://glashdb.com).
 
 ## Install
 
-Pick whichever install style you prefer — all four produce the same `glash` command:
+Pick whichever install style you prefer - all four produce the same `glash` command:
 
 ```bash
 # Short-name (recommended)
@@ -18,7 +18,7 @@ pnpm add -g glashdb
 yarn global add glashdb
 bun add -g glashdb
 
-# No install — run on demand
+# No install - run on demand
 npx -y glashdb deploy
 ```
 
@@ -44,7 +44,7 @@ glash --version
 ```
 
 On macOS with Homebrew Node, the global prefix is usually
-`/opt/homebrew/bin` (Apple Silicon) or `/usr/local/bin` (Intel) — both are
+`/opt/homebrew/bin` (Apple Silicon) or `/usr/local/bin` (Intel) - both are
 typically already on `PATH`. With `nvm`, re-run `nvm use` in new shells or
 add `nvm use --default` to your shell init.
 
@@ -109,6 +109,14 @@ glash deploy --asset-mode auto --asset-threshold 100mb
 Every deploy prints a live monitor link. Open it to watch the black-screen deployment flow while the CLI is packaging, uploading, building, routing, and checking the live URL.
 Public asset offload prepares assets in small batches and uses multipart uploads for large files, so image/video-heavy `public/` folders can upload without forcing the source bundle over the platform limit.
 
+Before a local source upload, `glash deploy` automatically runs the project's
+`build` script with the package manager declared in `package.json` or detected
+from its lockfile. The progress display keeps the progress bar on top and shows
+the active step and latest build output underneath it. A failed local build
+stops the deployment before source is uploaded. Use `--no-build` only when you
+intentionally need to bypass this pre-deploy check. Remote Git deployments
+continue to build on the Glash build worker.
+
 Framework/runtime checks:
 
 `glash deploy` detects both the project framework and the runtime scripts in `package.json`. If they disagree, for example the project looks like Next.js but `start` calls `glash serve`, the CLI stops before upload and asks you to align the scripts or explicitly continue. Use `--ignore-framework-mismatch` only when the mismatch is intentional.
@@ -142,7 +150,8 @@ For glashjs projects, `glash deploy` detects `glashjs` or `glash.config.mjs`, ma
 | `glash projects:rm <slug>` | Delete a project |
 | `glash link <slug>` | Link the current directory to an existing project |
 | `glash open` | Open the linked project's primary domain |
-| `glash deploy [--prod] [--detach]` | Deploy the linked project; streams the pipeline until live |
+| `glash deploy [--prod] [--detach]` | Build and deploy the linked project; streams the pipeline until live |
+| `glash deploy --no-build` | Skip the automatic local build before uploading source |
 | `glash deploy --asset-mode offload` | Upload `public/` assets to object storage/CDN before zipping source |
 | `glash deploy --source-upload chunked` | Stage the source zip through multipart object storage to bypass Cloudflare's single-request cap |
 | `glash deployments` | List recent deployments |
@@ -200,7 +209,7 @@ The commands require PostgreSQL client tools locally: `pg_dump` for dumps,
 | --- | --- | --- |
 | `GLASH_API_URL` | `https://api.glashdb.com/api` | Override the API base (self-hosted, staging) |
 | `GLASH_APP_URL` | `https://glashdb.com` | Override the dashboard base used for live monitor links |
-| `GLASH_TOKEN` | — | Use this token instead of `~/.glash/credentials.json` (useful in CI) |
+| `GLASH_TOKEN` | - | Use this token instead of `~/.glash/credentials.json` (useful in CI) |
 | `GLASH_ASSET_OFFLOAD_THRESHOLD` | `100mb` | Default threshold for `glash deploy --asset-mode auto` |
 | `GLASH_ASSET_BATCH_SIZE` | `50` | Number of public assets prepared per request during `--asset-mode offload` |
 | `GLASH_SOURCE_UPLOAD_MODE` | `auto` | Source upload mode: `auto`, `direct`, or `chunked` |

package/bin/glash.mjs

@@ -49,7 +49,7 @@ const commands = {
 };
 
 function usage() {
-  info(`${color.bold('glash')} ${color.dim(`v${VERSION}`)} — glashDB command line
+  info(`${color.bold('glash')} ${color.dim(`v${VERSION}`)} - glashDB command line
 
 ${color.bold('USAGE')}
   glash <command> [args] [flags]
@@ -68,7 +68,7 @@ ${color.bold('PROJECTS')}
   open                        Open the project's primary domain in a browser
 
 ${color.bold('DEPLOY')}
-  deploy [--prod] [--detach]  Deploy the linked project, syncing .env files first
+  deploy [--prod] [--detach]  Build and deploy the linked project, syncing .env files
   new deploy                  Deploy to a brand new project, ignoring any existing link
   deployments                 List recent deployments
   status <id>                 Show deployment pipeline + events
@@ -98,6 +98,7 @@ ${color.bold('FLAGS')}
   --environment <name>        Env-var environment (default: production)
   --env-file <file[,file]>    Env file(s) to sync before deploy
   --no-env                    Skip automatic env sync during deploy
+  --no-build                  Skip the automatic local build before source upload
   --asset-mode <mode>         Public asset handling: inline, auto, offload
   --asset-threshold <size>    Auto-offload threshold (default: 100mb)
   --source-upload <mode>      Source upload: auto, direct, chunked

package/commands/deploy.mjs

@@ -5,11 +5,12 @@ import fg from 'fast-glob';
 import { execSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { zipDirectory } from '../lib/zip.mjs';
+import { buildProjectBeforeDeploy, compactBuildOutputLine } from '../lib/project-build.mjs';
 import { join, basename, extname } from 'node:path';
 import { tmpdir } from 'node:os';
 import { createReadStream, openAsBlob } from 'node:fs';
 import { access, readFile, rm, stat } from 'node:fs/promises';
-import { stdin, stdout } from 'node:process';
+import { stdin, stdout, stderr } from 'node:process';
 
 function currentCommit() {
   try {
@@ -147,6 +148,9 @@ export async function deploy({ flags }) {
   let dep;
   let envSummary = { count: 0, skipped: Boolean(flags['no-env']) };
   let assetSummary = { mode: requestedAssetMode, status: requestedAssetMode === 'inline' ? 'inline' : 'pending', offloaded: false, count: 0, bytes: 0, skipped: 0 };
+  let localBuild = remoteDeploy
+    ? { status: 'remote' }
+    : { status: 'pending' };
   let currentPhase = 'doing';
   const start = Date.now();
   const indicator = createDeployIndicator();
@@ -158,6 +162,7 @@ export async function deploy({ flags }) {
     source: remoteDeploy ? 'remote git deploy' : 'local upload',
     framework: projectProfile.framework,
     runtime: projectProfile.runtime?.summary || '',
+    localBuild,
     sourceUpload: { mode: remoteDeploy ? 'remote' : 'pending', parts: 0 },
     packagesUploaded: 0,
     filesIncluded: 0,
@@ -172,6 +177,33 @@ export async function deploy({ flags }) {
   info(`Live status: ${terminalLink(initialStatusUrl)}`);
   indicator.start(currentPhase);
 
+  if (!remoteDeploy) {
+    try {
+      localBuild = await buildProjectBeforeDeploy(process.cwd(), {
+        packageJson: projectProfile.runtime?.pkg,
+        skip: Boolean(flags['no-build']) || process.env.GLASH_CLI_BUILD_RUNNING === '1',
+        onStart: (plan) => {
+          indicator.setPhase('prebuilding', `Building project (${plan.displayCommand})`);
+        },
+        onLine: ({ line }) => {
+          const detail = compactBuildOutputLine(line);
+          if (detail) indicator.setDetail(`Building project — ${detail}`);
+        },
+      });
+      report.localBuild = localBuild;
+    } catch (e) {
+      localBuild = {
+        status: 'failed',
+        command: e.buildPlan?.displayCommand || '',
+      };
+      report.localBuild = localBuild;
+      indicator.fail('failed', 'Project build failed');
+      printBuildFailureOutput(e.buildOutput);
+      printDeployReport({ ...report, status: 'failed', error: `Project build failed: ${e.message}` });
+      return fail(`Project build failed: ${e.message}`);
+    }
+  }
+
   if (!flags['no-env']) {
     indicator.setPhase('syncing');
     try {
@@ -711,7 +743,7 @@ function sourceUploadPartSize(value) {
 }
 
 function sourceUploadConcurrency(flags = {}) {
-  // Default 4 — parts upload simultaneously and 4 is the measured throughput
+  // Default 4 - parts upload simultaneously and 4 is the measured throughput
   // sweet spot: a single connection can't saturate a typical uplink (~2.5x
   // speedup from parallelism), but past ~4 connections contention makes it
   // slower and unreliable. Override with --source-concurrency or
@@ -1243,6 +1275,7 @@ function printDeployReport(report) {
     ['Source', report.source || '-'],
     ['Framework', report.framework || 'auto'],
     ['Runtime', report.runtime || '-'],
+    ['Local build', formatLocalBuildSummary(report.localBuild)],
     ['Packages uploaded', formatPackagesUploaded(report)],
     ['Public assets', formatAssetSummary(report.assetSummary)],
     ['Deployment size', formatDeploymentSize(report)],
@@ -1269,6 +1302,27 @@ function formatReportStatus(status) {
   return status || '-';
 }
 
+function formatLocalBuildSummary(build) {
+  if (!build || build.status === 'pending') return 'pending';
+  if (build.status === 'remote') return 'handled by the Glash build worker';
+  if (build.status === 'built') {
+    const duration = Number.isFinite(build.durationMs) ? ` in ${formatDuration(build.durationMs)}` : '';
+    return `${build.displayCommand || 'build completed'}${duration}`;
+  }
+  if (build.status === 'failed') return `${build.command || 'build command'} failed`;
+  if (build.reason === 'disabled') return 'skipped (--no-build)';
+  if (build.reason === 'no-package-json') return 'skipped (no package.json)';
+  if (build.reason === 'no-build-script') return 'skipped (no build script)';
+  return build.status || '-';
+}
+
+function printBuildFailureOutput(output) {
+  const lines = String(output || '').trim().split(/\r?\n/).filter(Boolean).slice(-80);
+  if (!lines.length) return;
+  warn(`Build output (last ${lines.length} line${lines.length === 1 ? '' : 's'}):`);
+  stderr.write(`${lines.join('\n')}\n`);
+}
+
 function formatPackagesUploaded(report) {
   const count = report.packagesUploaded ?? 0;
   if (report.sourceUpload?.mode === 'chunked') {
@@ -1347,27 +1401,38 @@ function createDeployIndicator() {
   const interactive = Boolean(stdout.isTTY);
   let timer;
   let phase = 'doing';
+  let detail = detailFromPhase(phase);
   let progress = 0;
   let lastPrinted = '';
+  let rendered = false;
 
-  function message() {
+  function messages() {
     const width = 24;
     const filled = Math.round((progress / 100) * width);
     const bar = `${'#'.repeat(filled)}${'-'.repeat(width - filled)}`;
     const percent = `${String(Math.round(progress)).padStart(3, ' ')}%`;
-    return `${color.dim(`[${bar}]`)} ${percent} ${phase}`;
+    return {
+      bar: `${color.dim(`[${bar}]`)} ${percent}`,
+      status: `  ${color.cyan('→')} ${detail}`,
+    };
   }
 
   function render({ force = false } = {}) {
-    const next = message();
+    const next = messages();
+    const signature = `${next.bar}\n${next.status}`;
+    if (signature === lastPrinted) return;
     if (!interactive) {
-      if (force && next !== lastPrinted) {
-        lastPrinted = next;
-        info(next);
+      if (force) {
+        lastPrinted = signature;
+        info(next.bar);
+        info(next.status);
       }
       return;
     }
-    stdout.write(`\r\x1b[2K${next}`);
+    if (rendered) stdout.write('\r\x1b[2K\x1b[1A\r\x1b[2K');
+    stdout.write(`${next.bar}\n${next.status}`);
+    lastPrinted = signature;
+    rendered = true;
   }
 
   function stopTimer() {
@@ -1375,45 +1440,59 @@ function createDeployIndicator() {
     timer = undefined;
   }
 
-  function setProgress(nextProgress, nextPhase = phase) {
+  function updateProgress(nextProgress, nextPhase = phase, nextDetail) {
     const bounded = Math.max(0, Math.min(100, Number(nextProgress) || 0));
     const advanced = Math.max(progress, bounded);
-    const changed = nextPhase !== phase || advanced !== progress;
+    const resolvedDetail = nextDetail || (nextPhase !== phase ? detailFromPhase(nextPhase) : detail);
+    const changed = nextPhase !== phase || advanced !== progress || resolvedDetail !== detail;
     phase = nextPhase;
     progress = advanced;
+    detail = resolvedDetail;
     if (changed) render({ force: true });
   }
 
   return {
     start(initialPhase = 'doing') {
       phase = initialPhase;
+      detail = detailFromPhase(initialPhase);
       progress = 0;
+      lastPrinted = '';
+      rendered = false;
       render({ force: true });
       timer = setInterval(render, 1000);
     },
-    setPhase(nextPhase) {
+    setPhase(nextPhase, nextDetail) {
       if (!nextPhase) return;
-      setProgress(progressFromPhase(nextPhase), nextPhase);
+      updateProgress(progressFromPhase(nextPhase), nextPhase, nextDetail);
     },
-    setProgress(nextProgress, nextPhase = phase) {
-      setProgress(nextProgress, nextPhase);
+    setProgress(nextProgress, nextPhase = phase, nextDetail) {
+      updateProgress(nextProgress, nextPhase, nextDetail);
     },
-    finish(finalPhase = 'complete') {
+    setDetail(nextDetail) {
+      const value = String(nextDetail || '').trim();
+      if (!value || value === detail) return;
+      detail = value;
+      render();
+    },
+    finish(finalPhase = 'complete', finalDetail = detailFromPhase(finalPhase)) {
       stopTimer();
       phase = finalPhase;
+      detail = finalDetail;
       progress = 100;
       render({ force: true });
       if (interactive) stdout.write('\n');
     },
-    fail(finalPhase = 'failed') {
+    fail(finalPhase = 'failed', finalDetail = detailFromPhase(finalPhase)) {
       stopTimer();
       phase = finalPhase;
+      detail = finalDetail;
       render({ force: true });
       if (interactive) stdout.write('\n');
     },
     stop() {
       stopTimer();
-      if (interactive) stdout.write('\r\x1b[2K');
+      if (interactive && rendered) stdout.write('\r\x1b[2K\x1b[1A\r\x1b[2K');
+      rendered = false;
     },
     wait(ms) {
       return sleep(ms);
@@ -1421,14 +1500,38 @@ function createDeployIndicator() {
   };
 }
 
+function detailFromPhase(phase) {
+  const details = {
+    doing: 'Preparing deployment',
+    prebuilding: 'Building project',
+    syncing: 'Syncing environment variables',
+    assets: 'Preparing public assets',
+    packaging: 'Packaging source files',
+    uploading: 'Uploading source chunks',
+    glashing: 'Uploading source bundle',
+    hatching: 'Waiting for a Glash build worker',
+    waiting: 'Waiting for deployment updates',
+    building: 'Building project on Glash',
+    deploying: 'Deploying application',
+    routing: 'Configuring domains and routing',
+    checking: 'Checking the live deployment',
+    complete: 'Deployment complete',
+    queued: 'Deployment queued',
+    failed: 'Deployment failed',
+    'timed out': 'Deployment timed out',
+  };
+  return details[phase] || String(phase || 'Working');
+}
+
 function progressFromPhase(phase) {
   const progressByPhase = {
     doing: 2,
-    syncing: 8,
-    assets: 15,
-    packaging: 22,
-    uploading: 28,
-    glashing: 35,
+    prebuilding: 7,
+    syncing: 12,
+    assets: 18,
+    packaging: 25,
+    uploading: 32,
+    glashing: 38,
     hatching: 45,
     waiting: 48,
     building: 65,

package/commands/login.mjs

@@ -7,6 +7,17 @@ import { prompt, ok, fail, info, warn, color } from '../lib/ui.mjs';
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
+async function identityPost(path, body, opts) {
+  try {
+    return await apiPost(`/identity${path}`, body, opts);
+  } catch (e) {
+    if (e?.status === 404) {
+      return apiPost(`/auth${path}`, body, opts);
+    }
+    throw e;
+  }
+}
+
 function openBrowser(url) {
   try {
     const opener = platform === 'darwin' ? 'open' : platform === 'win32' ? 'cmd' : 'xdg-open';
@@ -29,9 +40,9 @@ export async function login({ flags }) {
 async function browserLogin(flags) {
   let start;
   try {
-    start = await apiPost('/auth/cli/device/start', { deviceName: hostname() });
+    start = await identityPost('/cli/device/start', { deviceName: hostname() });
   } catch (e) {
-    // Older backend without device auth — fall back to password login.
+    // Older backend without device auth - fall back to password login.
     warn('Browser login is unavailable; falling back to email/password.');
     return passwordLogin(flags);
   }
@@ -50,7 +61,7 @@ async function browserLogin(flags) {
   } else if (openBrowser(approveUrl)) {
     info(color.dim('  Opened your browser… waiting for approval.'));
   } else {
-    info('  Could not open a browser automatically — open the link above.');
+    info('  Could not open a browser automatically - open the link above.');
   }
 
   const deadline = Date.now() + expiresIn * 1000;
@@ -60,7 +71,7 @@ async function browserLogin(flags) {
       await sleep(delay);
       let r;
       try {
-        r = await apiPost('/auth/cli/device/poll', { deviceCode });
+        r = await identityPost('/cli/device/poll', { deviceCode });
       } catch (e) {
         return fail(e.message);
       }
@@ -84,16 +95,16 @@ async function passwordLogin(flags) {
   if (!email || !password) return fail('email and password required');
 
   try {
-    let r = await apiPost('/auth/login', { email, password });
+    let r = await identityPost('/login', { email, password });
 
     // Second factor is always required. Complete the email-OTP challenge.
     if (!r?.accessToken && r?.secondFactorRequired && !r?.challengeId) {
-      r = await apiPost('/auth/login', { email, password, secondFactorMethod: 'email_otp' });
+      r = await identityPost('/login', { email, password, secondFactorMethod: 'email_otp' });
     }
     if (!r?.accessToken && (r?.otpRequired || r?.challengeId)) {
       const code = flags.otp || (await prompt('Enter the 6-digit code sent to your email: '));
       if (!code) throw new Error('A verification code is required to sign in.');
-      r = await apiPost('/auth/login', {
+      r = await identityPost('/login', {
         email,
         password,
         emailOtpCode: String(code).trim(),

package/commands/logout.mjs

@@ -11,7 +11,7 @@ export async function logout() {
     try {
       await apiPost('/auth/logout', {}, { token });
     } catch (e) {
-      info(color.dim(`(server-side revoke failed: ${e?.message || e} — clearing local creds anyway)`));
+      info(color.dim(`(server-side revoke failed: ${e?.message || e} - clearing local creds anyway)`));
     }
   }
   await clearCreds();

package/commands/open.mjs

@@ -12,7 +12,7 @@ export async function open({ flags }) {
   try {
     const p = await apiGet(`/projects/${projectId}`);
     const primary = p.domains?.find((d) => d.isPrimary) ?? p.domains?.[0];
-    if (!primary) return fail('Project has no domains yet — deploy first.');
+    if (!primary) return fail('Project has no domains yet - deploy first.');
     url = `https://${primary.domain}`;
   } catch (e) {
     return fail(e.message);

package/commands/whoami.mjs

@@ -10,6 +10,6 @@ export async function whoami() {
     info(`${color.bold(me.email)}  ${color.dim(`(${me.role})`)}`);
     info(color.dim(`API: ${API_URL}`));
   } catch (e) {
-    fail(`${e.message} — try \`glash login\` again`);
+    fail(`${e.message} - try \`glash login\` again`);
   }
 }

package/lib/api.mjs

@@ -65,7 +65,7 @@ export async function api(method, path, { body, token, query, retries = DEFAULT_
   }
 
   // FormData bodies carry file Blobs backed by the on-disk zip, so they are
-  // re-streamable — fetch reads them fresh on each attempt, which lets us
+  // re-streamable - fetch reads them fresh on each attempt, which lets us
   // retry uploads without re-zipping.
   const requestBody = isForm ? body : (body === undefined ? undefined : JSON.stringify(body));
   const effectiveTimeout = timeoutMs ?? (isForm ? UPLOAD_TIMEOUT_MS : DEFAULT_TIMEOUT_MS);

package/lib/project-build.mjs

@@ -0,0 +1,146 @@
+import { spawn } from 'node:child_process';
+import { access, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+const PACKAGE_MANAGERS = new Set(['npm', 'pnpm', 'yarn', 'bun']);
+const LOCKFILES = [
+  ['pnpm-lock.yaml', 'pnpm'],
+  ['yarn.lock', 'yarn'],
+  ['bun.lock', 'bun'],
+  ['bun.lockb', 'bun'],
+  ['package-lock.json', 'npm'],
+  ['npm-shrinkwrap.json', 'npm'],
+];
+const MAX_CAPTURED_OUTPUT = 64 * 1024;
+
+export async function planProjectBuild(cwd, { packageJson } = {}) {
+  const pkg = packageJson ?? await readPackageJson(cwd);
+  if (!pkg) {
+    return { status: 'skipped', reason: 'no-package-json' };
+  }
+
+  const script = String(pkg.scripts?.build || '').trim();
+  if (!script) {
+    return { status: 'skipped', reason: 'no-build-script' };
+  }
+
+  const packageManager = await detectPackageManager(cwd, pkg);
+  const args = ['run', 'build'];
+  return {
+    status: 'ready',
+    command: packageManager,
+    args,
+    displayCommand: `${packageManager} ${args.join(' ')}`,
+    script,
+  };
+}
+
+export async function buildProjectBeforeDeploy(cwd, {
+  packageJson,
+  skip = false,
+  onStart,
+  onLine,
+  spawnImpl = spawn,
+  env = process.env,
+} = {}) {
+  if (skip) return { status: 'skipped', reason: 'disabled' };
+
+  const plan = await planProjectBuild(cwd, { packageJson });
+  if (plan.status !== 'ready') return plan;
+
+  onStart?.(plan);
+  const startedAt = Date.now();
+  let capturedOutput = '';
+
+  const appendOutput = (stream, line) => {
+    const text = String(line || '').trimEnd();
+    if (!text) return;
+    capturedOutput += `${stream === 'stderr' ? '[stderr] ' : ''}${text}\n`;
+    if (capturedOutput.length > MAX_CAPTURED_OUTPUT) {
+      capturedOutput = capturedOutput.slice(-MAX_CAPTURED_OUTPUT);
+    }
+    try { onLine?.({ stream, line: text }); } catch {}
+  };
+
+  await new Promise((resolve, reject) => {
+    const child = spawnImpl(plan.command, plan.args, {
+      cwd,
+      env: { ...env, GLASH_CLI_BUILD_RUNNING: '1' },
+      stdio: ['inherit', 'pipe', 'pipe'],
+    });
+
+    streamLines(child.stdout, (line) => appendOutput('stdout', line));
+    streamLines(child.stderr, (line) => appendOutput('stderr', line));
+
+    child.once('error', (cause) => {
+      const error = new Error(`Could not start ${plan.displayCommand}: ${cause.message}`, { cause });
+      error.buildOutput = capturedOutput;
+      error.buildPlan = plan;
+      reject(error);
+    });
+    child.once('close', (code, signal) => {
+      if (code === 0) return resolve();
+      const outcome = signal ? `signal ${signal}` : `exit code ${code ?? 'unknown'}`;
+      const error = new Error(`${plan.displayCommand} failed with ${outcome}`);
+      error.exitCode = code;
+      error.signal = signal;
+      error.buildOutput = capturedOutput;
+      error.buildPlan = plan;
+      reject(error);
+    });
+  });
+
+  return {
+    ...plan,
+    status: 'built',
+    durationMs: Date.now() - startedAt,
+    output: capturedOutput,
+  };
+}
+
+export function compactBuildOutputLine(line, maxLength = 110) {
+  const compact = String(line || '')
+    .replace(/\x1B\][^\x07]*(?:\x07|\x1B\\)/g, '')
+    .replace(/\x1B\[[0-?]*[ -/]*[@-~]/g, '')
+    .replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/g, '')
+    .replace(/\s+/g, ' ')
+    .trim();
+  if (!compact) return '';
+  return compact.length > maxLength ? `${compact.slice(0, maxLength - 1)}…` : compact;
+}
+
+async function detectPackageManager(cwd, pkg) {
+  const declared = String(pkg.packageManager || '').trim().toLowerCase().match(/^([a-z]+)(?:@|$)/)?.[1];
+  if (declared && PACKAGE_MANAGERS.has(declared)) return declared;
+
+  for (const [filename, packageManager] of LOCKFILES) {
+    try {
+      await access(join(cwd, filename));
+      return packageManager;
+    } catch {}
+  }
+  return 'npm';
+}
+
+async function readPackageJson(cwd) {
+  try {
+    return JSON.parse(await readFile(join(cwd, 'package.json'), 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function streamLines(stream, onLine) {
+  if (!stream) return;
+  let pending = '';
+  stream.setEncoding('utf8');
+  stream.on('data', (chunk) => {
+    pending += chunk;
+    const lines = pending.split(/\r?\n|\r/);
+    pending = lines.pop() ?? '';
+    for (const line of lines) onLine(line);
+  });
+  stream.on('end', () => {
+    if (pending) onLine(pending);
+  });
+}

package/lib/ui.mjs

@@ -25,7 +25,7 @@ export async function prompt(question, { mask = false } = {}) {
     rl.close();
     return a.trim();
   }
-  // Masked input — write * for each typed char. readline doesn't natively
+  // Masked input - write * for each typed char. readline doesn't natively
   // mask, so we monkey-patch the output stream for this prompt only.
   const orig = rl._writeToOutput?.bind(rl);
   rl._writeToOutput = (s) => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@glash/cli",
-  "version": "0.2.38",
-  "description": "glashDB command-line interface — deploy projects, pull source + env, manage env vars.",
+  "version": "0.2.40",
+  "description": "glashDB command-line interface - deploy projects, pull source + env, manage env vars.",
   "license": "Apache-2.0",
   "homepage": "https://glashdb.com",
   "repository": {
@@ -30,13 +30,9 @@
     "database"
   ],
   "dependencies": {
-    "chalk": "^5.3.0",
-    "commander": "^12.1.0",
     "dotenv": "^16.4.5",
     "fast-glob": "^3.3.3",
     "fs-extra": "^11.2.0",
-    "open": "^10.1.0",
-    "ora": "^8.0.1",
     "yazl": "^3.3.1"
   },
   "publishConfig": {