@supatype/cli 0.1.7 → 0.1.10

package/src/cache-pins.ts

@@ -1,5 +1,5 @@
 /**
- * Pin-aware cache eviction — collect `versions.*` pins across local projects (C13).
+ * Pin-aware cache eviction: collect `versions.*` pins across local projects (C13).
  */
 
 import { existsSync, readdirSync, rmSync, statSync } from "node:fs"
@@ -219,7 +219,7 @@ export function cleanCachedBinaries(options: CleanCachedBinariesOptions): CleanC
       if (!force && explicitVersion && pinned) {
         const reason = pinReason(component, version, sources) ?? "pinned"
         result.warned.push(
-          `${component}@${version} is ${reason} — removing anyway (explicit version)`,
+          `${component}@${version} is ${reason}: removing anyway (explicit version)`,
         )
       }
 

package/src/cli-artifacts.ts

@@ -0,0 +1,65 @@
+/**
+ * Names and locations of the published standalone CLI artefacts.
+ *
+ * One place, because this layout had drifted into five: the release workflow, install.sh,
+ * this module's caller, the Homebrew generator and a now-deleted second installer all
+ * described it independently, and `supatype self-update` was asking for bare executables the
+ * publisher had stopped writing. `scripts/install.sh` cannot import this (it runs before any
+ * CLI exists on the machine), so the shell keeps its own copy; what holds the two together is
+ * the round-trip test in tests/integration/scripts/cli-artifact-roundtrip.sh, not this file.
+ */
+
+import { existsSync, readdirSync } from "node:fs"
+import { currentPlatform, type PlatformId } from "./binary-cache.js"
+
+/**
+ * Which C library the running system provides. Only meaningful on Linux: Bun links
+ * libstdc++ and libgcc dynamically, so a glibc build cannot start on Alpine, and installing a
+ * glibc binary over a working musl one is how a self-update would brick an Alpine install.
+ */
+export type LibcId = "glibc" | "musl"
+
+/** Detects musl by its dynamic loader, the same signal scripts/install.sh uses. */
+export function currentLibc(platform: PlatformId = currentPlatform()): LibcId {
+  if (platform.os !== "linux") return "glibc"
+  if (!existsSync("/lib")) return "glibc"
+  try {
+    const musl = readdirSync("/lib").some((f) => f.startsWith("ld-musl-") && f.endsWith(".so.1"))
+    return musl ? "musl" : "glibc"
+  } catch {
+    return "glibc"
+  }
+}
+
+/**
+ * The archive published for a platform. Windows gets a zip because that is what Windows
+ * users can open without extra tools; everything else is a tarball. Both hold a single
+ * executable called `supatype` (`supatype.exe` on Windows), whatever the archive is named.
+ */
+export function cliArchiveName(
+  platform: PlatformId = currentPlatform(),
+  libc: LibcId = currentLibc(platform),
+): string {
+  const suffix = platform.os === "linux" && libc === "musl" ? "-musl" : ""
+  const ext = platform.os === "windows" ? "zip" : "tar.gz"
+  return `supatype-cli-${platform.os}-${platform.arch}${suffix}.${ext}`
+}
+
+/** The executable inside the archive. */
+export function cliExecutableName(platform: PlatformId = currentPlatform()): string {
+  return platform.os === "windows" ? "supatype.exe" : "supatype"
+}
+
+/** CDN path of a version's archive, relative to the CDN root. */
+export function cliArchivePath(
+  version: string,
+  platform: PlatformId = currentPlatform(),
+  libc: LibcId = currentLibc(platform),
+): string {
+  return `/cli/v${version}/${cliArchiveName(platform, libc)}`
+}
+
+/** CDN path of the checksums file covering every archive in a version. */
+export function cliChecksumsPath(version: string): string {
+  return `/cli/v${version}/checksums.sha256`
+}

package/src/cli-install-method.ts

@@ -8,9 +8,40 @@ function normalizePath(path: string): string {
   return path.replace(/\\/g, "/")
 }
 
+/**
+ * Inside a Bun-compiled binary, argv[1] is a path in the embedded filesystem, not on disk:
+ * `/$bunfs/root/supatype` on Linux and macOS, `B:/~BUN/root/supatype.exe` on Windows. No
+ * filesystem call can touch either, which is why self-update failed with
+ * `ENOENT: copyfile '/$bunfs/root/supatype'` and could never have replaced itself.
+ */
+const EMBEDDED_FS_PATH = /(^|\/)(\$bunfs|~BUN)\//i
+
+/**
+ * The executable on disk.
+ *
+ * process.execPath is the compiled binary when running one, and the Node binary otherwise, so
+ * it is only correct to prefer it when argv[1] is an embedded path. Under Node the script path
+ * is what identifies the install.
+ */
+/**
+ * True when this process is a compiled single-file binary rather than Node running our JS.
+ *
+ * The distinction decides capability, not cosmetics: a compiled binary carries the Bun runtime
+ * and can import TypeScript directly, while it has no node_modules to resolve tsx from and no
+ * writable directory beside itself. A machine that installed with `curl | sh` has no Node at all.
+ */
+export function isCompiledBinary(): boolean {
+  return EMBEDDED_FS_PATH.test(normalizePath(process.argv[1] ?? ""))
+}
+
+export function runningBinaryPath(): string {
+  const main = normalizePath(process.argv[1] ?? "")
+  return EMBEDDED_FS_PATH.test(main) ? process.execPath : (process.argv[1] ?? "")
+}
+
 /** The running binary sits in an npm or workspace layout. */
 function hasNpmInstallPath(): boolean {
-  const main = normalizePath(process.argv[1] ?? "")
+  const main = normalizePath(runningBinaryPath())
   return (
     main.includes("node_modules") ||
     main.includes("/dist/cli") ||
@@ -30,7 +61,7 @@ export function looksLikeNpmOrWorkspaceCLI(): boolean {
 
 /** Homebrew / Linuxbrew Cellar layout. */
 export function looksLikeHomebrewCLI(): boolean {
-  const main = normalizePath(process.argv[1] ?? "")
+  const main = normalizePath(runningBinaryPath())
   if (!main) return false
 
   if (/(?:^|\/)Cellar\/supatype\//.test(main)) return true
@@ -44,7 +75,7 @@ export function looksLikeHomebrewCLI(): boolean {
 }
 
 /**
- * Which installer owns the running binary — this decides what `self-update`
+ * Which installer owns the running binary. This decides what `self-update`
  * tells the user to run, so it has to describe the binary on disk.
  *
  * Path shape wins over `npm_*` in the environment: those are set whenever the
@@ -62,6 +93,6 @@ export function detectCliInstallMethod(): CliInstallMethod {
 
 /** The `curl | sh` installer's default target. */
 function isStandalonePath(): boolean {
-  const main = normalizePath(process.argv[1] ?? "")
+  const main = normalizePath(runningBinaryPath())
   return main.includes("/.supatype/bin/")
 }

package/src/cli-package-version.ts

@@ -1,11 +1,15 @@
 import { readFileSync } from "node:fs"
 import { dirname, join } from "node:path"
 import { fileURLToPath } from "node:url"
+import { EMBEDDED_CLI_VERSION } from "./cli-version-embedded.js"
 
 const CLI_PACKAGE_JSON = join(dirname(fileURLToPath(import.meta.url)), "..", "package.json")
 
-/** Installed @supatype/cli version from package.json (used by --version and init scaffolding). */
+/** Installed @supatype/cli version (used by --version and init scaffolding). */
 export function cliPackageVersion(): string {
+  // Set in published builds; the package.json read below only works when one is on disk,
+  // which is true for the npm package and false inside the standalone binary.
+  if (EMBEDDED_CLI_VERSION !== "") return EMBEDDED_CLI_VERSION
   try {
     const pkg = JSON.parse(readFileSync(CLI_PACKAGE_JSON, "utf8")) as { version?: string }
     return pkg.version ?? "0.0.0"

package/src/cli-standalone.ts

@@ -1,23 +1,45 @@
 /**
- * Standalone CLI binary CDN download (self-update + curl|sh installers).
+ * Standalone CLI archive download, used by `supatype self-update`.
+ *
+ * The artefact is a per-platform archive holding one executable, not a bare executable, and it
+ * is verified against the release's checksums.sha256 before anything is replaced. Previously
+ * this path checked only that the download was over 64 bytes and did not begin like HTML or
+ * JSON, which made the CLI stricter about a postgres archive than about overwriting itself.
  */
 
-import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs"
-import { homedir } from "node:os"
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { createHash } from "node:crypto"
+import { homedir, tmpdir } from "node:os"
 import { join } from "node:path"
-import { currentPlatform, type PlatformId } from "./binary-cache.js"
+import { spawnSync } from "node:child_process"
+import { currentPlatform, fetchChecksums, type PlatformId } from "./binary-cache.js"
+import {
+  cliArchiveName,
+  cliArchivePath,
+  cliChecksumsPath,
+  cliExecutableName,
+  currentLibc,
+  type LibcId,
+} from "./cli-artifacts.js"
 
-const CDN_BASE = "https://releases.supatype.com"
-
-export function cliCdnPath(version: string, platform: PlatformId): string {
-  const win = platform.os === "windows"
-  return `/cli/v${version}/supatype-cli-${platform.os}-${platform.arch}${win ? ".exe" : ""}`
-}
+/**
+ * Overridable for the same reason scripts/install.sh takes SUPATYPE_CDN: with the host fixed,
+ * nothing can exercise this path except a real release, which is how it came to request bare
+ * executables the publisher had stopped writing. SUPATYPE_CDN_BASE is the CDN root, where
+ * install.sh's SUPATYPE_CDN is the root plus /cli.
+ *
+ * binary-cache.ts hardcodes the same host for component downloads and could use the same
+ * treatment, which is left alone here as it is not part of this change.
+ */
+const CDN_BASE = process.env["SUPATYPE_CDN_BASE"]?.replace(/\/$/, "")
+  || "https://releases.supatype.com"
 
-export function cliCachePath(version: string, platform: PlatformId = currentPlatform()): string {
-  const win = platform.os === "windows"
-  const name = `supatype-cli-${platform.os}-${platform.arch}${win ? ".exe" : ""}`
-  return join(homedir(), ".supatype", "cache", "cli", version, name)
+/** Where a downloaded release is unpacked, so a repeated update does not refetch it. */
+export function cliCachePath(
+  version: string,
+  platform: PlatformId = currentPlatform(),
+): string {
+  return join(homedir(), ".supatype", "cache", "cli", version, cliExecutableName(platform))
 }
 
 export async function fetchStandaloneCliLatestVersion(): Promise<string> {
@@ -32,31 +54,91 @@ export async function fetchStandaloneCliLatestVersion(): Promise<string> {
   return data.version.trim()
 }
 
-/** Download the standalone CLI binary for the current platform. */
-export async function downloadStandaloneCli(version?: string): Promise<string> {
-  const platform = currentPlatform()
-  const resolved = version ?? await fetchStandaloneCliLatestVersion()
-  const dest = cliCachePath(resolved, platform)
-  if (existsSync(dest)) return dest
-
-  const url = `${CDN_BASE}${cliCdnPath(resolved, platform)}`
+async function fetchBytes(url: string, what: string): Promise<Buffer> {
   const resp = await fetch(url)
   if (!resp.ok) {
-    throw new Error(`Failed to download CLI from ${url}: HTTP ${resp.status}`)
+    throw new Error(`Failed to download ${what} from ${url}: HTTP ${resp.status}`)
   }
-  const buf = Buffer.from(await resp.arrayBuffer())
-  if (buf.length < 64) {
-    throw new Error("Downloaded CLI artifact is too small")
+  return Buffer.from(await resp.arrayBuffer())
+}
+
+/**
+ * Unpack the single executable from an archive.
+ *
+ * PowerShell on Windows, because Git Bash's tar is usually first on PATH there and chokes on
+ * drive-letter paths. The same split exists in commands/dev.ts for component archives.
+ */
+function unpackExecutable(archivePath: string, destDir: string, platform: PlatformId): string {
+  mkdirSync(destDir, { recursive: true })
+  const result = platform.os === "windows"
+    ? spawnSync(
+        "powershell.exe",
+        [
+          "-NoProfile",
+          "-Command",
+          `Expand-Archive -Path '${archivePath}' -DestinationPath '${destDir}' -Force`,
+        ],
+        { stdio: "pipe" },
+      )
+    : spawnSync("tar", ["-xzf", archivePath, "-C", destDir], { stdio: "pipe" })
+
+  if (result.status !== 0) {
+    throw new Error(
+      `Failed to unpack ${archivePath}: ${result.stderr?.toString().trim() || "unknown error"}`,
+    )
   }
-  const head = buf.subarray(0, 5).toString("utf8").toLowerCase()
-  if (head.startsWith("<!doc") || head.startsWith("{")) {
-    throw new Error("Downloaded CLI artifact looks like an error page, not a binary")
+
+  const exe = join(destDir, cliExecutableName(platform))
+  if (!existsSync(exe)) {
+    throw new Error(
+      `${cliArchiveName(platform)} did not contain ${cliExecutableName(platform)}.`,
+    )
+  }
+  return exe
+}
+
+/**
+ * Download and verify the standalone CLI for this machine, returning the path to the
+ * executable. Nothing is written to the cache until the checksum matches.
+ */
+export async function downloadStandaloneCli(
+  version?: string,
+  platform: PlatformId = currentPlatform(),
+  libc: LibcId = currentLibc(platform),
+): Promise<string> {
+  const resolved = version ?? await fetchStandaloneCliLatestVersion()
+  const dest = cliCachePath(resolved, platform)
+  if (existsSync(dest)) return dest
+
+  const name = cliArchiveName(platform, libc)
+  const archive = await fetchBytes(`${CDN_BASE}${cliArchivePath(resolved, platform, libc)}`, name)
+
+  // The manifest is verified before it is trusted, and only then is the archive compared
+  // against it. A checksum alone would prove the download was intact, not that it came from
+  // us, and the signature is what makes replacing our own executable no weaker than fetching
+  // a postgres archive. fetchChecksums treats the .minisig as mandatory and fails closed
+  // without a public key, which is the same rule component downloads follow.
+  const checksumsUrl = `${CDN_BASE}${cliChecksumsPath(resolved)}`
+  const expected = await fetchChecksums(checksumsUrl, `${checksumsUrl}.minisig`, name)
+  const actual = createHash("sha256").update(archive).digest("hex")
+  if (actual !== expected.checksum) {
+    throw new Error(
+      `Checksum mismatch for ${name}.\n  expected: ${expected.checksum}\n  actual:   ${actual}`,
+    )
   }
 
-  mkdirSync(join(dest, ".."), { recursive: true })
-  writeFileSync(dest, buf)
-  if (platform.os !== "windows") {
-    chmodSync(dest, 0o755)
+  const staging = join(tmpdir(), `supatype-cli-${resolved}-${process.pid}`)
+  try {
+    mkdirSync(staging, { recursive: true })
+    const archivePath = join(staging, name)
+    writeFileSync(archivePath, archive)
+    const unpacked = unpackExecutable(archivePath, staging, platform)
+
+    mkdirSync(join(dest, ".."), { recursive: true })
+    writeFileSync(dest, readFileSync(unpacked))
+    if (platform.os !== "windows") chmodSync(dest, 0o755)
+    return dest
+  } finally {
+    rmSync(staging, { recursive: true, force: true })
   }
-  return dest
 }

package/src/cli-version-embedded.ts

@@ -0,0 +1,12 @@
+/**
+ * CLI version, baked in at publish by scripts/set-version.mjs.
+ *
+ * The standalone binary cannot read its own package.json: pkg carries only files it can
+ * find by static analysis, and that path is assembled at runtime, so `--version` inside a
+ * published binary would answer 0.0.0 without this. Empty in a source checkout, where
+ * cliPackageVersion() falls back to reading package.json.
+ */
+// Annotated `string`, not left to inference: once a release stamps a value here, the
+// inferred literal type makes the `!== ""` test in cliPackageVersion() a compile error
+// (TS2367, no overlap), so the build would only fail during a release.
+export const EMBEDDED_CLI_VERSION: string = "0.1.10"

package/src/cli.ts

@@ -39,7 +39,7 @@ import { wrapProgramActionsWithChrome } from "./ui/runtime/command-chrome.js"
 export async function run(): Promise<void> {
   const program = new Command()
     .name("supatype")
-    .description("Supatype — type-first platform for PostgreSQL")
+    .description("Supatype: type-first platform for PostgreSQL")
     .version(cliPackageVersion())
 
   registerInit(program)

package/src/commands/add.ts

@@ -1,6 +1,6 @@
 import type { Command } from "commander"
 import { p, runClackFlow } from "../ui/clack.js"
-import { loadConfig } from "../config.js"
+import { loadConfig, rethrowIfConfigBroken } from "../config.js"
 import { selfHostTlsEnabled } from "../project-config.js"
 import { updateServerConfigInProject } from "../app-config.js"
 import { ensureNotCancelled } from "../ui/prompts.js"
@@ -82,7 +82,8 @@ function printDomainNextSteps(cwd: string, domain: string): void {
   let tlsActive = true
   try {
     tlsActive = selfHostTlsEnabled(loadConfig(cwd))
-  } catch {
+  } catch (err) {
+    rethrowIfConfigBroken(err)
     // config re-load is best-effort for the warning below
   }
 
@@ -99,6 +100,6 @@ function printDomainNextSteps(cwd: string, domain: string): void {
     "supatype self-host compose up -d   # Kong provisions HTTPS automatically",
     `Platform URL: https://${domain}`,
   ])
-  plain("  App, REST, Auth, Storage, Realtime, Functions, and Studio — one HTTPS domain.")
+  plain("  App, REST, Auth, Storage, Realtime, Functions, and Studio, one HTTPS domain.")
   plain("  Certificates persist in the valkey-data volume.\n")
 }

package/src/commands/admin.ts

@@ -1,6 +1,6 @@
 // ─── Admin panel CLI commands (Gap Appendices task 48) ──────────────────────
 //
-// `npx supatype admin create-user` — create an admin user in the project's
+// `npx supatype admin create-user`, create an admin user in the project's
 // auth.users table. First admin is ensured on `supatype dev` or `supatype push`.
 
 import type { Command } from "commander"
@@ -242,7 +242,7 @@ export function registerAdmin(program: Command): void {
       const pool = new pg.Pool({ connectionString: connection, max: 2 })
 
       try {
-        // Studio access is membership, not a claim — list the grant that
+        // Studio access is membership, not a claim, list the grant that
         // actually decides admission. LEFT JOIN, because a membership held by a
         // Supatype Cloud account has no row in this project's `auth.users`;
         // hiding those would make `list-users` disagree with who can log in.
@@ -308,7 +308,7 @@ export async function ensureFirstAdminUser(
       options,
     )
   } catch {
-    // Non-fatal — skip when DB is unreachable or auth schema is not ready
+    // Non-fatal: skip when DB is unreachable or auth schema is not ready
   } finally {
     await pool.end()
   }
@@ -528,7 +528,7 @@ async function createAdminUser(
  * the developer's own app roles, and letting it grant Studio access means a
  * developer assigning an app role could hand out admin UI access by accident.
  *
- * This is now the *only* grant, so a failure here is fatal to the command — a
+ * This is now the *only* grant, so a failure here is fatal to the command, a
  * user created without a membership row cannot reach Studio at all, and
  * reporting success would leave no clue why.
  */
@@ -591,12 +591,12 @@ async function authUsersTableExists(query: DbQuery): Promise<boolean> {
  *
  * Counts membership rows, not `app_metadata` claims: the claim no longer grants
  * anything, so counting it would report an admin exists while nobody can log in.
- * A missing table means the project has never been pushed — no admins.
+ * A missing table means the project has never been pushed, no admins.
  */
 async function hasAdminUsers(query: DbQuery): Promise<boolean> {
   // Postgres resolves relations at parse time, so the table has to be checked
   // separately rather than guarded inside the count query. Absent means the
-  // project has never been pushed — no admins, and `createAdminUser` will
+  // project has never been pushed, no admins, and `createAdminUser` will
   // create the table itself.
   if (!(await studioMembersTableExists(query))) return false
 

package/src/commands/adopt.ts

@@ -54,7 +54,7 @@ export function registerAdopt(program: Command): void {
 
       const statements = preview.stampStatements ?? []
       if (statements.length === 0) {
-        info("Nothing to stamp — matching objects are already managed or absent.")
+        info("Nothing to stamp: matching objects are already managed or absent.")
         return
       }
 

package/src/commands/app.ts

@@ -17,7 +17,7 @@ export function registerApp(program: Command): void {
     .option("--static", "Serve a static directory at / (default: ./public, or [dir] argument)")
     .option("--port <port>", "Port your app listens on (proxy mode)", "3000")
     .option("--upstream <url>", "URL of your running dev server (proxy mode; defaults to localhost:<port>)")
-    .option("--dockerfile <path>", "(deprecated) ignored — use supatype.config.ts")
+    .option("--dockerfile <path>", "(deprecated) ignored, use supatype.config.ts")
     .action(
       (
         dir: string | undefined,
@@ -80,7 +80,7 @@ function addProxyApp(cwd: string, port: string, upstream?: string): void {
   try {
     const configPath = updateAppConfigInProject(cwd, { mode: "proxy", upstream: upstreamUrl })
     file("updated", configPath)
-    info(`Forwarding to ${upstreamUrl} — app at ${localKongBaseUrl()}/`)
+    info(`Forwarding to ${upstreamUrl}: app at ${localKongBaseUrl()}/`)
     nextSteps("Next:", ["supatype self-host compose render"])
   } catch (err) {
     error((err as Error).message)

package/src/commands/cache.ts

@@ -1,5 +1,5 @@
 /**
- * supatype cache — list and clean cached component binaries + REST Valkey cache.
+ * supatype cache: list and clean cached component binaries + REST Valkey cache.
  */
 
 import type { Command } from "commander"
@@ -126,7 +126,7 @@ export function registerCache(program: Command): void {
         if (result.removed.length === 0 && result.skipped.length === 0) {
           info("Nothing to clean.")
         } else if (opts?.dryRun) {
-          info(`Dry run — ${result.removed.length} entr${result.removed.length === 1 ? "y" : "ies"} would be removed.`)
+          info(`Dry run: ${result.removed.length} entr${result.removed.length === 1 ? "y" : "ies"} would be removed.`)
         } else {
           info("Done.")
         }
@@ -160,7 +160,7 @@ export function registerCache(program: Command): void {
           )
         }
         if (result.cursor !== "0") {
-          plain(`\n(more available — cursor ${result.cursor})`)
+          plain(`\n(more available: cursor ${result.cursor})`)
         }
       } catch (e) {
         error(e instanceof Error ? e.message : String(e))

package/src/commands/db.ts

@@ -1,12 +1,12 @@
 /**
  * Database connection commands:
- *   supatype db connection-string  — show the connection string for the linked project
- *   supatype db reset-password     — reset the database password
- *   supatype db check              — does this database meet what Supatype needs of it?
+ *   supatype db connection-string: show the connection string for the linked project
+ *   supatype db reset-password: reset the database password
+ *   supatype db check: does this database meet what Supatype needs of it?
  */
 
 import type { Command } from "commander"
-import { loadConfig } from "../config.js"
+import { loadConfig, rethrowIfConfigBroken } from "../config.js"
 import { connectionString } from "../project-config.js"
 import { loadProjectLink } from "../link.js"
 import { resolveTarget } from "../resolve-target.js"
@@ -153,8 +153,9 @@ export function registerDb(program: Command): void {
           const config = loadConfig(cwd)
           url = url ?? connectionString(config)
           schema = schema ?? config.schema?.pg_schema ?? "public"
-        } catch {
-          // Runnable outside a project, which is the point — an operator should be able to check a
+        } catch (err) {
+          rethrowIfConfigBroken(err)
+          // Runnable outside a project, which is the point, an operator should be able to check a
           // database before committing to any config at all.
           url = url ?? process.env["DATABASE_URL"]
           schema = schema ?? "public"
@@ -190,7 +191,7 @@ export function registerDb(program: Command): void {
         if (opts.emit) {
           // Machine-consumable: SQL on stdout, commentary on stderr, so it can be piped to psql.
           if (fixable.length === 0) {
-            warn("Nothing to emit — no SQL-fixable findings.")
+            warn("Nothing to emit: no SQL-fixable findings.")
           } else {
             plain("BEGIN;")
             for (const r of fixable) plain(`\n-- ${r.title}\n${r.remedy}`)
@@ -198,7 +199,7 @@ export function registerDb(program: Command): void {
           }
           if (manual.length > 0) {
             warn(`\n${manual.length} finding(s) need operator action and are not included above:`)
-            for (const r of manual) warn(`  ${r.title} — ${r.detail}`)
+            for (const r of manual) warn(`  ${r.title}, ${r.detail}`)
           }
           return
         }
@@ -224,7 +225,7 @@ export function registerDb(program: Command): void {
               await applyRemedies(client, fixable)
               info("Applied. Re-run `supatype db check` to confirm.")
             } catch (err) {
-              error(`Rolled back — the database is unchanged: ${(err as Error).message}`)
+              error(`Rolled back: the database is unchanged: ${(err as Error).message}`)
               process.exitCode = 1
               return
             }
@@ -232,7 +233,7 @@ export function registerDb(program: Command): void {
           if (manual.length > 0) {
             warn(`\n${manual.length} finding(s) cannot be fixed in a transaction:`)
             for (const r of manual) {
-              warn(`  ${r.title} — needs a server setting change and likely a restart`)
+              warn(`  ${r.title}: needs a server setting change and likely a restart`)
             }
           }
           return
@@ -265,7 +266,7 @@ const SEVERITY_LABEL: Record<Severity, string> = {
 
 function printReport(results: readonly CheckResult[]): void {
   for (const r of results) {
-    const line = `[${SEVERITY_LABEL[r.severity]}] ${r.title} — ${r.detail}`
+    const line = `[${SEVERITY_LABEL[r.severity]}] ${r.title}, ${r.detail}`
     if (r.severity === "fail") error(line)
     else if (r.severity === "degrade" || r.severity === "warn") warn(line)
     else plain(line)

package/src/commands/deploy.ts

@@ -1,14 +1,14 @@
 /**
  * Deploy commands:
- *   supatype deploy              — Supatype Cloud by default (linked via supatype link), else platform projectRef; use --local for engine + DB
- *   supatype deploy --local      — push schema via local engine + optional static app to .supatype/static
- *   supatype deploy --app-only   — only build & deploy the static site
- *   supatype deploy --schema-only — only push schema changes
- *   supatype deploy --skip-build — deploy existing build output (no build step)
- *   supatype deploy --preview    — deploy to a preview URL
- *   supatype deploy rollback     — roll back to previous deployment
- *   supatype deploy status       — show current deployment info
- *   supatype deploy logs <version> — show build logs
+ *   supatype deploy: Supatype Cloud by default (linked via supatype link), else platform projectRef; use --local for engine + DB
+ *   supatype deploy --local: push schema via local engine + optional static app to .supatype/static
+ *   supatype deploy --app-only: only build & deploy the static site
+ *   supatype deploy --schema-only: only push schema changes
+ *   supatype deploy --skip-build: deploy existing build output (no build step)
+ *   supatype deploy --preview: deploy to a preview URL
+ *   supatype deploy rollback: roll back to previous deployment
+ *   supatype deploy status: show current deployment info
+ *   supatype deploy logs <version>, show build logs
  */
 
 import type { Command } from "commander"
@@ -31,7 +31,7 @@ export function registerDeploy(program: Command): void {
   const deploy = program
     .command("deploy")
     .description(
-      "Deploy schema and app — Supatype Cloud by default when linked (`supatype link`); pass --local for engine + your database",
+      "Deploy schema and app, Supatype Cloud by default when linked (`supatype link`); pass --local for engine + your database",
     )
     .option("--local", "Use local schema engine and database_url from config (skip cloud control plane)")
     .option("--environment <name>", "Target environment when linked", "production")
@@ -119,7 +119,7 @@ export function registerDeploy(program: Command): void {
             error("No build section found in supatype.config.ts")
             process.exit(1)
           }
-          // No build config — skip app deployment silently
+          // No build config: skip app deployment silently
           return
         }
 
@@ -151,7 +151,7 @@ export function registerDeploy(program: Command): void {
             buildEnv["NEXT_PUBLIC_SUPATYPE_URL"] = cloudCfg.apiUrl || `https://${cloudCfg.projectSlug}.supatype.dev`
             buildEnv["VITE_SUPATYPE_URL"] = buildEnv["NEXT_PUBLIC_SUPATYPE_URL"]!
             buildEnv["PUBLIC_SUPATYPE_URL"] = buildEnv["NEXT_PUBLIC_SUPATYPE_URL"]!
-            // NEVER inject service_role key — only anon key is safe for client-side
+            // NEVER inject service_role key, only anon key is safe for client-side
           }
 
           // Install dependencies