@supatype/cli 0.1.7 → 0.1.10

package/src/commands/dev.ts

@@ -1,9 +1,9 @@
 /**
- * supatype dev — start local Postgres, apply schema, run supatype-server.
+ * supatype dev: start local Postgres, apply schema, run supatype-server.
  *
  * Runtime provider (top-level `provider` or legacy `database.provider`):
- *   native — host Postgres + host server + host engine (default)
- *   docker — full self-host Compose stack (Kong :18473); see dev-compose.ts
+ *   native: host Postgres + host server + host engine (default)
+ *   docker: full self-host Compose stack (Kong :18473); see dev-compose.ts
  *
  * Edge functions (when a functions/ dir exists): Deno is resolved from the CDN cache
  * (auto-download on miss). Self-host/cloud Docker stacks use supatype-server in-container;
@@ -127,7 +127,7 @@ export function registerDev(program: Command): void {
     .action(async (opts: { watch: boolean; stream?: boolean; port?: string }) => {
       const cwd = process.cwd()
 
-      // ── 1. Load project config (before TUI — fatal errors must hit real stderr) ──
+      // ── 1. Load project config (before TUI, fatal errors must hit real stderr) ──
       const config = loadConfig(cwd)
       const provider = resolveRuntimeProvider(config)
 
@@ -181,7 +181,7 @@ export function registerDev(program: Command): void {
 
       // ── 5–7. Start Postgres ───────────────────────────────────────────────
       let dbURL: string
-      /** What PostgREST connects as — deliberately not `dbURL`, which is a superuser. */
+      /** What PostgREST connects as, deliberately not `dbURL`, which is a superuser. */
       let postgrestDbURL: string
       let stopPostgres: () => void | Promise<void>
       const pgPort = NATIVE_PG_PORT
@@ -195,7 +195,7 @@ export function registerDev(program: Command): void {
       let pgBinDir: string | null = null
 
       {
-        // native — resolve pg bin dir and manage with pg_ctl
+        // native: resolve pg bin dir and manage with pg_ctl
         pgBinDir = await resolvePgBinDir(config)
         const dataDir = config.database.data_dir ?? join(stateRoot, "data")
         mkdirSync(dataDir, { recursive: true })
@@ -239,7 +239,7 @@ export function registerDev(program: Command): void {
         //
         // `authenticator` is NOINHERIT and holds no privileges of its own: it can only
         // SET ROLE to the three above. That containment is the point. Connecting as
-        // `postgres` — a superuser — meant a request whose JWT named *any* role in the
+        // `postgres`: a superuser: meant a request whose JWT named *any* role in the
         // cluster got it, because a superuser may SET ROLE to anything. Verified: as
         // postgres, `SET ROLE supatype_replication_admin` succeeds; as authenticator the
         // same statement is refused. Mirrors the image, which has had this role all along.
@@ -300,7 +300,7 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
       mkdirSync(supatypeDir, { recursive: true })
 
       const localStoragePath = config.storage?.provider !== "s3" ? join(stateRoot, "storage") : undefined
-      // Native Postgres builds don't include PostGIS — skip geo fields rather than failing.
+      // Native Postgres builds don't include PostGIS, skip geo fields rather than failing.
       const skipFieldKinds: ReadonlySet<string> = new Set(["geo", "vector"])
 
       await runSchemaPush(cwd, engineBin, schemaPath, dbURL, manifestPath, adminConfigPath, localStoragePath, skipFieldKinds, config).catch(
@@ -341,7 +341,7 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
           }
         } catch (err) {
           console.warn(
-            `[supatype] ⚠  Found ${functionsDir} but could not provision Deno — edge functions will not run.\n` +
+            `[supatype] ⚠  Found ${functionsDir} but could not provision Deno, edge functions will not run.\n` +
               `  ${(err as Error).message}\n` +
               "  (Functions still appear in Studio; invocations need Deno.)",
           )
@@ -383,7 +383,7 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
         console.log(`[supatype] Realtime service: ${realtimeUrl}`)
       } catch (err) {
         console.warn(
-          `[supatype] ⚠  Realtime unavailable — WebSocket subscriptions will not work.\n` +
+          `[supatype] ⚠  Realtime unavailable, WebSocket subscriptions will not work.\n` +
             `  ${(err as Error).message}`,
         )
       }
@@ -509,10 +509,10 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
 
         const postgrestEnv: Record<string, string> = {
           PGRST_DB_URI: postgrestDbURL,
-          // Derived from schema.pg_schema (or schema.api_schemas) — a hardcoded "public" here meant
+          // Derived from schema.pg_schema (or schema.api_schemas), a hardcoded "public" here meant
           // a non-default pg_schema pushed correctly and then answered PGRST106 on every request.
           // Native dev has no masking extension either, so a schema with field rules is served from
-          // `api` here too — the case an "is the database external" rule would have got wrong.
+          // `api` here too: the case an "is the database external" rule would have got wrong.
           PGRST_DB_SCHEMA: apiSchemaList(
             config,
             // The installed archive decides: one downloaded before the masking library was bundled
@@ -644,9 +644,9 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
 // Schema push (engine subprocess)
 // ---------------------------------------------------------------------------
 
-// Last successfully-pushed AST JSON — used to skip no-op re-fires.
+// Last successfully-pushed AST JSON, used to skip no-op re-fires.
 let _lastPushedAst: string | null = null
-// AST that failed on its last attempt — always retried even if content is unchanged.
+// AST that failed on its last attempt, always retried even if content is unchanged.
 let _lastFailedAst: string | null = null
 
 async function runSchemaPush(
@@ -670,7 +670,7 @@ async function runSchemaPush(
     ast = filtered
     if (adapted.length > 0) {
       console.warn(
-        `[supatype] ⚠  ${adapted.length} field(s) replaced with JSONB — required extensions not available:\n` +
+        `[supatype] ⚠  ${adapted.length} field(s) replaced with JSONB, required extensions not available:\n` +
         adapted.map((s: string) => `    ${s}`).join("\n"),
       )
     }
@@ -744,7 +744,7 @@ async function runSchemaPush(
     { cwd, stdio: "pipe", encoding: "utf8" },
   )
   if (genResult.status !== 0) {
-    console.warn("[supatype] Manifest generation failed — server routing may be stale.")
+    console.warn("[supatype] Manifest generation failed, server routing may be stale.")
   }
 
   // Generate admin config (for Studio). Engine writes to stdout.
@@ -889,7 +889,7 @@ async function extractPostgresArchive(
 }
 
 // ---------------------------------------------------------------------------
-// PostgREST resolver — downloads from GitHub releases if not cached
+// PostgREST resolver: downloads from GitHub releases if not cached
 // ---------------------------------------------------------------------------
 
 const POSTGREST_DEFAULT_VERSION = "12.2.3"
@@ -1030,12 +1030,12 @@ function repairWindowsPostgrestRuntime(cacheDir: string, archivePath: string, bi
 }
 
 // ---------------------------------------------------------------------------
-// Local-dev JWT generator (no external dep — pure crypto)
+// Local-dev JWT generator (no external dep, pure crypto)
 // ---------------------------------------------------------------------------
 
 
 // ---------------------------------------------------------------------------
-// AST adaptation — replace extension-dependent fields with JSONB fallbacks
+// AST adaptation: replace extension-dependent fields with JSONB fallbacks
 // ---------------------------------------------------------------------------
 
 interface AstField { kind: string; required?: boolean; [k: string]: unknown }

package/src/commands/doctor.ts

@@ -114,7 +114,7 @@ export function registerDoctor(program: Command): void {
  * Whether declared hooks can actually run.
  *
  * Worth its own section because every failure here is silent: a hook whose function is missing, or a
- * stack with functions switched off, produces no error anywhere — the write just succeeds
+ * stack with functions switched off, produces no error anywhere, the write just succeeds
  * unvalidated. Drift you cannot see is the thing doctor exists for.
  */
 export function printHooks(report: HooksReport): void {
@@ -133,7 +133,7 @@ export function printHooks(report: HooksReport): void {
     plain("  Create it with: supatype hooks new <name>")
   }
   if (report.functionsDisabled) {
-    plain("\n  functions_enabled is false in .supatype/manifest.json — every hook is inert.")
+    plain("\n  functions_enabled is false in .supatype/manifest.json, every hook is inert.")
     plain("  Regenerate the stack config with: supatype self-host compose")
   }
   if (report.mapMissing) {
@@ -162,7 +162,7 @@ export function printServiceRoleGrants(
   }
 
   if (broken.size > 0) {
-    plain("\n  Those marked ✗ match no function, so they grant nothing — the function reads no key.")
+    plain("\n  Those marked ✗ match no function, so they grant nothing, the function reads no key.")
   }
   for (const warning of problems.warnings) plain(warning)
   plain("\n  These functions bypass every access rule in the schema. Anything not listed cannot.")

package/src/commands/engine.ts

@@ -1,6 +1,6 @@
 /**
  * Engine management commands:
- *   supatype engine status  — check if the engine container is reachable
+ *   supatype engine status: check if the engine container is reachable
  */
 
 import type { Command } from "commander"

package/src/commands/functions.ts

@@ -11,7 +11,7 @@ import {
 import { resolve, join, basename, relative, isAbsolute } from "node:path"
 import { spawnSync, execSync } from "node:child_process"
 import { localKongBaseUrl } from "../local-gateway.js"
-import { loadConfig } from "../config.js"
+import { loadConfig, rethrowIfConfigBroken } from "../config.js"
 import { ensureBinary } from "../ensure-binary.js"
 import {
   functionsPathCandidatesFromProject,
@@ -138,7 +138,7 @@ function scaffoldFunction(cwd: string, name: string): void {
 
   mkdirSync(fnDir, { recursive: true })
 
-  const indexContent = `// ${name} — Supatype Edge Function
+  const indexContent = `// ${name}, Supatype Edge Function
 // Docs: https://supatype.com/docs/edge-functions
 
 export default async function handler(req: Request): Promise<Response> {
@@ -257,7 +257,7 @@ function discoverFunctions(cwd: string): DiscoveredFunction[] {
     const stat = statSync(fullPath)
 
     if (stat.isDirectory()) {
-      // Directory function — look for index.ts
+      // Directory function: look for index.ts
       const indexPath = join(fullPath, "index.ts")
       if (existsSync(indexPath)) {
         fns.push({ name: entry, entrypoint: indexPath, absPath: fullPath })
@@ -369,7 +369,7 @@ async function deploy(cwd: string, opts: { only?: string; env?: string; dryRun?:
   }
 
   if (opts.dryRun) {
-    plain("Dry run — the following functions would be deployed:\n")
+    plain("Dry run: the following functions would be deployed:\n")
     for (const fn of fns) {
       plain(`  ${fn.name}  →  ${relative(cwd, fn.entrypoint)}`)
     }
@@ -532,7 +532,8 @@ async function deployCloud(cwd: string, fns: DiscoveredFunction[], env?: string)
 export function serviceRoleRoutesFor(cwd: string): string[] | undefined {
   try {
     return serviceRoleRoutes(loadConfig(cwd))
-  } catch {
+  } catch (err) {
+    rethrowIfConfigBroken(err)
     return undefined
   }
 }
@@ -543,7 +544,7 @@ function readFunctionSource(fn: DiscoveredFunction): string {
     return readFileSync(fn.absPath, "utf8")
   }
 
-  // Directory function — read all .ts files
+  // Directory function: read all .ts files
   const files: Record<string, string> = {}
   const entries = readdirSync(fn.absPath, { recursive: true }) as string[]
   for (const entry of entries) {
@@ -607,7 +608,7 @@ async function listFunctions(cwd: string): Promise<void> {
     plain(`  ${"─".repeat(28)} ${"─".repeat(24)} ${"─".repeat(20)} ${"─".repeat(12)}`)
 
     for (const fn of data) {
-      const deployed = fn.deployedAt ? new Date(fn.deployedAt).toLocaleString() : "—"
+      const deployed = fn.deployedAt ? new Date(fn.deployedAt).toLocaleString() : "-"
       plain(
         `  ${fn.name.padEnd(28)} ${deployed.padEnd(24)} ${String(fn.invocations24h ?? 0).padEnd(20)} ${fn.avgDurationMs ?? 0}ms`,
       )

package/src/commands/hooks.ts

@@ -1,9 +1,9 @@
 /**
- * `supatype hooks` — scaffold and inspect model hooks.
+ * `supatype hooks`: scaffold and inspect model hooks.
  *
  * Separate from `supatype functions` because the two are different things wearing the same runtime.
  * A function is a **public endpoint**: anyone holding the anon key can invoke it. A hook is
- * **procedural** — only the API server calls it, around a write, and the gateway refuses the route
+ * **procedural**: only the API server calls it, around a write, and the gateway refuses the route
  * from outside. Keeping them in separate directories is what makes that boundary structural instead
  * of a list somebody has to maintain.
  */
@@ -85,7 +85,7 @@ function scaffoldHook(cwd: string, name: string): void {
 /**
  * The scaffold deliberately imports from `../_supatype/hooks.ts`, which `push` generates.
  *
- * Before the first push that file does not exist, so the handler will not compile — which is the
+ * Before the first push that file does not exist, so the handler will not compile, which is the
  * honest state: the types come from the schema, and a handler typed against a model that has not been
  * pushed is a handler typed against a guess.
  */
@@ -94,7 +94,7 @@ function handlerTemplate(name: string, declared: { model: string; event: string
   const model = declared[0]?.model ?? "YourModel"
 
   if (event.startsWith("after")) {
-    return `// ${name} — model hook (${event})
+    return `// ${name}: model hook (${event})
 //
 // Runs after the write has succeeded. It cannot change or undo it: a rejection here would be a
 // rejection of something that already happened. Failures are logged, not surfaced to the caller.
@@ -109,7 +109,7 @@ export default hook(handler)
 `
   }
 
-  return `// ${name} — model hook (${event}) for ${model}
+  return `// ${name}: model hook (${event}) for ${model}
 //
 // Runs before the write reaches Postgres, so it can reject it or rewrite the body.
 //
@@ -125,7 +125,7 @@ const handler: BeforeChange<"your_table"> = async (ctx) => {
   }
 
   // \`ctx.patch\` is the submitted partial; \`ctx.previous()\` reads the rows about to change.
-  // Those come back as stored — unmasked — so do not echo them into a rejection message.
+  // Those come back as stored, unmasked, so do not echo them into a rejection message.
   return {}
 
   // Reject with a message the caller sees, and a status of your choosing:

package/src/commands/init.ts

@@ -248,7 +248,7 @@ interface InteractiveInitArgs {
   opts: InitCliOptions
 }
 
-/** Interactive init — one Ink session for wizard + scaffold + install + finish. */
+/** Interactive init: one Ink session for wizard + scaffold + install + finish. */
 async function runInteractiveInit(args: InteractiveInitArgs): Promise<void> {
   const { name, dir, defaultName, modeTarget, opts } = args
 
@@ -501,7 +501,7 @@ async function promptAdminUser(): Promise<{ adminEmail?: string; adminPassword?:
   )
   if (!createAdmin) return {}
 
-  p.note("First sign-in at /admin — created automatically on supatype dev or push.")
+  p.note("First sign-in at /admin, created automatically on supatype dev or push.")
 
   const adminEmail = ensureNotCancelled(
     await p.text({
@@ -686,7 +686,7 @@ export function scaffold(
       writeFileSync(pkgPath, `${JSON.stringify(merged, null, 2)}\n`, "utf8")
       file("updated", "package.json (added Supatype dependencies)")
     } catch {
-      warn("Could not merge into package.json — add @supatype/cli and @supatype/types manually.")
+      warn("Could not merge into package.json, add @supatype/cli and @supatype/types manually.")
       file("skipped", "package.json (invalid JSON)")
     }
   }
@@ -891,7 +891,7 @@ function localConfigTemplate(app: ScaffoldAppOptions): string {
   const lines: string[] = [
     `import type { SupatypeConfig } from "@supatype/cli"`,
     ``,
-    `// Local development overrides — gitignored, deep-merged over supatype.config.ts.`,
+    `// Local development overrides, gitignored, deep-merged over supatype.config.ts.`,
     `// Keeps \`supatype dev\` in local mode while the committed config targets production.`,
     `const localConfig: Partial<SupatypeConfig> = {`,
     `  server: { mode: "dev" },`,
@@ -997,8 +997,8 @@ function holdingPageTemplate(projectName: string): string {
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>${name} — Supatype</title>
-    <meta name="description" content="A Supatype project. Define your types — we generate your platform." />
+    <title>${name}: Supatype</title>
+    <meta name="description" content="A Supatype project. Define your types, we generate your platform." />
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet" />
@@ -1146,12 +1146,12 @@ function storageConfigLines(
 ): string[] {
   const lines: string[] = []
   if (storageLocal === "s3") {
-    lines.push(`  storage: { provider: "s3" },  // dev — configure S3_* in .env`)
+    lines.push(`  storage: { provider: "s3" },  // dev, configure S3_* in .env`)
   } else {
     lines.push(`  storage: { provider: "local", local_path: ".supatype/storage" },`)
   }
   if (storageProduction === "s3" && storageLocal !== "s3") {
-    lines.push(`  // Production storage: external S3 bucket — set production S3_* in .env`)
+    lines.push(`  // Production storage: external S3 bucket, set production S3_* in .env`)
   } else if (storageProduction === "local" && storageLocal === "s3") {
     lines.push(`  // Production storage: MinIO on your server (included in self-host compose)`)
   }
@@ -1174,7 +1174,7 @@ export type Profile = Model<{
   }
 }>
 
-/** Example singleton global — editable in Studio under Settings. */
+/** Example singleton global: editable in Studio under Settings. */
 export type SiteSettings = Model<{
   id: UUID
   site_name: string
@@ -1191,7 +1191,7 @@ export type SiteSettings = Model<{
 function envTemplate(opts: ScaffoldOptions): string {
   const sections: string[] = []
   // Generated, not constant. These reach a server: the previous defaults meant a self-host
-  // deployment ran with a password of `postgres` and a JWT secret published in this repo —
+  // deployment ran with a password of `postgres` and a JWT secret published in this repo,
   // and anyone holding that secret can mint a token naming any Postgres role. Safe to generate
   // only because `supatype dev` no longer overwrites them on every run (see local-secrets.ts).
   const postgresPassword = randomBytes(24).toString("base64url")
@@ -1202,14 +1202,14 @@ POSTGRES_PASSWORD=${postgresPassword}
 POSTGRES_DB=${opts.projectName}
 
 # PostgREST's own database credential. It connects as \`authenticator\`, a role that holds no
-# privileges and can only switch to anon/authenticated/service_role — so a request whose JWT
+# privileges and can only switch to anon/authenticated/service_role, so a request whose JWT
 # names any other role is refused by Postgres rather than honoured.
 #
 # Deliberately NOT the same as POSTGRES_PASSWORD: that one is yours, for direct SQL access, and
 # rotating it should never take the REST API down with it.
 AUTHENTICATOR_PASSWORD=${randomBytes(24).toString("base64url")}`)
 
-  sections.push(`# JWT — ANON_KEY and SERVICE_ROLE_KEY are derived from this secret.
+  sections.push(`# JWT: ANON_KEY and SERVICE_ROLE_KEY are derived from this secret.
 # Changing it invalidates every issued token; re-run \`supatype keys\` afterwards.
 JWT_SECRET=${randomBytes(48).toString("base64url")}
 ANON_KEY=
@@ -1221,7 +1221,7 @@ SITE_URL=http://localhost:3000`)
   if (opts.provider === "docker" && opts.kongPort !== undefined) {
     const apiUrl = `http://localhost:${opts.kongPort}`
     sections.push(
-      `# Local API gateway (Kong) — unique per project so multiple stacks can run concurrently
+      `# Local API gateway (Kong), unique per project so multiple stacks can run concurrently
 SUPATYPE_KONG_PORT=${opts.kongPort}
 PUBLIC_SUPATYPE_URL=${apiUrl}
 API_EXTERNAL_URL=${apiUrl}
@@ -1235,7 +1235,7 @@ VITE_SUPATYPE_ANON_KEY=`,
 
   if (opts.adminEmail && opts.adminPassword) {
     sections.push(
-      `# First admin for /admin — consumed on first supatype dev or push (password removed after use)
+      `# First admin for /admin, consumed on first supatype dev or push (password removed after use)
 SUPATYPE_ADMIN_EMAIL=${opts.adminEmail}
 SUPATYPE_ADMIN_PASSWORD=${opts.adminPassword}`,
     )
@@ -1269,7 +1269,7 @@ SMTP_PASS=
 SMTP_SENDER_NAME=${projectName}`
     case "console":
     default:
-      return `# SMTP — leave empty to use email autoconfirm in dev (no emails sent)
+      return `# SMTP: leave empty to use email autoconfirm in dev (no emails sent)
 SMTP_HOST=
 SMTP_PORT=
 SMTP_USER=
@@ -1284,7 +1284,7 @@ function storageEnvSections(
 ): string {
   if (storageLocal === storageProduction) {
     if (storageLocal === "s3") {
-      return `# Storage (local development and production — external bucket)
+      return `# Storage (local development and production, external bucket)
 # Use separate buckets for dev and production in your provider.
 S3_ENDPOINT=
 S3_REGION=us-east-1
@@ -1295,7 +1295,7 @@ S3_SECRET_KEY=`
     return `${localStorageEnvSection("local")}
 
 # Production storage (MinIO on your server)
-# Included in the self-host compose stack — no extra configuration needed.`
+# Included in the self-host compose stack, no extra configuration needed.`
   }
 
   return [localStorageEnvSection(storageLocal), productionStorageEnvSection(storageProduction)].join(
@@ -1305,14 +1305,14 @@ S3_SECRET_KEY=`
 
 function localStorageEnvSection(storage: StorageProvider): string {
   if (storage === "s3") {
-    return `# Storage (local development — external bucket)
+    return `# Storage (local development, external bucket)
 S3_ENDPOINT=
 S3_REGION=us-east-1
 S3_BUCKET=
 S3_ACCESS_KEY=
 S3_SECRET_KEY=`
   }
-  return `# Storage (local development — MinIO)
+  return `# Storage (local development, MinIO)
 S3_ENDPOINT=http://localhost:9000
 S3_ACCESS_KEY=supatype
 S3_SECRET_KEY=supatype-secret`
@@ -1320,15 +1320,15 @@ S3_SECRET_KEY=supatype-secret`
 
 function productionStorageEnvSection(storage: StorageProvider): string {
   if (storage === "s3") {
-    return `# Storage (production — external bucket)
+    return `# Storage (production, external bucket)
 S3_ENDPOINT=
 S3_REGION=us-east-1
 S3_BUCKET=
 S3_ACCESS_KEY=
 S3_SECRET_KEY=`
   }
-  return `# Storage (production — MinIO on your server)
-# Included in the self-host compose stack — no extra configuration needed.`
+  return `# Storage (production, MinIO on your server)
+# Included in the self-host compose stack, no extra configuration needed.`
 }
 
 function seedTemplate(projectName: string): string {
@@ -1358,7 +1358,7 @@ seed().catch((e) => {
 }
 
 function helloFunctionTemplate(): string {
-  return `// hello — Supatype Edge Function
+  return `// hello: Supatype Edge Function
 // Docs: https://supatype.com/docs/edge-functions
 
 export default async function handler(req: Request): Promise<Response> {
@@ -1397,7 +1397,7 @@ dist/
 supatype.local.config.ts
 supatype.local.config.js
 supatype.local.config.mjs
-# Generated by supatype push (legacy paths — prefer output.types in config)
+# Generated by supatype push (legacy paths, prefer output.types in config)
 src/types/supatype.d.ts
 src/lib/supatype.ts
 `
@@ -1408,7 +1408,7 @@ export function mergeGitignoreTemplate(existingContent: string): string {
     return existingContent
   }
   const block = `
-# Supatype — local runtime (contains secrets in link.json)
+# Supatype: local runtime (contains secrets in link.json)
 .supatype/
 `
   return existingContent.endsWith("\n") ? `${existingContent}${block}` : `${existingContent}\n${block}`
@@ -1460,9 +1460,9 @@ function printNextSteps(args: {
   nextSteps(setupComplete ? "Next steps:" : "Finish setup:", steps)
 
   // Shown once, at creation. These are generated per project rather than shipped as
-  // constants, so this is the moment to say they exist and where they live — nothing prints
+  // constants, so this is the moment to say they exist and where they live, nothing prints
   // them again, and the JWT secret is only echoed as a fingerprint from here on.
-  nextSteps("Secrets — generated for this project, kept in .env:", [
+  nextSteps("Secrets: generated for this project, kept in .env:", [
     "POSTGRES_PASSWORD    direct SQL access as the superuser",
     "AUTHENTICATOR_PASSWORD    PostgREST's own login; rotating the one above does not affect it",
     "JWT_SECRET    signs ANON_KEY and SERVICE_ROLE_KEY; changing it invalidates every token",
@@ -1496,7 +1496,7 @@ function printNextSteps(args: {
       selfHostSteps.push("supatype self-host compose up -d   # Kong provisions HTTPS automatically")
       selfHostSteps.push(`Your Supatype platform goes live at https://${domain}`)
       selfHostSteps.push(
-        "Your app, REST, Auth, Storage, Realtime, Functions, and Studio — all behind one HTTPS domain (certs persist in valkey-data)",
+        "Your app, REST, Auth, Storage, Realtime, Functions, and Studio, all behind one HTTPS domain (certs persist in valkey-data)",
       )
     } else {
       selfHostSteps.push(

package/src/commands/internal.ts

@@ -3,6 +3,8 @@
  */
 
 import type { Command } from "commander"
+import { resolve } from "node:path"
+import { pathToFileURL } from "node:url"
 import { downloadAll } from "../binary-cache.js"
 import { error, info } from "../ui/messages.js"
 
@@ -20,4 +22,39 @@ export function registerInternalCommands(program: Command): void {
         process.exit(1)
       }
     })
+
+  // Interpreter for the standalone binary. It carries the Bun runtime, so it can import
+  // TypeScript directly; what it cannot do is spawn `node` with `tsx`, because a machine that
+  // installed with `curl | sh` has neither, and neither is embedded. So the binary re-executes
+  // itself for these two jobs rather than reaching for a toolchain that is not there.
+  //
+  // Hidden and prefixed, like _postinstall: they are an implementation detail of config loading,
+  // not commands anyone should run.
+  program
+    .command("_print-module <target>", { hidden: true })
+    .description("Import a module and print its default export as JSON")
+    .action(async (target: string) => {
+      try {
+        const href = target.startsWith("file:") ? target : pathToFileURL(resolve(target)).href
+        const mod = (await import(href)) as { default?: unknown }
+        const value = mod.default ?? mod
+        process.stdout.write(JSON.stringify(value))
+      } catch (err) {
+        // stderr, because the caller parses stdout as JSON and a message there would corrupt it.
+        process.stderr.write(err instanceof Error ? (err.stack ?? err.message) : String(err))
+        process.exit(1)
+      }
+    })
+
+  program
+    .command("_run-ts <file>", { hidden: true })
+    .description("Execute a TypeScript file for its side effects")
+    .action(async (file: string) => {
+      try {
+        await import(pathToFileURL(resolve(file)).href)
+      } catch (err) {
+        process.stderr.write(err instanceof Error ? (err.stack ?? err.message) : String(err))
+        process.exit(1)
+      }
+    })
 }

package/src/commands/login.ts

@@ -1,6 +1,6 @@
 /**
  * Cloud session login / logout for CLI control-plane auth.
- * Self-host uses SERVICE_ROLE_KEY via `supatype link --url` — not this command.
+ * Self-host uses SERVICE_ROLE_KEY via `supatype link --url`, not this command.
  */
 import type { Command } from "commander"
 import {
@@ -77,7 +77,7 @@ export function registerLogin(program: Command): void {
         if (link?.kind === "cloud") {
           info(`Updated cloud session for linked project ${link.projectRef}`)
         } else if (!session.refreshToken) {
-          plain("Warning: no refresh_token returned — session may expire in ~1h. Update control plane.")
+          plain("Warning: no refresh_token returned, session may expire in ~1h. Update control plane.")
         } else {
           plain("Tip: link a project with: supatype link --project <slug>")
         }

package/src/commands/logs.ts

@@ -1,5 +1,5 @@
 /**
- * supatype logs — tail aggregated logs from local Docker containers.
+ * supatype logs: tail aggregated logs from local Docker containers.
  */
 import type { Command } from "commander"
 import { spawn } from "node:child_process"

package/src/commands/migrate.ts

@@ -58,9 +58,9 @@ export function registerMigrate(program: Command): void {
         const size =
           manifest?.compressedBytes !== undefined
             ? `${(manifest.compressedBytes / 1024).toFixed(1)} KB`
-            : "—"
-        const files = manifest?.fileCount ?? "—"
-        const author = manifest?.pushedBy ?? "—"
+            : "-"
+        const files = manifest?.fileCount ?? "-"
+        const author = manifest?.pushedBy ?? "-"
         const rolled = m.rolledBack ? " (rolled back)" : ""
         plain(
           `${m.name}${rolled}\n  applied: ${m.appliedAt}  status: ${m.status}\n  author: ${author}  files: ${files}  snapshot: ${size}`,
@@ -212,7 +212,7 @@ async function offerSchemaRestore(
   const manifestPaths = new Set(manifest.files.map((f) => f.path))
   const orphans = findOrphanSchemaFiles(root, manifest.entryPoint, manifestPaths)
   for (const orphan of orphans) {
-    warn(`${orphan} not in snapshot — review manually`)
+    warn(`${orphan} not in snapshot, review manually`)
   }
 
   info(`Restored schema files from migration ${label}.`)
@@ -222,6 +222,6 @@ async function offerSchemaRestore(
   if ((postDiff.operations ?? []).length === 0) {
     info("Schema matches database after restore.")
   } else {
-    info("Run `supatype diff` — schema may still differ from database.")
+    info("Run `supatype diff`: schema may still differ from database.")
   }
 }

package/src/commands/pg.ts

@@ -1,5 +1,5 @@
 /**
- * supatype pg — manage the native Postgres instance for a project.
+ * supatype pg: manage the native Postgres instance for a project.
  *
  * Commands: start, stop, reset, psql
  */

package/src/commands/plugins.ts

@@ -407,7 +407,7 @@ function validatePlugins(cwd: string): void {
     }
 
     if (issues.length === 0) {
-      plain(`  ✓ ${p.name} — valid`)
+      plain(`  ✓ ${p.name}: valid`)
     } else {
       hasErrors = true
       plain(`  ✗ ${p.name}`)

package/src/commands/pull.ts

@@ -10,7 +10,7 @@ import { info, plain } from "../ui/messages.js"
 export function registerPull(program: Command): void {
   program
     .command("pull")
-    .description("Scaffold schema/index.ts from live database introspection (draft — review before push)")
+    .description("Scaffold schema/index.ts from live database introspection (draft, review before push)")
     .option("--connection <url>", "Database connection URL (overrides config)")
     .option("--out <path>", "Write scaffold to file (default: stdout)")
     .option("--dry-run", "Print scaffold to stdout without writing files")
@@ -34,7 +34,7 @@ export function registerPull(program: Command): void {
       if (opts.dryRun || !opts.out) {
         plain(scaffold)
         if (!opts.dryRun && !opts.out) {
-          info("(draft printed to stdout — use --out to write a file)")
+          info("(draft printed to stdout, use --out to write a file)")
         }
         return
       }