@supatype/cli 0.1.7 → 0.1.10

package/src/self-host-compose.ts

@@ -130,7 +130,7 @@ export function composePullNeedsIgnoreFailures(
 /**
  * Schema-engine image for a one-off `docker compose run` when pushing schema.
  * Uses config pin when set; otherwise CDN engine semver (Docker Hub `:latest` can lag).
- * Does not touch `.env` — server/postgres still use compose `:latest` defaults.
+ * Does not touch `.env`, server/postgres still use compose `:latest` defaults.
  */
 export async function schemaEngineImageForPush(
   config: SupatypeProjectConfig,
@@ -174,7 +174,7 @@ export function staticDirForCompose(config: SupatypeProjectConfig): string | und
 /**
  * Bind-mount source for `/project` in generated compose files.
  * Paths are resolved from `--project-directory` (always the project root in `runDockerCompose`),
- * not from the compose file directory — use `.` not `../..`.
+ * not from the compose file directory, use `.` not `../..`.
  */
 function projectMountPath(_cwd: string): string {
   return "."
@@ -198,13 +198,13 @@ function kongMountPath(_cwd: string): string {
  *
  * One expression instead of six identical constructions of `@db:5432`. With an external database it
  * becomes `${DATABASE_URL:?…}`: the URL is the operator's, so there is nothing for the generator to
- * build — and interpolating the value into the compose file would write a password into a generated
+ * build: and interpolating the value into the compose file would write a password into a generated
  * file. Compose resolves the variable from `.env` at up-time, the same place the config's
  * `process.env.DATABASE_URL` read it from.
  */
 function ownerDatabaseUrl(config: SupatypeProjectConfig, scheme = "postgresql"): string {
   if (usesExternalDatabase(config)) {
-    return "${DATABASE_URL:?DATABASE_URL is missing from .env — required by database.external}"
+    return "${DATABASE_URL:?DATABASE_URL is missing from .env, required by database.external}"
   }
   return (
     `${scheme}://\${POSTGRES_USER:-supatype_admin}:` +
@@ -217,7 +217,7 @@ function ownerDatabaseUrl(config: SupatypeProjectConfig, scheme = "postgresql"):
  * PostgREST's DSN, which connects as `authenticator` rather than the owner.
  *
  * For an external database the host, port, database and query string are taken from the operator's
- * URL and only the password stays a variable. The alternative — a second full URL in `.env` — is one
+ * URL and only the password stays a variable. The alternative, a second full URL in `.env`, is one
  * more thing to keep in step with the first, and two URLs that disagree about *which database* is a
  * split-brain nobody notices until the API is serving one and migrations are landing in the other.
  * A hostname is not the secret here; the password is, and it stays out of the generated file.
@@ -237,7 +237,7 @@ function postgrestDatabaseUrl(config: SupatypeProjectConfig): string {
 /** Host Vite dev server as seen from Kong inside Docker Compose. */
 export const COMPOSE_STUDIO_HOST_URL = "http://host.docker.internal:3002"
 
-/** Studio container — always Docker Hub unless SUPATYPE_STUDIO_IMAGE is set in .env. */
+/** Studio container: always Docker Hub unless SUPATYPE_STUDIO_IMAGE is set in .env. */
 function studioServiceBlock(): string {
   return `    image: \${SUPATYPE_STUDIO_IMAGE:-supatype/studio:latest}`
 }
@@ -281,7 +281,7 @@ export interface SelfHostComposeOptions {
   /**
    * Which mechanism enforces per-column rules, when the caller knows.
    *
-   * Only the call sites that have loaded the schema can say — see `field-masking-tier.ts`. Left
+   * Only the call sites that have loaded the schema can say, see `field-masking-tier.ts`. Left
    * unset, the exposed schema list is today's, which is correct for every project without field
    * rules and for every project on `supatype/postgres`.
    */
@@ -385,7 +385,7 @@ ${external ? "" : "  db-data:\n"}  minio-data:
 
   // `depends_on` for the services that talk to Postgres. With an external database there is no
   // container to wait on, so the clause disappears entirely and each service retries on connect
-  // instead — which is also what covers a database that restarts *after* boot, something no
+  // instead: which is also what covers a database that restarts *after* boot, something no
   // healthcheck ever did.
   const dbDependencyClause = external
     ? ""
@@ -412,8 +412,8 @@ ${external ? "" : "  db-data:\n"}  minio-data:
       DATABASE_URL: "${ownerUrl}"
       JWT_SECRET: \${JWT_SECRET:?JWT_SECRET is missing from .env}
       SLOT_NAME: supatype_realtime
-      # Matches the publication the supatype/postgres image creates. Read by nothing today —
-      # wal2json decodes from the slot — and kept for a future pgoutput decoder.
+      # Matches the publication the supatype/postgres image creates. Read by nothing today,
+      # wal2json decodes from the slot, and kept for a future pgoutput decoder.
       PUBLICATION_NAME: supatype_realtime
 ${dbDependency}`
     : `  # No \`realtime\` service: database.external.realtime is false. Subscriptions are
@@ -443,7 +443,7 @@ ${dbPorts}    volumes:
       - db-data:/var/lib/postgresql/data
     healthcheck:
       # -h 127.0.0.1 forces TCP. Without it \`pg_isready\` uses the Unix socket, which the
-      # entrypoint's temporary init server is already listening on while TCP is still refused —
+      # entrypoint's temporary init server is already listening on while TCP is still refused,
       # so the container reported healthy, \`depends_on: service_healthy\` released, and every
       # service that connects over the network died with ECONNREFUSED on first boot. PostgREST
       # survived only because it retries. Observed on a clean stack: server, storage and
@@ -466,7 +466,7 @@ ${dbServiceBlock}  postgrest:
     expose:
       - "3000"
     environment:
-      # Connects as \`authenticator\`, not \${POSTGRES_USER} — which is a superuser, and a
+      # Connects as \`authenticator\`, not \${POSTGRES_USER}, which is a superuser, and a
       # superuser session may SET ROLE to any role in the cluster, so a request whose JWT
       # named one got it. \`authenticator\` is NOINHERIT with membership in only
       # anon/authenticated/service_role, so the same SET ROLE is refused.
@@ -476,7 +476,7 @@ ${dbServiceBlock}  postgrest:
       PGRST_DB_URI: ${postgrestUrl}
       # Derived from schema.pg_schema (or schema.api_schemas). Hardcoding this is why choosing a
       # non-public pg_schema used to give a correct push and an API that answered PGRST106 for
-      # everything — the engine moved and PostgREST was never told.
+      # everything: the engine moved and PostgREST was never told.
       PGRST_DB_SCHEMA: "${apiSchemaList(config, options?.fieldMaskingTier)}"
       PGRST_DB_ANON_ROLE: anon
       PGRST_JWT_SECRET: \${JWT_SECRET:?JWT_SECRET is missing from .env}
@@ -511,12 +511,12 @@ ${dbDependency}
       # cloud, for isolation the route boundary already provides.
       SUPATYPE_HOOKS_ROOT: /project/hooks
       PORT: "8001"
-      # In-compose loopback to Kong (not API_EXTERNAL_URL / localhost — unreachable from this container).
+      # In-compose loopback to Kong (not API_EXTERNAL_URL / localhost, unreachable from this container).
       SUPATYPE_URL: http://kong:8000
       SUPATYPE_INTERNAL_URL: http://kong:8000
       SUPATYPE_ANON_KEY: \${ANON_KEY:-}
-      # Present so the worker can hand it to hooks — which are procedural and unreachable from
-      # outside — and to the public functions named below. Withheld from every other handler before
+      # Present so the worker can hand it to hooks, which are procedural and unreachable from
+      # outside: and to the public functions named below. Withheld from every other handler before
       # any of them is imported: a function is a public endpoint, and an ambient admin credential made
       # each one able to read past every access rule in the schema.
       SUPATYPE_SERVICE_ROLE_KEY: \${SERVICE_ROLE_KEY:-}
@@ -629,7 +629,7 @@ ${kongDependsOn}${kongValkeyDepends}
 ${volumesBlock}`
 }
 
-/** In-compose worker address — matches the `functions-worker` service this file always generates. */
+/** In-compose worker address: matches the `functions-worker` service this file always generates. */
 const COMPOSE_FUNCTIONS_WORKER_URL = "http://functions-worker:8001"
 
 function ensureComposeManifest(cwd: string, config: SupatypeProjectConfig): void {
@@ -653,7 +653,7 @@ function ensureComposeManifest(cwd: string, config: SupatypeProjectConfig): void
     ...(realtimeEnabled(config) && { realtime_url: "http://realtime:4000" }),
     // True because this file *always* generates a `functions-worker` service and hands the server
     // `SUPATYPE_FUNCTIONS_WORKER_URL`. It said false, so the server answered 404 for every function
-    // in a stack that was running a worker for them — provisioned, then switched off.
+    // in a stack that was running a worker for them, provisioned, then switched off.
     functions_enabled: true,
     functions_worker_url: COMPOSE_FUNCTIONS_WORKER_URL,
   }
@@ -664,8 +664,8 @@ function ensureComposeManifest(cwd: string, config: SupatypeProjectConfig): void
  * Turn functions on in a manifest written by an older CLI, leaving every other key alone.
  *
  * Without this, only new projects get working functions: a stack generated before the flag was
- * corrected keeps `functions_enabled: false` on disk, and regenerating the compose file — the
- * obvious thing to try — does not fix it.
+ * corrected keeps `functions_enabled: false` on disk, and regenerating the compose file, the
+ * obvious thing to try, does not fix it.
  */
 function repairComposeFunctionsFlag(manifestPath: string): void {
   let parsed: Record<string, unknown>
@@ -696,7 +696,7 @@ function ensureProjectFunctionsDir(cwd: string, config: SupatypeProjectConfig):
  * The config's external URL and `.env`'s `DATABASE_URL` must be the same string.
  *
  * The CLI resolves the URL from config; Compose substitutes `.env` at up-time. If the two disagree,
- * `push` migrates one database while the services serve another — which reads as data loss and
+ * `push` migrates one database while the services serve another, which reads as data loss and
  * isn't. It also makes the generated GoTrue DSN wrong, since whether to append `search_path` with
  * `?` or `&` is decided from the config URL's query string.
  */
@@ -731,14 +731,14 @@ function assertExternalUrlMatchesEnv(cwd: string, config: SupatypeProjectConfig)
  * A loopback host in the external URL cannot work from inside a container.
  *
  * `127.0.0.1` means "this container" to every service in the stack, so an external database on the
- * host machine is unreachable — while the *CLI* reaches it fine, because the CLI runs on the host.
+ * host machine is unreachable, while the *CLI* reaches it fine, because the CLI runs on the host.
  * That asymmetry is the trap: `supatype db check` passes, `push` applies the schema, and then
  * storage, realtime and the server all die with ECONNREFUSED against their own loopback. Found by
  * rehearsing exactly that.
  *
  * Refused rather than rewritten. The compose file interpolates one `${DATABASE_URL}` for every
  * service, so silently substituting a different host would mean the CLI and the stack no longer
- * agree about which database they are talking to — the thing every other check here exists to
+ * agree about which database they are talking to, the thing every other check here exists to
  * prevent.
  */
 export function loopbackExternalHost(config: SupatypeProjectConfig): string | undefined {
@@ -767,7 +767,7 @@ function assertExternalUrlReachableFromContainers(config: SupatypeProjectConfig)
   fatalError(
     `database.external.url points at ${host}, which no container can reach`,
     [
-      "Inside a container, localhost is that container — not the machine running Docker. Every",
+      "Inside a container, localhost is that container, not the machine running Docker. Every",
       "service in the stack would fail to connect, while the CLI succeeds because it runs on the host.",
       "",
       "Use a host the containers can resolve:",
@@ -902,7 +902,7 @@ export function runDockerCompose(
   return result.status ?? 1
 }
 
-/** Compose project name for a Supatype project — isolates docker state per project. */
+/** Compose project name for a Supatype project, isolates docker state per project. */
 export function composeProjectName(projectName: string): string {
   const slug = projectName.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "")
   return `supatype-${slug || "project"}`

package/src/service-role-check.ts

@@ -2,7 +2,7 @@
  * Check that every name in `functions.serviceRole` is a function that exists.
  *
  * The grant fails **closed**: a typo, or a function that has since been renamed, means that function
- * quietly does not receive the service-role key. Nothing breaks loudly — the handler simply reads
+ * quietly does not receive the service-role key. Nothing breaks loudly, the handler simply reads
  * `undefined` and whatever it does with the key stops working, at runtime, in a deploy that reported
  * success. So the name is checked where it is declared, against the directory it must match.
  *
@@ -77,7 +77,7 @@ export function checkServiceRoleRoutes(
       // Not an error: it was the documented form once, and the worker grants hooks whatever this says.
       // Still worth saying, because a reader would reasonably assume the line is what does the granting.
       warnings.push(
-        `  "${name}" is not needed — a hook receives the service-role key because only the API server ` +
+        `  "${name}" is not needed, a hook receives the service-role key because only the API server ` +
           `can reach it`,
       )
       continue
@@ -85,7 +85,7 @@ export function checkServiceRoleRoutes(
     if (!known.has(name)) {
       const where =
         searched.length > 1 ? ` (searched ${searched.join(", ")})` : ""
-      errors.push(`  "${name}" — no ${primary}/${name}/index.ts${where}`)
+      errors.push(`  "${name}": no ${primary}/${name}/index.ts${where}`)
       missing.push(name)
     }
   }

package/src/storage-provision.ts

@@ -1,7 +1,7 @@
 /**
  * Provision storage buckets declared in a schema AST via the storage server API.
  *
- * The storage server is the authority on bucket existence — going through the API
+ * The storage server is the authority on bucket existence, going through the API
  * ensures it creates any backing resources (directories, S3 buckets, etc.).
  * Buckets already registered return 409 Conflict, which is treated as success.
  */
@@ -76,10 +76,10 @@ export async function provisionBuckets(
       .catch(() => null)
 
     if (res === null) {
-      console.warn(`[storage] Storage API unreachable — skipped bucket "${bucket.id}"`)
+      console.warn(`[storage] Storage API unreachable, skipped bucket "${bucket.id}"`)
       continue
     }
-    if (res.status === 409) continue // already exists — fine
+    if (res.status === 409) continue // already exists, fine
     if (!res.ok) {
       const msg = await res.text().catch(() => res.statusText)
       console.warn(`[storage] Failed to provision bucket "${bucket.id}": ${msg}`)

package/src/studio-dev-server.ts

@@ -20,7 +20,7 @@ export interface StudioDevServerOptions {
    * so fetches hit the Vite proxy (SUPATYPE_PROXY_TARGET) and avoid CORS.
    */
   viteSupatypeUrl: string
-  /** Vite `base` — `/studio/` when behind Kong at `/studio/`; `/` for native dev on :3002. */
+  /** Vite `base`: `/studio/` when behind Kong at `/studio/`; `/` for native dev on :3002. */
   basePath?: string
 }
 

package/src/systemd.ts

@@ -1,5 +1,5 @@
 /**
- * systemd.ts — generate systemd unit files for self-hosted deployments.
+ * systemd.ts: generate systemd unit files for self-hosted deployments.
  *
  * Usage:
  *   generateUnits(config, outputDir)

package/src/target-client.ts

@@ -115,7 +115,7 @@ export async function targetFetch<T>(
       !opts.authRefresh
     ) {
       throw new TargetApiError(
-        `${message}. Session expired — run: supatype login`,
+        `${message}. Session expired, run: supatype login`,
         result.status,
         result.json.code,
       )

package/src/tsx-runner.ts

@@ -10,10 +10,11 @@ import { createRequire } from "node:module"
 import { fileURLToPath } from "node:url"
 import { writeFileSync, unlinkSync } from "node:fs"
 import { tmpdir } from "node:os"
+import { isCompiledBinary } from "./cli-install-method.js"
 
 const _require = createRequire(import.meta.url)
 
-// The CLI's own source directory — workspace packages are
+// The CLI's own source directory, workspace packages are
 // resolvable from here. Eval snippets are written here so ESM resolution finds them.
 const CLI_SRC_DIR = dirname(fileURLToPath(import.meta.url))
 
@@ -51,7 +52,9 @@ export function runTsFile(
   filePath: string,
   opts: SpawnSyncOptions = {},
 ): RunResult {
-  const result = spawnSync(process.execPath, [TSX_BIN, filePath], {
+  // Same split as importModuleAsJson: the binary interprets TypeScript itself, Node uses tsx.
+  const argv = isCompiledBinary() ? ["_run-ts", filePath] : [TSX_BIN, filePath]
+  const result = spawnSync(process.execPath, argv, {
     encoding: "utf8",
     maxBuffer: 50 * 1024 * 1024,
     ...opts,
@@ -87,3 +90,39 @@ export function evalTsSnippet(
     }
   }
 }
+
+/**
+ * Import a module and return its default export as JSON text.
+ *
+ * Two interpreters, one contract. Under Node this writes a snippet and runs it through tsx, as
+ * it always has. As a compiled binary it re-executes itself, because there is no node_modules to
+ * resolve tsx from, no writable directory beside the executable, and on a `curl | sh` machine no
+ * Node either: the previous behaviour failed with
+ * `ENOENT: open '/$bunfs/root/supatype-eval-....mts'` and broke init, update, dev and push.
+ *
+ * Callers get the same stdout, stderr and exit code either way.
+ */
+export function importModuleAsJson(
+  target: string,
+  opts: SpawnSyncOptions = {},
+): RunResult {
+  if (isCompiledBinary()) {
+    const result = spawnSync(process.execPath, ["_print-module", target], {
+      encoding: "utf8",
+      maxBuffer: 50 * 1024 * 1024,
+      ...opts,
+    })
+    return {
+      stdout: String(result.stdout ?? ""),
+      stderr: String(result.stderr ?? ""),
+      exitCode: result.status ?? 1,
+    }
+  }
+
+  const snippet = `
+const mod = await import(${JSON.stringify(target)})
+const config = mod.default ?? mod
+process.stdout.write(JSON.stringify(config))
+`
+  return evalTsSnippet(snippet, opts)
+}

package/src/type-extractor.ts

@@ -313,7 +313,7 @@ function mergeIntersectionParts(
         continue
       }
     }
-    // Unresolvable parts are skipped — the model still extracts with whatever fields were found
+    // Unresolvable parts are skipped, the model still extracts with whatever fields were found
   }
   if (allMembers.length === 0) return null
   return ts.factory.createTypeLiteralNode(allMembers)
@@ -910,7 +910,7 @@ function parseScalarType(
         return scalar("money")
       case "Decimal": {
         // `Decimal<10, 2>` names a precision and a scale, and the engine renders `NUMERIC(p, s)`
-        // from them — but nothing used to read the type arguments, so every Decimal became an
+        // from them: but nothing used to read the type arguments, so every Decimal became an
         // unbounded NUMERIC. Silently, which is the worst way to lose a constraint on a money column.
         const precision = parseNumericTypeArg(typeNode.typeArguments?.[0], sourceFile)
         const scale = parseNumericTypeArg(typeNode.typeArguments?.[1], sourceFile)
@@ -1453,7 +1453,7 @@ function looksLikeComputedTemplateLiteral(lit: string): boolean {
   return /\{truncate\s*\(/i.test(lit) || /\{[a-zA-Z_]\w*\}/g.test(lit)
 }
 
-/** Resolves second type arg of `ComputedFrom<Value, Sources>` — tuple concat, single field, or template literal. */
+/** Resolves second type arg of `ComputedFrom<Value, Sources>`, tuple concat, single field, or template literal. */
 function parseComputedFromSecondArg(
   sourcesArg: ts.TypeNode | undefined,
   sourceFile: ts.SourceFile,
@@ -1789,12 +1789,12 @@ function resolveIndexFieldName(fieldName: string, fields: Record<string, FieldAs
  * Resolve an `access:` annotation to its rule object.
  *
  * `access` may be written inline (`access: { read: Public }`) or factored into a
- * shared type alias (`access: CmsPublicReadAdminWrite`) — the latter is the
+ * shared type alias (`access: CmsPublicReadAdminWrite`), the latter is the
  * natural way to reuse one policy set across many models, so it has to resolve
  * through aliases and intersections, not just literals.
  *
  * Anything unresolvable throws. Returning `{}` here means "no access rules",
- * which the differ treats as "emit no RLS policies" — so a typo or an
+ * which the differ treats as "emit no RLS policies", so a typo or an
  * unsupported shape silently published a table with no row-level protection at
  * all. Failing the extract is the only safe outcome.
  */
@@ -1820,7 +1820,7 @@ function parseModelAccess(
         `\`${accessProp.type.getText(sourceFile)}\`.\n` +
         `  access must be an object type, or a type alias for one:\n` +
         `    export type PublicReadAdminWrite = { read: Public; create: Role<"admin"> }\n` +
-        `  A \`const … as const\` value cannot be used here — access is read from types, and\n` +
+        `  A \`const … as const\` value cannot be used here, access is read from types, and\n` +
         `  rule names like Public / Role are types, not values.\n` +
         `  Refusing to continue: an unresolved access block would publish this table with no RLS.`,
     )
@@ -1864,11 +1864,11 @@ function parseModelAccess(
 }
 
 /**
- * `fields: { [column]: { read?, write? } }` — per-column narrowing of the table rules.
+ * `fields: { [column]: { read?, write? } }`, per-column narrowing of the table rules.
  *
  * Any rule the DSL can express is allowed. Enforcement is a query rewrite that
  * evaluates the rule per row with the caller's claims, so ownership, membership and
- * application roles all work here — none of which a column privilege could express.
+ * application roles all work here, none of which a column privilege could express.
  */
 function parseFieldAccess(
   typeNode: ts.TypeNode,
@@ -1944,7 +1944,7 @@ function parseFieldAccess(
  *
  * An update policy has two halves: `USING` picks which existing rows may be
  * modified, `WITH CHECK` constrains what they may become. One rule for both is the
- * right default and what every existing schema means — but it makes "an editor may
+ * right default and what every existing schema means, but it makes "an editor may
  * move a post between their own sites" inexpressible, because the row they are
  * changing and the row they are changing it into are judged by the same predicate.
  */
@@ -1974,11 +1974,11 @@ function parseUpdateSplit(
     }
   }
 
-  // Not the split form at all — an object with neither key is some other shape.
+  // Not the split form at all, an object with neither key is some other shape.
   if (!using && !check) return null
   if (!using) {
     throw new Error(
-      "`update: { check }` needs a `using` rule too — without it no row is " +
+      "`update: { check }` needs a `using` rule too, without it no row is " +
         "selectable for update, so the check can never apply.",
     )
   }
@@ -2028,7 +2028,7 @@ function resolveAccessLiteral(
 /**
  * `access` rules may be declared in a different file from the model (a shared
  * alias), and `getText(file)` reads the given file's text at the node's offsets
- * — so passing the model's file for a node owned by another one yielded garbage
+ *- so passing the model's file for a node owned by another one yielded garbage
  * and every rule silently fell through to `private`. Always read a node's text
  * from the file that actually owns it.
  */
@@ -2056,7 +2056,7 @@ function parseAccessRule(
   if (!ts.isTypeReferenceNode(typeNode)) return { type: "private" }
 
   // `Rules.read` is a qualified name (namespace lookup), not a member of a type
-  // alias — TypeScript rejects it, and it used to fall through to `private`,
+  // alias: TypeScript rejects it, and it used to fall through to `private`,
   // silently denying an operation the author meant to grant.
   if (ts.isQualifiedName(typeNode.typeName)) {
     const text = ownerText(typeNode.typeName, sourceFile)
@@ -2113,7 +2113,7 @@ function parseAccessRule(
         )
       }
       // An empty list would compile to a policy that grants nothing while
-      // reading like a grant — the exact silent-denial failure the unknown-rule
+      // reading like a grant, the exact silent-denial failure the unknown-rule
       // branch below exists to prevent.
       if (listArg.elements.length === 0) {
         throw new Error(
@@ -2135,7 +2135,7 @@ function parseAccessRule(
           '`All<>` takes a tuple of rules, as in `All<[Role<"editor">, NotNull<"published_at">]>`.',
         )
       }
-      // Unlike `Any<[]>`, an empty `All` grants *everything* — an empty AND is
+      // Unlike `Any<[]>`, an empty `All` grants *everything*, an empty AND is
       // true. Reading as a restriction while imposing none is worse than an error.
       if (listArg.elements.length === 0) {
         throw new Error(
@@ -2209,7 +2209,7 @@ function parseAccessRule(
       const column = parseAccessOperand(args[0]!, sourceFile)
       if (column["kind"] !== "column") {
         throw new Error(
-          "`In<>`'s first argument must be a column name — the membership test is " +
+          "`In<>`'s first argument must be a column name, the membership test is " +
             "about a column of the row being checked.",
         )
       }
@@ -2220,7 +2220,7 @@ function parseAccessRule(
       }
     }
     default: {
-      // A named alias — possibly parameterised — standing for a rule. Expanded
+      // A named alias: possibly parameterised, standing for a rule. Expanded
       // before giving up, so `SiteAccess<"site_id">` works.
       if (resolveCtx && depth < 16) {
         const expanded = resolveAccessAliasNode(typeNode, sourceFile, resolveCtx)
@@ -2228,7 +2228,7 @@ function parseAccessRule(
       }
 
       // Falling back to `private` here would silently deny an operation the
-      // author believed they had granted — and with deny-by-default there is no
+      // author believed they had granted, and with deny-by-default there is no
       // longer any need for a permissive guess. Name the offending rule instead.
       throw new Error(
         `Unknown access rule "${ref}". Supported: Public, Private, LoggedIn, ` +
@@ -2244,7 +2244,7 @@ function parseAccessRule(
 /**
  * Expands a named alias to the type it stands for.
  *
- * This is what makes rules parameterisable — the type-level equivalent of
+ * This is what makes rules parameterisable, the type-level equivalent of
  * Payload's access-control factory:
  *
  * ```typescript
@@ -2252,8 +2252,8 @@ function parseAccessRule(
  * access: { update: SiteAccess<"site_id"> }
  * ```
  *
- * Without it a rule had to be written inline at every use, and any alias — even an
- * unparameterised one — was reported as an unknown rule.
+ * Without it a rule had to be written inline at every use, and any alias, even an
+ * unparameterised one: was reported as an unknown rule.
  */
 function resolveAccessAliasNode(
   typeNode: ts.TypeReferenceNode,
@@ -2274,7 +2274,7 @@ function resolveAccessAliasNode(
  * The set on the right of an `In<>`.
  *
  * Resolved through the same alias machinery as rules, so a shared
- * `type MySites = Rows<…>` can be reused across models — the parameterisation the
+ * `type MySites = Rows<…>` can be reused across models, the parameterisation the
  * plan calls the type-level equivalent of Payload's access factory.
  */
 function parseMembershipSource(
@@ -2300,7 +2300,7 @@ function parseMembershipSource(
       const column = stringLiteralArg(args[1], "Rows", "column name")
       const source: Record<string, unknown> = { kind: "rows", table, column }
       // The third argument narrows the source rows. Absent means "every row",
-      // which is a lookup rather than a membership check — allowed, but rarely
+      // which is a lookup rather than a membership check, allowed, but rarely
       // what was meant, so it stays explicit rather than being defaulted.
       if (args[2]) {
         source["where"] = parseAccessRule(args[2], sourceFile, resolveCtx)
@@ -2318,7 +2318,7 @@ function parseMembershipSource(
       }
       // Not `parseAccessOperand`: there, a bare string is a *column*, which is
       // right for a comparison and wrong here. Inside a value list a string can
-      // only be a value, so it is read as one — no `Literal<>` wrapper needed.
+      // only be a value, so it is read as one, no `Literal<>` wrapper needed.
       return {
         kind: "literal",
         values: listArg.elements.map((element) => literalFromNode(element, sourceFile)),
@@ -2373,7 +2373,7 @@ function parseDurationOperand(
   const opposite = ref === "Ago" ? "FromNow" : "Ago"
 
   // A negative literal is a prefix-unary expression in the TypeScript AST, not a
-  // numeric literal, so it has to be recognised separately — otherwise `Ago<-5, …>`
+  // numeric literal, so it has to be recognised separately, otherwise `Ago<-5, …>`
   // is refused for the wrong reason and the message misses the real advice.
   if (
     ts.isLiteralTypeNode(amountNode) &&
@@ -2392,7 +2392,7 @@ function parseDurationOperand(
   const amount = Number(amountNode.literal.text)
   if (!Number.isInteger(amount)) {
     throw new Error(
-      `\`${ref}<${amount}, …>\` must be a whole number of units — Postgres intervals ` +
+      `\`${ref}<${amount}, …>\` must be a whole number of units, Postgres intervals ` +
         `take integers, so a fraction would be silently truncated or rejected.`,
     )
   }
@@ -2512,7 +2512,7 @@ function parseAccessOperand(
         // segment would silently look up a key that cannot exist.
         if (path === "" || path.split(".").some((segment) => segment.trim() === "")) {
           throw new Error(
-            `\`Claim<"${path}">\` is not a valid claim path — use dotted segments, ` +
+            `\`Claim<"${path}">\` is not a valid claim path, use dotted segments, ` +
               `as in \`Claim<"app_metadata.tier">\`.`,
           )
         }

package/src/type-resolver.ts

@@ -295,7 +295,7 @@ function parseResolvedTypeText(typeText: string): ts.TypeNode {
   return decl.type
 }
 
-/** `T extends string ? Optional<T> : T` and similar — pick the Optional branch for scalar args. */
+/** `T extends string ? Optional<T> : T` and similar, pick the Optional branch for scalar args. */
 function tryEvaluateConditionalAlias(entry: AliasEntry, typeArgs: readonly ts.TypeNode[]): ts.TypeNode | null {
   const substituted = substituteAndParse(entry, typeArgs)
   if (!ts.isConditionalTypeNode(substituted)) return null

package/src/ui/README.md

@@ -9,7 +9,7 @@ Shared Ink-based design system for the Supatype CLI.
 | `fatal.ts` | `fatalError`, `reportCliFatal` |
 | `confirm.ts` | Yes/no prompts (Ink overlay in dev, Ink flow in TTY) |
 | `progress.ts` | `withSpinner` + `runCommandChrome` for one-shot commands |
-| `runtime/command-chrome.ts` | Ink shell (logo, logs, spinner) — applied globally via `wrapProgramActionsWithChrome` in `cli.ts` |
+| `runtime/command-chrome.ts` | Ink shell (logo, logs, spinner), applied globally via `wrapProgramActionsWithChrome` in `cli.ts` |
 | `prompts.ts` | Logo, `promptText`, `promptPassword`, `ensureNotCancelled` |
 | `clack.ts` | Clack-compatible `p.*` API + `runClackFlow()` for wizards |
 | `flows/` | Ink flow shell + prompt fields |

package/src/ui/brand.ts

@@ -1,6 +1,6 @@
 /**
  * Shared ANSI styling for Supatype CLI output and the dev TUI.
- * @deprecated Prefer `theme.ts` for new code — re-exports kept for dev-logo / task colors.
+ * @deprecated Prefer `theme.ts` for new code, re-exports kept for dev-logo / task colors.
  */
 
 export { BOLD, BRAND_COLOR, brandStyle, DIM, RESET } from "./theme.js"

package/src/ui/components/LogoWordmark.tsx

@@ -15,7 +15,7 @@ export interface LogoWordmarkProps {
   tagline?: string
 }
 
-/** Figlet slant wordmark — native Ink colours (no embedded ANSI). */
+/** Figlet slant wordmark: native Ink colours (no embedded ANSI). */
 export function LogoWordmark({ maxWidth, tagline }: LogoWordmarkProps): React.ReactElement {
   const lines = layoutLogoBlock(pickLogoLines())
 

package/src/ui/components/SelectField.tsx

@@ -34,7 +34,7 @@ export function SelectField({
   })
 
   const items = options.map((opt) => ({
-    label: opt.hint ? `${opt.label} — ${opt.hint}` : opt.label,
+    label: opt.hint ? `${opt.label}, ${opt.hint}` : opt.label,
     value: opt.value,
   }))
 

package/src/ui/confirm.ts

@@ -9,7 +9,7 @@ export interface ConfirmOptions {
 }
 
 /**
- * Yes/no confirmation — Ink overlay in dev, Ink flow in TTY, default otherwise.
+ * Yes/no confirmation: Ink overlay in dev, Ink flow in TTY, default otherwise.
  */
 export async function confirm(message: string, opts: ConfirmOptions = {}): Promise<boolean> {
   const fallback = opts.nonInteractive ?? opts.default ?? false

package/src/ui/fatal.ts

@@ -27,7 +27,7 @@ export function fatalError(message: string, hints: string[] = [], opts?: FatalOp
   process.exit(opts?.exitCode ?? 1)
 }
 
-/** Top-level CLI catch — user-facing message without branding. */
+/** Top-level CLI catch: user-facing message without branding. */
 export function reportCliFatal(err: unknown): void {
   const message = err instanceof Error ? err.message : String(err)
   error(message)

package/src/ui/flows/prompt-fields.tsx

@@ -80,7 +80,7 @@ export function ConfirmPrompt({ spec, onSubmit }: ConfirmPromptProps): React.Rea
         ) : (
           <Text dimColor>No</Text>
         )}
-        <Text dimColor> — y/n, ←/→, enter</Text>
+        <Text dimColor>: y/n, ←/→, enter</Text>
       </Text>
     </Box>
   )

package/src/ui/interactive.ts

@@ -1,4 +1,4 @@
-/** True when stdin/stdout are TTYs — interactive prompts and spinners are allowed. */
+/** True when stdin/stdout are TTYs, interactive prompts and spinners are allowed. */
 export function isInteractive(): boolean {
   return Boolean(process.stdin.isTTY && process.stdout.isTTY)
 }