@supatype/cli 0.1.7 → 0.1.10

package/src/ui/progress.ts

@@ -1,5 +1,5 @@
 /**
- * Progress UI for one-shot commands — Ink spinner inside command chrome.
+ * Progress UI for one-shot commands, Ink spinner inside command chrome.
  */
 
 import { getActiveFlowApi } from "./runtime/flow-session.js"

package/src/ui/runtime/command-chrome.ts

@@ -89,7 +89,7 @@ export function isCommandChromeActive(): boolean {
   return getActiveFlowApi() !== null
 }
 
-/** Commands that mount their own Ink UI — do not wrap with command chrome. */
+/** Commands that mount their own Ink UI, do not wrap with command chrome. */
 const WIZARD_COMMAND_PATHS = new Set(["dev", "init", "link", "login", "_postinstall"])
 
 /** Prefixes for subcommands that call `runClackFlow` internally. */

package/src/ui/runtime/run-clack-flow.tsx

@@ -55,7 +55,7 @@ function teardownInk(instance: Instance): void {
   try {
     instance.clear()
   } catch {
-    // ignore — terminal may already be reset
+    // ignore: terminal may already be reset
   }
   instance.unmount()
   instance.cleanup()

package/src/ui/runtime/stdin-after-ink.ts

@@ -10,7 +10,7 @@ export function restoreStdinAfterInk(): void {
   try {
     if (stdin.isRaw) stdin.setRawMode?.(false)
   } catch {
-    // ignore — stdin may already be restored
+    // ignore: stdin may already be restored
   }
 
   // Pause so one-shot Ink flows (cache list, keys, …) can exit; resume() would keep the

package/src/ui/theme.ts

@@ -1,5 +1,5 @@
 /**
- * Supatype terminal design tokens — shared by Ink components and plain CI output.
+ * Supatype terminal design tokens, shared by Ink components and plain CI output.
  */
 
 export const RESET = "\x1b[0m"

package/src/valkey-sidecar.ts

@@ -100,7 +100,7 @@ export function ensureValkeySidecar(projectName: string): ValkeySidecarResult {
     sleepMs(100)
   }
 
-  console.warn("[supatype] ⚠  Valkey sidecar started but not reachable yet — cache may bypass initially.")
+  console.warn("[supatype] ⚠  Valkey sidecar started but not reachable yet, cache may bypass initially.")
   return { addr, containerName: name, started: true }
 }
 
@@ -109,7 +109,7 @@ export function stopValkeySidecar(containerName: string | null): void {
   spawnSync("docker", ["rm", "-f", containerName], { stdio: "ignore" })
 }
 
-/** @internal Test helper — probe without subprocess. */
+/** @internal Test helper: probe without subprocess. */
 export function probeTcp(host: string, port: number): Promise<boolean> {
   return new Promise((resolve) => {
     const s = createConnection({ host, port })

package/tests/access-composition.test.ts

@@ -24,7 +24,7 @@ function access(model: ModelAstV2 | undefined): Record<string, unknown> {
 }
 
 // Without OR-composition the rule set is a closed list of single shapes, and the
-// commonest real requirement — "an admin, or the owner" — cannot be written at all.
+// commonest real requirement: "an admin, or the owner", cannot be written at all.
 describe("Any<[…]>", () => {
   it("composes rules into an OR-join", () => {
     const post = extract(
@@ -81,7 +81,7 @@ export type Post = Model<{
   })
 
   // An empty list reads like a grant and compiles to a policy that grants
-  // nothing — exactly the silent denial the unknown-rule error exists to prevent.
+  // nothing: exactly the silent denial the unknown-rule error exists to prevent.
   it("rejects an empty list", () => {
     expect(() =>
       extract(
@@ -350,7 +350,7 @@ export type Post = Model<{ id: UUID }, { access: { read: In<"a", Rows<"a b; drop
 })
 
 // The plan's headline parameterisation: the type-level equivalent of Payload's
-// access-control factory. Before this, any named alias — even unparameterised —
+// access-control factory. Before this, any named alias, even unparameterised,
 // was reported as an unknown rule and had to be written inline at every use.
 describe("parameterised rule aliases", () => {
   it("expands a generic alias at the point of use", () => {
@@ -480,7 +480,7 @@ export type Post = Model<{ id: UUID }, { access: { update: { using: Public; wat:
 })
 
 
-// "Publish at 09:00 next Tuesday" is *data* — the row carries `published_at` and the
+// "Publish at 09:00 next Tuesday" is *data*, the row carries `published_at` and the
 // rule is the same for every row. There is deliberately no literal-timestamp
 // operand; the policy re-evaluates per query, so the row starts matching at 09:00
 // with no cron and no publish worker.
@@ -589,7 +589,7 @@ export type Post = Model<{ id: UUID }, { access: { read: Gte<"a", Ago<${n}, "day
 `
     expect(() => extract(bad("0.5"), "ago-frac")).toThrow(/whole number/)
     // A negative literal is a prefix-unary expression, not a numeric literal, so it
-    // needs its own branch — otherwise the message misses the real advice.
+    // needs its own branch, otherwise the message misses the real advice.
     expect(() => extract(bad("-5"), "ago-neg")).toThrow(/does not take a negative amount/)
   })
 
@@ -619,7 +619,7 @@ export type Post = Model<{ id: UUID }, { access: { read: Gte<"a", StartOf<"fortn
 })
 
 // `In<>` asks "is this row's value in the set". Payload's site-access rule guards on
-// `user.sites?.length > 0` first — without that, an editor with no sites still
+// `user.sites?.length > 0` first, without that, an editor with no sites still
 // matches the unassigned-rows branch.
 describe("Exists<> non-empty guard", () => {
   it("expresses the Payload site-access rule in full", () => {

package/tests/admin-studio-membership.test.ts

@@ -68,7 +68,7 @@ async function seedFirstAdmin(): Promise<Recorded[]> {
 
 // Capability checks refuse a role they do not recognise, so the CLI's set has to
 // match the server's (`studioRolePermissions`) and the control plane's
-// (`STUDIO_ROLE_PERMISSIONS`) exactly — a role only this side knows about creates
+// (`STUDIO_ROLE_PERMISSIONS`) exactly: a role only this side knows about creates
 // a user who is locked out of the panel they were made for.
 describe("STUDIO_ROLES", () => {
   it("matches the roles the servers understand", () => {

package/tests/api-schemas.test.ts

@@ -42,7 +42,7 @@ describe("apiSchemas", () => {
 
   it("leads with the managed schema when pg_schema moves", () => {
     // First entry is what PostgREST serves as the default profile, so the managed schema has to
-    // lead — otherwise unprefixed requests would resolve against `supatype`.
+    // lead: otherwise unprefixed requests would resolve against `supatype`.
     expect(apiSchemaList(project({ pg_schema: "app" }))).toBe(
       "app, supatype, graphql_public, auth",
     )

package/tests/archive-name-alias.test.ts

@@ -4,7 +4,7 @@ import { archiveNameCandidates } from "../src/binary-cache.js"
 
 /**
  * `supatype-postgres` published the Intel macOS archive as `darwin-x86_64` while the CLI asks for
- * `darwin-amd64` — the spelling it derives from `process.arch === "x64"` on every platform. So
+ * `darwin-amd64`: the spelling it derives from `process.arch === "x64"` on every platform. So
  * `supatype dev` on an Intel Mac failed with "Checksum not found", and had done for as long as both
  * sides existed: CI could not run Docker on a macOS runner, so the path was never exercised.
  *

package/tests/cli-help.test.ts

@@ -1,5 +1,5 @@
 /**
- * Subprocess tests — spawn the compiled CLI binary and verify commands are
+ * Subprocess tests: spawn the compiled CLI binary and verify commands are
  * registered. Requires `pnpm build` to have run first (turbo handles this).
  */
 import { describe, it, expect } from "vitest"
@@ -17,8 +17,14 @@ const PACKAGE_VERSION = (
 function runCli(args: string[]): { stdout: string; stderr: string; exitCode: number } {
   const result = spawnSync(process.execPath, [CLI_BIN, ...args], {
     encoding: "utf8",
-    timeout: 10_000,
+    timeout: 60_000,
   })
+  if (result.signal) {
+    throw new Error(
+      `CLI subprocess killed by ${result.signal} after the spawn timeout. `
+        + `Args: ${args.join(" ")}. This is usually machine contention, not a CLI fault.`,
+    )
+  }
   return {
     stdout: String(result.stdout ?? ""),
     stderr: String(result.stderr ?? ""),

package/tests/config-load-failure.test.ts

@@ -0,0 +1,44 @@
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import { spawnSync } from "node:child_process"
+import { describe, expect, it } from "vitest"
+
+const CLI = join(import.meta.dirname, "../bin/supatype.js")
+
+function runIn(dir: string, args: string[]): { out: string; code: number } {
+  const r = spawnSync(process.execPath, [CLI, ...args], {
+    cwd: dir,
+    encoding: "utf8",
+    timeout: 60_000,
+  })
+  if (r.signal) throw new Error(`CLI killed by ${r.signal}, usually machine contention`)
+  return { out: `${r.stdout ?? ""}${r.stderr ?? ""}`, code: r.status ?? 1 }
+}
+
+describe("a config that cannot be read", () => {
+  // A broken config used to be indistinguishable from no config: the call sites that catch
+  // loadConfig so the CLI works outside a project swallowed both. That is why a standalone
+  // binary which could read no config at all still looked like it was working, for a whole
+  // release.
+  it("is reported, rather than treated as absent", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-broken-config-"))
+    writeFileSync(
+      join(dir, "supatype.config.ts"),
+      'throw new Error("deliberately broken")\n',
+      "utf8",
+    )
+    const { out, code } = runIn(dir, ["db", "check"])
+    expect(out).toContain("Failed to load supatype.config.ts")
+    expect(out).not.toContain("No connection. Pass --connection")
+    expect(code).not.toBe(0)
+  })
+
+  it("does not stop the CLI working with no config at all", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-no-config-"))
+    mkdirSync(join(dir, "empty"), { recursive: true })
+    const { out } = runIn(join(dir, "empty"), ["db", "check"])
+    expect(out).toContain("No connection. Pass --connection")
+    expect(out).not.toContain("Failed to load")
+  })
+})

package/tests/db-preflight.test.ts

@@ -44,7 +44,7 @@ describe("splitting remedies", () => {
 
 describe("the authenticator password guard", () => {
   // The credential is the operator's by decision. Executing the placeholder would create a role
-  // with a password from our source code — worse than refusing, and harder to notice.
+  // with a password from our source code, worse than refusing, and harder to notice.
   it("detects a remedy that would execute the placeholder", () => {
     const remedies = [
       result({ remedy: `CREATE ROLE authenticator LOGIN NOINHERIT PASSWORD '${PASSWORD_PLACEHOLDER}';` }),

package/tests/doctor-render.test.ts

@@ -5,7 +5,7 @@ import { printSection } from "../src/commands/doctor.js"
  * How a drift item reads to the operator.
  *
  * Items are keyed `table` + `name`, which for an index or constraint are different things and for a
- * *table* are the same — so the natural `table.name` form printed "widget.widget". Tables only
+ * *table* are the same, so the natural `table.name` form printed "widget.widget". Tables only
  * started appearing in this report when the ownership gate got its reporting (E17), and a report an
  * operator distrusts is worse than no report.
  */
@@ -30,7 +30,7 @@ describe("printSection", () => {
         table: "widget",
         name: "widget",
         fields: [],
-        message: "Unmanaged table widget — push will not drop; manual decision required",
+        message: "Unmanaged table widget, push will not drop; manual decision required",
       },
     ])
     const text = captured.join("\n")
@@ -48,7 +48,7 @@ describe("printSection", () => {
         table: "widget",
         name: "widget_name_idx",
         fields: ["name"],
-        message: "Unmanaged index widget_name_idx on widget — push will not drop",
+        message: "Unmanaged index widget_name_idx on widget, push will not drop",
       },
     ])
     expect(captured.join("\n")).toContain("• widget.widget_name_idx (name)")

package/tests/doctor-service-role.test.ts

@@ -36,7 +36,7 @@ describe("printServiceRoleGrants", () => {
 
   it("marks a grant that matches no function", () => {
     printServiceRoleGrants(
-      { ...empty, errors: ['  "send-emial" — no functions/send-emial/index.ts'], missing: ["send-emial"] },
+      { ...empty, errors: ['  "send-emial", no functions/send-emial/index.ts'], missing: ["send-emial"] },
       ["send-emial", "audit"],
     )
     const out = lines.join("\n")
@@ -47,7 +47,7 @@ describe("printServiceRoleGrants", () => {
 
   it("passes a redundant-entry warning through", () => {
     printServiceRoleGrants(
-      { ...empty, warnings: ['  "hooks/x" is not needed — a hook receives the key'] },
+      { ...empty, warnings: ['  "hooks/x" is not needed, a hook receives the key'] },
       ["hooks/x"],
     )
     expect(lines.join("\n")).toContain("is not needed")

package/tests/engine-push-output.test.ts

@@ -38,7 +38,7 @@ describe("formatEnginePushMessage()", () => {
   it("formats up_to_date with admin refresh", () => {
     expect(
       formatEnginePushMessage({ status: "up_to_date", operations: 0, admin_refreshed: true }),
-    ).toBe("Schema up to date — Studio metadata synced.")
+    ).toBe("Schema up to date, Studio metadata synced.")
   })
 
   it("formats up_to_date without admin refresh", () => {

package/tests/env-file.test.ts

@@ -10,7 +10,7 @@ import { MANAGED_MARKER, readEnvFile, upsertEnvFile } from "../src/env-file.js"
  * Two defects motivated this: the rewrite rebuilt the file from its assignments alone, so every
  * comment and blank line vanished; and the image keys derivable from `versions` were deleted
  * unconditionally, so `SUPATYPE_REALTIME_IMAGE` could be overridden from `.env` and
- * `SUPATYPE_SERVER_IMAGE` could not. Same file, same shape, different rules — which is how an hour
+ * `SUPATYPE_SERVER_IMAGE` could not. Same file, same shape, different rules, which is how an hour
  * goes into wondering why a locally built image is ignored.
  */
 let dir: string
@@ -63,7 +63,7 @@ JWT_SECRET=abc
 
   it("does clean up a value it wrote itself", () => {
     // Otherwise removing a pin from config leaves a stale image reference that silently keeps
-    // running the old version — the reason the deletion existed at all.
+    // running the old version, the reason the deletion existed at all.
     upsertEnvFile(
       dir,
       { SUPATYPE_SERVER_IMAGE: "supatype/server:v1.2.3" },
@@ -112,7 +112,7 @@ JWT_SECRET=abc
   })
 
   it("does not treat a commented-out assignment as a value", () => {
-    // `# FOO=bar` is a note, not a setting — the old parser kept it as a key called "# FOO".
+    // `# FOO=bar` is a note, not a setting, the old parser kept it as a key called "# FOO".
     write("# FOO=bar\nREAL=1\n")
     upsertEnvFile(dir, { REAL: "2" })
     expect(read()).toContain("# FOO=bar")

package/tests/external-database-compose.test.ts

@@ -30,7 +30,7 @@ const project = (database: unknown): SupatypeProjectConfig =>
 const external = (url = EXTERNAL_URL) => project({ external: { url } })
 const managed = () => project({ provider: "docker" })
 
-describe("external database — compose", () => {
+describe("external database: compose", () => {
   it("omits the db service and says why", () => {
     const compose = renderSelfHostCompose(external())
     expect(compose).not.toMatch(/^ {2}db:$/m)
@@ -88,12 +88,12 @@ describe("external database — compose", () => {
   it("appends GoTrue's search_path with the right separator", () => {
     // A URL that already has a query string needs `&`; a second `?` produces a DSN that fails to
     // parse, and GoTrue would exit rather than run its auth migrations.
-    expect(renderSelfHostCompose(external())).toContain('${DATABASE_URL:?DATABASE_URL is missing from .env — required by database.external}?search_path=auth"')
+    expect(renderSelfHostCompose(external())).toContain('${DATABASE_URL:?DATABASE_URL is missing from .env, required by database.external}?search_path=auth"')
     expect(
       renderSelfHostCompose(
         external("postgres://owner:secret@db.example.com:5432/app?sslmode=require"),
       ),
-    ).toContain('${DATABASE_URL:?DATABASE_URL is missing from .env — required by database.external}&search_path=auth"')
+    ).toContain('${DATABASE_URL:?DATABASE_URL is missing from .env, required by database.external}&search_path=auth"')
   })
 
   it("omits realtime entirely when the project turns it off", () => {
@@ -109,7 +109,7 @@ describe("external database — compose", () => {
   })
 
   it("keeps realtime when the flag is unset", () => {
-    // Unset means "probe it", not "assume it is broken" — the service reports its own capability.
+    // Unset means "probe it", not "assume it is broken", the service reports its own capability.
     const compose = renderSelfHostCompose(external())
     expect(compose).toMatch(/^ {2}realtime:$/m)
     expect(compose).toContain("SUPATYPE_REALTIME_URL: http://realtime:4000")
@@ -157,7 +157,7 @@ describe("external database — compose", () => {
 
 describe("a loopback external URL", () => {
   // Found by rehearsing a push against a real external Postgres: `db check` passed and `push`
-  // applied the schema, because the CLI runs on the host — then storage, realtime and the server all
+  // applied the schema, because the CLI runs on the host, then storage, realtime and the server all
   // died with ECONNREFUSED against their own loopback, because inside a container `127.0.0.1` is
   // that container. A retry loop would only have hidden it.
   it("is detected, whatever form it takes", () => {

package/tests/external-database-config.test.ts

@@ -28,7 +28,7 @@ const raw = (database: unknown, rest: Record<string, unknown> = {}): unknown =>
 const validate = (database: unknown, rest?: Record<string, unknown>) =>
   validateProjectConfig(raw(database, rest), "supatype.config.ts")
 
-describe("database.external — accepted", () => {
+describe("database.external: accepted", () => {
   it("accepts a url on its own, with no database.provider", () => {
     const cfg = validate({ external: { url: EXTERNAL_URL } })
     expect(externalDatabaseUrl(cfg)).toBe(EXTERNAL_URL)
@@ -52,7 +52,7 @@ describe("database.external — accepted", () => {
   })
 })
 
-describe("database.external — rejected", () => {
+describe("database.external: rejected", () => {
   it("rejects a missing url", () => {
     expect(() => validate({ external: {} })).toThrow(/database\.external\.url is required/)
     expect(() => validate({ external: { url: "   " } })).toThrow(

package/tests/field-masking-tier.test.ts

@@ -20,7 +20,7 @@ import { apiSchemaList, validateProjectConfig, type SupatypeProjectConfig } from
  *
  * The rule is deliberately **not** "is the database external". A native `supatype dev` has no
  * extension either, and calling that tier 1 would point PostgREST at a schema whose tables the API
- * roles no longer hold privileges on — every request denied.
+ * roles no longer hold privileges on, every request denied.
  */
 const project = (database: unknown, rest: Record<string, unknown> = {}): SupatypeProjectConfig =>
   validateProjectConfig(

package/tests/homebrew-formula.test.ts

@@ -1,4 +1,5 @@
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { createHash } from "node:crypto"
 import { join } from "node:path"
 import { tmpdir } from "node:os"
 import { spawnSync } from "node:child_process"
@@ -7,19 +8,36 @@ import { afterEach, beforeEach, describe, expect, it } from "vitest"
 let counter = 0
 let tmpDir: string
 
-const PLATFORMS = [
-  "supatype-cli-darwin-arm64",
-  "supatype-cli-darwin-amd64",
-  "supatype-cli-linux-arm64",
-  "supatype-cli-linux-amd64",
+// The published artefacts: one archive per platform, plus the musl variants Homebrew does not
+// use, since Homebrew on Linux is glibc.
+const ARCHIVES = [
+  "supatype-cli-darwin-arm64.tar.gz",
+  "supatype-cli-darwin-amd64.tar.gz",
+  "supatype-cli-linux-arm64.tar.gz",
+  "supatype-cli-linux-amd64.tar.gz",
+  "supatype-cli-linux-amd64-musl.tar.gz",
+  "supatype-cli-windows-amd64.zip",
 ]
 
+const script = () => join(import.meta.dirname, "../scripts/generate-homebrew-formula.mjs")
+
+/** Write stub archives and the checksums manifest that build-release-artifacts.sh produces. */
+function writeArtifacts(names: string[]): Record<string, string> {
+  const hashes: Record<string, string> = {}
+  const lines: string[] = []
+  for (const name of names) {
+    const body = `stub-${name}\n`
+    writeFileSync(join(tmpDir, name), body, "utf8")
+    hashes[name] = createHash("sha256").update(body).digest("hex")
+    lines.push(`${hashes[name]}  ${name}`)
+  }
+  writeFileSync(join(tmpDir, "checksums.sha256"), lines.join("\n") + "\n", "utf8")
+  return hashes
+}
+
 beforeEach(() => {
   tmpDir = join(tmpdir(), `homebrew-formula-${Date.now()}-${++counter}`)
   mkdirSync(tmpDir, { recursive: true })
-  for (const name of PLATFORMS) {
-    writeFileSync(join(tmpDir, name), `stub-${name}\n`, "utf8")
-  }
 })
 
 afterEach(() => {
@@ -27,32 +45,56 @@ afterEach(() => {
 })
 
 describe("generate-homebrew-formula.mjs", () => {
-  it("writes a Formula with versioned CDN URLs and sha256 blocks", () => {
+  it("points at the published archives, with the hashes from the manifest", () => {
+    const hashes = writeArtifacts(ARCHIVES)
     const outPath = join(tmpDir, "supatype.rb")
-    const script = join(import.meta.dirname, "../scripts/generate-homebrew-formula.mjs")
-    const result = spawnSync(
-      process.execPath,
-      [script, "9.9.9", tmpDir],
-      {
-        encoding: "utf8",
-        env: { ...process.env, HOMEBREW_FORMULA_OUT: outPath },
-      },
-    )
+    const result = spawnSync(process.execPath, [script(), "9.9.9", tmpDir], {
+      encoding: "utf8",
+      env: { ...process.env, HOMEBREW_FORMULA_OUT: outPath },
+    })
 
     expect(result.status, result.stderr).toBe(0)
     const formula = readFileSync(outPath, "utf8")
+
     expect(formula).toContain('version "9.9.9"')
-    expect(formula).toContain("https://releases.supatype.com/cli/v9.9.9/supatype-cli-darwin-arm64")
-    expect(formula).toMatch(/sha256 "[a-f0-9]{64}"/)
+    expect(formula).toContain('license "Apache-2.0"')
+    expect(formula).toContain(
+      "https://releases.supatype.com/cli/v9.9.9/supatype-cli-darwin-arm64.tar.gz",
+    )
+    // The hash has to be the manifest's, not one the generator computed for itself: the manifest
+    // is the signed record of what was published.
+    expect(formula).toContain(`sha256 "${hashes["supatype-cli-darwin-arm64.tar.gz"]}"`)
+    // Every archive holds one executable called `supatype`, so there is no per-platform rename.
+    expect(formula).toContain('bin.install "supatype"')
     expect(formula).toContain('system bin/"supatype", "_postinstall"')
-    expect(formula).toContain('bin.install "supatype-cli-#{arch}" => "supatype"')
   })
 
-  it("fails when an artifact is missing", () => {
-    rmSync(join(tmpDir, "supatype-cli-linux-amd64"))
-    const script = join(import.meta.dirname, "../scripts/generate-homebrew-formula.mjs")
-    const result = spawnSync(process.execPath, [script, "1.0.0", tmpDir], { encoding: "utf8" })
+  it("does not reference the musl or windows artefacts", () => {
+    writeArtifacts(ARCHIVES)
+    const outPath = join(tmpDir, "supatype.rb")
+    const result = spawnSync(process.execPath, [script(), "9.9.9", tmpDir], {
+      encoding: "utf8",
+      env: { ...process.env, HOMEBREW_FORMULA_OUT: outPath },
+    })
+
+    expect(result.status, result.stderr).toBe(0)
+    const formula = readFileSync(outPath, "utf8")
+    expect(formula).not.toContain("musl")
+    expect(formula).not.toContain("windows")
+  })
+
+  it("fails when the manifest is missing, rather than hashing the files itself", () => {
+    writeArtifacts(ARCHIVES)
+    rmSync(join(tmpDir, "checksums.sha256"))
+    const result = spawnSync(process.execPath, [script(), "1.0.0", tmpDir], { encoding: "utf8" })
+    expect(result.status).not.toBe(0)
+    expect(result.stderr).toContain("checksums.sha256")
+  })
+
+  it("fails when the manifest omits a platform it needs", () => {
+    writeArtifacts(ARCHIVES.filter((n) => n !== "supatype-cli-linux-amd64.tar.gz"))
+    const result = spawnSync(process.execPath, [script(), "1.0.0", tmpDir], { encoding: "utf8" })
     expect(result.status).not.toBe(0)
-    expect(result.stderr).toContain("Missing artifact")
+    expect(result.stderr).toContain("No checksum for supatype-cli-linux-amd64.tar.gz")
   })
 })

package/tests/hook-upload.test.ts

@@ -86,7 +86,7 @@ describe("readHookUpload", () => {
   })
 
   it("refuses a hook with a second file rather than dropping it", () => {
-    // Silent truncation would deploy successfully and fail at import — which reads to the caller as
+    // Silent truncation would deploy successfully and fail at import, which reads to the caller as
     // that table's writes being broken for no visible reason.
     const { cwd, hooks } = project()
     writeHook(hooks, "moderate-post", HANDLER, { "helpers.ts": "export const x = 1\n" })

package/tests/hooks-generator.test.ts

@@ -71,7 +71,7 @@ export type Post = Model<{ id: UUID }, { tableName: "posts" }>
 describe("the generated module compiles", () => {
   /**
    * The generator emits TypeScript, so the only test that really proves it works is a compiler.
-   * A missing brace or a type that does not resolve would otherwise reach a user's editor — and this
+   * A missing brace or a type that does not resolve would otherwise reach a user's editor, and this
    * file is imported by their hook, so a broken emit breaks their function rather than our build.
    */
   it("typechecks under strict mode, together with a handler that uses it", () => {

package/tests/init.test.ts

@@ -329,7 +329,7 @@ describe("scaffold()", () => {
     expect(config).toContain('provider: "local"')
     expect(config).toContain("Production storage: external S3")
     const env = readFileSync(join(tmpRoot, ".env"), "utf8")
-    expect(env).toContain("local development — MinIO")
-    expect(env).toContain("production — external bucket")
+    expect(env).toContain("local development, MinIO")
+    expect(env).toContain("production, external bucket")
   })
 })

package/tests/keys.test.ts

@@ -1,5 +1,5 @@
 /**
- * Tests for `supatype keys` — JWT generation command.
+ * Tests for `supatype keys`, JWT generation command.
  * Uses subprocess tests (requires built dist/) for the CLI integration,
  * plus direct module tests for the signing logic.
  */
@@ -20,10 +20,16 @@ function runCli(
 ): { stdout: string; stderr: string; exitCode: number } {
   const result = spawnSync(process.execPath, [CLI_BIN, ...args], {
     encoding: "utf8",
-    timeout: 10_000,
+    timeout: 60_000,
     cwd: opts.cwd,
     env: { ...process.env, ...opts.env },
   })
+  if (result.signal) {
+    throw new Error(
+      `CLI subprocess killed by ${result.signal} after the spawn timeout. `
+        + `Args: ${args.join(" ")}. This is usually machine contention, not a CLI fault.`,
+    )
+  }
   return {
     stdout: String(result.stdout ?? ""),
     stderr: String(result.stderr ?? ""),

package/tests/local-secrets.test.ts

@@ -14,7 +14,7 @@ import {
 import { upsertEnvFile } from "../src/env-file.js"
 
 // The bug these exist to prevent: `supatype dev` used to pin POSTGRES_PASSWORD and JWT_SECRET
-// to published constants in `.env` on every run — the same `.env` a self-host deployment reads.
+// to published constants in `.env` on every run, the same `.env` a self-host deployment reads.
 // A generated secret survived until the developer's next `dev`, then reverted silently, and the
 // deployment went out with a secret anyone can look up.
 
@@ -32,7 +32,7 @@ describe("resolving local secrets", () => {
     expect(devAuthenticatorPassword(dir)).toBe("auth-mine")
   })
 
-  // A project with no `.env` still has to start, so the constants remain — as fallbacks only.
+  // A project with no `.env` still has to start, so the constants remain, as fallbacks only.
   it("falls back when the project has none", () => {
     const dir = project()
     expect(devJwtSecret(dir)).toBe(FALLBACK_JWT_SECRET)
@@ -43,7 +43,7 @@ describe("resolving local secrets", () => {
 
 describe("the dev env write does not clobber secrets", () => {
   // This is the regression. `upsertEnvFile` replaces any key handed to it, so the guarantee has
-  // to be that the dev path never hands it these — asserted here at the level that matters:
+  // to be that the dev path never hands it these, asserted here at the level that matters:
   // write what dev writes, then check the secrets are byte-identical.
   it("leaves generated secrets untouched across repeated writes", () => {
     const dir = project(