@supatype/cli 0.1.7 → 0.1.9

package/src/cli-package-version.ts

@@ -1,11 +1,15 @@
 import { readFileSync } from "node:fs"
 import { dirname, join } from "node:path"
 import { fileURLToPath } from "node:url"
+import { EMBEDDED_CLI_VERSION } from "./cli-version-embedded.js"
 
 const CLI_PACKAGE_JSON = join(dirname(fileURLToPath(import.meta.url)), "..", "package.json")
 
-/** Installed @supatype/cli version from package.json (used by --version and init scaffolding). */
+/** Installed @supatype/cli version (used by --version and init scaffolding). */
 export function cliPackageVersion(): string {
+  // Set in published builds; the package.json read below only works when one is on disk,
+  // which is true for the npm package and false inside the standalone binary.
+  if (EMBEDDED_CLI_VERSION !== "") return EMBEDDED_CLI_VERSION
   try {
     const pkg = JSON.parse(readFileSync(CLI_PACKAGE_JSON, "utf8")) as { version?: string }
     return pkg.version ?? "0.0.0"

package/src/cli-standalone.ts

@@ -1,23 +1,45 @@
 /**
- * Standalone CLI binary CDN download (self-update + curl|sh installers).
+ * Standalone CLI archive download, used by `supatype self-update`.
+ *
+ * The artefact is a per-platform archive holding one executable, not a bare executable, and it
+ * is verified against the release's checksums.sha256 before anything is replaced. Previously
+ * this path checked only that the download was over 64 bytes and did not begin like HTML or
+ * JSON, which made the CLI stricter about a postgres archive than about overwriting itself.
  */
 
-import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs"
-import { homedir } from "node:os"
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { createHash } from "node:crypto"
+import { homedir, tmpdir } from "node:os"
 import { join } from "node:path"
-import { currentPlatform, type PlatformId } from "./binary-cache.js"
+import { spawnSync } from "node:child_process"
+import { currentPlatform, fetchChecksums, type PlatformId } from "./binary-cache.js"
+import {
+  cliArchiveName,
+  cliArchivePath,
+  cliChecksumsPath,
+  cliExecutableName,
+  currentLibc,
+  type LibcId,
+} from "./cli-artifacts.js"
 
-const CDN_BASE = "https://releases.supatype.com"
-
-export function cliCdnPath(version: string, platform: PlatformId): string {
-  const win = platform.os === "windows"
-  return `/cli/v${version}/supatype-cli-${platform.os}-${platform.arch}${win ? ".exe" : ""}`
-}
+/**
+ * Overridable for the same reason scripts/install.sh takes SUPATYPE_CDN: with the host fixed,
+ * nothing can exercise this path except a real release, which is how it came to request bare
+ * executables the publisher had stopped writing. SUPATYPE_CDN_BASE is the CDN root, where
+ * install.sh's SUPATYPE_CDN is the root plus /cli.
+ *
+ * binary-cache.ts hardcodes the same host for component downloads and could use the same
+ * treatment, which is left alone here as it is not part of this change.
+ */
+const CDN_BASE = process.env["SUPATYPE_CDN_BASE"]?.replace(/\/$/, "")
+  || "https://releases.supatype.com"
 
-export function cliCachePath(version: string, platform: PlatformId = currentPlatform()): string {
-  const win = platform.os === "windows"
-  const name = `supatype-cli-${platform.os}-${platform.arch}${win ? ".exe" : ""}`
-  return join(homedir(), ".supatype", "cache", "cli", version, name)
+/** Where a downloaded release is unpacked, so a repeated update does not refetch it. */
+export function cliCachePath(
+  version: string,
+  platform: PlatformId = currentPlatform(),
+): string {
+  return join(homedir(), ".supatype", "cache", "cli", version, cliExecutableName(platform))
 }
 
 export async function fetchStandaloneCliLatestVersion(): Promise<string> {
@@ -32,31 +54,91 @@ export async function fetchStandaloneCliLatestVersion(): Promise<string> {
   return data.version.trim()
 }
 
-/** Download the standalone CLI binary for the current platform. */
-export async function downloadStandaloneCli(version?: string): Promise<string> {
-  const platform = currentPlatform()
-  const resolved = version ?? await fetchStandaloneCliLatestVersion()
-  const dest = cliCachePath(resolved, platform)
-  if (existsSync(dest)) return dest
-
-  const url = `${CDN_BASE}${cliCdnPath(resolved, platform)}`
+async function fetchBytes(url: string, what: string): Promise<Buffer> {
   const resp = await fetch(url)
   if (!resp.ok) {
-    throw new Error(`Failed to download CLI from ${url}: HTTP ${resp.status}`)
+    throw new Error(`Failed to download ${what} from ${url}: HTTP ${resp.status}`)
   }
-  const buf = Buffer.from(await resp.arrayBuffer())
-  if (buf.length < 64) {
-    throw new Error("Downloaded CLI artifact is too small")
+  return Buffer.from(await resp.arrayBuffer())
+}
+
+/**
+ * Unpack the single executable from an archive.
+ *
+ * PowerShell on Windows, because Git Bash's tar is usually first on PATH there and chokes on
+ * drive-letter paths. The same split exists in commands/dev.ts for component archives.
+ */
+function unpackExecutable(archivePath: string, destDir: string, platform: PlatformId): string {
+  mkdirSync(destDir, { recursive: true })
+  const result = platform.os === "windows"
+    ? spawnSync(
+        "powershell.exe",
+        [
+          "-NoProfile",
+          "-Command",
+          `Expand-Archive -Path '${archivePath}' -DestinationPath '${destDir}' -Force`,
+        ],
+        { stdio: "pipe" },
+      )
+    : spawnSync("tar", ["-xzf", archivePath, "-C", destDir], { stdio: "pipe" })
+
+  if (result.status !== 0) {
+    throw new Error(
+      `Failed to unpack ${archivePath}: ${result.stderr?.toString().trim() || "unknown error"}`,
+    )
   }
-  const head = buf.subarray(0, 5).toString("utf8").toLowerCase()
-  if (head.startsWith("<!doc") || head.startsWith("{")) {
-    throw new Error("Downloaded CLI artifact looks like an error page, not a binary")
+
+  const exe = join(destDir, cliExecutableName(platform))
+  if (!existsSync(exe)) {
+    throw new Error(
+      `${cliArchiveName(platform)} did not contain ${cliExecutableName(platform)}.`,
+    )
+  }
+  return exe
+}
+
+/**
+ * Download and verify the standalone CLI for this machine, returning the path to the
+ * executable. Nothing is written to the cache until the checksum matches.
+ */
+export async function downloadStandaloneCli(
+  version?: string,
+  platform: PlatformId = currentPlatform(),
+  libc: LibcId = currentLibc(platform),
+): Promise<string> {
+  const resolved = version ?? await fetchStandaloneCliLatestVersion()
+  const dest = cliCachePath(resolved, platform)
+  if (existsSync(dest)) return dest
+
+  const name = cliArchiveName(platform, libc)
+  const archive = await fetchBytes(`${CDN_BASE}${cliArchivePath(resolved, platform, libc)}`, name)
+
+  // The manifest is verified before it is trusted, and only then is the archive compared
+  // against it. A checksum alone would prove the download was intact, not that it came from
+  // us, and the signature is what makes replacing our own executable no weaker than fetching
+  // a postgres archive. fetchChecksums treats the .minisig as mandatory and fails closed
+  // without a public key, which is the same rule component downloads follow.
+  const checksumsUrl = `${CDN_BASE}${cliChecksumsPath(resolved)}`
+  const expected = await fetchChecksums(checksumsUrl, `${checksumsUrl}.minisig`, name)
+  const actual = createHash("sha256").update(archive).digest("hex")
+  if (actual !== expected.checksum) {
+    throw new Error(
+      `Checksum mismatch for ${name}.\n  expected: ${expected.checksum}\n  actual:   ${actual}`,
+    )
   }
 
-  mkdirSync(join(dest, ".."), { recursive: true })
-  writeFileSync(dest, buf)
-  if (platform.os !== "windows") {
-    chmodSync(dest, 0o755)
+  const staging = join(tmpdir(), `supatype-cli-${resolved}-${process.pid}`)
+  try {
+    mkdirSync(staging, { recursive: true })
+    const archivePath = join(staging, name)
+    writeFileSync(archivePath, archive)
+    const unpacked = unpackExecutable(archivePath, staging, platform)
+
+    mkdirSync(join(dest, ".."), { recursive: true })
+    writeFileSync(dest, readFileSync(unpacked))
+    if (platform.os !== "windows") chmodSync(dest, 0o755)
+    return dest
+  } finally {
+    rmSync(staging, { recursive: true, force: true })
   }
-  return dest
 }

package/src/cli-version-embedded.ts

@@ -0,0 +1,12 @@
+/**
+ * CLI version, baked in at publish by scripts/set-version.mjs.
+ *
+ * The standalone binary cannot read its own package.json: pkg carries only files it can
+ * find by static analysis, and that path is assembled at runtime, so `--version` inside a
+ * published binary would answer 0.0.0 without this. Empty in a source checkout, where
+ * cliPackageVersion() falls back to reading package.json.
+ */
+// Annotated `string`, not left to inference: once a release stamps a value here, the
+// inferred literal type makes the `!== ""` test in cliPackageVersion() a compile error
+// (TS2367, no overlap), so the build would only fail during a release.
+export const EMBEDDED_CLI_VERSION: string = "0.1.9"

package/src/cli.ts

@@ -39,7 +39,7 @@ import { wrapProgramActionsWithChrome } from "./ui/runtime/command-chrome.js"
 export async function run(): Promise<void> {
   const program = new Command()
     .name("supatype")
-    .description("Supatype — type-first platform for PostgreSQL")
+    .description("Supatype: type-first platform for PostgreSQL")
     .version(cliPackageVersion())
 
   registerInit(program)

package/src/commands/add.ts

@@ -99,6 +99,6 @@ function printDomainNextSteps(cwd: string, domain: string): void {
     "supatype self-host compose up -d   # Kong provisions HTTPS automatically",
     `Platform URL: https://${domain}`,
   ])
-  plain("  App, REST, Auth, Storage, Realtime, Functions, and Studio — one HTTPS domain.")
+  plain("  App, REST, Auth, Storage, Realtime, Functions, and Studio, one HTTPS domain.")
   plain("  Certificates persist in the valkey-data volume.\n")
 }

package/src/commands/admin.ts

@@ -1,6 +1,6 @@
 // ─── Admin panel CLI commands (Gap Appendices task 48) ──────────────────────
 //
-// `npx supatype admin create-user` — create an admin user in the project's
+// `npx supatype admin create-user`, create an admin user in the project's
 // auth.users table. First admin is ensured on `supatype dev` or `supatype push`.
 
 import type { Command } from "commander"
@@ -242,7 +242,7 @@ export function registerAdmin(program: Command): void {
       const pool = new pg.Pool({ connectionString: connection, max: 2 })
 
       try {
-        // Studio access is membership, not a claim — list the grant that
+        // Studio access is membership, not a claim, list the grant that
         // actually decides admission. LEFT JOIN, because a membership held by a
         // Supatype Cloud account has no row in this project's `auth.users`;
         // hiding those would make `list-users` disagree with who can log in.
@@ -308,7 +308,7 @@ export async function ensureFirstAdminUser(
       options,
     )
   } catch {
-    // Non-fatal — skip when DB is unreachable or auth schema is not ready
+    // Non-fatal: skip when DB is unreachable or auth schema is not ready
   } finally {
     await pool.end()
   }
@@ -528,7 +528,7 @@ async function createAdminUser(
  * the developer's own app roles, and letting it grant Studio access means a
  * developer assigning an app role could hand out admin UI access by accident.
  *
- * This is now the *only* grant, so a failure here is fatal to the command — a
+ * This is now the *only* grant, so a failure here is fatal to the command, a
  * user created without a membership row cannot reach Studio at all, and
  * reporting success would leave no clue why.
  */
@@ -591,12 +591,12 @@ async function authUsersTableExists(query: DbQuery): Promise<boolean> {
  *
  * Counts membership rows, not `app_metadata` claims: the claim no longer grants
  * anything, so counting it would report an admin exists while nobody can log in.
- * A missing table means the project has never been pushed — no admins.
+ * A missing table means the project has never been pushed, no admins.
  */
 async function hasAdminUsers(query: DbQuery): Promise<boolean> {
   // Postgres resolves relations at parse time, so the table has to be checked
   // separately rather than guarded inside the count query. Absent means the
-  // project has never been pushed — no admins, and `createAdminUser` will
+  // project has never been pushed, no admins, and `createAdminUser` will
   // create the table itself.
   if (!(await studioMembersTableExists(query))) return false
 

package/src/commands/adopt.ts

@@ -54,7 +54,7 @@ export function registerAdopt(program: Command): void {
 
       const statements = preview.stampStatements ?? []
       if (statements.length === 0) {
-        info("Nothing to stamp — matching objects are already managed or absent.")
+        info("Nothing to stamp: matching objects are already managed or absent.")
         return
       }
 

package/src/commands/app.ts

@@ -17,7 +17,7 @@ export function registerApp(program: Command): void {
     .option("--static", "Serve a static directory at / (default: ./public, or [dir] argument)")
     .option("--port <port>", "Port your app listens on (proxy mode)", "3000")
     .option("--upstream <url>", "URL of your running dev server (proxy mode; defaults to localhost:<port>)")
-    .option("--dockerfile <path>", "(deprecated) ignored — use supatype.config.ts")
+    .option("--dockerfile <path>", "(deprecated) ignored, use supatype.config.ts")
     .action(
       (
         dir: string | undefined,
@@ -80,7 +80,7 @@ function addProxyApp(cwd: string, port: string, upstream?: string): void {
   try {
     const configPath = updateAppConfigInProject(cwd, { mode: "proxy", upstream: upstreamUrl })
     file("updated", configPath)
-    info(`Forwarding to ${upstreamUrl} — app at ${localKongBaseUrl()}/`)
+    info(`Forwarding to ${upstreamUrl}: app at ${localKongBaseUrl()}/`)
     nextSteps("Next:", ["supatype self-host compose render"])
   } catch (err) {
     error((err as Error).message)

package/src/commands/cache.ts

@@ -1,5 +1,5 @@
 /**
- * supatype cache — list and clean cached component binaries + REST Valkey cache.
+ * supatype cache: list and clean cached component binaries + REST Valkey cache.
  */
 
 import type { Command } from "commander"
@@ -126,7 +126,7 @@ export function registerCache(program: Command): void {
         if (result.removed.length === 0 && result.skipped.length === 0) {
           info("Nothing to clean.")
         } else if (opts?.dryRun) {
-          info(`Dry run — ${result.removed.length} entr${result.removed.length === 1 ? "y" : "ies"} would be removed.`)
+          info(`Dry run: ${result.removed.length} entr${result.removed.length === 1 ? "y" : "ies"} would be removed.`)
         } else {
           info("Done.")
         }
@@ -160,7 +160,7 @@ export function registerCache(program: Command): void {
           )
         }
         if (result.cursor !== "0") {
-          plain(`\n(more available — cursor ${result.cursor})`)
+          plain(`\n(more available: cursor ${result.cursor})`)
         }
       } catch (e) {
         error(e instanceof Error ? e.message : String(e))

package/src/commands/db.ts

@@ -1,8 +1,8 @@
 /**
  * Database connection commands:
- *   supatype db connection-string  — show the connection string for the linked project
- *   supatype db reset-password     — reset the database password
- *   supatype db check              — does this database meet what Supatype needs of it?
+ *   supatype db connection-string: show the connection string for the linked project
+ *   supatype db reset-password: reset the database password
+ *   supatype db check: does this database meet what Supatype needs of it?
  */
 
 import type { Command } from "commander"
@@ -154,7 +154,7 @@ export function registerDb(program: Command): void {
           url = url ?? connectionString(config)
           schema = schema ?? config.schema?.pg_schema ?? "public"
         } catch {
-          // Runnable outside a project, which is the point — an operator should be able to check a
+          // Runnable outside a project, which is the point, an operator should be able to check a
           // database before committing to any config at all.
           url = url ?? process.env["DATABASE_URL"]
           schema = schema ?? "public"
@@ -190,7 +190,7 @@ export function registerDb(program: Command): void {
         if (opts.emit) {
           // Machine-consumable: SQL on stdout, commentary on stderr, so it can be piped to psql.
           if (fixable.length === 0) {
-            warn("Nothing to emit — no SQL-fixable findings.")
+            warn("Nothing to emit: no SQL-fixable findings.")
           } else {
             plain("BEGIN;")
             for (const r of fixable) plain(`\n-- ${r.title}\n${r.remedy}`)
@@ -198,7 +198,7 @@ export function registerDb(program: Command): void {
           }
           if (manual.length > 0) {
             warn(`\n${manual.length} finding(s) need operator action and are not included above:`)
-            for (const r of manual) warn(`  ${r.title} — ${r.detail}`)
+            for (const r of manual) warn(`  ${r.title}, ${r.detail}`)
           }
           return
         }
@@ -224,7 +224,7 @@ export function registerDb(program: Command): void {
               await applyRemedies(client, fixable)
               info("Applied. Re-run `supatype db check` to confirm.")
             } catch (err) {
-              error(`Rolled back — the database is unchanged: ${(err as Error).message}`)
+              error(`Rolled back: the database is unchanged: ${(err as Error).message}`)
               process.exitCode = 1
               return
             }
@@ -232,7 +232,7 @@ export function registerDb(program: Command): void {
           if (manual.length > 0) {
             warn(`\n${manual.length} finding(s) cannot be fixed in a transaction:`)
             for (const r of manual) {
-              warn(`  ${r.title} — needs a server setting change and likely a restart`)
+              warn(`  ${r.title}: needs a server setting change and likely a restart`)
             }
           }
           return
@@ -265,7 +265,7 @@ const SEVERITY_LABEL: Record<Severity, string> = {
 
 function printReport(results: readonly CheckResult[]): void {
   for (const r of results) {
-    const line = `[${SEVERITY_LABEL[r.severity]}] ${r.title} — ${r.detail}`
+    const line = `[${SEVERITY_LABEL[r.severity]}] ${r.title}, ${r.detail}`
     if (r.severity === "fail") error(line)
     else if (r.severity === "degrade" || r.severity === "warn") warn(line)
     else plain(line)

package/src/commands/deploy.ts

@@ -1,14 +1,14 @@
 /**
  * Deploy commands:
- *   supatype deploy              — Supatype Cloud by default (linked via supatype link), else platform projectRef; use --local for engine + DB
- *   supatype deploy --local      — push schema via local engine + optional static app to .supatype/static
- *   supatype deploy --app-only   — only build & deploy the static site
- *   supatype deploy --schema-only — only push schema changes
- *   supatype deploy --skip-build — deploy existing build output (no build step)
- *   supatype deploy --preview    — deploy to a preview URL
- *   supatype deploy rollback     — roll back to previous deployment
- *   supatype deploy status       — show current deployment info
- *   supatype deploy logs <version> — show build logs
+ *   supatype deploy: Supatype Cloud by default (linked via supatype link), else platform projectRef; use --local for engine + DB
+ *   supatype deploy --local: push schema via local engine + optional static app to .supatype/static
+ *   supatype deploy --app-only: only build & deploy the static site
+ *   supatype deploy --schema-only: only push schema changes
+ *   supatype deploy --skip-build: deploy existing build output (no build step)
+ *   supatype deploy --preview: deploy to a preview URL
+ *   supatype deploy rollback: roll back to previous deployment
+ *   supatype deploy status: show current deployment info
+ *   supatype deploy logs <version>, show build logs
  */
 
 import type { Command } from "commander"
@@ -31,7 +31,7 @@ export function registerDeploy(program: Command): void {
   const deploy = program
     .command("deploy")
     .description(
-      "Deploy schema and app — Supatype Cloud by default when linked (`supatype link`); pass --local for engine + your database",
+      "Deploy schema and app, Supatype Cloud by default when linked (`supatype link`); pass --local for engine + your database",
     )
     .option("--local", "Use local schema engine and database_url from config (skip cloud control plane)")
     .option("--environment <name>", "Target environment when linked", "production")
@@ -119,7 +119,7 @@ export function registerDeploy(program: Command): void {
             error("No build section found in supatype.config.ts")
             process.exit(1)
           }
-          // No build config — skip app deployment silently
+          // No build config: skip app deployment silently
           return
         }
 
@@ -151,7 +151,7 @@ export function registerDeploy(program: Command): void {
             buildEnv["NEXT_PUBLIC_SUPATYPE_URL"] = cloudCfg.apiUrl || `https://${cloudCfg.projectSlug}.supatype.dev`
             buildEnv["VITE_SUPATYPE_URL"] = buildEnv["NEXT_PUBLIC_SUPATYPE_URL"]!
             buildEnv["PUBLIC_SUPATYPE_URL"] = buildEnv["NEXT_PUBLIC_SUPATYPE_URL"]!
-            // NEVER inject service_role key — only anon key is safe for client-side
+            // NEVER inject service_role key, only anon key is safe for client-side
           }
 
           // Install dependencies

package/src/commands/dev.ts

@@ -1,9 +1,9 @@
 /**
- * supatype dev — start local Postgres, apply schema, run supatype-server.
+ * supatype dev: start local Postgres, apply schema, run supatype-server.
  *
  * Runtime provider (top-level `provider` or legacy `database.provider`):
- *   native — host Postgres + host server + host engine (default)
- *   docker — full self-host Compose stack (Kong :18473); see dev-compose.ts
+ *   native: host Postgres + host server + host engine (default)
+ *   docker: full self-host Compose stack (Kong :18473); see dev-compose.ts
  *
  * Edge functions (when a functions/ dir exists): Deno is resolved from the CDN cache
  * (auto-download on miss). Self-host/cloud Docker stacks use supatype-server in-container;
@@ -127,7 +127,7 @@ export function registerDev(program: Command): void {
     .action(async (opts: { watch: boolean; stream?: boolean; port?: string }) => {
       const cwd = process.cwd()
 
-      // ── 1. Load project config (before TUI — fatal errors must hit real stderr) ──
+      // ── 1. Load project config (before TUI, fatal errors must hit real stderr) ──
       const config = loadConfig(cwd)
       const provider = resolveRuntimeProvider(config)
 
@@ -181,7 +181,7 @@ export function registerDev(program: Command): void {
 
       // ── 5–7. Start Postgres ───────────────────────────────────────────────
       let dbURL: string
-      /** What PostgREST connects as — deliberately not `dbURL`, which is a superuser. */
+      /** What PostgREST connects as, deliberately not `dbURL`, which is a superuser. */
       let postgrestDbURL: string
       let stopPostgres: () => void | Promise<void>
       const pgPort = NATIVE_PG_PORT
@@ -195,7 +195,7 @@ export function registerDev(program: Command): void {
       let pgBinDir: string | null = null
 
       {
-        // native — resolve pg bin dir and manage with pg_ctl
+        // native: resolve pg bin dir and manage with pg_ctl
         pgBinDir = await resolvePgBinDir(config)
         const dataDir = config.database.data_dir ?? join(stateRoot, "data")
         mkdirSync(dataDir, { recursive: true })
@@ -239,7 +239,7 @@ export function registerDev(program: Command): void {
         //
         // `authenticator` is NOINHERIT and holds no privileges of its own: it can only
         // SET ROLE to the three above. That containment is the point. Connecting as
-        // `postgres` — a superuser — meant a request whose JWT named *any* role in the
+        // `postgres`: a superuser: meant a request whose JWT named *any* role in the
         // cluster got it, because a superuser may SET ROLE to anything. Verified: as
         // postgres, `SET ROLE supatype_replication_admin` succeeds; as authenticator the
         // same statement is refused. Mirrors the image, which has had this role all along.
@@ -300,7 +300,7 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
       mkdirSync(supatypeDir, { recursive: true })
 
       const localStoragePath = config.storage?.provider !== "s3" ? join(stateRoot, "storage") : undefined
-      // Native Postgres builds don't include PostGIS — skip geo fields rather than failing.
+      // Native Postgres builds don't include PostGIS, skip geo fields rather than failing.
       const skipFieldKinds: ReadonlySet<string> = new Set(["geo", "vector"])
 
       await runSchemaPush(cwd, engineBin, schemaPath, dbURL, manifestPath, adminConfigPath, localStoragePath, skipFieldKinds, config).catch(
@@ -341,7 +341,7 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
           }
         } catch (err) {
           console.warn(
-            `[supatype] ⚠  Found ${functionsDir} but could not provision Deno — edge functions will not run.\n` +
+            `[supatype] ⚠  Found ${functionsDir} but could not provision Deno, edge functions will not run.\n` +
               `  ${(err as Error).message}\n` +
               "  (Functions still appear in Studio; invocations need Deno.)",
           )
@@ -383,7 +383,7 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
         console.log(`[supatype] Realtime service: ${realtimeUrl}`)
       } catch (err) {
         console.warn(
-          `[supatype] ⚠  Realtime unavailable — WebSocket subscriptions will not work.\n` +
+          `[supatype] ⚠  Realtime unavailable, WebSocket subscriptions will not work.\n` +
             `  ${(err as Error).message}`,
         )
       }
@@ -509,10 +509,10 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
 
         const postgrestEnv: Record<string, string> = {
           PGRST_DB_URI: postgrestDbURL,
-          // Derived from schema.pg_schema (or schema.api_schemas) — a hardcoded "public" here meant
+          // Derived from schema.pg_schema (or schema.api_schemas), a hardcoded "public" here meant
           // a non-default pg_schema pushed correctly and then answered PGRST106 on every request.
           // Native dev has no masking extension either, so a schema with field rules is served from
-          // `api` here too — the case an "is the database external" rule would have got wrong.
+          // `api` here too: the case an "is the database external" rule would have got wrong.
           PGRST_DB_SCHEMA: apiSchemaList(
             config,
             // The installed archive decides: one downloaded before the masking library was bundled
@@ -644,9 +644,9 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authenticate
 // Schema push (engine subprocess)
 // ---------------------------------------------------------------------------
 
-// Last successfully-pushed AST JSON — used to skip no-op re-fires.
+// Last successfully-pushed AST JSON, used to skip no-op re-fires.
 let _lastPushedAst: string | null = null
-// AST that failed on its last attempt — always retried even if content is unchanged.
+// AST that failed on its last attempt, always retried even if content is unchanged.
 let _lastFailedAst: string | null = null
 
 async function runSchemaPush(
@@ -670,7 +670,7 @@ async function runSchemaPush(
     ast = filtered
     if (adapted.length > 0) {
       console.warn(
-        `[supatype] ⚠  ${adapted.length} field(s) replaced with JSONB — required extensions not available:\n` +
+        `[supatype] ⚠  ${adapted.length} field(s) replaced with JSONB, required extensions not available:\n` +
         adapted.map((s: string) => `    ${s}`).join("\n"),
       )
     }
@@ -744,7 +744,7 @@ async function runSchemaPush(
     { cwd, stdio: "pipe", encoding: "utf8" },
   )
   if (genResult.status !== 0) {
-    console.warn("[supatype] Manifest generation failed — server routing may be stale.")
+    console.warn("[supatype] Manifest generation failed, server routing may be stale.")
   }
 
   // Generate admin config (for Studio). Engine writes to stdout.
@@ -889,7 +889,7 @@ async function extractPostgresArchive(
 }
 
 // ---------------------------------------------------------------------------
-// PostgREST resolver — downloads from GitHub releases if not cached
+// PostgREST resolver: downloads from GitHub releases if not cached
 // ---------------------------------------------------------------------------
 
 const POSTGREST_DEFAULT_VERSION = "12.2.3"
@@ -1030,12 +1030,12 @@ function repairWindowsPostgrestRuntime(cacheDir: string, archivePath: string, bi
 }
 
 // ---------------------------------------------------------------------------
-// Local-dev JWT generator (no external dep — pure crypto)
+// Local-dev JWT generator (no external dep, pure crypto)
 // ---------------------------------------------------------------------------
 
 
 // ---------------------------------------------------------------------------
-// AST adaptation — replace extension-dependent fields with JSONB fallbacks
+// AST adaptation: replace extension-dependent fields with JSONB fallbacks
 // ---------------------------------------------------------------------------
 
 interface AstField { kind: string; required?: boolean; [k: string]: unknown }

package/src/commands/doctor.ts

@@ -114,7 +114,7 @@ export function registerDoctor(program: Command): void {
  * Whether declared hooks can actually run.
  *
  * Worth its own section because every failure here is silent: a hook whose function is missing, or a
- * stack with functions switched off, produces no error anywhere — the write just succeeds
+ * stack with functions switched off, produces no error anywhere, the write just succeeds
  * unvalidated. Drift you cannot see is the thing doctor exists for.
  */
 export function printHooks(report: HooksReport): void {
@@ -133,7 +133,7 @@ export function printHooks(report: HooksReport): void {
     plain("  Create it with: supatype hooks new <name>")
   }
   if (report.functionsDisabled) {
-    plain("\n  functions_enabled is false in .supatype/manifest.json — every hook is inert.")
+    plain("\n  functions_enabled is false in .supatype/manifest.json, every hook is inert.")
     plain("  Regenerate the stack config with: supatype self-host compose")
   }
   if (report.mapMissing) {
@@ -162,7 +162,7 @@ export function printServiceRoleGrants(
   }
 
   if (broken.size > 0) {
-    plain("\n  Those marked ✗ match no function, so they grant nothing — the function reads no key.")
+    plain("\n  Those marked ✗ match no function, so they grant nothing, the function reads no key.")
   }
   for (const warning of problems.warnings) plain(warning)
   plain("\n  These functions bypass every access rule in the schema. Anything not listed cannot.")

package/src/commands/engine.ts

@@ -1,6 +1,6 @@
 /**
  * Engine management commands:
- *   supatype engine status  — check if the engine container is reachable
+ *   supatype engine status: check if the engine container is reachable
  */
 
 import type { Command } from "commander"