@supatype/cli 0.1.7 → 0.1.9

package/src/ensure-binary.ts

@@ -11,8 +11,26 @@ import {
   type Component,
 } from "./binary-cache.js"
 import { isDownloadInProgress, waitForComponentDownload } from "./binary-download-lock.js"
+import { currentLibc } from "./cli-artifacts.js"
 import type { SupatypeProjectConfig } from "./project-config.js"
 
+/**
+ * Components are published for glibc only, so on Alpine the CLI itself runs (it has a musl
+ * build) while everything it downloads cannot start. Said once, before the first download,
+ * because the alternative is a dynamic loader error naming a file the user never asked for.
+ */
+let warnedAboutMusl = false
+function warnIfMusl(component: Component): void {
+  if (warnedAboutMusl || currentLibc() !== "musl") return
+  warnedAboutMusl = true
+  console.warn(
+    `[supatype] This is a musl system (Alpine). Component binaries such as ${component} are ` +
+      "published for glibc only, so they may fail to start here.\n" +
+      "[supatype] Use a glibc image (for example node:22-bookworm) for local stacks, or run " +
+      "against a remote target with `supatype link`.",
+  )
+}
+
 export async function ensureBinary(
   component: Component,
   config: SupatypeProjectConfig,
@@ -26,6 +44,8 @@ export async function ensureBinary(
     }
   }
 
+  warnIfMusl(component)
+
   const version = await resolveVersionFor(component, config)
   const platform = currentPlatform()
 

package/src/ensure-component-binaries.ts

@@ -37,7 +37,7 @@ export async function ensureComponentBinaries(
   const list = describeRequiredHostComponents(components)
   if (provider === "docker") {
     info(
-      `Preparing host CLI tools (${list}) — Compose still runs Postgres and the API stack.`,
+      `Preparing host CLI tools (${list}), Compose still runs Postgres and the API stack.`,
     )
   } else {
     info(`Preparing local runtime components (${list})…`)

package/src/env-file.ts

@@ -10,7 +10,7 @@ import { join } from "node:path"
  * `SUPATYPE_REALTIME_IMAGE` from `.env` and could not override `SUPATYPE_SERVER_IMAGE`, because the
  * latter is derivable from a pin and the former is not. Same file, same shape, different rules.
  */
-export const MANAGED_MARKER = "# supatype:managed — value from versions in supatype.config.ts"
+export const MANAGED_MARKER = "# supatype:managed, value from versions in supatype.config.ts"
 
 interface EnvLine {
   /** `KEY` for an assignment, undefined for comments and blanks. */
@@ -47,7 +47,7 @@ function parseLines(text: string): EnvLine[] {
 
 export interface UpsertOptions {
   /**
-   * Keys to delete — but only where the CLI wrote them (see [`MANAGED_MARKER`]). A hand-written value
+   * Keys to delete: but only where the CLI wrote them (see [`MANAGED_MARKER`]). A hand-written value
    * is left alone, because the operator putting an image tag in `.env` is the documented way to run a
    * local build and deleting it silently sent them back to `:latest`.
    */

package/src/field-masking-tier.ts

@@ -1,10 +1,10 @@
 /**
- * Which mechanism will enforce this project's per-column rules — decided offline.
+ * Which mechanism will enforce this project's per-column rules, decided offline.
  *
  * The engine makes the same decision at push time by asking the database whether `supatype_mask` is
  * installed. The CLI has to answer earlier: it writes `PGRST_DB_SCHEMA` when it generates compose,
  * before any database necessarily exists. It can, because the extension needs
- * `shared_preload_libraries` and a compiled library on the host, so exactly one path ships it —
+ * `shared_preload_libraries` and a compiled library on the host, so exactly one path ships it,
  * `supatype/postgres`. Everything else gets the view tier:
  *
  * | Config                                       | Ships the extension | Tier      |
@@ -16,7 +16,7 @@
  *
  * Deliberately **not** "is the database external": a native `supatype dev` has no extension either,
  * and treating it as tier 1 would point PostgREST at a schema whose tables the API roles no longer
- * hold privileges on — every request denied.
+ * hold privileges on: every request denied.
  *
  * The one case this cannot call is a self-managed Postgres where the operator compiled and installed
  * the extension themselves and points at it with `database.external`. They set `schema.api_schemas`
@@ -25,7 +25,7 @@
 
 import { existsSync } from "node:fs"
 // Statically imported: these packages are ESM, where `require` does not exist. The first attempt used
-// it for a lazy import and every command that generates compose would have thrown at runtime — caught
+// it for a lazy import and every command that generates compose would have thrown at runtime, caught
 // by the tests that run the built binary rather than the source.
 import { loadSchemaAst } from "./config.js"
 export { nativeMaskLibraryPresent } from "./postgres-ctl.js"
@@ -77,7 +77,7 @@ export function schemaHasFieldRules(ast: unknown): boolean {
 export function fieldMaskingTier(
   config: SupatypeProjectConfig,
   ast: unknown,
-  /** Set on the native path once the Postgres install is known — see [`nativeMaskLibraryPresent`]. */
+  /** Set on the native path once the Postgres install is known, see [`nativeMaskLibraryPresent`]. */
   maskLibraryPresent?: boolean,
 ): FieldMaskingTier {
   if (!schemaHasFieldRules(ast)) return "none"
@@ -88,7 +88,7 @@ export function fieldMaskingTier(
 /**
  * The tier for a project on disk, loading its schema to see whether any column is masked.
  *
- * A schema that fails to load falls back to `"none"` — the default exposed-schema list. Deciding the
+ * A schema that fails to load falls back to `"none"`, the default exposed-schema list. Deciding the
  * tier is the wrong moment to report a syntax error, and `push`/`dev` do it properly moments later
  * with the file and line.
  */

package/src/functions-deno-types.ts

@@ -23,7 +23,7 @@ export function functionsDenoAmbientSource(): string {
   return `/**
  * ${MARKER}.
  * Runtime is Deno; this file covers APIs edge functions commonly use.
- * Do not add \`@types/deno\` to the app package.json — it leaks into the
+ * Do not add \`@types/deno\` to the app package.json, it leaks into the
  * whole project when root tsconfig has no \`"types"\` field.
  *
  * Optional: for the full Deno API, install the Deno VS Code/Cursor extension
@@ -75,7 +75,7 @@ declare namespace Deno {
 `
 }
 
-/** `functions/tsconfig.json` — owns function files so the app config can exclude them. */
+/** `functions/tsconfig.json`: owns function files so the app config can exclude them. */
 export function functionsTsConfigSource(): string {
   return `{
   "compilerOptions": {
@@ -166,7 +166,7 @@ function ensureRootTsconfigExcludesFunctions(
     writeFileSync(path, `${JSON.stringify(asJson, null, 2)}\n`, "utf8")
     return "updated"
   } catch {
-    // JSONC / trailing commas — try a conservative string splice into an existing exclude array.
+    // JSONC / trailing commas, try a conservative string splice into an existing exclude array.
     if (/"exclude"\s*:\s*\[/.test(raw)) {
       const next = raw.replace(/("exclude"\s*:\s*\[)/, `$1\n    "functions",`)
       if (next !== raw) {

package/src/functions-router-gen.ts

@@ -58,7 +58,7 @@ export function generateFunctionsRouterSource(
   )
   const routes = fns.map((fn, i) => `  "${fn.name}": handler_${i},`)
 
-  return `// Auto-generated — do not edit (regenerated by supatype dev / functions serve)
+  return `// Auto-generated: do not edit (regenerated by supatype dev / functions serve)
 ${imports.join("\n")}
 
 const handlers: Record<string, (req: Request) => Response | Promise<Response>> = {

package/src/gitignore.ts

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs"
 import { resolve } from "node:path"
 
-export const SUPATYPE_GITIGNORE_MARKER = "# Supatype — local runtime (contains secrets in link.json)"
+export const SUPATYPE_GITIGNORE_MARKER = "# Supatype, local runtime (contains secrets in link.json)"
 export const SUPATYPE_GITIGNORE_BLOCK = `${SUPATYPE_GITIGNORE_MARKER}
 .env
 .supatype/
@@ -34,7 +34,7 @@ export function ensureSupatypeGitignore(cwd: string, opts?: { silent?: boolean }
   }
 
   if (!opts?.silent) {
-    console.warn("Added .supatype/ to .gitignore (link.json contains secrets — never commit).")
+    console.warn("Added .supatype/ to .gitignore (link.json contains secrets, never commit).")
   }
   return true
 }
@@ -42,7 +42,7 @@ export function ensureSupatypeGitignore(cwd: string, opts?: { silent?: boolean }
 export function warnIfLinkNotGitignored(cwd: string): void {
   if (isSupatypeGitignored(cwd)) return
   console.warn(
-    "\n⚠  Warning: .supatype/ is not in .gitignore — link.json contains tokens and must not be committed.",
+    "\n⚠  Warning: .supatype/ is not in .gitignore, link.json contains tokens and must not be committed.",
   )
   console.warn("   Run with link --fix-gitignore to append the Supatype block.\n")
 }

package/src/hook-upload.ts

@@ -2,7 +2,7 @@
  * Package a project's hooks for a managed stack.
  *
  * Self-hosted stacks need none of this: the worker mounts the project directory, so `hooks/` is already
- * where it looks. A managed project has no directory — its worker reads a ConfigMap, whose keys may only
+ * where it looks. A managed project has no directory, its worker reads a ConfigMap, whose keys may only
  * contain alphanumerics, `-`, `_` and `.`. So the tree is flattened here, where it can be checked and
  * explained, rather than in the deploy route where a dropped file would be silent.
  */
@@ -28,7 +28,7 @@ export interface HookUpload {
  * Rewrite the one import a hook handler is generated to make.
  *
  * `../_supatype/hooks.ts` is a path that cannot survive flattening, and it is the specifier our own
- * scaffold writes — so it is rewritten rather than refused. Any *other* relative import is refused
+ * scaffold writes: so it is rewritten rather than refused. Any *other* relative import is refused
  * below: it would resolve to nothing on the worker, and a hook that fails to import is a hooked table
  * whose writes all start failing.
  */
@@ -55,7 +55,7 @@ function unsupportedImports(source: string): string[] {
  * holding the service-role key with nothing able to call it. Uploading it buys nothing and widens what
  * runs with that credential.
  *
- * Throws with a message meant for a terminal when a handler cannot be flattened faithfully — the
+ * Throws with a message meant for a terminal when a handler cannot be flattened faithfully, the
  * alternative is a deploy that succeeds and a hook that fails to import, which reads to the caller as
  * the table's writes being broken for no visible reason.
  */

package/src/hooks-generator.ts

@@ -1,5 +1,5 @@
 /**
- * Generate `functions/_supatype/hooks.ts` — the typed handler surface for model hooks.
+ * Generate `functions/_supatype/hooks.ts`: the typed handler surface for model hooks.
  *
  * Generated into the project rather than shipped as a package, for two reasons: a Deno function
  * resolves a relative `.ts` import with no npm involved, and the types then move in lockstep with the
@@ -40,7 +40,7 @@ function hookedModels(ast: unknown): HookedModel[] {
  * The module source, or `null` when no model declares a hook.
  *
  * Returning null rather than an empty module keeps a `_supatype/hooks.ts` from appearing in projects
- * that have no hooks — a generated file nobody imports is a file somebody eventually edits.
+ * that have no hooks, a generated file nobody imports is a file somebody eventually edits.
  */
 export function generateHooksModule(ast: unknown): string | null {
   const models = hookedModels(ast)
@@ -56,7 +56,7 @@ export function generateHooksModule(ast: unknown): string | null {
     )
     .join("\n")
 
-  return `// Generated by supatype CLI — do not edit manually.
+  return `// Generated by supatype CLI, do not edit manually.
 //
 // Typed handlers for the models that declare \`hooks\`. Import from a function beside it:
 //
@@ -103,7 +103,7 @@ interface HookBase {
 /**
  * The rows this request is about to overwrite, fetched only if you ask.
  *
- * Resolved by the server from the in-flight request's own filter, as the caller's own role — so it
+ * Resolved by the server from the in-flight request's own filter, as the caller's own role, so it
  * cannot show you rows the caller could not read, and you cannot widen the filter. Capped:
  * \`truncated\` is true when there were more, in which case acting on what you got means acting on a
  * prefix you did not choose.
@@ -131,7 +131,7 @@ export type BeforeDeleteContext<T extends HookedTable> = HookBase & {
 
 export type AfterChangeContext<T extends HookedTable> = HookBase & {
   readonly operation: "insert" | "update"
-  /** Written rows — present only when the caller sent \`Prefer: return=representation\`. */
+  /** Written rows: present only when the caller sent \`Prefer: return=representation\`. */
   readonly rows?: HookTables[T]["Row"][]
 }
 
@@ -201,7 +201,7 @@ interface WireContext {
  *
  * The outcome travels as the **HTTP status**: 200 for proceed, 4xx for a rejection. That keeps the
  * contract in the transport rather than in a second envelope inside the body, so a hook written by
- * hand — or in another language — needs to know nothing about this file.
+ * hand: or in another language, needs to know nothing about this file.
  */
 export function hook(handler: AnyHandler): (req: Request) => Promise<Response> {
   return async (req: Request): Promise<Response> => {
@@ -263,7 +263,7 @@ export function hook(handler: AnyHandler): (req: Request) => Promise<Response> {
  *
  * The worker takes **one default export per function directory**, so \`hook(single)\` is one hook per
  * directory. That is fine for a single moderation rule and tedious for a model whose whole lifecycle
- * you want in one place — hence this. Point every event at the same function name in the schema:
+ * you want in one place, hence this. Point every event at the same function name in the schema:
  *
  *   hooks: { beforeChange: "post-hooks", afterChange: "post-hooks" }
  *
@@ -284,7 +284,7 @@ export function hooks(handlers: Record<string, AnyHandler | undefined>): (req: R
  * The stack's address from this worker's point of view.
  *
  * \`SUPATYPE_INTERNAL_URL\` in Compose is the in-network gateway; \`SUPATYPE_URL\` is the same value
- * there. Never a public or host URL — \`localhost\` inside this container is this container.
+ * there. Never a public or host URL, \`localhost\` inside this container is this container.
  */
 function stackBaseUrl(): string {
   const base =
@@ -330,7 +330,7 @@ function json(body: unknown, status: number): Response {
  * Replace cross-package type imports the client types use but a hook cannot resolve.
  *
  * `RichText` normally generates `import("@supatype/types/lexical").SerializedEditorState`. That works
- * in an app, where the package is installed — but this file lives in `functions/`, is imported by a
+ * in an app, where the package is installed, but this file lives in `functions/`, is imported by a
  * Deno handler, and has no node_modules to reach into. Left alone, any hooked model with a rich-text
  * column emitted a module that failed to compile in the user's editor. Caught by compiling the
  * generated file in a test rather than by a reader reporting it.

package/src/index.ts

@@ -1,5 +1,5 @@
 /**
- * @supatype/cli — programmatic API for invoking the engine.
+ * @supatype/cli: programmatic API for invoking the engine.
  *
  * For CLI usage: use the `supatype` binary.
  */

package/src/init-project-detect.ts

@@ -62,7 +62,7 @@ function detectStaticDir(cwd: string): string {
   return "./public"
 }
 
-/** Inspect `cwd` before init prompts — Vite, static dir, existing Supatype config. */
+/** Inspect `cwd` before init prompts, Vite, static dir, existing Supatype config. */
 export function detectProjectSetup(cwd: string): DetectedProjectSetup {
   let entries: string[] = []
   try {

package/src/link.ts

@@ -23,7 +23,7 @@ export interface ProjectLink {
   defaultEnvironment: string
   /** Access token (cloud user JWT) or self-host SERVICE_ROLE_KEY. */
   token?: string
-  /** Cloud GoTrue refresh token — used to renew short-lived access JWTs. */
+  /** Cloud GoTrue refresh token, used to renew short-lived access JWTs. */
   refreshToken?: string
   orgId?: string | undefined
   cloudApiUrl?: string

package/src/local-secrets.ts

@@ -2,7 +2,7 @@
  * The secrets the local stack runs with.
  *
  * **Read from `.env`, never pinned back into it.** These used to be hardcoded constants that
- * `supatype dev` wrote to `.env` on every run — which meant a project could not hold its own
+ * `supatype dev` wrote to `.env` on every run, which meant a project could not hold its own
  * secrets: whatever `supatype init` or the developer put there was replaced by the published
  * defaults on the next `dev`, and the same `.env` then went to a server. Resolving instead of
  * pinning is what lets a generated secret survive to production.
@@ -16,7 +16,7 @@ import { hasEnvValue, readEnvValue } from "./env-file.js"
 /**
  * Fallback JWT signing secret for a project that has none.
  *
- * Published, therefore worthless as a secret — anyone can mint a token for a stack still using
+ * Published, therefore worthless as a secret, anyone can mint a token for a stack still using
  * it. That is precisely why `init` generates one instead of relying on this.
  */
 export const FALLBACK_JWT_SECRET = "super-secret-jwt-token-with-at-least-32-characters-long"
@@ -52,7 +52,7 @@ export function devAuthenticatorPassword(cwd: string): string {
  *
  * The compose template requires these with `${VAR:?}` rather than defaulting them, because a
  * default is how a published constant ends up signing a real deployment's tokens. That only
- * works if something guarantees presence — this does, for any project that predates
+ * works if something guarantees presence, this does, for any project that predates
  * `supatype init` writing them.
  *
  * **Fills with the fallback, does not generate.** Preserving the value such a project has been
@@ -72,11 +72,11 @@ export function seedMissingLocalSecrets(cwd: string): Record<string, string> {
 }
 
 /**
- * The database identity the local stack connects with — seeded, never overwritten.
+ * The database identity the local stack connects with, seeded, never overwritten.
  *
  * `POSTGRES_DB` in particular is *project configuration*: `supatype init` sets it to the
  * project name, and the running container's database was created from it. Rewriting it to a
- * default afterwards points every tool at a database that does not exist — observed as
+ * default afterwards points every tool at a database that does not exist, observed as
  * `supatype push` failing with `FATAL: database "supatype" does not exist` on a project called
  * something else, because the push path rewrote `.env` after `self-host compose up` had already
  * created the database under its real name.

package/src/main.ts

@@ -0,0 +1,20 @@
+/**
+ * Entry point for the standalone binary.
+ *
+ * `bin/supatype.js` stays the npm entry: it loads the CLI with a dynamic import, which Bun
+ * cannot follow when compiling. Given `import("../dist/cli.js")` it emits a binary that
+ * bundles one module and then fails at runtime with
+ * `Cannot find module '../dist/cli.js' from '/$bunfs/root/supatype'`. The import below is
+ * static, so the whole graph is embedded.
+ */
+import { run } from "./cli.js"
+import { reportCliFatal } from "./ui/fatal.js"
+
+// reportCliFatal rather than console.error: it is what run() already uses for a failed
+// command, and it prints a stack under SUPATYPE_DEBUG=1. Open-coding the message here would
+// make a crash report from a curl | bash user less useful than one from an npm user. This
+// only fires for a throw during command registration, since run() catches everything after.
+run().catch((err: unknown) => {
+  reportCliFatal(err)
+  process.exit(1)
+})

package/src/model-hooks.ts

@@ -2,7 +2,7 @@
  * Validate the lifecycle hooks a schema declares against the functions that exist.
  *
  * A hook names a function directory. If the name is wrong, the honest failure is at push time with
- * the path we searched — not at runtime, where the symptom is a hook that never fires and a write
+ * the path we searched, not at runtime, where the symptom is a hook that never fires and a write
  * that quietly succeeds unvalidated. That silence is the whole reason this check exists.
  *
  * Kept out of the extractor on purpose: resolving the functions directory needs the project config,
@@ -119,7 +119,7 @@ export interface ManifestHookEntry {
 }
 
 /**
- * The hook map for `.supatype/manifest.json`, keyed by **table name** — because that is what the
+ * The hook map for `.supatype/manifest.json`, keyed by **table name**, because that is what the
  * server matches a request path against, not the model name.
  *
  * Defaults are resolved here rather than in the server: one place decides that a `before*` hook
@@ -172,7 +172,7 @@ export const DEFAULT_HOOK_TIMEOUT_MS = 2000
  *
  * **Only updates a manifest that is already there.** Creating one from scratch here would be a
  * hazard: `functions_enabled` is a plain bool on the server's side, so a manifest carrying only
- * hooks would read as functions *disabled* — the exact defect this repo fixed a commit ago, arriving
+ * hooks would read as functions *disabled*, the exact defect this repo fixed a commit ago, arriving
  * by a different door. The compose path owns creation; this owns one key.
  *
  * Returns true when the file was rewritten.
@@ -216,7 +216,7 @@ export interface HooksReport {
 /**
  * What `supatype doctor` needs to answer "will my hooks actually run?".
  *
- * Local facts only — the schema, the functions on disk, and the manifest the server reads. No probe
+ * Local facts only: the schema, the functions on disk, and the manifest the server reads. No probe
  * of a running worker, so the answer is the same whether or not the stack is up, and a report that
  * needs a stack is a report nobody runs before deploying.
  *

package/src/pgbouncer-userlist.ts

@@ -1,13 +1,13 @@
 import { createHash } from "node:crypto"
 
-/** PgBouncer md5 auth: "md5" + md5(password + username) — same as supatype-cloud / self-host. */
+/** PgBouncer md5 auth: "md5" + md5(password + username), same as supatype-cloud / self-host. */
 export function pgbouncerMd5Hash(password: string, username: string): string {
   return "md5" + createHash("md5").update(password + username).digest("hex")
 }
 
 /** Two roles used by local compose: superuser pools (GoTrue, engine) and PostgREST. */
 export function pgbouncerUserlistContent(pgPassword: string): string {
-  return `# PgBouncer md5 userlist — matches supatype-cloud transaction pool (auth_type = md5).
+  return `# PgBouncer md5 userlist, matches supatype-cloud transaction pool (auth_type = md5).
 # Regenerated by supatype dev --local / init from POSTGRES_PASSWORD.
 "supatype_admin" "${pgbouncerMd5Hash(pgPassword, "supatype_admin")}"
 "authenticator" "${pgbouncerMd5Hash(pgPassword, "authenticator")}"

package/src/postgres-ctl.ts

@@ -1,5 +1,5 @@
 /**
- * postgres-ctl — wrappers around pg_ctl, initdb, and pg_isready for managing
+ * postgres-ctl: wrappers around pg_ctl, initdb, and pg_isready for managing
  * a native Postgres installation.
  */
 
@@ -95,7 +95,7 @@ export function start(opts: PgOptions): void {
   const bin = pgBin(opts.pgBinDir, "pg_ctl")
   const logPath = opts.logPath ?? join(opts.dataDir, "postgres.log")
 
-  // `supatype_mask` is a planner hook, so it has to be preloaded — `CREATE EXTENSION` alone does
+  // `supatype_mask` is a planner hook, so it has to be preloaded, `CREATE EXTENSION` alone does
   // nothing without it. Only when the archive actually carries the library: an install downloaded
   // before it was bundled would fail to start with "could not access file".
   //
@@ -131,7 +131,7 @@ export function stop(opts: PgOptions): void {
     encoding: "utf8",
     env: pgSpawnEnv(opts.pgBinDir),
   })
-  // Ignore exit code — Postgres may already be stopped.
+  // Ignore exit code: Postgres may already be stopped.
   void result
 }
 
@@ -175,7 +175,7 @@ export async function isPortInUse(port: number): Promise<boolean> {
   return new Promise((resolve) => {
     const server = createServer()
     server.once("error", (err: NodeJS.ErrnoException) => {
-      // EADDRINUSE — something is listening. EACCES — Windows excluded/reserved port range.
+      // EADDRINUSE: something is listening. EACCES, Windows excluded/reserved port range.
       resolve(err.code === "EADDRINUSE" || err.code === "EACCES")
     })
     server.once("listening", () => {

package/src/process-manager.ts

@@ -1,5 +1,5 @@
 /**
- * ProcessManager — spawn a child process, write its PID, stream logs with a
+ * ProcessManager: spawn a child process, write its PID, stream logs with a
  * colored prefix, and restart on crash with exponential backoff.
  */
 
@@ -73,7 +73,7 @@ export class ProcessManager {
     this.backoffMs = this.opts.initialBackoffMs
   }
 
-  /** Start the process. Returns immediately — the process runs in the background. */
+  /** Start the process. Returns immediately, the process runs in the background. */
   start(): void {
     this.stopped = false
     this.spawn()
@@ -201,7 +201,7 @@ export class ProcessManager {
       mkdirSync(this.opts.pidDir, { recursive: true })
       writeFileSync(join(this.opts.pidDir, `${this.opts.label}.pid`), String(pid))
     } catch {
-      // Non-fatal — PID tracking is best-effort.
+      // Non-fatal: PID tracking is best-effort.
     }
   }
 
@@ -209,7 +209,7 @@ export class ProcessManager {
     try {
       await unlink(join(this.opts.pidDir, `${this.opts.label}.pid`))
     } catch {
-      // Ignore — file may already be gone.
+      // Ignore: file may already be gone.
     }
   }
 }

package/src/project-config.ts

@@ -21,7 +21,7 @@ export interface SupatypeProjectConfig {
     root?: string
   }
   project: {
-    /** Project name — used for per-project state dirs and logging. */
+    /** Project name: used for per-project state dirs and logging. */
     name: string
     /** Cloud project reference (set by `supatype link`). */
     ref?: string
@@ -32,7 +32,7 @@ export interface SupatypeProjectConfig {
      * "native" = supatype manages a native Postgres binary (downloaded from CDN).
      * "docker" = supatype runs supatype/postgres via Docker (includes all extensions).
      *
-     * Omitted when `external` is set — there is no backend for Supatype to choose.
+     * Omitted when `external` is set, there is no backend for Supatype to choose.
      */
     provider?: "native" | "docker"
     /**
@@ -50,7 +50,7 @@ export interface SupatypeProjectConfig {
        * Postgres URL for every service in the stack.
        *
        * The role in it owns the schema and runs migrations. PostgREST connects as `authenticator`
-       * separately — see `supatype db check`, which reports what this database is missing.
+       * separately: see `supatype db check`, which reports what this database is missing.
        */
       url: string
       /**
@@ -215,12 +215,12 @@ export interface SupatypeProjectConfig {
     /**
      * Schemas the REST API exposes, in order (`PGRST_DB_SCHEMA`).
      *
-     * Defaults to `pg_schema` plus the ones the stack needs for itself — `supatype` for Studio's
-     * views, `graphql_public`, `auth` — so setting `pg_schema` alone does the sensible thing.
+     * Defaults to `pg_schema` plus the ones the stack needs for itself, `supatype` for Studio's
+     * views, `graphql_public`, `auth`: so setting `pg_schema` alone does the sensible thing.
      *
      * It used to be a hardcoded literal, which meant choosing a non-`public` `pg_schema` gave you
      * a correct push and an API that answered `PGRST106` for everything: the engine had moved and
-     * PostgREST had not been told. State this explicitly when you need a different set — an extra
+     * PostgREST had not been told. State this explicitly when you need a different set, an extra
      * schema of your own, or to stop exposing one.
      */
     api_schemas?: readonly string[]
@@ -238,7 +238,7 @@ export interface SupatypeProjectConfig {
      *
      * **Model hooks are not listed here and do not need to be.** A hook is procedural: only the API
      * server calls it, around a write the caller was already permitted to make, and the gateway
-     * refuses its route from outside — so there is no attacker to withhold it from, and the trust is
+     * refuses its route from outside, so there is no attacker to withhold it from, and the trust is
      * the same a trigger already has.
      */
     serviceRole?: readonly string[]
@@ -430,7 +430,7 @@ function validateExternalDatabase(cfg: Record<string, unknown>, filename: string
   const url = (external as Record<string, unknown>)["url"]
   if (typeof url !== "string" || url.trim().length === 0) {
     throw new Error(
-      `${filename}: database.external.url is required — the Postgres URL every service connects to.\n` +
+      `${filename}: database.external.url is required, the Postgres URL every service connects to.\n` +
         "Reading it from the environment keeps the password out of version control:\n" +
         "  database: { external: { url: process.env.DATABASE_URL! } }\n" +
         "The project's .env is loaded before the config module, so DATABASE_URL there is enough.",
@@ -450,7 +450,7 @@ function validateExternalDatabase(cfg: Record<string, unknown>, filename: string
   if (database["provider"] !== undefined) {
     throw new Error(
       `${filename}: database.provider ("${String(database["provider"])}") and database.external ` +
-        "cannot both be set — provider chooses a Postgres for Supatype to run, external says one " +
+        "cannot both be set, provider chooses a Postgres for Supatype to run, external says one " +
         "already exists.\n" +
         "Remove database.provider. The runtime stack is still chosen by the top-level `provider`.",
     )
@@ -459,7 +459,7 @@ function validateExternalDatabase(cfg: Record<string, unknown>, filename: string
   const server = cfg["server"] as Record<string, unknown> | undefined
   if (server?.["mode"] === "managed") {
     throw new Error(
-      `${filename}: database.external is not supported with server.mode "managed" — on the cloud ` +
+      `${filename}: database.external is not supported with server.mode "managed", on the cloud ` +
         "path the database is part of what is being provided.\n" +
         "Use an external database with a self-hosted stack (server.mode \"dev\" or \"standalone\").",
     )
@@ -469,7 +469,7 @@ function validateExternalDatabase(cfg: Record<string, unknown>, filename: string
   if (typeof connection === "string" && connection.trim() !== url.trim()) {
     throw new Error(
       `${filename}: connection and database.external.url are both set and disagree.\n` +
-        "database.external.url is what the whole stack uses, CLI commands included — remove " +
+        "database.external.url is what the whole stack uses, CLI commands included, remove " +
         "`connection`.",
     )
   }
@@ -496,11 +496,11 @@ export function functionsPathCandidatesFromProject(cfg: SupatypeProjectConfig, c
 }
 
 /**
- * Directory holding **model hooks** — procedural handlers the API calls around a write.
+ * Directory holding **model hooks**, procedural handlers the API calls around a write.
  *
  * Separate from `functions/` because the two have different trust models: a function is a public
  * endpoint anyone with the anon key may invoke, while a hook is only ever called by the server. One
- * worker serves both, and the gateway refuses the hook namespace from outside — so keeping them in
+ * worker serves both, and the gateway refuses the hook namespace from outside, so keeping them in
  * separate directories is what makes that boundary structural rather than a list to maintain.
  */
 export function hooksPathFromProject(cfg: SupatypeProjectConfig, cwd: string): string {
@@ -565,7 +565,7 @@ export function resolveRuntimeProvider(cfg: SupatypeProjectConfig): "native" | "
  *
  * Resolved here rather than in the compose template so there is one definition of the format.
  *
- * This does **not** check that the names exist — it cannot, since it has only the config. An earlier
+ * This does **not** check that the names exist, it cannot, since it has only the config. An earlier
  * version of this comment claimed a typo was "visible in one place rather than silently granting
  * nothing", which was false: nothing read the list except the two callers that turn it into an env var.
  * `checkServiceRoleRoutes` in `service-role-check.ts` is what actually resolves the names, and `push`
@@ -614,7 +614,7 @@ export function externalDatabaseUrl(cfg: SupatypeProjectConfig): string | undefi
  * Whether realtime should run.
  *
  * `false` only when stated. An external database that cannot support logical replication is detected
- * rather than declared — the capability record is what Studio and `doctor` read, so an operator who
+ * rather than declared: the capability record is what Studio and `doctor` read, so an operator who
  * has not thought about it gets a truthful answer instead of a silent default.
  */
 export function realtimeEnabled(cfg: SupatypeProjectConfig): boolean {
@@ -643,7 +643,7 @@ export const STACK_API_SCHEMAS = ["supatype", "graphql_public", "auth"] as const
  * while PostgREST kept serving `public`, so every request answered `PGRST106` and nothing in the
  * output mentioned the setting that caused it.
  *
- * `api_schemas` replaces the whole list when stated — including the stack schemas, so dropping
+ * `api_schemas` replaces the whole list when stated, including the stack schemas, so dropping
  * `supatype` from it is a supported way to stop exposing Studio's views. Order is preserved and
  * duplicates removed: PostgREST serves the first entry as the default profile, so the managed
  * schema has to lead.