@supatype/cli 0.1.7 → 0.1.9

package/src/type-extractor.ts

@@ -313,7 +313,7 @@ function mergeIntersectionParts(
         continue
       }
     }
-    // Unresolvable parts are skipped — the model still extracts with whatever fields were found
+    // Unresolvable parts are skipped, the model still extracts with whatever fields were found
   }
   if (allMembers.length === 0) return null
   return ts.factory.createTypeLiteralNode(allMembers)
@@ -910,7 +910,7 @@ function parseScalarType(
         return scalar("money")
       case "Decimal": {
         // `Decimal<10, 2>` names a precision and a scale, and the engine renders `NUMERIC(p, s)`
-        // from them — but nothing used to read the type arguments, so every Decimal became an
+        // from them: but nothing used to read the type arguments, so every Decimal became an
         // unbounded NUMERIC. Silently, which is the worst way to lose a constraint on a money column.
         const precision = parseNumericTypeArg(typeNode.typeArguments?.[0], sourceFile)
         const scale = parseNumericTypeArg(typeNode.typeArguments?.[1], sourceFile)
@@ -1453,7 +1453,7 @@ function looksLikeComputedTemplateLiteral(lit: string): boolean {
   return /\{truncate\s*\(/i.test(lit) || /\{[a-zA-Z_]\w*\}/g.test(lit)
 }
 
-/** Resolves second type arg of `ComputedFrom<Value, Sources>` — tuple concat, single field, or template literal. */
+/** Resolves second type arg of `ComputedFrom<Value, Sources>`, tuple concat, single field, or template literal. */
 function parseComputedFromSecondArg(
   sourcesArg: ts.TypeNode | undefined,
   sourceFile: ts.SourceFile,
@@ -1789,12 +1789,12 @@ function resolveIndexFieldName(fieldName: string, fields: Record<string, FieldAs
  * Resolve an `access:` annotation to its rule object.
  *
  * `access` may be written inline (`access: { read: Public }`) or factored into a
- * shared type alias (`access: CmsPublicReadAdminWrite`) — the latter is the
+ * shared type alias (`access: CmsPublicReadAdminWrite`), the latter is the
  * natural way to reuse one policy set across many models, so it has to resolve
  * through aliases and intersections, not just literals.
  *
  * Anything unresolvable throws. Returning `{}` here means "no access rules",
- * which the differ treats as "emit no RLS policies" — so a typo or an
+ * which the differ treats as "emit no RLS policies", so a typo or an
  * unsupported shape silently published a table with no row-level protection at
  * all. Failing the extract is the only safe outcome.
  */
@@ -1820,7 +1820,7 @@ function parseModelAccess(
         `\`${accessProp.type.getText(sourceFile)}\`.\n` +
         `  access must be an object type, or a type alias for one:\n` +
         `    export type PublicReadAdminWrite = { read: Public; create: Role<"admin"> }\n` +
-        `  A \`const … as const\` value cannot be used here — access is read from types, and\n` +
+        `  A \`const … as const\` value cannot be used here, access is read from types, and\n` +
         `  rule names like Public / Role are types, not values.\n` +
         `  Refusing to continue: an unresolved access block would publish this table with no RLS.`,
     )
@@ -1864,11 +1864,11 @@ function parseModelAccess(
 }
 
 /**
- * `fields: { [column]: { read?, write? } }` — per-column narrowing of the table rules.
+ * `fields: { [column]: { read?, write? } }`, per-column narrowing of the table rules.
  *
  * Any rule the DSL can express is allowed. Enforcement is a query rewrite that
  * evaluates the rule per row with the caller's claims, so ownership, membership and
- * application roles all work here — none of which a column privilege could express.
+ * application roles all work here, none of which a column privilege could express.
  */
 function parseFieldAccess(
   typeNode: ts.TypeNode,
@@ -1944,7 +1944,7 @@ function parseFieldAccess(
  *
  * An update policy has two halves: `USING` picks which existing rows may be
  * modified, `WITH CHECK` constrains what they may become. One rule for both is the
- * right default and what every existing schema means — but it makes "an editor may
+ * right default and what every existing schema means, but it makes "an editor may
  * move a post between their own sites" inexpressible, because the row they are
  * changing and the row they are changing it into are judged by the same predicate.
  */
@@ -1974,11 +1974,11 @@ function parseUpdateSplit(
     }
   }
 
-  // Not the split form at all — an object with neither key is some other shape.
+  // Not the split form at all, an object with neither key is some other shape.
   if (!using && !check) return null
   if (!using) {
     throw new Error(
-      "`update: { check }` needs a `using` rule too — without it no row is " +
+      "`update: { check }` needs a `using` rule too, without it no row is " +
         "selectable for update, so the check can never apply.",
     )
   }
@@ -2028,7 +2028,7 @@ function resolveAccessLiteral(
 /**
  * `access` rules may be declared in a different file from the model (a shared
  * alias), and `getText(file)` reads the given file's text at the node's offsets
- * — so passing the model's file for a node owned by another one yielded garbage
+ *- so passing the model's file for a node owned by another one yielded garbage
  * and every rule silently fell through to `private`. Always read a node's text
  * from the file that actually owns it.
  */
@@ -2056,7 +2056,7 @@ function parseAccessRule(
   if (!ts.isTypeReferenceNode(typeNode)) return { type: "private" }
 
   // `Rules.read` is a qualified name (namespace lookup), not a member of a type
-  // alias — TypeScript rejects it, and it used to fall through to `private`,
+  // alias: TypeScript rejects it, and it used to fall through to `private`,
   // silently denying an operation the author meant to grant.
   if (ts.isQualifiedName(typeNode.typeName)) {
     const text = ownerText(typeNode.typeName, sourceFile)
@@ -2113,7 +2113,7 @@ function parseAccessRule(
         )
       }
       // An empty list would compile to a policy that grants nothing while
-      // reading like a grant — the exact silent-denial failure the unknown-rule
+      // reading like a grant, the exact silent-denial failure the unknown-rule
       // branch below exists to prevent.
       if (listArg.elements.length === 0) {
         throw new Error(
@@ -2135,7 +2135,7 @@ function parseAccessRule(
           '`All<>` takes a tuple of rules, as in `All<[Role<"editor">, NotNull<"published_at">]>`.',
         )
       }
-      // Unlike `Any<[]>`, an empty `All` grants *everything* — an empty AND is
+      // Unlike `Any<[]>`, an empty `All` grants *everything*, an empty AND is
       // true. Reading as a restriction while imposing none is worse than an error.
       if (listArg.elements.length === 0) {
         throw new Error(
@@ -2209,7 +2209,7 @@ function parseAccessRule(
       const column = parseAccessOperand(args[0]!, sourceFile)
       if (column["kind"] !== "column") {
         throw new Error(
-          "`In<>`'s first argument must be a column name — the membership test is " +
+          "`In<>`'s first argument must be a column name, the membership test is " +
             "about a column of the row being checked.",
         )
       }
@@ -2220,7 +2220,7 @@ function parseAccessRule(
       }
     }
     default: {
-      // A named alias — possibly parameterised — standing for a rule. Expanded
+      // A named alias: possibly parameterised, standing for a rule. Expanded
       // before giving up, so `SiteAccess<"site_id">` works.
       if (resolveCtx && depth < 16) {
         const expanded = resolveAccessAliasNode(typeNode, sourceFile, resolveCtx)
@@ -2228,7 +2228,7 @@ function parseAccessRule(
       }
 
       // Falling back to `private` here would silently deny an operation the
-      // author believed they had granted — and with deny-by-default there is no
+      // author believed they had granted, and with deny-by-default there is no
       // longer any need for a permissive guess. Name the offending rule instead.
       throw new Error(
         `Unknown access rule "${ref}". Supported: Public, Private, LoggedIn, ` +
@@ -2244,7 +2244,7 @@ function parseAccessRule(
 /**
  * Expands a named alias to the type it stands for.
  *
- * This is what makes rules parameterisable — the type-level equivalent of
+ * This is what makes rules parameterisable, the type-level equivalent of
  * Payload's access-control factory:
  *
  * ```typescript
@@ -2252,8 +2252,8 @@ function parseAccessRule(
  * access: { update: SiteAccess<"site_id"> }
  * ```
  *
- * Without it a rule had to be written inline at every use, and any alias — even an
- * unparameterised one — was reported as an unknown rule.
+ * Without it a rule had to be written inline at every use, and any alias, even an
+ * unparameterised one: was reported as an unknown rule.
  */
 function resolveAccessAliasNode(
   typeNode: ts.TypeReferenceNode,
@@ -2274,7 +2274,7 @@ function resolveAccessAliasNode(
  * The set on the right of an `In<>`.
  *
  * Resolved through the same alias machinery as rules, so a shared
- * `type MySites = Rows<…>` can be reused across models — the parameterisation the
+ * `type MySites = Rows<…>` can be reused across models, the parameterisation the
  * plan calls the type-level equivalent of Payload's access factory.
  */
 function parseMembershipSource(
@@ -2300,7 +2300,7 @@ function parseMembershipSource(
       const column = stringLiteralArg(args[1], "Rows", "column name")
       const source: Record<string, unknown> = { kind: "rows", table, column }
       // The third argument narrows the source rows. Absent means "every row",
-      // which is a lookup rather than a membership check — allowed, but rarely
+      // which is a lookup rather than a membership check, allowed, but rarely
       // what was meant, so it stays explicit rather than being defaulted.
       if (args[2]) {
         source["where"] = parseAccessRule(args[2], sourceFile, resolveCtx)
@@ -2318,7 +2318,7 @@ function parseMembershipSource(
       }
       // Not `parseAccessOperand`: there, a bare string is a *column*, which is
       // right for a comparison and wrong here. Inside a value list a string can
-      // only be a value, so it is read as one — no `Literal<>` wrapper needed.
+      // only be a value, so it is read as one, no `Literal<>` wrapper needed.
       return {
         kind: "literal",
         values: listArg.elements.map((element) => literalFromNode(element, sourceFile)),
@@ -2373,7 +2373,7 @@ function parseDurationOperand(
   const opposite = ref === "Ago" ? "FromNow" : "Ago"
 
   // A negative literal is a prefix-unary expression in the TypeScript AST, not a
-  // numeric literal, so it has to be recognised separately — otherwise `Ago<-5, …>`
+  // numeric literal, so it has to be recognised separately, otherwise `Ago<-5, …>`
   // is refused for the wrong reason and the message misses the real advice.
   if (
     ts.isLiteralTypeNode(amountNode) &&
@@ -2392,7 +2392,7 @@ function parseDurationOperand(
   const amount = Number(amountNode.literal.text)
   if (!Number.isInteger(amount)) {
     throw new Error(
-      `\`${ref}<${amount}, …>\` must be a whole number of units — Postgres intervals ` +
+      `\`${ref}<${amount}, …>\` must be a whole number of units, Postgres intervals ` +
         `take integers, so a fraction would be silently truncated or rejected.`,
     )
   }
@@ -2512,7 +2512,7 @@ function parseAccessOperand(
         // segment would silently look up a key that cannot exist.
         if (path === "" || path.split(".").some((segment) => segment.trim() === "")) {
           throw new Error(
-            `\`Claim<"${path}">\` is not a valid claim path — use dotted segments, ` +
+            `\`Claim<"${path}">\` is not a valid claim path, use dotted segments, ` +
               `as in \`Claim<"app_metadata.tier">\`.`,
           )
         }

package/src/type-resolver.ts

@@ -295,7 +295,7 @@ function parseResolvedTypeText(typeText: string): ts.TypeNode {
   return decl.type
 }
 
-/** `T extends string ? Optional<T> : T` and similar — pick the Optional branch for scalar args. */
+/** `T extends string ? Optional<T> : T` and similar, pick the Optional branch for scalar args. */
 function tryEvaluateConditionalAlias(entry: AliasEntry, typeArgs: readonly ts.TypeNode[]): ts.TypeNode | null {
   const substituted = substituteAndParse(entry, typeArgs)
   if (!ts.isConditionalTypeNode(substituted)) return null

package/src/ui/README.md

@@ -9,7 +9,7 @@ Shared Ink-based design system for the Supatype CLI.
 | `fatal.ts` | `fatalError`, `reportCliFatal` |
 | `confirm.ts` | Yes/no prompts (Ink overlay in dev, Ink flow in TTY) |
 | `progress.ts` | `withSpinner` + `runCommandChrome` for one-shot commands |
-| `runtime/command-chrome.ts` | Ink shell (logo, logs, spinner) — applied globally via `wrapProgramActionsWithChrome` in `cli.ts` |
+| `runtime/command-chrome.ts` | Ink shell (logo, logs, spinner), applied globally via `wrapProgramActionsWithChrome` in `cli.ts` |
 | `prompts.ts` | Logo, `promptText`, `promptPassword`, `ensureNotCancelled` |
 | `clack.ts` | Clack-compatible `p.*` API + `runClackFlow()` for wizards |
 | `flows/` | Ink flow shell + prompt fields |

package/src/ui/brand.ts

@@ -1,6 +1,6 @@
 /**
  * Shared ANSI styling for Supatype CLI output and the dev TUI.
- * @deprecated Prefer `theme.ts` for new code — re-exports kept for dev-logo / task colors.
+ * @deprecated Prefer `theme.ts` for new code, re-exports kept for dev-logo / task colors.
  */
 
 export { BOLD, BRAND_COLOR, brandStyle, DIM, RESET } from "./theme.js"

package/src/ui/components/LogoWordmark.tsx

@@ -15,7 +15,7 @@ export interface LogoWordmarkProps {
   tagline?: string
 }
 
-/** Figlet slant wordmark — native Ink colours (no embedded ANSI). */
+/** Figlet slant wordmark: native Ink colours (no embedded ANSI). */
 export function LogoWordmark({ maxWidth, tagline }: LogoWordmarkProps): React.ReactElement {
   const lines = layoutLogoBlock(pickLogoLines())
 

package/src/ui/components/SelectField.tsx

@@ -34,7 +34,7 @@ export function SelectField({
   })
 
   const items = options.map((opt) => ({
-    label: opt.hint ? `${opt.label} — ${opt.hint}` : opt.label,
+    label: opt.hint ? `${opt.label}, ${opt.hint}` : opt.label,
     value: opt.value,
   }))
 

package/src/ui/confirm.ts

@@ -9,7 +9,7 @@ export interface ConfirmOptions {
 }
 
 /**
- * Yes/no confirmation — Ink overlay in dev, Ink flow in TTY, default otherwise.
+ * Yes/no confirmation: Ink overlay in dev, Ink flow in TTY, default otherwise.
  */
 export async function confirm(message: string, opts: ConfirmOptions = {}): Promise<boolean> {
   const fallback = opts.nonInteractive ?? opts.default ?? false

package/src/ui/fatal.ts

@@ -27,7 +27,7 @@ export function fatalError(message: string, hints: string[] = [], opts?: FatalOp
   process.exit(opts?.exitCode ?? 1)
 }
 
-/** Top-level CLI catch — user-facing message without branding. */
+/** Top-level CLI catch: user-facing message without branding. */
 export function reportCliFatal(err: unknown): void {
   const message = err instanceof Error ? err.message : String(err)
   error(message)

package/src/ui/flows/prompt-fields.tsx

@@ -80,7 +80,7 @@ export function ConfirmPrompt({ spec, onSubmit }: ConfirmPromptProps): React.Rea
         ) : (
           <Text dimColor>No</Text>
         )}
-        <Text dimColor> — y/n, ←/→, enter</Text>
+        <Text dimColor>: y/n, ←/→, enter</Text>
       </Text>
     </Box>
   )

package/src/ui/interactive.ts

@@ -1,4 +1,4 @@
-/** True when stdin/stdout are TTYs — interactive prompts and spinners are allowed. */
+/** True when stdin/stdout are TTYs, interactive prompts and spinners are allowed. */
 export function isInteractive(): boolean {
   return Boolean(process.stdin.isTTY && process.stdout.isTTY)
 }

package/src/ui/progress.ts

@@ -1,5 +1,5 @@
 /**
- * Progress UI for one-shot commands — Ink spinner inside command chrome.
+ * Progress UI for one-shot commands, Ink spinner inside command chrome.
  */
 
 import { getActiveFlowApi } from "./runtime/flow-session.js"

package/src/ui/runtime/command-chrome.ts

@@ -89,7 +89,7 @@ export function isCommandChromeActive(): boolean {
   return getActiveFlowApi() !== null
 }
 
-/** Commands that mount their own Ink UI — do not wrap with command chrome. */
+/** Commands that mount their own Ink UI, do not wrap with command chrome. */
 const WIZARD_COMMAND_PATHS = new Set(["dev", "init", "link", "login", "_postinstall"])
 
 /** Prefixes for subcommands that call `runClackFlow` internally. */

package/src/ui/runtime/run-clack-flow.tsx

@@ -55,7 +55,7 @@ function teardownInk(instance: Instance): void {
   try {
     instance.clear()
   } catch {
-    // ignore — terminal may already be reset
+    // ignore: terminal may already be reset
   }
   instance.unmount()
   instance.cleanup()

package/src/ui/runtime/stdin-after-ink.ts

@@ -10,7 +10,7 @@ export function restoreStdinAfterInk(): void {
   try {
     if (stdin.isRaw) stdin.setRawMode?.(false)
   } catch {
-    // ignore — stdin may already be restored
+    // ignore: stdin may already be restored
   }
 
   // Pause so one-shot Ink flows (cache list, keys, …) can exit; resume() would keep the

package/src/ui/theme.ts

@@ -1,5 +1,5 @@
 /**
- * Supatype terminal design tokens — shared by Ink components and plain CI output.
+ * Supatype terminal design tokens, shared by Ink components and plain CI output.
  */
 
 export const RESET = "\x1b[0m"

package/src/valkey-sidecar.ts

@@ -100,7 +100,7 @@ export function ensureValkeySidecar(projectName: string): ValkeySidecarResult {
     sleepMs(100)
   }
 
-  console.warn("[supatype] ⚠  Valkey sidecar started but not reachable yet — cache may bypass initially.")
+  console.warn("[supatype] ⚠  Valkey sidecar started but not reachable yet, cache may bypass initially.")
   return { addr, containerName: name, started: true }
 }
 
@@ -109,7 +109,7 @@ export function stopValkeySidecar(containerName: string | null): void {
   spawnSync("docker", ["rm", "-f", containerName], { stdio: "ignore" })
 }
 
-/** @internal Test helper — probe without subprocess. */
+/** @internal Test helper: probe without subprocess. */
 export function probeTcp(host: string, port: number): Promise<boolean> {
   return new Promise((resolve) => {
     const s = createConnection({ host, port })

package/tests/access-composition.test.ts

@@ -24,7 +24,7 @@ function access(model: ModelAstV2 | undefined): Record<string, unknown> {
 }
 
 // Without OR-composition the rule set is a closed list of single shapes, and the
-// commonest real requirement — "an admin, or the owner" — cannot be written at all.
+// commonest real requirement: "an admin, or the owner", cannot be written at all.
 describe("Any<[…]>", () => {
   it("composes rules into an OR-join", () => {
     const post = extract(
@@ -81,7 +81,7 @@ export type Post = Model<{
   })
 
   // An empty list reads like a grant and compiles to a policy that grants
-  // nothing — exactly the silent denial the unknown-rule error exists to prevent.
+  // nothing: exactly the silent denial the unknown-rule error exists to prevent.
   it("rejects an empty list", () => {
     expect(() =>
       extract(
@@ -350,7 +350,7 @@ export type Post = Model<{ id: UUID }, { access: { read: In<"a", Rows<"a b; drop
 })
 
 // The plan's headline parameterisation: the type-level equivalent of Payload's
-// access-control factory. Before this, any named alias — even unparameterised —
+// access-control factory. Before this, any named alias, even unparameterised,
 // was reported as an unknown rule and had to be written inline at every use.
 describe("parameterised rule aliases", () => {
   it("expands a generic alias at the point of use", () => {
@@ -480,7 +480,7 @@ export type Post = Model<{ id: UUID }, { access: { update: { using: Public; wat:
 })
 
 
-// "Publish at 09:00 next Tuesday" is *data* — the row carries `published_at` and the
+// "Publish at 09:00 next Tuesday" is *data*, the row carries `published_at` and the
 // rule is the same for every row. There is deliberately no literal-timestamp
 // operand; the policy re-evaluates per query, so the row starts matching at 09:00
 // with no cron and no publish worker.
@@ -589,7 +589,7 @@ export type Post = Model<{ id: UUID }, { access: { read: Gte<"a", Ago<${n}, "day
 `
     expect(() => extract(bad("0.5"), "ago-frac")).toThrow(/whole number/)
     // A negative literal is a prefix-unary expression, not a numeric literal, so it
-    // needs its own branch — otherwise the message misses the real advice.
+    // needs its own branch, otherwise the message misses the real advice.
     expect(() => extract(bad("-5"), "ago-neg")).toThrow(/does not take a negative amount/)
   })
 
@@ -619,7 +619,7 @@ export type Post = Model<{ id: UUID }, { access: { read: Gte<"a", StartOf<"fortn
 })
 
 // `In<>` asks "is this row's value in the set". Payload's site-access rule guards on
-// `user.sites?.length > 0` first — without that, an editor with no sites still
+// `user.sites?.length > 0` first, without that, an editor with no sites still
 // matches the unassigned-rows branch.
 describe("Exists<> non-empty guard", () => {
   it("expresses the Payload site-access rule in full", () => {

package/tests/admin-studio-membership.test.ts

@@ -68,7 +68,7 @@ async function seedFirstAdmin(): Promise<Recorded[]> {
 
 // Capability checks refuse a role they do not recognise, so the CLI's set has to
 // match the server's (`studioRolePermissions`) and the control plane's
-// (`STUDIO_ROLE_PERMISSIONS`) exactly — a role only this side knows about creates
+// (`STUDIO_ROLE_PERMISSIONS`) exactly: a role only this side knows about creates
 // a user who is locked out of the panel they were made for.
 describe("STUDIO_ROLES", () => {
   it("matches the roles the servers understand", () => {

package/tests/api-schemas.test.ts

@@ -42,7 +42,7 @@ describe("apiSchemas", () => {
 
   it("leads with the managed schema when pg_schema moves", () => {
     // First entry is what PostgREST serves as the default profile, so the managed schema has to
-    // lead — otherwise unprefixed requests would resolve against `supatype`.
+    // lead: otherwise unprefixed requests would resolve against `supatype`.
     expect(apiSchemaList(project({ pg_schema: "app" }))).toBe(
       "app, supatype, graphql_public, auth",
     )

package/tests/archive-name-alias.test.ts

@@ -4,7 +4,7 @@ import { archiveNameCandidates } from "../src/binary-cache.js"
 
 /**
  * `supatype-postgres` published the Intel macOS archive as `darwin-x86_64` while the CLI asks for
- * `darwin-amd64` — the spelling it derives from `process.arch === "x64"` on every platform. So
+ * `darwin-amd64`: the spelling it derives from `process.arch === "x64"` on every platform. So
  * `supatype dev` on an Intel Mac failed with "Checksum not found", and had done for as long as both
  * sides existed: CI could not run Docker on a macOS runner, so the path was never exercised.
  *

package/tests/cli-help.test.ts

@@ -1,5 +1,5 @@
 /**
- * Subprocess tests — spawn the compiled CLI binary and verify commands are
+ * Subprocess tests: spawn the compiled CLI binary and verify commands are
  * registered. Requires `pnpm build` to have run first (turbo handles this).
  */
 import { describe, it, expect } from "vitest"
@@ -17,8 +17,14 @@ const PACKAGE_VERSION = (
 function runCli(args: string[]): { stdout: string; stderr: string; exitCode: number } {
   const result = spawnSync(process.execPath, [CLI_BIN, ...args], {
     encoding: "utf8",
-    timeout: 10_000,
+    timeout: 60_000,
   })
+  if (result.signal) {
+    throw new Error(
+      `CLI subprocess killed by ${result.signal} after the spawn timeout. `
+        + `Args: ${args.join(" ")}. This is usually machine contention, not a CLI fault.`,
+    )
+  }
   return {
     stdout: String(result.stdout ?? ""),
     stderr: String(result.stderr ?? ""),

package/tests/db-preflight.test.ts

@@ -44,7 +44,7 @@ describe("splitting remedies", () => {
 
 describe("the authenticator password guard", () => {
   // The credential is the operator's by decision. Executing the placeholder would create a role
-  // with a password from our source code — worse than refusing, and harder to notice.
+  // with a password from our source code, worse than refusing, and harder to notice.
   it("detects a remedy that would execute the placeholder", () => {
     const remedies = [
       result({ remedy: `CREATE ROLE authenticator LOGIN NOINHERIT PASSWORD '${PASSWORD_PLACEHOLDER}';` }),

package/tests/doctor-render.test.ts

@@ -5,7 +5,7 @@ import { printSection } from "../src/commands/doctor.js"
  * How a drift item reads to the operator.
  *
  * Items are keyed `table` + `name`, which for an index or constraint are different things and for a
- * *table* are the same — so the natural `table.name` form printed "widget.widget". Tables only
+ * *table* are the same, so the natural `table.name` form printed "widget.widget". Tables only
  * started appearing in this report when the ownership gate got its reporting (E17), and a report an
  * operator distrusts is worse than no report.
  */
@@ -30,7 +30,7 @@ describe("printSection", () => {
         table: "widget",
         name: "widget",
         fields: [],
-        message: "Unmanaged table widget — push will not drop; manual decision required",
+        message: "Unmanaged table widget, push will not drop; manual decision required",
       },
     ])
     const text = captured.join("\n")
@@ -48,7 +48,7 @@ describe("printSection", () => {
         table: "widget",
         name: "widget_name_idx",
         fields: ["name"],
-        message: "Unmanaged index widget_name_idx on widget — push will not drop",
+        message: "Unmanaged index widget_name_idx on widget, push will not drop",
       },
     ])
     expect(captured.join("\n")).toContain("• widget.widget_name_idx (name)")

package/tests/doctor-service-role.test.ts

@@ -36,7 +36,7 @@ describe("printServiceRoleGrants", () => {
 
   it("marks a grant that matches no function", () => {
     printServiceRoleGrants(
-      { ...empty, errors: ['  "send-emial" — no functions/send-emial/index.ts'], missing: ["send-emial"] },
+      { ...empty, errors: ['  "send-emial", no functions/send-emial/index.ts'], missing: ["send-emial"] },
       ["send-emial", "audit"],
     )
     const out = lines.join("\n")
@@ -47,7 +47,7 @@ describe("printServiceRoleGrants", () => {
 
   it("passes a redundant-entry warning through", () => {
     printServiceRoleGrants(
-      { ...empty, warnings: ['  "hooks/x" is not needed — a hook receives the key'] },
+      { ...empty, warnings: ['  "hooks/x" is not needed, a hook receives the key'] },
       ["hooks/x"],
     )
     expect(lines.join("\n")).toContain("is not needed")

package/tests/engine-push-output.test.ts

@@ -38,7 +38,7 @@ describe("formatEnginePushMessage()", () => {
   it("formats up_to_date with admin refresh", () => {
     expect(
       formatEnginePushMessage({ status: "up_to_date", operations: 0, admin_refreshed: true }),
-    ).toBe("Schema up to date — Studio metadata synced.")
+    ).toBe("Schema up to date, Studio metadata synced.")
   })
 
   it("formats up_to_date without admin refresh", () => {

package/tests/env-file.test.ts

@@ -10,7 +10,7 @@ import { MANAGED_MARKER, readEnvFile, upsertEnvFile } from "../src/env-file.js"
  * Two defects motivated this: the rewrite rebuilt the file from its assignments alone, so every
  * comment and blank line vanished; and the image keys derivable from `versions` were deleted
  * unconditionally, so `SUPATYPE_REALTIME_IMAGE` could be overridden from `.env` and
- * `SUPATYPE_SERVER_IMAGE` could not. Same file, same shape, different rules — which is how an hour
+ * `SUPATYPE_SERVER_IMAGE` could not. Same file, same shape, different rules, which is how an hour
  * goes into wondering why a locally built image is ignored.
  */
 let dir: string
@@ -63,7 +63,7 @@ JWT_SECRET=abc
 
   it("does clean up a value it wrote itself", () => {
     // Otherwise removing a pin from config leaves a stale image reference that silently keeps
-    // running the old version — the reason the deletion existed at all.
+    // running the old version, the reason the deletion existed at all.
     upsertEnvFile(
       dir,
       { SUPATYPE_SERVER_IMAGE: "supatype/server:v1.2.3" },
@@ -112,7 +112,7 @@ JWT_SECRET=abc
   })
 
   it("does not treat a commented-out assignment as a value", () => {
-    // `# FOO=bar` is a note, not a setting — the old parser kept it as a key called "# FOO".
+    // `# FOO=bar` is a note, not a setting, the old parser kept it as a key called "# FOO".
     write("# FOO=bar\nREAL=1\n")
     upsertEnvFile(dir, { REAL: "2" })
     expect(read()).toContain("# FOO=bar")

package/tests/external-database-compose.test.ts

@@ -30,7 +30,7 @@ const project = (database: unknown): SupatypeProjectConfig =>
 const external = (url = EXTERNAL_URL) => project({ external: { url } })
 const managed = () => project({ provider: "docker" })
 
-describe("external database — compose", () => {
+describe("external database: compose", () => {
   it("omits the db service and says why", () => {
     const compose = renderSelfHostCompose(external())
     expect(compose).not.toMatch(/^ {2}db:$/m)
@@ -88,12 +88,12 @@ describe("external database — compose", () => {
   it("appends GoTrue's search_path with the right separator", () => {
     // A URL that already has a query string needs `&`; a second `?` produces a DSN that fails to
     // parse, and GoTrue would exit rather than run its auth migrations.
-    expect(renderSelfHostCompose(external())).toContain('${DATABASE_URL:?DATABASE_URL is missing from .env — required by database.external}?search_path=auth"')
+    expect(renderSelfHostCompose(external())).toContain('${DATABASE_URL:?DATABASE_URL is missing from .env, required by database.external}?search_path=auth"')
     expect(
       renderSelfHostCompose(
         external("postgres://owner:secret@db.example.com:5432/app?sslmode=require"),
       ),
-    ).toContain('${DATABASE_URL:?DATABASE_URL is missing from .env — required by database.external}&search_path=auth"')
+    ).toContain('${DATABASE_URL:?DATABASE_URL is missing from .env, required by database.external}&search_path=auth"')
   })
 
   it("omits realtime entirely when the project turns it off", () => {
@@ -109,7 +109,7 @@ describe("external database — compose", () => {
   })
 
   it("keeps realtime when the flag is unset", () => {
-    // Unset means "probe it", not "assume it is broken" — the service reports its own capability.
+    // Unset means "probe it", not "assume it is broken", the service reports its own capability.
     const compose = renderSelfHostCompose(external())
     expect(compose).toMatch(/^ {2}realtime:$/m)
     expect(compose).toContain("SUPATYPE_REALTIME_URL: http://realtime:4000")
@@ -157,7 +157,7 @@ describe("external database — compose", () => {
 
 describe("a loopback external URL", () => {
   // Found by rehearsing a push against a real external Postgres: `db check` passed and `push`
-  // applied the schema, because the CLI runs on the host — then storage, realtime and the server all
+  // applied the schema, because the CLI runs on the host, then storage, realtime and the server all
   // died with ECONNREFUSED against their own loopback, because inside a container `127.0.0.1` is
   // that container. A retry loop would only have hidden it.
   it("is detected, whatever form it takes", () => {

package/tests/external-database-config.test.ts

@@ -28,7 +28,7 @@ const raw = (database: unknown, rest: Record<string, unknown> = {}): unknown =>
 const validate = (database: unknown, rest?: Record<string, unknown>) =>
   validateProjectConfig(raw(database, rest), "supatype.config.ts")
 
-describe("database.external — accepted", () => {
+describe("database.external: accepted", () => {
   it("accepts a url on its own, with no database.provider", () => {
     const cfg = validate({ external: { url: EXTERNAL_URL } })
     expect(externalDatabaseUrl(cfg)).toBe(EXTERNAL_URL)
@@ -52,7 +52,7 @@ describe("database.external — accepted", () => {
   })
 })
 
-describe("database.external — rejected", () => {
+describe("database.external: rejected", () => {
   it("rejects a missing url", () => {
     expect(() => validate({ external: {} })).toThrow(/database\.external\.url is required/)
     expect(() => validate({ external: { url: "   " } })).toThrow(