@kernlang/core 3.1.2 → 3.1.3

package/dist/codegen-core.d.ts

@@ -7,6 +7,14 @@
  * Machine nodes are KERN's killer feature: 12 lines of KERN → 140+ lines of TS.
  */
 import type { IRNode } from './types.js';
+/** Validate and emit a safe identifier for generated code. Throws on invalid. */
+export declare function emitIdentifier(value: string | undefined, fallback: string, node?: IRNode): string;
+/** Escape a string for safe interpolation into a single-quoted JS string literal. */
+export declare function emitStringLiteral(value: string): string;
+/** Validate and emit a safe filesystem path for generated code. */
+export declare function emitPath(value: string, node?: IRNode): string;
+/** Escape a value for interpolation into a template literal in generated code. */
+export declare function emitTemplateSafe(value: string): string;
 /** Register an evolved generator (called at startup). */
 export declare function registerEvolvedGenerator(keyword: string, fn: (node: IRNode) => string[]): void;
 /** Register a target-specific evolved generator (called at startup). */
@@ -73,7 +81,7 @@ export declare function generateResolve(node: IRNode): string[];
 export declare function generateExpect(node: IRNode): string[];
 export declare function generateRecover(node: IRNode): string[];
 export declare function generatePattern(node: IRNode): string[];
-export declare function generateApply(node: IRNode): string[];
+export declare function generateApply(node: IRNode, _depth?: number): string[];
 export declare function generateConditional(node: IRNode): string[];
 export declare function generateSelect(node: IRNode): string[];
 export declare function generateModel(node: IRNode): string[];

package/dist/codegen-core.js

@@ -8,6 +8,50 @@
  */
 import { isTemplateNode, expandTemplateNode } from './template-engine.js';
 import { KernCodegenError } from './errors.js';
+// ── Safe Emitters (prompt-injection immunity) ────────────────────────────
+// Every prop value interpolated into generated code MUST go through these.
+// Raw string splicing is the root cause of codegen injection (audit 2026-03-25).
+// Matches valid JS/TS identifiers — KERN hyphens are converted to camelCase by the parser.
+// Allows $ for React patterns (e.g., $state). Does NOT allow hyphens since
+// generated TypeScript rejects them (e.g., `interface My-User` is invalid TS).
+const SAFE_IDENT_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+const SAFE_PATH_RE = /^[A-Za-z0-9/_.\-~]+$/;
+/** Validate and emit a safe identifier for generated code. Throws on invalid. */
+export function emitIdentifier(value, fallback, node) {
+    const v = value || fallback;
+    if (!SAFE_IDENT_RE.test(v)) {
+        throw new KernCodegenError(`Invalid identifier: '${v.slice(0, 50)}' — must match KERN identifier grammar [A-Za-z_$][A-Za-z0-9_$-]*`, node);
+    }
+    return v;
+}
+/** Escape a string for safe interpolation into a single-quoted JS string literal. */
+export function emitStringLiteral(value) {
+    const escaped = value
+        .replace(/\\/g, '\\\\')
+        .replace(/'/g, "\\'")
+        .replace(/`/g, '\\`')
+        .replace(/\$/g, '\\$')
+        .replace(/\n/g, '\\n')
+        .replace(/\r/g, '\\r');
+    return `'${escaped}'`;
+}
+/** Validate and emit a safe filesystem path for generated code. */
+export function emitPath(value, node) {
+    if (!SAFE_PATH_RE.test(value)) {
+        throw new KernCodegenError(`Invalid path: '${value.slice(0, 80)}' — contains unsafe characters`, node);
+    }
+    if (value.includes('..')) {
+        throw new KernCodegenError(`Invalid path: '${value.slice(0, 80)}' — path traversal (..) not allowed`, node);
+    }
+    return emitStringLiteral(value);
+}
+/** Escape a value for interpolation into a template literal in generated code. */
+export function emitTemplateSafe(value) {
+    return value
+        .replace(/\\/g, '\\\\')
+        .replace(/`/g, '\\`')
+        .replace(/\$\{/g, '\\${');
+}
 // ── Evolved Generators (v4) ─────────────────────────────────────────────
 // Populated at startup by evolved-node-loader. Checked in generateCoreNode
 // before the default case, allowing graduated nodes to produce output.
@@ -97,10 +141,11 @@ export function exportPrefix(node) {
 // type name=PlanState values="draft|approved|running|paused|completed|failed|cancelled"
 // → export type PlanState = 'draft' | 'approved' | 'running' | ...;
 export function generateType(node) {
-    const { name, values, alias } = p(node);
+    const { name: rawName, values, alias } = p(node);
+    const name = emitIdentifier(rawName, 'UnknownType', node);
     const exp = exportPrefix(node);
     if (values) {
-        const members = values.split('|').map(v => `'${v.trim()}'`).join(' | ');
+        const members = values.split('|').map(v => `'${emitTemplateSafe(v.trim())}'`).join(' | ');
         return [`${exp}type ${name} = ${members};`];
     }
     if (alias) {
@@ -116,15 +161,16 @@ export function generateType(node) {
 //   field name=engineId type=string optional=true
 export function generateInterface(node) {
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'UnknownInterface', node);
     const ext = props.extends ? ` extends ${props.extends}` : '';
     const exp = exportPrefix(node);
     const lines = [];
     lines.push(`${exp}interface ${name}${ext} {`);
     for (const field of kids(node, 'field')) {
         const fp = p(field);
+        const fieldName = emitIdentifier(fp.name, 'field', field);
         const opt = fp.optional === 'true' || fp.optional === true ? '?' : '';
-        lines.push(`  ${fp.name}${opt}: ${fp.type};`);
+        lines.push(`  ${fieldName}${opt}: ${fp.type};`);
     }
     lines.push('}');
     return lines;
@@ -141,8 +187,8 @@ export function generateInterface(node) {
 //   | { type: 'code'; language: string; code: string };
 export function generateUnion(node) {
     const props = p(node);
-    const name = props.name;
-    const discriminant = props.discriminant || 'type';
+    const name = emitIdentifier(props.name, 'UnknownUnion', node);
+    const discriminant = emitIdentifier(props.discriminant, 'type', node);
     const exp = exportPrefix(node);
     const variants = kids(node, 'variant');
     if (variants.length === 0) {
@@ -151,9 +197,9 @@ export function generateUnion(node) {
     const lines = [`${exp}type ${name} =`];
     for (let i = 0; i < variants.length; i++) {
         const vp = p(variants[i]);
-        const vname = vp.name;
+        const vname = emitIdentifier(vp.name, 'variant', variants[i]);
         const fields = kids(variants[i], 'field');
-        const fieldParts = [`${discriminant}: '${vname}'`];
+        const fieldParts = [`${discriminant}: '${emitTemplateSafe(vname)}'`];
         for (const field of fields) {
             const fp = p(field);
             const opt = fp.optional === 'true' || fp.optional === true ? '?' : '';
@@ -180,7 +226,7 @@ export function generateUnion(node) {
 // → export const tracker = new TokenTracker();
 export function generateService(node) {
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'UnknownService', node);
     const impl = props.implements;
     const exp = exportPrefix(node);
     const lines = [];
@@ -214,7 +260,7 @@ export function generateService(node) {
     // Methods
     for (const method of kids(node, 'method')) {
         const mp = p(method);
-        const mname = mp.name;
+        const mname = emitIdentifier(mp.name, 'method', method);
         const mparams = mp.params ? parseParamList(mp.params) : '';
         const isAsync = mp.async === 'true' || mp.async === true;
         const isStream = mp.stream === 'true' || mp.stream === true;
@@ -241,8 +287,8 @@ export function generateService(node) {
     // Singleton instances
     for (const singleton of kids(node, 'singleton')) {
         const sp = p(singleton);
-        const sname = sp.name;
-        const stype = sp.type || name;
+        const sname = emitIdentifier(sp.name, 'instance', singleton);
+        const stype = emitIdentifier(sp.type, name, singleton);
         lines.push('');
         lines.push(`${exp}const ${sname} = new ${stype}();`);
     }
@@ -255,7 +301,7 @@ export function generateService(node) {
 //   >>>
 export function generateFunction(node) {
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'unknownFn', node);
     const params = props.params || '';
     const returns = props.returns;
     const isAsync = props.async === 'true' || props.async === true;
@@ -290,7 +336,7 @@ export function generateFunction(node) {
     lines.push(`${exp}${asyncKw}function ${name}(${paramList})${retClause} {`);
     // Signal → AbortController setup
     if (hasSignal) {
-        const signalName = p(signalNode).name || 'abort';
+        const signalName = emitIdentifier(p(signalNode).name, 'abort', signalNode);
         lines.push(`  const ${signalName} = new AbortController();`);
     }
     // Wrap body in try/finally if cleanup exists
@@ -327,8 +373,8 @@ export function generateFunction(node) {
 //   message "Invalid plan state: expected ${expected}, got ${actual}"
 export function generateError(node) {
     const props = p(node);
-    const name = props.name;
-    const ext = props.extends || 'Error';
+    const name = emitIdentifier(props.name, 'UnknownError', node);
+    const ext = emitIdentifier(props.extends, 'Error', node);
     const message = props.message;
     const exp = exportPrefix(node);
     const fields = kids(node, 'field');
@@ -412,18 +458,18 @@ export function generateError(node) {
 //   - approvePlan(), startPlan(), cancelPlan(), failPlan() functions
 export function generateMachine(node) {
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'UnknownMachine', node);
     const exp = exportPrefix(node);
     const lines = [];
     // Collect states
     const states = kids(node, 'state');
     const stateNames = states.map(s => {
         const sp = p(s);
-        return (sp.name || sp.value);
+        return emitIdentifier((sp.name || sp.value), 'state', s);
     });
     // State type
     const stateType = `${name}State`;
-    lines.push(`${exp}type ${stateType} = ${stateNames.map(s => `'${s}'`).join(' | ')};`);
+    lines.push(`${exp}type ${stateType} = ${stateNames.map(s => `'${emitTemplateSafe(s)}'`).join(' | ')};`);
     lines.push('');
     // Error class
     const errorName = `${name}StateError`;
@@ -442,7 +488,7 @@ export function generateMachine(node) {
     const transitions = kids(node, 'transition');
     for (const t of transitions) {
         const tp = p(t);
-        const tname = tp.name;
+        const tname = emitIdentifier(tp.name, 'transition', t);
         const from = tp.from;
         const to = tp.to;
         const fromStates = from.split('|').map(s => s.trim());
@@ -480,7 +526,7 @@ export function generateMachine(node) {
 // Called by transpiler-ink.ts when target=ink.
 export function generateMachineReducer(node) {
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'UnknownMachine', node);
     const exp = exportPrefix(node);
     const lines = [];
     // First emit the standard machine output
@@ -496,7 +542,7 @@ export function generateMachineReducer(node) {
     const transitions = kids(node, 'transition');
     const stateType = `${name}State`;
     // Action type union
-    const actionNames = transitions.map(t => p(t).name);
+    const actionNames = transitions.map(t => emitIdentifier(p(t).name, 'action', t));
     lines.push(`${exp}type ${name}Action = ${actionNames.map(a => `'${a}'`).join(' | ')};`);
     lines.push('');
     // Reducer function
@@ -505,9 +551,9 @@ export function generateMachineReducer(node) {
     lines.push(`  switch (action) {`);
     for (const t of transitions) {
         const tp = p(t);
-        const tname = tp.name;
+        const tname = emitIdentifier(tp.name, 'action', t);
         const fnName = `${tname}${name}`;
-        lines.push(`    case '${tname}': return ${fnName}(entity).state;`);
+        lines.push(`    case '${emitTemplateSafe(tname)}': return ${fnName}(entity).state;`);
     }
     lines.push(`    default: return state;`);
     lines.push(`  }`);
@@ -527,7 +573,7 @@ export function generateMachineReducer(node) {
 //   field name=approvalLevel type=ApprovalLevel default="plan"
 export function generateConfig(node) {
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'Config', node);
     const exp = exportPrefix(node);
     const fields = kids(node, 'field');
     const lines = [];
@@ -535,8 +581,9 @@ export function generateConfig(node) {
     lines.push(`${exp}interface ${name} {`);
     for (const field of fields) {
         const fp = p(field);
+        const fieldName = emitIdentifier(fp.name, 'field', field);
         const opt = fp.default !== undefined ? '?' : '';
-        lines.push(`  ${fp.name}${opt}: ${fp.type};`);
+        lines.push(`  ${fieldName}${opt}: ${fp.type};`);
     }
     lines.push('}');
     lines.push('');
@@ -544,6 +591,7 @@ export function generateConfig(node) {
     lines.push(`${exp}const DEFAULT_${name.replace(/([a-z])([A-Z])/g, '$1_$2').toUpperCase()}: Required<${name}> = {`);
     for (const field of fields) {
         const fp = p(field);
+        const fieldName = emitIdentifier(fp.name, 'field', field);
         const ftype = fp.type;
         let def = fp.default;
         if (def === undefined) {
@@ -557,9 +605,9 @@ export function generateConfig(node) {
                 def = "''";
         }
         else if (ftype === 'string' || (!['number', 'boolean'].includes(ftype) && !ftype.endsWith('[]') && !def.startsWith("'") && !def.startsWith('"'))) {
-            def = `'${def}'`;
+            def = emitStringLiteral(def);
         }
-        lines.push(`  ${fp.name}: ${def},`);
+        lines.push(`  ${fieldName}: ${def},`);
     }
     lines.push('};');
     return lines;
@@ -569,16 +617,17 @@ export function generateConfig(node) {
 //   model Plan
 export function generateStore(node) {
     const props = p(node);
-    const name = props.name;
-    const storePath = props.path || '~/.data';
-    const key = props.key || 'id';
-    const model = props.model || 'unknown';
+    const name = emitIdentifier(props.name, 'Store', node);
+    const rawPath = props.path || '~/.data';
+    const key = emitIdentifier(props.key, 'id', node);
+    const model = emitIdentifier(props.model, 'unknown', node);
     const exp = exportPrefix(node);
     const lines = [];
     const dirConst = `${name.toUpperCase()}_DIR`;
-    const resolvedPath = storePath.startsWith('~/')
-        ? `join(homedir(), '${storePath.slice(2)}')`
-        : `'${storePath}'`;
+    // Validate path before interpolation — blocks injection + traversal via storePath
+    const resolvedPath = rawPath.startsWith('~/')
+        ? `join(homedir(), ${emitPath(rawPath.slice(2), node)})`
+        : emitPath(rawPath, node);
     lines.push(`import { readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync } from 'node:fs';`);
     lines.push(`import { join, resolve } from 'node:path';`);
     lines.push(`import { homedir } from 'node:os';`);
@@ -591,6 +640,7 @@ export function generateStore(node) {
     lines.push('');
     lines.push(`function safe${name}Path(id: string): string {`);
     lines.push(`  const sanitized = id.replace(/[^a-zA-Z0-9_-]/g, '');`);
+    lines.push(`  if (!sanitized) throw new Error(\`Invalid ID: \${id}\`);`);
     lines.push(`  const full = resolve(${dirConst}, \`\${sanitized}.json\`);`);
     lines.push(`  if (!full.startsWith(resolve(${dirConst}))) throw new Error(\`Invalid ID: \${id}\`);`);
     lines.push(`  return full;`);
@@ -603,17 +653,18 @@ export function generateStore(node) {
     lines.push('');
     lines.push(`${exp}function load${name}(id: string): ${model} | null {`);
     lines.push(`  try { return JSON.parse(readFileSync(safe${name}Path(id), 'utf-8')) as ${model}; }`);
-    lines.push(`  catch { return null; }`);
+    lines.push(`  catch (e) { if ((e as NodeJS.ErrnoException).code === 'ENOENT') return null; throw e; }`);
     lines.push('}');
     lines.push('');
     lines.push(`${exp}function list${name}s(limit = 20): ${model}[] {`);
     lines.push(`  ensure${name}Dir();`);
-    lines.push(`  try {`);
-    lines.push(`    return readdirSync(${dirConst}).filter(f => f.endsWith('.json'))`);
-    lines.push(`      .map(f => JSON.parse(readFileSync(join(${dirConst}, f), 'utf-8')) as ${model})`);
-    lines.push(`      .sort((a: any, b: any) => (b.updatedAt || '').localeCompare(a.updatedAt || ''))`);
-    lines.push(`      .slice(0, limit);`);
-    lines.push(`  } catch { return []; }`);
+    lines.push(`  const files = readdirSync(${dirConst}).filter(f => f.endsWith('.json'));`);
+    lines.push(`  const items: ${model}[] = [];`);
+    lines.push(`  for (const f of files) {`);
+    lines.push(`    try { items.push(JSON.parse(readFileSync(join(${dirConst}, f), 'utf-8')) as ${model}); }`);
+    lines.push(`    catch { /* skip corrupt files */ }`);
+    lines.push(`  }`);
+    lines.push(`  return items.sort((a: any, b: any) => (b.updatedAt || '').localeCompare(a.updatedAt || '')).slice(0, limit);`);
     lines.push('}');
     lines.push('');
     lines.push(`${exp}function delete${name}(id: string): boolean {`);
@@ -631,7 +682,7 @@ export function generateStore(node) {
 //       >>>
 export function generateTest(node) {
     const props = p(node);
-    const name = props.name;
+    const name = emitTemplateSafe(props.name || 'UnknownTest');
     const lines = [];
     lines.push(`import { describe, it, expect } from 'vitest';`);
     lines.push('');
@@ -644,10 +695,10 @@ export function generateTest(node) {
     }
     lines.push(`describe('${name}', () => {`);
     for (const desc of kids(node, 'describe')) {
-        const dname = p(desc).name;
+        const dname = emitTemplateSafe(p(desc).name || 'describe');
         lines.push(`  describe('${dname}', () => {`);
         for (const test of kids(desc, 'it')) {
-            const tname = p(test).name;
+            const tname = emitTemplateSafe(p(test).name || 'test');
             const code = handlerCode(test);
             lines.push(`    it('${tname}', () => {`);
             if (code) {
@@ -660,7 +711,7 @@ export function generateTest(node) {
     }
     // Top-level it blocks
     for (const test of kids(node, 'it')) {
-        const tname = p(test).name;
+        const tname = emitTemplateSafe(p(test).name || 'test');
         const code = handlerCode(test);
         lines.push(`  it('${tname}', () => {`);
         if (code) {
@@ -679,12 +730,12 @@ export function generateTest(node) {
 //   type name="winner:determined" data="{ winner: string, bestScore: number }"
 export function generateEvent(node) {
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'UnknownEvent', node);
     const exp = exportPrefix(node);
     const types = kids(node, 'type');
     const lines = [];
     // Event type union
-    lines.push(`${exp}type ${name}Type = ${types.map(t => `'${(p(t).name || p(t).value)}'`).join(' | ')};`);
+    lines.push(`${exp}type ${name}Type = ${types.map(t => `'${emitTemplateSafe((p(t).name || p(t).value))}'`).join(' | ')};`);
     lines.push('');
     // Event interface
     lines.push(`${exp}interface ${name} {`);
@@ -697,7 +748,7 @@ export function generateEvent(node) {
     lines.push(`${exp}interface ${name}Map {`);
     for (const t of types) {
         const tp = p(t);
-        const tname = (tp.name || tp.value);
+        const tname = emitTemplateSafe((tp.name || tp.value));
         const data = tp.data || 'Record<string, unknown>';
         lines.push(`  '${tname}': ${data};`);
     }
@@ -853,7 +904,7 @@ export function generateWebSocket(node) {
 //   export from="./plan.js" names="createPlan,advanceStep"
 export function generateModule(node) {
     const props = p(node);
-    const name = props.name;
+    const name = emitTemplateSafe(props.name || 'unknown');
     const lines = [];
     lines.push(`// ── Module: ${name} ──`);
     lines.push('');
@@ -949,7 +1000,7 @@ export function generateImport(node) {
 // → export const DEFAULT_WEIGHTS: ScoreWeights = { pass: 50 };
 export function generateConst(node) {
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'unknownConst', node);
     const constType = props.type;
     const value = props.value;
     const exp = exportPrefix(node);
@@ -1090,7 +1141,7 @@ export function generateDerive(node) {
     const conf = p(node).confidence;
     const todo = emitLowConfidenceTodo(node, conf);
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'derived', node);
     const expr = props.expr;
     const constType = props.type;
     const exp = exportPrefix(node);
@@ -1105,7 +1156,7 @@ export function generateTransform(node) {
     const conf = p(node).confidence;
     const todo = emitLowConfidenceTodo(node, conf);
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'transform', node);
     const target = props.target;
     const via = props.via;
     const constType = props.type;
@@ -1138,7 +1189,7 @@ export function generateAction(node) {
     const conf = p(node).confidence;
     const todo = emitLowConfidenceTodo(node, conf);
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'action', node);
     const idempotent = props.idempotent === 'true' || props.idempotent === true;
     const reversible = props.reversible === 'true' || props.reversible === true;
     const params = props.params || '';
@@ -1257,7 +1308,7 @@ export function generateCollect(node) {
     const conf = p(node).confidence;
     const todo = emitLowConfidenceTodo(node, conf);
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'collected', node);
     const from = props.from;
     const where = props.where;
     const limit = props.limit;
@@ -1314,7 +1365,7 @@ export function generateResolve(node) {
     const conf = p(node).confidence;
     const todo = emitLowConfidenceTodo(node, conf);
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'resolver', node);
     const candidates = kids(node, 'candidate');
     const discriminator = firstChild(node, 'discriminator');
     if (!discriminator)
@@ -1328,7 +1379,7 @@ export function generateResolve(node) {
     lines.push(`const _${name}_candidates = [`);
     for (const c of candidates) {
         const cp = p(c);
-        const cname = cp.name;
+        const cname = emitIdentifier(cp.name, 'candidate', c);
         const code = handlerCode(c);
         lines.push(`  { name: '${cname}', fn: (signal: unknown) => { ${code.trim()} } },`);
     }
@@ -1392,7 +1443,7 @@ export function generateRecover(node) {
     const conf = p(node).confidence;
     const todo = emitLowConfidenceTodo(node, conf);
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'recovery', node);
     const strategies = kids(node, 'strategy');
     const hasFallback = strategies.some(s => p(s).name === 'fallback');
     if (!hasFallback)
@@ -1402,7 +1453,7 @@ export function generateRecover(node) {
     lines.push(`async function ${name}WithRecovery<T>(fn: () => Promise<T>): Promise<T> {`);
     for (const strategy of strategies) {
         const sp = p(strategy);
-        const sname = sp.name;
+        const sname = emitIdentifier(sp.name, 'strategy', strategy);
         const code = handlerCode(strategy);
         if (sname === 'retry') {
             const max = Number(sp.max) || 3;
@@ -1446,16 +1497,16 @@ export function generatePattern(node) {
     // pattern nodes are registered as templates — no direct output
     return [];
 }
-export function generateApply(node) {
+export function generateApply(node, _depth = 0) {
     // apply nodes expand the referenced pattern
     const props = p(node);
     const patternName = props.pattern;
     if (!patternName)
         return [];
-    // Delegate to template expansion with the pattern name as node type
+    // Delegate to template expansion — propagate depth to prevent infinite recursion
     const syntheticNode = { ...node, type: patternName };
     if (isTemplateNode(patternName)) {
-        return expandTemplateNode(syntheticNode);
+        return expandTemplateNode(syntheticNode, _depth + 1);
     }
     return [`// apply: pattern '${patternName}' not found`];
 }
@@ -1509,12 +1560,12 @@ export function generateSelect(node) {
     const lines = onChange ? [`{/* kern:use-client */}`] : [];
     lines.push(`<select ${attrs.join(' ')}>`);
     if (placeholder) {
-        lines.push(`  <option value="" disabled>${placeholder}</option>`);
+        lines.push(`  <option value="" disabled>${emitTemplateSafe(placeholder)}</option>`);
     }
     for (const opt of kids(node, 'option')) {
         const op = p(opt);
-        const optValue = op.value || '';
-        const optLabel = op.label || optValue;
+        const optValue = emitTemplateSafe(op.value || '');
+        const optLabel = emitTemplateSafe(op.label || op.value || '');
         lines.push(`  <option value="${optValue}">${optLabel}</option>`);
     }
     lines.push(`</select>`);
@@ -1527,7 +1578,7 @@ export function generateSelect(node) {
 //   relation name=posts target=Post kind=one-to-many cascade=delete
 export function generateModel(node) {
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'UnknownModel', node);
     const table = props.table;
     const exp = exportPrefix(node);
     const lines = [];
@@ -1535,14 +1586,14 @@ export function generateModel(node) {
     lines.push(`${exp}interface ${name} {`);
     for (const col of kids(node, 'column')) {
         const cp = p(col);
-        const colName = cp.name;
+        const colName = emitIdentifier(cp.name, 'column', col);
         const colType = mapColumnType(cp.type);
         const opt = cp.optional === 'true' || cp.optional === true ? '?' : '';
         lines.push(`  ${colName}${opt}: ${colType};`);
     }
     for (const rel of kids(node, 'relation')) {
         const rp = p(rel);
-        const relName = rp.name;
+        const relName = emitIdentifier(rp.name, 'relation', rel);
         const target = rp.target;
         const kind = rp.kind || 'one-to-many';
         const relType = kind.includes('many') ? `${target}[]` : target;
@@ -1572,7 +1623,7 @@ function mapColumnType(kernType) {
 //     handler <<<return this.findOne({ email });>>>
 export function generateRepository(node) {
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'UnknownRepo', node);
     const model = props.model;
     const exp = exportPrefix(node);
     const lines = [];
@@ -1583,7 +1634,7 @@ export function generateRepository(node) {
     }
     for (const method of kids(node, 'method')) {
         const mp = p(method);
-        const mname = mp.name;
+        const mname = emitIdentifier(mp.name, 'method', method);
         const mparams = mp.params ? parseParamList(mp.params) : '';
         const isAsync = mp.async === 'true' || mp.async === true;
         const asyncKw = isAsync ? 'async ' : '';
@@ -1608,7 +1659,7 @@ export function generateRepository(node) {
 //   returns AuthService with=repo
 export function generateDependency(node) {
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'unknownDep', node);
     const scope = props.scope || 'transient';
     const exp = exportPrefix(node);
     const lines = [];
@@ -1625,7 +1676,7 @@ export function generateDependency(node) {
     }
     for (const inj of injects) {
         const ip = p(inj);
-        const injName = ip.name;
+        const injName = emitIdentifier(ip.name, 'dep', inj);
         const injType = ip.type;
         const injFrom = ip.from;
         const injWith = ip.with;
@@ -1660,7 +1711,7 @@ export function generateDependency(node) {
 //   invalidate on=userUpdate tags="user:{id}"
 export function generateCache(node) {
     const props = p(node);
-    const name = props.name;
+    const name = emitIdentifier(props.name, 'unknownCache', node);
     const backend = props.backend || 'memory';
     const prefix = props.prefix || '';
     const ttl = props.ttl;
@@ -1675,7 +1726,7 @@ export function generateCache(node) {
     // Entry methods
     for (const entry of kids(node, 'entry')) {
         const ep = p(entry);
-        const entryName = ep.name;
+        const entryName = emitIdentifier(ep.name, 'entry', entry);
         const key = ep.key || entryName;
         const strategyNode = firstChild(entry, 'strategy');
         const strategy = strategyNode ? (p(strategyNode).name || 'cache-aside') : 'cache-aside';