zitejs 0.9.107 → 0.9.108

package/dist/cjs/check/index.js

@@ -12,9 +12,18 @@ function findAppDirs() {
         .filter(d => d.isDirectory())
         .map(d => d.name);
 }
-function run(cmd, cwd) {
+/**
+ * An argument array, not a command string, so no shell is involved.
+ *
+ * Every command below takes an app directory name straight off `readdirSync`.
+ * Through a shell, a directory named `x;touch PWNED;#` ran the injected command
+ * AND still printed `tsc --noEmit ... ✓` — a check that never executed
+ * reporting a pass, which is the worse half. Passing argv defeats both, and
+ * leaves nothing to escape.
+ */
+function run(file, args, cwd) {
     try {
-        const output = (0, child_process_1.execSync)(cmd, {
+        const output = (0, child_process_1.execFileSync)(file, args, {
             cwd,
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -78,7 +87,7 @@ async function runCheck() {
         }
         else {
             process.stdout.write('  tsc --noEmit ... ');
-            const tsc = run(`npx tsc --noEmit -p ${tsconfigAppPath}`, '.');
+            const tsc = run('npx', ['tsc', '--noEmit', '-p', tsconfigAppPath], '.');
             if (tsc.ok) {
                 console.log('✓');
             }
@@ -93,7 +102,7 @@ async function runCheck() {
         // `zitejs/*` alias has no generated file behind it; only the bundler knows.
         if ((0, fs_1.existsSync)((0, path_1.join)(appPath, 'src', 'api'))) {
             process.stdout.write('  bundle endpoints ... ');
-            const bundle = run(`npx zitejs bundle --app ${app}`, '.');
+            const bundle = run('npx', ['zitejs', 'bundle', '--app', app], '.');
             const failures = bundle.ok ? bundleFailures(bundle.output) : [bundle.output];
             if (failures.length === 0) {
                 console.log('✓');
@@ -107,7 +116,7 @@ async function runCheck() {
         const viteConfig = (0, path_1.join)(appPath, 'vite.config.ts');
         if ((0, fs_1.existsSync)(viteConfig)) {
             process.stdout.write('  vite build ... ');
-            const vite = run('npx vite build', appPath);
+            const vite = run('npx', ['vite', 'build'], appPath);
             if (vite.ok) {
                 console.log('✓');
             }

package/dist/cjs/runtime/index.d.ts

@@ -121,8 +121,15 @@ export interface TableFindAllOptions<T = Record<string, unknown>> {
 export interface BulkCreateResult<T> {
     /** Absent when `records: []` was passed — the dispatch short-circuits before setting it. */
     success?: boolean;
+    /**
+     * The nested copy has no `id`: both dispatchers build it with
+     * `const { id, ...fields } = record`, so `fields` is the record *minus* the
+     * id. Typing it `T` (which requires `id`) made the common
+     * `{ id: rec.id, ...rec.fields }` idiom a TS2783 — the type promised the
+     * spread always overwrites `id` when at runtime it never does.
+     */
     records: Array<T & {
-        fields: T;
+        fields: Omit<T, "id">;
     }>;
 }
 /** A type alias, not an interface: an interface cannot extend a generic `Partial<T>`. */

package/dist/cjs/runtime/writeResultTypes.test-d.js

@@ -13,6 +13,17 @@ const vitest_1 = require("vitest");
         (0, vitest_1.expectTypeOf)().toEqualTypeOf();
         (0, vitest_1.expectTypeOf)().toEqualTypeOf();
     });
+    // Both dispatchers destructure `id` out before nesting
+    // (`const { id, ...fields } = record`), so `fields` must not claim one.
+    (0, vitest_1.it)("omits id from the nested copy", () => {
+        (0, vitest_1.expectTypeOf)().toEqualTypeOf();
+    });
+    // The idiom that regressed under `fields: T` (TS2783, "this spread always
+    // overwrites this property"). Compiling at all is the assertion.
+    (0, vitest_1.it)("allows the id-then-spread idiom", () => {
+        const rebuild = (rec) => ({ id: rec.id, ...rec.fields });
+        (0, vitest_1.expectTypeOf)().toEqualTypeOf();
+    });
     (0, vitest_1.it)("keeps success optional", () => {
         (0, vitest_1.expectTypeOf)().toEqualTypeOf();
     });

package/dist/cjs/sync/lib.js

@@ -150,6 +150,34 @@ const ATTACHMENT_TYPES = [
     "",
 ];
 const MAX_SELECT_OPTIONS = 100;
+/**
+ * A select option label as a TypeScript string-literal type.
+ *
+ * `JSON.stringify` rather than hand-rolled quote escaping: a label is arbitrary
+ * user text, and a newline in one produced an unterminated literal that made the
+ * whole of `.zite/db.ts` unparseable — which breaks typecheck for every app in
+ * the project, not just the one that owns the table. Backslashes and control
+ * characters break it the same way. TS literal syntax is a superset of JSON's
+ * for strings, so the output is always valid.
+ */
+const tsStringLiteral = (value) => JSON.stringify(value);
+/**
+ * The same, single-quoted, for the emitters that write single-quoted source.
+ * The escaping still comes from `JSON.stringify` — only the delimiter differs —
+ * so newlines, backslashes and control characters stay handled.
+ */
+const tsSingleQuoted = (value) => `'${JSON.stringify(value).slice(1, -1).replace(/'/g, "\\'")}'`;
+/**
+ * User-controlled text inside a generated comment. Names reach both a `//` line
+ * and a one-line JSDoc, so a newline would end the first and a comment-close
+ * sequence would end the second — leaving the remainder to parse as code.
+ * Applied where the comment is written rather than at each contributor, so
+ * anything added to one later is covered by default.
+ */
+const commentSafe = (value) => value
+    .replace(/\*\//g, "* /")
+    .replace(/\s+/g, " ")
+    .trim();
 const NUMBER_FORMAT_EXAMPLES = {
     local: "1,000,000.50",
     comma_period: "1,000,000.50",
@@ -200,7 +228,7 @@ function tsTypeForSchemaField(def, variant = "read") {
         if (options && options.length > 0) {
             const literals = options
                 .slice(0, MAX_SELECT_OPTIONS)
-                .map((o) => `"${o.label.replace(/"/g, '\\"')}"`)
+                .map((o) => tsStringLiteral(o.label))
                 .join(" | ");
             const union = `${literals} | string`;
             // No `| null` on the read side — see FIELD_TYPE_MAP. The write side keeps
@@ -454,7 +482,7 @@ function buildLinkTableComments(schema) {
         "// Link tables for zite.sql() JOINs (use these exact names):",
     ];
     for (const e of entries) {
-        lines.push(`//   "${e.name}" — columns: "${e.cols[0]}", "${e.cols[1]}"`);
+        lines.push(`//   "${commentSafe(e.name)}" — columns: "${commentSafe(e.cols[0])}", "${commentSafe(e.cols[1])}"`);
     }
     return lines;
 }
@@ -550,7 +578,7 @@ function generateDbTs(inputSchema) {
             const tsType = tsTypeForSchemaField(field.definition);
             const jsdoc = fieldJsdoc(field, table, schema);
             if (jsdoc) {
-                lines.push(`  /** ${jsdoc} */`);
+                lines.push(`  /** ${commentSafe(jsdoc)} */`);
             }
             // Optional, matching the pre-monorepo type (`required: ['id']` — "none of
             // these are required to be defined aside from 'id'"). A `fields:`
@@ -768,13 +796,13 @@ function generateApiTs(endpointFiles) {
     if (skipped.length > 0) {
         lines.push("// Not endpoints, so no callers were generated for them:");
         for (const name of skipped)
-            lines.push(`//   ${name}`);
+            lines.push(`//   ${commentSafe(name)}`);
         lines.push("");
     }
     for (const { pascal, baseName, typed } of endpoints) {
         if (!typed)
             continue;
-        lines.push(`import type { default as _${pascal}Ep } from '../src/api/${baseName}';`);
+        lines.push(`import type { default as _${pascal}Ep } from ${tsSingleQuoted(`../src/api/${baseName}`)};`);
     }
     lines.push("");
     for (const { baseName, ident, pascal, stream, typed } of endpoints) {
@@ -782,10 +810,10 @@ function generateApiTs(endpointFiles) {
             // Declared with `export const x = createEndpoint(...)` — the 1.0 shape.
             // The route is real and the bundler deploys it, so the caller has to
             // exist; there is just no default export to read its types from.
-            lines.push(`// '${baseName}' has no default export, so its input/output are untyped.`);
+            lines.push(`// ${commentSafe(`'${baseName}'`)} has no default export, so its input/output are untyped.`);
             lines.push(`export type ${pascal}InputType = unknown;`);
             lines.push(`export type ${pascal}OutputType = unknown;`);
-            lines.push(`export const ${ident} = ${stream ? "createStreamingCaller" : "createCaller"}<${pascal}InputType, ${pascal}OutputType>('${baseName}');`);
+            lines.push(`export const ${ident} = ${stream ? "createStreamingCaller" : "createCaller"}<${pascal}InputType, ${pascal}OutputType>(${tsSingleQuoted(baseName)});`);
             lines.push("");
             continue;
         }
@@ -804,7 +832,7 @@ function generateApiTs(endpointFiles) {
         // Calling it `sendEmail` here made every hyphenated or snake_cased endpoint
         // a 404.
         const caller = stream ? "createStreamingCaller" : "createCaller";
-        lines.push(`export const ${ident} = ${caller}<${pascal}InputType, ${pascal}OutputType>('${baseName}');`);
+        lines.push(`export const ${ident} = ${caller}<${pascal}InputType, ${pascal}OutputType>(${tsSingleQuoted(baseName)});`);
         lines.push("");
     }
     lines.push("");
@@ -912,7 +940,7 @@ function airtableTsType(field, lock, depth, variant = "read") {
         choices.length > 0) {
         const literals = choices
             .slice(0, MAX_SELECT_OPTIONS)
-            .map((o) => `"${o.replace(/"/g, '\\"')}"`)
+            .map((o) => tsStringLiteral(o))
             .join(" | ");
         const union = `${literals} | string`;
         if (field.type === "multipleSelects")
@@ -1058,7 +1086,7 @@ function generateAirtableTs(lock) {
     lines.push(...AIRTABLE_ATTACHMENT_TYPE);
     for (const table of lock.tables) {
         const recordType = `${table.sdkName}RecordType`;
-        lines.push(`/** A ${table.sdkName} record as it is read back. */`);
+        lines.push(`/** A ${commentSafe(table.sdkName)} record as it is read back. */`);
         lines.push(`export type ${recordType} = {`);
         lines.push("  id: string;");
         for (const field of table.fields) {
@@ -1066,7 +1094,7 @@ function generateAirtableTs(lock) {
                 continue;
             const jsdoc = airtableFieldJsdoc(field, table, lock);
             if (jsdoc) {
-                lines.push(`  /** ${jsdoc} */`);
+                lines.push(`  /** ${commentSafe(jsdoc)} */`);
             }
             const tsType = airtableTsType(field, lock);
             // Optional, because Airtable omits a field from the response entirely
@@ -1080,7 +1108,7 @@ function generateAirtableTs(lock) {
         // Read-only fields are omitted rather than typed: Airtable rejects a write
         // to a formula, rollup, lookup or autonumber with a 422.
         const writableFields = table.fields.filter((f) => f.sdkName !== "id" && !READ_ONLY_AIRTABLE_FIELDS.has(f.type));
-        lines.push(`/** What you may write when creating or updating a ${table.sdkName}. */`);
+        lines.push(`/** What you may write when creating or updating a ${commentSafe(table.sdkName)}. */`);
         lines.push(`export type ${table.sdkName}RecordInput = {`);
         for (const field of writableFields) {
             lines.push(`  ${field.sdkName}: ${airtableTsType(field, lock, 0, "write")};`);
@@ -1246,7 +1274,7 @@ function generateEmailSdk(integrationId) {
         "  SendEmailResult,",
         "} from 'zitejs/runtime';",
         "",
-        `export const Email = createEmailClient('${integrationId}');`,
+        `export const Email = createEmailClient(${tsSingleQuoted(integrationId)});`,
         "",
     ].join("\n");
 }

package/dist/cjs/sync/lib.test.js

@@ -1,7 +1,128 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 const vitest_1 = require("vitest");
+const typescript_1 = __importDefault(require("typescript"));
 const lib_js_1 = require("./lib.js");
+/**
+ * Syntax errors in the emitted source. `.zite/db.ts` sits at the repo root and
+ * every app imports it, so anything unparseable here fails typecheck for the
+ * whole project — and the file is generated, so no one can edit their way out.
+ */
+const syntaxErrorsIn = (source) => (typescript_1.default.transpileModule(source, {
+    reportDiagnostics: true,
+    compilerOptions: { target: typescript_1.default.ScriptTarget.Latest },
+}).diagnostics ?? []).map(d => typescript_1.default.flattenDiagnosticMessageText(d.messageText, ' '));
+const schemaWithSelectOption = (label) => ({
+    tables: [
+        {
+            id: 'tbl1',
+            sdkName: 'registrations',
+            fields: [
+                {
+                    id: 'fld1',
+                    sdkName: 'ticketType',
+                    definition: {
+                        type: 'single_select',
+                        template: { options: [{ label }] },
+                    },
+                },
+            ],
+        },
+    ],
+});
+(0, vitest_1.describe)('generateDbTs select option literals', () => {
+    // Reported from a migrated app: a consent paragraph pasted in as an option
+    // label carried a newline, so the emitted literal never closed and the whole
+    // generated file failed with TS1002 — taking every sibling app with it.
+    vitest_1.it.each([
+        ['a newline', 'I am 18 or above.\nI agree to the rules.'],
+        ['a carriage return', 'Lite Pass\r\nRegular Pass'],
+        ['a double quote', 'The "Premium" tier'],
+        ['a trailing backslash', 'Group / Crew Purchase\\'],
+        ['a tab', 'Lite\tPass'],
+    ])('emits parseable TypeScript for a label containing %s', (_what, label) => {
+        (0, vitest_1.expect)(syntaxErrorsIn((0, lib_js_1.generateDbTs)(schemaWithSelectOption(label)))).toEqual([]);
+    });
+    (0, vitest_1.it)('keeps the option readable in the union', () => {
+        const out = (0, lib_js_1.generateDbTs)(schemaWithSelectOption('The "Premium" tier'));
+        (0, vitest_1.expect)(out).toContain('"The \\"Premium\\" tier"');
+    });
+});
+(0, vitest_1.describe)('generateDbTs field names in comments', () => {
+    // A field's display name is user text and reaches a one-line JSDoc. A
+    // comment-close sequence in it would end the comment early and leave the
+    // remainder to parse as code.
+    const schemaWithFieldNamed = (name) => ({
+        tables: [
+            {
+                id: 'tbl1',
+                sdkName: 'orders',
+                primaryFieldId: 'fld1',
+                fields: [
+                    {
+                        id: 'fld1',
+                        sdkName: 'amount',
+                        definition: {
+                            type: 'currency',
+                            name,
+                            template: { currencySymbol: '$' },
+                        },
+                    },
+                ],
+            },
+        ],
+    });
+    vitest_1.it.each([
+        ['a comment-close sequence', 'Total */ console.log(1); /*'],
+        ['a newline', 'Total\namount'],
+    ])('emits parseable TypeScript for a field named with %s', (_what, name) => {
+        (0, vitest_1.expect)(syntaxErrorsIn((0, lib_js_1.generateDbTs)(schemaWithFieldNamed(name)))).toEqual([]);
+    });
+});
+(0, vitest_1.describe)('generateApiTs endpoint file names', () => {
+    // An endpoint filename is the LLM's raw `writeFile` path argument — nothing
+    // validates its characters — and it lands in an import specifier, a comment
+    // and two string literals. `.zite/api.ts` is imported by every component that
+    // calls `api.*`, so one bad name takes the whole app down.
+    vitest_1.it.each([
+        ['an apostrophe', "it's.ts"],
+        ['a newline', 'ok\nreport.ts'],
+        ['a trailing backslash', 'back\\.ts'],
+        ['a double quote', 'say"hi.ts'],
+    ])('emits parseable TypeScript for a file named with %s', (_what, name) => {
+        const out = (0, lib_js_1.generateApiTs)([
+            { fileName: name, content: 'export default createEndpoint({});' },
+        ]);
+        (0, vitest_1.expect)(out).not.toBeNull();
+        (0, vitest_1.expect)(syntaxErrorsIn(out)).toEqual([]);
+    });
+    // The no-default-export branch puts the name in a `//` comment instead, so it
+    // needs its own case: there a line terminator ends the comment, not a string.
+    (0, vitest_1.it)('emits parseable TypeScript for an untyped endpoint with a newline', () => {
+        const out = (0, lib_js_1.generateApiTs)([
+            {
+                fileName: 'ok\nreport.ts',
+                content: 'export const report = createEndpoint({});',
+            },
+        ]);
+        (0, vitest_1.expect)(out).not.toBeNull();
+        (0, vitest_1.expect)(syntaxErrorsIn(out)).toEqual([]);
+    });
+});
+(0, vitest_1.describe)('generateEmailSdk integration id', () => {
+    // An LLM-authored `zite.config.json` key, validated only as
+    // `z.record(z.string(), …)`.
+    vitest_1.it.each([
+        ['an apostrophe', "resend'prod"],
+        ['a newline', 'resend\nprod'],
+        ['a trailing backslash', 'resend\\'],
+    ])('emits parseable TypeScript for an id with %s', (_what, id) => {
+        (0, vitest_1.expect)(syntaxErrorsIn((0, lib_js_1.generateEmailSdk)(id))).toEqual([]);
+    });
+});
 (0, vitest_1.describe)('generateBackendWrapperTs', () => {
     const output = (0, lib_js_1.generateBackendWrapperTs)();
     (0, vitest_1.it)('imports User from zitejs/auth', () => {

package/dist/esm/check/index.js

@@ -1,4 +1,4 @@
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import { existsSync, readdirSync } from 'fs';
 import { join } from 'path';
 function findAppDirs() {
@@ -9,9 +9,18 @@ function findAppDirs() {
         .filter(d => d.isDirectory())
         .map(d => d.name);
 }
-function run(cmd, cwd) {
+/**
+ * An argument array, not a command string, so no shell is involved.
+ *
+ * Every command below takes an app directory name straight off `readdirSync`.
+ * Through a shell, a directory named `x;touch PWNED;#` ran the injected command
+ * AND still printed `tsc --noEmit ... ✓` — a check that never executed
+ * reporting a pass, which is the worse half. Passing argv defeats both, and
+ * leaves nothing to escape.
+ */
+function run(file, args, cwd) {
     try {
-        const output = execSync(cmd, {
+        const output = execFileSync(file, args, {
             cwd,
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -75,7 +84,7 @@ export async function runCheck() {
         }
         else {
             process.stdout.write('  tsc --noEmit ... ');
-            const tsc = run(`npx tsc --noEmit -p ${tsconfigAppPath}`, '.');
+            const tsc = run('npx', ['tsc', '--noEmit', '-p', tsconfigAppPath], '.');
             if (tsc.ok) {
                 console.log('✓');
             }
@@ -90,7 +99,7 @@ export async function runCheck() {
         // `zitejs/*` alias has no generated file behind it; only the bundler knows.
         if (existsSync(join(appPath, 'src', 'api'))) {
             process.stdout.write('  bundle endpoints ... ');
-            const bundle = run(`npx zitejs bundle --app ${app}`, '.');
+            const bundle = run('npx', ['zitejs', 'bundle', '--app', app], '.');
             const failures = bundle.ok ? bundleFailures(bundle.output) : [bundle.output];
             if (failures.length === 0) {
                 console.log('✓');
@@ -104,7 +113,7 @@ export async function runCheck() {
         const viteConfig = join(appPath, 'vite.config.ts');
         if (existsSync(viteConfig)) {
             process.stdout.write('  vite build ... ');
-            const vite = run('npx vite build', appPath);
+            const vite = run('npx', ['vite', 'build'], appPath);
             if (vite.ok) {
                 console.log('✓');
             }

package/dist/esm/runtime/index.d.ts

@@ -121,8 +121,15 @@ export interface TableFindAllOptions<T = Record<string, unknown>> {
 export interface BulkCreateResult<T> {
     /** Absent when `records: []` was passed — the dispatch short-circuits before setting it. */
     success?: boolean;
+    /**
+     * The nested copy has no `id`: both dispatchers build it with
+     * `const { id, ...fields } = record`, so `fields` is the record *minus* the
+     * id. Typing it `T` (which requires `id`) made the common
+     * `{ id: rec.id, ...rec.fields }` idiom a TS2783 — the type promised the
+     * spread always overwrites `id` when at runtime it never does.
+     */
     records: Array<T & {
-        fields: T;
+        fields: Omit<T, "id">;
     }>;
 }
 /** A type alias, not an interface: an interface cannot extend a generic `Partial<T>`. */

package/dist/esm/runtime/writeResultTypes.test-d.js

@@ -11,6 +11,17 @@ describe("BulkCreateResult", () => {
         expectTypeOf().toEqualTypeOf();
         expectTypeOf().toEqualTypeOf();
     });
+    // Both dispatchers destructure `id` out before nesting
+    // (`const { id, ...fields } = record`), so `fields` must not claim one.
+    it("omits id from the nested copy", () => {
+        expectTypeOf().toEqualTypeOf();
+    });
+    // The idiom that regressed under `fields: T` (TS2783, "this spread always
+    // overwrites this property"). Compiling at all is the assertion.
+    it("allows the id-then-spread idiom", () => {
+        const rebuild = (rec) => ({ id: rec.id, ...rec.fields });
+        expectTypeOf().toEqualTypeOf();
+    });
     it("keeps success optional", () => {
         expectTypeOf().toEqualTypeOf();
     });

package/dist/esm/sync/lib.js

@@ -141,6 +141,34 @@ const ATTACHMENT_TYPES = [
     "",
 ];
 const MAX_SELECT_OPTIONS = 100;
+/**
+ * A select option label as a TypeScript string-literal type.
+ *
+ * `JSON.stringify` rather than hand-rolled quote escaping: a label is arbitrary
+ * user text, and a newline in one produced an unterminated literal that made the
+ * whole of `.zite/db.ts` unparseable — which breaks typecheck for every app in
+ * the project, not just the one that owns the table. Backslashes and control
+ * characters break it the same way. TS literal syntax is a superset of JSON's
+ * for strings, so the output is always valid.
+ */
+const tsStringLiteral = (value) => JSON.stringify(value);
+/**
+ * The same, single-quoted, for the emitters that write single-quoted source.
+ * The escaping still comes from `JSON.stringify` — only the delimiter differs —
+ * so newlines, backslashes and control characters stay handled.
+ */
+const tsSingleQuoted = (value) => `'${JSON.stringify(value).slice(1, -1).replace(/'/g, "\\'")}'`;
+/**
+ * User-controlled text inside a generated comment. Names reach both a `//` line
+ * and a one-line JSDoc, so a newline would end the first and a comment-close
+ * sequence would end the second — leaving the remainder to parse as code.
+ * Applied where the comment is written rather than at each contributor, so
+ * anything added to one later is covered by default.
+ */
+const commentSafe = (value) => value
+    .replace(/\*\//g, "* /")
+    .replace(/\s+/g, " ")
+    .trim();
 const NUMBER_FORMAT_EXAMPLES = {
     local: "1,000,000.50",
     comma_period: "1,000,000.50",
@@ -188,7 +216,7 @@ function tsTypeForSchemaField(def, variant = "read") {
         if (options && options.length > 0) {
             const literals = options
                 .slice(0, MAX_SELECT_OPTIONS)
-                .map((o) => `"${o.label.replace(/"/g, '\\"')}"`)
+                .map((o) => tsStringLiteral(o.label))
                 .join(" | ");
             const union = `${literals} | string`;
             // No `| null` on the read side — see FIELD_TYPE_MAP. The write side keeps
@@ -442,7 +470,7 @@ function buildLinkTableComments(schema) {
         "// Link tables for zite.sql() JOINs (use these exact names):",
     ];
     for (const e of entries) {
-        lines.push(`//   "${e.name}" — columns: "${e.cols[0]}", "${e.cols[1]}"`);
+        lines.push(`//   "${commentSafe(e.name)}" — columns: "${commentSafe(e.cols[0])}", "${commentSafe(e.cols[1])}"`);
     }
     return lines;
 }
@@ -538,7 +566,7 @@ export function generateDbTs(inputSchema) {
             const tsType = tsTypeForSchemaField(field.definition);
             const jsdoc = fieldJsdoc(field, table, schema);
             if (jsdoc) {
-                lines.push(`  /** ${jsdoc} */`);
+                lines.push(`  /** ${commentSafe(jsdoc)} */`);
             }
             // Optional, matching the pre-monorepo type (`required: ['id']` — "none of
             // these are required to be defined aside from 'id'"). A `fields:`
@@ -756,13 +784,13 @@ export function generateApiTs(endpointFiles) {
     if (skipped.length > 0) {
         lines.push("// Not endpoints, so no callers were generated for them:");
         for (const name of skipped)
-            lines.push(`//   ${name}`);
+            lines.push(`//   ${commentSafe(name)}`);
         lines.push("");
     }
     for (const { pascal, baseName, typed } of endpoints) {
         if (!typed)
             continue;
-        lines.push(`import type { default as _${pascal}Ep } from '../src/api/${baseName}';`);
+        lines.push(`import type { default as _${pascal}Ep } from ${tsSingleQuoted(`../src/api/${baseName}`)};`);
     }
     lines.push("");
     for (const { baseName, ident, pascal, stream, typed } of endpoints) {
@@ -770,10 +798,10 @@ export function generateApiTs(endpointFiles) {
             // Declared with `export const x = createEndpoint(...)` — the 1.0 shape.
             // The route is real and the bundler deploys it, so the caller has to
             // exist; there is just no default export to read its types from.
-            lines.push(`// '${baseName}' has no default export, so its input/output are untyped.`);
+            lines.push(`// ${commentSafe(`'${baseName}'`)} has no default export, so its input/output are untyped.`);
             lines.push(`export type ${pascal}InputType = unknown;`);
             lines.push(`export type ${pascal}OutputType = unknown;`);
-            lines.push(`export const ${ident} = ${stream ? "createStreamingCaller" : "createCaller"}<${pascal}InputType, ${pascal}OutputType>('${baseName}');`);
+            lines.push(`export const ${ident} = ${stream ? "createStreamingCaller" : "createCaller"}<${pascal}InputType, ${pascal}OutputType>(${tsSingleQuoted(baseName)});`);
             lines.push("");
             continue;
         }
@@ -792,7 +820,7 @@ export function generateApiTs(endpointFiles) {
         // Calling it `sendEmail` here made every hyphenated or snake_cased endpoint
         // a 404.
         const caller = stream ? "createStreamingCaller" : "createCaller";
-        lines.push(`export const ${ident} = ${caller}<${pascal}InputType, ${pascal}OutputType>('${baseName}');`);
+        lines.push(`export const ${ident} = ${caller}<${pascal}InputType, ${pascal}OutputType>(${tsSingleQuoted(baseName)});`);
         lines.push("");
     }
     lines.push("");
@@ -900,7 +928,7 @@ function airtableTsType(field, lock, depth, variant = "read") {
         choices.length > 0) {
         const literals = choices
             .slice(0, MAX_SELECT_OPTIONS)
-            .map((o) => `"${o.replace(/"/g, '\\"')}"`)
+            .map((o) => tsStringLiteral(o))
             .join(" | ");
         const union = `${literals} | string`;
         if (field.type === "multipleSelects")
@@ -1046,7 +1074,7 @@ export function generateAirtableTs(lock) {
     lines.push(...AIRTABLE_ATTACHMENT_TYPE);
     for (const table of lock.tables) {
         const recordType = `${table.sdkName}RecordType`;
-        lines.push(`/** A ${table.sdkName} record as it is read back. */`);
+        lines.push(`/** A ${commentSafe(table.sdkName)} record as it is read back. */`);
         lines.push(`export type ${recordType} = {`);
         lines.push("  id: string;");
         for (const field of table.fields) {
@@ -1054,7 +1082,7 @@ export function generateAirtableTs(lock) {
                 continue;
             const jsdoc = airtableFieldJsdoc(field, table, lock);
             if (jsdoc) {
-                lines.push(`  /** ${jsdoc} */`);
+                lines.push(`  /** ${commentSafe(jsdoc)} */`);
             }
             const tsType = airtableTsType(field, lock);
             // Optional, because Airtable omits a field from the response entirely
@@ -1068,7 +1096,7 @@ export function generateAirtableTs(lock) {
         // Read-only fields are omitted rather than typed: Airtable rejects a write
         // to a formula, rollup, lookup or autonumber with a 422.
         const writableFields = table.fields.filter((f) => f.sdkName !== "id" && !READ_ONLY_AIRTABLE_FIELDS.has(f.type));
-        lines.push(`/** What you may write when creating or updating a ${table.sdkName}. */`);
+        lines.push(`/** What you may write when creating or updating a ${commentSafe(table.sdkName)}. */`);
         lines.push(`export type ${table.sdkName}RecordInput = {`);
         for (const field of writableFields) {
             lines.push(`  ${field.sdkName}: ${airtableTsType(field, lock, 0, "write")};`);
@@ -1234,7 +1262,7 @@ export function generateEmailSdk(integrationId) {
         "  SendEmailResult,",
         "} from 'zitejs/runtime';",
         "",
-        `export const Email = createEmailClient('${integrationId}');`,
+        `export const Email = createEmailClient(${tsSingleQuoted(integrationId)});`,
         "",
     ].join("\n");
 }

package/dist/esm/sync/lib.test.js

@@ -1,5 +1,123 @@
 import { describe, it, expect } from 'vitest';
-import { generateBackendWrapperTs } from './lib.js';
+import ts from 'typescript';
+import { generateApiTs, generateBackendWrapperTs, generateDbTs, generateEmailSdk, } from './lib.js';
+/**
+ * Syntax errors in the emitted source. `.zite/db.ts` sits at the repo root and
+ * every app imports it, so anything unparseable here fails typecheck for the
+ * whole project — and the file is generated, so no one can edit their way out.
+ */
+const syntaxErrorsIn = (source) => (ts.transpileModule(source, {
+    reportDiagnostics: true,
+    compilerOptions: { target: ts.ScriptTarget.Latest },
+}).diagnostics ?? []).map(d => ts.flattenDiagnosticMessageText(d.messageText, ' '));
+const schemaWithSelectOption = (label) => ({
+    tables: [
+        {
+            id: 'tbl1',
+            sdkName: 'registrations',
+            fields: [
+                {
+                    id: 'fld1',
+                    sdkName: 'ticketType',
+                    definition: {
+                        type: 'single_select',
+                        template: { options: [{ label }] },
+                    },
+                },
+            ],
+        },
+    ],
+});
+describe('generateDbTs select option literals', () => {
+    // Reported from a migrated app: a consent paragraph pasted in as an option
+    // label carried a newline, so the emitted literal never closed and the whole
+    // generated file failed with TS1002 — taking every sibling app with it.
+    it.each([
+        ['a newline', 'I am 18 or above.\nI agree to the rules.'],
+        ['a carriage return', 'Lite Pass\r\nRegular Pass'],
+        ['a double quote', 'The "Premium" tier'],
+        ['a trailing backslash', 'Group / Crew Purchase\\'],
+        ['a tab', 'Lite\tPass'],
+    ])('emits parseable TypeScript for a label containing %s', (_what, label) => {
+        expect(syntaxErrorsIn(generateDbTs(schemaWithSelectOption(label)))).toEqual([]);
+    });
+    it('keeps the option readable in the union', () => {
+        const out = generateDbTs(schemaWithSelectOption('The "Premium" tier'));
+        expect(out).toContain('"The \\"Premium\\" tier"');
+    });
+});
+describe('generateDbTs field names in comments', () => {
+    // A field's display name is user text and reaches a one-line JSDoc. A
+    // comment-close sequence in it would end the comment early and leave the
+    // remainder to parse as code.
+    const schemaWithFieldNamed = (name) => ({
+        tables: [
+            {
+                id: 'tbl1',
+                sdkName: 'orders',
+                primaryFieldId: 'fld1',
+                fields: [
+                    {
+                        id: 'fld1',
+                        sdkName: 'amount',
+                        definition: {
+                            type: 'currency',
+                            name,
+                            template: { currencySymbol: '$' },
+                        },
+                    },
+                ],
+            },
+        ],
+    });
+    it.each([
+        ['a comment-close sequence', 'Total */ console.log(1); /*'],
+        ['a newline', 'Total\namount'],
+    ])('emits parseable TypeScript for a field named with %s', (_what, name) => {
+        expect(syntaxErrorsIn(generateDbTs(schemaWithFieldNamed(name)))).toEqual([]);
+    });
+});
+describe('generateApiTs endpoint file names', () => {
+    // An endpoint filename is the LLM's raw `writeFile` path argument — nothing
+    // validates its characters — and it lands in an import specifier, a comment
+    // and two string literals. `.zite/api.ts` is imported by every component that
+    // calls `api.*`, so one bad name takes the whole app down.
+    it.each([
+        ['an apostrophe', "it's.ts"],
+        ['a newline', 'ok\nreport.ts'],
+        ['a trailing backslash', 'back\\.ts'],
+        ['a double quote', 'say"hi.ts'],
+    ])('emits parseable TypeScript for a file named with %s', (_what, name) => {
+        const out = generateApiTs([
+            { fileName: name, content: 'export default createEndpoint({});' },
+        ]);
+        expect(out).not.toBeNull();
+        expect(syntaxErrorsIn(out)).toEqual([]);
+    });
+    // The no-default-export branch puts the name in a `//` comment instead, so it
+    // needs its own case: there a line terminator ends the comment, not a string.
+    it('emits parseable TypeScript for an untyped endpoint with a newline', () => {
+        const out = generateApiTs([
+            {
+                fileName: 'ok\nreport.ts',
+                content: 'export const report = createEndpoint({});',
+            },
+        ]);
+        expect(out).not.toBeNull();
+        expect(syntaxErrorsIn(out)).toEqual([]);
+    });
+});
+describe('generateEmailSdk integration id', () => {
+    // An LLM-authored `zite.config.json` key, validated only as
+    // `z.record(z.string(), …)`.
+    it.each([
+        ['an apostrophe', "resend'prod"],
+        ['a newline', 'resend\nprod'],
+        ['a trailing backslash', 'resend\\'],
+    ])('emits parseable TypeScript for an id with %s', (_what, id) => {
+        expect(syntaxErrorsIn(generateEmailSdk(id))).toEqual([]);
+    });
+});
 describe('generateBackendWrapperTs', () => {
     const output = generateBackendWrapperTs();
     it('imports User from zitejs/auth', () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zitejs",
-  "version": "0.9.107",
+  "version": "0.9.108",
   "description": "The Zite framework — build apps on Zite Database",
   "type": "module",
   "main": "./dist/cjs/index.js",