zitejs 0.9.107 → 0.9.109

package/dist/cjs/check/index.js

@@ -12,9 +12,18 @@ function findAppDirs() {
         .filter(d => d.isDirectory())
         .map(d => d.name);
 }
-function run(cmd, cwd) {
+/**
+ * An argument array, not a command string, so no shell is involved.
+ *
+ * Every command below takes an app directory name straight off `readdirSync`.
+ * Through a shell, a directory named `x;touch PWNED;#` ran the injected command
+ * AND still printed `tsc --noEmit ... ✓` — a check that never executed
+ * reporting a pass, which is the worse half. Passing argv defeats both, and
+ * leaves nothing to escape.
+ */
+function run(file, args, cwd) {
     try {
-        const output = (0, child_process_1.execSync)(cmd, {
+        const output = (0, child_process_1.execFileSync)(file, args, {
             cwd,
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -78,7 +87,7 @@ async function runCheck() {
         }
         else {
             process.stdout.write('  tsc --noEmit ... ');
-            const tsc = run(`npx tsc --noEmit -p ${tsconfigAppPath}`, '.');
+            const tsc = run('npx', ['tsc', '--noEmit', '-p', tsconfigAppPath], '.');
             if (tsc.ok) {
                 console.log('✓');
             }
@@ -93,7 +102,7 @@ async function runCheck() {
         // `zitejs/*` alias has no generated file behind it; only the bundler knows.
         if ((0, fs_1.existsSync)((0, path_1.join)(appPath, 'src', 'api'))) {
             process.stdout.write('  bundle endpoints ... ');
-            const bundle = run(`npx zitejs bundle --app ${app}`, '.');
+            const bundle = run('npx', ['zitejs', 'bundle', '--app', app], '.');
             const failures = bundle.ok ? bundleFailures(bundle.output) : [bundle.output];
             if (failures.length === 0) {
                 console.log('✓');
@@ -107,7 +116,7 @@ async function runCheck() {
         const viteConfig = (0, path_1.join)(appPath, 'vite.config.ts');
         if ((0, fs_1.existsSync)(viteConfig)) {
             process.stdout.write('  vite build ... ');
-            const vite = run('npx vite build', appPath);
+            const vite = run('npx', ['vite', 'build'], appPath);
             if (vite.ok) {
                 console.log('✓');
             }

package/dist/cjs/runtime/index.d.ts

@@ -1,4 +1,3 @@
-import type { NotificationsCreateParams, NotificationsCreateResult } from "../notifications/index.js";
 /**
  * A comparison against one field. Mirrors base-runner's operator set
  * (`LegacyWhereConditionOperators`); anything else in the object is ignored.
@@ -121,8 +120,15 @@ export interface TableFindAllOptions<T = Record<string, unknown>> {
 export interface BulkCreateResult<T> {
     /** Absent when `records: []` was passed — the dispatch short-circuits before setting it. */
     success?: boolean;
+    /**
+     * The nested copy has no `id`: both dispatchers build it with
+     * `const { id, ...fields } = record`, so `fields` is the record *minus* the
+     * id. Typing it `T` (which requires `id`) made the common
+     * `{ id: rec.id, ...rec.fields }` idiom a TS2783 — the type promised the
+     * spread always overwrites `id` when at runtime it never does.
+     */
     records: Array<T & {
-        fields: T;
+        fields: Omit<T, "id">;
     }>;
 }
 /** A type alias, not an interface: an interface cannot extend a generic `Partial<T>`. */
@@ -321,9 +327,6 @@ export interface EmailClient {
  * app's connected email integration key.
  */
 export declare function createEmailClient(integrationId: string): EmailClient;
-export declare function createNotificationsClient(): {
-    create(params: NotificationsCreateParams): Promise<NotificationsCreateResult>;
-};
 export type { NotificationLink, NotificationsCreateParams, NotificationsCreateResult, } from "../notifications/index.js";
 export { createCaller } from "../caller/index.js";
 export type { EndpointConfig } from "../caller/index.js";

package/dist/cjs/runtime/index.js

@@ -6,7 +6,6 @@ exports.createSqlClient = createSqlClient;
 exports.createAuthClient = createAuthClient;
 exports.createAirtableClient = createAirtableClient;
 exports.createEmailClient = createEmailClient;
-exports.createNotificationsClient = createNotificationsClient;
 const sdkCall_js_1 = require("../internal/sdkCall.js");
 const DB_INTEGRATION_ID = "databases";
 function getBaseId() {
@@ -126,11 +125,5 @@ function createEmailClient(integrationId) {
         send: (params) => (0, sdkCall_js_1.getSdkCall)()(integrationId, "Email", "send", params),
     };
 }
-const NOTIFICATIONS_SDK_INTEGRATION_ID = "__notifications__";
-function createNotificationsClient() {
-    return {
-        create: (params) => (0, sdkCall_js_1.getSdkCall)()(NOTIFICATIONS_SDK_INTEGRATION_ID, "ZiteNotifications", "create", params),
-    };
-}
 var index_js_1 = require("../caller/index.js");
 Object.defineProperty(exports, "createCaller", { enumerable: true, get: function () { return index_js_1.createCaller; } });

package/dist/cjs/runtime/writeResultTypes.test-d.js

@@ -13,6 +13,17 @@ const vitest_1 = require("vitest");
         (0, vitest_1.expectTypeOf)().toEqualTypeOf();
         (0, vitest_1.expectTypeOf)().toEqualTypeOf();
     });
+    // Both dispatchers destructure `id` out before nesting
+    // (`const { id, ...fields } = record`), so `fields` must not claim one.
+    (0, vitest_1.it)("omits id from the nested copy", () => {
+        (0, vitest_1.expectTypeOf)().toEqualTypeOf();
+    });
+    // The idiom that regressed under `fields: T` (TS2783, "this spread always
+    // overwrites this property"). Compiling at all is the assertion.
+    (0, vitest_1.it)("allows the id-then-spread idiom", () => {
+        const rebuild = (rec) => ({ id: rec.id, ...rec.fields });
+        (0, vitest_1.expectTypeOf)().toEqualTypeOf();
+    });
     (0, vitest_1.it)("keeps success optional", () => {
         (0, vitest_1.expectTypeOf)().toEqualTypeOf();
     });

package/dist/cjs/sync/lib.js

@@ -150,6 +150,31 @@ const ATTACHMENT_TYPES = [
     "",
 ];
 const MAX_SELECT_OPTIONS = 100;
+/**
+ * A select option label as a TypeScript string-literal type.
+ *
+ * `JSON.stringify` rather than hand-rolled quote escaping: a label is arbitrary
+ * user text, and a newline in one produced an unterminated literal that made the
+ * whole of `.zite/db.ts` unparseable — which breaks typecheck for every app in
+ * the project, not just the one that owns the table. Backslashes and control
+ * characters break it the same way. TS literal syntax is a superset of JSON's
+ * for strings, so the output is always valid.
+ */
+const tsStringLiteral = (value) => JSON.stringify(value);
+/**
+ * The same, single-quoted, for the emitters that write single-quoted source.
+ * The escaping still comes from `JSON.stringify` — only the delimiter differs —
+ * so newlines, backslashes and control characters stay handled.
+ */
+const tsSingleQuoted = (value) => `'${JSON.stringify(value).slice(1, -1).replace(/'/g, "\\'")}'`;
+/**
+ * User-controlled text inside a generated comment. Names reach both a `//` line
+ * and a one-line JSDoc, so a newline would end the first and a comment-close
+ * sequence would end the second — leaving the remainder to parse as code.
+ * Applied where the comment is written rather than at each contributor, so
+ * anything added to one later is covered by default.
+ */
+const commentSafe = (value) => value.replace(/\*\//g, "* /").replace(/\s+/g, " ").trim();
 const NUMBER_FORMAT_EXAMPLES = {
     local: "1,000,000.50",
     comma_period: "1,000,000.50",
@@ -200,7 +225,7 @@ function tsTypeForSchemaField(def, variant = "read") {
         if (options && options.length > 0) {
             const literals = options
                 .slice(0, MAX_SELECT_OPTIONS)
-                .map((o) => `"${o.label.replace(/"/g, '\\"')}"`)
+                .map((o) => tsStringLiteral(o.label))
                 .join(" | ");
             const union = `${literals} | string`;
             // No `| null` on the read side — see FIELD_TYPE_MAP. The write side keeps
@@ -454,7 +479,7 @@ function buildLinkTableComments(schema) {
         "// Link tables for zite.sql() JOINs (use these exact names):",
     ];
     for (const e of entries) {
-        lines.push(`//   "${e.name}" — columns: "${e.cols[0]}", "${e.cols[1]}"`);
+        lines.push(`//   "${commentSafe(e.name)}" — columns: "${commentSafe(e.cols[0])}", "${commentSafe(e.cols[1])}"`);
     }
     return lines;
 }
@@ -535,7 +560,7 @@ function generateDbTs(inputSchema) {
     lines.push("//   - SELECT only — use .create/.update/.delete for writes");
     lines.push('//   - Load the "zite:sql" skill for full SQL reference (formulas, lookups, etc.)');
     lines.push(...buildLinkTableComments(schema));
-    lines.push("import { createTableClient, createSqlClient, createNotificationsClient, createAuthClient } from 'zitejs/runtime';");
+    lines.push("import { createTableClient, createSqlClient, createAuthClient } from 'zitejs/runtime';");
     lines.push("");
     lines.push(...ATTACHMENT_TYPES);
     for (const table of tables) {
@@ -550,7 +575,7 @@ function generateDbTs(inputSchema) {
             const tsType = tsTypeForSchemaField(field.definition);
             const jsdoc = fieldJsdoc(field, table, schema);
             if (jsdoc) {
-                lines.push(`  /** ${jsdoc} */`);
+                lines.push(`  /** ${commentSafe(jsdoc)} */`);
             }
             // Optional, matching the pre-monorepo type (`required: ['id']` — "none of
             // these are required to be defined aside from 'id'"). A `fields:`
@@ -580,7 +605,10 @@ function generateDbTs(inputSchema) {
         lines.push(`  ${table.sdkName}: createTableClient<${className}RecordType, ${className}RecordInput>('${className}'),`);
     }
     lines.push(`  sql: createSqlClient(),`);
-    lines.push(`  notifications: createNotificationsClient(),`);
+    // No `notifications` here: it is a platform primitive, not something backed
+    // by the project database, so it lives at `zitejs/notifications` alongside
+    // `zitejs/pdf` and `zitejs/schedules`. Keeping it on `zite` cost a table
+    // named "Notifications" its accessor — see RESERVED_TABLE_ACCESSORS.
     lines.push(`  auth: createAuthClient<ZiteAuthUser>(),`);
     lines.push("};");
     lines.push("");
@@ -768,13 +796,13 @@ function generateApiTs(endpointFiles) {
     if (skipped.length > 0) {
         lines.push("// Not endpoints, so no callers were generated for them:");
         for (const name of skipped)
-            lines.push(`//   ${name}`);
+            lines.push(`//   ${commentSafe(name)}`);
         lines.push("");
     }
     for (const { pascal, baseName, typed } of endpoints) {
         if (!typed)
             continue;
-        lines.push(`import type { default as _${pascal}Ep } from '../src/api/${baseName}';`);
+        lines.push(`import type { default as _${pascal}Ep } from ${tsSingleQuoted(`../src/api/${baseName}`)};`);
     }
     lines.push("");
     for (const { baseName, ident, pascal, stream, typed } of endpoints) {
@@ -782,10 +810,10 @@ function generateApiTs(endpointFiles) {
             // Declared with `export const x = createEndpoint(...)` — the 1.0 shape.
             // The route is real and the bundler deploys it, so the caller has to
             // exist; there is just no default export to read its types from.
-            lines.push(`// '${baseName}' has no default export, so its input/output are untyped.`);
+            lines.push(`// ${commentSafe(`'${baseName}'`)} has no default export, so its input/output are untyped.`);
             lines.push(`export type ${pascal}InputType = unknown;`);
             lines.push(`export type ${pascal}OutputType = unknown;`);
-            lines.push(`export const ${ident} = ${stream ? "createStreamingCaller" : "createCaller"}<${pascal}InputType, ${pascal}OutputType>('${baseName}');`);
+            lines.push(`export const ${ident} = ${stream ? "createStreamingCaller" : "createCaller"}<${pascal}InputType, ${pascal}OutputType>(${tsSingleQuoted(baseName)});`);
             lines.push("");
             continue;
         }
@@ -804,7 +832,7 @@ function generateApiTs(endpointFiles) {
         // Calling it `sendEmail` here made every hyphenated or snake_cased endpoint
         // a 404.
         const caller = stream ? "createStreamingCaller" : "createCaller";
-        lines.push(`export const ${ident} = ${caller}<${pascal}InputType, ${pascal}OutputType>('${baseName}');`);
+        lines.push(`export const ${ident} = ${caller}<${pascal}InputType, ${pascal}OutputType>(${tsSingleQuoted(baseName)});`);
         lines.push("");
     }
     lines.push("");
@@ -874,7 +902,14 @@ const AIRTABLE_FIELD_INPUT_TYPE_MAP = {
     singleCollaborator: "{ id: string } | { email: string }",
     multipleCollaborators: "Array<{ id: string } | { email: string }>",
 };
-/** Mirrors `airtable/lib/attachment.d.ts`. Every property but `thumbnails` is present on a read. */
+/**
+ * Airtable's attachment object as the REST API really returns it.
+ *
+ * Not quite `airtable/lib/attachment.d.ts`: that declaration omits `width` and
+ * `height`, which the API does return for image attachments. 1.0 exposed them
+ * and apps read them, so leaving them out turns a working `photo.width` into a
+ * migration type error. Optional, because a non-image attachment has neither.
+ */
 const AIRTABLE_ATTACHMENT_TYPE = [
     "export type AirtableAttachment = {",
     "  id: string;",
@@ -884,6 +919,10 @@ const AIRTABLE_ATTACHMENT_TYPE = [
     "  size: number;",
     "  /** MIME type. */",
     "  type: string;",
+    "  /** Pixel width — images only. */",
+    "  width?: number;",
+    "  /** Pixel height — images only. */",
+    "  height?: number;",
     "  thumbnails?: {",
     "    small: { url: string; width: number; height: number };",
     "    large: { url: string; width: number; height: number };",
@@ -912,7 +951,7 @@ function airtableTsType(field, lock, depth, variant = "read") {
         choices.length > 0) {
         const literals = choices
             .slice(0, MAX_SELECT_OPTIONS)
-            .map((o) => `"${o.replace(/"/g, '\\"')}"`)
+            .map((o) => tsStringLiteral(o))
             .join(" | ");
         const union = `${literals} | string`;
         if (field.type === "multipleSelects")
@@ -1058,7 +1097,7 @@ function generateAirtableTs(lock) {
     lines.push(...AIRTABLE_ATTACHMENT_TYPE);
     for (const table of lock.tables) {
         const recordType = `${table.sdkName}RecordType`;
-        lines.push(`/** A ${table.sdkName} record as it is read back. */`);
+        lines.push(`/** A ${commentSafe(table.sdkName)} record as it is read back. */`);
         lines.push(`export type ${recordType} = {`);
         lines.push("  id: string;");
         for (const field of table.fields) {
@@ -1066,7 +1105,7 @@ function generateAirtableTs(lock) {
                 continue;
             const jsdoc = airtableFieldJsdoc(field, table, lock);
             if (jsdoc) {
-                lines.push(`  /** ${jsdoc} */`);
+                lines.push(`  /** ${commentSafe(jsdoc)} */`);
             }
             const tsType = airtableTsType(field, lock);
             // Optional, because Airtable omits a field from the response entirely
@@ -1080,7 +1119,7 @@ function generateAirtableTs(lock) {
         // Read-only fields are omitted rather than typed: Airtable rejects a write
         // to a formula, rollup, lookup or autonumber with a 422.
         const writableFields = table.fields.filter((f) => f.sdkName !== "id" && !READ_ONLY_AIRTABLE_FIELDS.has(f.type));
-        lines.push(`/** What you may write when creating or updating a ${table.sdkName}. */`);
+        lines.push(`/** What you may write when creating or updating a ${commentSafe(table.sdkName)}. */`);
         lines.push(`export type ${table.sdkName}RecordInput = {`);
         for (const field of writableFields) {
             lines.push(`  ${field.sdkName}: ${airtableTsType(field, lock, 0, "write")};`);
@@ -1246,7 +1285,7 @@ function generateEmailSdk(integrationId) {
         "  SendEmailResult,",
         "} from 'zitejs/runtime';",
         "",
-        `export const Email = createEmailClient('${integrationId}');`,
+        `export const Email = createEmailClient(${tsSingleQuoted(integrationId)});`,
         "",
     ].join("\n");
 }

package/dist/cjs/sync/lib.test.js

@@ -1,7 +1,161 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 const vitest_1 = require("vitest");
+const typescript_1 = __importDefault(require("typescript"));
 const lib_js_1 = require("./lib.js");
+/**
+ * Syntax errors in the emitted source. `.zite/db.ts` sits at the repo root and
+ * every app imports it, so anything unparseable here fails typecheck for the
+ * whole project — and the file is generated, so no one can edit their way out.
+ */
+const syntaxErrorsIn = (source) => (typescript_1.default.transpileModule(source, {
+    reportDiagnostics: true,
+    compilerOptions: { target: typescript_1.default.ScriptTarget.Latest },
+}).diagnostics ?? []).map(d => typescript_1.default.flattenDiagnosticMessageText(d.messageText, ' '));
+const schemaWithSelectOption = (label) => ({
+    tables: [
+        {
+            id: 'tbl1',
+            sdkName: 'registrations',
+            fields: [
+                {
+                    id: 'fld1',
+                    sdkName: 'ticketType',
+                    definition: {
+                        type: 'single_select',
+                        template: { options: [{ label }] },
+                    },
+                },
+            ],
+        },
+    ],
+});
+(0, vitest_1.describe)('generateDbTs select option literals', () => {
+    // Reported from a migrated app: a consent paragraph pasted in as an option
+    // label carried a newline, so the emitted literal never closed and the whole
+    // generated file failed with TS1002 — taking every sibling app with it.
+    vitest_1.it.each([
+        ['a newline', 'I am 18 or above.\nI agree to the rules.'],
+        ['a carriage return', 'Lite Pass\r\nRegular Pass'],
+        ['a double quote', 'The "Premium" tier'],
+        ['a trailing backslash', 'Group / Crew Purchase\\'],
+        ['a tab', 'Lite\tPass'],
+    ])('emits parseable TypeScript for a label containing %s', (_what, label) => {
+        (0, vitest_1.expect)(syntaxErrorsIn((0, lib_js_1.generateDbTs)(schemaWithSelectOption(label)))).toEqual([]);
+    });
+    (0, vitest_1.it)('keeps the option readable in the union', () => {
+        const out = (0, lib_js_1.generateDbTs)(schemaWithSelectOption('The "Premium" tier'));
+        (0, vitest_1.expect)(out).toContain('"The \\"Premium\\" tier"');
+    });
+});
+(0, vitest_1.describe)('generateAirtableTs attachment type', () => {
+    const lockWithAttachment = {
+        integrationId: 'airtable',
+        tables: [
+            {
+                id: 'tbl1',
+                sdkName: 'Speakers',
+                primaryFieldId: 'fld1',
+                fields: [
+                    { id: 'fld1', sdkName: 'name', type: 'singleLineText', name: 'Name' },
+                    {
+                        id: 'fld2',
+                        sdkName: 'headshot',
+                        type: 'multipleAttachments',
+                        name: 'Headshot',
+                    },
+                ],
+            },
+        ],
+    };
+    // Reported from a migrated app reading `photo.width` to lay out an image
+    // grid. Airtable returns width/height on image attachments and 1.0 exposed
+    // them; `airtable/lib/attachment.d.ts`, which this type was copied from,
+    // omits both — so the read became a TS2339 the app could not edit away.
+    vitest_1.it.each(['width', 'height'])('exposes %s, which Airtable returns for images', prop => {
+        const out = (0, lib_js_1.generateAirtableTs)(lockWithAttachment);
+        (0, vitest_1.expect)(out).not.toBeNull();
+        (0, vitest_1.expect)(out).toContain(`  ${prop}?: number;`);
+    });
+    (0, vitest_1.it)('emits parseable TypeScript', () => {
+        (0, vitest_1.expect)(syntaxErrorsIn((0, lib_js_1.generateAirtableTs)(lockWithAttachment) ?? '')).toEqual([]);
+    });
+});
+(0, vitest_1.describe)('generateDbTs field names in comments', () => {
+    // A field's display name is user text and reaches a one-line JSDoc. A
+    // comment-close sequence in it would end the comment early and leave the
+    // remainder to parse as code.
+    const schemaWithFieldNamed = (name) => ({
+        tables: [
+            {
+                id: 'tbl1',
+                sdkName: 'orders',
+                primaryFieldId: 'fld1',
+                fields: [
+                    {
+                        id: 'fld1',
+                        sdkName: 'amount',
+                        definition: {
+                            type: 'currency',
+                            name,
+                            template: { currencySymbol: '$' },
+                        },
+                    },
+                ],
+            },
+        ],
+    });
+    vitest_1.it.each([
+        ['a comment-close sequence', 'Total */ console.log(1); /*'],
+        ['a newline', 'Total\namount'],
+    ])('emits parseable TypeScript for a field named with %s', (_what, name) => {
+        (0, vitest_1.expect)(syntaxErrorsIn((0, lib_js_1.generateDbTs)(schemaWithFieldNamed(name)))).toEqual([]);
+    });
+});
+(0, vitest_1.describe)('generateApiTs endpoint file names', () => {
+    // An endpoint filename is the LLM's raw `writeFile` path argument — nothing
+    // validates its characters — and it lands in an import specifier, a comment
+    // and two string literals. `.zite/api.ts` is imported by every component that
+    // calls `api.*`, so one bad name takes the whole app down.
+    vitest_1.it.each([
+        ['an apostrophe', "it's.ts"],
+        ['a newline', 'ok\nreport.ts'],
+        ['a trailing backslash', 'back\\.ts'],
+        ['a double quote', 'say"hi.ts'],
+    ])('emits parseable TypeScript for a file named with %s', (_what, name) => {
+        const out = (0, lib_js_1.generateApiTs)([
+            { fileName: name, content: 'export default createEndpoint({});' },
+        ]);
+        (0, vitest_1.expect)(out).not.toBeNull();
+        (0, vitest_1.expect)(syntaxErrorsIn(out)).toEqual([]);
+    });
+    // The no-default-export branch puts the name in a `//` comment instead, so it
+    // needs its own case: there a line terminator ends the comment, not a string.
+    (0, vitest_1.it)('emits parseable TypeScript for an untyped endpoint with a newline', () => {
+        const out = (0, lib_js_1.generateApiTs)([
+            {
+                fileName: 'ok\nreport.ts',
+                content: 'export const report = createEndpoint({});',
+            },
+        ]);
+        (0, vitest_1.expect)(out).not.toBeNull();
+        (0, vitest_1.expect)(syntaxErrorsIn(out)).toEqual([]);
+    });
+});
+(0, vitest_1.describe)('generateEmailSdk integration id', () => {
+    // An LLM-authored `zite.config.json` key, validated only as
+    // `z.record(z.string(), …)`.
+    vitest_1.it.each([
+        ['an apostrophe', "resend'prod"],
+        ['a newline', 'resend\nprod'],
+        ['a trailing backslash', 'resend\\'],
+    ])('emits parseable TypeScript for an id with %s', (_what, id) => {
+        (0, vitest_1.expect)(syntaxErrorsIn((0, lib_js_1.generateEmailSdk)(id))).toEqual([]);
+    });
+});
 (0, vitest_1.describe)('generateBackendWrapperTs', () => {
     const output = (0, lib_js_1.generateBackendWrapperTs)();
     (0, vitest_1.it)('imports User from zitejs/auth', () => {

package/dist/cjs/sync/sdkNames.d.ts

@@ -36,8 +36,15 @@ export declare function toSdkName(name: string): string;
 /**
  * Accessors `generateDbTs` puts on the `zite` object itself, after the tables.
  * A table that allocates one of these produces a duplicate key.
+ *
+ * `notifications` used to be here and no longer is: it was a platform
+ * primitive hanging off `zite`, so a table named "Notifications" collided with
+ * it and — because the sentinel was written last — lost its client entirely.
+ * Moving it to `zitejs/notifications` removes the collision rather than
+ * managing it, and frees the name for the table that wants it. Everything left
+ * is genuinely backed by the project database.
  */
-export declare const RESERVED_TABLE_ACCESSORS: readonly ["sql", "notifications", "auth"];
+export declare const RESERVED_TABLE_ACCESSORS: readonly ["sql", "auth"];
 /**
  * Never safe as a generated key, in any namespace. Assigning `__proto__` in an
  * object literal sets the prototype rather than defining a property, and

package/dist/cjs/sync/sdkNames.js

@@ -66,12 +66,15 @@ function toSdkName(name) {
 /**
  * Accessors `generateDbTs` puts on the `zite` object itself, after the tables.
  * A table that allocates one of these produces a duplicate key.
+ *
+ * `notifications` used to be here and no longer is: it was a platform
+ * primitive hanging off `zite`, so a table named "Notifications" collided with
+ * it and — because the sentinel was written last — lost its client entirely.
+ * Moving it to `zitejs/notifications` removes the collision rather than
+ * managing it, and frees the name for the table that wants it. Everything left
+ * is genuinely backed by the project database.
  */
-exports.RESERVED_TABLE_ACCESSORS = [
-    "sql",
-    "notifications",
-    "auth",
-];
+exports.RESERVED_TABLE_ACCESSORS = ["sql", "auth"];
 /**
  * Never safe as a generated key, in any namespace. Assigning `__proto__` in an
  * object literal sets the prototype rather than defining a property, and

package/dist/cjs/sync/sdkNames.test.js

@@ -33,17 +33,18 @@ const recordTypeKeys = (source, typeName) => {
 };
 (0, vitest_1.describe)("reserved platform accessors", () => {
     // Sudzy Dashboard: a table named "Notifications" emitted a second
-    // `notifications:` key, and the platform client — written last — won. The
+    // `notifications:` key and the platform client — written last — won, so the
     // table lost findAll and typed as `{ create(NotificationsCreateParams) }`.
-    (0, vitest_1.it)("moves a table off the notifications accessor", () => {
+    // The platform client has since moved to `zitejs/notifications`, so the name
+    // belongs to the table again and there is nothing left to collide with.
+    (0, vitest_1.it)("lets a table keep the notifications accessor", () => {
         const schema = (0, lib_js_1.generateSchema)(database([{ id: "tbl_1", name: "Notifications", fields: [] }]));
-        (0, vitest_1.expect)(schema.tables[0].sdkName).toBe("notifications2");
+        (0, vitest_1.expect)(schema.tables[0].sdkName).toBe("notifications");
         const keys = ziteKeys((0, lib_js_1.generateDbTs)(schema));
-        (0, vitest_1.expect)(keys).toContain("notifications2");
         (0, vitest_1.expect)(keys.filter((k) => k === "notifications")).toHaveLength(1);
         (0, vitest_1.expect)(new Set(keys).size).toBe(keys.length);
     });
-    vitest_1.it.each(["sql", "auth", "notifications"])("keeps the platform %s accessor for the platform", (reserved) => {
+    vitest_1.it.each(["sql", "auth"])("keeps the platform %s accessor for the platform", (reserved) => {
         const schema = (0, lib_js_1.generateSchema)(database([{ id: "tbl_1", name: reserved, fields: [] }]));
         (0, vitest_1.expect)(schema.tables[0].sdkName).toBe(`${reserved}2`);
         const keys = ziteKeys((0, lib_js_1.generateDbTs)(schema));
@@ -192,14 +193,17 @@ const recordTypeKeys = (source, typeName) => {
     // `zitejs generate` reads it with no generateSchema pass in front, so this is
     // the only thing standing between it and a TS1117 it cannot build past.
     (0, vitest_1.it)("repairs a committed schema that already holds the collision", () => {
+        // `sql`, not `notifications` — the latter stopped being a platform
+        // accessor when the client moved to `zitejs/notifications`, so a schema
+        // holding it is no longer a collision to repair.
         const source = (0, lib_js_1.generateDbTs)({
             tables: [
-                { id: "tbl_1", sdkName: "notifications", fields: [] },
+                { id: "tbl_1", sdkName: "sql", fields: [] },
                 { id: "tbl_2", sdkName: "orders", fields: [] },
             ],
         });
         const keys = ziteKeys(source);
         (0, vitest_1.expect)(new Set(keys).size).toBe(keys.length);
-        (0, vitest_1.expect)(keys).toContain("notifications2");
+        (0, vitest_1.expect)(keys).toContain("sql2");
     });
 });

package/dist/esm/check/index.js

@@ -1,4 +1,4 @@
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import { existsSync, readdirSync } from 'fs';
 import { join } from 'path';
 function findAppDirs() {
@@ -9,9 +9,18 @@ function findAppDirs() {
         .filter(d => d.isDirectory())
         .map(d => d.name);
 }
-function run(cmd, cwd) {
+/**
+ * An argument array, not a command string, so no shell is involved.
+ *
+ * Every command below takes an app directory name straight off `readdirSync`.
+ * Through a shell, a directory named `x;touch PWNED;#` ran the injected command
+ * AND still printed `tsc --noEmit ... ✓` — a check that never executed
+ * reporting a pass, which is the worse half. Passing argv defeats both, and
+ * leaves nothing to escape.
+ */
+function run(file, args, cwd) {
     try {
-        const output = execSync(cmd, {
+        const output = execFileSync(file, args, {
             cwd,
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -75,7 +84,7 @@ export async function runCheck() {
         }
         else {
             process.stdout.write('  tsc --noEmit ... ');
-            const tsc = run(`npx tsc --noEmit -p ${tsconfigAppPath}`, '.');
+            const tsc = run('npx', ['tsc', '--noEmit', '-p', tsconfigAppPath], '.');
             if (tsc.ok) {
                 console.log('✓');
             }
@@ -90,7 +99,7 @@ export async function runCheck() {
         // `zitejs/*` alias has no generated file behind it; only the bundler knows.
         if (existsSync(join(appPath, 'src', 'api'))) {
             process.stdout.write('  bundle endpoints ... ');
-            const bundle = run(`npx zitejs bundle --app ${app}`, '.');
+            const bundle = run('npx', ['zitejs', 'bundle', '--app', app], '.');
             const failures = bundle.ok ? bundleFailures(bundle.output) : [bundle.output];
             if (failures.length === 0) {
                 console.log('✓');
@@ -104,7 +113,7 @@ export async function runCheck() {
         const viteConfig = join(appPath, 'vite.config.ts');
         if (existsSync(viteConfig)) {
             process.stdout.write('  vite build ... ');
-            const vite = run('npx vite build', appPath);
+            const vite = run('npx', ['vite', 'build'], appPath);
             if (vite.ok) {
                 console.log('✓');
             }

package/dist/esm/runtime/index.d.ts

@@ -1,4 +1,3 @@
-import type { NotificationsCreateParams, NotificationsCreateResult } from "../notifications/index.js";
 /**
  * A comparison against one field. Mirrors base-runner's operator set
  * (`LegacyWhereConditionOperators`); anything else in the object is ignored.
@@ -121,8 +120,15 @@ export interface TableFindAllOptions<T = Record<string, unknown>> {
 export interface BulkCreateResult<T> {
     /** Absent when `records: []` was passed — the dispatch short-circuits before setting it. */
     success?: boolean;
+    /**
+     * The nested copy has no `id`: both dispatchers build it with
+     * `const { id, ...fields } = record`, so `fields` is the record *minus* the
+     * id. Typing it `T` (which requires `id`) made the common
+     * `{ id: rec.id, ...rec.fields }` idiom a TS2783 — the type promised the
+     * spread always overwrites `id` when at runtime it never does.
+     */
     records: Array<T & {
-        fields: T;
+        fields: Omit<T, "id">;
     }>;
 }
 /** A type alias, not an interface: an interface cannot extend a generic `Partial<T>`. */
@@ -321,9 +327,6 @@ export interface EmailClient {
  * app's connected email integration key.
  */
 export declare function createEmailClient(integrationId: string): EmailClient;
-export declare function createNotificationsClient(): {
-    create(params: NotificationsCreateParams): Promise<NotificationsCreateResult>;
-};
 export type { NotificationLink, NotificationsCreateParams, NotificationsCreateResult, } from "../notifications/index.js";
 export { createCaller } from "../caller/index.js";
 export type { EndpointConfig } from "../caller/index.js";

package/dist/esm/runtime/index.js

@@ -117,10 +117,4 @@ export function createEmailClient(integrationId) {
         send: (params) => getSdkCall()(integrationId, "Email", "send", params),
     };
 }
-const NOTIFICATIONS_SDK_INTEGRATION_ID = "__notifications__";
-export function createNotificationsClient() {
-    return {
-        create: (params) => getSdkCall()(NOTIFICATIONS_SDK_INTEGRATION_ID, "ZiteNotifications", "create", params),
-    };
-}
 export { createCaller } from "../caller/index.js";

package/dist/esm/runtime/writeResultTypes.test-d.js

@@ -11,6 +11,17 @@ describe("BulkCreateResult", () => {
         expectTypeOf().toEqualTypeOf();
         expectTypeOf().toEqualTypeOf();
     });
+    // Both dispatchers destructure `id` out before nesting
+    // (`const { id, ...fields } = record`), so `fields` must not claim one.
+    it("omits id from the nested copy", () => {
+        expectTypeOf().toEqualTypeOf();
+    });
+    // The idiom that regressed under `fields: T` (TS2783, "this spread always
+    // overwrites this property"). Compiling at all is the assertion.
+    it("allows the id-then-spread idiom", () => {
+        const rebuild = (rec) => ({ id: rec.id, ...rec.fields });
+        expectTypeOf().toEqualTypeOf();
+    });
     it("keeps success optional", () => {
         expectTypeOf().toEqualTypeOf();
     });

package/dist/esm/sync/lib.js

@@ -141,6 +141,31 @@ const ATTACHMENT_TYPES = [
     "",
 ];
 const MAX_SELECT_OPTIONS = 100;
+/**
+ * A select option label as a TypeScript string-literal type.
+ *
+ * `JSON.stringify` rather than hand-rolled quote escaping: a label is arbitrary
+ * user text, and a newline in one produced an unterminated literal that made the
+ * whole of `.zite/db.ts` unparseable — which breaks typecheck for every app in
+ * the project, not just the one that owns the table. Backslashes and control
+ * characters break it the same way. TS literal syntax is a superset of JSON's
+ * for strings, so the output is always valid.
+ */
+const tsStringLiteral = (value) => JSON.stringify(value);
+/**
+ * The same, single-quoted, for the emitters that write single-quoted source.
+ * The escaping still comes from `JSON.stringify` — only the delimiter differs —
+ * so newlines, backslashes and control characters stay handled.
+ */
+const tsSingleQuoted = (value) => `'${JSON.stringify(value).slice(1, -1).replace(/'/g, "\\'")}'`;
+/**
+ * User-controlled text inside a generated comment. Names reach both a `//` line
+ * and a one-line JSDoc, so a newline would end the first and a comment-close
+ * sequence would end the second — leaving the remainder to parse as code.
+ * Applied where the comment is written rather than at each contributor, so
+ * anything added to one later is covered by default.
+ */
+const commentSafe = (value) => value.replace(/\*\//g, "* /").replace(/\s+/g, " ").trim();
 const NUMBER_FORMAT_EXAMPLES = {
     local: "1,000,000.50",
     comma_period: "1,000,000.50",
@@ -188,7 +213,7 @@ function tsTypeForSchemaField(def, variant = "read") {
         if (options && options.length > 0) {
             const literals = options
                 .slice(0, MAX_SELECT_OPTIONS)
-                .map((o) => `"${o.label.replace(/"/g, '\\"')}"`)
+                .map((o) => tsStringLiteral(o.label))
                 .join(" | ");
             const union = `${literals} | string`;
             // No `| null` on the read side — see FIELD_TYPE_MAP. The write side keeps
@@ -442,7 +467,7 @@ function buildLinkTableComments(schema) {
         "// Link tables for zite.sql() JOINs (use these exact names):",
     ];
     for (const e of entries) {
-        lines.push(`//   "${e.name}" — columns: "${e.cols[0]}", "${e.cols[1]}"`);
+        lines.push(`//   "${commentSafe(e.name)}" — columns: "${commentSafe(e.cols[0])}", "${commentSafe(e.cols[1])}"`);
     }
     return lines;
 }
@@ -523,7 +548,7 @@ export function generateDbTs(inputSchema) {
     lines.push("//   - SELECT only — use .create/.update/.delete for writes");
     lines.push('//   - Load the "zite:sql" skill for full SQL reference (formulas, lookups, etc.)');
     lines.push(...buildLinkTableComments(schema));
-    lines.push("import { createTableClient, createSqlClient, createNotificationsClient, createAuthClient } from 'zitejs/runtime';");
+    lines.push("import { createTableClient, createSqlClient, createAuthClient } from 'zitejs/runtime';");
     lines.push("");
     lines.push(...ATTACHMENT_TYPES);
     for (const table of tables) {
@@ -538,7 +563,7 @@ export function generateDbTs(inputSchema) {
             const tsType = tsTypeForSchemaField(field.definition);
             const jsdoc = fieldJsdoc(field, table, schema);
             if (jsdoc) {
-                lines.push(`  /** ${jsdoc} */`);
+                lines.push(`  /** ${commentSafe(jsdoc)} */`);
             }
             // Optional, matching the pre-monorepo type (`required: ['id']` — "none of
             // these are required to be defined aside from 'id'"). A `fields:`
@@ -568,7 +593,10 @@ export function generateDbTs(inputSchema) {
         lines.push(`  ${table.sdkName}: createTableClient<${className}RecordType, ${className}RecordInput>('${className}'),`);
     }
     lines.push(`  sql: createSqlClient(),`);
-    lines.push(`  notifications: createNotificationsClient(),`);
+    // No `notifications` here: it is a platform primitive, not something backed
+    // by the project database, so it lives at `zitejs/notifications` alongside
+    // `zitejs/pdf` and `zitejs/schedules`. Keeping it on `zite` cost a table
+    // named "Notifications" its accessor — see RESERVED_TABLE_ACCESSORS.
     lines.push(`  auth: createAuthClient<ZiteAuthUser>(),`);
     lines.push("};");
     lines.push("");
@@ -756,13 +784,13 @@ export function generateApiTs(endpointFiles) {
     if (skipped.length > 0) {
         lines.push("// Not endpoints, so no callers were generated for them:");
         for (const name of skipped)
-            lines.push(`//   ${name}`);
+            lines.push(`//   ${commentSafe(name)}`);
         lines.push("");
     }
     for (const { pascal, baseName, typed } of endpoints) {
         if (!typed)
             continue;
-        lines.push(`import type { default as _${pascal}Ep } from '../src/api/${baseName}';`);
+        lines.push(`import type { default as _${pascal}Ep } from ${tsSingleQuoted(`../src/api/${baseName}`)};`);
     }
     lines.push("");
     for (const { baseName, ident, pascal, stream, typed } of endpoints) {
@@ -770,10 +798,10 @@ export function generateApiTs(endpointFiles) {
             // Declared with `export const x = createEndpoint(...)` — the 1.0 shape.
             // The route is real and the bundler deploys it, so the caller has to
             // exist; there is just no default export to read its types from.
-            lines.push(`// '${baseName}' has no default export, so its input/output are untyped.`);
+            lines.push(`// ${commentSafe(`'${baseName}'`)} has no default export, so its input/output are untyped.`);
             lines.push(`export type ${pascal}InputType = unknown;`);
             lines.push(`export type ${pascal}OutputType = unknown;`);
-            lines.push(`export const ${ident} = ${stream ? "createStreamingCaller" : "createCaller"}<${pascal}InputType, ${pascal}OutputType>('${baseName}');`);
+            lines.push(`export const ${ident} = ${stream ? "createStreamingCaller" : "createCaller"}<${pascal}InputType, ${pascal}OutputType>(${tsSingleQuoted(baseName)});`);
             lines.push("");
             continue;
         }
@@ -792,7 +820,7 @@ export function generateApiTs(endpointFiles) {
         // Calling it `sendEmail` here made every hyphenated or snake_cased endpoint
         // a 404.
         const caller = stream ? "createStreamingCaller" : "createCaller";
-        lines.push(`export const ${ident} = ${caller}<${pascal}InputType, ${pascal}OutputType>('${baseName}');`);
+        lines.push(`export const ${ident} = ${caller}<${pascal}InputType, ${pascal}OutputType>(${tsSingleQuoted(baseName)});`);
         lines.push("");
     }
     lines.push("");
@@ -862,7 +890,14 @@ const AIRTABLE_FIELD_INPUT_TYPE_MAP = {
     singleCollaborator: "{ id: string } | { email: string }",
     multipleCollaborators: "Array<{ id: string } | { email: string }>",
 };
-/** Mirrors `airtable/lib/attachment.d.ts`. Every property but `thumbnails` is present on a read. */
+/**
+ * Airtable's attachment object as the REST API really returns it.
+ *
+ * Not quite `airtable/lib/attachment.d.ts`: that declaration omits `width` and
+ * `height`, which the API does return for image attachments. 1.0 exposed them
+ * and apps read them, so leaving them out turns a working `photo.width` into a
+ * migration type error. Optional, because a non-image attachment has neither.
+ */
 const AIRTABLE_ATTACHMENT_TYPE = [
     "export type AirtableAttachment = {",
     "  id: string;",
@@ -872,6 +907,10 @@ const AIRTABLE_ATTACHMENT_TYPE = [
     "  size: number;",
     "  /** MIME type. */",
     "  type: string;",
+    "  /** Pixel width — images only. */",
+    "  width?: number;",
+    "  /** Pixel height — images only. */",
+    "  height?: number;",
     "  thumbnails?: {",
     "    small: { url: string; width: number; height: number };",
     "    large: { url: string; width: number; height: number };",
@@ -900,7 +939,7 @@ function airtableTsType(field, lock, depth, variant = "read") {
         choices.length > 0) {
         const literals = choices
             .slice(0, MAX_SELECT_OPTIONS)
-            .map((o) => `"${o.replace(/"/g, '\\"')}"`)
+            .map((o) => tsStringLiteral(o))
             .join(" | ");
         const union = `${literals} | string`;
         if (field.type === "multipleSelects")
@@ -1046,7 +1085,7 @@ export function generateAirtableTs(lock) {
     lines.push(...AIRTABLE_ATTACHMENT_TYPE);
     for (const table of lock.tables) {
         const recordType = `${table.sdkName}RecordType`;
-        lines.push(`/** A ${table.sdkName} record as it is read back. */`);
+        lines.push(`/** A ${commentSafe(table.sdkName)} record as it is read back. */`);
         lines.push(`export type ${recordType} = {`);
         lines.push("  id: string;");
         for (const field of table.fields) {
@@ -1054,7 +1093,7 @@ export function generateAirtableTs(lock) {
                 continue;
             const jsdoc = airtableFieldJsdoc(field, table, lock);
             if (jsdoc) {
-                lines.push(`  /** ${jsdoc} */`);
+                lines.push(`  /** ${commentSafe(jsdoc)} */`);
             }
             const tsType = airtableTsType(field, lock);
             // Optional, because Airtable omits a field from the response entirely
@@ -1068,7 +1107,7 @@ export function generateAirtableTs(lock) {
         // Read-only fields are omitted rather than typed: Airtable rejects a write
         // to a formula, rollup, lookup or autonumber with a 422.
         const writableFields = table.fields.filter((f) => f.sdkName !== "id" && !READ_ONLY_AIRTABLE_FIELDS.has(f.type));
-        lines.push(`/** What you may write when creating or updating a ${table.sdkName}. */`);
+        lines.push(`/** What you may write when creating or updating a ${commentSafe(table.sdkName)}. */`);
         lines.push(`export type ${table.sdkName}RecordInput = {`);
         for (const field of writableFields) {
             lines.push(`  ${field.sdkName}: ${airtableTsType(field, lock, 0, "write")};`);
@@ -1234,7 +1273,7 @@ export function generateEmailSdk(integrationId) {
         "  SendEmailResult,",
         "} from 'zitejs/runtime';",
         "",
-        `export const Email = createEmailClient('${integrationId}');`,
+        `export const Email = createEmailClient(${tsSingleQuoted(integrationId)});`,
         "",
     ].join("\n");
 }

package/dist/esm/sync/lib.test.js

@@ -1,5 +1,156 @@
 import { describe, it, expect } from 'vitest';
-import { generateBackendWrapperTs } from './lib.js';
+import ts from 'typescript';
+import { generateAirtableTs, generateApiTs, generateBackendWrapperTs, generateDbTs, generateEmailSdk, } from './lib.js';
+/**
+ * Syntax errors in the emitted source. `.zite/db.ts` sits at the repo root and
+ * every app imports it, so anything unparseable here fails typecheck for the
+ * whole project — and the file is generated, so no one can edit their way out.
+ */
+const syntaxErrorsIn = (source) => (ts.transpileModule(source, {
+    reportDiagnostics: true,
+    compilerOptions: { target: ts.ScriptTarget.Latest },
+}).diagnostics ?? []).map(d => ts.flattenDiagnosticMessageText(d.messageText, ' '));
+const schemaWithSelectOption = (label) => ({
+    tables: [
+        {
+            id: 'tbl1',
+            sdkName: 'registrations',
+            fields: [
+                {
+                    id: 'fld1',
+                    sdkName: 'ticketType',
+                    definition: {
+                        type: 'single_select',
+                        template: { options: [{ label }] },
+                    },
+                },
+            ],
+        },
+    ],
+});
+describe('generateDbTs select option literals', () => {
+    // Reported from a migrated app: a consent paragraph pasted in as an option
+    // label carried a newline, so the emitted literal never closed and the whole
+    // generated file failed with TS1002 — taking every sibling app with it.
+    it.each([
+        ['a newline', 'I am 18 or above.\nI agree to the rules.'],
+        ['a carriage return', 'Lite Pass\r\nRegular Pass'],
+        ['a double quote', 'The "Premium" tier'],
+        ['a trailing backslash', 'Group / Crew Purchase\\'],
+        ['a tab', 'Lite\tPass'],
+    ])('emits parseable TypeScript for a label containing %s', (_what, label) => {
+        expect(syntaxErrorsIn(generateDbTs(schemaWithSelectOption(label)))).toEqual([]);
+    });
+    it('keeps the option readable in the union', () => {
+        const out = generateDbTs(schemaWithSelectOption('The "Premium" tier'));
+        expect(out).toContain('"The \\"Premium\\" tier"');
+    });
+});
+describe('generateAirtableTs attachment type', () => {
+    const lockWithAttachment = {
+        integrationId: 'airtable',
+        tables: [
+            {
+                id: 'tbl1',
+                sdkName: 'Speakers',
+                primaryFieldId: 'fld1',
+                fields: [
+                    { id: 'fld1', sdkName: 'name', type: 'singleLineText', name: 'Name' },
+                    {
+                        id: 'fld2',
+                        sdkName: 'headshot',
+                        type: 'multipleAttachments',
+                        name: 'Headshot',
+                    },
+                ],
+            },
+        ],
+    };
+    // Reported from a migrated app reading `photo.width` to lay out an image
+    // grid. Airtable returns width/height on image attachments and 1.0 exposed
+    // them; `airtable/lib/attachment.d.ts`, which this type was copied from,
+    // omits both — so the read became a TS2339 the app could not edit away.
+    it.each(['width', 'height'])('exposes %s, which Airtable returns for images', prop => {
+        const out = generateAirtableTs(lockWithAttachment);
+        expect(out).not.toBeNull();
+        expect(out).toContain(`  ${prop}?: number;`);
+    });
+    it('emits parseable TypeScript', () => {
+        expect(syntaxErrorsIn(generateAirtableTs(lockWithAttachment) ?? '')).toEqual([]);
+    });
+});
+describe('generateDbTs field names in comments', () => {
+    // A field's display name is user text and reaches a one-line JSDoc. A
+    // comment-close sequence in it would end the comment early and leave the
+    // remainder to parse as code.
+    const schemaWithFieldNamed = (name) => ({
+        tables: [
+            {
+                id: 'tbl1',
+                sdkName: 'orders',
+                primaryFieldId: 'fld1',
+                fields: [
+                    {
+                        id: 'fld1',
+                        sdkName: 'amount',
+                        definition: {
+                            type: 'currency',
+                            name,
+                            template: { currencySymbol: '$' },
+                        },
+                    },
+                ],
+            },
+        ],
+    });
+    it.each([
+        ['a comment-close sequence', 'Total */ console.log(1); /*'],
+        ['a newline', 'Total\namount'],
+    ])('emits parseable TypeScript for a field named with %s', (_what, name) => {
+        expect(syntaxErrorsIn(generateDbTs(schemaWithFieldNamed(name)))).toEqual([]);
+    });
+});
+describe('generateApiTs endpoint file names', () => {
+    // An endpoint filename is the LLM's raw `writeFile` path argument — nothing
+    // validates its characters — and it lands in an import specifier, a comment
+    // and two string literals. `.zite/api.ts` is imported by every component that
+    // calls `api.*`, so one bad name takes the whole app down.
+    it.each([
+        ['an apostrophe', "it's.ts"],
+        ['a newline', 'ok\nreport.ts'],
+        ['a trailing backslash', 'back\\.ts'],
+        ['a double quote', 'say"hi.ts'],
+    ])('emits parseable TypeScript for a file named with %s', (_what, name) => {
+        const out = generateApiTs([
+            { fileName: name, content: 'export default createEndpoint({});' },
+        ]);
+        expect(out).not.toBeNull();
+        expect(syntaxErrorsIn(out)).toEqual([]);
+    });
+    // The no-default-export branch puts the name in a `//` comment instead, so it
+    // needs its own case: there a line terminator ends the comment, not a string.
+    it('emits parseable TypeScript for an untyped endpoint with a newline', () => {
+        const out = generateApiTs([
+            {
+                fileName: 'ok\nreport.ts',
+                content: 'export const report = createEndpoint({});',
+            },
+        ]);
+        expect(out).not.toBeNull();
+        expect(syntaxErrorsIn(out)).toEqual([]);
+    });
+});
+describe('generateEmailSdk integration id', () => {
+    // An LLM-authored `zite.config.json` key, validated only as
+    // `z.record(z.string(), …)`.
+    it.each([
+        ['an apostrophe', "resend'prod"],
+        ['a newline', 'resend\nprod'],
+        ['a trailing backslash', 'resend\\'],
+    ])('emits parseable TypeScript for an id with %s', (_what, id) => {
+        expect(syntaxErrorsIn(generateEmailSdk(id))).toEqual([]);
+    });
+});
 describe('generateBackendWrapperTs', () => {
     const output = generateBackendWrapperTs();
     it('imports User from zitejs/auth', () => {

package/dist/esm/sync/sdkNames.d.ts

@@ -36,8 +36,15 @@ export declare function toSdkName(name: string): string;
 /**
  * Accessors `generateDbTs` puts on the `zite` object itself, after the tables.
  * A table that allocates one of these produces a duplicate key.
+ *
+ * `notifications` used to be here and no longer is: it was a platform
+ * primitive hanging off `zite`, so a table named "Notifications" collided with
+ * it and — because the sentinel was written last — lost its client entirely.
+ * Moving it to `zitejs/notifications` removes the collision rather than
+ * managing it, and frees the name for the table that wants it. Everything left
+ * is genuinely backed by the project database.
  */
-export declare const RESERVED_TABLE_ACCESSORS: readonly ["sql", "notifications", "auth"];
+export declare const RESERVED_TABLE_ACCESSORS: readonly ["sql", "auth"];
 /**
  * Never safe as a generated key, in any namespace. Assigning `__proto__` in an
  * object literal sets the prototype rather than defining a property, and

package/dist/esm/sync/sdkNames.js

@@ -56,12 +56,15 @@ export function toSdkName(name) {
 /**
  * Accessors `generateDbTs` puts on the `zite` object itself, after the tables.
  * A table that allocates one of these produces a duplicate key.
+ *
+ * `notifications` used to be here and no longer is: it was a platform
+ * primitive hanging off `zite`, so a table named "Notifications" collided with
+ * it and — because the sentinel was written last — lost its client entirely.
+ * Moving it to `zitejs/notifications` removes the collision rather than
+ * managing it, and frees the name for the table that wants it. Everything left
+ * is genuinely backed by the project database.
  */
-export const RESERVED_TABLE_ACCESSORS = [
-    "sql",
-    "notifications",
-    "auth",
-];
+export const RESERVED_TABLE_ACCESSORS = ["sql", "auth"];
 /**
  * Never safe as a generated key, in any namespace. Assigning `__proto__` in an
  * object literal sets the prototype rather than defining a property, and

package/dist/esm/sync/sdkNames.test.js

@@ -31,17 +31,18 @@ const recordTypeKeys = (source, typeName) => {
 };
 describe("reserved platform accessors", () => {
     // Sudzy Dashboard: a table named "Notifications" emitted a second
-    // `notifications:` key, and the platform client — written last — won. The
+    // `notifications:` key and the platform client — written last — won, so the
     // table lost findAll and typed as `{ create(NotificationsCreateParams) }`.
-    it("moves a table off the notifications accessor", () => {
+    // The platform client has since moved to `zitejs/notifications`, so the name
+    // belongs to the table again and there is nothing left to collide with.
+    it("lets a table keep the notifications accessor", () => {
         const schema = generateSchema(database([{ id: "tbl_1", name: "Notifications", fields: [] }]));
-        expect(schema.tables[0].sdkName).toBe("notifications2");
+        expect(schema.tables[0].sdkName).toBe("notifications");
         const keys = ziteKeys(generateDbTs(schema));
-        expect(keys).toContain("notifications2");
         expect(keys.filter((k) => k === "notifications")).toHaveLength(1);
         expect(new Set(keys).size).toBe(keys.length);
     });
-    it.each(["sql", "auth", "notifications"])("keeps the platform %s accessor for the platform", (reserved) => {
+    it.each(["sql", "auth"])("keeps the platform %s accessor for the platform", (reserved) => {
         const schema = generateSchema(database([{ id: "tbl_1", name: reserved, fields: [] }]));
         expect(schema.tables[0].sdkName).toBe(`${reserved}2`);
         const keys = ziteKeys(generateDbTs(schema));
@@ -190,14 +191,17 @@ describe("normalizeSchemaNames", () => {
     // `zitejs generate` reads it with no generateSchema pass in front, so this is
     // the only thing standing between it and a TS1117 it cannot build past.
     it("repairs a committed schema that already holds the collision", () => {
+        // `sql`, not `notifications` — the latter stopped being a platform
+        // accessor when the client moved to `zitejs/notifications`, so a schema
+        // holding it is no longer a collision to repair.
         const source = generateDbTs({
             tables: [
-                { id: "tbl_1", sdkName: "notifications", fields: [] },
+                { id: "tbl_1", sdkName: "sql", fields: [] },
                 { id: "tbl_2", sdkName: "orders", fields: [] },
             ],
         });
         const keys = ziteKeys(source);
         expect(new Set(keys).size).toBe(keys.length);
-        expect(keys).toContain("notifications2");
+        expect(keys).toContain("sql2");
     });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zitejs",
-  "version": "0.9.107",
+  "version": "0.9.109",
   "description": "The Zite framework — build apps on Zite Database",
   "type": "module",
   "main": "./dist/cjs/index.js",