fix: sanitize object keys

src/transformers/field-object.transform.ts

@@ -1,5 +1,6 @@
 import type { CmsFieldBase, CmsFieldObject } from 'decap-cms-core';
 
+import { getObjectKey } from '../utils/format.utils.js';
 import type { Transformer } from '../utils/transform.utils.js';
 import { transformField } from './field.transform.js';
 
@@ -8,7 +9,7 @@ export const transformObjectField: Transformer<CmsFieldBase & CmsFieldObject> =
   fields = [],
 }) => {
   const results = fields.map(field => [field.name, transformField(field)] as const);
-  const compiled = `z.object({${results.map(([name, r]) => `${name}: ${r.compiled}`).join(',')}})`;
+  const compiled = `z.object({${results.map(([name, r]) => `${getObjectKey(name)}: ${r.compiled}`).join(',')}})`;
   const dependencies = ['z', ...results.flatMap(([, { dependencies }]) => dependencies)];
   return { compiled, dependencies };
 };

src/utils/format.utils.ts

@@ -33,3 +33,10 @@ export async function formatCode(
 export function escapeString(input: string): string {
   return input.replace(/'/g, "\\'");
 }
+
+// object keys can either be strings or identifiers, the latter
+// are more common and can be used without quotes
+export function getObjectKey(name: string): string {
+  const isIdentifier = /^[a-zA-Z_$][\w$]*$/.test(name);
+  return isIdentifier ? name : `['${escapeString(name)}']`;
+}