fix: validate storage collection names by manifest rules, not SQL rules

The previous commit removed collection validation outright to unblock
kebab-case names, which dropped the injection-shape rejection an existing
unit test guards. sql.ref does neutralize such names — it doubles embedded
quotes — but the defensive check is still worth keeping.

Validate against the manifest key charset instead: letters, digits,
underscores and hyphens, either case. form-submissions indexes, and
quote/semicolon-bearing names are still rejected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017m3BaSx6e1DQcU77hBLTxU

Author: edrpls

packages/core/src/database/validate.ts

@@ -26,6 +26,13 @@ const GENERIC_IDENTIFIER_PATTERN = /^[a-zA-Z][a-zA-Z0-9_]*$/;
  */
 const PLUGIN_IDENTIFIER_PATTERN = /^[a-z][a-z0-9_-]*$/;
 
+/**
+ * Pattern for plugin storage collection names.
+ * Manifests declare these as free-form keys, so both cases and hyphens are
+ * allowed; the charset still excludes quotes, whitespace, and punctuation.
+ */
+const STORAGE_COLLECTION_PATTERN = /^[a-zA-Z][a-zA-Z0-9_-]*$/;
+
 /**
  * Maximum length for SQL identifiers.
  * SQLite has no formal limit, but we cap at 128 for sanity.
@@ -136,3 +143,35 @@ export function validatePluginIdentifier(value: string, label = "plugin identifi
 		throw new IdentifierError(`${label} must match /^[a-z][a-z0-9_-]*$/ (got "${value}")`, value);
 	}
 }
+
+/**
+ * Validate a plugin storage collection name.
+ *
+ * Collections are declared as free-form manifest keys and stored as opaque
+ * text, so this is deliberately more permissive than `validateIdentifier`:
+ * `form-submissions` and `formSubmissions` are legitimate. The charset still
+ * rejects quotes and punctuation, keeping generated index names inert.
+ *
+ * @param value - The string to validate
+ * @param label - Human-readable label for error messages
+ * @throws {IdentifierError} If the value is not valid
+ */
+export function validateStorageCollectionName(value: string, label = "collection name"): void {
+	if (!value || typeof value !== "string") {
+		throw new IdentifierError(`${label} must be a non-empty string`, String(value));
+	}
+
+	if (value.length > MAX_IDENTIFIER_LENGTH) {
+		throw new IdentifierError(
+			`${label} must be ${MAX_IDENTIFIER_LENGTH} characters or less, got ${value.length}`,
+			value,
+		);
+	}
+
+	if (!STORAGE_COLLECTION_PATTERN.test(value)) {
+		throw new IdentifierError(
+			`${label} must match /^[a-zA-Z][a-zA-Z0-9_-]*$/ (got "${value}")`,
+			value,
+		);
+	}
+}

packages/core/src/plugins/storage-indexes.ts

@@ -11,7 +11,11 @@ import { sql } from "kysely";
 
 import { jsonExtractExpr, isPostgres } from "../database/dialect-helpers.js";
 import type { Database } from "../database/types.js";
-import { validateJsonFieldName, validatePluginIdentifier } from "../database/validate.js";
+import {
+	validateJsonFieldName,
+	validatePluginIdentifier,
+	validateStorageCollectionName,
+} from "../database/validate.js";
 
 /**
  * Generate a deterministic index name.
@@ -32,9 +36,10 @@ export function generateIndexName(
 /**
  * Generate a Kysely sql expression for creating an expression index.
  *
- * The plugin ID and field names are validated before interpolation; the
- * collection is an opaque text value (the manifest schema allows arbitrary
- * keys) and only appears inside the index name, which `sql.ref` quotes.
+ * Validates all inputs before interpolation. The collection uses the
+ * permissive manifest-key rules rather than SQL-identifier rules — it is
+ * stored as opaque text and only reaches SQL inside the generated index
+ * name — so kebab-case collections index like any other.
  */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance
 export function generateCreateIndexSql(
@@ -45,6 +50,7 @@ export function generateCreateIndexSql(
 	options?: { unique?: boolean },
 ): RawBuilder<unknown> {
 	validatePluginIdentifier(pluginId, "plugin ID");
+	validateStorageCollectionName(collection, "collection name");
 	for (const field of fields) {
 		validateJsonFieldName(field, "index field name");
 	}