@kubuild/core 0.5.0 → 0.7.0

package/dist/index.cjs

@@ -54,10 +54,12 @@ __export(index_exports, {
   createPageArtboard: () => createPageArtboard,
   createRuntimeStore: () => createRuntimeStore,
   createTemplateRecord: () => createTemplateRecord,
+  createTrackingRelayHandler: () => createTrackingRelayHandler,
   deepClone: () => deepClone,
   defaultIdGenerator: () => defaultIdGenerator,
   defaultMigrationRegistry: () => defaultMigrationRegistry,
   defaultRenameAssetStrategy: () => defaultRenameAssetStrategy,
+  dispatchServerTracking: () => dispatchServerTracking,
   duplicateNode: () => duplicateNode,
   evaluateActionCondition: () => evaluateActionCondition,
   evaluateCondition: () => evaluateCondition,
@@ -77,6 +79,7 @@ __export(index_exports, {
   findMissingComponentNodes: () => findMissingComponentNodes,
   findNodeById: () => findNodeById,
   findNodeLocation: () => findNodeLocation,
+  generateTrackingEventId: () => generateTrackingEventId,
   getActiveArtboard: () => getActiveArtboard,
   getAncestorChain: () => getAncestorChain,
   getComponentArtboards: () => getComponentArtboards,
@@ -86,6 +89,7 @@ __export(index_exports, {
   getPageArtboards: () => getPageArtboards,
   getParentNodeId: () => getParentNodeId,
   hasTemplateExpressions: () => hasTemplateExpressions,
+  hashSha256: () => hashSha256,
   importPackage: () => importPackage,
   importStoraPackage: () => importStoraPackage,
   insertNode: () => insertNode,
@@ -103,6 +107,9 @@ __export(index_exports, {
   loadProjectDocument: () => loadProjectDocument,
   migrateDocument: () => migrateDocument,
   moveNode: () => moveNode,
+  normalizeEmail: () => normalizeEmail,
+  normalizePhone: () => normalizePhone,
+  normalizeText: () => normalizeText,
   preflightPackage: () => preflightPackage,
   previewImportPackage: () => previewImportPackage,
   remapAssetReferences: () => remapAssetReferences,
@@ -114,12 +121,19 @@ __export(index_exports, {
   resolveBinding: () => resolveBinding,
   resolveBindingValue: () => resolveBindingValue,
   resolvePropertyPath: () => resolvePropertyPath,
+  sanitizeDocumentTracking: () => sanitizeDocumentTracking,
   sanitizeFilename: () => sanitizeFilename,
   sanitizeHtml: () => sanitizeHtml,
   sanitizeUrl: () => sanitizeUrl,
   saveDraftAsTemplate: () => saveDraftAsTemplate,
+  sendCustomWebhookEvent: () => sendCustomWebhookEvent,
+  sendGa4MeasurementEvent: () => sendGa4MeasurementEvent,
+  sendMetaCapiEvent: () => sendMetaCapiEvent,
+  sendTikTokEventsApi: () => sendTikTokEventsApi,
   setActiveArtboard: () => setActiveArtboard,
   sha256Sync: () => sha256Sync,
+  stripDocumentTrackingSecretsInPlace: () => stripDocumentTrackingSecretsInPlace,
+  stripTrackingSecretsInPlace: () => stripTrackingSecretsInPlace,
   ungroupNodeFrame: () => ungroupNodeFrame,
   updateActions: () => updateActions,
   updateAnimation: () => updateAnimation,
@@ -145,7 +159,7 @@ var import_schema = require("@kubuild/schema");
 function createBlankDocument(title = "Untitled Page") {
   return {
     schema: import_schema.SCHEMA_NAME,
-    version: "1.0.0",
+    version: import_schema.CURRENT_SCHEMA_VERSION,
     metadata: {
       title,
       description: "",
@@ -1541,6 +1555,15 @@ var DocumentHistoryManager = class {
 var FORBIDDEN_KEY_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function resolveBinding(binding, context) {
   const segments = binding.key.split(".").filter(Boolean);
+  if (segments.some((segment) => FORBIDDEN_KEY_SEGMENTS.has(segment))) {
+    return applyMissingPolicy(binding);
+  }
+  if (context?.variables && typeof context.variables === "object" && Object.prototype.hasOwnProperty.call(context.variables, binding.key)) {
+    const directValue = context.variables[binding.key];
+    if (directValue !== void 0 && typeof directValue !== "function") {
+      return { status: "resolved", value: directValue };
+    }
+  }
   let current = context?.variables;
   for (const segment of segments) {
     if (FORBIDDEN_KEY_SEGMENTS.has(segment)) {
@@ -2112,14 +2135,14 @@ var ActionPipelineExecutor = class {
   async executeSingleStep(step, context, parentSignal, options) {
     const stepStartTime = Date.now();
     if (step.condition && !evaluateActionCondition(step.condition, context)) {
-      const skippedResult = {
+      const skippedResult2 = {
         stepId: step.id,
         stepType: step.type,
         status: "skipped",
         durationMs: Date.now() - stepStartTime
       };
-      options?.onStepComplete?.(step, skippedResult, context);
-      return skippedResult;
+      options?.onStepComplete?.(step, skippedResult2, context);
+      return skippedResult2;
     }
     options?.onStepStart?.(step, context);
     const stepTimeout = step.timeout;
@@ -2584,12 +2607,559 @@ function createRuntimeStore(initialState) {
   return new RuntimeStateStore(initialState);
 }
 
+// src/runtime/server-tracking.ts
+function normalizeEmail(email) {
+  return (email || "").trim().toLowerCase();
+}
+function normalizePhone(phone) {
+  return (phone || "").replace(/[^0-9]/g, "");
+}
+function normalizeText(text) {
+  return (text || "").trim().toLowerCase();
+}
+async function hashSha256(value) {
+  const normalized = (value || "").trim();
+  if (!normalized) return "";
+  if (typeof globalThis.crypto?.subtle?.digest === "function") {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(normalized);
+    const hashBuffer = await globalThis.crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
+  throw new Error("Web Crypto API (crypto.subtle) is not available in current runtime environment.");
+}
+function generateTrackingEventId(prefix = "evt") {
+  const timestamp = Date.now().toString(36);
+  const randomPart = Math.random().toString(36).substring(2, 10);
+  return `${prefix}_${timestamp}_${randomPart}`;
+}
+async function sendMetaCapiEvent(event, config, secrets, options) {
+  const fetcher = options?.fetchFn || globalThis.fetch;
+  if (!config.pixelId) {
+    return {
+      provider: "meta",
+      success: false,
+      error: "Meta Pixel ID is missing"
+    };
+  }
+  const rawUserData = event.userData || {};
+  const hashedUserData = {};
+  if (rawUserData.email) {
+    hashedUserData.em = [await hashSha256(normalizeEmail(String(rawUserData.email)))];
+  }
+  if (rawUserData.phone) {
+    hashedUserData.ph = [await hashSha256(normalizePhone(String(rawUserData.phone)))];
+  }
+  if (rawUserData.firstName) {
+    hashedUserData.fn = [await hashSha256(normalizeText(String(rawUserData.firstName)))];
+  }
+  if (rawUserData.lastName) {
+    hashedUserData.ln = [await hashSha256(normalizeText(String(rawUserData.lastName)))];
+  }
+  if (rawUserData.city) {
+    hashedUserData.ct = [await hashSha256(normalizeText(String(rawUserData.city)))];
+  }
+  if (rawUserData.state) {
+    hashedUserData.st = [await hashSha256(normalizeText(String(rawUserData.state)))];
+  }
+  if (rawUserData.zip) {
+    hashedUserData.zp = [await hashSha256(normalizeText(String(rawUserData.zip)))];
+  }
+  if (rawUserData.country) {
+    hashedUserData.country = [await hashSha256(normalizeText(String(rawUserData.country)))];
+  }
+  const clientIp = rawUserData.clientIp || options?.clientIp;
+  if (clientIp) hashedUserData.client_ip_address = clientIp;
+  const clientUserAgent = rawUserData.clientUserAgent || options?.clientUserAgent;
+  if (clientUserAgent) hashedUserData.client_user_agent = clientUserAgent;
+  if (rawUserData.fbp) hashedUserData.fbp = rawUserData.fbp;
+  if (rawUserData.fbc) hashedUserData.fbc = rawUserData.fbc;
+  if (rawUserData.externalId) {
+    hashedUserData.external_id = [await hashSha256(String(rawUserData.externalId))];
+  }
+  const eventTime = event.eventTime || Math.floor(Date.now() / 1e3);
+  const eventSourceUrl = event.eventSourceUrl || options?.sourceUrl;
+  const capiPayload = {
+    data: [
+      {
+        event_name: event.eventName,
+        event_time: eventTime,
+        event_id: event.eventId,
+        event_source_url: eventSourceUrl,
+        action_source: event.actionSource || "website",
+        user_data: hashedUserData,
+        custom_data: {
+          ...event.params || {},
+          ...event.customData || {}
+        }
+      }
+    ]
+  };
+  if (config.testEventCode) {
+    capiPayload.test_event_code = config.testEventCode;
+  }
+  if (options?.simulateInDebug) {
+    options.onLog?.("[Meta CAPI SIMULATED]", capiPayload);
+    return { provider: "meta", success: true, data: { simulated: true, payload: capiPayload } };
+  }
+  try {
+    const url = `https://graph.facebook.com/v19.0/${encodeURIComponent(config.pixelId)}/events`;
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    if (!secrets?.capiAccessToken) {
+      return skippedResult("meta", "No Meta CAPI access token resolved for this credential");
+    }
+    headers["Authorization"] = `Bearer ${secrets.capiAccessToken}`;
+    const res = await fetcher(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(capiPayload)
+    });
+    const resJson = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      return {
+        provider: "meta",
+        success: false,
+        status: res.status,
+        error: resJson?.error?.message || `HTTP ${res.status}`,
+        data: resJson
+      };
+    }
+    return {
+      provider: "meta",
+      success: true,
+      status: res.status,
+      data: resJson
+    };
+  } catch (err) {
+    return {
+      provider: "meta",
+      success: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function sendTikTokEventsApi(event, config, secrets, options) {
+  const fetcher = options?.fetchFn || globalThis.fetch;
+  if (!config.pixelId) {
+    return { provider: "tiktok", success: false, error: "TikTok Pixel ID is missing" };
+  }
+  const rawUserData = event.userData || {};
+  const user = {};
+  if (rawUserData.email) {
+    user.email = await hashSha256(normalizeEmail(String(rawUserData.email)));
+  }
+  if (rawUserData.phone) {
+    user.phone_number = await hashSha256(normalizePhone(String(rawUserData.phone)));
+  }
+  if (rawUserData.clientIp || options?.clientIp) {
+    user.ip = rawUserData.clientIp || options?.clientIp;
+  }
+  if (rawUserData.clientUserAgent || options?.clientUserAgent) {
+    user.user_agent = rawUserData.clientUserAgent || options?.clientUserAgent;
+  }
+  const tiktokPayload = {
+    event_source: "web",
+    event_source_id: config.pixelId,
+    data: [
+      {
+        event: event.eventName,
+        event_id: event.eventId,
+        timestamp: new Date(event.eventTime ? event.eventTime * 1e3 : Date.now()).toISOString(),
+        user,
+        properties: {
+          ...event.params || {},
+          ...event.customData || {}
+        },
+        page: {
+          url: event.eventSourceUrl || options?.sourceUrl
+        }
+      }
+    ]
+  };
+  if (config.testEventCode) {
+    tiktokPayload.test_event_code = config.testEventCode;
+  }
+  if (options?.simulateInDebug) {
+    options.onLog?.("[TikTok Events API SIMULATED]", tiktokPayload);
+    return { provider: "tiktok", success: true, data: { simulated: true, payload: tiktokPayload } };
+  }
+  try {
+    const url = "https://business-api.tiktok.com/open_api/v1.3/event/track/";
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    if (!secrets?.accessToken) {
+      return skippedResult("tiktok", "No TikTok Events API access token resolved for this credential");
+    }
+    headers["Access-Token"] = secrets.accessToken;
+    const res = await fetcher(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(tiktokPayload)
+    });
+    const resJson = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      return {
+        provider: "tiktok",
+        success: false,
+        status: res.status,
+        error: resJson?.message || `HTTP ${res.status}`,
+        data: resJson
+      };
+    }
+    return { provider: "tiktok", success: true, status: res.status, data: resJson };
+  } catch (err) {
+    return {
+      provider: "tiktok",
+      success: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function sendGa4MeasurementEvent(event, config, secrets, options) {
+  const fetcher = options?.fetchFn || globalThis.fetch;
+  if (!config.measurementId) {
+    return { provider: "google", success: false, error: "GA4 Measurement ID is missing" };
+  }
+  const clientId = event.userData?.clientId || event.userData?.externalId || "anonymous_client";
+  const ga4Payload = {
+    client_id: clientId,
+    events: [
+      {
+        name: event.eventName.toLowerCase().replace(/[^a-z0-9_]/g, "_"),
+        params: {
+          ...event.params || {},
+          ...event.customData || {},
+          event_id: event.eventId
+        }
+      }
+    ]
+  };
+  if (options?.simulateInDebug) {
+    options.onLog?.("[GA4 Measurement Protocol SIMULATED]", ga4Payload);
+    return { provider: "google", success: true, data: { simulated: true, payload: ga4Payload } };
+  }
+  try {
+    if (!secrets?.measurementProtocolSecret) {
+      return skippedResult("google", "No GA4 Measurement Protocol API secret resolved for this credential");
+    }
+    const url = `https://www.google-analytics.com/mp/collect?measurement_id=${encodeURIComponent(config.measurementId)}&api_secret=${encodeURIComponent(secrets.measurementProtocolSecret)}`;
+    const res = await fetcher(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(ga4Payload)
+    });
+    return {
+      provider: "google",
+      success: res.ok,
+      status: res.status,
+      data: { status: res.status }
+    };
+  } catch (err) {
+    return {
+      provider: "google",
+      success: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function sendCustomWebhookEvent(event, _config, secrets, options) {
+  const fetcher = options?.fetchFn || globalThis.fetch;
+  const webhookPayload = {
+    event: event.eventName,
+    eventId: event.eventId,
+    timestamp: event.eventTime ? event.eventTime * 1e3 : Date.now(),
+    userData: event.userData,
+    params: event.params,
+    customData: event.customData,
+    sourceUrl: event.eventSourceUrl || options?.sourceUrl
+  };
+  if (options?.simulateInDebug) {
+    options.onLog?.("[Custom Webhook SIMULATED]", webhookPayload);
+    return { provider: "custom", success: true, data: { simulated: true, payload: webhookPayload } };
+  }
+  if (!secrets?.endpointUrl) {
+    return skippedResult("custom", "No custom webhook destination resolved for this credential");
+  }
+  try {
+    const res = await fetcher(secrets.endpointUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...secrets.headers || {}
+      },
+      body: JSON.stringify(webhookPayload)
+    });
+    const resJson = await res.json().catch(() => ({}));
+    return {
+      provider: "custom",
+      success: res.ok,
+      status: res.status,
+      data: resJson
+    };
+  } catch (err) {
+    return {
+      provider: "custom",
+      success: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function skippedResult(provider, reason) {
+  return { provider, success: true, skipped: true, reason };
+}
+async function dispatchServerTracking(event, config, options) {
+  const eventId = event.eventId || generateTrackingEventId();
+  const eventWithId = { ...event, eventId };
+  if (!config || config.enabled === false) {
+    return {
+      success: true,
+      eventId,
+      skipped: true,
+      reason: "Tracking is disabled globally",
+      results: {}
+    };
+  }
+  const isDebug = Boolean(config.debugMode);
+  const simulate = isDebug && options?.simulateInDebug !== false;
+  const mergedOptions = {
+    ...options,
+    simulateInDebug: simulate,
+    onLog: (msg, data) => {
+      if (isDebug) {
+        console.log(`[KUBUILD Tracking] ${msg}`, data || "");
+      }
+      options?.onLog?.(msg, data);
+    }
+  };
+  const target = options?.provider || "all";
+  const wants = (key) => target === "all" || target === key;
+  const providers = config.providers || {};
+  const tasks = [];
+  const meta = providers.meta;
+  if (wants("meta") && meta && meta.enabled !== false && meta.capiEnabled) {
+    tasks.push({
+      key: "meta",
+      credentialId: meta.credentialId,
+      run: (s) => sendMetaCapiEvent(eventWithId, meta, s, mergedOptions)
+    });
+  }
+  const tiktok = providers.tiktok;
+  if (wants("tiktok") && tiktok && tiktok.enabled !== false && tiktok.eventsApiEnabled) {
+    tasks.push({
+      key: "tiktok",
+      credentialId: tiktok.credentialId,
+      run: (s) => sendTikTokEventsApi(eventWithId, tiktok, s, mergedOptions)
+    });
+  }
+  const google = providers.google;
+  if (wants("google") && google && google.enabled !== false && google.measurementId) {
+    tasks.push({
+      key: "google",
+      credentialId: google.credentialId,
+      run: (s) => sendGa4MeasurementEvent(eventWithId, google, s, mergedOptions)
+    });
+  }
+  const custom = providers.custom;
+  if (wants("custom") && custom && custom.enabled !== false) {
+    tasks.push({
+      key: "custom",
+      credentialId: custom.credentialId,
+      run: (s) => sendCustomWebhookEvent(eventWithId, custom, s, mergedOptions)
+    });
+  }
+  if (tasks.length === 0) {
+    return {
+      success: true,
+      eventId,
+      skipped: true,
+      reason: target === "gtm" ? "GTM is client-side only (dataLayer); no server delivery" : "No server-side tracking provider is enabled",
+      results: {}
+    };
+  }
+  const resolve = options?.resolveSecrets;
+  const runTask = async (task) => {
+    let secrets = null;
+    if (resolve) {
+      try {
+        secrets = await resolve({ provider: task.key, credentialId: task.credentialId, documentId: options?.documentId }) ?? null;
+      } catch (err) {
+        return {
+          provider: task.key,
+          success: false,
+          error: `Secret resolution failed: ${err instanceof Error ? err.message : String(err)}`
+        };
+      }
+    }
+    if (!secrets && !simulate) {
+      const reason = resolve ? `No secret resolved for provider "${task.key}"${task.credentialId ? ` (credentialId "${task.credentialId}")` : " (no credentialId linked)"}` : "No secret resolver configured (options.resolveSecrets)";
+      mergedOptions.onLog?.(`[${task.key}] skipped: ${reason}`);
+      return skippedResult(task.key, reason);
+    }
+    return task.run(secrets);
+  };
+  const settled = await Promise.allSettled(tasks.map((task) => runTask(task)));
+  const results = {};
+  let overallSuccess = true;
+  let delivered = 0;
+  settled.forEach((item, index) => {
+    const key = tasks[index].key;
+    if (item.status === "fulfilled") {
+      results[key] = item.value;
+      if (!item.value.success) overallSuccess = false;
+      if (!item.value.skipped) delivered++;
+    } else {
+      overallSuccess = false;
+      results[key] = {
+        provider: key,
+        success: false,
+        error: item.reason instanceof Error ? item.reason.message : String(item.reason)
+      };
+    }
+  });
+  const allSkipped = delivered === 0 && overallSuccess;
+  return {
+    success: overallSuccess,
+    eventId,
+    ...allSkipped ? { skipped: true, reason: "All server providers were skipped" } : {},
+    results
+  };
+}
+
+// src/runtime/tracking-relay.ts
+var import_schema5 = require("@kubuild/schema");
+var DEFAULT_MAX_BODY_BYTES = 64 * 1024;
+function defaultClientIp(request) {
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (forwarded) {
+    const first = forwarded.split(",")[0]?.trim();
+    if (first) return first;
+  }
+  return request.headers.get("cf-connecting-ip")?.trim() || request.headers.get("x-real-ip")?.trim() || void 0;
+}
+function isOriginAllowed(origin, allowed) {
+  if (!allowed) return true;
+  if (!origin) return false;
+  if (typeof allowed === "function") return allowed(origin);
+  return allowed.includes(origin);
+}
+function createTrackingRelayHandler(options) {
+  const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+  return async (request) => {
+    const origin = request.headers.get("origin");
+    const corsHeaders = {};
+    if (options.allowedOrigins && origin && isOriginAllowed(origin, options.allowedOrigins)) {
+      corsHeaders["Access-Control-Allow-Origin"] = origin;
+      corsHeaders["Vary"] = "Origin";
+    }
+    const json = (body, status, extra) => new Response(JSON.stringify(body), {
+      status,
+      headers: { "Content-Type": "application/json", ...corsHeaders, ...extra || {} }
+    });
+    const fail = (code, message, status, extra) => json({ version: import_schema5.TRACKING_RELAY_PROTOCOL_VERSION, success: false, error: { code, message } }, status, extra);
+    if (!isOriginAllowed(origin, options.allowedOrigins)) {
+      return fail("FORBIDDEN_ORIGIN", "Origin is not allowed", 403);
+    }
+    if (request.method === "OPTIONS") {
+      return new Response(null, {
+        status: 204,
+        headers: {
+          ...corsHeaders,
+          "Access-Control-Allow-Methods": "POST, OPTIONS",
+          "Access-Control-Allow-Headers": "Content-Type",
+          "Access-Control-Max-Age": "600"
+        }
+      });
+    }
+    if (request.method !== "POST") {
+      return fail("METHOD_NOT_ALLOWED", "Only POST requests are accepted", 405, { Allow: "POST, OPTIONS" });
+    }
+    try {
+      const text = await request.text();
+      if (text.length > maxBodyBytes) {
+        return fail("INVALID_REQUEST", `Request body exceeds ${maxBodyBytes} bytes`, 413);
+      }
+      let raw;
+      try {
+        raw = JSON.parse(text);
+      } catch {
+        return fail("INVALID_REQUEST", "Request body must be valid JSON", 400);
+      }
+      if (raw && typeof raw === "object" && "version" in raw && raw.version !== import_schema5.TRACKING_RELAY_PROTOCOL_VERSION) {
+        return fail(
+          "UNSUPPORTED_VERSION",
+          `Unsupported relay protocol version; expected ${import_schema5.TRACKING_RELAY_PROTOCOL_VERSION}`,
+          400
+        );
+      }
+      const parsed = import_schema5.TrackingRelayRequestSchema.safeParse(raw);
+      if (!parsed.success) {
+        const issues = parsed.error.issues.slice(0, 5).map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+        return fail("INVALID_REQUEST", `Invalid relay request: ${issues}`, 400);
+      }
+      const body = parsed.data;
+      const config = await options.getConfig({
+        request,
+        documentId: body.documentId,
+        credentialId: body.credentialId,
+        provider: body.provider
+      });
+      if (!config) {
+        return fail("CONFIG_NOT_FOUND", "No tracking configuration found for this page", 404);
+      }
+      const clientIp = (options.getClientIp ?? defaultClientIp)(request);
+      const clientUserAgent = request.headers.get("user-agent") || void 0;
+      const userData = { ...body.event.userData || {} };
+      delete userData.clientIp;
+      delete userData.clientUserAgent;
+      const event = { ...body.event, userData };
+      const outcome = await dispatchServerTracking(event, config, {
+        resolveSecrets: options.resolveSecrets,
+        documentId: body.documentId,
+        provider: body.provider,
+        fetchFn: options.fetchFn,
+        clientIp,
+        clientUserAgent,
+        onLog: options.onLog
+      });
+      const results = {};
+      for (const [key, r] of Object.entries(outcome.results)) {
+        results[key] = {
+          provider: r.provider,
+          success: r.success,
+          ...r.status !== void 0 ? { status: r.status } : {},
+          ...r.skipped ? { skipped: true } : {},
+          ...r.reason ? { reason: r.reason } : {},
+          ...r.error ? { error: r.error } : {}
+        };
+      }
+      return json(
+        {
+          version: import_schema5.TRACKING_RELAY_PROTOCOL_VERSION,
+          success: outcome.success,
+          eventId: outcome.eventId,
+          ...outcome.skipped ? { skipped: true } : {},
+          ...outcome.reason ? { reason: outcome.reason } : {},
+          results
+        },
+        200
+      );
+    } catch (err) {
+      options.onLog?.("[Tracking relay] internal error", err);
+      return fail("INTERNAL_ERROR", "Tracking relay failed", 500);
+    }
+  };
+}
+
 // src/io/exporter.ts
 var import_fflate = require("fflate");
-var import_schema6 = require("@kubuild/schema");
+var import_schema8 = require("@kubuild/schema");
 
 // src/validation/validator.ts
-var import_schema5 = require("@kubuild/schema");
+var import_schema6 = require("@kubuild/schema");
 
 // src/validation/security.ts
 var DEFAULT_DOCUMENT_SECURITY_LIMITS = {
@@ -2878,10 +3448,10 @@ function validateDocument(input, options = {}) {
       };
     }
   }
-  if (doc.schema !== import_schema5.SCHEMA_NAME) {
+  if (doc.schema !== import_schema6.SCHEMA_NAME) {
     errors.push({
       code: "GLOBAL_SCHEMA_INVALID",
-      message: `Invalid schema identifier. Expected "${import_schema5.SCHEMA_NAME}", received "${String(doc.schema)}"`,
+      message: `Invalid schema identifier. Expected "${import_schema6.SCHEMA_NAME}", received "${String(doc.schema)}"`,
       path: "/schema"
     });
   }
@@ -2945,7 +3515,7 @@ function validateDocument(input, options = {}) {
     warnings
   );
   if (errors.length === 0) {
-    const zodResult = import_schema5.PageDocumentSchema.safeParse(input);
+    const zodResult = import_schema6.PageDocumentSchema.safeParse(input);
     if (!zodResult.success) {
       for (const issue of zodResult.error.issues) {
         const jsonPath = "/" + issue.path.join("/");
@@ -3125,7 +3695,8 @@ function validateNodeRecursive(nodeObj, currentPath, parentNode, seenIds, visite
         `${currentPath}/props`,
         effectiveNodeId,
         options,
-        errors
+        errors,
+        warnings
       );
     }
   }
@@ -3140,7 +3711,10 @@ function validateNodeRecursive(nodeObj, currentPath, parentNode, seenIds, visite
     }
   }
 }
-function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
+function validatePropsBindings(propsObj, propsPath, nodeId, options, errors, warnings) {
+  const checkAssets = options.checkAssetReferences !== false;
+  const checkVariables = options.checkVariableBindings !== false;
+  const checkActions = options.checkActionBindings !== false;
   for (const [key, value] of Object.entries(propsObj)) {
     const currentPath = `${propsPath}/${key}`;
     if (!value || typeof value !== "object") {
@@ -3154,7 +3728,8 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
             `${currentPath}/${index}`,
             nodeId,
             options,
-            errors
+            errors,
+            warnings
           );
         }
       });
@@ -3162,7 +3737,9 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
     }
     const record = value;
     if (record.type === "asset") {
-      if (typeof record.assetId !== "string" || record.assetId.trim().length === 0) {
+      if (!checkAssets) continue;
+      const assetId = typeof record.assetId === "string" && record.assetId.trim().length > 0 ? record.assetId : void 0;
+      if (assetId === void 0) {
         errors.push({
           code: "INVALID_ASSET_REFERENCE",
           message: 'Asset reference must have a non-empty "assetId"',
@@ -3178,7 +3755,27 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
           nodeId
         });
       }
+      if (assetId !== void 0 && options.knownAssetIds && !isKnownId(options.knownAssetIds, assetId)) {
+        if (typeof record.fallbackUrl === "string" && record.fallbackUrl.length > 0) {
+          warnings.push({
+            code: "UNRESOLVED_ASSET_REFERENCE",
+            message: `Asset "${assetId}" is not among the known assets; its fallbackUrl will be used`,
+            path: `${currentPath}/assetId`,
+            nodeId,
+            details: { assetId }
+          });
+        } else {
+          errors.push({
+            code: "INVALID_ASSET_REFERENCE",
+            message: `Asset "${assetId}" is not among the known assets and has no fallbackUrl`,
+            path: `${currentPath}/assetId`,
+            nodeId,
+            details: { assetId }
+          });
+        }
+      }
     } else if (record.type === "variable") {
+      if (!checkVariables) continue;
       if (typeof record.key !== "string" || record.key.trim().length === 0) {
         errors.push({
           code: "INVALID_VARIABLE_BINDING",
@@ -3188,6 +3785,7 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
         });
       }
     } else if (key === "action" || typeof record.type === "string" && record.payload !== void 0) {
+      if (!checkActions) continue;
       if (typeof record.type !== "string" || record.type.trim().length === 0) {
         errors.push({
           code: "INVALID_ACTION_BINDING",
@@ -3197,10 +3795,62 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
         });
       }
     } else {
-      validatePropsBindings(record, currentPath, nodeId, options, errors);
+      validatePropsBindings(record, currentPath, nodeId, options, errors, warnings);
     }
   }
 }
+function isKnownId(ids, id) {
+  return Array.isArray(ids) ? ids.includes(id) : ids.has(id);
+}
+
+// src/io/tracking-sanitizer.ts
+var import_schema7 = require("@kubuild/schema");
+function stripTrackingSecretsInPlace(tracking, basePath = "tracking") {
+  const removed = [];
+  if (!tracking || typeof tracking !== "object" || Array.isArray(tracking)) return removed;
+  const providers = tracking.providers;
+  if (!providers || typeof providers !== "object" || Array.isArray(providers)) return removed;
+  for (const provider of Object.keys(import_schema7.LEGACY_TRACKING_SECRET_KEYS)) {
+    const cfg = providers[provider];
+    if (!cfg || typeof cfg !== "object" || Array.isArray(cfg)) continue;
+    for (const key of import_schema7.LEGACY_TRACKING_SECRET_KEYS[provider]) {
+      if (Object.prototype.hasOwnProperty.call(cfg, key)) {
+        delete cfg[key];
+        removed.push(`${basePath}.providers.${provider}.${key}`);
+      }
+    }
+  }
+  return removed;
+}
+function stripDocumentTrackingSecretsInPlace(doc) {
+  const removed = [];
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) return removed;
+  const record = doc;
+  removed.push(...stripTrackingSecretsInPlace(record.tracking, "tracking"));
+  const metadata = record.metadata;
+  if (metadata && typeof metadata === "object" && !Array.isArray(metadata)) {
+    removed.push(
+      ...stripTrackingSecretsInPlace(metadata.tracking, "metadata.tracking")
+    );
+  }
+  if (Array.isArray(record.artboards)) {
+    record.artboards.forEach((artboard, index) => {
+      if (artboard && typeof artboard === "object") {
+        const inner = artboard.document;
+        for (const path of stripDocumentTrackingSecretsInPlace(inner)) {
+          removed.push(`artboards.${index}.document.${path}`);
+        }
+      }
+    });
+  }
+  return removed;
+}
+function sanitizeDocumentTracking(doc) {
+  if (!doc || typeof doc !== "object") return { document: doc, removed: [] };
+  const copy = JSON.parse(JSON.stringify(doc));
+  const removed = stripDocumentTrackingSecretsInPlace(copy);
+  return { document: copy, removed };
+}
 
 // src/io/exporter.ts
 function sha256Sync(data) {
@@ -3421,6 +4071,7 @@ async function exportPackage(document, options = {}) {
     };
   }
   const pageDoc = JSON.parse(JSON.stringify(validation.data));
+  stripDocumentTrackingSecretsInPlace(pageDoc);
   if (options.metadata) {
     pageDoc.metadata = {
       ...pageDoc.metadata || {
@@ -3544,8 +4195,8 @@ async function exportPackage(document, options = {}) {
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   const manifest = {
-    schema: import_schema6.SCHEMA_NAME,
-    schemaVersion: pageDoc.version || import_schema6.CURRENT_SCHEMA_VERSION,
+    schema: import_schema8.SCHEMA_NAME,
+    schemaVersion: pageDoc.version || import_schema8.CURRENT_SCHEMA_VERSION,
     packageVersion: options.packageVersion || "1.0.0",
     builderCompatibility: options.builderCompatibility || ">=0.1.0",
     requiredComponents: requirements.requiredComponents,
@@ -3570,10 +4221,10 @@ var exportStoraPackage = exportPackage;
 
 // src/io/importer.ts
 var import_fflate2 = require("fflate");
-var import_schema8 = require("@kubuild/schema");
+var import_schema10 = require("@kubuild/schema");
 
 // src/io/migration.ts
-var import_schema7 = require("@kubuild/schema");
+var import_schema9 = require("@kubuild/schema");
 var MigrationRegistry = class {
   steps = /* @__PURE__ */ new Map();
   /**
@@ -3652,7 +4303,7 @@ defaultMigrationRegistry.register({
   description: "Migrate alpha 0.1.0 schema (root node key, flat styles) to v1.0.0",
   migrate: (rawDoc) => {
     const migrated = deepClone(rawDoc);
-    migrated.schema = import_schema7.SCHEMA_NAME;
+    migrated.schema = import_schema9.SCHEMA_NAME;
     migrated.version = "1.0.0";
     if (migrated.root && !migrated.document) {
       migrated.document = migrated.root;
@@ -3687,7 +4338,7 @@ defaultMigrationRegistry.register({
   description: "Migrate 0.2.0 schema to v1.0.0",
   migrate: (rawDoc) => {
     const migrated = deepClone(rawDoc);
-    migrated.schema = import_schema7.SCHEMA_NAME;
+    migrated.schema = import_schema9.SCHEMA_NAME;
     migrated.version = "1.0.0";
     if (migrated.document && typeof migrated.document === "object") {
       convertNodeStylesToResponsive(migrated.document);
@@ -3701,7 +4352,7 @@ defaultMigrationRegistry.register({
   description: "Migrate 0.9.0 beta schema to v1.0.0",
   migrate: (rawDoc) => {
     const migrated = deepClone(rawDoc);
-    migrated.schema = import_schema7.SCHEMA_NAME;
+    migrated.schema = import_schema9.SCHEMA_NAME;
     migrated.version = "1.0.0";
     if (!migrated.metadata || typeof migrated.metadata !== "object") {
       migrated.metadata = {
@@ -3726,17 +4377,36 @@ defaultMigrationRegistry.register({
     return migrated;
   }
 });
-function canMigrate(sourceVersion, targetVersion = import_schema7.CURRENT_SCHEMA_VERSION, registry = defaultMigrationRegistry) {
+defaultMigrationRegistry.register({
+  fromVersion: "1.0.0",
+  toVersion: "1.1.0",
+  description: "Remove tracking secrets and server destinations (capiAccessToken, accessToken, measurementProtocolSecret, serverRelayUrl, custom endpointUrl/headers) from the document",
+  migrate: (rawDoc, context) => {
+    const migrated = deepClone(rawDoc);
+    migrated.version = "1.1.0";
+    const removed = stripDocumentTrackingSecretsInPlace(migrated);
+    if (removed.length > 0) {
+      context.warn({
+        code: "TRACKING_SECRET_REMOVED",
+        message: "Tracking secret removed; re-link credential via credentialId (secrets are now stored by the host and resolved server-side).",
+        step: "1.0.0->1.1.0",
+        paths: removed
+      });
+    }
+    return migrated;
+  }
+});
+function canMigrate(sourceVersion, targetVersion = import_schema9.CURRENT_SCHEMA_VERSION, registry = defaultMigrationRegistry) {
   if (!sourceVersion || !targetVersion) return false;
   if (sourceVersion === targetVersion) return true;
   return registry.hasPath(sourceVersion, targetVersion);
 }
-function getMigrationPath(sourceVersion, targetVersion = import_schema7.CURRENT_SCHEMA_VERSION, registry = defaultMigrationRegistry) {
+function getMigrationPath(sourceVersion, targetVersion = import_schema9.CURRENT_SCHEMA_VERSION, registry = defaultMigrationRegistry) {
   if (!sourceVersion || !targetVersion) return null;
   return registry.findPath(sourceVersion, targetVersion);
 }
 function migrateDocument(rawDocument, options = {}) {
-  const targetVersion = options.targetVersion ?? import_schema7.CURRENT_SCHEMA_VERSION;
+  const targetVersion = options.targetVersion ?? import_schema9.CURRENT_SCHEMA_VERSION;
   const dryRun = options.dryRun ?? false;
   const registry = options.registry ?? defaultMigrationRegistry;
   const validate = options.validate ?? true;
@@ -3764,6 +4434,14 @@ function migrateDocument(rawDocument, options = {}) {
   const sourceVersion = typeof doc.version === "string" ? doc.version.trim() : "unknown";
   if (sourceVersion === targetVersion) {
     const cloned = deepClone(doc);
+    const removedSecrets = stripDocumentTrackingSecretsInPlace(cloned);
+    const currentWarnings = removedSecrets.length > 0 ? [
+      {
+        code: "TRACKING_SECRET_REMOVED",
+        message: "Tracking secret removed; re-link credential via credentialId (secrets are stored by the host and resolved server-side).",
+        paths: removedSecrets
+      }
+    ] : [];
     if (validate) {
       const validation = validateDocument(cloned);
       if (!validation.valid) {
@@ -3795,7 +4473,8 @@ function migrateDocument(rawDocument, options = {}) {
         targetVersion,
         migrationPath: [sourceVersion],
         stepsApplied: 0,
-        dryRun
+        dryRun,
+        ...currentWarnings.length > 0 ? { warnings: currentWarnings } : {}
       }
     };
   }
@@ -3835,6 +4514,8 @@ function migrateDocument(rawDocument, options = {}) {
   }
   let currentDoc = deepClone(doc);
   let stepsApplied = 0;
+  const warnings = [];
+  const stepContext = { warn: (w) => warnings.push(w) };
   for (let i = 0; i < path.length - 1; i++) {
     const fromVer = path[i];
     const toVer = path[i + 1];
@@ -3860,7 +4541,7 @@ function migrateDocument(rawDocument, options = {}) {
       };
     }
     try {
-      currentDoc = step.migrate(currentDoc);
+      currentDoc = step.migrate(currentDoc, stepContext);
       stepsApplied++;
     } catch (err) {
       const error = {
@@ -3916,7 +4597,8 @@ function migrateDocument(rawDocument, options = {}) {
       targetVersion,
       migrationPath: path,
       stepsApplied,
-      dryRun: false
+      dryRun: false,
+      ...warnings.length > 0 ? { warnings } : {}
     }
   };
 }
@@ -3951,7 +4633,7 @@ async function preflightPackage(archiveData, options = {}) {
     ...DEFAULT_SECURITY_LIMITS,
     ...options.securityLimits
   };
-  const targetVersion = options.targetSchemaVersion || import_schema8.CURRENT_SCHEMA_VERSION;
+  const targetVersion = options.targetSchemaVersion || import_schema10.CURRENT_SCHEMA_VERSION;
   const migrationRegistry = options.migrationRegistry || defaultMigrationRegistry;
   const diagnostics = [];
   let dependencyPolicy = options.dependencyPolicy || "cancel";
@@ -4084,7 +4766,7 @@ async function preflightPackage(archiveData, options = {}) {
         path: manifestProtoCheck.path
       });
     }
-    const parseResult = import_schema8.ManifestSchema.safeParse(manifestJson);
+    const parseResult = import_schema10.ManifestSchema.safeParse(manifestJson);
     if (!parseResult.success) {
       const issues = parseResult.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join(", ");
       diagnostics.push({
@@ -4114,6 +4796,16 @@ async function preflightPackage(archiveData, options = {}) {
   let rawPageDoc;
   try {
     rawPageDoc = JSON.parse((0, import_fflate2.strFromU8)(pageEntry));
+    const secretScan = sanitizeDocumentTracking(rawPageDoc);
+    if (secretScan.removed.length > 0) {
+      diagnostics.push({
+        code: "TRACKING_SECRET_REMOVED",
+        severity: "warning",
+        message: "Tracking secrets found in page.json will be removed on import; re-link credentials via credentialId.",
+        path: "page.json",
+        details: { paths: secretScan.removed }
+      });
+    }
     const pageProtoCheck = containsProhibitedKeys(rawPageDoc);
     if (pageProtoCheck.found) {
       diagnostics.push({
@@ -4360,7 +5052,7 @@ function buildReport(valid, canImport, fields) {
   return {
     valid,
     canImport,
-    targetVersion: fields.targetVersion || import_schema8.CURRENT_SCHEMA_VERSION,
+    targetVersion: fields.targetVersion || import_schema10.CURRENT_SCHEMA_VERSION,
     requiresMigration: fields.requiresMigration || false,
     missingComponents: fields.missingComponents || [],
     missingCapabilities: fields.missingCapabilities || [],
@@ -4433,7 +5125,7 @@ async function importPackage(archiveData, options = {}) {
   if (preflight.requiresMigration) {
     const migrationRegistry = options.migrationRegistry || defaultMigrationRegistry;
     const migrationRes = migrateDocument(pageRaw, {
-      targetVersion: options.targetSchemaVersion || import_schema8.CURRENT_SCHEMA_VERSION,
+      targetVersion: options.targetSchemaVersion || import_schema10.CURRENT_SCHEMA_VERSION,
       registry: migrationRegistry,
       validate: true
     });
@@ -4455,13 +5147,24 @@ async function importPackage(archiveData, options = {}) {
   } else {
     finalDocument = pageRaw;
   }
+  const importWarnings = [];
+  const strippedSecrets = stripDocumentTrackingSecretsInPlace(finalDocument);
+  if (strippedSecrets.length > 0) {
+    importWarnings.push({
+      code: "TRACKING_SECRET_REMOVED",
+      severity: "warning",
+      message: "Tracking secret removed from imported document; re-link credential via credentialId.",
+      path: "page.json",
+      details: { paths: strippedSecrets }
+    });
+  }
   let metadata = finalDocument.metadata || {
     title: "Imported Page",
     description: "",
     author: "",
     tags: [],
     category: "general",
-    version: finalDocument.version || import_schema8.CURRENT_SCHEMA_VERSION
+    version: finalDocument.version || import_schema10.CURRENT_SCHEMA_VERSION
   };
   if (unzipped["metadata.json"]) {
     try {
@@ -4613,13 +5316,14 @@ async function importPackage(archiveData, options = {}) {
     metadata,
     extractedAssets,
     renamedAssets: Object.keys(renameMap).length > 0 ? renameMap : void 0,
-    preflight
+    preflight,
+    ...importWarnings.length > 0 ? { warnings: importWarnings } : {}
   };
 }
 var importStoraPackage = importPackage;
 
 // src/io/load-project.ts
-var import_schema9 = require("@kubuild/schema");
+var import_schema11 = require("@kubuild/schema");
 var DEFAULT_PAGE_ARTBOARD_ID = "artboard-page-1";
 function wrapPageDocumentAsProject(document, options = {}) {
   const artboardId = options.artboardId ?? DEFAULT_PAGE_ARTBOARD_ID;
@@ -4632,8 +5336,8 @@ function wrapPageDocumentAsProject(document, options = {}) {
     ...options.width !== void 0 ? { width: options.width } : {}
   };
   return {
-    schema: import_schema9.PROJECT_SCHEMA_NAME,
-    version: import_schema9.CURRENT_PROJECT_SCHEMA_VERSION,
+    schema: import_schema11.PROJECT_SCHEMA_NAME,
+    version: import_schema11.CURRENT_PROJECT_SCHEMA_VERSION,
     metadata: document.metadata,
     artboards: [artboard],
     activeArtboardId: artboardId
@@ -4652,8 +5356,8 @@ function loadProjectDocument(raw) {
       ]
     };
   }
-  if ((0, import_schema9.looksLikeProjectDocument)(raw)) {
-    const parsed = import_schema9.ProjectDocumentSchema.safeParse(raw);
+  if ((0, import_schema11.looksLikeProjectDocument)(raw)) {
+    const parsed = import_schema11.ProjectDocumentSchema.safeParse(raw);
     if (!parsed.success) {
       return {
         success: false,
@@ -5138,7 +5842,7 @@ function compareManifestsSemantically(expected, actual, options = {}) {
 }
 
 // src/io/template-utils.ts
-var import_schema10 = require("@kubuild/schema");
+var import_schema12 = require("@kubuild/schema");
 var CORE_BUILTIN_COMPONENTS = /* @__PURE__ */ new Set([
   "page",
   "section",
@@ -5152,7 +5856,7 @@ var CORE_BUILTIN_COMPONENTS = /* @__PURE__ */ new Set([
   "collection"
 ]);
 function validateTemplate(value) {
-  const parseResult = import_schema10.TemplateRecordSchema.safeParse(value);
+  const parseResult = import_schema12.TemplateRecordSchema.safeParse(value);
   if (parseResult.success) {
     return {
       valid: true,
@@ -5280,7 +5984,7 @@ function cloneTreeWithFreshIds(root, idGen) {
 function cloneTemplateAsPage(templateOrDoc, options = {}) {
   let sourceDoc;
   let templateOrigin = null;
-  if ((0, import_schema10.isTemplateRecord)(templateOrDoc)) {
+  if ((0, import_schema12.isTemplateRecord)(templateOrDoc)) {
     if (!templateOrDoc.document) {
       throw new Error(
         `Template "${templateOrDoc.name}" (${templateOrDoc.id}) does not contain an inline document snapshot to clone from.`
@@ -5297,7 +6001,7 @@ function cloneTemplateAsPage(templateOrDoc, options = {}) {
   } else {
     throw new Error("Invalid input: expected a TemplateRecord or PageDocument.");
   }
-  const existingIdsInSource = new Set((0, import_schema10.collectNodeIds)(sourceDoc.document));
+  const existingIdsInSource = new Set((0, import_schema12.collectNodeIds)(sourceDoc.document));
   const assignedNewIds = /* @__PURE__ */ new Set();
   const prefix = options.idPrefix || `page_${Date.now().toString(36)}_${Math.random().toString(36).substring(2, 6)}`;
   let counter = 1;
@@ -5346,8 +6050,8 @@ function cloneTemplateAsPage(templateOrDoc, options = {}) {
 }
 function areNodeIdsCompletelyDistinct(docA, docB) {
   if (!docA?.document || !docB?.document) return true;
-  const idsA = new Set((0, import_schema10.collectNodeIds)(docA.document));
-  const idsB = (0, import_schema10.collectNodeIds)(docB.document);
+  const idsA = new Set((0, import_schema12.collectNodeIds)(docA.document));
+  const idsB = (0, import_schema12.collectNodeIds)(docB.document);
   for (const id of idsB) {
     if (idsA.has(id)) {
       return false;
@@ -5357,7 +6061,7 @@ function areNodeIdsCompletelyDistinct(docA, docB) {
 }
 
 // src/validation/project-validator.ts
-var import_schema11 = require("@kubuild/schema");
+var import_schema13 = require("@kubuild/schema");
 function walk(node, visit) {
   visit(node);
   for (const child of node.children ?? []) {
@@ -5367,7 +6071,7 @@ function walk(node, visit) {
 function collectArtboardReferences(artboard) {
   const refs = [];
   walk(artboard.document.document, (node) => {
-    if (node.type === import_schema11.ARTBOARD_REFERENCE_NODE_TYPE) {
+    if (node.type === import_schema13.ARTBOARD_REFERENCE_NODE_TYPE) {
       const target = node.props?.artboardId;
       refs.push({
         nodeId: node.id,
@@ -5394,7 +6098,7 @@ function validateProject(input, options = {}) {
       artboardErrors
     };
   }
-  const parsed = import_schema11.ProjectDocumentSchema.safeParse(input);
+  const parsed = import_schema13.ProjectDocumentSchema.safeParse(input);
   if (!parsed.success) {
     return {
       valid: false,
@@ -5402,7 +6106,7 @@ function validateProject(input, options = {}) {
       errors: [
         {
           code: "PROJECT_SCHEMA_INVALID",
-          message: `Project failed schema validation. Expected schema "${import_schema11.PROJECT_SCHEMA_NAME}".`,
+          message: `Project failed schema validation. Expected schema "${import_schema13.PROJECT_SCHEMA_NAME}".`,
           path: "",
           details: { issues: parsed.error.issues }
         }
@@ -5495,7 +6199,7 @@ function validateProject(input, options = {}) {
 function collectArtboardReferenceNodes(root) {
   const refs = [];
   walk(root, (node) => {
-    if (node.type === import_schema11.ARTBOARD_REFERENCE_NODE_TYPE) {
+    if (node.type === import_schema13.ARTBOARD_REFERENCE_NODE_TYPE) {
       const target = node.props?.artboardId;
       refs.push({ nodeId: node.id, artboardId: typeof target === "string" ? target : void 0 });
     }
@@ -5744,10 +6448,12 @@ function isFormValid(errors) {
   createPageArtboard,
   createRuntimeStore,
   createTemplateRecord,
+  createTrackingRelayHandler,
   deepClone,
   defaultIdGenerator,
   defaultMigrationRegistry,
   defaultRenameAssetStrategy,
+  dispatchServerTracking,
   duplicateNode,
   evaluateActionCondition,
   evaluateCondition,
@@ -5767,6 +6473,7 @@ function isFormValid(errors) {
   findMissingComponentNodes,
   findNodeById,
   findNodeLocation,
+  generateTrackingEventId,
   getActiveArtboard,
   getAncestorChain,
   getComponentArtboards,
@@ -5776,6 +6483,7 @@ function isFormValid(errors) {
   getPageArtboards,
   getParentNodeId,
   hasTemplateExpressions,
+  hashSha256,
   importPackage,
   importStoraPackage,
   insertNode,
@@ -5793,6 +6501,9 @@ function isFormValid(errors) {
   loadProjectDocument,
   migrateDocument,
   moveNode,
+  normalizeEmail,
+  normalizePhone,
+  normalizeText,
   preflightPackage,
   previewImportPackage,
   remapAssetReferences,
@@ -5804,12 +6515,19 @@ function isFormValid(errors) {
   resolveBinding,
   resolveBindingValue,
   resolvePropertyPath,
+  sanitizeDocumentTracking,
   sanitizeFilename,
   sanitizeHtml,
   sanitizeUrl,
   saveDraftAsTemplate,
+  sendCustomWebhookEvent,
+  sendGa4MeasurementEvent,
+  sendMetaCapiEvent,
+  sendTikTokEventsApi,
   setActiveArtboard,
   sha256Sync,
+  stripDocumentTrackingSecretsInPlace,
+  stripTrackingSecretsInPlace,
   ungroupNodeFrame,
   updateActions,
   updateAnimation,