@kubuild/core 0.5.0 → 0.7.0

package/dist/index.js

@@ -1,9 +1,9 @@
 // src/document/document-utils.ts
-import { SCHEMA_NAME } from "@kubuild/schema";
+import { SCHEMA_NAME, CURRENT_SCHEMA_VERSION } from "@kubuild/schema";
 function createBlankDocument(title = "Untitled Page") {
   return {
     schema: SCHEMA_NAME,
-    version: "1.0.0",
+    version: CURRENT_SCHEMA_VERSION,
     metadata: {
       title,
       description: "",
@@ -889,7 +889,7 @@ import {
   SCHEMA_NAME as SCHEMA_NAME2,
   PROJECT_SCHEMA_NAME,
   CURRENT_PROJECT_SCHEMA_VERSION,
-  CURRENT_SCHEMA_VERSION,
+  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION2,
   ARTBOARD_REFERENCE_NODE_TYPE
 } from "@kubuild/schema";
 var now = () => (/* @__PURE__ */ new Date()).toISOString();
@@ -947,14 +947,14 @@ function createComponentArtboard(node, options = {}) {
   const triggerId = options.triggerId ?? (typeof node.props?.modalId === "string" && node.props.modalId.trim().length > 0 ? node.props.modalId : node.id);
   const document = {
     schema: SCHEMA_NAME2,
-    version: CURRENT_SCHEMA_VERSION,
+    version: CURRENT_SCHEMA_VERSION2,
     metadata: {
       title: name,
       description: "",
       author: "",
       tags: [],
       category: "component",
-      version: CURRENT_SCHEMA_VERSION,
+      version: CURRENT_SCHEMA_VERSION2,
       createdAt: now(),
       updatedAt: now()
     },
@@ -1411,6 +1411,15 @@ var DocumentHistoryManager = class {
 var FORBIDDEN_KEY_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function resolveBinding(binding, context) {
   const segments = binding.key.split(".").filter(Boolean);
+  if (segments.some((segment) => FORBIDDEN_KEY_SEGMENTS.has(segment))) {
+    return applyMissingPolicy(binding);
+  }
+  if (context?.variables && typeof context.variables === "object" && Object.prototype.hasOwnProperty.call(context.variables, binding.key)) {
+    const directValue = context.variables[binding.key];
+    if (directValue !== void 0 && typeof directValue !== "function") {
+      return { status: "resolved", value: directValue };
+    }
+  }
   let current = context?.variables;
   for (const segment of segments) {
     if (FORBIDDEN_KEY_SEGMENTS.has(segment)) {
@@ -1982,14 +1991,14 @@ var ActionPipelineExecutor = class {
   async executeSingleStep(step, context, parentSignal, options) {
     const stepStartTime = Date.now();
     if (step.condition && !evaluateActionCondition(step.condition, context)) {
-      const skippedResult = {
+      const skippedResult2 = {
         stepId: step.id,
         stepType: step.type,
         status: "skipped",
         durationMs: Date.now() - stepStartTime
       };
-      options?.onStepComplete?.(step, skippedResult, context);
-      return skippedResult;
+      options?.onStepComplete?.(step, skippedResult2, context);
+      return skippedResult2;
     }
     options?.onStepStart?.(step, context);
     const stepTimeout = step.timeout;
@@ -2454,11 +2463,561 @@ function createRuntimeStore(initialState) {
   return new RuntimeStateStore(initialState);
 }
 
+// src/runtime/server-tracking.ts
+function normalizeEmail(email) {
+  return (email || "").trim().toLowerCase();
+}
+function normalizePhone(phone) {
+  return (phone || "").replace(/[^0-9]/g, "");
+}
+function normalizeText(text) {
+  return (text || "").trim().toLowerCase();
+}
+async function hashSha256(value) {
+  const normalized = (value || "").trim();
+  if (!normalized) return "";
+  if (typeof globalThis.crypto?.subtle?.digest === "function") {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(normalized);
+    const hashBuffer = await globalThis.crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
+  throw new Error("Web Crypto API (crypto.subtle) is not available in current runtime environment.");
+}
+function generateTrackingEventId(prefix = "evt") {
+  const timestamp = Date.now().toString(36);
+  const randomPart = Math.random().toString(36).substring(2, 10);
+  return `${prefix}_${timestamp}_${randomPart}`;
+}
+async function sendMetaCapiEvent(event, config, secrets, options) {
+  const fetcher = options?.fetchFn || globalThis.fetch;
+  if (!config.pixelId) {
+    return {
+      provider: "meta",
+      success: false,
+      error: "Meta Pixel ID is missing"
+    };
+  }
+  const rawUserData = event.userData || {};
+  const hashedUserData = {};
+  if (rawUserData.email) {
+    hashedUserData.em = [await hashSha256(normalizeEmail(String(rawUserData.email)))];
+  }
+  if (rawUserData.phone) {
+    hashedUserData.ph = [await hashSha256(normalizePhone(String(rawUserData.phone)))];
+  }
+  if (rawUserData.firstName) {
+    hashedUserData.fn = [await hashSha256(normalizeText(String(rawUserData.firstName)))];
+  }
+  if (rawUserData.lastName) {
+    hashedUserData.ln = [await hashSha256(normalizeText(String(rawUserData.lastName)))];
+  }
+  if (rawUserData.city) {
+    hashedUserData.ct = [await hashSha256(normalizeText(String(rawUserData.city)))];
+  }
+  if (rawUserData.state) {
+    hashedUserData.st = [await hashSha256(normalizeText(String(rawUserData.state)))];
+  }
+  if (rawUserData.zip) {
+    hashedUserData.zp = [await hashSha256(normalizeText(String(rawUserData.zip)))];
+  }
+  if (rawUserData.country) {
+    hashedUserData.country = [await hashSha256(normalizeText(String(rawUserData.country)))];
+  }
+  const clientIp = rawUserData.clientIp || options?.clientIp;
+  if (clientIp) hashedUserData.client_ip_address = clientIp;
+  const clientUserAgent = rawUserData.clientUserAgent || options?.clientUserAgent;
+  if (clientUserAgent) hashedUserData.client_user_agent = clientUserAgent;
+  if (rawUserData.fbp) hashedUserData.fbp = rawUserData.fbp;
+  if (rawUserData.fbc) hashedUserData.fbc = rawUserData.fbc;
+  if (rawUserData.externalId) {
+    hashedUserData.external_id = [await hashSha256(String(rawUserData.externalId))];
+  }
+  const eventTime = event.eventTime || Math.floor(Date.now() / 1e3);
+  const eventSourceUrl = event.eventSourceUrl || options?.sourceUrl;
+  const capiPayload = {
+    data: [
+      {
+        event_name: event.eventName,
+        event_time: eventTime,
+        event_id: event.eventId,
+        event_source_url: eventSourceUrl,
+        action_source: event.actionSource || "website",
+        user_data: hashedUserData,
+        custom_data: {
+          ...event.params || {},
+          ...event.customData || {}
+        }
+      }
+    ]
+  };
+  if (config.testEventCode) {
+    capiPayload.test_event_code = config.testEventCode;
+  }
+  if (options?.simulateInDebug) {
+    options.onLog?.("[Meta CAPI SIMULATED]", capiPayload);
+    return { provider: "meta", success: true, data: { simulated: true, payload: capiPayload } };
+  }
+  try {
+    const url = `https://graph.facebook.com/v19.0/${encodeURIComponent(config.pixelId)}/events`;
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    if (!secrets?.capiAccessToken) {
+      return skippedResult("meta", "No Meta CAPI access token resolved for this credential");
+    }
+    headers["Authorization"] = `Bearer ${secrets.capiAccessToken}`;
+    const res = await fetcher(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(capiPayload)
+    });
+    const resJson = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      return {
+        provider: "meta",
+        success: false,
+        status: res.status,
+        error: resJson?.error?.message || `HTTP ${res.status}`,
+        data: resJson
+      };
+    }
+    return {
+      provider: "meta",
+      success: true,
+      status: res.status,
+      data: resJson
+    };
+  } catch (err) {
+    return {
+      provider: "meta",
+      success: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function sendTikTokEventsApi(event, config, secrets, options) {
+  const fetcher = options?.fetchFn || globalThis.fetch;
+  if (!config.pixelId) {
+    return { provider: "tiktok", success: false, error: "TikTok Pixel ID is missing" };
+  }
+  const rawUserData = event.userData || {};
+  const user = {};
+  if (rawUserData.email) {
+    user.email = await hashSha256(normalizeEmail(String(rawUserData.email)));
+  }
+  if (rawUserData.phone) {
+    user.phone_number = await hashSha256(normalizePhone(String(rawUserData.phone)));
+  }
+  if (rawUserData.clientIp || options?.clientIp) {
+    user.ip = rawUserData.clientIp || options?.clientIp;
+  }
+  if (rawUserData.clientUserAgent || options?.clientUserAgent) {
+    user.user_agent = rawUserData.clientUserAgent || options?.clientUserAgent;
+  }
+  const tiktokPayload = {
+    event_source: "web",
+    event_source_id: config.pixelId,
+    data: [
+      {
+        event: event.eventName,
+        event_id: event.eventId,
+        timestamp: new Date(event.eventTime ? event.eventTime * 1e3 : Date.now()).toISOString(),
+        user,
+        properties: {
+          ...event.params || {},
+          ...event.customData || {}
+        },
+        page: {
+          url: event.eventSourceUrl || options?.sourceUrl
+        }
+      }
+    ]
+  };
+  if (config.testEventCode) {
+    tiktokPayload.test_event_code = config.testEventCode;
+  }
+  if (options?.simulateInDebug) {
+    options.onLog?.("[TikTok Events API SIMULATED]", tiktokPayload);
+    return { provider: "tiktok", success: true, data: { simulated: true, payload: tiktokPayload } };
+  }
+  try {
+    const url = "https://business-api.tiktok.com/open_api/v1.3/event/track/";
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    if (!secrets?.accessToken) {
+      return skippedResult("tiktok", "No TikTok Events API access token resolved for this credential");
+    }
+    headers["Access-Token"] = secrets.accessToken;
+    const res = await fetcher(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(tiktokPayload)
+    });
+    const resJson = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      return {
+        provider: "tiktok",
+        success: false,
+        status: res.status,
+        error: resJson?.message || `HTTP ${res.status}`,
+        data: resJson
+      };
+    }
+    return { provider: "tiktok", success: true, status: res.status, data: resJson };
+  } catch (err) {
+    return {
+      provider: "tiktok",
+      success: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function sendGa4MeasurementEvent(event, config, secrets, options) {
+  const fetcher = options?.fetchFn || globalThis.fetch;
+  if (!config.measurementId) {
+    return { provider: "google", success: false, error: "GA4 Measurement ID is missing" };
+  }
+  const clientId = event.userData?.clientId || event.userData?.externalId || "anonymous_client";
+  const ga4Payload = {
+    client_id: clientId,
+    events: [
+      {
+        name: event.eventName.toLowerCase().replace(/[^a-z0-9_]/g, "_"),
+        params: {
+          ...event.params || {},
+          ...event.customData || {},
+          event_id: event.eventId
+        }
+      }
+    ]
+  };
+  if (options?.simulateInDebug) {
+    options.onLog?.("[GA4 Measurement Protocol SIMULATED]", ga4Payload);
+    return { provider: "google", success: true, data: { simulated: true, payload: ga4Payload } };
+  }
+  try {
+    if (!secrets?.measurementProtocolSecret) {
+      return skippedResult("google", "No GA4 Measurement Protocol API secret resolved for this credential");
+    }
+    const url = `https://www.google-analytics.com/mp/collect?measurement_id=${encodeURIComponent(config.measurementId)}&api_secret=${encodeURIComponent(secrets.measurementProtocolSecret)}`;
+    const res = await fetcher(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(ga4Payload)
+    });
+    return {
+      provider: "google",
+      success: res.ok,
+      status: res.status,
+      data: { status: res.status }
+    };
+  } catch (err) {
+    return {
+      provider: "google",
+      success: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function sendCustomWebhookEvent(event, _config, secrets, options) {
+  const fetcher = options?.fetchFn || globalThis.fetch;
+  const webhookPayload = {
+    event: event.eventName,
+    eventId: event.eventId,
+    timestamp: event.eventTime ? event.eventTime * 1e3 : Date.now(),
+    userData: event.userData,
+    params: event.params,
+    customData: event.customData,
+    sourceUrl: event.eventSourceUrl || options?.sourceUrl
+  };
+  if (options?.simulateInDebug) {
+    options.onLog?.("[Custom Webhook SIMULATED]", webhookPayload);
+    return { provider: "custom", success: true, data: { simulated: true, payload: webhookPayload } };
+  }
+  if (!secrets?.endpointUrl) {
+    return skippedResult("custom", "No custom webhook destination resolved for this credential");
+  }
+  try {
+    const res = await fetcher(secrets.endpointUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...secrets.headers || {}
+      },
+      body: JSON.stringify(webhookPayload)
+    });
+    const resJson = await res.json().catch(() => ({}));
+    return {
+      provider: "custom",
+      success: res.ok,
+      status: res.status,
+      data: resJson
+    };
+  } catch (err) {
+    return {
+      provider: "custom",
+      success: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function skippedResult(provider, reason) {
+  return { provider, success: true, skipped: true, reason };
+}
+async function dispatchServerTracking(event, config, options) {
+  const eventId = event.eventId || generateTrackingEventId();
+  const eventWithId = { ...event, eventId };
+  if (!config || config.enabled === false) {
+    return {
+      success: true,
+      eventId,
+      skipped: true,
+      reason: "Tracking is disabled globally",
+      results: {}
+    };
+  }
+  const isDebug = Boolean(config.debugMode);
+  const simulate = isDebug && options?.simulateInDebug !== false;
+  const mergedOptions = {
+    ...options,
+    simulateInDebug: simulate,
+    onLog: (msg, data) => {
+      if (isDebug) {
+        console.log(`[KUBUILD Tracking] ${msg}`, data || "");
+      }
+      options?.onLog?.(msg, data);
+    }
+  };
+  const target = options?.provider || "all";
+  const wants = (key) => target === "all" || target === key;
+  const providers = config.providers || {};
+  const tasks = [];
+  const meta = providers.meta;
+  if (wants("meta") && meta && meta.enabled !== false && meta.capiEnabled) {
+    tasks.push({
+      key: "meta",
+      credentialId: meta.credentialId,
+      run: (s) => sendMetaCapiEvent(eventWithId, meta, s, mergedOptions)
+    });
+  }
+  const tiktok = providers.tiktok;
+  if (wants("tiktok") && tiktok && tiktok.enabled !== false && tiktok.eventsApiEnabled) {
+    tasks.push({
+      key: "tiktok",
+      credentialId: tiktok.credentialId,
+      run: (s) => sendTikTokEventsApi(eventWithId, tiktok, s, mergedOptions)
+    });
+  }
+  const google = providers.google;
+  if (wants("google") && google && google.enabled !== false && google.measurementId) {
+    tasks.push({
+      key: "google",
+      credentialId: google.credentialId,
+      run: (s) => sendGa4MeasurementEvent(eventWithId, google, s, mergedOptions)
+    });
+  }
+  const custom = providers.custom;
+  if (wants("custom") && custom && custom.enabled !== false) {
+    tasks.push({
+      key: "custom",
+      credentialId: custom.credentialId,
+      run: (s) => sendCustomWebhookEvent(eventWithId, custom, s, mergedOptions)
+    });
+  }
+  if (tasks.length === 0) {
+    return {
+      success: true,
+      eventId,
+      skipped: true,
+      reason: target === "gtm" ? "GTM is client-side only (dataLayer); no server delivery" : "No server-side tracking provider is enabled",
+      results: {}
+    };
+  }
+  const resolve = options?.resolveSecrets;
+  const runTask = async (task) => {
+    let secrets = null;
+    if (resolve) {
+      try {
+        secrets = await resolve({ provider: task.key, credentialId: task.credentialId, documentId: options?.documentId }) ?? null;
+      } catch (err) {
+        return {
+          provider: task.key,
+          success: false,
+          error: `Secret resolution failed: ${err instanceof Error ? err.message : String(err)}`
+        };
+      }
+    }
+    if (!secrets && !simulate) {
+      const reason = resolve ? `No secret resolved for provider "${task.key}"${task.credentialId ? ` (credentialId "${task.credentialId}")` : " (no credentialId linked)"}` : "No secret resolver configured (options.resolveSecrets)";
+      mergedOptions.onLog?.(`[${task.key}] skipped: ${reason}`);
+      return skippedResult(task.key, reason);
+    }
+    return task.run(secrets);
+  };
+  const settled = await Promise.allSettled(tasks.map((task) => runTask(task)));
+  const results = {};
+  let overallSuccess = true;
+  let delivered = 0;
+  settled.forEach((item, index) => {
+    const key = tasks[index].key;
+    if (item.status === "fulfilled") {
+      results[key] = item.value;
+      if (!item.value.success) overallSuccess = false;
+      if (!item.value.skipped) delivered++;
+    } else {
+      overallSuccess = false;
+      results[key] = {
+        provider: key,
+        success: false,
+        error: item.reason instanceof Error ? item.reason.message : String(item.reason)
+      };
+    }
+  });
+  const allSkipped = delivered === 0 && overallSuccess;
+  return {
+    success: overallSuccess,
+    eventId,
+    ...allSkipped ? { skipped: true, reason: "All server providers were skipped" } : {},
+    results
+  };
+}
+
+// src/runtime/tracking-relay.ts
+import {
+  TRACKING_RELAY_PROTOCOL_VERSION,
+  TrackingRelayRequestSchema
+} from "@kubuild/schema";
+var DEFAULT_MAX_BODY_BYTES = 64 * 1024;
+function defaultClientIp(request) {
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (forwarded) {
+    const first = forwarded.split(",")[0]?.trim();
+    if (first) return first;
+  }
+  return request.headers.get("cf-connecting-ip")?.trim() || request.headers.get("x-real-ip")?.trim() || void 0;
+}
+function isOriginAllowed(origin, allowed) {
+  if (!allowed) return true;
+  if (!origin) return false;
+  if (typeof allowed === "function") return allowed(origin);
+  return allowed.includes(origin);
+}
+function createTrackingRelayHandler(options) {
+  const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+  return async (request) => {
+    const origin = request.headers.get("origin");
+    const corsHeaders = {};
+    if (options.allowedOrigins && origin && isOriginAllowed(origin, options.allowedOrigins)) {
+      corsHeaders["Access-Control-Allow-Origin"] = origin;
+      corsHeaders["Vary"] = "Origin";
+    }
+    const json = (body, status, extra) => new Response(JSON.stringify(body), {
+      status,
+      headers: { "Content-Type": "application/json", ...corsHeaders, ...extra || {} }
+    });
+    const fail = (code, message, status, extra) => json({ version: TRACKING_RELAY_PROTOCOL_VERSION, success: false, error: { code, message } }, status, extra);
+    if (!isOriginAllowed(origin, options.allowedOrigins)) {
+      return fail("FORBIDDEN_ORIGIN", "Origin is not allowed", 403);
+    }
+    if (request.method === "OPTIONS") {
+      return new Response(null, {
+        status: 204,
+        headers: {
+          ...corsHeaders,
+          "Access-Control-Allow-Methods": "POST, OPTIONS",
+          "Access-Control-Allow-Headers": "Content-Type",
+          "Access-Control-Max-Age": "600"
+        }
+      });
+    }
+    if (request.method !== "POST") {
+      return fail("METHOD_NOT_ALLOWED", "Only POST requests are accepted", 405, { Allow: "POST, OPTIONS" });
+    }
+    try {
+      const text = await request.text();
+      if (text.length > maxBodyBytes) {
+        return fail("INVALID_REQUEST", `Request body exceeds ${maxBodyBytes} bytes`, 413);
+      }
+      let raw;
+      try {
+        raw = JSON.parse(text);
+      } catch {
+        return fail("INVALID_REQUEST", "Request body must be valid JSON", 400);
+      }
+      if (raw && typeof raw === "object" && "version" in raw && raw.version !== TRACKING_RELAY_PROTOCOL_VERSION) {
+        return fail(
+          "UNSUPPORTED_VERSION",
+          `Unsupported relay protocol version; expected ${TRACKING_RELAY_PROTOCOL_VERSION}`,
+          400
+        );
+      }
+      const parsed = TrackingRelayRequestSchema.safeParse(raw);
+      if (!parsed.success) {
+        const issues = parsed.error.issues.slice(0, 5).map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+        return fail("INVALID_REQUEST", `Invalid relay request: ${issues}`, 400);
+      }
+      const body = parsed.data;
+      const config = await options.getConfig({
+        request,
+        documentId: body.documentId,
+        credentialId: body.credentialId,
+        provider: body.provider
+      });
+      if (!config) {
+        return fail("CONFIG_NOT_FOUND", "No tracking configuration found for this page", 404);
+      }
+      const clientIp = (options.getClientIp ?? defaultClientIp)(request);
+      const clientUserAgent = request.headers.get("user-agent") || void 0;
+      const userData = { ...body.event.userData || {} };
+      delete userData.clientIp;
+      delete userData.clientUserAgent;
+      const event = { ...body.event, userData };
+      const outcome = await dispatchServerTracking(event, config, {
+        resolveSecrets: options.resolveSecrets,
+        documentId: body.documentId,
+        provider: body.provider,
+        fetchFn: options.fetchFn,
+        clientIp,
+        clientUserAgent,
+        onLog: options.onLog
+      });
+      const results = {};
+      for (const [key, r] of Object.entries(outcome.results)) {
+        results[key] = {
+          provider: r.provider,
+          success: r.success,
+          ...r.status !== void 0 ? { status: r.status } : {},
+          ...r.skipped ? { skipped: true } : {},
+          ...r.reason ? { reason: r.reason } : {},
+          ...r.error ? { error: r.error } : {}
+        };
+      }
+      return json(
+        {
+          version: TRACKING_RELAY_PROTOCOL_VERSION,
+          success: outcome.success,
+          eventId: outcome.eventId,
+          ...outcome.skipped ? { skipped: true } : {},
+          ...outcome.reason ? { reason: outcome.reason } : {},
+          results
+        },
+        200
+      );
+    } catch (err) {
+      options.onLog?.("[Tracking relay] internal error", err);
+      return fail("INTERNAL_ERROR", "Tracking relay failed", 500);
+    }
+  };
+}
+
 // src/io/exporter.ts
 import { zipSync, strToU8 } from "fflate";
 import {
   SCHEMA_NAME as SCHEMA_NAME4,
-  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION2
+  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION3
 } from "@kubuild/schema";
 
 // src/validation/validator.ts
@@ -3001,7 +3560,8 @@ function validateNodeRecursive(nodeObj, currentPath, parentNode, seenIds, visite
         `${currentPath}/props`,
         effectiveNodeId,
         options,
-        errors
+        errors,
+        warnings
       );
     }
   }
@@ -3016,7 +3576,10 @@ function validateNodeRecursive(nodeObj, currentPath, parentNode, seenIds, visite
     }
   }
 }
-function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
+function validatePropsBindings(propsObj, propsPath, nodeId, options, errors, warnings) {
+  const checkAssets = options.checkAssetReferences !== false;
+  const checkVariables = options.checkVariableBindings !== false;
+  const checkActions = options.checkActionBindings !== false;
   for (const [key, value] of Object.entries(propsObj)) {
     const currentPath = `${propsPath}/${key}`;
     if (!value || typeof value !== "object") {
@@ -3030,7 +3593,8 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
             `${currentPath}/${index}`,
             nodeId,
             options,
-            errors
+            errors,
+            warnings
           );
         }
       });
@@ -3038,7 +3602,9 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
     }
     const record = value;
     if (record.type === "asset") {
-      if (typeof record.assetId !== "string" || record.assetId.trim().length === 0) {
+      if (!checkAssets) continue;
+      const assetId = typeof record.assetId === "string" && record.assetId.trim().length > 0 ? record.assetId : void 0;
+      if (assetId === void 0) {
         errors.push({
           code: "INVALID_ASSET_REFERENCE",
           message: 'Asset reference must have a non-empty "assetId"',
@@ -3054,7 +3620,27 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
           nodeId
         });
       }
+      if (assetId !== void 0 && options.knownAssetIds && !isKnownId(options.knownAssetIds, assetId)) {
+        if (typeof record.fallbackUrl === "string" && record.fallbackUrl.length > 0) {
+          warnings.push({
+            code: "UNRESOLVED_ASSET_REFERENCE",
+            message: `Asset "${assetId}" is not among the known assets; its fallbackUrl will be used`,
+            path: `${currentPath}/assetId`,
+            nodeId,
+            details: { assetId }
+          });
+        } else {
+          errors.push({
+            code: "INVALID_ASSET_REFERENCE",
+            message: `Asset "${assetId}" is not among the known assets and has no fallbackUrl`,
+            path: `${currentPath}/assetId`,
+            nodeId,
+            details: { assetId }
+          });
+        }
+      }
     } else if (record.type === "variable") {
+      if (!checkVariables) continue;
       if (typeof record.key !== "string" || record.key.trim().length === 0) {
         errors.push({
           code: "INVALID_VARIABLE_BINDING",
@@ -3064,6 +3650,7 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
         });
       }
     } else if (key === "action" || typeof record.type === "string" && record.payload !== void 0) {
+      if (!checkActions) continue;
       if (typeof record.type !== "string" || record.type.trim().length === 0) {
         errors.push({
           code: "INVALID_ACTION_BINDING",
@@ -3073,10 +3660,62 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
         });
       }
     } else {
-      validatePropsBindings(record, currentPath, nodeId, options, errors);
+      validatePropsBindings(record, currentPath, nodeId, options, errors, warnings);
     }
   }
 }
+function isKnownId(ids, id) {
+  return Array.isArray(ids) ? ids.includes(id) : ids.has(id);
+}
+
+// src/io/tracking-sanitizer.ts
+import { LEGACY_TRACKING_SECRET_KEYS } from "@kubuild/schema";
+function stripTrackingSecretsInPlace(tracking, basePath = "tracking") {
+  const removed = [];
+  if (!tracking || typeof tracking !== "object" || Array.isArray(tracking)) return removed;
+  const providers = tracking.providers;
+  if (!providers || typeof providers !== "object" || Array.isArray(providers)) return removed;
+  for (const provider of Object.keys(LEGACY_TRACKING_SECRET_KEYS)) {
+    const cfg = providers[provider];
+    if (!cfg || typeof cfg !== "object" || Array.isArray(cfg)) continue;
+    for (const key of LEGACY_TRACKING_SECRET_KEYS[provider]) {
+      if (Object.prototype.hasOwnProperty.call(cfg, key)) {
+        delete cfg[key];
+        removed.push(`${basePath}.providers.${provider}.${key}`);
+      }
+    }
+  }
+  return removed;
+}
+function stripDocumentTrackingSecretsInPlace(doc) {
+  const removed = [];
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) return removed;
+  const record = doc;
+  removed.push(...stripTrackingSecretsInPlace(record.tracking, "tracking"));
+  const metadata = record.metadata;
+  if (metadata && typeof metadata === "object" && !Array.isArray(metadata)) {
+    removed.push(
+      ...stripTrackingSecretsInPlace(metadata.tracking, "metadata.tracking")
+    );
+  }
+  if (Array.isArray(record.artboards)) {
+    record.artboards.forEach((artboard, index) => {
+      if (artboard && typeof artboard === "object") {
+        const inner = artboard.document;
+        for (const path of stripDocumentTrackingSecretsInPlace(inner)) {
+          removed.push(`artboards.${index}.document.${path}`);
+        }
+      }
+    });
+  }
+  return removed;
+}
+function sanitizeDocumentTracking(doc) {
+  if (!doc || typeof doc !== "object") return { document: doc, removed: [] };
+  const copy = JSON.parse(JSON.stringify(doc));
+  const removed = stripDocumentTrackingSecretsInPlace(copy);
+  return { document: copy, removed };
+}
 
 // src/io/exporter.ts
 function sha256Sync(data) {
@@ -3297,6 +3936,7 @@ async function exportPackage(document, options = {}) {
     };
   }
   const pageDoc = JSON.parse(JSON.stringify(validation.data));
+  stripDocumentTrackingSecretsInPlace(pageDoc);
   if (options.metadata) {
     pageDoc.metadata = {
       ...pageDoc.metadata || {
@@ -3421,7 +4061,7 @@ async function exportPackage(document, options = {}) {
   };
   const manifest = {
     schema: SCHEMA_NAME4,
-    schemaVersion: pageDoc.version || CURRENT_SCHEMA_VERSION2,
+    schemaVersion: pageDoc.version || CURRENT_SCHEMA_VERSION3,
     packageVersion: options.packageVersion || "1.0.0",
     builderCompatibility: options.builderCompatibility || ">=0.1.0",
     requiredComponents: requirements.requiredComponents,
@@ -3448,12 +4088,12 @@ var exportStoraPackage = exportPackage;
 import { unzipSync, strFromU8 } from "fflate";
 import {
   ManifestSchema,
-  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION4
+  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION5
 } from "@kubuild/schema";
 
 // src/io/migration.ts
 import {
-  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION3,
+  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION4,
   SCHEMA_NAME as SCHEMA_NAME5
 } from "@kubuild/schema";
 var MigrationRegistry = class {
@@ -3608,17 +4248,36 @@ defaultMigrationRegistry.register({
     return migrated;
   }
 });
-function canMigrate(sourceVersion, targetVersion = CURRENT_SCHEMA_VERSION3, registry = defaultMigrationRegistry) {
+defaultMigrationRegistry.register({
+  fromVersion: "1.0.0",
+  toVersion: "1.1.0",
+  description: "Remove tracking secrets and server destinations (capiAccessToken, accessToken, measurementProtocolSecret, serverRelayUrl, custom endpointUrl/headers) from the document",
+  migrate: (rawDoc, context) => {
+    const migrated = deepClone(rawDoc);
+    migrated.version = "1.1.0";
+    const removed = stripDocumentTrackingSecretsInPlace(migrated);
+    if (removed.length > 0) {
+      context.warn({
+        code: "TRACKING_SECRET_REMOVED",
+        message: "Tracking secret removed; re-link credential via credentialId (secrets are now stored by the host and resolved server-side).",
+        step: "1.0.0->1.1.0",
+        paths: removed
+      });
+    }
+    return migrated;
+  }
+});
+function canMigrate(sourceVersion, targetVersion = CURRENT_SCHEMA_VERSION4, registry = defaultMigrationRegistry) {
   if (!sourceVersion || !targetVersion) return false;
   if (sourceVersion === targetVersion) return true;
   return registry.hasPath(sourceVersion, targetVersion);
 }
-function getMigrationPath(sourceVersion, targetVersion = CURRENT_SCHEMA_VERSION3, registry = defaultMigrationRegistry) {
+function getMigrationPath(sourceVersion, targetVersion = CURRENT_SCHEMA_VERSION4, registry = defaultMigrationRegistry) {
   if (!sourceVersion || !targetVersion) return null;
   return registry.findPath(sourceVersion, targetVersion);
 }
 function migrateDocument(rawDocument, options = {}) {
-  const targetVersion = options.targetVersion ?? CURRENT_SCHEMA_VERSION3;
+  const targetVersion = options.targetVersion ?? CURRENT_SCHEMA_VERSION4;
   const dryRun = options.dryRun ?? false;
   const registry = options.registry ?? defaultMigrationRegistry;
   const validate = options.validate ?? true;
@@ -3646,6 +4305,14 @@ function migrateDocument(rawDocument, options = {}) {
   const sourceVersion = typeof doc.version === "string" ? doc.version.trim() : "unknown";
   if (sourceVersion === targetVersion) {
     const cloned = deepClone(doc);
+    const removedSecrets = stripDocumentTrackingSecretsInPlace(cloned);
+    const currentWarnings = removedSecrets.length > 0 ? [
+      {
+        code: "TRACKING_SECRET_REMOVED",
+        message: "Tracking secret removed; re-link credential via credentialId (secrets are stored by the host and resolved server-side).",
+        paths: removedSecrets
+      }
+    ] : [];
     if (validate) {
       const validation = validateDocument(cloned);
       if (!validation.valid) {
@@ -3677,7 +4344,8 @@ function migrateDocument(rawDocument, options = {}) {
         targetVersion,
         migrationPath: [sourceVersion],
         stepsApplied: 0,
-        dryRun
+        dryRun,
+        ...currentWarnings.length > 0 ? { warnings: currentWarnings } : {}
       }
     };
   }
@@ -3717,6 +4385,8 @@ function migrateDocument(rawDocument, options = {}) {
   }
   let currentDoc = deepClone(doc);
   let stepsApplied = 0;
+  const warnings = [];
+  const stepContext = { warn: (w) => warnings.push(w) };
   for (let i = 0; i < path.length - 1; i++) {
     const fromVer = path[i];
     const toVer = path[i + 1];
@@ -3742,7 +4412,7 @@ function migrateDocument(rawDocument, options = {}) {
       };
     }
     try {
-      currentDoc = step.migrate(currentDoc);
+      currentDoc = step.migrate(currentDoc, stepContext);
       stepsApplied++;
     } catch (err) {
       const error = {
@@ -3798,7 +4468,8 @@ function migrateDocument(rawDocument, options = {}) {
       targetVersion,
       migrationPath: path,
       stepsApplied,
-      dryRun: false
+      dryRun: false,
+      ...warnings.length > 0 ? { warnings } : {}
     }
   };
 }
@@ -3833,7 +4504,7 @@ async function preflightPackage(archiveData, options = {}) {
     ...DEFAULT_SECURITY_LIMITS,
     ...options.securityLimits
   };
-  const targetVersion = options.targetSchemaVersion || CURRENT_SCHEMA_VERSION4;
+  const targetVersion = options.targetSchemaVersion || CURRENT_SCHEMA_VERSION5;
   const migrationRegistry = options.migrationRegistry || defaultMigrationRegistry;
   const diagnostics = [];
   let dependencyPolicy = options.dependencyPolicy || "cancel";
@@ -3996,6 +4667,16 @@ async function preflightPackage(archiveData, options = {}) {
   let rawPageDoc;
   try {
     rawPageDoc = JSON.parse(strFromU8(pageEntry));
+    const secretScan = sanitizeDocumentTracking(rawPageDoc);
+    if (secretScan.removed.length > 0) {
+      diagnostics.push({
+        code: "TRACKING_SECRET_REMOVED",
+        severity: "warning",
+        message: "Tracking secrets found in page.json will be removed on import; re-link credentials via credentialId.",
+        path: "page.json",
+        details: { paths: secretScan.removed }
+      });
+    }
     const pageProtoCheck = containsProhibitedKeys(rawPageDoc);
     if (pageProtoCheck.found) {
       diagnostics.push({
@@ -4242,7 +4923,7 @@ function buildReport(valid, canImport, fields) {
   return {
     valid,
     canImport,
-    targetVersion: fields.targetVersion || CURRENT_SCHEMA_VERSION4,
+    targetVersion: fields.targetVersion || CURRENT_SCHEMA_VERSION5,
     requiresMigration: fields.requiresMigration || false,
     missingComponents: fields.missingComponents || [],
     missingCapabilities: fields.missingCapabilities || [],
@@ -4315,7 +4996,7 @@ async function importPackage(archiveData, options = {}) {
   if (preflight.requiresMigration) {
     const migrationRegistry = options.migrationRegistry || defaultMigrationRegistry;
     const migrationRes = migrateDocument(pageRaw, {
-      targetVersion: options.targetSchemaVersion || CURRENT_SCHEMA_VERSION4,
+      targetVersion: options.targetSchemaVersion || CURRENT_SCHEMA_VERSION5,
       registry: migrationRegistry,
       validate: true
     });
@@ -4337,13 +5018,24 @@ async function importPackage(archiveData, options = {}) {
   } else {
     finalDocument = pageRaw;
   }
+  const importWarnings = [];
+  const strippedSecrets = stripDocumentTrackingSecretsInPlace(finalDocument);
+  if (strippedSecrets.length > 0) {
+    importWarnings.push({
+      code: "TRACKING_SECRET_REMOVED",
+      severity: "warning",
+      message: "Tracking secret removed from imported document; re-link credential via credentialId.",
+      path: "page.json",
+      details: { paths: strippedSecrets }
+    });
+  }
   let metadata = finalDocument.metadata || {
     title: "Imported Page",
     description: "",
     author: "",
     tags: [],
     category: "general",
-    version: finalDocument.version || CURRENT_SCHEMA_VERSION4
+    version: finalDocument.version || CURRENT_SCHEMA_VERSION5
   };
   if (unzipped["metadata.json"]) {
     try {
@@ -4495,7 +5187,8 @@ async function importPackage(archiveData, options = {}) {
     metadata,
     extractedAssets,
     renamedAssets: Object.keys(renameMap).length > 0 ? renameMap : void 0,
-    preflight
+    preflight,
+    ...importWarnings.length > 0 ? { warnings: importWarnings } : {}
   };
 }
 var importStoraPackage = importPackage;
@@ -5638,10 +6331,12 @@ export {
   createPageArtboard,
   createRuntimeStore,
   createTemplateRecord,
+  createTrackingRelayHandler,
   deepClone,
   defaultIdGenerator,
   defaultMigrationRegistry,
   defaultRenameAssetStrategy,
+  dispatchServerTracking,
   duplicateNode,
   evaluateActionCondition,
   evaluateCondition,
@@ -5661,6 +6356,7 @@ export {
   findMissingComponentNodes,
   findNodeById,
   findNodeLocation,
+  generateTrackingEventId,
   getActiveArtboard,
   getAncestorChain,
   getComponentArtboards,
@@ -5670,6 +6366,7 @@ export {
   getPageArtboards,
   getParentNodeId,
   hasTemplateExpressions,
+  hashSha256,
   importPackage,
   importStoraPackage,
   insertNode,
@@ -5687,6 +6384,9 @@ export {
   loadProjectDocument,
   migrateDocument,
   moveNode,
+  normalizeEmail,
+  normalizePhone,
+  normalizeText,
   preflightPackage,
   previewImportPackage,
   remapAssetReferences,
@@ -5698,12 +6398,19 @@ export {
   resolveBinding,
   resolveBindingValue,
   resolvePropertyPath,
+  sanitizeDocumentTracking,
   sanitizeFilename,
   sanitizeHtml,
   sanitizeUrl,
   saveDraftAsTemplate,
+  sendCustomWebhookEvent,
+  sendGa4MeasurementEvent,
+  sendMetaCapiEvent,
+  sendTikTokEventsApi,
   setActiveArtboard,
   sha256Sync,
+  stripDocumentTrackingSecretsInPlace,
+  stripTrackingSecretsInPlace,
   ungroupNodeFrame,
   updateActions,
   updateAnimation,