@kubuild/core 0.6.0 → 0.7.0

package/dist/index.cjs

@@ -54,6 +54,7 @@ __export(index_exports, {
   createPageArtboard: () => createPageArtboard,
   createRuntimeStore: () => createRuntimeStore,
   createTemplateRecord: () => createTemplateRecord,
+  createTrackingRelayHandler: () => createTrackingRelayHandler,
   deepClone: () => deepClone,
   defaultIdGenerator: () => defaultIdGenerator,
   defaultMigrationRegistry: () => defaultMigrationRegistry,
@@ -120,6 +121,7 @@ __export(index_exports, {
   resolveBinding: () => resolveBinding,
   resolveBindingValue: () => resolveBindingValue,
   resolvePropertyPath: () => resolvePropertyPath,
+  sanitizeDocumentTracking: () => sanitizeDocumentTracking,
   sanitizeFilename: () => sanitizeFilename,
   sanitizeHtml: () => sanitizeHtml,
   sanitizeUrl: () => sanitizeUrl,
@@ -130,6 +132,8 @@ __export(index_exports, {
   sendTikTokEventsApi: () => sendTikTokEventsApi,
   setActiveArtboard: () => setActiveArtboard,
   sha256Sync: () => sha256Sync,
+  stripDocumentTrackingSecretsInPlace: () => stripDocumentTrackingSecretsInPlace,
+  stripTrackingSecretsInPlace: () => stripTrackingSecretsInPlace,
   ungroupNodeFrame: () => ungroupNodeFrame,
   updateActions: () => updateActions,
   updateAnimation: () => updateAnimation,
@@ -155,7 +159,7 @@ var import_schema = require("@kubuild/schema");
 function createBlankDocument(title = "Untitled Page") {
   return {
     schema: import_schema.SCHEMA_NAME,
-    version: "1.0.0",
+    version: import_schema.CURRENT_SCHEMA_VERSION,
     metadata: {
       title,
       description: "",
@@ -1551,6 +1555,15 @@ var DocumentHistoryManager = class {
 var FORBIDDEN_KEY_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function resolveBinding(binding, context) {
   const segments = binding.key.split(".").filter(Boolean);
+  if (segments.some((segment) => FORBIDDEN_KEY_SEGMENTS.has(segment))) {
+    return applyMissingPolicy(binding);
+  }
+  if (context?.variables && typeof context.variables === "object" && Object.prototype.hasOwnProperty.call(context.variables, binding.key)) {
+    const directValue = context.variables[binding.key];
+    if (directValue !== void 0 && typeof directValue !== "function") {
+      return { status: "resolved", value: directValue };
+    }
+  }
   let current = context?.variables;
   for (const segment of segments) {
     if (FORBIDDEN_KEY_SEGMENTS.has(segment)) {
@@ -2122,14 +2135,14 @@ var ActionPipelineExecutor = class {
   async executeSingleStep(step, context, parentSignal, options) {
     const stepStartTime = Date.now();
     if (step.condition && !evaluateActionCondition(step.condition, context)) {
-      const skippedResult = {
+      const skippedResult2 = {
         stepId: step.id,
         stepType: step.type,
         status: "skipped",
         durationMs: Date.now() - stepStartTime
       };
-      options?.onStepComplete?.(step, skippedResult, context);
-      return skippedResult;
+      options?.onStepComplete?.(step, skippedResult2, context);
+      return skippedResult2;
     }
     options?.onStepStart?.(step, context);
     const stepTimeout = step.timeout;
@@ -2621,7 +2634,7 @@ function generateTrackingEventId(prefix = "evt") {
   const randomPart = Math.random().toString(36).substring(2, 10);
   return `${prefix}_${timestamp}_${randomPart}`;
 }
-async function sendMetaCapiEvent(event, config, options) {
+async function sendMetaCapiEvent(event, config, secrets, options) {
   const fetcher = options?.fetchFn || globalThis.fetch;
   if (!config.pixelId) {
     return {
@@ -2695,9 +2708,10 @@ async function sendMetaCapiEvent(event, config, options) {
     const headers = {
       "Content-Type": "application/json"
     };
-    if (config.capiAccessToken) {
-      headers["Authorization"] = `Bearer ${config.capiAccessToken}`;
+    if (!secrets?.capiAccessToken) {
+      return skippedResult("meta", "No Meta CAPI access token resolved for this credential");
     }
+    headers["Authorization"] = `Bearer ${secrets.capiAccessToken}`;
     const res = await fetcher(url, {
       method: "POST",
       headers,
@@ -2727,7 +2741,7 @@ async function sendMetaCapiEvent(event, config, options) {
     };
   }
 }
-async function sendTikTokEventsApi(event, config, options) {
+async function sendTikTokEventsApi(event, config, secrets, options) {
   const fetcher = options?.fetchFn || globalThis.fetch;
   if (!config.pixelId) {
     return { provider: "tiktok", success: false, error: "TikTok Pixel ID is missing" };
@@ -2777,9 +2791,10 @@ async function sendTikTokEventsApi(event, config, options) {
     const headers = {
       "Content-Type": "application/json"
     };
-    if (config.accessToken) {
-      headers["Access-Token"] = config.accessToken;
+    if (!secrets?.accessToken) {
+      return skippedResult("tiktok", "No TikTok Events API access token resolved for this credential");
     }
+    headers["Access-Token"] = secrets.accessToken;
     const res = await fetcher(url, {
       method: "POST",
       headers,
@@ -2804,7 +2819,7 @@ async function sendTikTokEventsApi(event, config, options) {
     };
   }
 }
-async function sendGa4MeasurementEvent(event, config, options) {
+async function sendGa4MeasurementEvent(event, config, secrets, options) {
   const fetcher = options?.fetchFn || globalThis.fetch;
   if (!config.measurementId) {
     return { provider: "google", success: false, error: "GA4 Measurement ID is missing" };
@@ -2828,12 +2843,10 @@ async function sendGa4MeasurementEvent(event, config, options) {
     return { provider: "google", success: true, data: { simulated: true, payload: ga4Payload } };
   }
   try {
-    let url = `https://www.google-analytics.com/mp/collect?measurement_id=${encodeURIComponent(
-      config.measurementId
-    )}`;
-    if (config.measurementProtocolSecret) {
-      url += `&api_secret=${encodeURIComponent(config.measurementProtocolSecret)}`;
+    if (!secrets?.measurementProtocolSecret) {
+      return skippedResult("google", "No GA4 Measurement Protocol API secret resolved for this credential");
     }
+    const url = `https://www.google-analytics.com/mp/collect?measurement_id=${encodeURIComponent(config.measurementId)}&api_secret=${encodeURIComponent(secrets.measurementProtocolSecret)}`;
     const res = await fetcher(url, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
@@ -2853,11 +2866,8 @@ async function sendGa4MeasurementEvent(event, config, options) {
     };
   }
 }
-async function sendCustomWebhookEvent(event, config, options) {
+async function sendCustomWebhookEvent(event, _config, secrets, options) {
   const fetcher = options?.fetchFn || globalThis.fetch;
-  if (!config.endpointUrl) {
-    return { provider: "custom", success: false, error: "Custom Webhook URL is missing" };
-  }
   const webhookPayload = {
     event: event.eventName,
     eventId: event.eventId,
@@ -2871,12 +2881,15 @@ async function sendCustomWebhookEvent(event, config, options) {
     options.onLog?.("[Custom Webhook SIMULATED]", webhookPayload);
     return { provider: "custom", success: true, data: { simulated: true, payload: webhookPayload } };
   }
+  if (!secrets?.endpointUrl) {
+    return skippedResult("custom", "No custom webhook destination resolved for this credential");
+  }
   try {
-    const res = await fetcher(config.endpointUrl, {
+    const res = await fetcher(secrets.endpointUrl, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        ...config.headers || {}
+        ...secrets.headers || {}
       },
       body: JSON.stringify(webhookPayload)
     });
@@ -2895,6 +2908,9 @@ async function sendCustomWebhookEvent(event, config, options) {
     };
   }
 }
+function skippedResult(provider, reason) {
+  return { provider, success: true, skipped: true, reason };
+}
 async function dispatchServerTracking(event, config, options) {
   const eventId = event.eventId || generateTrackingEventId();
   const eventWithId = { ...event, eventId };
@@ -2919,66 +2935,231 @@ async function dispatchServerTracking(event, config, options) {
       options?.onLog?.(msg, data);
     }
   };
+  const target = options?.provider || "all";
+  const wants = (key) => target === "all" || target === key;
   const providers = config.providers || {};
-  const dispatchPromises = [];
-  if (providers.meta && providers.meta.enabled !== false && providers.meta.capiEnabled) {
-    dispatchPromises.push(
-      sendMetaCapiEvent(eventWithId, providers.meta, mergedOptions).then((result) => ({
-        key: "meta",
-        result
-      }))
-    );
+  const tasks = [];
+  const meta = providers.meta;
+  if (wants("meta") && meta && meta.enabled !== false && meta.capiEnabled) {
+    tasks.push({
+      key: "meta",
+      credentialId: meta.credentialId,
+      run: (s) => sendMetaCapiEvent(eventWithId, meta, s, mergedOptions)
+    });
   }
-  if (providers.tiktok && providers.tiktok.enabled !== false && providers.tiktok.eventsApiEnabled) {
-    dispatchPromises.push(
-      sendTikTokEventsApi(eventWithId, providers.tiktok, mergedOptions).then((result) => ({
-        key: "tiktok",
-        result
-      }))
-    );
+  const tiktok = providers.tiktok;
+  if (wants("tiktok") && tiktok && tiktok.enabled !== false && tiktok.eventsApiEnabled) {
+    tasks.push({
+      key: "tiktok",
+      credentialId: tiktok.credentialId,
+      run: (s) => sendTikTokEventsApi(eventWithId, tiktok, s, mergedOptions)
+    });
   }
-  if (providers.google && providers.google.enabled !== false && providers.google.measurementId && providers.google.measurementProtocolSecret) {
-    dispatchPromises.push(
-      sendGa4MeasurementEvent(eventWithId, providers.google, mergedOptions).then((result) => ({
-        key: "google",
-        result
-      }))
-    );
+  const google = providers.google;
+  if (wants("google") && google && google.enabled !== false && google.measurementId) {
+    tasks.push({
+      key: "google",
+      credentialId: google.credentialId,
+      run: (s) => sendGa4MeasurementEvent(eventWithId, google, s, mergedOptions)
+    });
   }
-  if (providers.custom && providers.custom.enabled !== false && providers.custom.endpointUrl) {
-    dispatchPromises.push(
-      sendCustomWebhookEvent(eventWithId, providers.custom, mergedOptions).then((result) => ({
-        key: "custom",
-        result
-      }))
-    );
+  const custom = providers.custom;
+  if (wants("custom") && custom && custom.enabled !== false) {
+    tasks.push({
+      key: "custom",
+      credentialId: custom.credentialId,
+      run: (s) => sendCustomWebhookEvent(eventWithId, custom, s, mergedOptions)
+    });
+  }
+  if (tasks.length === 0) {
+    return {
+      success: true,
+      eventId,
+      skipped: true,
+      reason: target === "gtm" ? "GTM is client-side only (dataLayer); no server delivery" : "No server-side tracking provider is enabled",
+      results: {}
+    };
   }
-  const settled = await Promise.allSettled(dispatchPromises);
+  const resolve = options?.resolveSecrets;
+  const runTask = async (task) => {
+    let secrets = null;
+    if (resolve) {
+      try {
+        secrets = await resolve({ provider: task.key, credentialId: task.credentialId, documentId: options?.documentId }) ?? null;
+      } catch (err) {
+        return {
+          provider: task.key,
+          success: false,
+          error: `Secret resolution failed: ${err instanceof Error ? err.message : String(err)}`
+        };
+      }
+    }
+    if (!secrets && !simulate) {
+      const reason = resolve ? `No secret resolved for provider "${task.key}"${task.credentialId ? ` (credentialId "${task.credentialId}")` : " (no credentialId linked)"}` : "No secret resolver configured (options.resolveSecrets)";
+      mergedOptions.onLog?.(`[${task.key}] skipped: ${reason}`);
+      return skippedResult(task.key, reason);
+    }
+    return task.run(secrets);
+  };
+  const settled = await Promise.allSettled(tasks.map((task) => runTask(task)));
   const results = {};
   let overallSuccess = true;
-  for (const item of settled) {
+  let delivered = 0;
+  settled.forEach((item, index) => {
+    const key = tasks[index].key;
     if (item.status === "fulfilled") {
-      results[item.value.key] = item.value.result;
-      if (!item.value.result.success) {
-        overallSuccess = false;
-      }
+      results[key] = item.value;
+      if (!item.value.success) overallSuccess = false;
+      if (!item.value.skipped) delivered++;
     } else {
       overallSuccess = false;
+      results[key] = {
+        provider: key,
+        success: false,
+        error: item.reason instanceof Error ? item.reason.message : String(item.reason)
+      };
     }
-  }
+  });
+  const allSkipped = delivered === 0 && overallSuccess;
   return {
     success: overallSuccess,
     eventId,
+    ...allSkipped ? { skipped: true, reason: "All server providers were skipped" } : {},
     results
   };
 }
 
+// src/runtime/tracking-relay.ts
+var import_schema5 = require("@kubuild/schema");
+var DEFAULT_MAX_BODY_BYTES = 64 * 1024;
+function defaultClientIp(request) {
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (forwarded) {
+    const first = forwarded.split(",")[0]?.trim();
+    if (first) return first;
+  }
+  return request.headers.get("cf-connecting-ip")?.trim() || request.headers.get("x-real-ip")?.trim() || void 0;
+}
+function isOriginAllowed(origin, allowed) {
+  if (!allowed) return true;
+  if (!origin) return false;
+  if (typeof allowed === "function") return allowed(origin);
+  return allowed.includes(origin);
+}
+function createTrackingRelayHandler(options) {
+  const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+  return async (request) => {
+    const origin = request.headers.get("origin");
+    const corsHeaders = {};
+    if (options.allowedOrigins && origin && isOriginAllowed(origin, options.allowedOrigins)) {
+      corsHeaders["Access-Control-Allow-Origin"] = origin;
+      corsHeaders["Vary"] = "Origin";
+    }
+    const json = (body, status, extra) => new Response(JSON.stringify(body), {
+      status,
+      headers: { "Content-Type": "application/json", ...corsHeaders, ...extra || {} }
+    });
+    const fail = (code, message, status, extra) => json({ version: import_schema5.TRACKING_RELAY_PROTOCOL_VERSION, success: false, error: { code, message } }, status, extra);
+    if (!isOriginAllowed(origin, options.allowedOrigins)) {
+      return fail("FORBIDDEN_ORIGIN", "Origin is not allowed", 403);
+    }
+    if (request.method === "OPTIONS") {
+      return new Response(null, {
+        status: 204,
+        headers: {
+          ...corsHeaders,
+          "Access-Control-Allow-Methods": "POST, OPTIONS",
+          "Access-Control-Allow-Headers": "Content-Type",
+          "Access-Control-Max-Age": "600"
+        }
+      });
+    }
+    if (request.method !== "POST") {
+      return fail("METHOD_NOT_ALLOWED", "Only POST requests are accepted", 405, { Allow: "POST, OPTIONS" });
+    }
+    try {
+      const text = await request.text();
+      if (text.length > maxBodyBytes) {
+        return fail("INVALID_REQUEST", `Request body exceeds ${maxBodyBytes} bytes`, 413);
+      }
+      let raw;
+      try {
+        raw = JSON.parse(text);
+      } catch {
+        return fail("INVALID_REQUEST", "Request body must be valid JSON", 400);
+      }
+      if (raw && typeof raw === "object" && "version" in raw && raw.version !== import_schema5.TRACKING_RELAY_PROTOCOL_VERSION) {
+        return fail(
+          "UNSUPPORTED_VERSION",
+          `Unsupported relay protocol version; expected ${import_schema5.TRACKING_RELAY_PROTOCOL_VERSION}`,
+          400
+        );
+      }
+      const parsed = import_schema5.TrackingRelayRequestSchema.safeParse(raw);
+      if (!parsed.success) {
+        const issues = parsed.error.issues.slice(0, 5).map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+        return fail("INVALID_REQUEST", `Invalid relay request: ${issues}`, 400);
+      }
+      const body = parsed.data;
+      const config = await options.getConfig({
+        request,
+        documentId: body.documentId,
+        credentialId: body.credentialId,
+        provider: body.provider
+      });
+      if (!config) {
+        return fail("CONFIG_NOT_FOUND", "No tracking configuration found for this page", 404);
+      }
+      const clientIp = (options.getClientIp ?? defaultClientIp)(request);
+      const clientUserAgent = request.headers.get("user-agent") || void 0;
+      const userData = { ...body.event.userData || {} };
+      delete userData.clientIp;
+      delete userData.clientUserAgent;
+      const event = { ...body.event, userData };
+      const outcome = await dispatchServerTracking(event, config, {
+        resolveSecrets: options.resolveSecrets,
+        documentId: body.documentId,
+        provider: body.provider,
+        fetchFn: options.fetchFn,
+        clientIp,
+        clientUserAgent,
+        onLog: options.onLog
+      });
+      const results = {};
+      for (const [key, r] of Object.entries(outcome.results)) {
+        results[key] = {
+          provider: r.provider,
+          success: r.success,
+          ...r.status !== void 0 ? { status: r.status } : {},
+          ...r.skipped ? { skipped: true } : {},
+          ...r.reason ? { reason: r.reason } : {},
+          ...r.error ? { error: r.error } : {}
+        };
+      }
+      return json(
+        {
+          version: import_schema5.TRACKING_RELAY_PROTOCOL_VERSION,
+          success: outcome.success,
+          eventId: outcome.eventId,
+          ...outcome.skipped ? { skipped: true } : {},
+          ...outcome.reason ? { reason: outcome.reason } : {},
+          results
+        },
+        200
+      );
+    } catch (err) {
+      options.onLog?.("[Tracking relay] internal error", err);
+      return fail("INTERNAL_ERROR", "Tracking relay failed", 500);
+    }
+  };
+}
+
 // src/io/exporter.ts
 var import_fflate = require("fflate");
-var import_schema6 = require("@kubuild/schema");
+var import_schema8 = require("@kubuild/schema");
 
 // src/validation/validator.ts
-var import_schema5 = require("@kubuild/schema");
+var import_schema6 = require("@kubuild/schema");
 
 // src/validation/security.ts
 var DEFAULT_DOCUMENT_SECURITY_LIMITS = {
@@ -3267,10 +3448,10 @@ function validateDocument(input, options = {}) {
       };
     }
   }
-  if (doc.schema !== import_schema5.SCHEMA_NAME) {
+  if (doc.schema !== import_schema6.SCHEMA_NAME) {
     errors.push({
       code: "GLOBAL_SCHEMA_INVALID",
-      message: `Invalid schema identifier. Expected "${import_schema5.SCHEMA_NAME}", received "${String(doc.schema)}"`,
+      message: `Invalid schema identifier. Expected "${import_schema6.SCHEMA_NAME}", received "${String(doc.schema)}"`,
       path: "/schema"
     });
   }
@@ -3334,7 +3515,7 @@ function validateDocument(input, options = {}) {
     warnings
   );
   if (errors.length === 0) {
-    const zodResult = import_schema5.PageDocumentSchema.safeParse(input);
+    const zodResult = import_schema6.PageDocumentSchema.safeParse(input);
     if (!zodResult.success) {
       for (const issue of zodResult.error.issues) {
         const jsonPath = "/" + issue.path.join("/");
@@ -3514,7 +3695,8 @@ function validateNodeRecursive(nodeObj, currentPath, parentNode, seenIds, visite
         `${currentPath}/props`,
         effectiveNodeId,
         options,
-        errors
+        errors,
+        warnings
       );
     }
   }
@@ -3529,7 +3711,10 @@ function validateNodeRecursive(nodeObj, currentPath, parentNode, seenIds, visite
     }
   }
 }
-function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
+function validatePropsBindings(propsObj, propsPath, nodeId, options, errors, warnings) {
+  const checkAssets = options.checkAssetReferences !== false;
+  const checkVariables = options.checkVariableBindings !== false;
+  const checkActions = options.checkActionBindings !== false;
   for (const [key, value] of Object.entries(propsObj)) {
     const currentPath = `${propsPath}/${key}`;
     if (!value || typeof value !== "object") {
@@ -3543,7 +3728,8 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
             `${currentPath}/${index}`,
             nodeId,
             options,
-            errors
+            errors,
+            warnings
           );
         }
       });
@@ -3551,7 +3737,9 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
     }
     const record = value;
     if (record.type === "asset") {
-      if (typeof record.assetId !== "string" || record.assetId.trim().length === 0) {
+      if (!checkAssets) continue;
+      const assetId = typeof record.assetId === "string" && record.assetId.trim().length > 0 ? record.assetId : void 0;
+      if (assetId === void 0) {
         errors.push({
           code: "INVALID_ASSET_REFERENCE",
           message: 'Asset reference must have a non-empty "assetId"',
@@ -3567,7 +3755,27 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
           nodeId
         });
       }
+      if (assetId !== void 0 && options.knownAssetIds && !isKnownId(options.knownAssetIds, assetId)) {
+        if (typeof record.fallbackUrl === "string" && record.fallbackUrl.length > 0) {
+          warnings.push({
+            code: "UNRESOLVED_ASSET_REFERENCE",
+            message: `Asset "${assetId}" is not among the known assets; its fallbackUrl will be used`,
+            path: `${currentPath}/assetId`,
+            nodeId,
+            details: { assetId }
+          });
+        } else {
+          errors.push({
+            code: "INVALID_ASSET_REFERENCE",
+            message: `Asset "${assetId}" is not among the known assets and has no fallbackUrl`,
+            path: `${currentPath}/assetId`,
+            nodeId,
+            details: { assetId }
+          });
+        }
+      }
     } else if (record.type === "variable") {
+      if (!checkVariables) continue;
       if (typeof record.key !== "string" || record.key.trim().length === 0) {
         errors.push({
           code: "INVALID_VARIABLE_BINDING",
@@ -3577,6 +3785,7 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
         });
       }
     } else if (key === "action" || typeof record.type === "string" && record.payload !== void 0) {
+      if (!checkActions) continue;
       if (typeof record.type !== "string" || record.type.trim().length === 0) {
         errors.push({
           code: "INVALID_ACTION_BINDING",
@@ -3586,10 +3795,62 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
         });
       }
     } else {
-      validatePropsBindings(record, currentPath, nodeId, options, errors);
+      validatePropsBindings(record, currentPath, nodeId, options, errors, warnings);
     }
   }
 }
+function isKnownId(ids, id) {
+  return Array.isArray(ids) ? ids.includes(id) : ids.has(id);
+}
+
+// src/io/tracking-sanitizer.ts
+var import_schema7 = require("@kubuild/schema");
+function stripTrackingSecretsInPlace(tracking, basePath = "tracking") {
+  const removed = [];
+  if (!tracking || typeof tracking !== "object" || Array.isArray(tracking)) return removed;
+  const providers = tracking.providers;
+  if (!providers || typeof providers !== "object" || Array.isArray(providers)) return removed;
+  for (const provider of Object.keys(import_schema7.LEGACY_TRACKING_SECRET_KEYS)) {
+    const cfg = providers[provider];
+    if (!cfg || typeof cfg !== "object" || Array.isArray(cfg)) continue;
+    for (const key of import_schema7.LEGACY_TRACKING_SECRET_KEYS[provider]) {
+      if (Object.prototype.hasOwnProperty.call(cfg, key)) {
+        delete cfg[key];
+        removed.push(`${basePath}.providers.${provider}.${key}`);
+      }
+    }
+  }
+  return removed;
+}
+function stripDocumentTrackingSecretsInPlace(doc) {
+  const removed = [];
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) return removed;
+  const record = doc;
+  removed.push(...stripTrackingSecretsInPlace(record.tracking, "tracking"));
+  const metadata = record.metadata;
+  if (metadata && typeof metadata === "object" && !Array.isArray(metadata)) {
+    removed.push(
+      ...stripTrackingSecretsInPlace(metadata.tracking, "metadata.tracking")
+    );
+  }
+  if (Array.isArray(record.artboards)) {
+    record.artboards.forEach((artboard, index) => {
+      if (artboard && typeof artboard === "object") {
+        const inner = artboard.document;
+        for (const path of stripDocumentTrackingSecretsInPlace(inner)) {
+          removed.push(`artboards.${index}.document.${path}`);
+        }
+      }
+    });
+  }
+  return removed;
+}
+function sanitizeDocumentTracking(doc) {
+  if (!doc || typeof doc !== "object") return { document: doc, removed: [] };
+  const copy = JSON.parse(JSON.stringify(doc));
+  const removed = stripDocumentTrackingSecretsInPlace(copy);
+  return { document: copy, removed };
+}
 
 // src/io/exporter.ts
 function sha256Sync(data) {
@@ -3810,6 +4071,7 @@ async function exportPackage(document, options = {}) {
     };
   }
   const pageDoc = JSON.parse(JSON.stringify(validation.data));
+  stripDocumentTrackingSecretsInPlace(pageDoc);
   if (options.metadata) {
     pageDoc.metadata = {
       ...pageDoc.metadata || {
@@ -3933,8 +4195,8 @@ async function exportPackage(document, options = {}) {
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   const manifest = {
-    schema: import_schema6.SCHEMA_NAME,
-    schemaVersion: pageDoc.version || import_schema6.CURRENT_SCHEMA_VERSION,
+    schema: import_schema8.SCHEMA_NAME,
+    schemaVersion: pageDoc.version || import_schema8.CURRENT_SCHEMA_VERSION,
     packageVersion: options.packageVersion || "1.0.0",
     builderCompatibility: options.builderCompatibility || ">=0.1.0",
     requiredComponents: requirements.requiredComponents,
@@ -3959,10 +4221,10 @@ var exportStoraPackage = exportPackage;
 
 // src/io/importer.ts
 var import_fflate2 = require("fflate");
-var import_schema8 = require("@kubuild/schema");
+var import_schema10 = require("@kubuild/schema");
 
 // src/io/migration.ts
-var import_schema7 = require("@kubuild/schema");
+var import_schema9 = require("@kubuild/schema");
 var MigrationRegistry = class {
   steps = /* @__PURE__ */ new Map();
   /**
@@ -4041,7 +4303,7 @@ defaultMigrationRegistry.register({
   description: "Migrate alpha 0.1.0 schema (root node key, flat styles) to v1.0.0",
   migrate: (rawDoc) => {
     const migrated = deepClone(rawDoc);
-    migrated.schema = import_schema7.SCHEMA_NAME;
+    migrated.schema = import_schema9.SCHEMA_NAME;
     migrated.version = "1.0.0";
     if (migrated.root && !migrated.document) {
       migrated.document = migrated.root;
@@ -4076,7 +4338,7 @@ defaultMigrationRegistry.register({
   description: "Migrate 0.2.0 schema to v1.0.0",
   migrate: (rawDoc) => {
     const migrated = deepClone(rawDoc);
-    migrated.schema = import_schema7.SCHEMA_NAME;
+    migrated.schema = import_schema9.SCHEMA_NAME;
     migrated.version = "1.0.0";
     if (migrated.document && typeof migrated.document === "object") {
       convertNodeStylesToResponsive(migrated.document);
@@ -4090,7 +4352,7 @@ defaultMigrationRegistry.register({
   description: "Migrate 0.9.0 beta schema to v1.0.0",
   migrate: (rawDoc) => {
     const migrated = deepClone(rawDoc);
-    migrated.schema = import_schema7.SCHEMA_NAME;
+    migrated.schema = import_schema9.SCHEMA_NAME;
     migrated.version = "1.0.0";
     if (!migrated.metadata || typeof migrated.metadata !== "object") {
       migrated.metadata = {
@@ -4115,17 +4377,36 @@ defaultMigrationRegistry.register({
     return migrated;
   }
 });
-function canMigrate(sourceVersion, targetVersion = import_schema7.CURRENT_SCHEMA_VERSION, registry = defaultMigrationRegistry) {
+defaultMigrationRegistry.register({
+  fromVersion: "1.0.0",
+  toVersion: "1.1.0",
+  description: "Remove tracking secrets and server destinations (capiAccessToken, accessToken, measurementProtocolSecret, serverRelayUrl, custom endpointUrl/headers) from the document",
+  migrate: (rawDoc, context) => {
+    const migrated = deepClone(rawDoc);
+    migrated.version = "1.1.0";
+    const removed = stripDocumentTrackingSecretsInPlace(migrated);
+    if (removed.length > 0) {
+      context.warn({
+        code: "TRACKING_SECRET_REMOVED",
+        message: "Tracking secret removed; re-link credential via credentialId (secrets are now stored by the host and resolved server-side).",
+        step: "1.0.0->1.1.0",
+        paths: removed
+      });
+    }
+    return migrated;
+  }
+});
+function canMigrate(sourceVersion, targetVersion = import_schema9.CURRENT_SCHEMA_VERSION, registry = defaultMigrationRegistry) {
   if (!sourceVersion || !targetVersion) return false;
   if (sourceVersion === targetVersion) return true;
   return registry.hasPath(sourceVersion, targetVersion);
 }
-function getMigrationPath(sourceVersion, targetVersion = import_schema7.CURRENT_SCHEMA_VERSION, registry = defaultMigrationRegistry) {
+function getMigrationPath(sourceVersion, targetVersion = import_schema9.CURRENT_SCHEMA_VERSION, registry = defaultMigrationRegistry) {
   if (!sourceVersion || !targetVersion) return null;
   return registry.findPath(sourceVersion, targetVersion);
 }
 function migrateDocument(rawDocument, options = {}) {
-  const targetVersion = options.targetVersion ?? import_schema7.CURRENT_SCHEMA_VERSION;
+  const targetVersion = options.targetVersion ?? import_schema9.CURRENT_SCHEMA_VERSION;
   const dryRun = options.dryRun ?? false;
   const registry = options.registry ?? defaultMigrationRegistry;
   const validate = options.validate ?? true;
@@ -4153,6 +4434,14 @@ function migrateDocument(rawDocument, options = {}) {
   const sourceVersion = typeof doc.version === "string" ? doc.version.trim() : "unknown";
   if (sourceVersion === targetVersion) {
     const cloned = deepClone(doc);
+    const removedSecrets = stripDocumentTrackingSecretsInPlace(cloned);
+    const currentWarnings = removedSecrets.length > 0 ? [
+      {
+        code: "TRACKING_SECRET_REMOVED",
+        message: "Tracking secret removed; re-link credential via credentialId (secrets are stored by the host and resolved server-side).",
+        paths: removedSecrets
+      }
+    ] : [];
     if (validate) {
       const validation = validateDocument(cloned);
       if (!validation.valid) {
@@ -4184,7 +4473,8 @@ function migrateDocument(rawDocument, options = {}) {
         targetVersion,
         migrationPath: [sourceVersion],
         stepsApplied: 0,
-        dryRun
+        dryRun,
+        ...currentWarnings.length > 0 ? { warnings: currentWarnings } : {}
       }
     };
   }
@@ -4224,6 +4514,8 @@ function migrateDocument(rawDocument, options = {}) {
   }
   let currentDoc = deepClone(doc);
   let stepsApplied = 0;
+  const warnings = [];
+  const stepContext = { warn: (w) => warnings.push(w) };
   for (let i = 0; i < path.length - 1; i++) {
     const fromVer = path[i];
     const toVer = path[i + 1];
@@ -4249,7 +4541,7 @@ function migrateDocument(rawDocument, options = {}) {
       };
     }
     try {
-      currentDoc = step.migrate(currentDoc);
+      currentDoc = step.migrate(currentDoc, stepContext);
       stepsApplied++;
     } catch (err) {
       const error = {
@@ -4305,7 +4597,8 @@ function migrateDocument(rawDocument, options = {}) {
       targetVersion,
       migrationPath: path,
       stepsApplied,
-      dryRun: false
+      dryRun: false,
+      ...warnings.length > 0 ? { warnings } : {}
     }
   };
 }
@@ -4340,7 +4633,7 @@ async function preflightPackage(archiveData, options = {}) {
     ...DEFAULT_SECURITY_LIMITS,
     ...options.securityLimits
   };
-  const targetVersion = options.targetSchemaVersion || import_schema8.CURRENT_SCHEMA_VERSION;
+  const targetVersion = options.targetSchemaVersion || import_schema10.CURRENT_SCHEMA_VERSION;
   const migrationRegistry = options.migrationRegistry || defaultMigrationRegistry;
   const diagnostics = [];
   let dependencyPolicy = options.dependencyPolicy || "cancel";
@@ -4473,7 +4766,7 @@ async function preflightPackage(archiveData, options = {}) {
         path: manifestProtoCheck.path
       });
     }
-    const parseResult = import_schema8.ManifestSchema.safeParse(manifestJson);
+    const parseResult = import_schema10.ManifestSchema.safeParse(manifestJson);
     if (!parseResult.success) {
       const issues = parseResult.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join(", ");
       diagnostics.push({
@@ -4503,6 +4796,16 @@ async function preflightPackage(archiveData, options = {}) {
   let rawPageDoc;
   try {
     rawPageDoc = JSON.parse((0, import_fflate2.strFromU8)(pageEntry));
+    const secretScan = sanitizeDocumentTracking(rawPageDoc);
+    if (secretScan.removed.length > 0) {
+      diagnostics.push({
+        code: "TRACKING_SECRET_REMOVED",
+        severity: "warning",
+        message: "Tracking secrets found in page.json will be removed on import; re-link credentials via credentialId.",
+        path: "page.json",
+        details: { paths: secretScan.removed }
+      });
+    }
     const pageProtoCheck = containsProhibitedKeys(rawPageDoc);
     if (pageProtoCheck.found) {
       diagnostics.push({
@@ -4749,7 +5052,7 @@ function buildReport(valid, canImport, fields) {
   return {
     valid,
     canImport,
-    targetVersion: fields.targetVersion || import_schema8.CURRENT_SCHEMA_VERSION,
+    targetVersion: fields.targetVersion || import_schema10.CURRENT_SCHEMA_VERSION,
     requiresMigration: fields.requiresMigration || false,
     missingComponents: fields.missingComponents || [],
     missingCapabilities: fields.missingCapabilities || [],
@@ -4822,7 +5125,7 @@ async function importPackage(archiveData, options = {}) {
   if (preflight.requiresMigration) {
     const migrationRegistry = options.migrationRegistry || defaultMigrationRegistry;
     const migrationRes = migrateDocument(pageRaw, {
-      targetVersion: options.targetSchemaVersion || import_schema8.CURRENT_SCHEMA_VERSION,
+      targetVersion: options.targetSchemaVersion || import_schema10.CURRENT_SCHEMA_VERSION,
       registry: migrationRegistry,
       validate: true
     });
@@ -4844,13 +5147,24 @@ async function importPackage(archiveData, options = {}) {
   } else {
     finalDocument = pageRaw;
   }
+  const importWarnings = [];
+  const strippedSecrets = stripDocumentTrackingSecretsInPlace(finalDocument);
+  if (strippedSecrets.length > 0) {
+    importWarnings.push({
+      code: "TRACKING_SECRET_REMOVED",
+      severity: "warning",
+      message: "Tracking secret removed from imported document; re-link credential via credentialId.",
+      path: "page.json",
+      details: { paths: strippedSecrets }
+    });
+  }
   let metadata = finalDocument.metadata || {
     title: "Imported Page",
     description: "",
     author: "",
     tags: [],
     category: "general",
-    version: finalDocument.version || import_schema8.CURRENT_SCHEMA_VERSION
+    version: finalDocument.version || import_schema10.CURRENT_SCHEMA_VERSION
   };
   if (unzipped["metadata.json"]) {
     try {
@@ -5002,13 +5316,14 @@ async function importPackage(archiveData, options = {}) {
     metadata,
     extractedAssets,
     renamedAssets: Object.keys(renameMap).length > 0 ? renameMap : void 0,
-    preflight
+    preflight,
+    ...importWarnings.length > 0 ? { warnings: importWarnings } : {}
   };
 }
 var importStoraPackage = importPackage;
 
 // src/io/load-project.ts
-var import_schema9 = require("@kubuild/schema");
+var import_schema11 = require("@kubuild/schema");
 var DEFAULT_PAGE_ARTBOARD_ID = "artboard-page-1";
 function wrapPageDocumentAsProject(document, options = {}) {
   const artboardId = options.artboardId ?? DEFAULT_PAGE_ARTBOARD_ID;
@@ -5021,8 +5336,8 @@ function wrapPageDocumentAsProject(document, options = {}) {
     ...options.width !== void 0 ? { width: options.width } : {}
   };
   return {
-    schema: import_schema9.PROJECT_SCHEMA_NAME,
-    version: import_schema9.CURRENT_PROJECT_SCHEMA_VERSION,
+    schema: import_schema11.PROJECT_SCHEMA_NAME,
+    version: import_schema11.CURRENT_PROJECT_SCHEMA_VERSION,
     metadata: document.metadata,
     artboards: [artboard],
     activeArtboardId: artboardId
@@ -5041,8 +5356,8 @@ function loadProjectDocument(raw) {
       ]
     };
   }
-  if ((0, import_schema9.looksLikeProjectDocument)(raw)) {
-    const parsed = import_schema9.ProjectDocumentSchema.safeParse(raw);
+  if ((0, import_schema11.looksLikeProjectDocument)(raw)) {
+    const parsed = import_schema11.ProjectDocumentSchema.safeParse(raw);
     if (!parsed.success) {
       return {
         success: false,
@@ -5527,7 +5842,7 @@ function compareManifestsSemantically(expected, actual, options = {}) {
 }
 
 // src/io/template-utils.ts
-var import_schema10 = require("@kubuild/schema");
+var import_schema12 = require("@kubuild/schema");
 var CORE_BUILTIN_COMPONENTS = /* @__PURE__ */ new Set([
   "page",
   "section",
@@ -5541,7 +5856,7 @@ var CORE_BUILTIN_COMPONENTS = /* @__PURE__ */ new Set([
   "collection"
 ]);
 function validateTemplate(value) {
-  const parseResult = import_schema10.TemplateRecordSchema.safeParse(value);
+  const parseResult = import_schema12.TemplateRecordSchema.safeParse(value);
   if (parseResult.success) {
     return {
       valid: true,
@@ -5669,7 +5984,7 @@ function cloneTreeWithFreshIds(root, idGen) {
 function cloneTemplateAsPage(templateOrDoc, options = {}) {
   let sourceDoc;
   let templateOrigin = null;
-  if ((0, import_schema10.isTemplateRecord)(templateOrDoc)) {
+  if ((0, import_schema12.isTemplateRecord)(templateOrDoc)) {
     if (!templateOrDoc.document) {
       throw new Error(
         `Template "${templateOrDoc.name}" (${templateOrDoc.id}) does not contain an inline document snapshot to clone from.`
@@ -5686,7 +6001,7 @@ function cloneTemplateAsPage(templateOrDoc, options = {}) {
   } else {
     throw new Error("Invalid input: expected a TemplateRecord or PageDocument.");
   }
-  const existingIdsInSource = new Set((0, import_schema10.collectNodeIds)(sourceDoc.document));
+  const existingIdsInSource = new Set((0, import_schema12.collectNodeIds)(sourceDoc.document));
   const assignedNewIds = /* @__PURE__ */ new Set();
   const prefix = options.idPrefix || `page_${Date.now().toString(36)}_${Math.random().toString(36).substring(2, 6)}`;
   let counter = 1;
@@ -5735,8 +6050,8 @@ function cloneTemplateAsPage(templateOrDoc, options = {}) {
 }
 function areNodeIdsCompletelyDistinct(docA, docB) {
   if (!docA?.document || !docB?.document) return true;
-  const idsA = new Set((0, import_schema10.collectNodeIds)(docA.document));
-  const idsB = (0, import_schema10.collectNodeIds)(docB.document);
+  const idsA = new Set((0, import_schema12.collectNodeIds)(docA.document));
+  const idsB = (0, import_schema12.collectNodeIds)(docB.document);
   for (const id of idsB) {
     if (idsA.has(id)) {
       return false;
@@ -5746,7 +6061,7 @@ function areNodeIdsCompletelyDistinct(docA, docB) {
 }
 
 // src/validation/project-validator.ts
-var import_schema11 = require("@kubuild/schema");
+var import_schema13 = require("@kubuild/schema");
 function walk(node, visit) {
   visit(node);
   for (const child of node.children ?? []) {
@@ -5756,7 +6071,7 @@ function walk(node, visit) {
 function collectArtboardReferences(artboard) {
   const refs = [];
   walk(artboard.document.document, (node) => {
-    if (node.type === import_schema11.ARTBOARD_REFERENCE_NODE_TYPE) {
+    if (node.type === import_schema13.ARTBOARD_REFERENCE_NODE_TYPE) {
       const target = node.props?.artboardId;
       refs.push({
         nodeId: node.id,
@@ -5783,7 +6098,7 @@ function validateProject(input, options = {}) {
       artboardErrors
     };
   }
-  const parsed = import_schema11.ProjectDocumentSchema.safeParse(input);
+  const parsed = import_schema13.ProjectDocumentSchema.safeParse(input);
   if (!parsed.success) {
     return {
       valid: false,
@@ -5791,7 +6106,7 @@ function validateProject(input, options = {}) {
       errors: [
         {
           code: "PROJECT_SCHEMA_INVALID",
-          message: `Project failed schema validation. Expected schema "${import_schema11.PROJECT_SCHEMA_NAME}".`,
+          message: `Project failed schema validation. Expected schema "${import_schema13.PROJECT_SCHEMA_NAME}".`,
           path: "",
           details: { issues: parsed.error.issues }
         }
@@ -5884,7 +6199,7 @@ function validateProject(input, options = {}) {
 function collectArtboardReferenceNodes(root) {
   const refs = [];
   walk(root, (node) => {
-    if (node.type === import_schema11.ARTBOARD_REFERENCE_NODE_TYPE) {
+    if (node.type === import_schema13.ARTBOARD_REFERENCE_NODE_TYPE) {
       const target = node.props?.artboardId;
       refs.push({ nodeId: node.id, artboardId: typeof target === "string" ? target : void 0 });
     }
@@ -6133,6 +6448,7 @@ function isFormValid(errors) {
   createPageArtboard,
   createRuntimeStore,
   createTemplateRecord,
+  createTrackingRelayHandler,
   deepClone,
   defaultIdGenerator,
   defaultMigrationRegistry,
@@ -6199,6 +6515,7 @@ function isFormValid(errors) {
   resolveBinding,
   resolveBindingValue,
   resolvePropertyPath,
+  sanitizeDocumentTracking,
   sanitizeFilename,
   sanitizeHtml,
   sanitizeUrl,
@@ -6209,6 +6526,8 @@ function isFormValid(errors) {
   sendTikTokEventsApi,
   setActiveArtboard,
   sha256Sync,
+  stripDocumentTrackingSecretsInPlace,
+  stripTrackingSecretsInPlace,
   ungroupNodeFrame,
   updateActions,
   updateAnimation,