@kubuild/core 0.6.0 → 0.7.0

package/dist/index.js

@@ -1,9 +1,9 @@
 // src/document/document-utils.ts
-import { SCHEMA_NAME } from "@kubuild/schema";
+import { SCHEMA_NAME, CURRENT_SCHEMA_VERSION } from "@kubuild/schema";
 function createBlankDocument(title = "Untitled Page") {
   return {
     schema: SCHEMA_NAME,
-    version: "1.0.0",
+    version: CURRENT_SCHEMA_VERSION,
     metadata: {
       title,
       description: "",
@@ -889,7 +889,7 @@ import {
   SCHEMA_NAME as SCHEMA_NAME2,
   PROJECT_SCHEMA_NAME,
   CURRENT_PROJECT_SCHEMA_VERSION,
-  CURRENT_SCHEMA_VERSION,
+  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION2,
   ARTBOARD_REFERENCE_NODE_TYPE
 } from "@kubuild/schema";
 var now = () => (/* @__PURE__ */ new Date()).toISOString();
@@ -947,14 +947,14 @@ function createComponentArtboard(node, options = {}) {
   const triggerId = options.triggerId ?? (typeof node.props?.modalId === "string" && node.props.modalId.trim().length > 0 ? node.props.modalId : node.id);
   const document = {
     schema: SCHEMA_NAME2,
-    version: CURRENT_SCHEMA_VERSION,
+    version: CURRENT_SCHEMA_VERSION2,
     metadata: {
       title: name,
       description: "",
       author: "",
       tags: [],
       category: "component",
-      version: CURRENT_SCHEMA_VERSION,
+      version: CURRENT_SCHEMA_VERSION2,
       createdAt: now(),
       updatedAt: now()
     },
@@ -1411,6 +1411,15 @@ var DocumentHistoryManager = class {
 var FORBIDDEN_KEY_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function resolveBinding(binding, context) {
   const segments = binding.key.split(".").filter(Boolean);
+  if (segments.some((segment) => FORBIDDEN_KEY_SEGMENTS.has(segment))) {
+    return applyMissingPolicy(binding);
+  }
+  if (context?.variables && typeof context.variables === "object" && Object.prototype.hasOwnProperty.call(context.variables, binding.key)) {
+    const directValue = context.variables[binding.key];
+    if (directValue !== void 0 && typeof directValue !== "function") {
+      return { status: "resolved", value: directValue };
+    }
+  }
   let current = context?.variables;
   for (const segment of segments) {
     if (FORBIDDEN_KEY_SEGMENTS.has(segment)) {
@@ -1982,14 +1991,14 @@ var ActionPipelineExecutor = class {
   async executeSingleStep(step, context, parentSignal, options) {
     const stepStartTime = Date.now();
     if (step.condition && !evaluateActionCondition(step.condition, context)) {
-      const skippedResult = {
+      const skippedResult2 = {
         stepId: step.id,
         stepType: step.type,
         status: "skipped",
         durationMs: Date.now() - stepStartTime
       };
-      options?.onStepComplete?.(step, skippedResult, context);
-      return skippedResult;
+      options?.onStepComplete?.(step, skippedResult2, context);
+      return skippedResult2;
     }
     options?.onStepStart?.(step, context);
     const stepTimeout = step.timeout;
@@ -2481,7 +2490,7 @@ function generateTrackingEventId(prefix = "evt") {
   const randomPart = Math.random().toString(36).substring(2, 10);
   return `${prefix}_${timestamp}_${randomPart}`;
 }
-async function sendMetaCapiEvent(event, config, options) {
+async function sendMetaCapiEvent(event, config, secrets, options) {
   const fetcher = options?.fetchFn || globalThis.fetch;
   if (!config.pixelId) {
     return {
@@ -2555,9 +2564,10 @@ async function sendMetaCapiEvent(event, config, options) {
     const headers = {
       "Content-Type": "application/json"
     };
-    if (config.capiAccessToken) {
-      headers["Authorization"] = `Bearer ${config.capiAccessToken}`;
+    if (!secrets?.capiAccessToken) {
+      return skippedResult("meta", "No Meta CAPI access token resolved for this credential");
     }
+    headers["Authorization"] = `Bearer ${secrets.capiAccessToken}`;
     const res = await fetcher(url, {
       method: "POST",
       headers,
@@ -2587,7 +2597,7 @@ async function sendMetaCapiEvent(event, config, options) {
     };
   }
 }
-async function sendTikTokEventsApi(event, config, options) {
+async function sendTikTokEventsApi(event, config, secrets, options) {
   const fetcher = options?.fetchFn || globalThis.fetch;
   if (!config.pixelId) {
     return { provider: "tiktok", success: false, error: "TikTok Pixel ID is missing" };
@@ -2637,9 +2647,10 @@ async function sendTikTokEventsApi(event, config, options) {
     const headers = {
       "Content-Type": "application/json"
     };
-    if (config.accessToken) {
-      headers["Access-Token"] = config.accessToken;
+    if (!secrets?.accessToken) {
+      return skippedResult("tiktok", "No TikTok Events API access token resolved for this credential");
     }
+    headers["Access-Token"] = secrets.accessToken;
     const res = await fetcher(url, {
       method: "POST",
       headers,
@@ -2664,7 +2675,7 @@ async function sendTikTokEventsApi(event, config, options) {
     };
   }
 }
-async function sendGa4MeasurementEvent(event, config, options) {
+async function sendGa4MeasurementEvent(event, config, secrets, options) {
   const fetcher = options?.fetchFn || globalThis.fetch;
   if (!config.measurementId) {
     return { provider: "google", success: false, error: "GA4 Measurement ID is missing" };
@@ -2688,12 +2699,10 @@ async function sendGa4MeasurementEvent(event, config, options) {
     return { provider: "google", success: true, data: { simulated: true, payload: ga4Payload } };
   }
   try {
-    let url = `https://www.google-analytics.com/mp/collect?measurement_id=${encodeURIComponent(
-      config.measurementId
-    )}`;
-    if (config.measurementProtocolSecret) {
-      url += `&api_secret=${encodeURIComponent(config.measurementProtocolSecret)}`;
+    if (!secrets?.measurementProtocolSecret) {
+      return skippedResult("google", "No GA4 Measurement Protocol API secret resolved for this credential");
     }
+    const url = `https://www.google-analytics.com/mp/collect?measurement_id=${encodeURIComponent(config.measurementId)}&api_secret=${encodeURIComponent(secrets.measurementProtocolSecret)}`;
     const res = await fetcher(url, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
@@ -2713,11 +2722,8 @@ async function sendGa4MeasurementEvent(event, config, options) {
     };
   }
 }
-async function sendCustomWebhookEvent(event, config, options) {
+async function sendCustomWebhookEvent(event, _config, secrets, options) {
   const fetcher = options?.fetchFn || globalThis.fetch;
-  if (!config.endpointUrl) {
-    return { provider: "custom", success: false, error: "Custom Webhook URL is missing" };
-  }
   const webhookPayload = {
     event: event.eventName,
     eventId: event.eventId,
@@ -2731,12 +2737,15 @@ async function sendCustomWebhookEvent(event, config, options) {
     options.onLog?.("[Custom Webhook SIMULATED]", webhookPayload);
     return { provider: "custom", success: true, data: { simulated: true, payload: webhookPayload } };
   }
+  if (!secrets?.endpointUrl) {
+    return skippedResult("custom", "No custom webhook destination resolved for this credential");
+  }
   try {
-    const res = await fetcher(config.endpointUrl, {
+    const res = await fetcher(secrets.endpointUrl, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        ...config.headers || {}
+        ...secrets.headers || {}
       },
       body: JSON.stringify(webhookPayload)
     });
@@ -2755,6 +2764,9 @@ async function sendCustomWebhookEvent(event, config, options) {
     };
   }
 }
+function skippedResult(provider, reason) {
+  return { provider, success: true, skipped: true, reason };
+}
 async function dispatchServerTracking(event, config, options) {
   const eventId = event.eventId || generateTrackingEventId();
   const eventWithId = { ...event, eventId };
@@ -2779,65 +2791,233 @@ async function dispatchServerTracking(event, config, options) {
       options?.onLog?.(msg, data);
     }
   };
+  const target = options?.provider || "all";
+  const wants = (key) => target === "all" || target === key;
   const providers = config.providers || {};
-  const dispatchPromises = [];
-  if (providers.meta && providers.meta.enabled !== false && providers.meta.capiEnabled) {
-    dispatchPromises.push(
-      sendMetaCapiEvent(eventWithId, providers.meta, mergedOptions).then((result) => ({
-        key: "meta",
-        result
-      }))
-    );
+  const tasks = [];
+  const meta = providers.meta;
+  if (wants("meta") && meta && meta.enabled !== false && meta.capiEnabled) {
+    tasks.push({
+      key: "meta",
+      credentialId: meta.credentialId,
+      run: (s) => sendMetaCapiEvent(eventWithId, meta, s, mergedOptions)
+    });
   }
-  if (providers.tiktok && providers.tiktok.enabled !== false && providers.tiktok.eventsApiEnabled) {
-    dispatchPromises.push(
-      sendTikTokEventsApi(eventWithId, providers.tiktok, mergedOptions).then((result) => ({
-        key: "tiktok",
-        result
-      }))
-    );
+  const tiktok = providers.tiktok;
+  if (wants("tiktok") && tiktok && tiktok.enabled !== false && tiktok.eventsApiEnabled) {
+    tasks.push({
+      key: "tiktok",
+      credentialId: tiktok.credentialId,
+      run: (s) => sendTikTokEventsApi(eventWithId, tiktok, s, mergedOptions)
+    });
   }
-  if (providers.google && providers.google.enabled !== false && providers.google.measurementId && providers.google.measurementProtocolSecret) {
-    dispatchPromises.push(
-      sendGa4MeasurementEvent(eventWithId, providers.google, mergedOptions).then((result) => ({
-        key: "google",
-        result
-      }))
-    );
+  const google = providers.google;
+  if (wants("google") && google && google.enabled !== false && google.measurementId) {
+    tasks.push({
+      key: "google",
+      credentialId: google.credentialId,
+      run: (s) => sendGa4MeasurementEvent(eventWithId, google, s, mergedOptions)
+    });
   }
-  if (providers.custom && providers.custom.enabled !== false && providers.custom.endpointUrl) {
-    dispatchPromises.push(
-      sendCustomWebhookEvent(eventWithId, providers.custom, mergedOptions).then((result) => ({
-        key: "custom",
-        result
-      }))
-    );
+  const custom = providers.custom;
+  if (wants("custom") && custom && custom.enabled !== false) {
+    tasks.push({
+      key: "custom",
+      credentialId: custom.credentialId,
+      run: (s) => sendCustomWebhookEvent(eventWithId, custom, s, mergedOptions)
+    });
+  }
+  if (tasks.length === 0) {
+    return {
+      success: true,
+      eventId,
+      skipped: true,
+      reason: target === "gtm" ? "GTM is client-side only (dataLayer); no server delivery" : "No server-side tracking provider is enabled",
+      results: {}
+    };
   }
-  const settled = await Promise.allSettled(dispatchPromises);
+  const resolve = options?.resolveSecrets;
+  const runTask = async (task) => {
+    let secrets = null;
+    if (resolve) {
+      try {
+        secrets = await resolve({ provider: task.key, credentialId: task.credentialId, documentId: options?.documentId }) ?? null;
+      } catch (err) {
+        return {
+          provider: task.key,
+          success: false,
+          error: `Secret resolution failed: ${err instanceof Error ? err.message : String(err)}`
+        };
+      }
+    }
+    if (!secrets && !simulate) {
+      const reason = resolve ? `No secret resolved for provider "${task.key}"${task.credentialId ? ` (credentialId "${task.credentialId}")` : " (no credentialId linked)"}` : "No secret resolver configured (options.resolveSecrets)";
+      mergedOptions.onLog?.(`[${task.key}] skipped: ${reason}`);
+      return skippedResult(task.key, reason);
+    }
+    return task.run(secrets);
+  };
+  const settled = await Promise.allSettled(tasks.map((task) => runTask(task)));
   const results = {};
   let overallSuccess = true;
-  for (const item of settled) {
+  let delivered = 0;
+  settled.forEach((item, index) => {
+    const key = tasks[index].key;
     if (item.status === "fulfilled") {
-      results[item.value.key] = item.value.result;
-      if (!item.value.result.success) {
-        overallSuccess = false;
-      }
+      results[key] = item.value;
+      if (!item.value.success) overallSuccess = false;
+      if (!item.value.skipped) delivered++;
     } else {
       overallSuccess = false;
+      results[key] = {
+        provider: key,
+        success: false,
+        error: item.reason instanceof Error ? item.reason.message : String(item.reason)
+      };
     }
-  }
+  });
+  const allSkipped = delivered === 0 && overallSuccess;
   return {
     success: overallSuccess,
     eventId,
+    ...allSkipped ? { skipped: true, reason: "All server providers were skipped" } : {},
     results
   };
 }
 
+// src/runtime/tracking-relay.ts
+import {
+  TRACKING_RELAY_PROTOCOL_VERSION,
+  TrackingRelayRequestSchema
+} from "@kubuild/schema";
+var DEFAULT_MAX_BODY_BYTES = 64 * 1024;
+function defaultClientIp(request) {
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (forwarded) {
+    const first = forwarded.split(",")[0]?.trim();
+    if (first) return first;
+  }
+  return request.headers.get("cf-connecting-ip")?.trim() || request.headers.get("x-real-ip")?.trim() || void 0;
+}
+function isOriginAllowed(origin, allowed) {
+  if (!allowed) return true;
+  if (!origin) return false;
+  if (typeof allowed === "function") return allowed(origin);
+  return allowed.includes(origin);
+}
+function createTrackingRelayHandler(options) {
+  const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+  return async (request) => {
+    const origin = request.headers.get("origin");
+    const corsHeaders = {};
+    if (options.allowedOrigins && origin && isOriginAllowed(origin, options.allowedOrigins)) {
+      corsHeaders["Access-Control-Allow-Origin"] = origin;
+      corsHeaders["Vary"] = "Origin";
+    }
+    const json = (body, status, extra) => new Response(JSON.stringify(body), {
+      status,
+      headers: { "Content-Type": "application/json", ...corsHeaders, ...extra || {} }
+    });
+    const fail = (code, message, status, extra) => json({ version: TRACKING_RELAY_PROTOCOL_VERSION, success: false, error: { code, message } }, status, extra);
+    if (!isOriginAllowed(origin, options.allowedOrigins)) {
+      return fail("FORBIDDEN_ORIGIN", "Origin is not allowed", 403);
+    }
+    if (request.method === "OPTIONS") {
+      return new Response(null, {
+        status: 204,
+        headers: {
+          ...corsHeaders,
+          "Access-Control-Allow-Methods": "POST, OPTIONS",
+          "Access-Control-Allow-Headers": "Content-Type",
+          "Access-Control-Max-Age": "600"
+        }
+      });
+    }
+    if (request.method !== "POST") {
+      return fail("METHOD_NOT_ALLOWED", "Only POST requests are accepted", 405, { Allow: "POST, OPTIONS" });
+    }
+    try {
+      const text = await request.text();
+      if (text.length > maxBodyBytes) {
+        return fail("INVALID_REQUEST", `Request body exceeds ${maxBodyBytes} bytes`, 413);
+      }
+      let raw;
+      try {
+        raw = JSON.parse(text);
+      } catch {
+        return fail("INVALID_REQUEST", "Request body must be valid JSON", 400);
+      }
+      if (raw && typeof raw === "object" && "version" in raw && raw.version !== TRACKING_RELAY_PROTOCOL_VERSION) {
+        return fail(
+          "UNSUPPORTED_VERSION",
+          `Unsupported relay protocol version; expected ${TRACKING_RELAY_PROTOCOL_VERSION}`,
+          400
+        );
+      }
+      const parsed = TrackingRelayRequestSchema.safeParse(raw);
+      if (!parsed.success) {
+        const issues = parsed.error.issues.slice(0, 5).map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+        return fail("INVALID_REQUEST", `Invalid relay request: ${issues}`, 400);
+      }
+      const body = parsed.data;
+      const config = await options.getConfig({
+        request,
+        documentId: body.documentId,
+        credentialId: body.credentialId,
+        provider: body.provider
+      });
+      if (!config) {
+        return fail("CONFIG_NOT_FOUND", "No tracking configuration found for this page", 404);
+      }
+      const clientIp = (options.getClientIp ?? defaultClientIp)(request);
+      const clientUserAgent = request.headers.get("user-agent") || void 0;
+      const userData = { ...body.event.userData || {} };
+      delete userData.clientIp;
+      delete userData.clientUserAgent;
+      const event = { ...body.event, userData };
+      const outcome = await dispatchServerTracking(event, config, {
+        resolveSecrets: options.resolveSecrets,
+        documentId: body.documentId,
+        provider: body.provider,
+        fetchFn: options.fetchFn,
+        clientIp,
+        clientUserAgent,
+        onLog: options.onLog
+      });
+      const results = {};
+      for (const [key, r] of Object.entries(outcome.results)) {
+        results[key] = {
+          provider: r.provider,
+          success: r.success,
+          ...r.status !== void 0 ? { status: r.status } : {},
+          ...r.skipped ? { skipped: true } : {},
+          ...r.reason ? { reason: r.reason } : {},
+          ...r.error ? { error: r.error } : {}
+        };
+      }
+      return json(
+        {
+          version: TRACKING_RELAY_PROTOCOL_VERSION,
+          success: outcome.success,
+          eventId: outcome.eventId,
+          ...outcome.skipped ? { skipped: true } : {},
+          ...outcome.reason ? { reason: outcome.reason } : {},
+          results
+        },
+        200
+      );
+    } catch (err) {
+      options.onLog?.("[Tracking relay] internal error", err);
+      return fail("INTERNAL_ERROR", "Tracking relay failed", 500);
+    }
+  };
+}
+
 // src/io/exporter.ts
 import { zipSync, strToU8 } from "fflate";
 import {
   SCHEMA_NAME as SCHEMA_NAME4,
-  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION2
+  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION3
 } from "@kubuild/schema";
 
 // src/validation/validator.ts
@@ -3380,7 +3560,8 @@ function validateNodeRecursive(nodeObj, currentPath, parentNode, seenIds, visite
         `${currentPath}/props`,
         effectiveNodeId,
         options,
-        errors
+        errors,
+        warnings
       );
     }
   }
@@ -3395,7 +3576,10 @@ function validateNodeRecursive(nodeObj, currentPath, parentNode, seenIds, visite
     }
   }
 }
-function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
+function validatePropsBindings(propsObj, propsPath, nodeId, options, errors, warnings) {
+  const checkAssets = options.checkAssetReferences !== false;
+  const checkVariables = options.checkVariableBindings !== false;
+  const checkActions = options.checkActionBindings !== false;
   for (const [key, value] of Object.entries(propsObj)) {
     const currentPath = `${propsPath}/${key}`;
     if (!value || typeof value !== "object") {
@@ -3409,7 +3593,8 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
             `${currentPath}/${index}`,
             nodeId,
             options,
-            errors
+            errors,
+            warnings
           );
         }
       });
@@ -3417,7 +3602,9 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
     }
     const record = value;
     if (record.type === "asset") {
-      if (typeof record.assetId !== "string" || record.assetId.trim().length === 0) {
+      if (!checkAssets) continue;
+      const assetId = typeof record.assetId === "string" && record.assetId.trim().length > 0 ? record.assetId : void 0;
+      if (assetId === void 0) {
         errors.push({
           code: "INVALID_ASSET_REFERENCE",
           message: 'Asset reference must have a non-empty "assetId"',
@@ -3433,7 +3620,27 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
           nodeId
         });
       }
+      if (assetId !== void 0 && options.knownAssetIds && !isKnownId(options.knownAssetIds, assetId)) {
+        if (typeof record.fallbackUrl === "string" && record.fallbackUrl.length > 0) {
+          warnings.push({
+            code: "UNRESOLVED_ASSET_REFERENCE",
+            message: `Asset "${assetId}" is not among the known assets; its fallbackUrl will be used`,
+            path: `${currentPath}/assetId`,
+            nodeId,
+            details: { assetId }
+          });
+        } else {
+          errors.push({
+            code: "INVALID_ASSET_REFERENCE",
+            message: `Asset "${assetId}" is not among the known assets and has no fallbackUrl`,
+            path: `${currentPath}/assetId`,
+            nodeId,
+            details: { assetId }
+          });
+        }
+      }
     } else if (record.type === "variable") {
+      if (!checkVariables) continue;
       if (typeof record.key !== "string" || record.key.trim().length === 0) {
         errors.push({
           code: "INVALID_VARIABLE_BINDING",
@@ -3443,6 +3650,7 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
         });
       }
     } else if (key === "action" || typeof record.type === "string" && record.payload !== void 0) {
+      if (!checkActions) continue;
       if (typeof record.type !== "string" || record.type.trim().length === 0) {
         errors.push({
           code: "INVALID_ACTION_BINDING",
@@ -3452,10 +3660,62 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
         });
       }
     } else {
-      validatePropsBindings(record, currentPath, nodeId, options, errors);
+      validatePropsBindings(record, currentPath, nodeId, options, errors, warnings);
     }
   }
 }
+function isKnownId(ids, id) {
+  return Array.isArray(ids) ? ids.includes(id) : ids.has(id);
+}
+
+// src/io/tracking-sanitizer.ts
+import { LEGACY_TRACKING_SECRET_KEYS } from "@kubuild/schema";
+function stripTrackingSecretsInPlace(tracking, basePath = "tracking") {
+  const removed = [];
+  if (!tracking || typeof tracking !== "object" || Array.isArray(tracking)) return removed;
+  const providers = tracking.providers;
+  if (!providers || typeof providers !== "object" || Array.isArray(providers)) return removed;
+  for (const provider of Object.keys(LEGACY_TRACKING_SECRET_KEYS)) {
+    const cfg = providers[provider];
+    if (!cfg || typeof cfg !== "object" || Array.isArray(cfg)) continue;
+    for (const key of LEGACY_TRACKING_SECRET_KEYS[provider]) {
+      if (Object.prototype.hasOwnProperty.call(cfg, key)) {
+        delete cfg[key];
+        removed.push(`${basePath}.providers.${provider}.${key}`);
+      }
+    }
+  }
+  return removed;
+}
+function stripDocumentTrackingSecretsInPlace(doc) {
+  const removed = [];
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) return removed;
+  const record = doc;
+  removed.push(...stripTrackingSecretsInPlace(record.tracking, "tracking"));
+  const metadata = record.metadata;
+  if (metadata && typeof metadata === "object" && !Array.isArray(metadata)) {
+    removed.push(
+      ...stripTrackingSecretsInPlace(metadata.tracking, "metadata.tracking")
+    );
+  }
+  if (Array.isArray(record.artboards)) {
+    record.artboards.forEach((artboard, index) => {
+      if (artboard && typeof artboard === "object") {
+        const inner = artboard.document;
+        for (const path of stripDocumentTrackingSecretsInPlace(inner)) {
+          removed.push(`artboards.${index}.document.${path}`);
+        }
+      }
+    });
+  }
+  return removed;
+}
+function sanitizeDocumentTracking(doc) {
+  if (!doc || typeof doc !== "object") return { document: doc, removed: [] };
+  const copy = JSON.parse(JSON.stringify(doc));
+  const removed = stripDocumentTrackingSecretsInPlace(copy);
+  return { document: copy, removed };
+}
 
 // src/io/exporter.ts
 function sha256Sync(data) {
@@ -3676,6 +3936,7 @@ async function exportPackage(document, options = {}) {
     };
   }
   const pageDoc = JSON.parse(JSON.stringify(validation.data));
+  stripDocumentTrackingSecretsInPlace(pageDoc);
   if (options.metadata) {
     pageDoc.metadata = {
       ...pageDoc.metadata || {
@@ -3800,7 +4061,7 @@ async function exportPackage(document, options = {}) {
   };
   const manifest = {
     schema: SCHEMA_NAME4,
-    schemaVersion: pageDoc.version || CURRENT_SCHEMA_VERSION2,
+    schemaVersion: pageDoc.version || CURRENT_SCHEMA_VERSION3,
     packageVersion: options.packageVersion || "1.0.0",
     builderCompatibility: options.builderCompatibility || ">=0.1.0",
     requiredComponents: requirements.requiredComponents,
@@ -3827,12 +4088,12 @@ var exportStoraPackage = exportPackage;
 import { unzipSync, strFromU8 } from "fflate";
 import {
   ManifestSchema,
-  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION4
+  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION5
 } from "@kubuild/schema";
 
 // src/io/migration.ts
 import {
-  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION3,
+  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION4,
   SCHEMA_NAME as SCHEMA_NAME5
 } from "@kubuild/schema";
 var MigrationRegistry = class {
@@ -3987,17 +4248,36 @@ defaultMigrationRegistry.register({
     return migrated;
   }
 });
-function canMigrate(sourceVersion, targetVersion = CURRENT_SCHEMA_VERSION3, registry = defaultMigrationRegistry) {
+defaultMigrationRegistry.register({
+  fromVersion: "1.0.0",
+  toVersion: "1.1.0",
+  description: "Remove tracking secrets and server destinations (capiAccessToken, accessToken, measurementProtocolSecret, serverRelayUrl, custom endpointUrl/headers) from the document",
+  migrate: (rawDoc, context) => {
+    const migrated = deepClone(rawDoc);
+    migrated.version = "1.1.0";
+    const removed = stripDocumentTrackingSecretsInPlace(migrated);
+    if (removed.length > 0) {
+      context.warn({
+        code: "TRACKING_SECRET_REMOVED",
+        message: "Tracking secret removed; re-link credential via credentialId (secrets are now stored by the host and resolved server-side).",
+        step: "1.0.0->1.1.0",
+        paths: removed
+      });
+    }
+    return migrated;
+  }
+});
+function canMigrate(sourceVersion, targetVersion = CURRENT_SCHEMA_VERSION4, registry = defaultMigrationRegistry) {
   if (!sourceVersion || !targetVersion) return false;
   if (sourceVersion === targetVersion) return true;
   return registry.hasPath(sourceVersion, targetVersion);
 }
-function getMigrationPath(sourceVersion, targetVersion = CURRENT_SCHEMA_VERSION3, registry = defaultMigrationRegistry) {
+function getMigrationPath(sourceVersion, targetVersion = CURRENT_SCHEMA_VERSION4, registry = defaultMigrationRegistry) {
   if (!sourceVersion || !targetVersion) return null;
   return registry.findPath(sourceVersion, targetVersion);
 }
 function migrateDocument(rawDocument, options = {}) {
-  const targetVersion = options.targetVersion ?? CURRENT_SCHEMA_VERSION3;
+  const targetVersion = options.targetVersion ?? CURRENT_SCHEMA_VERSION4;
   const dryRun = options.dryRun ?? false;
   const registry = options.registry ?? defaultMigrationRegistry;
   const validate = options.validate ?? true;
@@ -4025,6 +4305,14 @@ function migrateDocument(rawDocument, options = {}) {
   const sourceVersion = typeof doc.version === "string" ? doc.version.trim() : "unknown";
   if (sourceVersion === targetVersion) {
     const cloned = deepClone(doc);
+    const removedSecrets = stripDocumentTrackingSecretsInPlace(cloned);
+    const currentWarnings = removedSecrets.length > 0 ? [
+      {
+        code: "TRACKING_SECRET_REMOVED",
+        message: "Tracking secret removed; re-link credential via credentialId (secrets are stored by the host and resolved server-side).",
+        paths: removedSecrets
+      }
+    ] : [];
     if (validate) {
       const validation = validateDocument(cloned);
       if (!validation.valid) {
@@ -4056,7 +4344,8 @@ function migrateDocument(rawDocument, options = {}) {
         targetVersion,
         migrationPath: [sourceVersion],
         stepsApplied: 0,
-        dryRun
+        dryRun,
+        ...currentWarnings.length > 0 ? { warnings: currentWarnings } : {}
       }
     };
   }
@@ -4096,6 +4385,8 @@ function migrateDocument(rawDocument, options = {}) {
   }
   let currentDoc = deepClone(doc);
   let stepsApplied = 0;
+  const warnings = [];
+  const stepContext = { warn: (w) => warnings.push(w) };
   for (let i = 0; i < path.length - 1; i++) {
     const fromVer = path[i];
     const toVer = path[i + 1];
@@ -4121,7 +4412,7 @@ function migrateDocument(rawDocument, options = {}) {
       };
     }
     try {
-      currentDoc = step.migrate(currentDoc);
+      currentDoc = step.migrate(currentDoc, stepContext);
       stepsApplied++;
     } catch (err) {
       const error = {
@@ -4177,7 +4468,8 @@ function migrateDocument(rawDocument, options = {}) {
       targetVersion,
       migrationPath: path,
       stepsApplied,
-      dryRun: false
+      dryRun: false,
+      ...warnings.length > 0 ? { warnings } : {}
     }
   };
 }
@@ -4212,7 +4504,7 @@ async function preflightPackage(archiveData, options = {}) {
     ...DEFAULT_SECURITY_LIMITS,
     ...options.securityLimits
   };
-  const targetVersion = options.targetSchemaVersion || CURRENT_SCHEMA_VERSION4;
+  const targetVersion = options.targetSchemaVersion || CURRENT_SCHEMA_VERSION5;
   const migrationRegistry = options.migrationRegistry || defaultMigrationRegistry;
   const diagnostics = [];
   let dependencyPolicy = options.dependencyPolicy || "cancel";
@@ -4375,6 +4667,16 @@ async function preflightPackage(archiveData, options = {}) {
   let rawPageDoc;
   try {
     rawPageDoc = JSON.parse(strFromU8(pageEntry));
+    const secretScan = sanitizeDocumentTracking(rawPageDoc);
+    if (secretScan.removed.length > 0) {
+      diagnostics.push({
+        code: "TRACKING_SECRET_REMOVED",
+        severity: "warning",
+        message: "Tracking secrets found in page.json will be removed on import; re-link credentials via credentialId.",
+        path: "page.json",
+        details: { paths: secretScan.removed }
+      });
+    }
     const pageProtoCheck = containsProhibitedKeys(rawPageDoc);
     if (pageProtoCheck.found) {
       diagnostics.push({
@@ -4621,7 +4923,7 @@ function buildReport(valid, canImport, fields) {
   return {
     valid,
     canImport,
-    targetVersion: fields.targetVersion || CURRENT_SCHEMA_VERSION4,
+    targetVersion: fields.targetVersion || CURRENT_SCHEMA_VERSION5,
     requiresMigration: fields.requiresMigration || false,
     missingComponents: fields.missingComponents || [],
     missingCapabilities: fields.missingCapabilities || [],
@@ -4694,7 +4996,7 @@ async function importPackage(archiveData, options = {}) {
   if (preflight.requiresMigration) {
     const migrationRegistry = options.migrationRegistry || defaultMigrationRegistry;
     const migrationRes = migrateDocument(pageRaw, {
-      targetVersion: options.targetSchemaVersion || CURRENT_SCHEMA_VERSION4,
+      targetVersion: options.targetSchemaVersion || CURRENT_SCHEMA_VERSION5,
       registry: migrationRegistry,
       validate: true
     });
@@ -4716,13 +5018,24 @@ async function importPackage(archiveData, options = {}) {
   } else {
     finalDocument = pageRaw;
   }
+  const importWarnings = [];
+  const strippedSecrets = stripDocumentTrackingSecretsInPlace(finalDocument);
+  if (strippedSecrets.length > 0) {
+    importWarnings.push({
+      code: "TRACKING_SECRET_REMOVED",
+      severity: "warning",
+      message: "Tracking secret removed from imported document; re-link credential via credentialId.",
+      path: "page.json",
+      details: { paths: strippedSecrets }
+    });
+  }
   let metadata = finalDocument.metadata || {
     title: "Imported Page",
     description: "",
     author: "",
     tags: [],
     category: "general",
-    version: finalDocument.version || CURRENT_SCHEMA_VERSION4
+    version: finalDocument.version || CURRENT_SCHEMA_VERSION5
   };
   if (unzipped["metadata.json"]) {
     try {
@@ -4874,7 +5187,8 @@ async function importPackage(archiveData, options = {}) {
     metadata,
     extractedAssets,
     renamedAssets: Object.keys(renameMap).length > 0 ? renameMap : void 0,
-    preflight
+    preflight,
+    ...importWarnings.length > 0 ? { warnings: importWarnings } : {}
   };
 }
 var importStoraPackage = importPackage;
@@ -6017,6 +6331,7 @@ export {
   createPageArtboard,
   createRuntimeStore,
   createTemplateRecord,
+  createTrackingRelayHandler,
   deepClone,
   defaultIdGenerator,
   defaultMigrationRegistry,
@@ -6083,6 +6398,7 @@ export {
   resolveBinding,
   resolveBindingValue,
   resolvePropertyPath,
+  sanitizeDocumentTracking,
   sanitizeFilename,
   sanitizeHtml,
   sanitizeUrl,
@@ -6093,6 +6409,8 @@ export {
   sendTikTokEventsApi,
   setActiveArtboard,
   sha256Sync,
+  stripDocumentTrackingSecretsInPlace,
+  stripTrackingSecretsInPlace,
   ungroupNodeFrame,
   updateActions,
   updateAnimation,