@kubuild/core 0.6.0 → 0.8.0

package/dist/index.js

@@ -1,9 +1,9 @@
 // src/document/document-utils.ts
-import { SCHEMA_NAME } from "@kubuild/schema";
+import { SCHEMA_NAME, CURRENT_SCHEMA_VERSION } from "@kubuild/schema";
 function createBlankDocument(title = "Untitled Page") {
   return {
     schema: SCHEMA_NAME,
-    version: "1.0.0",
+    version: CURRENT_SCHEMA_VERSION,
     metadata: {
       title,
       description: "",
@@ -316,26 +316,84 @@ function defaultIdGenerator(oldId, existingIds) {
   }
   return candidate;
 }
-function cloneTreeWithNewIds(root, idGenerator, existingIds) {
+var NODE_ID_REFERENCE_KEYS = /* @__PURE__ */ new Set([
+  "modalId",
+  "modalNodeId",
+  "targetModalId",
+  "targetNodeId",
+  "nodeId",
+  "formId",
+  "targetId"
+]);
+var ANCHOR_REFERENCE_KEYS = /* @__PURE__ */ new Set(["url", "href"]);
+function remapReferenceValue(key, value, idMap) {
+  if (typeof value !== "string") return value;
+  if (NODE_ID_REFERENCE_KEYS.has(key)) {
+    return idMap.get(value) ?? idMap.get(value.trim()) ?? value;
+  }
+  if (ANCHOR_REFERENCE_KEYS.has(key) && value.startsWith("#")) {
+    const mapped = idMap.get(value.slice(1));
+    return mapped ? `#${mapped}` : value;
+  }
+  return value;
+}
+function remapReferenceRecord(record, idMap) {
+  for (const [key, value] of Object.entries(record)) {
+    record[key] = remapReferenceValue(key, value, idMap);
+  }
+}
+function remapStepReferences(steps, idMap) {
+  if (!Array.isArray(steps)) return;
+  for (const step of steps) {
+    if (step.payload && typeof step.payload === "object") {
+      remapReferenceRecord(step.payload, idMap);
+    }
+    remapStepReferences(step.onSuccess, idMap);
+    remapStepReferences(step.onError, idMap);
+  }
+}
+function remapNodeReferences(node, idMap) {
+  if (node.props && typeof node.props === "object") {
+    remapReferenceRecord(node.props, idMap);
+    const legacyAction = node.props.action;
+    if (legacyAction && typeof legacyAction === "object" && legacyAction.payload && typeof legacyAction.payload === "object" && !Array.isArray(legacyAction.payload)) {
+      remapReferenceRecord(legacyAction.payload, idMap);
+    }
+  }
+  if (node.formConfig && typeof node.formConfig.formId === "string") {
+    node.formConfig.formId = idMap.get(node.formConfig.formId) ?? node.formConfig.formId;
+  }
+  if (Array.isArray(node.actions)) {
+    for (const pipeline of node.actions) {
+      remapStepReferences(pipeline.steps, idMap);
+    }
+  }
+}
+function cloneNodeTreeWithFreshIds(root, idGen) {
   const idMap = /* @__PURE__ */ new Map();
-  const idGen = idGenerator || ((oldId) => defaultIdGenerator(oldId, existingIds));
+  const clonedNodes = [];
   function cloneRecursive(node) {
-    const newId = idGen(node.id);
+    const newId = idGen(node.id, node);
     idMap.set(node.id, newId);
-    const clonedProps = node.props ? deepClone(node.props) : void 0;
-    const clonedStyles = node.styles ? deepClone(node.styles) : void 0;
-    const clonedChildren = node.children ? node.children.map((child) => cloneRecursive(child)) : [];
-    return {
+    const { children, ...rest } = node;
+    const cloned = {
+      ...deepClone(rest),
       id: newId,
-      type: node.type,
-      ...clonedProps ? { props: clonedProps } : {},
-      ...clonedStyles ? { styles: clonedStyles } : {},
-      children: clonedChildren
+      children: children ? children.map((child) => cloneRecursive(child)) : []
     };
+    clonedNodes.push(cloned);
+    return cloned;
   }
   const clonedNode = cloneRecursive(root);
+  for (const cloned of clonedNodes) {
+    remapNodeReferences(cloned, idMap);
+  }
   return { clonedNode, idMap };
 }
+function cloneTreeWithNewIds(root, idGenerator, existingIds) {
+  const idGen = idGenerator || ((oldId) => defaultIdGenerator(oldId, existingIds));
+  return cloneNodeTreeWithFreshIds(root, (oldId) => idGen(oldId));
+}
 
 // src/document/commands.ts
 import {
@@ -343,7 +401,9 @@ import {
   ResponsiveStylesSchema,
   AnimationConfigSchema,
   ActionPipelineSchema,
-  FormConfigSchema
+  FormConfigSchema,
+  ThemeSchema,
+  THEME_TOKEN_GROUPS
 } from "@kubuild/schema";
 function insertNode(document, params) {
   const { parentId, node, index } = params;
@@ -883,13 +943,60 @@ function replaceNode(document, params) {
     }
   };
 }
+function updateTheme(document, params) {
+  const { theme, merge = true } = params;
+  const newDoc = deepClone(document);
+  const previousTheme = newDoc.theme ? deepClone(newDoc.theme) : void 0;
+  if (theme === null) {
+    delete newDoc.theme;
+  } else {
+    const next = {};
+    for (const group of THEME_TOKEN_GROUPS) {
+      const base = merge ? { ...previousTheme?.[group] ?? {} } : {};
+      const patch = theme[group];
+      if (patch === null) {
+        continue;
+      }
+      if (patch) {
+        for (const [key, value] of Object.entries(patch)) {
+          if (value === null) {
+            delete base[key];
+          } else {
+            base[key] = value;
+          }
+        }
+      }
+      if (Object.keys(base).length > 0) {
+        next[group] = base;
+      }
+    }
+    const parsed = ThemeSchema.parse(next);
+    if (Object.keys(parsed).length > 0) {
+      newDoc.theme = parsed;
+    } else {
+      delete newDoc.theme;
+    }
+  }
+  return {
+    document: newDoc,
+    event: {
+      type: "THEME_UPDATED",
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      nodeId: newDoc.document.id,
+      payload: {
+        theme: newDoc.theme,
+        previousTheme
+      }
+    }
+  };
+}
 
 // src/document/artboards.ts
 import {
   SCHEMA_NAME as SCHEMA_NAME2,
   PROJECT_SCHEMA_NAME,
   CURRENT_PROJECT_SCHEMA_VERSION,
-  CURRENT_SCHEMA_VERSION,
+  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION2,
   ARTBOARD_REFERENCE_NODE_TYPE
 } from "@kubuild/schema";
 var now = () => (/* @__PURE__ */ new Date()).toISOString();
@@ -947,14 +1054,14 @@ function createComponentArtboard(node, options = {}) {
   const triggerId = options.triggerId ?? (typeof node.props?.modalId === "string" && node.props.modalId.trim().length > 0 ? node.props.modalId : node.id);
   const document = {
     schema: SCHEMA_NAME2,
-    version: CURRENT_SCHEMA_VERSION,
+    version: CURRENT_SCHEMA_VERSION2,
     metadata: {
       title: name,
       description: "",
       author: "",
       tags: [],
       category: "component",
-      version: CURRENT_SCHEMA_VERSION,
+      version: CURRENT_SCHEMA_VERSION2,
       createdAt: now(),
       updatedAt: now()
     },
@@ -1411,6 +1518,15 @@ var DocumentHistoryManager = class {
 var FORBIDDEN_KEY_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function resolveBinding(binding, context) {
   const segments = binding.key.split(".").filter(Boolean);
+  if (segments.some((segment) => FORBIDDEN_KEY_SEGMENTS.has(segment))) {
+    return applyMissingPolicy(binding);
+  }
+  if (context?.variables && typeof context.variables === "object" && Object.prototype.hasOwnProperty.call(context.variables, binding.key)) {
+    const directValue = context.variables[binding.key];
+    if (directValue !== void 0 && typeof directValue !== "function") {
+      return { status: "resolved", value: directValue };
+    }
+  }
   let current = context?.variables;
   for (const segment of segments) {
     if (FORBIDDEN_KEY_SEGMENTS.has(segment)) {
@@ -1982,14 +2098,14 @@ var ActionPipelineExecutor = class {
   async executeSingleStep(step, context, parentSignal, options) {
     const stepStartTime = Date.now();
     if (step.condition && !evaluateActionCondition(step.condition, context)) {
-      const skippedResult = {
+      const skippedResult2 = {
         stepId: step.id,
         stepType: step.type,
         status: "skipped",
         durationMs: Date.now() - stepStartTime
       };
-      options?.onStepComplete?.(step, skippedResult, context);
-      return skippedResult;
+      options?.onStepComplete?.(step, skippedResult2, context);
+      return skippedResult2;
     }
     options?.onStepStart?.(step, context);
     const stepTimeout = step.timeout;
@@ -2481,7 +2597,7 @@ function generateTrackingEventId(prefix = "evt") {
   const randomPart = Math.random().toString(36).substring(2, 10);
   return `${prefix}_${timestamp}_${randomPart}`;
 }
-async function sendMetaCapiEvent(event, config, options) {
+async function sendMetaCapiEvent(event, config, secrets, options) {
   const fetcher = options?.fetchFn || globalThis.fetch;
   if (!config.pixelId) {
     return {
@@ -2555,9 +2671,10 @@ async function sendMetaCapiEvent(event, config, options) {
     const headers = {
       "Content-Type": "application/json"
     };
-    if (config.capiAccessToken) {
-      headers["Authorization"] = `Bearer ${config.capiAccessToken}`;
+    if (!secrets?.capiAccessToken) {
+      return skippedResult("meta", "No Meta CAPI access token resolved for this credential");
     }
+    headers["Authorization"] = `Bearer ${secrets.capiAccessToken}`;
     const res = await fetcher(url, {
       method: "POST",
       headers,
@@ -2587,7 +2704,7 @@ async function sendMetaCapiEvent(event, config, options) {
     };
   }
 }
-async function sendTikTokEventsApi(event, config, options) {
+async function sendTikTokEventsApi(event, config, secrets, options) {
   const fetcher = options?.fetchFn || globalThis.fetch;
   if (!config.pixelId) {
     return { provider: "tiktok", success: false, error: "TikTok Pixel ID is missing" };
@@ -2637,9 +2754,10 @@ async function sendTikTokEventsApi(event, config, options) {
     const headers = {
       "Content-Type": "application/json"
     };
-    if (config.accessToken) {
-      headers["Access-Token"] = config.accessToken;
+    if (!secrets?.accessToken) {
+      return skippedResult("tiktok", "No TikTok Events API access token resolved for this credential");
     }
+    headers["Access-Token"] = secrets.accessToken;
     const res = await fetcher(url, {
       method: "POST",
       headers,
@@ -2664,7 +2782,7 @@ async function sendTikTokEventsApi(event, config, options) {
     };
   }
 }
-async function sendGa4MeasurementEvent(event, config, options) {
+async function sendGa4MeasurementEvent(event, config, secrets, options) {
   const fetcher = options?.fetchFn || globalThis.fetch;
   if (!config.measurementId) {
     return { provider: "google", success: false, error: "GA4 Measurement ID is missing" };
@@ -2688,12 +2806,10 @@ async function sendGa4MeasurementEvent(event, config, options) {
     return { provider: "google", success: true, data: { simulated: true, payload: ga4Payload } };
   }
   try {
-    let url = `https://www.google-analytics.com/mp/collect?measurement_id=${encodeURIComponent(
-      config.measurementId
-    )}`;
-    if (config.measurementProtocolSecret) {
-      url += `&api_secret=${encodeURIComponent(config.measurementProtocolSecret)}`;
+    if (!secrets?.measurementProtocolSecret) {
+      return skippedResult("google", "No GA4 Measurement Protocol API secret resolved for this credential");
     }
+    const url = `https://www.google-analytics.com/mp/collect?measurement_id=${encodeURIComponent(config.measurementId)}&api_secret=${encodeURIComponent(secrets.measurementProtocolSecret)}`;
     const res = await fetcher(url, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
@@ -2713,11 +2829,8 @@ async function sendGa4MeasurementEvent(event, config, options) {
     };
   }
 }
-async function sendCustomWebhookEvent(event, config, options) {
+async function sendCustomWebhookEvent(event, _config, secrets, options) {
   const fetcher = options?.fetchFn || globalThis.fetch;
-  if (!config.endpointUrl) {
-    return { provider: "custom", success: false, error: "Custom Webhook URL is missing" };
-  }
   const webhookPayload = {
     event: event.eventName,
     eventId: event.eventId,
@@ -2731,12 +2844,15 @@ async function sendCustomWebhookEvent(event, config, options) {
     options.onLog?.("[Custom Webhook SIMULATED]", webhookPayload);
     return { provider: "custom", success: true, data: { simulated: true, payload: webhookPayload } };
   }
+  if (!secrets?.endpointUrl) {
+    return skippedResult("custom", "No custom webhook destination resolved for this credential");
+  }
   try {
-    const res = await fetcher(config.endpointUrl, {
+    const res = await fetcher(secrets.endpointUrl, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        ...config.headers || {}
+        ...secrets.headers || {}
       },
       body: JSON.stringify(webhookPayload)
     });
@@ -2755,6 +2871,9 @@ async function sendCustomWebhookEvent(event, config, options) {
     };
   }
 }
+function skippedResult(provider, reason) {
+  return { provider, success: true, skipped: true, reason };
+}
 async function dispatchServerTracking(event, config, options) {
   const eventId = event.eventId || generateTrackingEventId();
   const eventWithId = { ...event, eventId };
@@ -2779,65 +2898,233 @@ async function dispatchServerTracking(event, config, options) {
       options?.onLog?.(msg, data);
     }
   };
+  const target = options?.provider || "all";
+  const wants = (key) => target === "all" || target === key;
   const providers = config.providers || {};
-  const dispatchPromises = [];
-  if (providers.meta && providers.meta.enabled !== false && providers.meta.capiEnabled) {
-    dispatchPromises.push(
-      sendMetaCapiEvent(eventWithId, providers.meta, mergedOptions).then((result) => ({
-        key: "meta",
-        result
-      }))
-    );
+  const tasks = [];
+  const meta = providers.meta;
+  if (wants("meta") && meta && meta.enabled !== false && meta.capiEnabled) {
+    tasks.push({
+      key: "meta",
+      credentialId: meta.credentialId,
+      run: (s) => sendMetaCapiEvent(eventWithId, meta, s, mergedOptions)
+    });
   }
-  if (providers.tiktok && providers.tiktok.enabled !== false && providers.tiktok.eventsApiEnabled) {
-    dispatchPromises.push(
-      sendTikTokEventsApi(eventWithId, providers.tiktok, mergedOptions).then((result) => ({
-        key: "tiktok",
-        result
-      }))
-    );
+  const tiktok = providers.tiktok;
+  if (wants("tiktok") && tiktok && tiktok.enabled !== false && tiktok.eventsApiEnabled) {
+    tasks.push({
+      key: "tiktok",
+      credentialId: tiktok.credentialId,
+      run: (s) => sendTikTokEventsApi(eventWithId, tiktok, s, mergedOptions)
+    });
   }
-  if (providers.google && providers.google.enabled !== false && providers.google.measurementId && providers.google.measurementProtocolSecret) {
-    dispatchPromises.push(
-      sendGa4MeasurementEvent(eventWithId, providers.google, mergedOptions).then((result) => ({
-        key: "google",
-        result
-      }))
-    );
+  const google = providers.google;
+  if (wants("google") && google && google.enabled !== false && google.measurementId) {
+    tasks.push({
+      key: "google",
+      credentialId: google.credentialId,
+      run: (s) => sendGa4MeasurementEvent(eventWithId, google, s, mergedOptions)
+    });
   }
-  if (providers.custom && providers.custom.enabled !== false && providers.custom.endpointUrl) {
-    dispatchPromises.push(
-      sendCustomWebhookEvent(eventWithId, providers.custom, mergedOptions).then((result) => ({
-        key: "custom",
-        result
-      }))
-    );
+  const custom = providers.custom;
+  if (wants("custom") && custom && custom.enabled !== false) {
+    tasks.push({
+      key: "custom",
+      credentialId: custom.credentialId,
+      run: (s) => sendCustomWebhookEvent(eventWithId, custom, s, mergedOptions)
+    });
   }
-  const settled = await Promise.allSettled(dispatchPromises);
+  if (tasks.length === 0) {
+    return {
+      success: true,
+      eventId,
+      skipped: true,
+      reason: target === "gtm" ? "GTM is client-side only (dataLayer); no server delivery" : "No server-side tracking provider is enabled",
+      results: {}
+    };
+  }
+  const resolve = options?.resolveSecrets;
+  const runTask = async (task) => {
+    let secrets = null;
+    if (resolve) {
+      try {
+        secrets = await resolve({ provider: task.key, credentialId: task.credentialId, documentId: options?.documentId }) ?? null;
+      } catch (err) {
+        return {
+          provider: task.key,
+          success: false,
+          error: `Secret resolution failed: ${err instanceof Error ? err.message : String(err)}`
+        };
+      }
+    }
+    if (!secrets && !simulate) {
+      const reason = resolve ? `No secret resolved for provider "${task.key}"${task.credentialId ? ` (credentialId "${task.credentialId}")` : " (no credentialId linked)"}` : "No secret resolver configured (options.resolveSecrets)";
+      mergedOptions.onLog?.(`[${task.key}] skipped: ${reason}`);
+      return skippedResult(task.key, reason);
+    }
+    return task.run(secrets);
+  };
+  const settled = await Promise.allSettled(tasks.map((task) => runTask(task)));
   const results = {};
   let overallSuccess = true;
-  for (const item of settled) {
+  let delivered = 0;
+  settled.forEach((item, index) => {
+    const key = tasks[index].key;
     if (item.status === "fulfilled") {
-      results[item.value.key] = item.value.result;
-      if (!item.value.result.success) {
-        overallSuccess = false;
-      }
+      results[key] = item.value;
+      if (!item.value.success) overallSuccess = false;
+      if (!item.value.skipped) delivered++;
     } else {
       overallSuccess = false;
+      results[key] = {
+        provider: key,
+        success: false,
+        error: item.reason instanceof Error ? item.reason.message : String(item.reason)
+      };
     }
-  }
+  });
+  const allSkipped = delivered === 0 && overallSuccess;
   return {
     success: overallSuccess,
     eventId,
+    ...allSkipped ? { skipped: true, reason: "All server providers were skipped" } : {},
     results
   };
 }
 
+// src/runtime/tracking-relay.ts
+import {
+  TRACKING_RELAY_PROTOCOL_VERSION,
+  TrackingRelayRequestSchema
+} from "@kubuild/schema";
+var DEFAULT_MAX_BODY_BYTES = 64 * 1024;
+function defaultClientIp(request) {
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (forwarded) {
+    const first = forwarded.split(",")[0]?.trim();
+    if (first) return first;
+  }
+  return request.headers.get("cf-connecting-ip")?.trim() || request.headers.get("x-real-ip")?.trim() || void 0;
+}
+function isOriginAllowed(origin, allowed) {
+  if (!allowed) return true;
+  if (!origin) return false;
+  if (typeof allowed === "function") return allowed(origin);
+  return allowed.includes(origin);
+}
+function createTrackingRelayHandler(options) {
+  const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+  return async (request) => {
+    const origin = request.headers.get("origin");
+    const corsHeaders = {};
+    if (options.allowedOrigins && origin && isOriginAllowed(origin, options.allowedOrigins)) {
+      corsHeaders["Access-Control-Allow-Origin"] = origin;
+      corsHeaders["Vary"] = "Origin";
+    }
+    const json = (body, status, extra) => new Response(JSON.stringify(body), {
+      status,
+      headers: { "Content-Type": "application/json", ...corsHeaders, ...extra || {} }
+    });
+    const fail = (code, message, status, extra) => json({ version: TRACKING_RELAY_PROTOCOL_VERSION, success: false, error: { code, message } }, status, extra);
+    if (!isOriginAllowed(origin, options.allowedOrigins)) {
+      return fail("FORBIDDEN_ORIGIN", "Origin is not allowed", 403);
+    }
+    if (request.method === "OPTIONS") {
+      return new Response(null, {
+        status: 204,
+        headers: {
+          ...corsHeaders,
+          "Access-Control-Allow-Methods": "POST, OPTIONS",
+          "Access-Control-Allow-Headers": "Content-Type",
+          "Access-Control-Max-Age": "600"
+        }
+      });
+    }
+    if (request.method !== "POST") {
+      return fail("METHOD_NOT_ALLOWED", "Only POST requests are accepted", 405, { Allow: "POST, OPTIONS" });
+    }
+    try {
+      const text = await request.text();
+      if (text.length > maxBodyBytes) {
+        return fail("INVALID_REQUEST", `Request body exceeds ${maxBodyBytes} bytes`, 413);
+      }
+      let raw;
+      try {
+        raw = JSON.parse(text);
+      } catch {
+        return fail("INVALID_REQUEST", "Request body must be valid JSON", 400);
+      }
+      if (raw && typeof raw === "object" && "version" in raw && raw.version !== TRACKING_RELAY_PROTOCOL_VERSION) {
+        return fail(
+          "UNSUPPORTED_VERSION",
+          `Unsupported relay protocol version; expected ${TRACKING_RELAY_PROTOCOL_VERSION}`,
+          400
+        );
+      }
+      const parsed = TrackingRelayRequestSchema.safeParse(raw);
+      if (!parsed.success) {
+        const issues = parsed.error.issues.slice(0, 5).map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+        return fail("INVALID_REQUEST", `Invalid relay request: ${issues}`, 400);
+      }
+      const body = parsed.data;
+      const config = await options.getConfig({
+        request,
+        documentId: body.documentId,
+        credentialId: body.credentialId,
+        provider: body.provider
+      });
+      if (!config) {
+        return fail("CONFIG_NOT_FOUND", "No tracking configuration found for this page", 404);
+      }
+      const clientIp = (options.getClientIp ?? defaultClientIp)(request);
+      const clientUserAgent = request.headers.get("user-agent") || void 0;
+      const userData = { ...body.event.userData || {} };
+      delete userData.clientIp;
+      delete userData.clientUserAgent;
+      const event = { ...body.event, userData };
+      const outcome = await dispatchServerTracking(event, config, {
+        resolveSecrets: options.resolveSecrets,
+        documentId: body.documentId,
+        provider: body.provider,
+        fetchFn: options.fetchFn,
+        clientIp,
+        clientUserAgent,
+        onLog: options.onLog
+      });
+      const results = {};
+      for (const [key, r] of Object.entries(outcome.results)) {
+        results[key] = {
+          provider: r.provider,
+          success: r.success,
+          ...r.status !== void 0 ? { status: r.status } : {},
+          ...r.skipped ? { skipped: true } : {},
+          ...r.reason ? { reason: r.reason } : {},
+          ...r.error ? { error: r.error } : {}
+        };
+      }
+      return json(
+        {
+          version: TRACKING_RELAY_PROTOCOL_VERSION,
+          success: outcome.success,
+          eventId: outcome.eventId,
+          ...outcome.skipped ? { skipped: true } : {},
+          ...outcome.reason ? { reason: outcome.reason } : {},
+          results
+        },
+        200
+      );
+    } catch (err) {
+      options.onLog?.("[Tracking relay] internal error", err);
+      return fail("INTERNAL_ERROR", "Tracking relay failed", 500);
+    }
+  };
+}
+
 // src/io/exporter.ts
 import { zipSync, strToU8 } from "fflate";
 import {
   SCHEMA_NAME as SCHEMA_NAME4,
-  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION2
+  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION3
 } from "@kubuild/schema";
 
 // src/validation/validator.ts
@@ -3380,7 +3667,8 @@ function validateNodeRecursive(nodeObj, currentPath, parentNode, seenIds, visite
         `${currentPath}/props`,
         effectiveNodeId,
         options,
-        errors
+        errors,
+        warnings
       );
     }
   }
@@ -3395,7 +3683,10 @@ function validateNodeRecursive(nodeObj, currentPath, parentNode, seenIds, visite
     }
   }
 }
-function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
+function validatePropsBindings(propsObj, propsPath, nodeId, options, errors, warnings) {
+  const checkAssets = options.checkAssetReferences !== false;
+  const checkVariables = options.checkVariableBindings !== false;
+  const checkActions = options.checkActionBindings !== false;
   for (const [key, value] of Object.entries(propsObj)) {
     const currentPath = `${propsPath}/${key}`;
     if (!value || typeof value !== "object") {
@@ -3409,7 +3700,8 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
             `${currentPath}/${index}`,
             nodeId,
             options,
-            errors
+            errors,
+            warnings
           );
         }
       });
@@ -3417,7 +3709,9 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
     }
     const record = value;
     if (record.type === "asset") {
-      if (typeof record.assetId !== "string" || record.assetId.trim().length === 0) {
+      if (!checkAssets) continue;
+      const assetId = typeof record.assetId === "string" && record.assetId.trim().length > 0 ? record.assetId : void 0;
+      if (assetId === void 0) {
         errors.push({
           code: "INVALID_ASSET_REFERENCE",
           message: 'Asset reference must have a non-empty "assetId"',
@@ -3433,7 +3727,27 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
           nodeId
         });
       }
+      if (assetId !== void 0 && options.knownAssetIds && !isKnownId(options.knownAssetIds, assetId)) {
+        if (typeof record.fallbackUrl === "string" && record.fallbackUrl.length > 0) {
+          warnings.push({
+            code: "UNRESOLVED_ASSET_REFERENCE",
+            message: `Asset "${assetId}" is not among the known assets; its fallbackUrl will be used`,
+            path: `${currentPath}/assetId`,
+            nodeId,
+            details: { assetId }
+          });
+        } else {
+          errors.push({
+            code: "INVALID_ASSET_REFERENCE",
+            message: `Asset "${assetId}" is not among the known assets and has no fallbackUrl`,
+            path: `${currentPath}/assetId`,
+            nodeId,
+            details: { assetId }
+          });
+        }
+      }
     } else if (record.type === "variable") {
+      if (!checkVariables) continue;
       if (typeof record.key !== "string" || record.key.trim().length === 0) {
         errors.push({
           code: "INVALID_VARIABLE_BINDING",
@@ -3443,6 +3757,7 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
         });
       }
     } else if (key === "action" || typeof record.type === "string" && record.payload !== void 0) {
+      if (!checkActions) continue;
       if (typeof record.type !== "string" || record.type.trim().length === 0) {
         errors.push({
           code: "INVALID_ACTION_BINDING",
@@ -3452,10 +3767,62 @@ function validatePropsBindings(propsObj, propsPath, nodeId, options, errors) {
         });
       }
     } else {
-      validatePropsBindings(record, currentPath, nodeId, options, errors);
+      validatePropsBindings(record, currentPath, nodeId, options, errors, warnings);
     }
   }
 }
+function isKnownId(ids, id) {
+  return Array.isArray(ids) ? ids.includes(id) : ids.has(id);
+}
+
+// src/io/tracking-sanitizer.ts
+import { LEGACY_TRACKING_SECRET_KEYS } from "@kubuild/schema";
+function stripTrackingSecretsInPlace(tracking, basePath = "tracking") {
+  const removed = [];
+  if (!tracking || typeof tracking !== "object" || Array.isArray(tracking)) return removed;
+  const providers = tracking.providers;
+  if (!providers || typeof providers !== "object" || Array.isArray(providers)) return removed;
+  for (const provider of Object.keys(LEGACY_TRACKING_SECRET_KEYS)) {
+    const cfg = providers[provider];
+    if (!cfg || typeof cfg !== "object" || Array.isArray(cfg)) continue;
+    for (const key of LEGACY_TRACKING_SECRET_KEYS[provider]) {
+      if (Object.prototype.hasOwnProperty.call(cfg, key)) {
+        delete cfg[key];
+        removed.push(`${basePath}.providers.${provider}.${key}`);
+      }
+    }
+  }
+  return removed;
+}
+function stripDocumentTrackingSecretsInPlace(doc) {
+  const removed = [];
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) return removed;
+  const record = doc;
+  removed.push(...stripTrackingSecretsInPlace(record.tracking, "tracking"));
+  const metadata = record.metadata;
+  if (metadata && typeof metadata === "object" && !Array.isArray(metadata)) {
+    removed.push(
+      ...stripTrackingSecretsInPlace(metadata.tracking, "metadata.tracking")
+    );
+  }
+  if (Array.isArray(record.artboards)) {
+    record.artboards.forEach((artboard, index) => {
+      if (artboard && typeof artboard === "object") {
+        const inner = artboard.document;
+        for (const path of stripDocumentTrackingSecretsInPlace(inner)) {
+          removed.push(`artboards.${index}.document.${path}`);
+        }
+      }
+    });
+  }
+  return removed;
+}
+function sanitizeDocumentTracking(doc) {
+  if (!doc || typeof doc !== "object") return { document: doc, removed: [] };
+  const copy = JSON.parse(JSON.stringify(doc));
+  const removed = stripDocumentTrackingSecretsInPlace(copy);
+  return { document: copy, removed };
+}
 
 // src/io/exporter.ts
 function sha256Sync(data) {
@@ -3676,6 +4043,7 @@ async function exportPackage(document, options = {}) {
     };
   }
   const pageDoc = JSON.parse(JSON.stringify(validation.data));
+  stripDocumentTrackingSecretsInPlace(pageDoc);
   if (options.metadata) {
     pageDoc.metadata = {
       ...pageDoc.metadata || {
@@ -3800,7 +4168,7 @@ async function exportPackage(document, options = {}) {
   };
   const manifest = {
     schema: SCHEMA_NAME4,
-    schemaVersion: pageDoc.version || CURRENT_SCHEMA_VERSION2,
+    schemaVersion: pageDoc.version || CURRENT_SCHEMA_VERSION3,
     packageVersion: options.packageVersion || "1.0.0",
     builderCompatibility: options.builderCompatibility || ">=0.1.0",
     requiredComponents: requirements.requiredComponents,
@@ -3827,13 +4195,14 @@ var exportStoraPackage = exportPackage;
 import { unzipSync, strFromU8 } from "fflate";
 import {
   ManifestSchema,
-  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION4
+  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION5
 } from "@kubuild/schema";
 
 // src/io/migration.ts
 import {
-  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION3,
-  SCHEMA_NAME as SCHEMA_NAME5
+  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION4,
+  SCHEMA_NAME as SCHEMA_NAME5,
+  getCanonicalTextPropRule
 } from "@kubuild/schema";
 var MigrationRegistry = class {
   steps = /* @__PURE__ */ new Map();
@@ -3987,17 +4356,86 @@ defaultMigrationRegistry.register({
     return migrated;
   }
 });
-function canMigrate(sourceVersion, targetVersion = CURRENT_SCHEMA_VERSION3, registry = defaultMigrationRegistry) {
+defaultMigrationRegistry.register({
+  fromVersion: "1.0.0",
+  toVersion: "1.1.0",
+  description: "Remove tracking secrets and server destinations (capiAccessToken, accessToken, measurementProtocolSecret, serverRelayUrl, custom endpointUrl/headers) from the document",
+  migrate: (rawDoc, context) => {
+    const migrated = deepClone(rawDoc);
+    migrated.version = "1.1.0";
+    const removed = stripDocumentTrackingSecretsInPlace(migrated);
+    if (removed.length > 0) {
+      context.warn({
+        code: "TRACKING_SECRET_REMOVED",
+        message: "Tracking secret removed; re-link credential via credentialId (secrets are now stored by the host and resolved server-side).",
+        step: "1.0.0->1.1.0",
+        paths: removed
+      });
+    }
+    return migrated;
+  }
+});
+function canonicalizeTextPropsInPlace(root, basePath = "document") {
+  const changed = [];
+  const walk2 = (value, path) => {
+    if (!value || typeof value !== "object" || Array.isArray(value)) return;
+    const node = value;
+    const props = node.props;
+    const rule = typeof node.type === "string" ? getCanonicalTextPropRule(node.type) : void 0;
+    if (rule && props && typeof props === "object" && !Array.isArray(props)) {
+      const record = props;
+      const presentAliases = rule.aliases.filter((alias) => record[alias] !== void 0);
+      if (presentAliases.length > 0) {
+        const displayedKey = rule.legacyReadOrder.find((key) => record[key] !== void 0);
+        if (node.type === "text" && displayedKey === "content" && record.as === void 0 && record.tag === void 0) {
+          record.as = "p";
+        }
+        if (displayedKey !== void 0 && displayedKey !== rule.canonical) {
+          record[rule.canonical] = record[displayedKey];
+        }
+        for (const alias of presentAliases) {
+          delete record[alias];
+          changed.push(`${path}.props.${alias}`);
+        }
+      }
+    }
+    if (Array.isArray(node.children)) {
+      node.children.forEach((child, index) => walk2(child, `${path}.children.${index}`));
+    }
+  };
+  walk2(root, basePath);
+  return changed;
+}
+defaultMigrationRegistry.register({
+  fromVersion: "1.1.0",
+  toVersion: "1.2.0",
+  description: "Rename deprecated text prop aliases to canonical names (heading/text/paragraph/link/badge/blockquote -> text, button -> label)",
+  migrate: (rawDoc, context) => {
+    const migrated = deepClone(rawDoc);
+    migrated.version = "1.2.0";
+    const changed = canonicalizeTextPropsInPlace(migrated.document);
+    if (changed.length > 0) {
+      context.warn({
+        code: "PROP_ALIAS_MIGRATED",
+        message: "Deprecated text prop aliases were renamed to their canonical names.",
+        step: "1.1.0->1.2.0",
+        paths: changed
+      });
+    }
+    return migrated;
+  }
+});
+function canMigrate(sourceVersion, targetVersion = CURRENT_SCHEMA_VERSION4, registry = defaultMigrationRegistry) {
   if (!sourceVersion || !targetVersion) return false;
   if (sourceVersion === targetVersion) return true;
   return registry.hasPath(sourceVersion, targetVersion);
 }
-function getMigrationPath(sourceVersion, targetVersion = CURRENT_SCHEMA_VERSION3, registry = defaultMigrationRegistry) {
+function getMigrationPath(sourceVersion, targetVersion = CURRENT_SCHEMA_VERSION4, registry = defaultMigrationRegistry) {
   if (!sourceVersion || !targetVersion) return null;
   return registry.findPath(sourceVersion, targetVersion);
 }
 function migrateDocument(rawDocument, options = {}) {
-  const targetVersion = options.targetVersion ?? CURRENT_SCHEMA_VERSION3;
+  const targetVersion = options.targetVersion ?? CURRENT_SCHEMA_VERSION4;
   const dryRun = options.dryRun ?? false;
   const registry = options.registry ?? defaultMigrationRegistry;
   const validate = options.validate ?? true;
@@ -4025,6 +4463,14 @@ function migrateDocument(rawDocument, options = {}) {
   const sourceVersion = typeof doc.version === "string" ? doc.version.trim() : "unknown";
   if (sourceVersion === targetVersion) {
     const cloned = deepClone(doc);
+    const removedSecrets = stripDocumentTrackingSecretsInPlace(cloned);
+    const currentWarnings = removedSecrets.length > 0 ? [
+      {
+        code: "TRACKING_SECRET_REMOVED",
+        message: "Tracking secret removed; re-link credential via credentialId (secrets are stored by the host and resolved server-side).",
+        paths: removedSecrets
+      }
+    ] : [];
     if (validate) {
       const validation = validateDocument(cloned);
       if (!validation.valid) {
@@ -4056,7 +4502,8 @@ function migrateDocument(rawDocument, options = {}) {
         targetVersion,
         migrationPath: [sourceVersion],
         stepsApplied: 0,
-        dryRun
+        dryRun,
+        ...currentWarnings.length > 0 ? { warnings: currentWarnings } : {}
       }
     };
   }
@@ -4082,6 +4529,16 @@ function migrateDocument(rawDocument, options = {}) {
     };
   }
   if (dryRun) {
+    const simulatedWarnings = [];
+    try {
+      let simulated = deepClone(doc);
+      for (let i = 0; i < path.length - 1; i++) {
+        const step = registry.getStep(path[i], path[i + 1]);
+        if (!step) break;
+        simulated = step.migrate(simulated, { warn: (w) => simulatedWarnings.push(w) });
+      }
+    } catch {
+    }
     return {
       success: true,
       diagnostic: {
@@ -4090,12 +4547,15 @@ function migrateDocument(rawDocument, options = {}) {
         targetVersion,
         migrationPath: path,
         stepsApplied: path.length - 1,
-        dryRun: true
+        dryRun: true,
+        ...simulatedWarnings.length > 0 ? { warnings: simulatedWarnings } : {}
       }
     };
   }
   let currentDoc = deepClone(doc);
   let stepsApplied = 0;
+  const warnings = [];
+  const stepContext = { warn: (w) => warnings.push(w) };
   for (let i = 0; i < path.length - 1; i++) {
     const fromVer = path[i];
     const toVer = path[i + 1];
@@ -4121,7 +4581,7 @@ function migrateDocument(rawDocument, options = {}) {
       };
     }
     try {
-      currentDoc = step.migrate(currentDoc);
+      currentDoc = step.migrate(currentDoc, stepContext);
       stepsApplied++;
     } catch (err) {
       const error = {
@@ -4177,7 +4637,8 @@ function migrateDocument(rawDocument, options = {}) {
       targetVersion,
       migrationPath: path,
       stepsApplied,
-      dryRun: false
+      dryRun: false,
+      ...warnings.length > 0 ? { warnings } : {}
     }
   };
 }
@@ -4212,7 +4673,7 @@ async function preflightPackage(archiveData, options = {}) {
     ...DEFAULT_SECURITY_LIMITS,
     ...options.securityLimits
   };
-  const targetVersion = options.targetSchemaVersion || CURRENT_SCHEMA_VERSION4;
+  const targetVersion = options.targetSchemaVersion || CURRENT_SCHEMA_VERSION5;
   const migrationRegistry = options.migrationRegistry || defaultMigrationRegistry;
   const diagnostics = [];
   let dependencyPolicy = options.dependencyPolicy || "cancel";
@@ -4375,6 +4836,16 @@ async function preflightPackage(archiveData, options = {}) {
   let rawPageDoc;
   try {
     rawPageDoc = JSON.parse(strFromU8(pageEntry));
+    const secretScan = sanitizeDocumentTracking(rawPageDoc);
+    if (secretScan.removed.length > 0) {
+      diagnostics.push({
+        code: "TRACKING_SECRET_REMOVED",
+        severity: "warning",
+        message: "Tracking secrets found in page.json will be removed on import; re-link credentials via credentialId.",
+        path: "page.json",
+        details: { paths: secretScan.removed }
+      });
+    }
     const pageProtoCheck = containsProhibitedKeys(rawPageDoc);
     if (pageProtoCheck.found) {
       diagnostics.push({
@@ -4621,7 +5092,7 @@ function buildReport(valid, canImport, fields) {
   return {
     valid,
     canImport,
-    targetVersion: fields.targetVersion || CURRENT_SCHEMA_VERSION4,
+    targetVersion: fields.targetVersion || CURRENT_SCHEMA_VERSION5,
     requiresMigration: fields.requiresMigration || false,
     missingComponents: fields.missingComponents || [],
     missingCapabilities: fields.missingCapabilities || [],
@@ -4694,7 +5165,7 @@ async function importPackage(archiveData, options = {}) {
   if (preflight.requiresMigration) {
     const migrationRegistry = options.migrationRegistry || defaultMigrationRegistry;
     const migrationRes = migrateDocument(pageRaw, {
-      targetVersion: options.targetSchemaVersion || CURRENT_SCHEMA_VERSION4,
+      targetVersion: options.targetSchemaVersion || CURRENT_SCHEMA_VERSION5,
       registry: migrationRegistry,
       validate: true
     });
@@ -4716,13 +5187,24 @@ async function importPackage(archiveData, options = {}) {
   } else {
     finalDocument = pageRaw;
   }
+  const importWarnings = [];
+  const strippedSecrets = stripDocumentTrackingSecretsInPlace(finalDocument);
+  if (strippedSecrets.length > 0) {
+    importWarnings.push({
+      code: "TRACKING_SECRET_REMOVED",
+      severity: "warning",
+      message: "Tracking secret removed from imported document; re-link credential via credentialId.",
+      path: "page.json",
+      details: { paths: strippedSecrets }
+    });
+  }
   let metadata = finalDocument.metadata || {
     title: "Imported Page",
     description: "",
     author: "",
     tags: [],
     category: "general",
-    version: finalDocument.version || CURRENT_SCHEMA_VERSION4
+    version: finalDocument.version || CURRENT_SCHEMA_VERSION5
   };
   if (unzipped["metadata.json"]) {
     try {
@@ -4874,7 +5356,8 @@ async function importPackage(archiveData, options = {}) {
     metadata,
     extractedAssets,
     renamedAssets: Object.keys(renameMap).length > 0 ? renameMap : void 0,
-    preflight
+    preflight,
+    ...importWarnings.length > 0 ? { warnings: importWarnings } : {}
   };
 }
 var importStoraPackage = importPackage;
@@ -4884,8 +5367,21 @@ import {
   ProjectDocumentSchema,
   PROJECT_SCHEMA_NAME as PROJECT_SCHEMA_NAME2,
   CURRENT_PROJECT_SCHEMA_VERSION as CURRENT_PROJECT_SCHEMA_VERSION2,
+  CURRENT_SCHEMA_VERSION as CURRENT_SCHEMA_VERSION6,
   looksLikeProjectDocument
 } from "@kubuild/schema";
+function migrateProjectArtboards(project) {
+  let changed = false;
+  const artboards = project.artboards.map((artboard) => {
+    const version = artboard.document.version;
+    if (version === CURRENT_SCHEMA_VERSION6 || !canMigrate(version)) return artboard;
+    const migration = migrateDocument(artboard.document);
+    if (!migration.success || !migration.document) return artboard;
+    changed = true;
+    return { ...artboard, document: migration.document };
+  });
+  return changed ? { ...project, artboards } : project;
+}
 var DEFAULT_PAGE_ARTBOARD_ID = "artboard-page-1";
 function wrapPageDocumentAsProject(document, options = {}) {
   const artboardId = options.artboardId ?? DEFAULT_PAGE_ARTBOARD_ID;
@@ -4935,7 +5431,7 @@ function loadProjectDocument(raw) {
     }
     return {
       success: true,
-      project: parsed.data,
+      project: migrateProjectArtboards(parsed.data),
       wrappedFromLegacyPage: false,
       errors: []
     };
@@ -5406,21 +5902,11 @@ function compareManifestsSemantically(expected, actual, options = {}) {
 // src/io/template-utils.ts
 import {
   TemplateRecordSchema,
+  BUILTIN_COMPONENT_TYPES,
   collectNodeIds as collectNodeIds2,
   isTemplateRecord
 } from "@kubuild/schema";
-var CORE_BUILTIN_COMPONENTS = /* @__PURE__ */ new Set([
-  "page",
-  "section",
-  "container",
-  "columns",
-  "column",
-  "heading",
-  "text",
-  "image",
-  "button",
-  "collection"
-]);
+var CORE_BUILTIN_COMPONENTS = new Set(BUILTIN_COMPONENT_TYPES);
 function validateTemplate(value) {
   const parseResult = TemplateRecordSchema.safeParse(value);
   if (parseResult.success) {
@@ -5531,22 +6017,6 @@ function saveDraftAsTemplate(draft, metadata, options = {}) {
     custom: metadata.custom ? deepClone(metadata.custom) : void 0
   });
 }
-function cloneTreeWithFreshIds(root, idGen) {
-  function cloneRec(node) {
-    const newId = idGen(node.id, node);
-    const clonedProps = node.props ? deepClone(node.props) : void 0;
-    const clonedStyles = node.styles ? deepClone(node.styles) : void 0;
-    const clonedChildren = node.children ? node.children.map((child) => cloneRec(child)) : [];
-    return {
-      id: newId,
-      type: node.type,
-      ...clonedProps ? { props: clonedProps } : {},
-      ...clonedStyles ? { styles: clonedStyles } : {},
-      children: clonedChildren
-    };
-  }
-  return cloneRec(root);
-}
 function cloneTemplateAsPage(templateOrDoc, options = {}) {
   let sourceDoc;
   let templateOrigin = null;
@@ -5582,7 +6052,7 @@ function cloneTemplateAsPage(templateOrDoc, options = {}) {
     return candidate;
   };
   const idGen = options.idGenerator || defaultIdGen;
-  const clonedRootNode = cloneTreeWithFreshIds(sourceDoc.document, idGen);
+  const { clonedNode: clonedRootNode } = cloneNodeTreeWithFreshIds(sourceDoc.document, idGen);
   const rootPageNode = {
     ...clonedRootNode,
     type: "page"
@@ -5993,6 +6463,7 @@ export {
   DocumentHistoryManager,
   HistoryEngine,
   MigrationRegistry,
+  NODE_ID_REFERENCE_KEYS,
   RuntimeStateStore,
   addArtboard,
   applyFieldTransform,
@@ -6000,7 +6471,9 @@ export {
   buildSampleVariablesFromCatalog,
   calculateChecksum,
   canMigrate,
+  canonicalizeTextPropsInPlace,
   checkZipBomb,
+  cloneNodeTreeWithFreshIds,
   cloneTemplateAsPage,
   cloneTreeWithNewIds,
   collectArtboardReferenceNodes,
@@ -6017,6 +6490,7 @@ export {
   createPageArtboard,
   createRuntimeStore,
   createTemplateRecord,
+  createTrackingRelayHandler,
   deepClone,
   defaultIdGenerator,
   defaultMigrationRegistry,
@@ -6076,6 +6550,7 @@ export {
   previewImportPackage,
   remapAssetReferences,
   remapDocumentAssetReferences,
+  remapNodeReferences,
   removeArtboard,
   removeNode,
   renameArtboard,
@@ -6083,6 +6558,7 @@ export {
   resolveBinding,
   resolveBindingValue,
   resolvePropertyPath,
+  sanitizeDocumentTracking,
   sanitizeFilename,
   sanitizeHtml,
   sanitizeUrl,
@@ -6093,6 +6569,8 @@ export {
   sendTikTokEventsApi,
   setActiveArtboard,
   sha256Sync,
+  stripDocumentTrackingSecretsInPlace,
+  stripTrackingSecretsInPlace,
   ungroupNodeFrame,
   updateActions,
   updateAnimation,
@@ -6100,6 +6578,7 @@ export {
   updateFormConfig,
   updateProps,
   updateStyle,
+  updateTheme,
   validateDocument,
   validateDocumentSecurity,
   validateFieldValue,