@kubuild/schema 0.5.0 → 0.7.0

package/dist/index.js

@@ -1,9 +1,210 @@
 // src/document.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 
 // src/actions.ts
+import { z as z2 } from "zod";
+
+// src/tracking.ts
 import { z } from "zod";
-var ActionTriggerTypeSchema = z.enum([
+var TrackingProviderTypeSchema = z.enum([
+  "meta",
+  "google",
+  "gtm",
+  "tiktok",
+  "custom"
+]);
+var TrackingDeliverySchema = z.enum(["both", "client_only", "server_only"]);
+var MetaTrackingProviderConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  /** Host credential id; the server resolves the CAPI access token from it. */
+  credentialId: z.string().optional(),
+  /** Meta Pixel ID (e.g. 123456789012345) — public */
+  pixelId: z.string().optional().default(""),
+  /** Enable Server-Side Conversions API (delivered through the host relay) */
+  capiEnabled: z.boolean().optional().default(false),
+  /** Test Event Code from Meta Events Manager (e.g. "TEST12345") — not a secret */
+  testEventCode: z.string().optional().default("")
+});
+var GoogleTrackingProviderConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  /** Host credential id; the server resolves the Measurement Protocol API secret from it. */
+  credentialId: z.string().optional(),
+  /** GA4 Measurement ID (e.g. "G-XXXXXXXXXX") — public */
+  measurementId: z.string().optional().default("")
+});
+var GtmTrackingProviderConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  /** Optional linked account/workspace credential ID */
+  credentialId: z.string().optional(),
+  /** GTM Container ID (e.g. "GTM-XXXXXXX") — public */
+  containerId: z.string().optional().default("")
+});
+var TikTokTrackingProviderConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  /** Host credential id; the server resolves the Events API access token from it. */
+  credentialId: z.string().optional(),
+  /** TikTok Pixel ID (e.g. "C1234567890") — public */
+  pixelId: z.string().optional().default(""),
+  /** Enable TikTok Events API (server-side, delivered through the host relay) */
+  eventsApiEnabled: z.boolean().optional().default(false),
+  /** Test Event Code from TikTok Event Manager — not a secret */
+  testEventCode: z.string().optional().default("")
+});
+var CustomTrackingProviderConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  /** Host credential id; the server resolves the webhook `endpointUrl` + `headers` from it. */
+  credentialId: z.string().optional()
+});
+var LEGACY_TRACKING_SECRET_KEYS = Object.freeze({
+  meta: ["capiAccessToken", "serverRelayUrl"],
+  google: ["measurementProtocolSecret", "serverRelayUrl"],
+  gtm: ["serverRelayUrl"],
+  tiktok: ["accessToken", "serverRelayUrl"],
+  custom: ["endpointUrl", "headers"]
+});
+var TrackingConfigSchema = z.object({
+  /** Master toggle: dynamically enables or disables all tracking operations */
+  enabled: z.boolean().default(true),
+  /** When enabled, events are logged to console and can bypass live API calls for safe debugging */
+  debugMode: z.boolean().optional().default(false),
+  /** Automatically trigger PageView event upon page load */
+  autoPageView: z.boolean().optional().default(true),
+  /** Default delivery method when not explicitly overridden in an action step */
+  defaultDelivery: TrackingDeliverySchema.optional().default("both"),
+  /** Provider-specific settings */
+  providers: z.object({
+    meta: MetaTrackingProviderConfigSchema.optional(),
+    google: GoogleTrackingProviderConfigSchema.optional(),
+    gtm: GtmTrackingProviderConfigSchema.optional(),
+    tiktok: TikTokTrackingProviderConfigSchema.optional(),
+    custom: CustomTrackingProviderConfigSchema.optional()
+  }).optional().default({})
+});
+var MetaTrackingSecretsSchema = z.object({
+  /** System User access token for the Meta Graph API. */
+  capiAccessToken: z.string().min(1)
+});
+var GoogleTrackingSecretsSchema = z.object({
+  /** Measurement Protocol `api_secret`. */
+  measurementProtocolSecret: z.string().min(1)
+});
+var TikTokTrackingSecretsSchema = z.object({
+  /** Long-term Events API access token. */
+  accessToken: z.string().min(1)
+});
+var CustomTrackingSecretsSchema = z.object({
+  endpointUrl: z.string().url(),
+  headers: z.record(z.string(), z.string()).optional()
+});
+var StandardTrackingEventSchema = z.enum([
+  "PageView",
+  "ViewContent",
+  "AddToCart",
+  "InitiateCheckout",
+  "Purchase",
+  "Lead",
+  "Contact",
+  "CompleteRegistration",
+  "Subscribe",
+  "Search",
+  "SubmitApplication",
+  "Schedule"
+]);
+var TrackEventProviderSchema = z.enum(["all", "meta", "google", "gtm", "tiktok", "custom"]);
+var TrackEventStepPayloadSchema = z.object({
+  /** Event name: e.g. "Purchase", "Lead", or custom string */
+  eventName: z.string().min(1, "Event name cannot be empty"),
+  /** Standard event vs custom event identifier */
+  eventType: z.enum(["standard", "custom"]).optional().default("standard"),
+  /**
+   * Target provider: 'all' or a specific provider.
+   * 'gtm' pushes the event to `window.dataLayer` (client-side only).
+   */
+  provider: TrackEventProviderSchema.optional().default("all"),
+  /** Delivery channel: 'both', 'client_only', or 'server_only' */
+  delivery: TrackingDeliverySchema.optional().default("both"),
+  /**
+   * Deduplication Event ID.
+   * If omitted, a unique ID is automatically generated so Meta/TikTok CAPI
+   * deduplicates cleanly with the browser pixel.
+   */
+  eventId: z.string().optional(),
+  /**
+   * Event parameters/properties (e.g. currency, value, content_name, order_id).
+   * Supports runtime variable interpolation (e.g. {{ form.price }} or {{ variables.currency }}).
+   */
+  params: z.record(z.string(), z.unknown()).optional().default({}),
+  /**
+   * User Data for advanced matching and server CAPI (e.g. email, phone, firstName, lastName).
+   * Supports runtime variable interpolation (e.g. {{ form.email }}).
+   */
+  userData: z.record(z.string(), z.unknown()).optional().default({}),
+  /** Step-level active toggle */
+  enabled: z.boolean().optional().default(true)
+});
+var TRACKING_RELAY_PROTOCOL_VERSION = 1;
+var ServerTrackingEventSchema = z.object({
+  eventName: z.string().min(1).max(256),
+  eventType: z.enum(["standard", "custom"]).optional(),
+  eventId: z.string().max(256).optional(),
+  /** Unix epoch seconds. */
+  eventTime: z.number().int().nonnegative().optional(),
+  eventSourceUrl: z.string().max(4096).optional(),
+  actionSource: z.enum(["website", "app", "system_generated"]).optional(),
+  params: z.record(z.string(), z.unknown()).optional(),
+  /** Raw (unhashed) user data; the relay hashes PII per provider spec before forwarding. */
+  userData: z.record(z.string(), z.unknown()).optional(),
+  customData: z.record(z.string(), z.unknown()).optional()
+});
+var TrackingRelayRequestSchema = z.object({
+  version: z.literal(TRACKING_RELAY_PROTOCOL_VERSION),
+  event: ServerTrackingEventSchema,
+  provider: TrackEventProviderSchema.optional().default("all"),
+  /** Optional hint only; the relay uses the credentialId from its trusted config. */
+  credentialId: z.string().max(256).optional(),
+  /** Host document/page id so the relay can look up the trusted tracking config. */
+  documentId: z.string().max(256).optional()
+});
+var TrackingRelayProviderResultSchema = z.object({
+  provider: z.string(),
+  success: z.boolean(),
+  status: z.number().int().optional(),
+  skipped: z.boolean().optional(),
+  reason: z.string().optional(),
+  error: z.string().optional()
+});
+var TrackingRelayErrorCodeSchema = z.enum([
+  "INVALID_REQUEST",
+  "UNSUPPORTED_VERSION",
+  "FORBIDDEN_ORIGIN",
+  "METHOD_NOT_ALLOWED",
+  "CONFIG_NOT_FOUND",
+  "INTERNAL_ERROR"
+]);
+var TrackingRelayResponseSchema = z.object({
+  version: z.literal(TRACKING_RELAY_PROTOCOL_VERSION),
+  success: z.boolean(),
+  eventId: z.string().optional(),
+  skipped: z.boolean().optional(),
+  reason: z.string().optional(),
+  results: z.record(z.string(), TrackingRelayProviderResultSchema).optional(),
+  error: z.object({
+    code: TrackingRelayErrorCodeSchema,
+    message: z.string()
+  }).optional()
+});
+function isTrackingConfig(value) {
+  return TrackingConfigSchema.safeParse(value).success;
+}
+function isTrackEventStepPayload(value) {
+  return TrackEventStepPayloadSchema.safeParse(value).success;
+}
+function isTrackingRelayRequest(value) {
+  return TrackingRelayRequestSchema.safeParse(value).success;
+}
+
+// src/actions.ts
+var ActionTriggerTypeSchema = z2.enum([
   "click",
   "submit",
   "change",
@@ -12,7 +213,7 @@ var ActionTriggerTypeSchema = z.enum([
   "load"
 ]);
 var ActionTriggerSchema = ActionTriggerTypeSchema;
-var ActionStepTypeSchema = z.enum([
+var ActionStepTypeSchema = z2.enum([
   "api_request",
   "navigate",
   "set_state",
@@ -20,10 +221,12 @@ var ActionStepTypeSchema = z.enum([
   "show_toast",
   "open_modal",
   "close_modal",
+  "toggle_modal",
   "copy_clipboard",
-  "custom_event"
+  "custom_event",
+  "track_event"
 ]);
-var ConditionOperatorSchema = z.enum([
+var ConditionOperatorSchema = z2.enum([
   "equals",
   "not_equals",
   "contains",
@@ -36,10 +239,10 @@ var ConditionOperatorSchema = z.enum([
   "lte",
   "regex"
 ]);
-var ActionStepConditionSchema = z.object({
-  field: z.string().min(1, "Condition field cannot be empty"),
+var ActionStepConditionSchema = z2.object({
+  field: z2.string().min(1, "Condition field cannot be empty"),
   operator: ConditionOperatorSchema,
-  value: z.unknown().optional()
+  value: z2.unknown().optional()
 });
 var DANGEROUS_URL_PATTERN = /(javascript:|vbscript:|data:text\/html)/i;
 var DANGEROUS_SCRIPT_PATTERN = /<\s*script/i;
@@ -50,68 +253,81 @@ function isSafeActionUrl(url) {
   if (DANGEROUS_SCRIPT_PATTERN.test(trimmed)) return false;
   return true;
 }
-var SafeUrlStringSchema = z.string().min(1, "URL cannot be empty").refine(isSafeActionUrl, {
+var SafeUrlStringSchema = z2.string().min(1, "URL cannot be empty").refine(isSafeActionUrl, {
   message: "URL contains disallowed or unsafe protocol/script pattern"
 });
-var SafeEventNameSchema = z.string().min(1, "Event name cannot be empty").regex(/^[a-zA-Z0-9_\-:]+$/, {
+var SafeEventNameSchema = z2.string().min(1, "Event name cannot be empty").regex(/^[a-zA-Z0-9_\-:]+$/, {
   message: "Event name must contain only alphanumeric characters, dashes, colons, or underscores"
 });
-var ApiRequestStepPayloadSchema = z.object({
+var ApiRequestStepPayloadSchema = z2.object({
   url: SafeUrlStringSchema,
-  method: z.enum(["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]).default("GET"),
-  headers: z.record(z.string(), z.string()).optional(),
-  queryParams: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
-  body: z.union([z.string(), z.record(z.string(), z.unknown()), z.array(z.unknown())]).optional(),
-  bodyFormat: z.enum(["json", "form-data", "formData", "urlencoded", "url-encoded", "raw", "text"]).optional(),
-  bodyType: z.enum(["json", "form-data", "formData", "urlencoded", "url-encoded", "raw", "text"]).optional(),
-  timeout: z.number().positive("Timeout must be greater than 0 ms").optional(),
-  responseMapping: z.record(z.string(), z.string()).optional()
+  method: z2.enum(["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]).default("GET"),
+  headers: z2.record(z2.string(), z2.string()).optional(),
+  queryParams: z2.record(z2.string(), z2.union([z2.string(), z2.number(), z2.boolean()])).optional(),
+  body: z2.union([z2.string(), z2.record(z2.string(), z2.unknown()), z2.array(z2.unknown())]).optional(),
+  bodyFormat: z2.enum(["json", "form-data", "formData", "urlencoded", "url-encoded", "raw", "text"]).optional(),
+  bodyType: z2.enum(["json", "form-data", "formData", "urlencoded", "url-encoded", "raw", "text"]).optional(),
+  timeout: z2.number().positive("Timeout must be greater than 0 ms").optional(),
+  responseMapping: z2.record(z2.string(), z2.string()).optional()
 });
-var NavigateStepPayloadSchema = z.object({
+var NavigateStepPayloadSchema = z2.object({
   url: SafeUrlStringSchema,
-  target: z.enum(["_self", "_blank", "_parent", "_top"]).optional().default("_self"),
-  replace: z.boolean().optional(),
-  scroll: z.boolean().optional(),
-  behavior: z.enum(["smooth", "auto"]).optional()
+  target: z2.enum(["_self", "_blank", "_parent", "_top"]).optional().default("_self"),
+  replace: z2.boolean().optional(),
+  scroll: z2.boolean().optional(),
+  behavior: z2.enum(["smooth", "auto"]).optional()
 });
-var SetStateStepPayloadSchema = z.object({
-  key: z.string().min(1, "State key cannot be empty"),
-  value: z.unknown(),
-  scope: z.enum(["runtime", "document", "session", "local"]).optional().default("runtime")
+var SetStateStepPayloadSchema = z2.object({
+  key: z2.string().min(1, "State key cannot be empty"),
+  value: z2.unknown(),
+  scope: z2.enum(["runtime", "document", "session", "local"]).optional().default("runtime")
 });
-var ResetFormStepPayloadSchema = z.object({
-  formId: z.string().optional()
+var ResetFormStepPayloadSchema = z2.object({
+  formId: z2.string().optional()
 });
-var ShowToastStepPayloadSchema = z.object({
-  message: z.string().min(1, "Toast message cannot be empty"),
-  type: z.enum(["success", "error", "warning", "info"]).optional().default("info"),
-  variant: z.enum(["success", "error", "warning", "info"]).optional(),
-  title: z.string().optional(),
-  duration: z.number().nonnegative("Duration must be >= 0 ms").optional(),
-  position: z.enum(["top-right", "top-left", "bottom-right", "bottom-left", "top-center", "bottom-center"]).optional()
+var ShowToastStepPayloadSchema = z2.object({
+  message: z2.string().min(1, "Toast message cannot be empty"),
+  type: z2.enum(["success", "error", "warning", "info"]).optional().default("info"),
+  variant: z2.enum(["success", "error", "warning", "info"]).optional(),
+  title: z2.string().optional(),
+  duration: z2.number().nonnegative("Duration must be >= 0 ms").optional(),
+  position: z2.enum(["top-right", "top-left", "bottom-right", "bottom-left", "top-center", "bottom-center"]).optional()
 });
-var OpenModalStepPayloadSchema = z.object({
-  modalId: z.string().optional(),
-  modalNodeId: z.string().optional(),
-  toggle: z.boolean().optional()
+var OpenModalStepPayloadSchema = z2.object({
+  modalId: z2.string().optional(),
+  modalNodeId: z2.string().optional(),
+  toggle: z2.boolean().optional()
 }).refine((data) => Boolean(data.modalId || data.modalNodeId), {
   message: "Modal ID or Modal Node ID cannot be empty"
 });
-var CloseModalStepPayloadSchema = z.object({
-  modalId: z.string().optional(),
-  modalNodeId: z.string().optional()
+var CloseModalStepPayloadSchema = z2.object({
+  modalId: z2.string().optional(),
+  modalNodeId: z2.string().optional()
 });
-var CopyClipboardStepPayloadSchema = z.object({
-  text: z.string().optional(),
-  value: z.unknown().optional(),
-  notify: z.boolean().optional(),
-  toastMessage: z.string().optional()
+var ToggleModalStepPayloadSchema = z2.object({
+  modalId: z2.string().optional(),
+  modalNodeId: z2.string().optional(),
+  targetNodeId: z2.string().optional(),
+  nodeId: z2.string().optional()
+}).refine(
+  (data) => [data.modalId, data.modalNodeId, data.targetNodeId, data.nodeId].some(
+    (id) => typeof id === "string" && id.trim().length > 0
+  ),
+  {
+    message: "Modal ID or Modal Node ID cannot be empty"
+  }
+);
+var CopyClipboardStepPayloadSchema = z2.object({
+  text: z2.string().optional(),
+  value: z2.unknown().optional(),
+  notify: z2.boolean().optional(),
+  toastMessage: z2.string().optional()
 });
-var CustomEventStepPayloadSchema = z.object({
+var CustomEventStepPayloadSchema = z2.object({
   eventName: SafeEventNameSchema,
-  detail: z.record(z.string(), z.unknown()).optional(),
-  bubbles: z.boolean().optional().default(true),
-  cancelable: z.boolean().optional().default(true)
+  detail: z2.record(z2.string(), z2.unknown()).optional(),
+  bubbles: z2.boolean().optional().default(true),
+  cancelable: z2.boolean().optional().default(true)
 });
 var StepPayloadSchemas = {
   api_request: ApiRequestStepPayloadSchema,
@@ -121,30 +337,32 @@ var StepPayloadSchemas = {
   show_toast: ShowToastStepPayloadSchema,
   open_modal: OpenModalStepPayloadSchema,
   close_modal: CloseModalStepPayloadSchema,
+  toggle_modal: ToggleModalStepPayloadSchema,
   copy_clipboard: CopyClipboardStepPayloadSchema,
-  custom_event: CustomEventStepPayloadSchema
+  custom_event: CustomEventStepPayloadSchema,
+  track_event: TrackEventStepPayloadSchema
 };
-var ActionStepSchema = z.lazy(
-  () => z.object({
-    id: z.string().min(1, "Step ID cannot be empty"),
+var ActionStepSchema = z2.lazy(
+  () => z2.object({
+    id: z2.string().min(1, "Step ID cannot be empty"),
     type: ActionStepTypeSchema,
-    label: z.string().optional(),
-    payload: z.record(z.string(), z.unknown()).optional().default({}),
+    label: z2.string().optional(),
+    payload: z2.record(z2.string(), z2.unknown()).optional().default({}),
     condition: ActionStepConditionSchema.optional(),
-    timeout: z.number().positive().optional(),
-    continueOnError: z.boolean().optional(),
-    onSuccess: z.array(ActionStepSchema).optional(),
-    onError: z.array(ActionStepSchema).optional()
+    timeout: z2.number().positive().optional(),
+    continueOnError: z2.boolean().optional(),
+    onSuccess: z2.array(ActionStepSchema).optional(),
+    onError: z2.array(ActionStepSchema).optional()
   })
 );
-var ActionPipelineSchema = z.object({
-  id: z.string().min(1, "Pipeline ID cannot be empty"),
+var ActionPipelineSchema = z2.object({
+  id: z2.string().min(1, "Pipeline ID cannot be empty"),
   trigger: ActionTriggerTypeSchema,
-  label: z.string().optional(),
-  debounceMs: z.number().nonnegative("Debounce ms must be >= 0").optional(),
-  preventDuplicate: z.boolean().optional(),
-  enabled: z.boolean().optional().default(true),
-  steps: z.array(ActionStepSchema).min(1, "Action pipeline must contain at least one step")
+  label: z2.string().optional(),
+  debounceMs: z2.number().nonnegative("Debounce ms must be >= 0").optional(),
+  preventDuplicate: z2.boolean().optional(),
+  enabled: z2.boolean().optional().default(true),
+  steps: z2.array(ActionStepSchema).min(1, "Action pipeline must contain at least one step")
 });
 function isActionTriggerType(value) {
   return ActionTriggerTypeSchema.safeParse(value).success;
@@ -169,9 +387,9 @@ function validateActionStepPayload(type, payload) {
   if (!schema) {
     return {
       success: false,
-      error: new z.ZodError([
+      error: new z2.ZodError([
         {
-          code: z.ZodIssueCode.custom,
+          code: z2.ZodIssueCode.custom,
           message: `Unknown step type: ${type}`,
           path: ["type"]
         }
@@ -259,8 +477,8 @@ function sanitizeActionPipeline(pipeline) {
 }
 
 // src/form.ts
-import { z as z2 } from "zod";
-var ValidationRuleTypeSchema = z2.enum([
+import { z as z3 } from "zod";
+var ValidationRuleTypeSchema = z3.enum([
   "required",
   "email",
   "url",
@@ -272,29 +490,29 @@ var ValidationRuleTypeSchema = z2.enum([
   "match_field",
   "custom_regex"
 ]);
-var ValidateOnEventSchema = z2.enum(["blur", "change", "submit"]);
-var ValidationRuleSchema = z2.object({
+var ValidateOnEventSchema = z3.enum(["blur", "change", "submit"]);
+var ValidationRuleSchema = z3.object({
   type: ValidationRuleTypeSchema,
-  value: z2.unknown().optional(),
-  message: z2.string().min(1, "Validation error message cannot be empty")
+  value: z3.unknown().optional(),
+  message: z3.string().min(1, "Validation error message cannot be empty")
 });
-var FormFieldBindingSchema = z2.object({
-  name: z2.string().min(1, "Field name cannot be empty"),
-  label: z2.string().optional(),
-  defaultValue: z2.unknown().optional(),
-  rules: z2.array(ValidationRuleSchema).optional().default([]),
+var FormFieldBindingSchema = z3.object({
+  name: z3.string().min(1, "Field name cannot be empty"),
+  label: z3.string().optional(),
+  defaultValue: z3.unknown().optional(),
+  rules: z3.array(ValidationRuleSchema).optional().default([]),
   validateOn: ValidateOnEventSchema.optional().default("blur"),
-  transform: z2.enum(["trim", "lowercase", "uppercase", "number"]).optional(),
-  disabled: z2.boolean().optional(),
-  required: z2.boolean().optional()
+  transform: z3.enum(["trim", "lowercase", "uppercase", "number"]).optional(),
+  disabled: z3.boolean().optional(),
+  required: z3.boolean().optional()
 });
-var FormConfigSchema = z2.object({
-  formId: z2.string().min(1, "Form ID cannot be empty"),
-  resetOnSubmit: z2.boolean().optional().default(false),
-  scrollToFirstError: z2.boolean().optional().default(true),
+var FormConfigSchema = z3.object({
+  formId: z3.string().min(1, "Form ID cannot be empty"),
+  resetOnSubmit: z3.boolean().optional().default(false),
+  scrollToFirstError: z3.boolean().optional().default(true),
   validateOn: ValidateOnEventSchema.optional().default("blur"),
-  initialValues: z2.record(z2.string(), z2.unknown()).optional(),
-  rules: z2.array(ValidationRuleSchema).optional()
+  initialValues: z3.record(z3.string(), z3.unknown()).optional(),
+  rules: z3.array(ValidationRuleSchema).optional()
 });
 function isValidationRuleType(value) {
   return ValidationRuleTypeSchema.safeParse(value).success;
@@ -314,56 +532,56 @@ function isFormConfig(value) {
 
 // src/document.ts
 var SCHEMA_NAME = "stora.page";
-var CURRENT_SCHEMA_VERSION = "1.0.0";
-var AssetReferenceSchema = z3.object({
-  type: z3.literal("asset"),
-  assetId: z3.string().min(1, "Asset ID cannot be empty"),
-  filename: z3.string().optional(),
-  mimeType: z3.string().optional(),
-  fallbackUrl: z3.string().url().optional()
+var CURRENT_SCHEMA_VERSION = "1.1.0";
+var AssetReferenceSchema = z4.object({
+  type: z4.literal("asset"),
+  assetId: z4.string().min(1, "Asset ID cannot be empty"),
+  filename: z4.string().optional(),
+  mimeType: z4.string().optional(),
+  fallbackUrl: z4.string().url().optional()
 });
-var VariableBindingSchema = z3.object({
-  type: z3.literal("variable"),
-  key: z3.string().min(1, "Variable key cannot be empty"),
-  fallback: z3.unknown().optional()
+var VariableBindingSchema = z4.object({
+  type: z4.literal("variable"),
+  key: z4.string().min(1, "Variable key cannot be empty"),
+  fallback: z4.unknown().optional()
 });
-var ActionBindingSchema = z3.object({
-  type: z3.string().min(1, "Action type cannot be empty"),
-  payload: z3.record(z3.string(), z3.unknown()).optional()
+var ActionBindingSchema = z4.object({
+  type: z4.string().min(1, "Action type cannot be empty"),
+  payload: z4.record(z4.string(), z4.unknown()).optional()
 });
 var DANGEROUS_STYLE_VALUE_PATTERN = /javascript:|expression\(|@import|<script|vbscript:|data:text\/html/i;
-var StyleValueSchema = z3.union([
-  z3.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
+var StyleValueSchema = z4.union([
+  z4.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
     message: "Style value contains a disallowed or unsafe pattern"
   }),
-  z3.number(),
-  z3.boolean(),
-  z3.null(),
-  z3.undefined()
+  z4.number(),
+  z4.boolean(),
+  z4.null(),
+  z4.undefined()
 ]);
-var StyleDefinitionSchema = z3.record(z3.string(), StyleValueSchema);
-var PseudoStateStylesSchema = z3.record(z3.string(), StyleDefinitionSchema);
-var ResponsiveStylesSchema = z3.object({
+var StyleDefinitionSchema = z4.record(z4.string(), StyleValueSchema);
+var PseudoStateStylesSchema = z4.record(z4.string(), StyleDefinitionSchema);
+var ResponsiveStylesSchema = z4.object({
   base: StyleDefinitionSchema.optional(),
   desktop: StyleDefinitionSchema.optional(),
   tablet: StyleDefinitionSchema.optional(),
   mobile: StyleDefinitionSchema.optional(),
   states: PseudoStateStylesSchema.optional()
 }).passthrough().default({});
-var AnimationConfigSchema = z3.object({
-  type: z3.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
+var AnimationConfigSchema = z4.object({
+  type: z4.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
     message: "Animation type contains a disallowed or unsafe pattern"
   }).optional().default("none"),
-  duration: z3.number().min(0, "Duration must be non-negative").optional().default(600),
-  delay: z3.number().min(0, "Delay must be non-negative").optional().default(0),
-  easing: z3.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
+  duration: z4.number().min(0, "Duration must be non-negative").optional().default(600),
+  delay: z4.number().min(0, "Delay must be non-negative").optional().default(0),
+  easing: z4.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
     message: "Animation easing contains a disallowed or unsafe pattern"
   }).optional().default("ease-out"),
-  once: z3.boolean().optional().default(true),
-  hoverEffect: z3.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
+  once: z4.boolean().optional().default(true),
+  hoverEffect: z4.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
     message: "Hover effect contains a disallowed or unsafe pattern"
   }).optional().default("none"),
-  loopEffect: z3.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
+  loopEffect: z4.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
     message: "Loop effect contains a disallowed or unsafe pattern"
   }).optional().default("none")
 });
@@ -376,16 +594,16 @@ var DEFAULT_ANIMATION_CONFIG = {
   hoverEffect: "none",
   loopEffect: "none"
 };
-var NodeSchema = z3.lazy(
-  () => z3.object({
-    id: z3.string().min(1, "Node ID must be a non-empty string"),
-    type: z3.string().min(1, "Node type must be a non-empty string"),
-    props: z3.record(z3.string(), z3.unknown()).optional().default({}),
+var NodeSchema = z4.lazy(
+  () => z4.object({
+    id: z4.string().min(1, "Node ID must be a non-empty string"),
+    type: z4.string().min(1, "Node type must be a non-empty string"),
+    props: z4.record(z4.string(), z4.unknown()).optional().default({}),
     styles: ResponsiveStylesSchema.optional().default({}),
     animation: AnimationConfigSchema.optional(),
-    actions: z3.array(ActionPipelineSchema).optional(),
+    actions: z4.array(ActionPipelineSchema).optional(),
     formConfig: FormConfigSchema.optional(),
-    children: z3.array(NodeSchema).optional().default([])
+    children: z4.array(NodeSchema).optional().default([])
   })
 );
 var RootPageNodeSchema = NodeSchema.refine(
@@ -395,61 +613,64 @@ var RootPageNodeSchema = NodeSchema.refine(
     path: ["type"]
   }
 );
-var DocumentMetadataSchema = z3.object({
-  title: z3.string().min(1, "Title is required").default("Untitled Page"),
-  description: z3.string().optional().default(""),
-  author: z3.string().optional().default(""),
-  createdAt: z3.string().optional(),
-  updatedAt: z3.string().optional(),
-  tags: z3.array(z3.string()).optional().default([]),
-  category: z3.string().optional().default("general"),
-  version: z3.string().optional().default("1.0.0"),
-  custom: z3.record(z3.string(), z3.unknown()).optional()
+var DocumentMetadataSchema = z4.object({
+  title: z4.string().min(1, "Title is required").default("Untitled Page"),
+  description: z4.string().optional().default(""),
+  author: z4.string().optional().default(""),
+  createdAt: z4.string().optional(),
+  updatedAt: z4.string().optional(),
+  tags: z4.array(z4.string()).optional().default([]),
+  category: z4.string().optional().default("general"),
+  version: z4.string().optional().default("1.0.0"),
+  custom: z4.record(z4.string(), z4.unknown()).optional(),
+  tracking: TrackingConfigSchema.optional()
 });
-var PageDocumentSchema = z3.object({
-  schema: z3.literal(SCHEMA_NAME),
-  version: z3.string().min(1, "Schema version is required").default(CURRENT_SCHEMA_VERSION),
+var PageDocumentSchema = z4.object({
+  schema: z4.literal(SCHEMA_NAME),
+  version: z4.string().min(1, "Schema version is required").default(CURRENT_SCHEMA_VERSION),
   metadata: DocumentMetadataSchema.optional(),
+  tracking: TrackingConfigSchema.optional(),
   document: RootPageNodeSchema
 });
 var PROJECT_SCHEMA_NAME = "stora.project";
 var CURRENT_PROJECT_SCHEMA_VERSION = "1.0.0";
 var ARTBOARD_REFERENCE_NODE_TYPE = "artboard-reference";
-var ArtboardTypeSchema = z3.enum(["page", "component"]);
-var ArtboardSchema = z3.object({
-  id: z3.string().min(1, "Artboard ID is required"),
-  name: z3.string().min(1, "Artboard name is required"),
+var ArtboardTypeSchema = z4.enum(["page", "component"]);
+var ArtboardSchema = z4.object({
+  id: z4.string().min(1, "Artboard ID is required"),
+  name: z4.string().min(1, "Artboard name is required"),
   artboardType: ArtboardTypeSchema,
   /** Route for page artboards (e.g. "/about"). */
-  slug: z3.string().optional(),
+  slug: z4.string().optional(),
   /**
    * For component artboards: the id that `open_modal` / `close_modal` actions target.
    * Mirrors the detached node's own `props.modalId` so ModalManager keeps working unchanged.
    */
-  triggerId: z3.string().optional(),
+  triggerId: z4.string().optional(),
   /**
    * Viewport/breakpoint this artboard is currently authored at. Declared inline
    * (rather than imported) because viewport is otherwise an editor/renderer concept.
    */
-  viewport: z3.enum(["desktop", "tablet", "mobile"]).optional(),
+  viewport: z4.enum(["desktop", "tablet", "mobile"]).optional(),
   /** Persisted artboard width in px, matching the canvas ViewportResizer's `width`. */
-  width: z3.number().positive().optional(),
+  width: z4.number().positive().optional(),
   /**
    * Free position on the builder's infinite canvas, in unscaled canvas px. Absent means
    * "not placed yet" — the canvas then falls back to laying the artboard out in a row.
    */
-  position: z3.object({
-    x: z3.number(),
-    y: z3.number()
+  position: z4.object({
+    x: z4.number(),
+    y: z4.number()
   }).optional(),
   document: PageDocumentSchema
 });
-var ProjectDocumentSchema = z3.object({
-  schema: z3.literal(PROJECT_SCHEMA_NAME),
-  version: z3.string().min(1, "Schema version is required").default(CURRENT_PROJECT_SCHEMA_VERSION),
+var ProjectDocumentSchema = z4.object({
+  schema: z4.literal(PROJECT_SCHEMA_NAME),
+  version: z4.string().min(1, "Schema version is required").default(CURRENT_PROJECT_SCHEMA_VERSION),
   metadata: DocumentMetadataSchema.optional(),
-  artboards: z3.array(ArtboardSchema).min(1, "A project needs at least one artboard"),
-  activeArtboardId: z3.string().optional()
+  tracking: TrackingConfigSchema.optional(),
+  artboards: z4.array(ArtboardSchema).min(1, "A project needs at least one artboard"),
+  activeArtboardId: z4.string().optional()
 });
 function isAssetReference(value) {
   return AssetReferenceSchema.safeParse(value).success;
@@ -505,30 +726,30 @@ function validateNodeIdUniqueness(node) {
 }
 
 // src/manifest.ts
-import { z as z4 } from "zod";
-var ManifestAssetItemSchema = z4.object({
-  id: z4.string().min(1, "Asset ID cannot be empty"),
-  path: z4.string().min(1, "Asset archive path cannot be empty"),
-  mimeType: z4.string().min(1, "MIME type cannot be empty"),
-  size: z4.number().nonnegative("Asset size must be non-negative"),
-  checksum: z4.string().optional()
+import { z as z5 } from "zod";
+var ManifestAssetItemSchema = z5.object({
+  id: z5.string().min(1, "Asset ID cannot be empty"),
+  path: z5.string().min(1, "Asset archive path cannot be empty"),
+  mimeType: z5.string().min(1, "MIME type cannot be empty"),
+  size: z5.number().nonnegative("Asset size must be non-negative"),
+  checksum: z5.string().optional()
 });
-var ManifestSchema = z4.object({
-  schema: z4.literal(SCHEMA_NAME).default(SCHEMA_NAME),
-  schemaVersion: z4.string().min(1, "Schema version cannot be empty").default("1.0.0"),
-  packageVersion: z4.string().min(1, "Package version cannot be empty").default("1.0.0"),
-  builderCompatibility: z4.string().default(">=0.1.0"),
-  requiredComponents: z4.array(z4.string()).default([]),
-  requiredCapabilities: z4.array(z4.string()).default([]),
-  assets: z4.array(ManifestAssetItemSchema).default([]),
-  createdAt: z4.string().optional()
+var ManifestSchema = z5.object({
+  schema: z5.literal(SCHEMA_NAME).default(SCHEMA_NAME),
+  schemaVersion: z5.string().min(1, "Schema version cannot be empty").default("1.0.0"),
+  packageVersion: z5.string().min(1, "Package version cannot be empty").default("1.0.0"),
+  builderCompatibility: z5.string().default(">=0.1.0"),
+  requiredComponents: z5.array(z5.string()).default([]),
+  requiredCapabilities: z5.array(z5.string()).default([]),
+  assets: z5.array(ManifestAssetItemSchema).default([]),
+  createdAt: z5.string().optional()
 });
 function isManifest(value) {
   return ManifestSchema.safeParse(value).success;
 }
 
 // src/template.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 var DANGEROUS_URI_PATTERN = /^(javascript:|vbscript:|data:(?!image\/))|<script/i;
 function isSafeThumbnailUrl(url) {
   if (!url || typeof url !== "string") return false;
@@ -537,49 +758,49 @@ function isSafeThumbnailUrl(url) {
   if (DANGEROUS_URI_PATTERN.test(trimmed)) return false;
   return true;
 }
-var SafeThumbnailUrlSchema = z5.string().min(1, "Thumbnail URL cannot be empty").refine(
+var SafeThumbnailUrlSchema = z6.string().min(1, "Thumbnail URL cannot be empty").refine(
   (url) => isSafeThumbnailUrl(url),
   { message: "Thumbnail URL contains an unsafe protocol or payload" }
 );
-var SafeThumbnailObjectSchema = z5.object({
+var SafeThumbnailObjectSchema = z6.object({
   url: SafeThumbnailUrlSchema,
-  alt: z5.string().optional(),
-  width: z5.number().positive().optional(),
-  height: z5.number().positive().optional()
+  alt: z6.string().optional(),
+  width: z6.number().positive().optional(),
+  height: z6.number().positive().optional()
 });
-var SafeThumbnailSchema = z5.union([
+var SafeThumbnailSchema = z6.union([
   AssetReferenceSchema,
   SafeThumbnailObjectSchema,
   SafeThumbnailUrlSchema
 ]);
-var TemplatePackageRefSchema = z5.object({
-  path: z5.string().optional(),
+var TemplatePackageRefSchema = z6.object({
+  path: z6.string().optional(),
   url: SafeThumbnailUrlSchema.optional(),
-  checksum: z5.string().optional(),
-  format: z5.enum(["stora", "json"]).default("stora")
+  checksum: z6.string().optional(),
+  format: z6.enum(["stora", "json"]).default("stora")
 });
-var TemplateRequirementsSchema = z5.object({
-  requiredComponents: z5.array(z5.string()).default([]),
-  requiredCapabilities: z5.array(z5.string()).default([])
+var TemplateRequirementsSchema = z6.object({
+  requiredComponents: z6.array(z6.string()).default([]),
+  requiredCapabilities: z6.array(z6.string()).default([])
 });
-var TemplateRecordSchema = z5.object({
-  id: z5.string().min(1, "Template ID must be a non-empty string"),
-  name: z5.string().min(1, "Template name must be a non-empty string"),
-  description: z5.string().optional().default(""),
-  category: z5.string().optional().default("general"),
-  tags: z5.array(z5.string()).optional().default([]),
+var TemplateRecordSchema = z6.object({
+  id: z6.string().min(1, "Template ID must be a non-empty string"),
+  name: z6.string().min(1, "Template name must be a non-empty string"),
+  description: z6.string().optional().default(""),
+  category: z6.string().optional().default("general"),
+  tags: z6.array(z6.string()).optional().default([]),
   thumbnail: SafeThumbnailSchema.optional(),
-  author: z5.string().optional().default(""),
-  version: z5.string().optional().default("1.0.0"),
+  author: z6.string().optional().default(""),
+  version: z6.string().optional().default("1.0.0"),
   document: PageDocumentSchema.optional(),
   packageReference: TemplatePackageRefSchema.optional(),
   requirements: TemplateRequirementsSchema.default({
     requiredComponents: [],
     requiredCapabilities: []
   }),
-  createdAt: z5.string().optional(),
-  updatedAt: z5.string().optional(),
-  custom: z5.record(z5.string(), z5.unknown()).optional()
+  createdAt: z6.string().optional(),
+  updatedAt: z6.string().optional(),
+  custom: z6.record(z6.string(), z6.unknown()).optional()
 });
 function isTemplateRecord(value) {
   return TemplateRecordSchema.safeParse(value).success;
@@ -591,7 +812,7 @@ function isSafeThumbnail(value) {
 // src/fixtures/starter-page.json
 var starter_page_default = {
   schema: "stora.page",
-  version: "1.0.0",
+  version: "1.1.0",
   metadata: {
     title: "Welcome to KUBUILD",
     description: "A starter template built with KUBUILD portable web builder",
@@ -750,6 +971,7 @@ var starter_page_default = {
 var starterPageFixture = starter_page_default;
 
 // src/json-schema.ts
+import { z as z7 } from "zod";
 var PAGE_DOCUMENT_JSON_SCHEMA_V1 = {
   $schema: "http://json-schema.org/draft-07/schema#",
   $id: "https://schema.stora.page/v1/page.json",
@@ -768,16 +990,84 @@ var PAGE_DOCUMENT_JSON_SCHEMA_V1 = {
       type: "string",
       pattern: "^\\d+(\\.\\d+)*$",
       description: "Schema version of the document",
-      default: "1.0.0"
+      default: "1.1.0"
     },
     metadata: {
       $ref: "#/definitions/documentMetadata"
     },
     document: {
       $ref: "#/definitions/rootPageNode"
+    },
+    tracking: {
+      $ref: "#/definitions/trackingConfig"
     }
   },
   definitions: {
+    trackingConfig: {
+      type: "object",
+      description: "Tracking configuration. Contains only public ids, flags and opaque credential ids \u2014 secrets are host-owned.",
+      properties: {
+        enabled: { type: "boolean", default: true },
+        debugMode: { type: "boolean", default: false },
+        autoPageView: { type: "boolean", default: true },
+        defaultDelivery: { type: "string", enum: ["both", "client_only", "server_only"], default: "both" },
+        providers: {
+          type: "object",
+          properties: {
+            meta: {
+              type: "object",
+              properties: {
+                enabled: { type: "boolean" },
+                credentialId: { type: "string" },
+                pixelId: { type: "string" },
+                capiEnabled: { type: "boolean" },
+                testEventCode: { type: "string" }
+              },
+              additionalProperties: false
+            },
+            google: {
+              type: "object",
+              properties: {
+                enabled: { type: "boolean" },
+                credentialId: { type: "string" },
+                measurementId: { type: "string" }
+              },
+              additionalProperties: false
+            },
+            gtm: {
+              type: "object",
+              properties: {
+                enabled: { type: "boolean" },
+                credentialId: { type: "string" },
+                containerId: { type: "string" }
+              },
+              additionalProperties: false
+            },
+            tiktok: {
+              type: "object",
+              properties: {
+                enabled: { type: "boolean" },
+                credentialId: { type: "string" },
+                pixelId: { type: "string" },
+                eventsApiEnabled: { type: "boolean" },
+                testEventCode: { type: "string" }
+              },
+              additionalProperties: false
+            },
+            custom: {
+              type: "object",
+              properties: {
+                enabled: { type: "boolean" },
+                credentialId: { type: "string" }
+              },
+              additionalProperties: false
+            }
+          },
+          additionalProperties: false
+        }
+      },
+      additionalProperties: false
+    },
     styleValue: {
       type: ["string", "number", "boolean", "null"],
       description: "A CSS property or design token value"
@@ -917,8 +1207,10 @@ var PAGE_DOCUMENT_JSON_SCHEMA_V1 = {
             "show_toast",
             "open_modal",
             "close_modal",
+            "toggle_modal",
             "copy_clipboard",
-            "custom_event"
+            "custom_event",
+            "track_event"
           ]
         },
         label: { type: "string" },
@@ -1439,8 +1731,10 @@ var ACTION_PIPELINE_JSON_SCHEMA_V1 = {
             "show_toast",
             "open_modal",
             "close_modal",
+            "toggle_modal",
             "copy_clipboard",
-            "custom_event"
+            "custom_event",
+            "track_event"
           ]
         },
         label: { type: "string" },
@@ -1607,6 +1901,48 @@ var FORM_FIELD_BINDING_JSON_SCHEMA_V1 = {
 function getFormFieldBindingJsonSchema() {
   return FORM_FIELD_BINDING_JSON_SCHEMA_V1;
 }
+function toDraft7(schema, id, title, io) {
+  return {
+    ...z7.toJSONSchema(schema, { target: "draft-7", io }),
+    $id: id,
+    title
+  };
+}
+var trackingRelayRequestJsonSchema;
+var trackingRelayResponseJsonSchema;
+var trackingProviderSecretsJsonSchema;
+function getTrackingRelayRequestJsonSchema() {
+  trackingRelayRequestJsonSchema ??= toDraft7(
+    TrackingRelayRequestSchema,
+    "https://schema.stora.page/v1/tracking-relay-request.json",
+    "StoraTrackingRelayRequest",
+    "input"
+  );
+  return trackingRelayRequestJsonSchema;
+}
+function getTrackingRelayResponseJsonSchema() {
+  trackingRelayResponseJsonSchema ??= toDraft7(
+    TrackingRelayResponseSchema,
+    "https://schema.stora.page/v1/tracking-relay-response.json",
+    "StoraTrackingRelayResponse",
+    "output"
+  );
+  return trackingRelayResponseJsonSchema;
+}
+function getTrackingProviderSecretsJsonSchema() {
+  trackingProviderSecretsJsonSchema ??= toDraft7(
+    z7.object({
+      meta: MetaTrackingSecretsSchema.optional(),
+      google: GoogleTrackingSecretsSchema.optional(),
+      tiktok: TikTokTrackingSecretsSchema.optional(),
+      custom: CustomTrackingSecretsSchema.optional()
+    }),
+    "https://schema.stora.page/v1/tracking-provider-secrets.json",
+    "StoraTrackingProviderSecrets",
+    "input"
+  );
+  return trackingProviderSecretsJsonSchema;
+}
 export {
   ACTION_PIPELINE_JSON_SCHEMA_V1,
   ARTBOARD_REFERENCE_NODE_TYPE,
@@ -1628,15 +1964,23 @@ export {
   ConditionOperatorSchema,
   CopyClipboardStepPayloadSchema,
   CustomEventStepPayloadSchema,
+  CustomTrackingProviderConfigSchema,
+  CustomTrackingSecretsSchema,
   DEFAULT_ANIMATION_CONFIG,
   DocumentMetadataSchema,
   FORM_CONFIG_JSON_SCHEMA_V1,
   FORM_FIELD_BINDING_JSON_SCHEMA_V1,
   FormConfigSchema,
   FormFieldBindingSchema,
+  GoogleTrackingProviderConfigSchema,
+  GoogleTrackingSecretsSchema,
+  GtmTrackingProviderConfigSchema,
+  LEGACY_TRACKING_SECRET_KEYS,
   MANIFEST_JSON_SCHEMA_V1,
   ManifestAssetItemSchema,
   ManifestSchema,
+  MetaTrackingProviderConfigSchema,
+  MetaTrackingSecretsSchema,
   NavigateStepPayloadSchema,
   NodeSchema,
   OpenModalStepPayloadSchema,
@@ -1652,15 +1996,30 @@ export {
   SafeThumbnailObjectSchema,
   SafeThumbnailSchema,
   SafeThumbnailUrlSchema,
+  ServerTrackingEventSchema,
   SetStateStepPayloadSchema,
   ShowToastStepPayloadSchema,
+  StandardTrackingEventSchema,
   StepPayloadSchemas,
   StyleDefinitionSchema,
   StyleValueSchema,
   TEMPLATE_RECORD_JSON_SCHEMA_V1,
+  TRACKING_RELAY_PROTOCOL_VERSION,
   TemplatePackageRefSchema,
   TemplateRecordSchema,
   TemplateRequirementsSchema,
+  TikTokTrackingProviderConfigSchema,
+  TikTokTrackingSecretsSchema,
+  ToggleModalStepPayloadSchema,
+  TrackEventProviderSchema,
+  TrackEventStepPayloadSchema,
+  TrackingConfigSchema,
+  TrackingDeliverySchema,
+  TrackingProviderTypeSchema,
+  TrackingRelayErrorCodeSchema,
+  TrackingRelayProviderResultSchema,
+  TrackingRelayRequestSchema,
+  TrackingRelayResponseSchema,
   ValidateOnEventSchema,
   ValidationRuleSchema,
   ValidationRuleTypeSchema,
@@ -1673,6 +2032,9 @@ export {
   getManifestJsonSchema,
   getPageDocumentJsonSchema,
   getTemplateRecordJsonSchema,
+  getTrackingProviderSecretsJsonSchema,
+  getTrackingRelayRequestJsonSchema,
+  getTrackingRelayResponseJsonSchema,
   isActionBinding,
   isActionPipeline,
   isActionStep,
@@ -1691,6 +2053,9 @@ export {
   isSafeThumbnail,
   isSafeThumbnailUrl,
   isTemplateRecord,
+  isTrackEventStepPayload,
+  isTrackingConfig,
+  isTrackingRelayRequest,
   isValidateOnEvent,
   isValidationRule,
   isValidationRuleType,