@kubuild/schema 0.6.0 → 0.7.0

package/dist/index.js

@@ -16,69 +16,51 @@ var TrackingProviderTypeSchema = z.enum([
 var TrackingDeliverySchema = z.enum(["both", "client_only", "server_only"]);
 var MetaTrackingProviderConfigSchema = z.object({
   enabled: z.boolean().default(true),
-  /** Optional linked account/workspace credential ID */
+  /** Host credential id; the server resolves the CAPI access token from it. */
   credentialId: z.string().optional(),
-  /** Meta Pixel ID (e.g. 123456789012345) */
+  /** Meta Pixel ID (e.g. 123456789012345) — public */
   pixelId: z.string().optional().default(""),
-  /** Enable Server-Side Conversions API */
+  /** Enable Server-Side Conversions API (delivered through the host relay) */
   capiEnabled: z.boolean().optional().default(false),
-  /**
-   * System User Access Token for Meta Graph API.
-   * Note: For security in production, prefer configuring tokens on your server backend
-   * or proxying via `serverRelayUrl`.
-   */
-  capiAccessToken: z.string().optional().default(""),
-  /** Test Event Code from Meta Events Manager (e.g. "TEST12345") */
-  testEventCode: z.string().optional().default(""),
-  /**
-   * Host Server Relay URL (e.g. "/api/tracking/meta").
-   * Recommended for browser clients to post CAPI events safely without exposing the secret token.
-   */
-  serverRelayUrl: z.string().optional().default("")
+  /** Test Event Code from Meta Events Manager (e.g. "TEST12345") — not a secret */
+  testEventCode: z.string().optional().default("")
 });
 var GoogleTrackingProviderConfigSchema = z.object({
   enabled: z.boolean().default(true),
-  /** Optional linked account/workspace credential ID */
+  /** Host credential id; the server resolves the Measurement Protocol API secret from it. */
   credentialId: z.string().optional(),
-  /** GA4 Measurement ID (e.g. "G-XXXXXXXXXX") */
-  measurementId: z.string().optional().default(""),
-  /** GA4 Measurement Protocol API Secret (for server-side events) */
-  measurementProtocolSecret: z.string().optional().default(""),
-  /** Host Server Relay URL (e.g. "/api/tracking/ga4") */
-  serverRelayUrl: z.string().optional().default("")
+  /** GA4 Measurement ID (e.g. "G-XXXXXXXXXX") — public */
+  measurementId: z.string().optional().default("")
 });
 var GtmTrackingProviderConfigSchema = z.object({
   enabled: z.boolean().default(true),
   /** Optional linked account/workspace credential ID */
   credentialId: z.string().optional(),
-  /** GTM Container ID (e.g. "GTM-XXXXXXX") */
-  containerId: z.string().optional().default(""),
-  /** Host Server Relay URL */
-  serverRelayUrl: z.string().optional().default("")
+  /** GTM Container ID (e.g. "GTM-XXXXXXX") — public */
+  containerId: z.string().optional().default("")
 });
 var TikTokTrackingProviderConfigSchema = z.object({
   enabled: z.boolean().default(true),
-  /** Optional linked account/workspace credential ID */
+  /** Host credential id; the server resolves the Events API access token from it. */
   credentialId: z.string().optional(),
-  /** TikTok Pixel ID (e.g. "C1234567890") */
+  /** TikTok Pixel ID (e.g. "C1234567890") — public */
   pixelId: z.string().optional().default(""),
-  /** Enable TikTok Events API (server-side) */
+  /** Enable TikTok Events API (server-side, delivered through the host relay) */
   eventsApiEnabled: z.boolean().optional().default(false),
-  /** Long-term Access Token for TikTok Events API */
-  accessToken: z.string().optional().default(""),
-  /** Test Event Code from TikTok Event Manager */
-  testEventCode: z.string().optional().default(""),
-  /** Host Server Relay URL (e.g. "/api/tracking/tiktok") */
-  serverRelayUrl: z.string().optional().default("")
+  /** Test Event Code from TikTok Event Manager — not a secret */
+  testEventCode: z.string().optional().default("")
 });
 var CustomTrackingProviderConfigSchema = z.object({
   enabled: z.boolean().default(true),
-  /** Optional linked account/workspace credential ID */
-  credentialId: z.string().optional(),
-  /** Custom Webhook endpoint URL */
-  endpointUrl: z.string().optional().default(""),
-  /** Optional headers sent with the webhook POST request */
-  headers: z.record(z.string(), z.string()).optional().default({})
+  /** Host credential id; the server resolves the webhook `endpointUrl` + `headers` from it. */
+  credentialId: z.string().optional()
+});
+var LEGACY_TRACKING_SECRET_KEYS = Object.freeze({
+  meta: ["capiAccessToken", "serverRelayUrl"],
+  google: ["measurementProtocolSecret", "serverRelayUrl"],
+  gtm: ["serverRelayUrl"],
+  tiktok: ["accessToken", "serverRelayUrl"],
+  custom: ["endpointUrl", "headers"]
 });
 var TrackingConfigSchema = z.object({
   /** Master toggle: dynamically enables or disables all tracking operations */
@@ -98,6 +80,22 @@ var TrackingConfigSchema = z.object({
     custom: CustomTrackingProviderConfigSchema.optional()
   }).optional().default({})
 });
+var MetaTrackingSecretsSchema = z.object({
+  /** System User access token for the Meta Graph API. */
+  capiAccessToken: z.string().min(1)
+});
+var GoogleTrackingSecretsSchema = z.object({
+  /** Measurement Protocol `api_secret`. */
+  measurementProtocolSecret: z.string().min(1)
+});
+var TikTokTrackingSecretsSchema = z.object({
+  /** Long-term Events API access token. */
+  accessToken: z.string().min(1)
+});
+var CustomTrackingSecretsSchema = z.object({
+  endpointUrl: z.string().url(),
+  headers: z.record(z.string(), z.string()).optional()
+});
 var StandardTrackingEventSchema = z.enum([
   "PageView",
   "ViewContent",
@@ -112,13 +110,17 @@ var StandardTrackingEventSchema = z.enum([
   "SubmitApplication",
   "Schedule"
 ]);
+var TrackEventProviderSchema = z.enum(["all", "meta", "google", "gtm", "tiktok", "custom"]);
 var TrackEventStepPayloadSchema = z.object({
   /** Event name: e.g. "Purchase", "Lead", or custom string */
   eventName: z.string().min(1, "Event name cannot be empty"),
   /** Standard event vs custom event identifier */
   eventType: z.enum(["standard", "custom"]).optional().default("standard"),
-  /** Target provider: 'all' or a specific provider */
-  provider: z.enum(["all", "meta", "google", "tiktok", "custom"]).optional().default("all"),
+  /**
+   * Target provider: 'all' or a specific provider.
+   * 'gtm' pushes the event to `window.dataLayer` (client-side only).
+   */
+  provider: TrackEventProviderSchema.optional().default("all"),
   /** Delivery channel: 'both', 'client_only', or 'server_only' */
   delivery: TrackingDeliverySchema.optional().default("both"),
   /**
@@ -140,12 +142,66 @@ var TrackEventStepPayloadSchema = z.object({
   /** Step-level active toggle */
   enabled: z.boolean().optional().default(true)
 });
+var TRACKING_RELAY_PROTOCOL_VERSION = 1;
+var ServerTrackingEventSchema = z.object({
+  eventName: z.string().min(1).max(256),
+  eventType: z.enum(["standard", "custom"]).optional(),
+  eventId: z.string().max(256).optional(),
+  /** Unix epoch seconds. */
+  eventTime: z.number().int().nonnegative().optional(),
+  eventSourceUrl: z.string().max(4096).optional(),
+  actionSource: z.enum(["website", "app", "system_generated"]).optional(),
+  params: z.record(z.string(), z.unknown()).optional(),
+  /** Raw (unhashed) user data; the relay hashes PII per provider spec before forwarding. */
+  userData: z.record(z.string(), z.unknown()).optional(),
+  customData: z.record(z.string(), z.unknown()).optional()
+});
+var TrackingRelayRequestSchema = z.object({
+  version: z.literal(TRACKING_RELAY_PROTOCOL_VERSION),
+  event: ServerTrackingEventSchema,
+  provider: TrackEventProviderSchema.optional().default("all"),
+  /** Optional hint only; the relay uses the credentialId from its trusted config. */
+  credentialId: z.string().max(256).optional(),
+  /** Host document/page id so the relay can look up the trusted tracking config. */
+  documentId: z.string().max(256).optional()
+});
+var TrackingRelayProviderResultSchema = z.object({
+  provider: z.string(),
+  success: z.boolean(),
+  status: z.number().int().optional(),
+  skipped: z.boolean().optional(),
+  reason: z.string().optional(),
+  error: z.string().optional()
+});
+var TrackingRelayErrorCodeSchema = z.enum([
+  "INVALID_REQUEST",
+  "UNSUPPORTED_VERSION",
+  "FORBIDDEN_ORIGIN",
+  "METHOD_NOT_ALLOWED",
+  "CONFIG_NOT_FOUND",
+  "INTERNAL_ERROR"
+]);
+var TrackingRelayResponseSchema = z.object({
+  version: z.literal(TRACKING_RELAY_PROTOCOL_VERSION),
+  success: z.boolean(),
+  eventId: z.string().optional(),
+  skipped: z.boolean().optional(),
+  reason: z.string().optional(),
+  results: z.record(z.string(), TrackingRelayProviderResultSchema).optional(),
+  error: z.object({
+    code: TrackingRelayErrorCodeSchema,
+    message: z.string()
+  }).optional()
+});
 function isTrackingConfig(value) {
   return TrackingConfigSchema.safeParse(value).success;
 }
 function isTrackEventStepPayload(value) {
   return TrackEventStepPayloadSchema.safeParse(value).success;
 }
+function isTrackingRelayRequest(value) {
+  return TrackingRelayRequestSchema.safeParse(value).success;
+}
 
 // src/actions.ts
 var ActionTriggerTypeSchema = z2.enum([
@@ -165,6 +221,7 @@ var ActionStepTypeSchema = z2.enum([
   "show_toast",
   "open_modal",
   "close_modal",
+  "toggle_modal",
   "copy_clipboard",
   "custom_event",
   "track_event"
@@ -247,6 +304,19 @@ var CloseModalStepPayloadSchema = z2.object({
   modalId: z2.string().optional(),
   modalNodeId: z2.string().optional()
 });
+var ToggleModalStepPayloadSchema = z2.object({
+  modalId: z2.string().optional(),
+  modalNodeId: z2.string().optional(),
+  targetNodeId: z2.string().optional(),
+  nodeId: z2.string().optional()
+}).refine(
+  (data) => [data.modalId, data.modalNodeId, data.targetNodeId, data.nodeId].some(
+    (id) => typeof id === "string" && id.trim().length > 0
+  ),
+  {
+    message: "Modal ID or Modal Node ID cannot be empty"
+  }
+);
 var CopyClipboardStepPayloadSchema = z2.object({
   text: z2.string().optional(),
   value: z2.unknown().optional(),
@@ -267,6 +337,7 @@ var StepPayloadSchemas = {
   show_toast: ShowToastStepPayloadSchema,
   open_modal: OpenModalStepPayloadSchema,
   close_modal: CloseModalStepPayloadSchema,
+  toggle_modal: ToggleModalStepPayloadSchema,
   copy_clipboard: CopyClipboardStepPayloadSchema,
   custom_event: CustomEventStepPayloadSchema,
   track_event: TrackEventStepPayloadSchema
@@ -461,7 +532,7 @@ function isFormConfig(value) {
 
 // src/document.ts
 var SCHEMA_NAME = "stora.page";
-var CURRENT_SCHEMA_VERSION = "1.0.0";
+var CURRENT_SCHEMA_VERSION = "1.1.0";
 var AssetReferenceSchema = z4.object({
   type: z4.literal("asset"),
   assetId: z4.string().min(1, "Asset ID cannot be empty"),
@@ -741,7 +812,7 @@ function isSafeThumbnail(value) {
 // src/fixtures/starter-page.json
 var starter_page_default = {
   schema: "stora.page",
-  version: "1.0.0",
+  version: "1.1.0",
   metadata: {
     title: "Welcome to KUBUILD",
     description: "A starter template built with KUBUILD portable web builder",
@@ -900,6 +971,7 @@ var starter_page_default = {
 var starterPageFixture = starter_page_default;
 
 // src/json-schema.ts
+import { z as z7 } from "zod";
 var PAGE_DOCUMENT_JSON_SCHEMA_V1 = {
   $schema: "http://json-schema.org/draft-07/schema#",
   $id: "https://schema.stora.page/v1/page.json",
@@ -918,16 +990,84 @@ var PAGE_DOCUMENT_JSON_SCHEMA_V1 = {
       type: "string",
       pattern: "^\\d+(\\.\\d+)*$",
       description: "Schema version of the document",
-      default: "1.0.0"
+      default: "1.1.0"
     },
     metadata: {
       $ref: "#/definitions/documentMetadata"
     },
     document: {
       $ref: "#/definitions/rootPageNode"
+    },
+    tracking: {
+      $ref: "#/definitions/trackingConfig"
     }
   },
   definitions: {
+    trackingConfig: {
+      type: "object",
+      description: "Tracking configuration. Contains only public ids, flags and opaque credential ids \u2014 secrets are host-owned.",
+      properties: {
+        enabled: { type: "boolean", default: true },
+        debugMode: { type: "boolean", default: false },
+        autoPageView: { type: "boolean", default: true },
+        defaultDelivery: { type: "string", enum: ["both", "client_only", "server_only"], default: "both" },
+        providers: {
+          type: "object",
+          properties: {
+            meta: {
+              type: "object",
+              properties: {
+                enabled: { type: "boolean" },
+                credentialId: { type: "string" },
+                pixelId: { type: "string" },
+                capiEnabled: { type: "boolean" },
+                testEventCode: { type: "string" }
+              },
+              additionalProperties: false
+            },
+            google: {
+              type: "object",
+              properties: {
+                enabled: { type: "boolean" },
+                credentialId: { type: "string" },
+                measurementId: { type: "string" }
+              },
+              additionalProperties: false
+            },
+            gtm: {
+              type: "object",
+              properties: {
+                enabled: { type: "boolean" },
+                credentialId: { type: "string" },
+                containerId: { type: "string" }
+              },
+              additionalProperties: false
+            },
+            tiktok: {
+              type: "object",
+              properties: {
+                enabled: { type: "boolean" },
+                credentialId: { type: "string" },
+                pixelId: { type: "string" },
+                eventsApiEnabled: { type: "boolean" },
+                testEventCode: { type: "string" }
+              },
+              additionalProperties: false
+            },
+            custom: {
+              type: "object",
+              properties: {
+                enabled: { type: "boolean" },
+                credentialId: { type: "string" }
+              },
+              additionalProperties: false
+            }
+          },
+          additionalProperties: false
+        }
+      },
+      additionalProperties: false
+    },
     styleValue: {
       type: ["string", "number", "boolean", "null"],
       description: "A CSS property or design token value"
@@ -1067,8 +1207,10 @@ var PAGE_DOCUMENT_JSON_SCHEMA_V1 = {
             "show_toast",
             "open_modal",
             "close_modal",
+            "toggle_modal",
             "copy_clipboard",
-            "custom_event"
+            "custom_event",
+            "track_event"
           ]
         },
         label: { type: "string" },
@@ -1589,8 +1731,10 @@ var ACTION_PIPELINE_JSON_SCHEMA_V1 = {
             "show_toast",
             "open_modal",
             "close_modal",
+            "toggle_modal",
             "copy_clipboard",
-            "custom_event"
+            "custom_event",
+            "track_event"
           ]
         },
         label: { type: "string" },
@@ -1757,6 +1901,48 @@ var FORM_FIELD_BINDING_JSON_SCHEMA_V1 = {
 function getFormFieldBindingJsonSchema() {
   return FORM_FIELD_BINDING_JSON_SCHEMA_V1;
 }
+function toDraft7(schema, id, title, io) {
+  return {
+    ...z7.toJSONSchema(schema, { target: "draft-7", io }),
+    $id: id,
+    title
+  };
+}
+var trackingRelayRequestJsonSchema;
+var trackingRelayResponseJsonSchema;
+var trackingProviderSecretsJsonSchema;
+function getTrackingRelayRequestJsonSchema() {
+  trackingRelayRequestJsonSchema ??= toDraft7(
+    TrackingRelayRequestSchema,
+    "https://schema.stora.page/v1/tracking-relay-request.json",
+    "StoraTrackingRelayRequest",
+    "input"
+  );
+  return trackingRelayRequestJsonSchema;
+}
+function getTrackingRelayResponseJsonSchema() {
+  trackingRelayResponseJsonSchema ??= toDraft7(
+    TrackingRelayResponseSchema,
+    "https://schema.stora.page/v1/tracking-relay-response.json",
+    "StoraTrackingRelayResponse",
+    "output"
+  );
+  return trackingRelayResponseJsonSchema;
+}
+function getTrackingProviderSecretsJsonSchema() {
+  trackingProviderSecretsJsonSchema ??= toDraft7(
+    z7.object({
+      meta: MetaTrackingSecretsSchema.optional(),
+      google: GoogleTrackingSecretsSchema.optional(),
+      tiktok: TikTokTrackingSecretsSchema.optional(),
+      custom: CustomTrackingSecretsSchema.optional()
+    }),
+    "https://schema.stora.page/v1/tracking-provider-secrets.json",
+    "StoraTrackingProviderSecrets",
+    "input"
+  );
+  return trackingProviderSecretsJsonSchema;
+}
 export {
   ACTION_PIPELINE_JSON_SCHEMA_V1,
   ARTBOARD_REFERENCE_NODE_TYPE,
@@ -1779,6 +1965,7 @@ export {
   CopyClipboardStepPayloadSchema,
   CustomEventStepPayloadSchema,
   CustomTrackingProviderConfigSchema,
+  CustomTrackingSecretsSchema,
   DEFAULT_ANIMATION_CONFIG,
   DocumentMetadataSchema,
   FORM_CONFIG_JSON_SCHEMA_V1,
@@ -1786,11 +1973,14 @@ export {
   FormConfigSchema,
   FormFieldBindingSchema,
   GoogleTrackingProviderConfigSchema,
+  GoogleTrackingSecretsSchema,
   GtmTrackingProviderConfigSchema,
+  LEGACY_TRACKING_SECRET_KEYS,
   MANIFEST_JSON_SCHEMA_V1,
   ManifestAssetItemSchema,
   ManifestSchema,
   MetaTrackingProviderConfigSchema,
+  MetaTrackingSecretsSchema,
   NavigateStepPayloadSchema,
   NodeSchema,
   OpenModalStepPayloadSchema,
@@ -1806,6 +1996,7 @@ export {
   SafeThumbnailObjectSchema,
   SafeThumbnailSchema,
   SafeThumbnailUrlSchema,
+  ServerTrackingEventSchema,
   SetStateStepPayloadSchema,
   ShowToastStepPayloadSchema,
   StandardTrackingEventSchema,
@@ -1813,14 +2004,22 @@ export {
   StyleDefinitionSchema,
   StyleValueSchema,
   TEMPLATE_RECORD_JSON_SCHEMA_V1,
+  TRACKING_RELAY_PROTOCOL_VERSION,
   TemplatePackageRefSchema,
   TemplateRecordSchema,
   TemplateRequirementsSchema,
   TikTokTrackingProviderConfigSchema,
+  TikTokTrackingSecretsSchema,
+  ToggleModalStepPayloadSchema,
+  TrackEventProviderSchema,
   TrackEventStepPayloadSchema,
   TrackingConfigSchema,
   TrackingDeliverySchema,
   TrackingProviderTypeSchema,
+  TrackingRelayErrorCodeSchema,
+  TrackingRelayProviderResultSchema,
+  TrackingRelayRequestSchema,
+  TrackingRelayResponseSchema,
   ValidateOnEventSchema,
   ValidationRuleSchema,
   ValidationRuleTypeSchema,
@@ -1833,6 +2032,9 @@ export {
   getManifestJsonSchema,
   getPageDocumentJsonSchema,
   getTemplateRecordJsonSchema,
+  getTrackingProviderSecretsJsonSchema,
+  getTrackingRelayRequestJsonSchema,
+  getTrackingRelayResponseJsonSchema,
   isActionBinding,
   isActionPipeline,
   isActionStep,
@@ -1853,6 +2055,7 @@ export {
   isTemplateRecord,
   isTrackEventStepPayload,
   isTrackingConfig,
+  isTrackingRelayRequest,
   isValidateOnEvent,
   isValidationRule,
   isValidationRuleType,