@kubuild/schema 0.7.0 → 0.8.0

package/dist/validate.cjs

@@ -0,0 +1,715 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/validate.ts
+var validate_exports = {};
+__export(validate_exports, {
+  isValidPageDocument: () => isValidPageDocument,
+  validateDocument: () => validateDocument,
+  validateManifest: () => validateManifest,
+  validateNode: () => validateNode,
+  validateProjectDocument: () => validateProjectDocument,
+  validateTemplateRecord: () => validateTemplateRecord,
+  validateTheme: () => validateTheme
+});
+module.exports = __toCommonJS(validate_exports);
+
+// src/document.ts
+var import_zod5 = require("zod");
+
+// src/actions.ts
+var import_zod2 = require("zod");
+
+// src/tracking.ts
+var import_zod = require("zod");
+var TrackingProviderTypeSchema = import_zod.z.enum([
+  "meta",
+  "google",
+  "gtm",
+  "tiktok",
+  "custom"
+]);
+var TrackingDeliverySchema = import_zod.z.enum(["both", "client_only", "server_only"]);
+var MetaTrackingProviderConfigSchema = import_zod.z.object({
+  enabled: import_zod.z.boolean().default(true),
+  /** Host credential id; the server resolves the CAPI access token from it. */
+  credentialId: import_zod.z.string().optional(),
+  /** Meta Pixel ID (e.g. 123456789012345) — public */
+  pixelId: import_zod.z.string().optional().default(""),
+  /** Enable Server-Side Conversions API (delivered through the host relay) */
+  capiEnabled: import_zod.z.boolean().optional().default(false),
+  /** Test Event Code from Meta Events Manager (e.g. "TEST12345") — not a secret */
+  testEventCode: import_zod.z.string().optional().default("")
+});
+var GoogleTrackingProviderConfigSchema = import_zod.z.object({
+  enabled: import_zod.z.boolean().default(true),
+  /** Host credential id; the server resolves the Measurement Protocol API secret from it. */
+  credentialId: import_zod.z.string().optional(),
+  /** GA4 Measurement ID (e.g. "G-XXXXXXXXXX") — public */
+  measurementId: import_zod.z.string().optional().default("")
+});
+var GtmTrackingProviderConfigSchema = import_zod.z.object({
+  enabled: import_zod.z.boolean().default(true),
+  /** Optional linked account/workspace credential ID */
+  credentialId: import_zod.z.string().optional(),
+  /** GTM Container ID (e.g. "GTM-XXXXXXX") — public */
+  containerId: import_zod.z.string().optional().default("")
+});
+var TikTokTrackingProviderConfigSchema = import_zod.z.object({
+  enabled: import_zod.z.boolean().default(true),
+  /** Host credential id; the server resolves the Events API access token from it. */
+  credentialId: import_zod.z.string().optional(),
+  /** TikTok Pixel ID (e.g. "C1234567890") — public */
+  pixelId: import_zod.z.string().optional().default(""),
+  /** Enable TikTok Events API (server-side, delivered through the host relay) */
+  eventsApiEnabled: import_zod.z.boolean().optional().default(false),
+  /** Test Event Code from TikTok Event Manager — not a secret */
+  testEventCode: import_zod.z.string().optional().default("")
+});
+var CustomTrackingProviderConfigSchema = import_zod.z.object({
+  enabled: import_zod.z.boolean().default(true),
+  /** Host credential id; the server resolves the webhook `endpointUrl` + `headers` from it. */
+  credentialId: import_zod.z.string().optional()
+});
+var LEGACY_TRACKING_SECRET_KEYS = Object.freeze({
+  meta: ["capiAccessToken", "serverRelayUrl"],
+  google: ["measurementProtocolSecret", "serverRelayUrl"],
+  gtm: ["serverRelayUrl"],
+  tiktok: ["accessToken", "serverRelayUrl"],
+  custom: ["endpointUrl", "headers"]
+});
+var TrackingConfigSchema = import_zod.z.object({
+  /** Master toggle: dynamically enables or disables all tracking operations */
+  enabled: import_zod.z.boolean().default(true),
+  /** When enabled, events are logged to console and can bypass live API calls for safe debugging */
+  debugMode: import_zod.z.boolean().optional().default(false),
+  /** Automatically trigger PageView event upon page load */
+  autoPageView: import_zod.z.boolean().optional().default(true),
+  /** Default delivery method when not explicitly overridden in an action step */
+  defaultDelivery: TrackingDeliverySchema.optional().default("both"),
+  /** Provider-specific settings */
+  providers: import_zod.z.object({
+    meta: MetaTrackingProviderConfigSchema.optional(),
+    google: GoogleTrackingProviderConfigSchema.optional(),
+    gtm: GtmTrackingProviderConfigSchema.optional(),
+    tiktok: TikTokTrackingProviderConfigSchema.optional(),
+    custom: CustomTrackingProviderConfigSchema.optional()
+  }).optional().default({})
+});
+var MetaTrackingSecretsSchema = import_zod.z.object({
+  /** System User access token for the Meta Graph API. */
+  capiAccessToken: import_zod.z.string().min(1)
+});
+var GoogleTrackingSecretsSchema = import_zod.z.object({
+  /** Measurement Protocol `api_secret`. */
+  measurementProtocolSecret: import_zod.z.string().min(1)
+});
+var TikTokTrackingSecretsSchema = import_zod.z.object({
+  /** Long-term Events API access token. */
+  accessToken: import_zod.z.string().min(1)
+});
+var CustomTrackingSecretsSchema = import_zod.z.object({
+  endpointUrl: import_zod.z.string().url(),
+  headers: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional()
+});
+var StandardTrackingEventSchema = import_zod.z.enum([
+  "PageView",
+  "ViewContent",
+  "AddToCart",
+  "InitiateCheckout",
+  "Purchase",
+  "Lead",
+  "Contact",
+  "CompleteRegistration",
+  "Subscribe",
+  "Search",
+  "SubmitApplication",
+  "Schedule"
+]);
+var TrackEventProviderSchema = import_zod.z.enum(["all", "meta", "google", "gtm", "tiktok", "custom"]);
+var TrackEventStepPayloadSchema = import_zod.z.object({
+  /** Event name: e.g. "Purchase", "Lead", or custom string */
+  eventName: import_zod.z.string().min(1, "Event name cannot be empty"),
+  /** Standard event vs custom event identifier */
+  eventType: import_zod.z.enum(["standard", "custom"]).optional().default("standard"),
+  /**
+   * Target provider: 'all' or a specific provider.
+   * 'gtm' pushes the event to `window.dataLayer` (client-side only).
+   */
+  provider: TrackEventProviderSchema.optional().default("all"),
+  /** Delivery channel: 'both', 'client_only', or 'server_only' */
+  delivery: TrackingDeliverySchema.optional().default("both"),
+  /**
+   * Deduplication Event ID.
+   * If omitted, a unique ID is automatically generated so Meta/TikTok CAPI
+   * deduplicates cleanly with the browser pixel.
+   */
+  eventId: import_zod.z.string().optional(),
+  /**
+   * Event parameters/properties (e.g. currency, value, content_name, order_id).
+   * Supports runtime variable interpolation (e.g. {{ form.price }} or {{ variables.currency }}).
+   */
+  params: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional().default({}),
+  /**
+   * User Data for advanced matching and server CAPI (e.g. email, phone, firstName, lastName).
+   * Supports runtime variable interpolation (e.g. {{ form.email }}).
+   */
+  userData: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional().default({}),
+  /** Step-level active toggle */
+  enabled: import_zod.z.boolean().optional().default(true)
+});
+var TRACKING_RELAY_PROTOCOL_VERSION = 1;
+var ServerTrackingEventSchema = import_zod.z.object({
+  eventName: import_zod.z.string().min(1).max(256),
+  eventType: import_zod.z.enum(["standard", "custom"]).optional(),
+  eventId: import_zod.z.string().max(256).optional(),
+  /** Unix epoch seconds. */
+  eventTime: import_zod.z.number().int().nonnegative().optional(),
+  eventSourceUrl: import_zod.z.string().max(4096).optional(),
+  actionSource: import_zod.z.enum(["website", "app", "system_generated"]).optional(),
+  params: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional(),
+  /** Raw (unhashed) user data; the relay hashes PII per provider spec before forwarding. */
+  userData: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional(),
+  customData: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional()
+});
+var TrackingRelayRequestSchema = import_zod.z.object({
+  version: import_zod.z.literal(TRACKING_RELAY_PROTOCOL_VERSION),
+  event: ServerTrackingEventSchema,
+  provider: TrackEventProviderSchema.optional().default("all"),
+  /** Optional hint only; the relay uses the credentialId from its trusted config. */
+  credentialId: import_zod.z.string().max(256).optional(),
+  /** Host document/page id so the relay can look up the trusted tracking config. */
+  documentId: import_zod.z.string().max(256).optional()
+});
+var TrackingRelayProviderResultSchema = import_zod.z.object({
+  provider: import_zod.z.string(),
+  success: import_zod.z.boolean(),
+  status: import_zod.z.number().int().optional(),
+  skipped: import_zod.z.boolean().optional(),
+  reason: import_zod.z.string().optional(),
+  error: import_zod.z.string().optional()
+});
+var TrackingRelayErrorCodeSchema = import_zod.z.enum([
+  "INVALID_REQUEST",
+  "UNSUPPORTED_VERSION",
+  "FORBIDDEN_ORIGIN",
+  "METHOD_NOT_ALLOWED",
+  "CONFIG_NOT_FOUND",
+  "INTERNAL_ERROR"
+]);
+var TrackingRelayResponseSchema = import_zod.z.object({
+  version: import_zod.z.literal(TRACKING_RELAY_PROTOCOL_VERSION),
+  success: import_zod.z.boolean(),
+  eventId: import_zod.z.string().optional(),
+  skipped: import_zod.z.boolean().optional(),
+  reason: import_zod.z.string().optional(),
+  results: import_zod.z.record(import_zod.z.string(), TrackingRelayProviderResultSchema).optional(),
+  error: import_zod.z.object({
+    code: TrackingRelayErrorCodeSchema,
+    message: import_zod.z.string()
+  }).optional()
+});
+
+// src/actions.ts
+var ActionTriggerTypeSchema = import_zod2.z.enum([
+  "click",
+  "submit",
+  "change",
+  "blur",
+  "focus",
+  "load",
+  // Fired once by time-bound components (e.g. `countdown`) when they reach zero.
+  "expire"
+]);
+var ActionStepTypeSchema = import_zod2.z.enum([
+  "api_request",
+  "navigate",
+  "set_state",
+  "reset_form",
+  "show_toast",
+  "open_modal",
+  "close_modal",
+  "toggle_modal",
+  "copy_clipboard",
+  "custom_event",
+  "track_event"
+]);
+var ConditionOperatorSchema = import_zod2.z.enum([
+  "equals",
+  "not_equals",
+  "contains",
+  "not_contains",
+  "is_truthy",
+  "is_falsy",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "regex"
+]);
+var ActionStepConditionSchema = import_zod2.z.object({
+  field: import_zod2.z.string().min(1, "Condition field cannot be empty"),
+  operator: ConditionOperatorSchema,
+  value: import_zod2.z.unknown().optional()
+});
+var DANGEROUS_URL_PATTERN = /(javascript:|vbscript:|data:text\/html)/i;
+var DANGEROUS_SCRIPT_PATTERN = /<\s*script/i;
+function isSafeActionUrl(url) {
+  if (!url || typeof url !== "string") return false;
+  const trimmed = url.trim();
+  if (DANGEROUS_URL_PATTERN.test(trimmed)) return false;
+  if (DANGEROUS_SCRIPT_PATTERN.test(trimmed)) return false;
+  return true;
+}
+var SafeUrlStringSchema = import_zod2.z.string().min(1, "URL cannot be empty").refine(isSafeActionUrl, {
+  message: "URL contains disallowed or unsafe protocol/script pattern"
+});
+var SafeEventNameSchema = import_zod2.z.string().min(1, "Event name cannot be empty").regex(/^[a-zA-Z0-9_\-:]+$/, {
+  message: "Event name must contain only alphanumeric characters, dashes, colons, or underscores"
+});
+var ApiRequestStepPayloadSchema = import_zod2.z.object({
+  url: SafeUrlStringSchema,
+  method: import_zod2.z.enum(["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]).default("GET"),
+  headers: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.string()).optional(),
+  queryParams: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.union([import_zod2.z.string(), import_zod2.z.number(), import_zod2.z.boolean()])).optional(),
+  /**
+   * Request body. Omitted inside a form `submit` pipeline → the form's values are sent;
+   * `null` → explicitly no body.
+   */
+  body: import_zod2.z.union([import_zod2.z.string(), import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()), import_zod2.z.array(import_zod2.z.unknown())]).nullable().optional(),
+  bodyFormat: import_zod2.z.enum(["json", "form-data", "formData", "urlencoded", "url-encoded", "raw", "text"]).optional(),
+  bodyType: import_zod2.z.enum(["json", "form-data", "formData", "urlencoded", "url-encoded", "raw", "text"]).optional(),
+  timeout: import_zod2.z.number().positive("Timeout must be greater than 0 ms").optional(),
+  responseMapping: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.string()).optional()
+});
+var NavigateStepPayloadSchema = import_zod2.z.object({
+  url: SafeUrlStringSchema,
+  target: import_zod2.z.enum(["_self", "_blank", "_parent", "_top"]).optional().default("_self"),
+  replace: import_zod2.z.boolean().optional(),
+  scroll: import_zod2.z.boolean().optional(),
+  behavior: import_zod2.z.enum(["smooth", "auto"]).optional()
+});
+var SetStateStepPayloadSchema = import_zod2.z.object({
+  key: import_zod2.z.string().min(1, "State key cannot be empty"),
+  value: import_zod2.z.unknown(),
+  scope: import_zod2.z.enum(["runtime", "document", "session", "local"]).optional().default("runtime")
+});
+var ResetFormStepPayloadSchema = import_zod2.z.object({
+  formId: import_zod2.z.string().optional()
+});
+var ShowToastStepPayloadSchema = import_zod2.z.object({
+  message: import_zod2.z.string().min(1, "Toast message cannot be empty"),
+  type: import_zod2.z.enum(["success", "error", "warning", "info"]).optional().default("info"),
+  variant: import_zod2.z.enum(["success", "error", "warning", "info"]).optional(),
+  title: import_zod2.z.string().optional(),
+  duration: import_zod2.z.number().nonnegative("Duration must be >= 0 ms").optional(),
+  position: import_zod2.z.enum(["top-right", "top-left", "bottom-right", "bottom-left", "top-center", "bottom-center"]).optional()
+});
+var OpenModalStepPayloadSchema = import_zod2.z.object({
+  modalId: import_zod2.z.string().optional(),
+  modalNodeId: import_zod2.z.string().optional(),
+  toggle: import_zod2.z.boolean().optional()
+}).refine((data) => Boolean(data.modalId || data.modalNodeId), {
+  message: "Modal ID or Modal Node ID cannot be empty"
+});
+var CloseModalStepPayloadSchema = import_zod2.z.object({
+  modalId: import_zod2.z.string().optional(),
+  modalNodeId: import_zod2.z.string().optional()
+});
+var ToggleModalStepPayloadSchema = import_zod2.z.object({
+  modalId: import_zod2.z.string().optional(),
+  modalNodeId: import_zod2.z.string().optional(),
+  targetNodeId: import_zod2.z.string().optional(),
+  nodeId: import_zod2.z.string().optional()
+}).refine(
+  (data) => [data.modalId, data.modalNodeId, data.targetNodeId, data.nodeId].some(
+    (id) => typeof id === "string" && id.trim().length > 0
+  ),
+  {
+    message: "Modal ID or Modal Node ID cannot be empty"
+  }
+);
+var CopyClipboardStepPayloadSchema = import_zod2.z.object({
+  text: import_zod2.z.string().optional(),
+  value: import_zod2.z.unknown().optional(),
+  notify: import_zod2.z.boolean().optional(),
+  toastMessage: import_zod2.z.string().optional()
+});
+var CustomEventStepPayloadSchema = import_zod2.z.object({
+  eventName: SafeEventNameSchema,
+  detail: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()).optional(),
+  bubbles: import_zod2.z.boolean().optional().default(true),
+  cancelable: import_zod2.z.boolean().optional().default(true)
+});
+var ActionStepSchema = import_zod2.z.lazy(
+  () => import_zod2.z.object({
+    id: import_zod2.z.string().min(1, "Step ID cannot be empty"),
+    type: ActionStepTypeSchema,
+    label: import_zod2.z.string().optional(),
+    payload: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.unknown()).optional().default({}),
+    condition: ActionStepConditionSchema.optional(),
+    timeout: import_zod2.z.number().positive().optional(),
+    continueOnError: import_zod2.z.boolean().optional(),
+    onSuccess: import_zod2.z.array(ActionStepSchema).optional(),
+    onError: import_zod2.z.array(ActionStepSchema).optional()
+  })
+);
+var ActionPipelineSchema = import_zod2.z.object({
+  id: import_zod2.z.string().min(1, "Pipeline ID cannot be empty"),
+  trigger: ActionTriggerTypeSchema,
+  label: import_zod2.z.string().optional(),
+  debounceMs: import_zod2.z.number().nonnegative("Debounce ms must be >= 0").optional(),
+  preventDuplicate: import_zod2.z.boolean().optional(),
+  enabled: import_zod2.z.boolean().optional().default(true),
+  steps: import_zod2.z.array(ActionStepSchema).min(1, "Action pipeline must contain at least one step")
+});
+
+// src/form.ts
+var import_zod3 = require("zod");
+var ValidationRuleTypeSchema = import_zod3.z.enum([
+  "required",
+  "email",
+  "url",
+  "min_length",
+  "max_length",
+  "numeric_min",
+  "numeric_max",
+  "pattern",
+  "match_field",
+  "custom_regex"
+]);
+var ValidateOnEventSchema = import_zod3.z.enum(["blur", "change", "submit"]);
+var ValidationRuleSchema = import_zod3.z.object({
+  type: ValidationRuleTypeSchema,
+  value: import_zod3.z.unknown().optional(),
+  message: import_zod3.z.string().min(1, "Validation error message cannot be empty")
+});
+var FormFieldBindingSchema = import_zod3.z.object({
+  name: import_zod3.z.string().min(1, "Field name cannot be empty"),
+  label: import_zod3.z.string().optional(),
+  defaultValue: import_zod3.z.unknown().optional(),
+  rules: import_zod3.z.array(ValidationRuleSchema).optional().default([]),
+  validateOn: ValidateOnEventSchema.optional().default("blur"),
+  transform: import_zod3.z.enum(["trim", "lowercase", "uppercase", "number"]).optional(),
+  disabled: import_zod3.z.boolean().optional(),
+  required: import_zod3.z.boolean().optional()
+});
+var FormConfigSchema = import_zod3.z.object({
+  formId: import_zod3.z.string().min(1, "Form ID cannot be empty"),
+  resetOnSubmit: import_zod3.z.boolean().optional().default(false),
+  scrollToFirstError: import_zod3.z.boolean().optional().default(true),
+  validateOn: ValidateOnEventSchema.optional().default("blur"),
+  initialValues: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()).optional(),
+  rules: import_zod3.z.array(ValidationRuleSchema).optional()
+});
+
+// src/theme.ts
+var import_zod4 = require("zod");
+var THEME_TOKEN_CSS_PREFIX = Object.freeze({
+  colors: "--kb-color-",
+  fonts: "--kb-font-",
+  radii: "--kb-radius-",
+  spacing: "--kb-space-"
+});
+var THEME_TOKEN_KEY_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
+var DANGEROUS_THEME_VALUE_PATTERN = /javascript:|expression\(|@import|<script|vbscript:|data:text\/html|url\s*\(/i;
+var FORBIDDEN_THEME_VALUE_CHARS = /[;{}<>\\]/;
+var MAX_THEME_VALUE_LENGTH = 512;
+function isSafeThemeTokenKey(key) {
+  return typeof key === "string" && THEME_TOKEN_KEY_PATTERN.test(key);
+}
+function isSafeThemeTokenValue(value) {
+  if (typeof value === "number") return Number.isFinite(value);
+  if (typeof value !== "string") return false;
+  if (value.trim().length === 0 || value.length > MAX_THEME_VALUE_LENGTH) return false;
+  if (FORBIDDEN_THEME_VALUE_CHARS.test(value)) return false;
+  if (DANGEROUS_THEME_VALUE_PATTERN.test(value)) return false;
+  return true;
+}
+var ThemeTokenKeySchema = import_zod4.z.string().refine(isSafeThemeTokenKey, {
+  message: 'Theme token key must be 1-64 characters of letters, digits, "-" or "_" (starting with a letter or digit)'
+});
+var ThemeTokenValueSchema = import_zod4.z.union([
+  import_zod4.z.string().refine((value) => isSafeThemeTokenValue(value), {
+    message: "Theme token value contains a disallowed or unsafe pattern"
+  }),
+  import_zod4.z.number().refine((value) => Number.isFinite(value), { message: "Theme token value must be finite" })
+]);
+var ThemeTokenMapSchema = import_zod4.z.record(ThemeTokenKeySchema, ThemeTokenValueSchema);
+var ThemeSchema = import_zod4.z.object({
+  colors: ThemeTokenMapSchema.optional(),
+  fonts: ThemeTokenMapSchema.optional(),
+  radii: ThemeTokenMapSchema.optional(),
+  spacing: ThemeTokenMapSchema.optional()
+});
+
+// src/document.ts
+var SCHEMA_NAME = "stora.page";
+var CURRENT_SCHEMA_VERSION = "1.2.0";
+var AssetReferenceSchema = import_zod5.z.object({
+  type: import_zod5.z.literal("asset"),
+  assetId: import_zod5.z.string().min(1, "Asset ID cannot be empty"),
+  filename: import_zod5.z.string().optional(),
+  mimeType: import_zod5.z.string().optional(),
+  fallbackUrl: import_zod5.z.string().url().optional()
+});
+var VariableBindingSchema = import_zod5.z.object({
+  type: import_zod5.z.literal("variable"),
+  key: import_zod5.z.string().min(1, "Variable key cannot be empty"),
+  fallback: import_zod5.z.unknown().optional()
+});
+var ActionBindingSchema = import_zod5.z.object({
+  type: import_zod5.z.string().min(1, "Action type cannot be empty"),
+  payload: import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()).optional()
+});
+var DANGEROUS_STYLE_VALUE_PATTERN = /javascript:|expression\(|@import|<script|vbscript:|data:text\/html/i;
+var StyleValueSchema = import_zod5.z.union([
+  import_zod5.z.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
+    message: "Style value contains a disallowed or unsafe pattern"
+  }),
+  import_zod5.z.number(),
+  import_zod5.z.boolean(),
+  import_zod5.z.null(),
+  import_zod5.z.undefined()
+]);
+var StyleDefinitionSchema = import_zod5.z.record(import_zod5.z.string(), StyleValueSchema);
+var PseudoStateStylesSchema = import_zod5.z.record(import_zod5.z.string(), StyleDefinitionSchema);
+var ResponsiveStylesSchema = import_zod5.z.object({
+  base: StyleDefinitionSchema.optional(),
+  desktop: StyleDefinitionSchema.optional(),
+  tablet: StyleDefinitionSchema.optional(),
+  mobile: StyleDefinitionSchema.optional(),
+  states: PseudoStateStylesSchema.optional()
+}).passthrough().default({});
+var AnimationConfigSchema = import_zod5.z.object({
+  type: import_zod5.z.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
+    message: "Animation type contains a disallowed or unsafe pattern"
+  }).optional().default("none"),
+  duration: import_zod5.z.number().min(0, "Duration must be non-negative").optional().default(600),
+  delay: import_zod5.z.number().min(0, "Delay must be non-negative").optional().default(0),
+  easing: import_zod5.z.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
+    message: "Animation easing contains a disallowed or unsafe pattern"
+  }).optional().default("ease-out"),
+  once: import_zod5.z.boolean().optional().default(true),
+  hoverEffect: import_zod5.z.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
+    message: "Hover effect contains a disallowed or unsafe pattern"
+  }).optional().default("none"),
+  loopEffect: import_zod5.z.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
+    message: "Loop effect contains a disallowed or unsafe pattern"
+  }).optional().default("none")
+});
+var NodeSchema = import_zod5.z.lazy(
+  () => import_zod5.z.object({
+    id: import_zod5.z.string().min(1, "Node ID must be a non-empty string"),
+    type: import_zod5.z.string().min(1, "Node type must be a non-empty string"),
+    props: import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()).optional().default({}),
+    styles: ResponsiveStylesSchema.optional().default({}),
+    animation: AnimationConfigSchema.optional(),
+    actions: import_zod5.z.array(ActionPipelineSchema).optional(),
+    formConfig: FormConfigSchema.optional(),
+    children: import_zod5.z.array(NodeSchema).optional().default([])
+  })
+);
+var RootPageNodeSchema = NodeSchema.refine(
+  (node) => node.type === "page",
+  {
+    message: 'Root node must have type "page"',
+    path: ["type"]
+  }
+);
+var DocumentMetadataSchema = import_zod5.z.object({
+  title: import_zod5.z.string().min(1, "Title is required").default("Untitled Page"),
+  description: import_zod5.z.string().optional().default(""),
+  author: import_zod5.z.string().optional().default(""),
+  createdAt: import_zod5.z.string().optional(),
+  updatedAt: import_zod5.z.string().optional(),
+  tags: import_zod5.z.array(import_zod5.z.string()).optional().default([]),
+  category: import_zod5.z.string().optional().default("general"),
+  version: import_zod5.z.string().optional().default("1.0.0"),
+  custom: import_zod5.z.record(import_zod5.z.string(), import_zod5.z.unknown()).optional(),
+  tracking: TrackingConfigSchema.optional()
+});
+var PageDocumentSchema = import_zod5.z.object({
+  schema: import_zod5.z.literal(SCHEMA_NAME),
+  version: import_zod5.z.string().min(1, "Schema version is required").default(CURRENT_SCHEMA_VERSION),
+  metadata: DocumentMetadataSchema.optional(),
+  tracking: TrackingConfigSchema.optional(),
+  theme: ThemeSchema.optional(),
+  document: RootPageNodeSchema
+});
+var PROJECT_SCHEMA_NAME = "stora.project";
+var CURRENT_PROJECT_SCHEMA_VERSION = "1.0.0";
+var ArtboardTypeSchema = import_zod5.z.enum(["page", "component"]);
+var ArtboardSchema = import_zod5.z.object({
+  id: import_zod5.z.string().min(1, "Artboard ID is required"),
+  name: import_zod5.z.string().min(1, "Artboard name is required"),
+  artboardType: ArtboardTypeSchema,
+  /** Route for page artboards (e.g. "/about"). */
+  slug: import_zod5.z.string().optional(),
+  /**
+   * For component artboards: the id that `open_modal` / `close_modal` actions target.
+   * Mirrors the detached node's own `props.modalId` so ModalManager keeps working unchanged.
+   */
+  triggerId: import_zod5.z.string().optional(),
+  /**
+   * Viewport/breakpoint this artboard is currently authored at. Declared inline
+   * (rather than imported) because viewport is otherwise an editor/renderer concept.
+   */
+  viewport: import_zod5.z.enum(["desktop", "tablet", "mobile"]).optional(),
+  /** Persisted artboard width in px, matching the canvas ViewportResizer's `width`. */
+  width: import_zod5.z.number().positive().optional(),
+  /**
+   * Free position on the builder's infinite canvas, in unscaled canvas px. Absent means
+   * "not placed yet" — the canvas then falls back to laying the artboard out in a row.
+   */
+  position: import_zod5.z.object({
+    x: import_zod5.z.number(),
+    y: import_zod5.z.number()
+  }).optional(),
+  document: PageDocumentSchema
+});
+var ProjectDocumentSchema = import_zod5.z.object({
+  schema: import_zod5.z.literal(PROJECT_SCHEMA_NAME),
+  version: import_zod5.z.string().min(1, "Schema version is required").default(CURRENT_PROJECT_SCHEMA_VERSION),
+  metadata: DocumentMetadataSchema.optional(),
+  tracking: TrackingConfigSchema.optional(),
+  artboards: import_zod5.z.array(ArtboardSchema).min(1, "A project needs at least one artboard"),
+  activeArtboardId: import_zod5.z.string().optional()
+});
+
+// src/manifest.ts
+var import_zod6 = require("zod");
+var ManifestAssetItemSchema = import_zod6.z.object({
+  id: import_zod6.z.string().min(1, "Asset ID cannot be empty"),
+  path: import_zod6.z.string().min(1, "Asset archive path cannot be empty"),
+  mimeType: import_zod6.z.string().min(1, "MIME type cannot be empty"),
+  size: import_zod6.z.number().nonnegative("Asset size must be non-negative"),
+  checksum: import_zod6.z.string().optional()
+});
+var ManifestSchema = import_zod6.z.object({
+  schema: import_zod6.z.literal(SCHEMA_NAME).default(SCHEMA_NAME),
+  schemaVersion: import_zod6.z.string().min(1, "Schema version cannot be empty").default("1.0.0"),
+  packageVersion: import_zod6.z.string().min(1, "Package version cannot be empty").default("1.0.0"),
+  builderCompatibility: import_zod6.z.string().default(">=0.1.0"),
+  requiredComponents: import_zod6.z.array(import_zod6.z.string()).default([]),
+  requiredCapabilities: import_zod6.z.array(import_zod6.z.string()).default([]),
+  assets: import_zod6.z.array(ManifestAssetItemSchema).default([]),
+  createdAt: import_zod6.z.string().optional()
+});
+
+// src/template.ts
+var import_zod7 = require("zod");
+var DANGEROUS_URI_PATTERN = /^(javascript:|vbscript:|data:(?!image\/))|<script/i;
+function isSafeThumbnailUrl(url) {
+  if (!url || typeof url !== "string") return false;
+  const trimmed = url.trim();
+  if (trimmed.length === 0) return false;
+  if (DANGEROUS_URI_PATTERN.test(trimmed)) return false;
+  return true;
+}
+var SafeThumbnailUrlSchema = import_zod7.z.string().min(1, "Thumbnail URL cannot be empty").refine(
+  (url) => isSafeThumbnailUrl(url),
+  { message: "Thumbnail URL contains an unsafe protocol or payload" }
+);
+var SafeThumbnailObjectSchema = import_zod7.z.object({
+  url: SafeThumbnailUrlSchema,
+  alt: import_zod7.z.string().optional(),
+  width: import_zod7.z.number().positive().optional(),
+  height: import_zod7.z.number().positive().optional()
+});
+var SafeThumbnailSchema = import_zod7.z.union([
+  AssetReferenceSchema,
+  SafeThumbnailObjectSchema,
+  SafeThumbnailUrlSchema
+]);
+var TemplatePackageRefSchema = import_zod7.z.object({
+  path: import_zod7.z.string().optional(),
+  url: SafeThumbnailUrlSchema.optional(),
+  checksum: import_zod7.z.string().optional(),
+  format: import_zod7.z.enum(["stora", "json"]).default("stora")
+});
+var TemplateRequirementsSchema = import_zod7.z.object({
+  requiredComponents: import_zod7.z.array(import_zod7.z.string()).default([]),
+  requiredCapabilities: import_zod7.z.array(import_zod7.z.string()).default([])
+});
+var TemplateRecordSchema = import_zod7.z.object({
+  id: import_zod7.z.string().min(1, "Template ID must be a non-empty string"),
+  name: import_zod7.z.string().min(1, "Template name must be a non-empty string"),
+  description: import_zod7.z.string().optional().default(""),
+  category: import_zod7.z.string().optional().default("general"),
+  tags: import_zod7.z.array(import_zod7.z.string()).optional().default([]),
+  thumbnail: SafeThumbnailSchema.optional(),
+  author: import_zod7.z.string().optional().default(""),
+  version: import_zod7.z.string().optional().default("1.0.0"),
+  document: PageDocumentSchema.optional(),
+  packageReference: TemplatePackageRefSchema.optional(),
+  requirements: TemplateRequirementsSchema.default({
+    requiredComponents: [],
+    requiredCapabilities: []
+  }),
+  createdAt: import_zod7.z.string().optional(),
+  updatedAt: import_zod7.z.string().optional(),
+  custom: import_zod7.z.record(import_zod7.z.string(), import_zod7.z.unknown()).optional()
+});
+
+// src/validate.ts
+function run(schema, input) {
+  const result = schema.safeParse(input);
+  if (result.success) {
+    return { success: true, data: result.data, issues: [] };
+  }
+  const issues = result.error.issues.map((issue) => ({
+    path: issue.path.map((segment) => String(segment)).join("."),
+    message: issue.message,
+    code: String(issue.code)
+  }));
+  return { success: false, issues };
+}
+function validateDocument(input) {
+  return run(PageDocumentSchema, input);
+}
+function validateNode(input) {
+  return run(NodeSchema, input);
+}
+function validateProjectDocument(input) {
+  return run(ProjectDocumentSchema, input);
+}
+function validateTemplateRecord(input) {
+  return run(TemplateRecordSchema, input);
+}
+function validateManifest(input) {
+  return run(ManifestSchema, input);
+}
+function validateTheme(input) {
+  return run(ThemeSchema, input);
+}
+function isValidPageDocument(input) {
+  return validateDocument(input).success;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  isValidPageDocument,
+  validateDocument,
+  validateManifest,
+  validateNode,
+  validateProjectDocument,
+  validateTemplateRecord,
+  validateTheme
+});
+//# sourceMappingURL=validate.cjs.map