@kubuild/schema 0.7.0 → 0.8.1

package/dist/chunk-MT3M7D67.js

@@ -0,0 +1,1041 @@
+// src/tracking.ts
+import { z } from "zod";
+var TrackingProviderTypeSchema = z.enum([
+  "meta",
+  "google",
+  "gtm",
+  "tiktok",
+  "custom"
+]);
+var TrackingDeliverySchema = z.enum(["both", "client_only", "server_only"]);
+var MetaTrackingProviderConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  /** Host credential id; the server resolves the CAPI access token from it. */
+  credentialId: z.string().optional(),
+  /** Meta Pixel ID (e.g. 123456789012345) — public */
+  pixelId: z.string().optional().default(""),
+  /** Enable Server-Side Conversions API (delivered through the host relay) */
+  capiEnabled: z.boolean().optional().default(false),
+  /** Test Event Code from Meta Events Manager (e.g. "TEST12345") — not a secret */
+  testEventCode: z.string().optional().default("")
+});
+var GoogleTrackingProviderConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  /** Host credential id; the server resolves the Measurement Protocol API secret from it. */
+  credentialId: z.string().optional(),
+  /** GA4 Measurement ID (e.g. "G-XXXXXXXXXX") — public */
+  measurementId: z.string().optional().default("")
+});
+var GtmTrackingProviderConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  /** Optional linked account/workspace credential ID */
+  credentialId: z.string().optional(),
+  /** GTM Container ID (e.g. "GTM-XXXXXXX") — public */
+  containerId: z.string().optional().default("")
+});
+var TikTokTrackingProviderConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  /** Host credential id; the server resolves the Events API access token from it. */
+  credentialId: z.string().optional(),
+  /** TikTok Pixel ID (e.g. "C1234567890") — public */
+  pixelId: z.string().optional().default(""),
+  /** Enable TikTok Events API (server-side, delivered through the host relay) */
+  eventsApiEnabled: z.boolean().optional().default(false),
+  /** Test Event Code from TikTok Event Manager — not a secret */
+  testEventCode: z.string().optional().default("")
+});
+var CustomTrackingProviderConfigSchema = z.object({
+  enabled: z.boolean().default(true),
+  /** Host credential id; the server resolves the webhook `endpointUrl` + `headers` from it. */
+  credentialId: z.string().optional()
+});
+var LEGACY_TRACKING_SECRET_KEYS = Object.freeze({
+  meta: ["capiAccessToken", "serverRelayUrl"],
+  google: ["measurementProtocolSecret", "serverRelayUrl"],
+  gtm: ["serverRelayUrl"],
+  tiktok: ["accessToken", "serverRelayUrl"],
+  custom: ["endpointUrl", "headers"]
+});
+var TrackingConfigSchema = z.object({
+  /** Master toggle: dynamically enables or disables all tracking operations */
+  enabled: z.boolean().default(true),
+  /** When enabled, events are logged to console and can bypass live API calls for safe debugging */
+  debugMode: z.boolean().optional().default(false),
+  /** Automatically trigger PageView event upon page load */
+  autoPageView: z.boolean().optional().default(true),
+  /** Default delivery method when not explicitly overridden in an action step */
+  defaultDelivery: TrackingDeliverySchema.optional().default("both"),
+  /** Provider-specific settings */
+  providers: z.object({
+    meta: MetaTrackingProviderConfigSchema.optional(),
+    google: GoogleTrackingProviderConfigSchema.optional(),
+    gtm: GtmTrackingProviderConfigSchema.optional(),
+    tiktok: TikTokTrackingProviderConfigSchema.optional(),
+    custom: CustomTrackingProviderConfigSchema.optional()
+  }).optional().default({})
+});
+var MetaTrackingSecretsSchema = z.object({
+  /** System User access token for the Meta Graph API. */
+  capiAccessToken: z.string().min(1)
+});
+var GoogleTrackingSecretsSchema = z.object({
+  /** Measurement Protocol `api_secret`. */
+  measurementProtocolSecret: z.string().min(1)
+});
+var TikTokTrackingSecretsSchema = z.object({
+  /** Long-term Events API access token. */
+  accessToken: z.string().min(1)
+});
+var CustomTrackingSecretsSchema = z.object({
+  endpointUrl: z.string().url(),
+  headers: z.record(z.string(), z.string()).optional()
+});
+var StandardTrackingEventSchema = z.enum([
+  "PageView",
+  "ViewContent",
+  "AddToCart",
+  "InitiateCheckout",
+  "Purchase",
+  "Lead",
+  "Contact",
+  "CompleteRegistration",
+  "Subscribe",
+  "Search",
+  "SubmitApplication",
+  "Schedule"
+]);
+var TrackEventProviderSchema = z.enum(["all", "meta", "google", "gtm", "tiktok", "custom"]);
+var TrackEventStepPayloadSchema = z.object({
+  /** Event name: e.g. "Purchase", "Lead", or custom string */
+  eventName: z.string().min(1, "Event name cannot be empty"),
+  /** Standard event vs custom event identifier */
+  eventType: z.enum(["standard", "custom"]).optional().default("standard"),
+  /**
+   * Target provider: 'all' or a specific provider.
+   * 'gtm' pushes the event to `window.dataLayer` (client-side only).
+   */
+  provider: TrackEventProviderSchema.optional().default("all"),
+  /** Delivery channel: 'both', 'client_only', or 'server_only' */
+  delivery: TrackingDeliverySchema.optional().default("both"),
+  /**
+   * Deduplication Event ID.
+   * If omitted, a unique ID is automatically generated so Meta/TikTok CAPI
+   * deduplicates cleanly with the browser pixel.
+   */
+  eventId: z.string().optional(),
+  /**
+   * Event parameters/properties (e.g. currency, value, content_name, order_id).
+   * Supports runtime variable interpolation (e.g. {{ form.price }} or {{ variables.currency }}).
+   */
+  params: z.record(z.string(), z.unknown()).optional().default({}),
+  /**
+   * User Data for advanced matching and server CAPI (e.g. email, phone, firstName, lastName).
+   * Supports runtime variable interpolation (e.g. {{ form.email }}).
+   */
+  userData: z.record(z.string(), z.unknown()).optional().default({}),
+  /** Step-level active toggle */
+  enabled: z.boolean().optional().default(true)
+});
+var TRACKING_RELAY_PROTOCOL_VERSION = 1;
+var ServerTrackingEventSchema = z.object({
+  eventName: z.string().min(1).max(256),
+  eventType: z.enum(["standard", "custom"]).optional(),
+  eventId: z.string().max(256).optional(),
+  /** Unix epoch seconds. */
+  eventTime: z.number().int().nonnegative().optional(),
+  eventSourceUrl: z.string().max(4096).optional(),
+  actionSource: z.enum(["website", "app", "system_generated"]).optional(),
+  params: z.record(z.string(), z.unknown()).optional(),
+  /** Raw (unhashed) user data; the relay hashes PII per provider spec before forwarding. */
+  userData: z.record(z.string(), z.unknown()).optional(),
+  customData: z.record(z.string(), z.unknown()).optional()
+});
+var TrackingRelayRequestSchema = z.object({
+  version: z.literal(TRACKING_RELAY_PROTOCOL_VERSION),
+  event: ServerTrackingEventSchema,
+  provider: TrackEventProviderSchema.optional().default("all"),
+  /** Optional hint only; the relay uses the credentialId from its trusted config. */
+  credentialId: z.string().max(256).optional(),
+  /** Host document/page id so the relay can look up the trusted tracking config. */
+  documentId: z.string().max(256).optional()
+});
+var TrackingRelayProviderResultSchema = z.object({
+  provider: z.string(),
+  success: z.boolean(),
+  status: z.number().int().optional(),
+  skipped: z.boolean().optional(),
+  reason: z.string().optional(),
+  error: z.string().optional()
+});
+var TrackingRelayErrorCodeSchema = z.enum([
+  "INVALID_REQUEST",
+  "UNSUPPORTED_VERSION",
+  "FORBIDDEN_ORIGIN",
+  "METHOD_NOT_ALLOWED",
+  "CONFIG_NOT_FOUND",
+  "INTERNAL_ERROR"
+]);
+var TrackingRelayResponseSchema = z.object({
+  version: z.literal(TRACKING_RELAY_PROTOCOL_VERSION),
+  success: z.boolean(),
+  eventId: z.string().optional(),
+  skipped: z.boolean().optional(),
+  reason: z.string().optional(),
+  results: z.record(z.string(), TrackingRelayProviderResultSchema).optional(),
+  error: z.object({
+    code: TrackingRelayErrorCodeSchema,
+    message: z.string()
+  }).optional()
+});
+function isTrackingConfig(value) {
+  return TrackingConfigSchema.safeParse(value).success;
+}
+function isTrackEventStepPayload(value) {
+  return TrackEventStepPayloadSchema.safeParse(value).success;
+}
+function isTrackingRelayRequest(value) {
+  return TrackingRelayRequestSchema.safeParse(value).success;
+}
+
+// src/actions.ts
+import { z as z2 } from "zod";
+var ActionTriggerTypeSchema = z2.enum([
+  "click",
+  "submit",
+  "change",
+  "blur",
+  "focus",
+  "load",
+  // Fired once by time-bound components (e.g. `countdown`) when they reach zero.
+  "expire"
+]);
+var ActionTriggerSchema = ActionTriggerTypeSchema;
+var ActionStepTypeSchema = z2.enum([
+  "api_request",
+  "navigate",
+  "set_state",
+  "reset_form",
+  "show_toast",
+  "open_modal",
+  "close_modal",
+  "toggle_modal",
+  "copy_clipboard",
+  "custom_event",
+  "track_event"
+]);
+var ConditionOperatorSchema = z2.enum([
+  "equals",
+  "not_equals",
+  "contains",
+  "not_contains",
+  "is_truthy",
+  "is_falsy",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "regex"
+]);
+var ActionStepConditionSchema = z2.object({
+  field: z2.string().min(1, "Condition field cannot be empty"),
+  operator: ConditionOperatorSchema,
+  value: z2.unknown().optional()
+});
+var DANGEROUS_URL_PATTERN = /(javascript:|vbscript:|data:text\/html)/i;
+var DANGEROUS_SCRIPT_PATTERN = /<\s*script/i;
+function isSafeActionUrl(url) {
+  if (!url || typeof url !== "string") return false;
+  const trimmed = url.trim();
+  if (DANGEROUS_URL_PATTERN.test(trimmed)) return false;
+  if (DANGEROUS_SCRIPT_PATTERN.test(trimmed)) return false;
+  return true;
+}
+var SafeUrlStringSchema = z2.string().min(1, "URL cannot be empty").refine(isSafeActionUrl, {
+  message: "URL contains disallowed or unsafe protocol/script pattern"
+});
+var SafeEventNameSchema = z2.string().min(1, "Event name cannot be empty").regex(/^[a-zA-Z0-9_\-:]+$/, {
+  message: "Event name must contain only alphanumeric characters, dashes, colons, or underscores"
+});
+var ApiRequestStepPayloadSchema = z2.object({
+  url: SafeUrlStringSchema,
+  method: z2.enum(["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]).default("GET"),
+  headers: z2.record(z2.string(), z2.string()).optional(),
+  queryParams: z2.record(z2.string(), z2.union([z2.string(), z2.number(), z2.boolean()])).optional(),
+  /**
+   * Request body. Omitted inside a form `submit` pipeline → the form's values are sent;
+   * `null` → explicitly no body.
+   */
+  body: z2.union([z2.string(), z2.record(z2.string(), z2.unknown()), z2.array(z2.unknown())]).nullable().optional(),
+  bodyFormat: z2.enum(["json", "form-data", "formData", "urlencoded", "url-encoded", "raw", "text"]).optional(),
+  bodyType: z2.enum(["json", "form-data", "formData", "urlencoded", "url-encoded", "raw", "text"]).optional(),
+  timeout: z2.number().positive("Timeout must be greater than 0 ms").optional(),
+  responseMapping: z2.record(z2.string(), z2.string()).optional()
+});
+var NavigateStepPayloadSchema = z2.object({
+  url: SafeUrlStringSchema,
+  target: z2.enum(["_self", "_blank", "_parent", "_top"]).optional().default("_self"),
+  replace: z2.boolean().optional(),
+  scroll: z2.boolean().optional(),
+  behavior: z2.enum(["smooth", "auto"]).optional()
+});
+var SetStateStepPayloadSchema = z2.object({
+  key: z2.string().min(1, "State key cannot be empty"),
+  value: z2.unknown(),
+  scope: z2.enum(["runtime", "document", "session", "local"]).optional().default("runtime")
+});
+var ResetFormStepPayloadSchema = z2.object({
+  formId: z2.string().optional()
+});
+var ShowToastStepPayloadSchema = z2.object({
+  message: z2.string().min(1, "Toast message cannot be empty"),
+  type: z2.enum(["success", "error", "warning", "info"]).optional().default("info"),
+  variant: z2.enum(["success", "error", "warning", "info"]).optional(),
+  title: z2.string().optional(),
+  duration: z2.number().nonnegative("Duration must be >= 0 ms").optional(),
+  position: z2.enum(["top-right", "top-left", "bottom-right", "bottom-left", "top-center", "bottom-center"]).optional()
+});
+var OpenModalStepPayloadSchema = z2.object({
+  modalId: z2.string().optional(),
+  modalNodeId: z2.string().optional(),
+  toggle: z2.boolean().optional()
+}).refine((data) => Boolean(data.modalId || data.modalNodeId), {
+  message: "Modal ID or Modal Node ID cannot be empty"
+});
+var CloseModalStepPayloadSchema = z2.object({
+  modalId: z2.string().optional(),
+  modalNodeId: z2.string().optional()
+});
+var ToggleModalStepPayloadSchema = z2.object({
+  modalId: z2.string().optional(),
+  modalNodeId: z2.string().optional(),
+  targetNodeId: z2.string().optional(),
+  nodeId: z2.string().optional()
+}).refine(
+  (data) => [data.modalId, data.modalNodeId, data.targetNodeId, data.nodeId].some(
+    (id) => typeof id === "string" && id.trim().length > 0
+  ),
+  {
+    message: "Modal ID or Modal Node ID cannot be empty"
+  }
+);
+var CopyClipboardStepPayloadSchema = z2.object({
+  text: z2.string().optional(),
+  value: z2.unknown().optional(),
+  notify: z2.boolean().optional(),
+  toastMessage: z2.string().optional()
+});
+var CustomEventStepPayloadSchema = z2.object({
+  eventName: SafeEventNameSchema,
+  detail: z2.record(z2.string(), z2.unknown()).optional(),
+  bubbles: z2.boolean().optional().default(true),
+  cancelable: z2.boolean().optional().default(true)
+});
+var StepPayloadSchemas = {
+  api_request: ApiRequestStepPayloadSchema,
+  navigate: NavigateStepPayloadSchema,
+  set_state: SetStateStepPayloadSchema,
+  reset_form: ResetFormStepPayloadSchema,
+  show_toast: ShowToastStepPayloadSchema,
+  open_modal: OpenModalStepPayloadSchema,
+  close_modal: CloseModalStepPayloadSchema,
+  toggle_modal: ToggleModalStepPayloadSchema,
+  copy_clipboard: CopyClipboardStepPayloadSchema,
+  custom_event: CustomEventStepPayloadSchema,
+  track_event: TrackEventStepPayloadSchema
+};
+var ActionStepSchema = z2.lazy(
+  () => z2.object({
+    id: z2.string().min(1, "Step ID cannot be empty"),
+    type: ActionStepTypeSchema,
+    label: z2.string().optional(),
+    payload: z2.record(z2.string(), z2.unknown()).optional().default({}),
+    condition: ActionStepConditionSchema.optional(),
+    timeout: z2.number().positive().optional(),
+    continueOnError: z2.boolean().optional(),
+    onSuccess: z2.array(ActionStepSchema).optional(),
+    onError: z2.array(ActionStepSchema).optional()
+  })
+);
+var ActionPipelineSchema = z2.object({
+  id: z2.string().min(1, "Pipeline ID cannot be empty"),
+  trigger: ActionTriggerTypeSchema,
+  label: z2.string().optional(),
+  debounceMs: z2.number().nonnegative("Debounce ms must be >= 0").optional(),
+  preventDuplicate: z2.boolean().optional(),
+  enabled: z2.boolean().optional().default(true),
+  steps: z2.array(ActionStepSchema).min(1, "Action pipeline must contain at least one step")
+});
+function isActionTriggerType(value) {
+  return ActionTriggerTypeSchema.safeParse(value).success;
+}
+function isActionStepType(value) {
+  return ActionStepTypeSchema.safeParse(value).success;
+}
+function isConditionOperator(value) {
+  return ConditionOperatorSchema.safeParse(value).success;
+}
+function isActionStepCondition(value) {
+  return ActionStepConditionSchema.safeParse(value).success;
+}
+function isActionStep(value) {
+  return ActionStepSchema.safeParse(value).success;
+}
+function isActionPipeline(value) {
+  return ActionPipelineSchema.safeParse(value).success;
+}
+function validateActionStepPayload(type, payload) {
+  const schema = StepPayloadSchemas[type];
+  if (!schema) {
+    return {
+      success: false,
+      error: new z2.ZodError([
+        {
+          code: z2.ZodIssueCode.custom,
+          message: `Unknown step type: ${type}`,
+          path: ["type"]
+        }
+      ])
+    };
+  }
+  const result = schema.safeParse(payload);
+  if (result.success) {
+    return { success: true, data: result.data };
+  }
+  return { success: false, error: result.error };
+}
+function sanitizeActionUrl(url, fallback = "") {
+  if (typeof url !== "string") return fallback;
+  const trimmed = url.trim();
+  if (!isSafeActionUrl(trimmed)) {
+    return fallback;
+  }
+  return trimmed;
+}
+function sanitizeActionString(value, fallback = "") {
+  if (typeof value !== "string") return fallback;
+  if (DANGEROUS_SCRIPT_PATTERN.test(value)) {
+    return value.replace(/<\s*script[^>]*>[\s\S]*?<\s*\/\s*script\s*>/gi, "").replace(/<\s*script[^>]*>/gi, "");
+  }
+  return value;
+}
+function sanitizeActionValue(value) {
+  if (value === null || value === void 0) return value;
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    if (DANGEROUS_URL_PATTERN.test(trimmed)) {
+      return "";
+    }
+    return sanitizeActionString(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => sanitizeActionValue(item));
+  }
+  if (typeof value === "object") {
+    const result = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (/^(url|href|src|endpoint|targetUrl)$/i.test(k) && typeof v === "string") {
+        result[k] = sanitizeActionUrl(v);
+      } else {
+        result[k] = sanitizeActionValue(v);
+      }
+    }
+    return result;
+  }
+  return value;
+}
+function sanitizeActionPayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return {};
+  }
+  return sanitizeActionValue(payload);
+}
+function sanitizeActionStep(step) {
+  const sanitized = {
+    ...step,
+    label: step.label ? sanitizeActionString(step.label) : step.label,
+    payload: sanitizeActionPayload(step.payload)
+  };
+  if (step.condition && step.condition.value !== void 0) {
+    sanitized.condition = {
+      ...step.condition,
+      value: sanitizeActionValue(step.condition.value)
+    };
+  }
+  if (step.onSuccess && Array.isArray(step.onSuccess)) {
+    sanitized.onSuccess = step.onSuccess.map((s) => sanitizeActionStep(s));
+  }
+  if (step.onError && Array.isArray(step.onError)) {
+    sanitized.onError = step.onError.map((s) => sanitizeActionStep(s));
+  }
+  return sanitized;
+}
+function sanitizeActionPipeline(pipeline) {
+  return {
+    ...pipeline,
+    label: pipeline.label ? sanitizeActionString(pipeline.label) : pipeline.label,
+    steps: Array.isArray(pipeline.steps) ? pipeline.steps.map((s) => sanitizeActionStep(s)) : []
+  };
+}
+
+// src/form.ts
+import { z as z3 } from "zod";
+var ValidationRuleTypeSchema = z3.enum([
+  "required",
+  "email",
+  "url",
+  "min_length",
+  "max_length",
+  "numeric_min",
+  "numeric_max",
+  "pattern",
+  "match_field",
+  "custom_regex"
+]);
+var ValidateOnEventSchema = z3.enum(["blur", "change", "submit"]);
+var ValidationRuleSchema = z3.object({
+  type: ValidationRuleTypeSchema,
+  value: z3.unknown().optional(),
+  message: z3.string().min(1, "Validation error message cannot be empty")
+});
+var FormFieldBindingSchema = z3.object({
+  name: z3.string().min(1, "Field name cannot be empty"),
+  label: z3.string().optional(),
+  defaultValue: z3.unknown().optional(),
+  rules: z3.array(ValidationRuleSchema).optional().default([]),
+  validateOn: ValidateOnEventSchema.optional().default("blur"),
+  transform: z3.enum(["trim", "lowercase", "uppercase", "number"]).optional(),
+  disabled: z3.boolean().optional(),
+  required: z3.boolean().optional()
+});
+var FormConfigSchema = z3.object({
+  formId: z3.string().min(1, "Form ID cannot be empty"),
+  resetOnSubmit: z3.boolean().optional().default(false),
+  scrollToFirstError: z3.boolean().optional().default(true),
+  validateOn: ValidateOnEventSchema.optional().default("blur"),
+  initialValues: z3.record(z3.string(), z3.unknown()).optional(),
+  rules: z3.array(ValidationRuleSchema).optional()
+});
+function isValidationRuleType(value) {
+  return ValidationRuleTypeSchema.safeParse(value).success;
+}
+function isValidationRule(value) {
+  return ValidationRuleSchema.safeParse(value).success;
+}
+function isValidateOnEvent(value) {
+  return ValidateOnEventSchema.safeParse(value).success;
+}
+function isFormFieldBinding(value) {
+  return FormFieldBindingSchema.safeParse(value).success;
+}
+function isFormConfig(value) {
+  return FormConfigSchema.safeParse(value).success;
+}
+
+// src/theme.ts
+import { z as z4 } from "zod";
+var THEME_TOKEN_GROUPS = ["colors", "fonts", "radii", "spacing"];
+var THEME_TOKEN_CSS_PREFIX = Object.freeze({
+  colors: "--kb-color-",
+  fonts: "--kb-font-",
+  radii: "--kb-radius-",
+  spacing: "--kb-space-"
+});
+var THEME_TOKEN_KEY_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
+var DANGEROUS_THEME_VALUE_PATTERN = /javascript:|expression\(|@import|<script|vbscript:|data:text\/html|url\s*\(/i;
+var FORBIDDEN_THEME_VALUE_CHARS = /[;{}<>\\]/;
+var MAX_THEME_VALUE_LENGTH = 512;
+function isSafeThemeTokenKey(key) {
+  return typeof key === "string" && THEME_TOKEN_KEY_PATTERN.test(key);
+}
+function isSafeThemeTokenValue(value) {
+  if (typeof value === "number") return Number.isFinite(value);
+  if (typeof value !== "string") return false;
+  if (value.trim().length === 0 || value.length > MAX_THEME_VALUE_LENGTH) return false;
+  if (FORBIDDEN_THEME_VALUE_CHARS.test(value)) return false;
+  if (DANGEROUS_THEME_VALUE_PATTERN.test(value)) return false;
+  return true;
+}
+var ThemeTokenKeySchema = z4.string().refine(isSafeThemeTokenKey, {
+  message: 'Theme token key must be 1-64 characters of letters, digits, "-" or "_" (starting with a letter or digit)'
+});
+var ThemeTokenValueSchema = z4.union([
+  z4.string().refine((value) => isSafeThemeTokenValue(value), {
+    message: "Theme token value contains a disallowed or unsafe pattern"
+  }),
+  z4.number().refine((value) => Number.isFinite(value), { message: "Theme token value must be finite" })
+]);
+var ThemeTokenMapSchema = z4.record(ThemeTokenKeySchema, ThemeTokenValueSchema);
+var ThemeSchema = z4.object({
+  colors: ThemeTokenMapSchema.optional(),
+  fonts: ThemeTokenMapSchema.optional(),
+  radii: ThemeTokenMapSchema.optional(),
+  spacing: ThemeTokenMapSchema.optional()
+});
+function themeTokenCssVarName(group, key) {
+  if (!isSafeThemeTokenKey(key)) return null;
+  return `${THEME_TOKEN_CSS_PREFIX[group]}${key}`;
+}
+function themeTokenRef(group, key) {
+  const name = themeTokenCssVarName(group, key);
+  if (!name) {
+    throw new Error(`Invalid theme token key "${key}"`);
+  }
+  return `var(${name})`;
+}
+var TOKEN_REF_PATTERN = /^var\(\s*--kb-(color|font|radius|space)-([a-zA-Z0-9][a-zA-Z0-9_-]*)\s*(?:,[^)]*)?\)$/;
+var PREFIX_TO_GROUP = {
+  color: "colors",
+  font: "fonts",
+  radius: "radii",
+  space: "spacing"
+};
+function parseThemeTokenRef(value) {
+  if (typeof value !== "string") return null;
+  const match = TOKEN_REF_PATTERN.exec(value.trim());
+  if (!match) return null;
+  return { group: PREFIX_TO_GROUP[match[1]], key: match[2] };
+}
+function mergeThemes(...layers) {
+  const merged = {};
+  for (const layer of layers) {
+    if (!layer || typeof layer !== "object") continue;
+    for (const group of THEME_TOKEN_GROUPS) {
+      const tokens = layer[group];
+      if (!tokens || typeof tokens !== "object") continue;
+      for (const [key, value] of Object.entries(tokens)) {
+        if (!isSafeThemeTokenKey(key) || !isSafeThemeTokenValue(value)) continue;
+        merged[group] = { ...merged[group] ?? {}, [key]: value };
+      }
+    }
+  }
+  return merged;
+}
+function themeToCssVariables(theme) {
+  const entries = [];
+  if (!theme || typeof theme !== "object") return entries;
+  for (const group of THEME_TOKEN_GROUPS) {
+    const tokens = theme[group];
+    if (!tokens || typeof tokens !== "object") continue;
+    for (const [key, value] of Object.entries(tokens)) {
+      const name = themeTokenCssVarName(group, key);
+      if (!name || !isSafeThemeTokenValue(value)) continue;
+      entries.push([
+        name,
+        typeof value === "number" && (group === "radii" || group === "spacing") ? `${value}px` : String(value)
+      ]);
+    }
+  }
+  return entries;
+}
+function isTheme(value) {
+  return ThemeSchema.safeParse(value).success;
+}
+
+// src/document.ts
+import { z as z5 } from "zod";
+var SCHEMA_NAME = "stora.page";
+var CURRENT_SCHEMA_VERSION = "1.2.0";
+var AssetReferenceSchema = z5.object({
+  type: z5.literal("asset"),
+  assetId: z5.string().min(1, "Asset ID cannot be empty"),
+  filename: z5.string().optional(),
+  mimeType: z5.string().optional(),
+  fallbackUrl: z5.string().url().optional()
+});
+var VariableBindingSchema = z5.object({
+  type: z5.literal("variable"),
+  key: z5.string().min(1, "Variable key cannot be empty"),
+  fallback: z5.unknown().optional()
+});
+var ActionBindingSchema = z5.object({
+  type: z5.string().min(1, "Action type cannot be empty"),
+  payload: z5.record(z5.string(), z5.unknown()).optional()
+});
+var DANGEROUS_STYLE_VALUE_PATTERN = /javascript:|expression\(|@import|<script|vbscript:|data:text\/html/i;
+var StyleValueSchema = z5.union([
+  z5.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
+    message: "Style value contains a disallowed or unsafe pattern"
+  }),
+  z5.number(),
+  z5.boolean(),
+  z5.null(),
+  z5.undefined()
+]);
+var StyleDefinitionSchema = z5.record(z5.string(), StyleValueSchema);
+var PseudoStateStylesSchema = z5.record(z5.string(), StyleDefinitionSchema);
+var ResponsiveStylesSchema = z5.object({
+  base: StyleDefinitionSchema.optional(),
+  desktop: StyleDefinitionSchema.optional(),
+  tablet: StyleDefinitionSchema.optional(),
+  mobile: StyleDefinitionSchema.optional(),
+  states: PseudoStateStylesSchema.optional()
+}).passthrough().default({});
+var AnimationConfigSchema = z5.object({
+  type: z5.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
+    message: "Animation type contains a disallowed or unsafe pattern"
+  }).optional().default("none"),
+  duration: z5.number().min(0, "Duration must be non-negative").optional().default(600),
+  delay: z5.number().min(0, "Delay must be non-negative").optional().default(0),
+  easing: z5.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
+    message: "Animation easing contains a disallowed or unsafe pattern"
+  }).optional().default("ease-out"),
+  once: z5.boolean().optional().default(true),
+  hoverEffect: z5.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
+    message: "Hover effect contains a disallowed or unsafe pattern"
+  }).optional().default("none"),
+  loopEffect: z5.string().refine((value) => !DANGEROUS_STYLE_VALUE_PATTERN.test(value), {
+    message: "Loop effect contains a disallowed or unsafe pattern"
+  }).optional().default("none")
+});
+var DEFAULT_ANIMATION_CONFIG = {
+  type: "none",
+  duration: 600,
+  delay: 0,
+  easing: "ease-out",
+  once: true,
+  hoverEffect: "none",
+  loopEffect: "none"
+};
+var NodeSchema = z5.lazy(
+  () => z5.object({
+    id: z5.string().min(1, "Node ID must be a non-empty string"),
+    type: z5.string().min(1, "Node type must be a non-empty string"),
+    props: z5.record(z5.string(), z5.unknown()).optional().default({}),
+    styles: ResponsiveStylesSchema.optional().default({}),
+    animation: AnimationConfigSchema.optional(),
+    actions: z5.array(ActionPipelineSchema).optional(),
+    formConfig: FormConfigSchema.optional(),
+    children: z5.array(NodeSchema).optional().default([])
+  })
+);
+var RootPageNodeSchema = NodeSchema.refine(
+  (node) => node.type === "page",
+  {
+    message: 'Root node must have type "page"',
+    path: ["type"]
+  }
+);
+var DocumentMetadataSchema = z5.object({
+  title: z5.string().min(1, "Title is required").default("Untitled Page"),
+  description: z5.string().optional().default(""),
+  author: z5.string().optional().default(""),
+  createdAt: z5.string().optional(),
+  updatedAt: z5.string().optional(),
+  tags: z5.array(z5.string()).optional().default([]),
+  category: z5.string().optional().default("general"),
+  version: z5.string().optional().default("1.0.0"),
+  custom: z5.record(z5.string(), z5.unknown()).optional(),
+  tracking: TrackingConfigSchema.optional()
+});
+var PageDocumentSchema = z5.object({
+  schema: z5.literal(SCHEMA_NAME),
+  version: z5.string().min(1, "Schema version is required").default(CURRENT_SCHEMA_VERSION),
+  metadata: DocumentMetadataSchema.optional(),
+  tracking: TrackingConfigSchema.optional(),
+  theme: ThemeSchema.optional(),
+  document: RootPageNodeSchema
+});
+var PROJECT_SCHEMA_NAME = "stora.project";
+var CURRENT_PROJECT_SCHEMA_VERSION = "1.0.0";
+var ARTBOARD_REFERENCE_NODE_TYPE = "artboard-reference";
+var ArtboardTypeSchema = z5.enum(["page", "component"]);
+var ArtboardSchema = z5.object({
+  id: z5.string().min(1, "Artboard ID is required"),
+  name: z5.string().min(1, "Artboard name is required"),
+  artboardType: ArtboardTypeSchema,
+  /** Route for page artboards (e.g. "/about"). */
+  slug: z5.string().optional(),
+  /**
+   * For component artboards: the id that `open_modal` / `close_modal` actions target.
+   * Mirrors the detached node's own `props.modalId` so ModalManager keeps working unchanged.
+   */
+  triggerId: z5.string().optional(),
+  /**
+   * Viewport/breakpoint this artboard is currently authored at. Declared inline
+   * (rather than imported) because viewport is otherwise an editor/renderer concept.
+   */
+  viewport: z5.enum(["desktop", "tablet", "mobile"]).optional(),
+  /** Persisted artboard width in px, matching the canvas ViewportResizer's `width`. */
+  width: z5.number().positive().optional(),
+  /**
+   * Free position on the builder's infinite canvas, in unscaled canvas px. Absent means
+   * "not placed yet" — the canvas then falls back to laying the artboard out in a row.
+   */
+  position: z5.object({
+    x: z5.number(),
+    y: z5.number()
+  }).optional(),
+  document: PageDocumentSchema
+});
+var ProjectDocumentSchema = z5.object({
+  schema: z5.literal(PROJECT_SCHEMA_NAME),
+  version: z5.string().min(1, "Schema version is required").default(CURRENT_PROJECT_SCHEMA_VERSION),
+  metadata: DocumentMetadataSchema.optional(),
+  tracking: TrackingConfigSchema.optional(),
+  artboards: z5.array(ArtboardSchema).min(1, "A project needs at least one artboard"),
+  activeArtboardId: z5.string().optional()
+});
+function isAssetReference(value) {
+  return AssetReferenceSchema.safeParse(value).success;
+}
+function isVariableBinding(value) {
+  return VariableBindingSchema.safeParse(value).success;
+}
+function isActionBinding(value) {
+  return ActionBindingSchema.safeParse(value).success;
+}
+function isAnimationConfig(value) {
+  return AnimationConfigSchema.safeParse(value).success;
+}
+function isProjectDocument(value) {
+  return ProjectDocumentSchema.safeParse(value).success;
+}
+function looksLikeProjectDocument(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value;
+  return candidate.schema === PROJECT_SCHEMA_NAME || Array.isArray(candidate.artboards);
+}
+function isArtboardReferenceNode(node) {
+  return node.type === ARTBOARD_REFERENCE_NODE_TYPE;
+}
+function generateDeterministicNodeId(prefix, indexOrKey) {
+  const cleanPrefix = prefix.toLowerCase().replace(/[^a-z0-9_-]/g, "-");
+  return `${cleanPrefix}_${indexOrKey}`;
+}
+function collectNodeIds(node) {
+  const ids = [node.id];
+  if (node.children && Array.isArray(node.children)) {
+    for (const child of node.children) {
+      ids.push(...collectNodeIds(child));
+    }
+  }
+  return ids;
+}
+function validateNodeIdUniqueness(node) {
+  const allIds = collectNodeIds(node);
+  const seen = /* @__PURE__ */ new Set();
+  const duplicates = /* @__PURE__ */ new Set();
+  for (const id of allIds) {
+    if (seen.has(id)) {
+      duplicates.add(id);
+    } else {
+      seen.add(id);
+    }
+  }
+  return {
+    valid: duplicates.size === 0,
+    duplicateIds: Array.from(duplicates)
+  };
+}
+
+// src/manifest.ts
+import { z as z6 } from "zod";
+var ManifestAssetItemSchema = z6.object({
+  id: z6.string().min(1, "Asset ID cannot be empty"),
+  path: z6.string().min(1, "Asset archive path cannot be empty"),
+  mimeType: z6.string().min(1, "MIME type cannot be empty"),
+  size: z6.number().nonnegative("Asset size must be non-negative"),
+  checksum: z6.string().optional()
+});
+var ManifestSchema = z6.object({
+  schema: z6.literal(SCHEMA_NAME).default(SCHEMA_NAME),
+  schemaVersion: z6.string().min(1, "Schema version cannot be empty").default("1.0.0"),
+  packageVersion: z6.string().min(1, "Package version cannot be empty").default("1.0.0"),
+  builderCompatibility: z6.string().default(">=0.1.0"),
+  requiredComponents: z6.array(z6.string()).default([]),
+  requiredCapabilities: z6.array(z6.string()).default([]),
+  assets: z6.array(ManifestAssetItemSchema).default([]),
+  createdAt: z6.string().optional()
+});
+function isManifest(value) {
+  return ManifestSchema.safeParse(value).success;
+}
+
+// src/template.ts
+import { z as z7 } from "zod";
+var DANGEROUS_URI_PATTERN = /^(javascript:|vbscript:|data:(?!image\/))|<script/i;
+function isSafeThumbnailUrl(url) {
+  if (!url || typeof url !== "string") return false;
+  const trimmed = url.trim();
+  if (trimmed.length === 0) return false;
+  if (DANGEROUS_URI_PATTERN.test(trimmed)) return false;
+  return true;
+}
+var SafeThumbnailUrlSchema = z7.string().min(1, "Thumbnail URL cannot be empty").refine(
+  (url) => isSafeThumbnailUrl(url),
+  { message: "Thumbnail URL contains an unsafe protocol or payload" }
+);
+var SafeThumbnailObjectSchema = z7.object({
+  url: SafeThumbnailUrlSchema,
+  alt: z7.string().optional(),
+  width: z7.number().positive().optional(),
+  height: z7.number().positive().optional()
+});
+var SafeThumbnailSchema = z7.union([
+  AssetReferenceSchema,
+  SafeThumbnailObjectSchema,
+  SafeThumbnailUrlSchema
+]);
+var TemplatePackageRefSchema = z7.object({
+  path: z7.string().optional(),
+  url: SafeThumbnailUrlSchema.optional(),
+  checksum: z7.string().optional(),
+  format: z7.enum(["stora", "json"]).default("stora")
+});
+var TemplateRequirementsSchema = z7.object({
+  requiredComponents: z7.array(z7.string()).default([]),
+  requiredCapabilities: z7.array(z7.string()).default([])
+});
+var TemplateRecordSchema = z7.object({
+  id: z7.string().min(1, "Template ID must be a non-empty string"),
+  name: z7.string().min(1, "Template name must be a non-empty string"),
+  description: z7.string().optional().default(""),
+  category: z7.string().optional().default("general"),
+  tags: z7.array(z7.string()).optional().default([]),
+  thumbnail: SafeThumbnailSchema.optional(),
+  author: z7.string().optional().default(""),
+  version: z7.string().optional().default("1.0.0"),
+  document: PageDocumentSchema.optional(),
+  packageReference: TemplatePackageRefSchema.optional(),
+  requirements: TemplateRequirementsSchema.default({
+    requiredComponents: [],
+    requiredCapabilities: []
+  }),
+  createdAt: z7.string().optional(),
+  updatedAt: z7.string().optional(),
+  custom: z7.record(z7.string(), z7.unknown()).optional()
+});
+function isTemplateRecord(value) {
+  return TemplateRecordSchema.safeParse(value).success;
+}
+function isSafeThumbnail(value) {
+  return SafeThumbnailSchema.safeParse(value).success;
+}
+
+export {
+  TrackingProviderTypeSchema,
+  TrackingDeliverySchema,
+  MetaTrackingProviderConfigSchema,
+  GoogleTrackingProviderConfigSchema,
+  GtmTrackingProviderConfigSchema,
+  TikTokTrackingProviderConfigSchema,
+  CustomTrackingProviderConfigSchema,
+  LEGACY_TRACKING_SECRET_KEYS,
+  TrackingConfigSchema,
+  MetaTrackingSecretsSchema,
+  GoogleTrackingSecretsSchema,
+  TikTokTrackingSecretsSchema,
+  CustomTrackingSecretsSchema,
+  StandardTrackingEventSchema,
+  TrackEventProviderSchema,
+  TrackEventStepPayloadSchema,
+  TRACKING_RELAY_PROTOCOL_VERSION,
+  ServerTrackingEventSchema,
+  TrackingRelayRequestSchema,
+  TrackingRelayProviderResultSchema,
+  TrackingRelayErrorCodeSchema,
+  TrackingRelayResponseSchema,
+  isTrackingConfig,
+  isTrackEventStepPayload,
+  isTrackingRelayRequest,
+  ActionTriggerTypeSchema,
+  ActionTriggerSchema,
+  ActionStepTypeSchema,
+  ConditionOperatorSchema,
+  ActionStepConditionSchema,
+  isSafeActionUrl,
+  ApiRequestStepPayloadSchema,
+  NavigateStepPayloadSchema,
+  SetStateStepPayloadSchema,
+  ResetFormStepPayloadSchema,
+  ShowToastStepPayloadSchema,
+  OpenModalStepPayloadSchema,
+  CloseModalStepPayloadSchema,
+  ToggleModalStepPayloadSchema,
+  CopyClipboardStepPayloadSchema,
+  CustomEventStepPayloadSchema,
+  StepPayloadSchemas,
+  ActionStepSchema,
+  ActionPipelineSchema,
+  isActionTriggerType,
+  isActionStepType,
+  isConditionOperator,
+  isActionStepCondition,
+  isActionStep,
+  isActionPipeline,
+  validateActionStepPayload,
+  sanitizeActionUrl,
+  sanitizeActionString,
+  sanitizeActionValue,
+  sanitizeActionPayload,
+  sanitizeActionStep,
+  sanitizeActionPipeline,
+  ValidationRuleTypeSchema,
+  ValidateOnEventSchema,
+  ValidationRuleSchema,
+  FormFieldBindingSchema,
+  FormConfigSchema,
+  isValidationRuleType,
+  isValidationRule,
+  isValidateOnEvent,
+  isFormFieldBinding,
+  isFormConfig,
+  THEME_TOKEN_GROUPS,
+  THEME_TOKEN_CSS_PREFIX,
+  isSafeThemeTokenKey,
+  isSafeThemeTokenValue,
+  ThemeTokenKeySchema,
+  ThemeTokenValueSchema,
+  ThemeTokenMapSchema,
+  ThemeSchema,
+  themeTokenCssVarName,
+  themeTokenRef,
+  parseThemeTokenRef,
+  mergeThemes,
+  themeToCssVariables,
+  isTheme,
+  SCHEMA_NAME,
+  CURRENT_SCHEMA_VERSION,
+  AssetReferenceSchema,
+  VariableBindingSchema,
+  ActionBindingSchema,
+  StyleValueSchema,
+  StyleDefinitionSchema,
+  PseudoStateStylesSchema,
+  ResponsiveStylesSchema,
+  AnimationConfigSchema,
+  DEFAULT_ANIMATION_CONFIG,
+  NodeSchema,
+  RootPageNodeSchema,
+  DocumentMetadataSchema,
+  PageDocumentSchema,
+  PROJECT_SCHEMA_NAME,
+  CURRENT_PROJECT_SCHEMA_VERSION,
+  ARTBOARD_REFERENCE_NODE_TYPE,
+  ArtboardTypeSchema,
+  ArtboardSchema,
+  ProjectDocumentSchema,
+  isAssetReference,
+  isVariableBinding,
+  isActionBinding,
+  isAnimationConfig,
+  isProjectDocument,
+  looksLikeProjectDocument,
+  isArtboardReferenceNode,
+  generateDeterministicNodeId,
+  collectNodeIds,
+  validateNodeIdUniqueness,
+  ManifestAssetItemSchema,
+  ManifestSchema,
+  isManifest,
+  isSafeThumbnailUrl,
+  SafeThumbnailUrlSchema,
+  SafeThumbnailObjectSchema,
+  SafeThumbnailSchema,
+  TemplatePackageRefSchema,
+  TemplateRequirementsSchema,
+  TemplateRecordSchema,
+  isTemplateRecord,
+  isSafeThumbnail
+};
+//# sourceMappingURL=chunk-MT3M7D67.js.map