@pablo2410/core-server 0.6.0 → 0.7.0

package/dist/auth.d.ts

@@ -1,6 +1,12 @@
-import * as express from 'express';
 import { Request, CookieOptions } from 'express';
 
+/**
+ * Types for the createSubdomainAuth factory.
+ *
+ * These types define the contract between the shared auth SDK and each
+ * subdomain's local database, role mapping, and portal enrichment logic.
+ */
+
 /** Payload stored inside the session JWT. */
 interface SessionPayload {
     openId: string;
@@ -24,42 +30,14 @@ interface PortalUser {
     companyId?: number;
     siteId?: number;
 }
-interface ExchangeTokenResponse {
-    accessToken: string;
-    tokenType: string;
-    expiresIn: number;
-    refreshToken?: string;
-    scope: string;
-    idToken: string;
-}
-interface GetUserInfoResponse {
-    openId: string;
-    projectId: string;
-    name: string;
-    email?: string | null;
-    platform?: string | null;
-    loginMethod?: string | null;
-}
-interface GetUserInfoWithJwtResponse {
-    openId: string;
-    projectId: string;
-    name: string;
-    email?: string | null;
-    platform?: string | null;
-    loginMethod?: string | null;
-}
 /** Environment variables required by the auth SDK. */
 interface AuthEnv {
-    /** Manus app ID (VITE_APP_ID) */
-    appId: string;
     /** JWT secret for signing local sessions (JWT_SECRET) */
     jwtSecret: string;
     /** Shared portal JWT secret for cross-subdomain SSO (PORTAL_JWT_SECRET) */
     portalJwtSecret: string;
     /** Cookie domain for cross-subdomain sharing, e.g. ".oplyticsdigital.net" */
     cookieDomain: string;
-    /** Manus OAuth server URL */
-    oAuthServerUrl: string;
     /** Owner's openId for auto-admin assignment */
     ownerOpenId: string;
     /** Portal API base URL for user enrichment */
@@ -99,7 +77,7 @@ interface UpsertUserPayload {
  * This decouples the auth SDK from any specific ORM or schema.
  */
 interface DbAdapter<TUser extends BaseUser = BaseUser> {
-    /** Find a user by their Manus openId. Returns null/undefined if not found. */
+    /** Find a user by their openId. Returns null/undefined if not found. */
     getUserByOpenId(openId: string): Promise<TUser | null | undefined>;
     /** Create or update a user record. */
     upsertUser(payload: UpsertUserPayload): Promise<void>;
@@ -169,20 +147,12 @@ interface SubdomainAuth<TUser extends BaseUser = BaseUser> {
      * from portal → backfill enterprise. Returns the local user record.
      */
     authenticateRequest(req: Request): Promise<TUser>;
-    /** Exchange an OAuth authorization code for tokens. */
-    exchangeCodeForToken(code: string, state: string): Promise<ExchangeTokenResponse>;
-    /** Get user info from Manus OAuth using an access token. */
-    getUserInfo(accessToken: string): Promise<GetUserInfoResponse>;
-    /** Get user info from Manus OAuth using a JWT. */
-    getUserInfoWithJwt(jwtToken: string): Promise<GetUserInfoWithJwtResponse>;
     /** Fetch a user from the portal API by openId. */
     getPortalUser(openId: string): Promise<PortalUser | null>;
     /** Get cookie options for setting session cookies. */
     getSessionCookieOptions(req: Request): Pick<CookieOptions, "domain" | "httpOnly" | "path" | "sameSite" | "secure">;
     /** Validate a returnTo URL to prevent open-redirect attacks. */
     isValidReturnUrl(url: string): boolean;
-    /** Register the /api/oauth/callback route on an Express app. */
-    registerOAuthRoutes(app: express.Express): void;
 }
 
 /**
@@ -194,12 +164,10 @@ interface SubdomainAuth<TUser extends BaseUser = BaseUser> {
  *   - Portal API user enrichment with X-Service-Key header
  *   - Auto-create user from JWT payload if not in local DB
  *   - Enterprise backfill from portal API
- *   - Manus OAuth code exchange and user info
- *   - OAuth callback route registration
  *
  * Based on SQDCP's battle-tested sdk.ts + cookies.ts.
  */
 
 declare function createSubdomainAuth<TUser extends BaseUser = BaseUser>(config: SubdomainAuthConfig<TUser>): SubdomainAuth<TUser>;
 
-export { type AuthEnv, type BaseUser, type DbAdapter, type ExchangeTokenResponse, type GetUserInfoResponse, type GetUserInfoWithJwtResponse, type PortalUser, type RoleMapper, type SessionPayload, type SubdomainAuth, type SubdomainAuthConfig, type UpsertUserPayload, createSubdomainAuth };
+export { type AuthEnv, type BaseUser, type DbAdapter, type PortalUser, type RoleMapper, type SessionPayload, type SubdomainAuth, type SubdomainAuthConfig, type UpsertUserPayload, createSubdomainAuth };

package/dist/auth.js

@@ -1,6 +1,6 @@
 import {
   createSubdomainAuth
-} from "./chunk-LH6QZJM4.js";
+} from "./chunk-B63ROBSD.js";
 export {
   createSubdomainAuth
 };

package/dist/{chunk-LH6QZJM4.js → chunk-B63ROBSD.js}

@@ -1,26 +1,7 @@
 // src/auth/createSubdomainAuth.ts
 var DEFAULT_COOKIE_NAME = "app_session_id";
 var ONE_YEAR_MS = 1e3 * 60 * 60 * 24 * 365;
-var AXIOS_TIMEOUT_MS = 3e4;
-var EXCHANGE_TOKEN_PATH = "/webdev.v1.WebDevAuthPublicService/ExchangeToken";
-var GET_USER_INFO_PATH = "/webdev.v1.WebDevAuthPublicService/GetUserInfo";
-var GET_USER_INFO_WITH_JWT_PATH = "/webdev.v1.WebDevAuthPublicService/GetUserInfoWithJwt";
 var isNonEmptyString = (value) => typeof value === "string" && value.length > 0;
-function deriveLoginMethod(platforms, fallback) {
-  if (fallback && fallback.length > 0) return fallback;
-  if (!Array.isArray(platforms) || platforms.length === 0) return null;
-  const set = new Set(
-    platforms.filter((p) => typeof p === "string")
-  );
-  if (set.has("REGISTERED_PLATFORM_EMAIL")) return "email";
-  if (set.has("REGISTERED_PLATFORM_GOOGLE")) return "google";
-  if (set.has("REGISTERED_PLATFORM_APPLE")) return "apple";
-  if (set.has("REGISTERED_PLATFORM_MICROSOFT") || set.has("REGISTERED_PLATFORM_AZURE"))
-    return "microsoft";
-  if (set.has("REGISTERED_PLATFORM_GITHUB")) return "github";
-  const first = Array.from(set)[0];
-  return first ? first.toLowerCase() : null;
-}
 function createSubdomainAuth(config) {
   const {
     env,
@@ -59,16 +40,6 @@ function createSubdomainAuth(config) {
     }
     return _axios;
   }
-  let oauthClient = null;
-  async function getOAuthClient() {
-    if (oauthClient) return oauthClient;
-    const axios = await getAxios();
-    oauthClient = axios.create({
-      baseURL: env.oAuthServerUrl,
-      timeout: AXIOS_TIMEOUT_MS
-    });
-    return oauthClient;
-  }
   let portalClient = null;
   function getPortalClient() {
     if (portalClient) return portalClient;
@@ -143,7 +114,7 @@ function createSubdomainAuth(config) {
   }
   async function createSessionToken(openId, options = {}) {
     return signSession(
-      { openId, appId: env.appId, name: options.name || "" },
+      { openId, appId: serviceName, name: options.name || "" },
       options
     );
   }
@@ -251,44 +222,6 @@ function createSubdomainAuth(config) {
       portalUserId: portalUser.id
     };
   }
-  async function exchangeCodeForToken(code, state) {
-    const client = await getOAuthClient();
-    const redirectUri = atob(state);
-    const { data } = await client.post(
-      EXCHANGE_TOKEN_PATH,
-      {
-        clientId: env.appId,
-        grantType: "authorization_code",
-        code,
-        redirectUri
-      }
-    );
-    return data;
-  }
-  async function getUserInfo(accessToken) {
-    const client = await getOAuthClient();
-    const { data } = await client.post(
-      GET_USER_INFO_PATH,
-      { accessToken }
-    );
-    const loginMethod = deriveLoginMethod(
-      data?.platforms,
-      data?.platform ?? data.platform ?? null
-    );
-    return { ...data, platform: loginMethod, loginMethod };
-  }
-  async function getUserInfoWithJwt(jwtToken) {
-    const client = await getOAuthClient();
-    const { data } = await client.post(
-      GET_USER_INFO_WITH_JWT_PATH,
-      { jwtToken, projectId: env.appId }
-    );
-    const loginMethod = deriveLoginMethod(
-      data?.platforms,
-      data?.platform ?? data.platform ?? null
-    );
-    return { ...data, platform: loginMethod, loginMethod };
-  }
   async function authenticateRequest(req) {
     const cookie = await getCookie();
     const cookies = req.headers.cookie ? new Map(Object.entries(cookie.parse(req.headers.cookie))) : /* @__PURE__ */ new Map();
@@ -339,26 +272,10 @@ function createSubdomainAuth(config) {
           user = await db.getUserByOpenId(sessionUserId) ?? null;
         }
       } catch (error) {
-        try {
-          const userInfo = await getUserInfoWithJwt(sessionCookie ?? "");
-          await db.upsertUser({
-            openId: userInfo.openId,
-            name: userInfo.name || null,
-            email: userInfo.email ?? null,
-            loginMethod: userInfo.loginMethod ?? userInfo.platform ?? null,
-            lastSignedIn: signedInAt
-          });
-          user = await db.getUserByOpenId(userInfo.openId) ?? null;
-        } catch (oauthError) {
-          console.error(
-            `${tag} All user sync methods failed:`,
-            error,
-            oauthError
-          );
-          throw Object.assign(new Error("Failed to sync user info"), {
-            statusCode: 403
-          });
-        }
+        console.error(`${tag} Failed to sync user info:`, error);
+        throw Object.assign(new Error("Failed to sync user info"), {
+          statusCode: 403
+        });
       }
     }
     if (!user) {
@@ -391,62 +308,17 @@ function createSubdomainAuth(config) {
     });
     return user;
   }
-  function registerOAuthRoutes(app) {
-    app.get(
-      "/api/oauth/callback",
-      async (req, res) => {
-        const code = typeof req.query.code === "string" ? req.query.code : void 0;
-        const state = typeof req.query.state === "string" ? req.query.state : void 0;
-        if (!code || !state) {
-          res.status(400).json({ error: "code and state are required" });
-          return;
-        }
-        try {
-          const tokenResponse = await exchangeCodeForToken(code, state);
-          const userInfo = await getUserInfo(tokenResponse.accessToken);
-          if (!userInfo.openId) {
-            res.status(400).json({ error: "openId missing from user info" });
-            return;
-          }
-          await db.upsertUser({
-            openId: userInfo.openId,
-            name: userInfo.name || null,
-            email: userInfo.email ?? null,
-            loginMethod: userInfo.loginMethod ?? userInfo.platform ?? null,
-            lastSignedIn: /* @__PURE__ */ new Date()
-          });
-          const sessionToken = await createSessionToken(userInfo.openId, {
-            name: userInfo.name || "",
-            expiresInMs: sessionExpiryMs
-          });
-          const cookieOptions = getSessionCookieOptions(req);
-          res.cookie(cookieName, sessionToken, {
-            ...cookieOptions,
-            maxAge: sessionExpiryMs
-          });
-          res.redirect(302, "/");
-        } catch (error) {
-          console.error(`${tag} OAuth callback failed`, error);
-          res.status(500).json({ error: "OAuth callback failed" });
-        }
-      }
-    );
-  }
   return {
     verifySession,
     createSessionToken,
     authenticateRequest,
-    exchangeCodeForToken,
-    getUserInfo,
-    getUserInfoWithJwt,
     getPortalUser,
     getSessionCookieOptions,
-    isValidReturnUrl,
-    registerOAuthRoutes
+    isValidReturnUrl
   };
 }
 
 export {
   createSubdomainAuth
 };
-//# sourceMappingURL=chunk-LH6QZJM4.js.map
+//# sourceMappingURL=chunk-B63ROBSD.js.map

package/dist/chunk-B63ROBSD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth/createSubdomainAuth.ts"],"sourcesContent":["/**\n * createSubdomainAuth — shared SSO auth factory for Oplytics.digital subdomains.\n *\n * Encapsulates:\n *   - JWT session verification (PORTAL_JWT_SECRET first, fallback to JWT_SECRET)\n *   - Cookie domain handling via COOKIE_DOMAIN env var\n *   - Portal API user enrichment with X-Service-Key header\n *   - Auto-create user from JWT payload if not in local DB\n *   - Enterprise backfill from portal API\n *\n * Based on SQDCP's battle-tested sdk.ts + cookies.ts.\n */\n\nimport type { Request, CookieOptions } from \"express\";\nimport type {\n  AuthEnv,\n  BaseUser,\n  DbAdapter,\n  PortalUser,\n  RoleMapper,\n  SessionPayload,\n  SubdomainAuth,\n  SubdomainAuthConfig,\n} from \"./types\";\n\n// ─── Constants ──────────────────────────────────────────────────────\n\nconst DEFAULT_COOKIE_NAME = \"app_session_id\";\nconst ONE_YEAR_MS = 1000 * 60 * 60 * 24 * 365;\n\n// ─── Helpers ────────────────────────────────────────────────────────\n\nconst isNonEmptyString = (value: unknown): value is string =>\n  typeof value === \"string\" && value.length > 0;\n\n// ─── Factory ────────────────────────────────────────────────────────\n\nexport function createSubdomainAuth<TUser extends BaseUser = BaseUser>(\n  config: SubdomainAuthConfig<TUser>\n): SubdomainAuth<TUser> {\n  const {\n    env,\n    db,\n    // Default to identity (no role translation). Subdomains should adopt the\n    // Portal's canonical roles verbatim; a custom mapper is legacy.\n    mapRole = (role: string) => role,\n    userSource = \"db\",\n    cookieName = DEFAULT_COOKIE_NAME,\n    sessionExpiryMs = ONE_YEAR_MS,\n    serviceName = \"Subdomain\",\n    portalUserCacheTtlMs = 30_000,\n  } = config;\n\n  const tag = `[${serviceName} Auth]`;\n\n  if (userSource === \"db\" && !db) {\n    throw new Error(\n      `${tag} userSource \"db\" requires a db adapter in createSubdomainAuth config`\n    );\n  }\n\n  // Short-TTL cache of Portal users (portal mode), keyed by openId, so we don't\n  // hit the Portal on every request.\n  const portalUserCache = new Map<string, { user: PortalUser; at: number }>();\n\n  // ── Lazy-loaded dependencies (jose, cookie, axios) ──────────────\n  // We use dynamic imports so consumers don't need to install these\n  // as peer deps if they only use other core-server features.\n\n  let _jose: typeof import(\"jose\") | null = null;\n  async function getJose() {\n    if (!_jose) _jose = await import(\"jose\");\n    return _jose;\n  }\n\n  let _cookie: typeof import(\"cookie\") | null = null;\n  async function getCookie() {\n    if (!_cookie) _cookie = await import(\"cookie\");\n    return _cookie;\n  }\n\n  let _axios: typeof import(\"axios\").default | null = null;\n  async function getAxios() {\n    if (!_axios) {\n      const mod = await import(\"axios\");\n      _axios = mod.default;\n    }\n    return _axios;\n  }\n\n  // ── Portal API client ──────────────────────────────────────────\n\n  let portalClient: import(\"axios\").AxiosInstance | null = null;\n  function getPortalClient() {\n    if (portalClient) return portalClient;\n    // Synchronous check — we only create if we have the URL\n    if (!env.portalApiUrl) return null;\n    // We need axios synchronously here, but it should already be loaded\n    // by the time portal client is needed (after authenticateRequest calls getAxios)\n    return null; // Will be created lazily in async context\n  }\n\n  async function getPortalClientAsync() {\n    if (portalClient) return portalClient;\n    if (!env.portalApiUrl) return null;\n    const axios = await getAxios();\n    portalClient = axios.create({\n      baseURL: env.portalApiUrl,\n      timeout: 10_000,\n      headers: {\n        \"Content-Type\": \"application/json\",\n        ...(env.portalApiKey ? { \"X-Service-Key\": env.portalApiKey } : {}),\n      },\n    });\n    return portalClient;\n  }\n\n  // ── JWT Secrets ────────────────────────────────────────────────\n\n  function getPortalSecret() {\n    const secret = env.portalJwtSecret;\n    if (!secret) throw new Error(\"PORTAL_JWT_SECRET is not configured\");\n    return new TextEncoder().encode(secret);\n  }\n\n  function getSessionSecret() {\n    // Prefer portalJwtSecret for signing so cookies work cross-subdomain\n    const secret = env.portalJwtSecret || env.jwtSecret;\n    return new TextEncoder().encode(secret);\n  }\n\n  // ── Cookie Helpers ─────────────────────────────────────────────\n\n  function getCookieDomain(): string | undefined {\n    return env.cookieDomain || undefined;\n  }\n\n  function isSecureRequest(req: Request): boolean {\n    if (req.protocol === \"https\") return true;\n    const forwardedProto = req.headers[\"x-forwarded-proto\"];\n    if (!forwardedProto) return false;\n    const protoList = Array.isArray(forwardedProto)\n      ? forwardedProto\n      : forwardedProto.split(\",\");\n    return protoList.some((p) => p.trim().toLowerCase() === \"https\");\n  }\n\n  function getSessionCookieOptions(\n    req: Request\n  ): Pick<\n    CookieOptions,\n    \"domain\" | \"httpOnly\" | \"path\" | \"sameSite\" | \"secure\"\n  > {\n    const secure = isSecureRequest(req);\n    const domain = getCookieDomain();\n    return {\n      domain,\n      httpOnly: true,\n      path: \"/\",\n      sameSite: \"lax\",\n      secure,\n    };\n  }\n\n  function isValidReturnUrl(url: string): boolean {\n    if (url.startsWith(\"/\") && !url.startsWith(\"//\")) return true;\n    try {\n      const parsed = new URL(url);\n      if (parsed.protocol !== \"https:\") return false;\n      return (\n        parsed.hostname === \"oplyticsdigital.net\" ||\n        parsed.hostname.endsWith(\".oplyticsdigital.net\")\n      );\n    } catch {\n      return false;\n    }\n  }\n\n  // ── Session Token ──────────────────────────────────────────────\n\n  async function signSession(\n    payload: SessionPayload,\n    options: { expiresInMs?: number } = {}\n  ): Promise<string> {\n    const jose = await getJose();\n    const issuedAt = Date.now();\n    const expiresInMs = options.expiresInMs ?? sessionExpiryMs;\n    const expirationSeconds = Math.floor((issuedAt + expiresInMs) / 1000);\n    const secretKey = getSessionSecret();\n\n    return new jose.SignJWT({\n      openId: payload.openId,\n      appId: payload.appId,\n      name: payload.name,\n    })\n      .setProtectedHeader({ alg: \"HS256\", typ: \"JWT\" })\n      .setExpirationTime(expirationSeconds)\n      .sign(secretKey);\n  }\n\n  async function createSessionToken(\n    openId: string,\n    options: { expiresInMs?: number; name?: string } = {}\n  ): Promise<string> {\n    return signSession(\n      { openId, appId: serviceName, name: options.name || \"\" },\n      options\n    );\n  }\n\n  // ── Session Verification ───────────────────────────────────────\n\n  async function verifySession(\n    cookieValue: string | undefined | null\n  ): Promise<SessionPayload | null> {\n    if (!cookieValue) {\n      console.warn(`${tag} Missing session cookie`);\n      return null;\n    }\n\n    const jose = await getJose();\n\n    // Try PORTAL_JWT_SECRET first (cross-subdomain SSO)\n    if (env.portalJwtSecret) {\n      try {\n        const portalKey = getPortalSecret();\n        const { payload } = await jose.jwtVerify(cookieValue, portalKey, {\n          algorithms: [\"HS256\"],\n        });\n        const { openId, appId, name } = payload as Record<string, unknown>;\n        if (\n          !isNonEmptyString(openId) ||\n          !isNonEmptyString(appId) ||\n          !isNonEmptyString(name)\n        ) {\n          console.warn(`${tag} Portal JWT payload missing required fields`);\n          return null;\n        }\n        return { openId, appId, name };\n      } catch {\n        // Portal secret didn't work — fall through to local secret\n      }\n    }\n\n    // Fallback: try local JWT_SECRET\n    try {\n      const secretKey = getSessionSecret();\n      const { payload } = await jose.jwtVerify(cookieValue, secretKey, {\n        algorithms: [\"HS256\"],\n      });\n      const { openId, appId, name } = payload as Record<string, unknown>;\n      if (\n        !isNonEmptyString(openId) ||\n        !isNonEmptyString(appId) ||\n        !isNonEmptyString(name)\n      ) {\n        console.warn(`${tag} Session payload missing required fields`);\n        return null;\n      }\n      return { openId, appId, name };\n    } catch (error) {\n      console.warn(\n        `${tag} Session verification failed:`,\n        (error as Error).message\n      );\n      return null;\n    }\n  }\n\n  // ── Portal API ─────────────────────────────────────────────────\n\n  async function getPortalUser(openId: string): Promise<PortalUser | null> {\n    try {\n      const client = await getPortalClientAsync();\n      if (!client) return null;\n      // The Portal Service API is under /api/service (base URL is the origin,\n      // e.g. https://portal.oplyticsdigital.net). Must include the /api/service\n      // prefix — omitting it 404s and silently strands enterprise resolution.\n      const { data } = await client.get<PortalUser>(\n        `/api/service/users/by-openid/${encodeURIComponent(openId)}`\n      );\n      return data ?? null;\n    } catch (err: unknown) {\n      const status = (err as any)?.response?.status;\n      if (status === 401) {\n        console.error(\n          `${tag} Portal API key revoked (401) — enrichment disabled`\n        );\n      } else if (status === 404) {\n        // User not found in portal — normal for first-time users\n      } else {\n        console.warn(\n          `${tag} Portal user lookup failed:`,\n          (err as Error).message\n        );\n      }\n      return null;\n    }\n  }\n\n  /** Portal user lookup with a short-TTL cache (portal mode). */\n  async function getPortalUserCached(\n    openId: string\n  ): Promise<PortalUser | null> {\n    if (portalUserCacheTtlMs > 0) {\n      const hit = portalUserCache.get(openId);\n      if (hit && Date.now() - hit.at < portalUserCacheTtlMs) {\n        return hit.user;\n      }\n    }\n    const user = await getPortalUser(openId);\n    if (user && portalUserCacheTtlMs > 0) {\n      portalUserCache.set(openId, { user, at: Date.now() });\n    }\n    return user;\n  }\n\n  /**\n   * Build ctx.user entirely from the Portal record — no local persistence.\n   * The single source of truth. ctx.user.id is the PORTAL user id. Roles and\n   * enterprise come from the Portal verbatim (no mapping).\n   *\n   * On a genuine Portal outage (the by-openid lookup returns null) we keep the\n   * user authenticated using their verified session claims, with role/enterprise\n   * unresolved, rather than throwing. Throwing here would make createContext (in\n   * every subdomain) swallow the error into `user = null`, which the AuthGate\n   * renders as the Sign In screen — i.e. a transient Portal blip would log the\n   * user out. Their session cookie is already valid; keep them in, degraded,\n   * until the Portal recovers. (Enterprise-scoped procedures will 403 during the\n   * outage; client array-guards keep pages from crashing.)\n   */\n  async function resolvePortalUser(\n    openId: string,\n    session: SessionPayload\n  ): Promise<TUser> {\n    const portalUser = await getPortalUserCached(openId);\n\n    if (!portalUser) {\n      console.warn(\n        `${tag} Portal user unavailable for ${openId} — keeping session (role/enterprise unresolved until Portal recovers)`\n      );\n      return {\n        id: 0,\n        openId,\n        name: session.name ?? null,\n        email: null,\n        role: \"\",\n        enterpriseId: null,\n        portalUserId: null,\n      } as unknown as TUser;\n    }\n\n    const enterpriseId =\n      portalUser.enterpriseId ?? portalUser.companyId ?? null;\n    return {\n      id: portalUser.id,\n      openId: portalUser.openId ?? openId,\n      name: portalUser.name ?? session.name ?? null,\n      email: portalUser.email ?? null,\n      role: portalUser.role,\n      enterpriseId,\n      portalUserId: portalUser.id,\n    } as unknown as TUser;\n  }\n\n  // ── Authenticate Request ───────────────────────────────────────\n\n  async function authenticateRequest(req: Request): Promise<TUser> {\n    const cookie = await getCookie();\n    const cookies = req.headers.cookie\n      ? new Map(Object.entries(cookie.parse(req.headers.cookie)))\n      : new Map<string, string>();\n\n    const sessionCookie = cookies.get(cookieName);\n    const session = await verifySession(sessionCookie);\n\n    if (!session) {\n      throw Object.assign(new Error(\"Invalid session cookie\"), {\n        statusCode: 403,\n      });\n    }\n\n    const sessionUserId = session.openId;\n    const signedInAt = new Date();\n\n    // ── Portal mode: single source of truth, no local mirror ────\n    if (userSource === \"portal\") {\n      return await resolvePortalUser(sessionUserId, session);\n    }\n\n    let user = (await db!.getUserByOpenId(sessionUserId)) ?? null;\n\n    // ── Auto-create user from verified JWT ──────────────────────\n    if (!user) {\n      try {\n        // Try portal API first for richer user info\n        const portalUser = await getPortalUser(sessionUserId);\n\n        if (portalUser) {\n          console.log(\n            `${tag} Cross-subdomain SSO: creating user from portal (${portalUser.email || sessionUserId})`\n          );\n          // Portal returns `enterpriseId`; `companyId` is a legacy alias.\n          const portalEnterpriseId =\n            portalUser.enterpriseId ?? portalUser.companyId ?? null;\n          await db!.upsertUser({\n            openId: sessionUserId,\n            name: portalUser.name || session.name || null,\n            email: portalUser.email ?? null,\n            loginMethod: \"portal-sso\",\n            role: mapRole(portalUser.role),\n            lastSignedIn: signedInAt,\n            ...(portalEnterpriseId != null\n              ? {\n                  enterpriseId: portalEnterpriseId,\n                  portalUserId: portalUser.id,\n                }\n              : {}),\n          });\n          user = (await db!.getUserByOpenId(sessionUserId)) ?? null;\n        } else {\n          // Portal unavailable — create from JWT payload\n          console.log(\n            `${tag} Cross-subdomain SSO: creating user from JWT payload (${sessionUserId})`\n          );\n          await db!.upsertUser({\n            openId: sessionUserId,\n            name: session.name || null,\n            loginMethod: \"portal-sso\",\n            lastSignedIn: signedInAt,\n          });\n          user = (await db!.getUserByOpenId(sessionUserId)) ?? null;\n        }\n      } catch (error) {\n        console.error(`${tag} Failed to sync user info:`, error);\n        throw Object.assign(new Error(\"Failed to sync user info\"), {\n          statusCode: 403,\n        });\n      }\n    }\n\n    if (!user) {\n      throw Object.assign(new Error(\"User not found\"), { statusCode: 403 });\n    }\n\n    // ── Enterprise backfill ─────────────────────────────────────\n    if (user.enterpriseId === null) {\n      try {\n        const portalUser = await getPortalUser(user.openId);\n        // Portal returns `enterpriseId`; `companyId` is a legacy alias.\n        const portalEnterpriseId =\n          portalUser?.enterpriseId ?? portalUser?.companyId ?? null;\n        if (portalEnterpriseId != null) {\n          console.log(\n            `${tag} Backfilling enterpriseId=${portalEnterpriseId} for user ${user.id}`\n          );\n          await db!.updateUserFields(user.id, {\n            enterpriseId: portalEnterpriseId,\n            ...(portalUser?.id ? { portalUserId: portalUser.id } : {}),\n          });\n          user = (await db!.getUserByOpenId(user.openId)) ?? user;\n        }\n      } catch (backfillError) {\n        console.warn(\n          `${tag} Failed to backfill enterpriseId for user ${user.id}:`,\n          backfillError\n        );\n        // Non-fatal — user can still proceed\n      }\n    }\n\n    // Touch lastSignedIn\n    await db!.upsertUser({\n      openId: user.openId,\n      lastSignedIn: signedInAt,\n    });\n\n    return user;\n  }\n\n  // ── Return public API ──────────────────────────────────────────\n\n  return {\n    verifySession,\n    createSessionToken,\n    authenticateRequest,\n    getPortalUser,\n    getSessionCookieOptions,\n    isValidReturnUrl,\n  };\n}\n"],"mappings":";AA2BA,IAAM,sBAAsB;AAC5B,IAAM,cAAc,MAAO,KAAK,KAAK,KAAK;AAI1C,IAAM,mBAAmB,CAAC,UACxB,OAAO,UAAU,YAAY,MAAM,SAAS;AAIvC,SAAS,oBACd,QACsB;AACtB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA;AAAA;AAAA,IAGA,UAAU,CAAC,SAAiB;AAAA,IAC5B,aAAa;AAAA,IACb,aAAa;AAAA,IACb,kBAAkB;AAAA,IAClB,cAAc;AAAA,IACd,uBAAuB;AAAA,EACzB,IAAI;AAEJ,QAAM,MAAM,IAAI,WAAW;AAE3B,MAAI,eAAe,QAAQ,CAAC,IAAI;AAC9B,UAAM,IAAI;AAAA,MACR,GAAG,GAAG;AAAA,IACR;AAAA,EACF;AAIA,QAAM,kBAAkB,oBAAI,IAA8C;AAM1E,MAAI,QAAsC;AAC1C,iBAAe,UAAU;AACvB,QAAI,CAAC,MAAO,SAAQ,MAAM,OAAO,MAAM;AACvC,WAAO;AAAA,EACT;AAEA,MAAI,UAA0C;AAC9C,iBAAe,YAAY;AACzB,QAAI,CAAC,QAAS,WAAU,MAAM,OAAO,QAAQ;AAC7C,WAAO;AAAA,EACT;AAEA,MAAI,SAAgD;AACpD,iBAAe,WAAW;AACxB,QAAI,CAAC,QAAQ;AACX,YAAM,MAAM,MAAM,OAAO,OAAO;AAChC,eAAS,IAAI;AAAA,IACf;AACA,WAAO;AAAA,EACT;AAIA,MAAI,eAAqD;AACzD,WAAS,kBAAkB;AACzB,QAAI,aAAc,QAAO;AAEzB,QAAI,CAAC,IAAI,aAAc,QAAO;AAG9B,WAAO;AAAA,EACT;AAEA,iBAAe,uBAAuB;AACpC,QAAI,aAAc,QAAO;AACzB,QAAI,CAAC,IAAI,aAAc,QAAO;AAC9B,UAAM,QAAQ,MAAM,SAAS;AAC7B,mBAAe,MAAM,OAAO;AAAA,MAC1B,SAAS,IAAI;AAAA,MACb,SAAS;AAAA,MACT,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAI,IAAI,eAAe,EAAE,iBAAiB,IAAI,aAAa,IAAI,CAAC;AAAA,MAClE;AAAA,IACF,CAAC;AACD,WAAO;AAAA,EACT;AAIA,WAAS,kBAAkB;AACzB,UAAM,SAAS,IAAI;AACnB,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,qCAAqC;AAClE,WAAO,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,EACxC;AAEA,WAAS,mBAAmB;AAE1B,UAAM,SAAS,IAAI,mBAAmB,IAAI;AAC1C,WAAO,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,EACxC;AAIA,WAAS,kBAAsC;AAC7C,WAAO,IAAI,gBAAgB;AAAA,EAC7B;AAEA,WAAS,gBAAgB,KAAuB;AAC9C,QAAI,IAAI,aAAa,QAAS,QAAO;AACrC,UAAM,iBAAiB,IAAI,QAAQ,mBAAmB;AACtD,QAAI,CAAC,eAAgB,QAAO;AAC5B,UAAM,YAAY,MAAM,QAAQ,cAAc,IAC1C,iBACA,eAAe,MAAM,GAAG;AAC5B,WAAO,UAAU,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,MAAM,OAAO;AAAA,EACjE;AAEA,WAAS,wBACP,KAIA;AACA,UAAM,SAAS,gBAAgB,GAAG;AAClC,UAAM,SAAS,gBAAgB;AAC/B,WAAO;AAAA,MACL;AAAA,MACA,UAAU;AAAA,MACV,MAAM;AAAA,MACN,UAAU;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAEA,WAAS,iBAAiB,KAAsB;AAC9C,QAAI,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,WAAW,IAAI,EAAG,QAAO;AACzD,QAAI;AACF,YAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,UAAI,OAAO,aAAa,SAAU,QAAO;AACzC,aACE,OAAO,aAAa,yBACpB,OAAO,SAAS,SAAS,sBAAsB;AAAA,IAEnD,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAIA,iBAAe,YACb,SACA,UAAoC,CAAC,GACpB;AACjB,UAAM,OAAO,MAAM,QAAQ;AAC3B,UAAM,WAAW,KAAK,IAAI;AAC1B,UAAM,cAAc,QAAQ,eAAe;AAC3C,UAAM,oBAAoB,KAAK,OAAO,WAAW,eAAe,GAAI;AACpE,UAAM,YAAY,iBAAiB;AAEnC,WAAO,IAAI,KAAK,QAAQ;AAAA,MACtB,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ;AAAA,IAChB,CAAC,EACE,mBAAmB,EAAE,KAAK,SAAS,KAAK,MAAM,CAAC,EAC/C,kBAAkB,iBAAiB,EACnC,KAAK,SAAS;AAAA,EACnB;AAEA,iBAAe,mBACb,QACA,UAAmD,CAAC,GACnC;AACjB,WAAO;AAAA,MACL,EAAE,QAAQ,OAAO,aAAa,MAAM,QAAQ,QAAQ,GAAG;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AAIA,iBAAe,cACb,aACgC;AAChC,QAAI,CAAC,aAAa;AAChB,cAAQ,KAAK,GAAG,GAAG,yBAAyB;AAC5C,aAAO;AAAA,IACT;AAEA,UAAM,OAAO,MAAM,QAAQ;AAG3B,QAAI,IAAI,iBAAiB;AACvB,UAAI;AACF,cAAM,YAAY,gBAAgB;AAClC,cAAM,EAAE,QAAQ,IAAI,MAAM,KAAK,UAAU,aAAa,WAAW;AAAA,UAC/D,YAAY,CAAC,OAAO;AAAA,QACtB,CAAC;AACD,cAAM,EAAE,QAAQ,OAAO,KAAK,IAAI;AAChC,YACE,CAAC,iBAAiB,MAAM,KACxB,CAAC,iBAAiB,KAAK,KACvB,CAAC,iBAAiB,IAAI,GACtB;AACA,kBAAQ,KAAK,GAAG,GAAG,6CAA6C;AAChE,iBAAO;AAAA,QACT;AACA,eAAO,EAAE,QAAQ,OAAO,KAAK;AAAA,MAC/B,QAAQ;AAAA,MAER;AAAA,IACF;AAGA,QAAI;AACF,YAAM,YAAY,iBAAiB;AACnC,YAAM,EAAE,QAAQ,IAAI,MAAM,KAAK,UAAU,aAAa,WAAW;AAAA,QAC/D,YAAY,CAAC,OAAO;AAAA,MACtB,CAAC;AACD,YAAM,EAAE,QAAQ,OAAO,KAAK,IAAI;AAChC,UACE,CAAC,iBAAiB,MAAM,KACxB,CAAC,iBAAiB,KAAK,KACvB,CAAC,iBAAiB,IAAI,GACtB;AACA,gBAAQ,KAAK,GAAG,GAAG,0CAA0C;AAC7D,eAAO;AAAA,MACT;AACA,aAAO,EAAE,QAAQ,OAAO,KAAK;AAAA,IAC/B,SAAS,OAAO;AACd,cAAQ;AAAA,QACN,GAAG,GAAG;AAAA,QACL,MAAgB;AAAA,MACnB;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAIA,iBAAe,cAAc,QAA4C;AACvE,QAAI;AACF,YAAM,SAAS,MAAM,qBAAqB;AAC1C,UAAI,CAAC,OAAQ,QAAO;AAIpB,YAAM,EAAE,KAAK,IAAI,MAAM,OAAO;AAAA,QAC5B,gCAAgC,mBAAmB,MAAM,CAAC;AAAA,MAC5D;AACA,aAAO,QAAQ;AAAA,IACjB,SAAS,KAAc;AACrB,YAAM,SAAU,KAAa,UAAU;AACvC,UAAI,WAAW,KAAK;AAClB,gBAAQ;AAAA,UACN,GAAG,GAAG;AAAA,QACR;AAAA,MACF,WAAW,WAAW,KAAK;AAAA,MAE3B,OAAO;AACL,gBAAQ;AAAA,UACN,GAAG,GAAG;AAAA,UACL,IAAc;AAAA,QACjB;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAGA,iBAAe,oBACb,QAC4B;AAC5B,QAAI,uBAAuB,GAAG;AAC5B,YAAM,MAAM,gBAAgB,IAAI,MAAM;AACtC,UAAI,OAAO,KAAK,IAAI,IAAI,IAAI,KAAK,sBAAsB;AACrD,eAAO,IAAI;AAAA,MACb;AAAA,IACF;AACA,UAAM,OAAO,MAAM,cAAc,MAAM;AACvC,QAAI,QAAQ,uBAAuB,GAAG;AACpC,sBAAgB,IAAI,QAAQ,EAAE,MAAM,IAAI,KAAK,IAAI,EAAE,CAAC;AAAA,IACtD;AACA,WAAO;AAAA,EACT;AAgBA,iBAAe,kBACb,QACA,SACgB;AAChB,UAAM,aAAa,MAAM,oBAAoB,MAAM;AAEnD,QAAI,CAAC,YAAY;AACf,cAAQ;AAAA,QACN,GAAG,GAAG,gCAAgC,MAAM;AAAA,MAC9C;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ;AAAA,QACA,MAAM,QAAQ,QAAQ;AAAA,QACtB,OAAO;AAAA,QACP,MAAM;AAAA,QACN,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,eACJ,WAAW,gBAAgB,WAAW,aAAa;AACrD,WAAO;AAAA,MACL,IAAI,WAAW;AAAA,MACf,QAAQ,WAAW,UAAU;AAAA,MAC7B,MAAM,WAAW,QAAQ,QAAQ,QAAQ;AAAA,MACzC,OAAO,WAAW,SAAS;AAAA,MAC3B,MAAM,WAAW;AAAA,MACjB;AAAA,MACA,cAAc,WAAW;AAAA,IAC3B;AAAA,EACF;AAIA,iBAAe,oBAAoB,KAA8B;AAC/D,UAAM,SAAS,MAAM,UAAU;AAC/B,UAAM,UAAU,IAAI,QAAQ,SACxB,IAAI,IAAI,OAAO,QAAQ,OAAO,MAAM,IAAI,QAAQ,MAAM,CAAC,CAAC,IACxD,oBAAI,IAAoB;AAE5B,UAAM,gBAAgB,QAAQ,IAAI,UAAU;AAC5C,UAAM,UAAU,MAAM,cAAc,aAAa;AAEjD,QAAI,CAAC,SAAS;AACZ,YAAM,OAAO,OAAO,IAAI,MAAM,wBAAwB,GAAG;AAAA,QACvD,YAAY;AAAA,MACd,CAAC;AAAA,IACH;AAEA,UAAM,gBAAgB,QAAQ;AAC9B,UAAM,aAAa,oBAAI,KAAK;AAG5B,QAAI,eAAe,UAAU;AAC3B,aAAO,MAAM,kBAAkB,eAAe,OAAO;AAAA,IACvD;AAEA,QAAI,OAAQ,MAAM,GAAI,gBAAgB,aAAa,KAAM;AAGzD,QAAI,CAAC,MAAM;AACT,UAAI;AAEF,cAAM,aAAa,MAAM,cAAc,aAAa;AAEpD,YAAI,YAAY;AACd,kBAAQ;AAAA,YACN,GAAG,GAAG,oDAAoD,WAAW,SAAS,aAAa;AAAA,UAC7F;AAEA,gBAAM,qBACJ,WAAW,gBAAgB,WAAW,aAAa;AACrD,gBAAM,GAAI,WAAW;AAAA,YACnB,QAAQ;AAAA,YACR,MAAM,WAAW,QAAQ,QAAQ,QAAQ;AAAA,YACzC,OAAO,WAAW,SAAS;AAAA,YAC3B,aAAa;AAAA,YACb,MAAM,QAAQ,WAAW,IAAI;AAAA,YAC7B,cAAc;AAAA,YACd,GAAI,sBAAsB,OACtB;AAAA,cACE,cAAc;AAAA,cACd,cAAc,WAAW;AAAA,YAC3B,IACA,CAAC;AAAA,UACP,CAAC;AACD,iBAAQ,MAAM,GAAI,gBAAgB,aAAa,KAAM;AAAA,QACvD,OAAO;AAEL,kBAAQ;AAAA,YACN,GAAG,GAAG,yDAAyD,aAAa;AAAA,UAC9E;AACA,gBAAM,GAAI,WAAW;AAAA,YACnB,QAAQ;AAAA,YACR,MAAM,QAAQ,QAAQ;AAAA,YACtB,aAAa;AAAA,YACb,cAAc;AAAA,UAChB,CAAC;AACD,iBAAQ,MAAM,GAAI,gBAAgB,aAAa,KAAM;AAAA,QACvD;AAAA,MACF,SAAS,OAAO;AACd,gBAAQ,MAAM,GAAG,GAAG,8BAA8B,KAAK;AACvD,cAAM,OAAO,OAAO,IAAI,MAAM,0BAA0B,GAAG;AAAA,UACzD,YAAY;AAAA,QACd,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,CAAC,MAAM;AACT,YAAM,OAAO,OAAO,IAAI,MAAM,gBAAgB,GAAG,EAAE,YAAY,IAAI,CAAC;AAAA,IACtE;AAGA,QAAI,KAAK,iBAAiB,MAAM;AAC9B,UAAI;AACF,cAAM,aAAa,MAAM,cAAc,KAAK,MAAM;AAElD,cAAM,qBACJ,YAAY,gBAAgB,YAAY,aAAa;AACvD,YAAI,sBAAsB,MAAM;AAC9B,kBAAQ;AAAA,YACN,GAAG,GAAG,6BAA6B,kBAAkB,aAAa,KAAK,EAAE;AAAA,UAC3E;AACA,gBAAM,GAAI,iBAAiB,KAAK,IAAI;AAAA,YAClC,cAAc;AAAA,YACd,GAAI,YAAY,KAAK,EAAE,cAAc,WAAW,GAAG,IAAI,CAAC;AAAA,UAC1D,CAAC;AACD,iBAAQ,MAAM,GAAI,gBAAgB,KAAK,MAAM,KAAM;AAAA,QACrD;AAAA,MACF,SAAS,eAAe;AACtB,gBAAQ;AAAA,UACN,GAAG,GAAG,6CAA6C,KAAK,EAAE;AAAA,UAC1D;AAAA,QACF;AAAA,MAEF;AAAA,IACF;AAGA,UAAM,GAAI,WAAW;AAAA,MACnB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,IAChB,CAAC;AAED,WAAO;AAAA,EACT;AAIA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { HierarchyService, HierarchyServiceConfig, createHierarchyService } from './hierarchy.js';
-export { AuthEnv, BaseUser, DbAdapter, ExchangeTokenResponse, GetUserInfoResponse, GetUserInfoWithJwtResponse, PortalUser, RoleMapper, SessionPayload, SubdomainAuth, SubdomainAuthConfig, UpsertUserPayload, createSubdomainAuth } from './auth.js';
+export { AuthEnv, BaseUser, DbAdapter, PortalUser, RoleMapper, SessionPayload, SubdomainAuth, SubdomainAuthConfig, UpsertUserPayload, createSubdomainAuth } from './auth.js';
 import '@pablo2410/shared-ui/hierarchy/core';
 import 'express';
 
@@ -12,44 +12,13 @@ declare const SQDCP_PILLAR_LABELS: Record<SqdcpPillar, string>;
  * Minimal environment interface required by core-server utilities.
  * Each subdomain provides its own ENV object that satisfies this shape.
  *
- * `forgeApiUrl`/`forgeApiKey` back the Manus "Forge" gateway, used by the
- * data API, map, image generation, notification, and transcription helpers.
  * `geminiApiUrl`/`geminiApiKey` back the LLM chat client (llm.ts) directly
- * against Google's Gemini OpenAI-compatible endpoint — separate credential,
- * separate provider, not a Forge passthrough.
+ * against Google's Gemini OpenAI-compatible endpoint.
  */
 interface CoreEnv {
-    forgeApiUrl: string;
-    forgeApiKey: string;
     geminiApiUrl: string;
     geminiApiKey: string;
 }
-/**
- * Storage upload function signature.
- * Subdomains provide their own storagePut implementation.
- */
-type StoragePutFn = (key: string, data: Buffer | Uint8Array | string, contentType?: string) => Promise<{
-    key: string;
-    url: string;
-}>;
-
-/**
- * Data API helper — calls the Manus built-in Data API Hub.
- *
- * Quick example:
- *   const callDataApi = createDataApiClient(ENV);
- *   await callDataApi("Youtube/search", {
- *     query: { gl: "US", hl: "en", q: "manus" },
- *   });
- */
-
-type DataApiCallOptions = {
-    query?: Record<string, unknown>;
-    body?: Record<string, unknown>;
-    pathParams?: Record<string, unknown>;
-    formData?: Record<string, unknown>;
-};
-declare function createDataApiClient(env: CoreEnv): (apiId: string, options?: DataApiCallOptions) => Promise<unknown>;
 
 /**
  * Metering + cost-control primitives for the AI layer.
@@ -66,8 +35,11 @@ interface TokenCostRate {
     outputPer1k: number;
 }
 /**
- * Default rate for gemini-2.5-flash (USD per 1k tokens).
- * Override per app via createLLMClient options if Forge pricing changes.
+ * Default rate (USD per 1k tokens). Was priced for gemini-2.5-flash;
+ * llm.ts's MODEL moved to gemini-3.5-flash (2.5-flash was deprecated for new
+ * API keys) but this rate was NOT re-verified against 3.5-flash's actual
+ * published pricing — treat cost figures as stale until confirmed.
+ * Override per app via createLLMClient options once real pricing is known.
  */
 declare const DEFAULT_COST_RATE: TokenCostRate;
 /** Per-call context that varies request-to-request (set via InvokeParams.meta). */
@@ -212,7 +184,7 @@ type InvokeParams = {
 type LLMClientOptions = {
     /** App identifier recorded on every usage event, e.g. "marketing-site". */
     app?: string;
-    /** Pricing used to estimate cost from tokens. Defaults to gemini-2.5-flash. */
+    /** Pricing used to estimate cost from tokens. Defaults to gemini-3.5-flash (rate unverified, see metering.ts). */
     costRate?: TokenCostRate;
     /** Metering sink — called after each successful call. Errors are swallowed. */
     onUsage?: (event: UsageEvent) => void | Promise<void>;
@@ -248,102 +220,6 @@ type InvokeResult = {
 };
 declare function createLLMClient(env: CoreEnv, options?: LLMClientOptions): (params: InvokeParams) => Promise<InvokeResult>;
 
-/**
- * Image generation helper using internal ImageService.
- *
- * Example:
- *   import { storagePut } from "../storage";
- *   const generateImage = createImageGenerator(ENV, storagePut);
- *   const { url } = await generateImage({ prompt: "A serene landscape" });
- */
-
-type GenerateImageOptions = {
-    prompt: string;
-    originalImages?: Array<{
-        url?: string;
-        b64Json?: string;
-        mimeType?: string;
-    }>;
-};
-type GenerateImageResponse = {
-    url?: string;
-};
-declare function createImageGenerator(env: CoreEnv, storagePut: StoragePutFn): (options: GenerateImageOptions) => Promise<GenerateImageResponse>;
-
-/**
- * Google Maps API Integration for Manus WebDev Templates.
- *
- * Main function: createMapClient(env) returns makeRequest<T>(endpoint, params)
- * All credentials are automatically injected. Array parameters use | as separator.
- *
- * Example:
- *   const makeRequest = createMapClient(ENV);
- *   const result = await makeRequest<GeocodeResult>(
- *     "/maps/api/geocode/json",
- *     { address: "1600 Amphitheatre Parkway" }
- *   );
- */
-
-type MapRequestParams = Record<string, string | number | boolean | string[] | undefined>;
-declare function createMapClient(env: CoreEnv): <T = unknown>(endpoint: string, params?: MapRequestParams) => Promise<T>;
-
-/**
- * Owner notification helper — pushes operational updates to the Manus project owner.
- *
- * Example:
- *   const notifyOwner = createNotificationClient(ENV);
- *   await notifyOwner({ title: "New submission", content: "User X submitted form Y" });
- */
-
-type NotificationPayload = {
-    title: string;
-    content: string;
-};
-declare function createNotificationClient(env: CoreEnv): (payload: NotificationPayload) => Promise<boolean>;
-
-/**
- * Voice transcription helper using internal Speech-to-Text service (Whisper API).
- *
- * Example:
- *   const transcribeAudio = createTranscriptionClient(ENV);
- *   const result = await transcribeAudio({
- *     audioUrl: "https://storage.example.com/audio/recording.mp3",
- *     language: "en",
- *   });
- */
-
-type TranscribeOptions = {
-    audioUrl: string;
-    language?: string;
-    prompt?: string;
-};
-type WhisperSegment = {
-    id: number;
-    seek: number;
-    start: number;
-    end: number;
-    text: string;
-    tokens: number[];
-    temperature: number;
-    avg_logprob: number;
-    compression_ratio: number;
-    no_speech_prob: number;
-};
-type WhisperResponse = {
-    task: string;
-    language: string;
-    duration: number;
-    text: string;
-    segments: WhisperSegment[];
-};
-type TranscriptionError = {
-    error: string;
-    code: string;
-    details: string;
-};
-type TranscriptionResult = WhisperResponse | TranscriptionError;
-declare function createTranscriptionClient(env: CoreEnv): (options: TranscribeOptions) => Promise<TranscriptionResult>;
-
 /**
  * Personas for the shared Oplytics AI assistant.
  *
@@ -454,4 +330,4 @@ declare function createSupportEngine(env: CoreEnv, options?: SupportEngineOption
 };
 type SupportEngine = ReturnType<typeof createSupportEngine>;
 
-export { type AssistantMode, type BuildSystemPromptParams, type CallMeta, type ChatMessage, type ChatParams, type ChatResult, type CoreEnv, DEFAULT_COST_RATE, type DataApiCallOptions, type FileContent, type GenerateImageOptions, type GenerateImageResponse, type GuardRequest, type GuardResult, type ImageContent, type InvokeParams, type InvokeResult, KNOWLEDGE, type KnowledgeItem, LLMBudgetError, type LLMClientOptions, type MapRequestParams, type Message, type MessageContent, type NotificationPayload, type OutputSchema, type ResponseFormat, type RetrieveOptions, type Retriever, type Role, SQDCP_PILLARS, SQDCP_PILLAR_COLORS, SQDCP_PILLAR_LABELS, type SqdcpPillar, type StoragePutFn, type SupportContext, type SupportEngine, type SupportEngineOptions, type TextContent, type TokenCostRate, type Tool, type ToolChoice, type TranscribeOptions, type TranscriptionError, type TranscriptionResult, type UsageEvent, type WhisperResponse, type WhisperSegment, buildSystemPrompt, computeCostUsd, createDataApiClient, createImageGenerator, createLLMClient, createMapClient, createNotificationClient, createStaticRetriever, createSupportEngine, createTranscriptionClient, estimateMessageTokens, estimateTokens, formatKnowledge };
+export { type AssistantMode, type BuildSystemPromptParams, type CallMeta, type ChatMessage, type ChatParams, type ChatResult, type CoreEnv, DEFAULT_COST_RATE, type FileContent, type GuardRequest, type GuardResult, type ImageContent, type InvokeParams, type InvokeResult, KNOWLEDGE, type KnowledgeItem, LLMBudgetError, type LLMClientOptions, type Message, type MessageContent, type OutputSchema, type ResponseFormat, type RetrieveOptions, type Retriever, type Role, SQDCP_PILLARS, SQDCP_PILLAR_COLORS, SQDCP_PILLAR_LABELS, type SqdcpPillar, type SupportContext, type SupportEngine, type SupportEngineOptions, type TextContent, type TokenCostRate, type Tool, type ToolChoice, type UsageEvent, buildSystemPrompt, computeCostUsd, createLLMClient, createStaticRetriever, createSupportEngine, estimateMessageTokens, estimateTokens, formatKnowledge };