1. Multi-Tenant & User-Scoped Architecture + Live Demo Tenants
Every upstream app connects using two orthogonal headers: X-Api-Key (isolates the Tenant) and optional HMAC-signed X-Actor-Token (isolates private user-scoped accounts, WhatsApp chats, executive LinkedIn DMs, and OTP challenges).
1. Diamond Stone (`diamondstonex.com`)
Natural Marble, Granite, Travertine & Quote-First BOQ Platform
Slug: diamondstonex
API Key: mk_live_diamondstone_demo2026
Pixel: /p/diamondstonex.js
Dedicated URL: https://marketing.diamondstonex.com
2. Al Hiba Industrial (`alhiba.om`)
Modular Portacabins & Industrial Manufacturing (Barka)
Slug: al-hiba-oman
API Key: mk_live_alhibaoman_demo2026
Pixel: /p/al-hiba-oman.js
Hub URL: https://marketing-hub.venturealliance.om
3. Muscat Prime Realty (`muscatprime.om`)
OmanReal Krooki Plots & Al Mouj Luxury Property
Slug: muscat-prime-realty
API Key: mk_live_muscatreal_demo2026
Pixel: /p/muscat-prime-realty.js
Default Wilayat: As Seeb
2. Upstream App Integration (`@vai/marketing-sdk` & FastAPI / SvelteKit)
Drop-in pattern for connecting diamondstonex.com (FastAPI + SvelteKit) or any Node/Python backend:
// TypeScript / SvelteKit Server Action (`@vai/marketing-sdk`)
import { VaiMarketingClient, verifyHubWebhookSignature } from '@vai/marketing-sdk';
const hub = new VaiMarketingClient({
baseUrl: 'https://marketing-hub.venturealliance.om',
apiKey: process.env.VAI_HUB_API_KEY!, // e.g. mk_live_diamondstone_demo2026
});
// Scope to a specific staff user (e.g. Eng. Nasser's private BOQ WhatsApp)
const advisorHub = hub.withActorToken(signedActorToken);
// 1. Launch White-Label Onboarding (/connect/:token) for private user WhatsApp
const session = await advisorHub.createConnectSession({
workspace_id: 'ws_diamondstonex_main',
target_scope: 'user',
return_url: 'https://diamondstonex.com/staff/channels',
});
// 2. Publish Architectural Marble Showcase (Quote-First — no forced cart price)
const job = await advisorHub.publishOrSimulate({
idempotency_key: 'dst_calcis_velata_2026_11',
workspace_id: 'ws_diamondstonex_main',
account_ids: ['acc_dst_ig_official', 'acc_dst_pinterest_boards'],
mode: 'live_preview',
wilayat: 'bawshar',
text_en: 'Honed Calcis Velata marble slabs — request physical sample or upload BOQ on diamondstonex.com.',
text_ar: 'ألواح رخام كالسيس فيلاتا المصقولة — اطلب عينة أو ارفع جدول الكميات عبر موقعنا.',
});
3. Model Context Protocol (`@vai/marketing-mcp`) Guide
Connect Claude Desktop, Cursor, Antigravity, or Diamond Stone's LLM Agent Layer over HTTP (`POST /mcp`) or `stdio`:
// Option A: Remote HTTP MCP (`mcp_config.json`)
{
"mcpServers": {
"vai-oman-marketing-hub": {
"url": "https://marketing-hub.venturealliance.om/mcp",
"headers": {
"X-Api-Key": "mk_live_diamondstone_demo2026",
"X-Actor-Token": "<OPTIONAL_USER_ACTOR_TOKEN>"
}
}
}
}
// Option B: Local Stdio MCP
{
"mcpServers": {
"vai-oman-marketing-local": {
"command": "node",
"args": ["--no-warnings", "C:/vaiprojects/vai-marketing-hub/packages/mcp/src/stdio.ts"],
"env": {
"VAI_API_KEY": "mk_live_diamondstone_demo2026"
}
}
}
}
8 Exposed MCP Tools:
list_integrations, list_visible_accounts, create_connect_session, publish_or_simulate, respond_challenge, provision_web_analytics, create_thawani_link, check_oman_compliance.
4. 3-Layer KMS Vault, Volatile OTP Relay & Isolated Chrome CDP
5 Credential Intake Modes:
oauth2, api_key_bundle, qr_or_pairing_code (`+968` WAHA), assisted_portal_login, and live_vnc_login (`me-central1` KasmVNC stream).Cryptographic AAD Binding: Every account DEK is sealed with
AAD = tenant_id|scope|owner_user_id|account_id. Even a compromised query cannot unseal User A's token under User B (`E_VAULT_AAD_MISMATCH`).Volatile RAM-Only OTP Burn: When OpenSooq, Dubizzle, OmanReal, or Instagram prompts for a 6-digit `+968` SMS OTP, the Hub emits
account.challenge_required over SSE + signed webhook, verifies the code via POST /api/v1/challenges/:id/respond in RAM only, burns it immediately, and auto-resumes the paused job.5. First-Party Oman PDPL Edge Pixel + GA4 + Clarity + GTM
Embed 1 line in diamondstonex.com or alhiba.om to govern Oman PDPL (`Royal Decree 6/2022`) AR/EN consent, load GTM/GA4/Clarity, and automatically stitch wa.me/+968... clicks to Microsoft Clarity video replays:
<!-- Drop into <head> of diamondstonex.com -->
<script async src="https://marketing.diamondstonex.com/p/diamondstonex.js"></script>
<!-- Programmatic BOQ / Sample Lead Stitching from SvelteKit -->
<script>
window.VaiOmanHubPixel?.identifyLead('+96896334411', 'Villa Architect — Al Mouj');
</script>