API first
Frontend and backend communicate through explicit, typed contracts. Inputs are validated at the service boundary; permissions belong in the application service rather than the interface.
Stable error codes are more useful than translated error text. Clients can decide reliably between retry, re-authentication and a user-facing warning.
Device-bound sessions
Short-lived access tokens and rotating refresh tokens are associated with a visible device. Individual sessions can be revoked without automatically signing out every other device.
- Refresh rotation and reuse detection
- Device inventory and targeted revocation
- Login history and security-relevant events
- Rate limiting by both IP and identifier
Realtime without state chaos
WebSocket events distribute new messages, receipts, presence and personal summaries. Reconnect reloads an authoritative state; events alone are not a database.
Realtime output is constrained at the mapper to exactly the fields in the public message contract. Internal record fields and nested membership lists are treated as prohibited baggage by negative tests.
Prepared integration ports
Events, Alerts, Cameras, Sensors, Monitoring and AI remain modular ports. Without a configured and reviewed provider they must not emit simulated live data.