API first
Frontend and backend communicate through explicit, typed contracts. Inputs are validated at the service boundary; permissions belong in the application service rather than the interface.
Stable error codes are more useful than translated error text. Clients can decide reliably between retry, re-authentication and a user-facing warning.
Device-bound sessions
Short-lived access tokens and rotating refresh tokens are associated with a visible device. Individual sessions can be revoked without automatically signing out every other device.
- Refresh rotation and reuse detection
- Device inventory and targeted revocation
- Login history and security-relevant events
- Rate limiting by both IP and identifier
Realtime without state chaos
WebSocket events distribute new messages, receipts, presence and personal summaries. Reconnect reloads an authoritative state; events alone are not a database.
Prepared integration ports
Events, Alerts, Cameras, Sensors, Monitoring and AI remain modular ports. Without a configured and reviewed provider they must not emit simulated live data.