@mindalike/platform-contracts

Single source of truth for the platform identity, CSRF, origin, cookie, and response-envelope contracts shared by every Mindalike worker (landing-page, netchat, mindavibe, orbit).

Rules:

• landing-page (core) MINTS tokens; all siblings VERIFY ONLY. Both sides use this same code with the same secret value.
• Contracts contain ZERO secrets. The secret VALUE lives in each repo's .dev.vars / wrangler secrets, never here.
• Breaking changes = major version bump + coordinated sibling upgrades.

Install (in a worker repo)

pnpm add @mindalike/platform-contracts

Wrangler inlines the imported code into the worker bundle at deploy — there is no runtime dependency, no network hop, no hosting of this package needed.

Usage — verifying side (netchat / mindavibe / orbit)

import { PlatformJwt, extractAccessToken } from '@mindalike/platform-contracts';

// once per isolate:
const jwt = new PlatformJwt(env.JWT_SECRET); // same secret VALUE as the core

const token = extractAccessToken(request);
if (!token) return new Response('Unauthorized', { status: 401 });

const payload = await jwt.verifyToken(token);
if (!payload) return new Response('Unauthorized', { status: 401 });

// Revocation is a SESSION-layer check on top of signature verification.
// Siblings with DB access check sessions.isRevoked for payload.sessionId;
// see landing-page/worker/database/services/AuthService.ts for reference.

Usage — minting side (landing-page core only)

import { PlatformJwt } from '@mindalike/platform-contracts';

const jwt = new PlatformJwt(env.JWT_SECRET);
const { accessToken, expiresIn } = await jwt.createAccessToken(
	userId, email, sessionId,
	3 * 24 * 3600, // sessionTTL
);
// set accessToken cookie (HttpOnly; Secure; SameSite=Lax; Path=/)

CSRF

import { validateCsrfToken, buildCsrfSetCookie } from '@mindalike/platform-contracts';

if (!validateCsrfToken(request)) {
	return fail('csrf_violation', 'CSRF validation failed', 403);
}
// seed the cookie on safe methods:
buildCsrfSetCookie(response, generateCsrfToken());

Origins

import { getAllowedOrigins, isOriginAllowed } from '@mindalike/platform-contracts';

const origins = getAllowedOrigins(env); // CUSTOM_DOMAIN + EXTRA_ALLOWED_ORIGINS (+ localhost in dev)

Adding a new cross-origin client host = one line in that worker's env var EXTRA_ALLOWED_ORIGINS, no code change.

Envelope

import { ok, fail } from '@mindalike/platform-contracts';
return ok(data);
return fail('quota_exceeded', 'no credits', 402);

Cookie contract (constants)

ACCESS_COOKIE_NAME (accessToken), legacy read-only names auth_token/jwt, extraction priority Authorization header → accessToken → legacy. See claims.ts.

Publishing

Version tags drive CI:

# bump version in package.json first, then:
git tag platform-contracts-v1.0.1
git push origin platform-contracts-v1.0.1

Requires NPM_TOKEN secret in this GitHub repo. CI runs lint+tests before publish and refuses if tag ≠ package.json version.

Local development inside worker repos

To work against an unreleased version, use pnpm's file protocol:

"@mindalike/platform-contracts": "file:../packages/platform-contracts"

Switch back to the registry version before deploying.