2nth Platform
Code & Infrastructure Review

What's working well

Issues & Improvements

Architecture Strengths

Issues Requiring Attention

Current vs Target State

Proposed Page Structure

Option A — Cross-origin Session API (Recommended)

The simplest approach. skills.2nth.ai JS calls https://2nth.ai/api/auth/session with credentials: 'include'. The browser sends the cookie automatically. The endpoint already exists.

// In skills.2nth.ai — client-side auth check (runs on every page load)
async function getSession() {
  try {
    const res = await fetch('https://2nth.ai/api/auth/session', {
      credentials: 'include'  // sends 2nth_session cookie cross-origin
    });
    if (!res.ok) return null;
    return await res.json(); // { user: { id, email, plan, token_balance } }
  } catch { return null; }
}

// Then show/hide install buttons based on session.user.plan
const session = await getSession();
renderSkillPage(skill, session?.user ?? null);

// src/middleware/cors.ts — ensure credentials are allowed for skills subdomain
const ALLOWED = ['https://2nth.ai', 'https://skills.2nth.ai', 'https://2nth-site.pages.dev'];

export function cors(req: Request, res: Response): Response {
  const origin = req.headers.get('Origin') ?? '';
  if (ALLOWED.includes(origin)) {
    res.headers.set('Access-Control-Allow-Origin', origin); // not '*' — must be specific
    res.headers.set('Access-Control-Allow-Credentials', 'true'); // ← critical
    res.headers.set('Vary', 'Origin');
  }
  return res;
}

Option B — Cloudflare Access JWT sharing (No code change)

With Cloudflare Access, configure both 2nth.ai and skills.2nth.ai under the same Access application with a wildcard policy (*.2nth.ai). Access injects a Cf-Access-Jwt-Assertion header to all requests — your Pages Function can read it without needing the session cookie at all. This is the most elegant approach for a multi-subdomain platform.

// functions/_middleware.ts (skills site) — read CF Access JWT
const cfJwt = req.headers.get('Cf-Access-Jwt-Assertion');
if (cfJwt) {
  // Verify with the CF Access JWKS (no secret sharing required)
  const user = await verifyCfAccessToken(cfJwt, TEAM_DOMAIN);
  // Fetch full user profile from 2nth.ai API using the verified email
  const profile = await fetch(`https://2nth.ai/api/auth/profile?email=${user.email}`, {
    headers: { 'Authorization': `Bearer ${SERVICE_TOKEN}` }
  });
}

Shared Login Flow (User Journey)

Proposed Tier Structure for Skills

SKILL.md Metadata — Add Tier Field

Add a tier field to the YAML frontmatter so the catalog can enforce gating server-side:

---
name: sagex3-ai
description: Sage X3 ERP GraphQL integration patterns for AI coding agents
license: MIT
tier: starter          # free | starter | designer | builder
metadata:
  domain: erp
  systems: [sage-x3]
  category: enterprise-erp
allowed-tools: Bash(curl:*) Bash(npx:*)
---

Gating Logic — Client-Side + Edge Enforcement

// skills.2nth.ai — tier check before showing install command
const TIER_ORDER = ['explorer', 'starter', 'designer', 'builder'];

function canInstall(userPlan: string, skillTier: string): boolean {
  return TIER_ORDER.indexOf(userPlan) >= TIER_ORDER.indexOf(skillTier);
}

function renderInstallPanel(skill, user) {
  if (!user) {
    return `<div class="install-gate">
      <a href="https://2nth.ai/join.html?return=${location.href}">Log in to install</a>
    </div>`;
  }
  if (!canInstall(user.plan, skill.tier)) {
    return `<div class="install-gate upgrade">
      <p>This skill requires <strong>${skill.tier}</strong> plan</p>
      <a href="https://2nth.ai/bill.html">Upgrade — from R1,850/mo</a>
    </div>`;
  }
  return `<div class="install-command">
    <code>npx skills add imbilawork/2nth-skills@${skill.name}</code>
    <button onclick="copyInstall('${skill.name}')">Copy</button>
  </div>`;
}

Events to Track

Tracking Implementation — POST to 2nth.ai API

Add a lightweight tracking endpoint to 2nth-site, then fire it from skills.2nth.ai with fetch(..., {credentials: 'include', keepalive: true}):

// 2nth-site: functions/api/track/skill.ts (new endpoint)
export async function onRequestPost({ request, env, data }) {
  const { event, skill_name, metadata } = await request.json();
  const user = data.user; // injected by global _middleware.ts

  if (user) {
    // Log to activity_log table (already exists in D1)
    await env.DB.prepare(
      `INSERT INTO activity_log (user_id, action, metadata, created_at)
       VALUES (?, ?, ?, ?)`
    ).bind(user.id, event, JSON.stringify({ skill_name, ...metadata }), Date.now()).run();

    // Update lead score for high-intent events
    if (event === 'skill_install_copied') {
      await env.DB.prepare(
        `UPDATE users SET lead_score = lead_score + 5 WHERE id = ?`
      ).bind(user.id).run();
    }
  } else {
    // Anonymous: log to anon_identities fingerprint
    const fp = getFingerprint(request);
    await env.DB.prepare(
      `INSERT OR IGNORE INTO anon_identities (fingerprint, first_seen, metadata)
       VALUES (?, ?, ?)`
    ).bind(fp, Date.now(), JSON.stringify({ referrer: request.headers.get('Referer') })).run();
  }

  return new Response(null, { status: 204 });
}

// skills.2nth.ai — fire tracking events
function track(event, data = {}) {
  fetch('https://2nth.ai/api/track/skill', {
    method: 'POST',
    credentials: 'include',
    keepalive: true,      // survives page unload
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ event, ...data })
  }).catch(() => {}); // fire-and-forget, never block UI
}

Cloudflare Web Analytics — Custom Events

Layer Cloudflare Web Analytics custom events on top of the API tracking for funnel visibility:

// Fire both: API tracking (to D1) + CF Analytics (to CF dashboard)
function track(event, data = {}) {
  // 1. Server-side: logs to D1 activity_log + CRM
  fetch('https://2nth.ai/api/track/skill', { method: 'POST', credentials: 'include',
    keepalive: true, body: JSON.stringify({ event, ...data }) }).catch(() => {});

  // 2. Client-side: CF Web Analytics custom event (appears in CF dashboard)
  if (typeof window.cfAnalytics !== 'undefined') {
    window.cfAnalytics.pushEvent({ type: event, ...data });
  }
}

Personalization Based on Tracking

Critical path summary