CineSend

Build me a watermarked private screener site for footage I own: my own film,
a rough cut for producers, a festival submission I control. This is the
deliberately low-stakes floor of CineSend, never a substitute for it when
someone else's unreleased master is involved. Requirements:

- Node + Express + better-sqlite3 on a VPS, media in Cloudflare R2, hls.js for
  playback. Server-rendered pages, no frontend framework.
- I invite viewers by name and email. Each gets a single-use /s/<random-id> link tied
  to that address, with an expiry date and a max view count I set per invite.
- ffmpeg burns the viewer's name, email, and the date into the picture as a semi
  transparent overlay, one encode per viewer, cached in R2 and deleted on expiry. It
  is visible and it is meant to be, deterrence is the entire mechanism.
- Every play logs timestamp, IP, user agent, and how far they watched, shown on an
  /admin page behind basic auth. I can revoke any link instantly.
- Downloads are off, right click is off, and the manifest URL is signed and short
  lived. State plainly in the UI that none of this stops a screen recording.
- SQLite holds invites and the access log, R2 keys and the SMTP credentials come from
  .env. No accounts for viewers, no telemetry, no third party analytics.
- Out of scope: DRM, forensic watermarking, and TV apps. Do not claim to implement
  any of them and do not build a fake watermark that only sounds forensic.
- README: R2 and signed URL setup, per-viewer encode cost and time, and one blunt
  paragraph saying this is deterrence only and must never be used for a title under
  someone else's security requirements.

# AGENTS.md — Build guide for CineSend

## Project scope
The honest floor: expiring private screener links with a visible per-viewer burn-in, view limits, and an access log. Deterrence, not security.

Catalogue verdict: no. The file delivery is not the product. The product is that A24, HBO, and Sundance accept it. A screener page with an expiring link is an afternoon, and it buys you nothing, because the two things CineSend actually sells cannot be written by an agent at any price: forensic watermarking, which is a licensed product from Nagra that survives a camcorder pointed at a monitor and traces the leak back to one named viewer, and studio-grade DRM, which needs license keys Google and Apple issue to companies, not to your VPS. Underneath both sits the part no code touches · a rights holder's legal team signing off on where their unreleased master is allowed to sit. You can build a private video page. You cannot build permission to receive the film.
Use the implementation prompt below to define the deliverable. Complete each phase's acceptance checks before extending the scope.

## Working agreement
- Inspect the repository and its existing instructions before choosing paths, dependencies or commands. Keep one coherent stack and explain changes to the proposed architecture.
- Plan a vertical slice that accepts a real input and produces the useful output described below. Persist only the state the prompt calls for; respect memory-only and upstream-managed workflows. Use fixtures only when they are clearly labelled.
- After scaffolding, document the actual install, development, check and build commands in README and keep them synchronized with the package or project manifest. Do not report commands as successful unless they ran.
- Work in small steps. At handoff, list implemented flows, checks actually performed, remaining blockers, and any credentials or provider setup the owner must supply.
- Do not publish, spend money, contact customers, delete source data or run irreversible migrations without the project owner's authorization.

## Prerequisites
- ffmpeg
- object storage plus a CDN
- a VPS for the screener pages
- an email sender for invites
- an accurate understanding of what a visible watermark does and does not stop

## Stack and architecture
- Node + Express + better-sqlite3 on a VPS, media in Cloudflare R2, hls.js for playback. Server-rendered pages, no frontend framework.
- Model source media, edit decisions, processing jobs, and exported assets; keep stable source IDs and timestamps.
- Interface for this secure screener distribution workflow: a local web page with input, progress, review, and export views.

## Security and data integrity
- Keep the original media file untouched when decoding or rendering fails; show the failing job and allow retry.
- Validate imported records and file paths; keep user data within the storage location named in the prompt.
- State the practical limit: NexGuard forensic watermarking that survives re-encoding and a phone pointed at the screen.

## Agent implementation rules
- Project rule, data: Model source media, edit decisions, processing jobs, and exported assets; keep stable source IDs and timestamps.
- Project rule, behavior: The honest floor: expiring private screener links with a visible per-viewer burn-in, view limits, and an access log. Deterrence, not security.
- Project rule, recovery: Keep the original media file untouched when decoding or rendering fails; show the failing job and allow retry.

## Optional agent skills and references
No installable skill is listed for this guide; use the project rules and the stack documentation.

Read the linked SKILL.md and its dependencies before adding a skill. Select only the skills matching this project's runtime and task; their documentation does not supply API access, credentials or approval to perform external actions. Pin the reviewed revision where the tool supports it. Follow the chosen agent's documented project-level installation mechanism.

## Distribution ideas
These are optional planning notes. Obtain the owner's approval before publishing or contacting anyone.
- Demonstrate this secure screener distribution operation with sample or user-owned data: The honest floor: expiring private screener links with a visible per-viewer burn-in, view limits, and an access log. Deterrence, not security.
- Show a concrete result or export: Downloads are off, right click is off, and the manifest URL is signed and short lived. State plainly in the UI that none of this stops a screen recording.
- State the practical limit: NexGuard forensic watermarking that survives re-encoding and a phone pointed at the screen.

## Engineering roadmap
1. Phase 1, architecture and data: Node + Express + better-sqlite3 on a VPS, media in Cloudflare R2, hls.js for playback. Server-rendered pages, no frontend framework. Model source media, edit decisions, processing jobs, and exported assets; keep stable source IDs and timestamps.
2. Phase 2, implement: The honest floor: expiring private screener links with a visible per-viewer burn-in, view limits, and an access log. Deterrence, not security.
3. Phase 3, implement: Secure screener and media delivery with DRM, forensic watermarking, geo-blocking, and view limits.
4. Phase 4, review and output: The honest floor: expiring private screener links with a visible per-viewer burn-in, view limits, and an access log. Deterrence, not security. Downloads are off, right click is off, and the manifest URL is signed and short lived. State plainly in the UI that none of this stops a screen recording.
5. Phase 5, recovery and acceptance: Keep the original media file untouched when decoding or rendering fails; show the failing job and allow retry. Verify this invariant with a saved fixture: The original hash must remain unchanged; cuts and captions must stay aligned after export despite a variable input frame rate. State the practical limit: NexGuard forensic watermarking that survives re-encoding and a phone pointed at the screen.

## Paid-product capabilities outside this build
- NexGuard forensic watermarking that survives re-encoding and a phone pointed at the screen
- Widevine, FairPlay, and PlayReady DRM, which require licensed keys issued to companies
- the studio and festival trust that makes anyone send you a master in the first place
- Aspera acceleration for moving finished masters across continents
- branded Apple TV, Roku, Fire TV, and smart TV apps for the screening room
- the audit trail and chain of custody a distribution contract asks for

## Implementation prompt
Build me a watermarked private screener site for footage I own: my own film,
a rough cut for producers, a festival submission I control. This is the
deliberately low-stakes floor of CineSend, never a substitute for it when
someone else's unreleased master is involved. Requirements:

- Node + Express + better-sqlite3 on a VPS, media in Cloudflare R2, hls.js for
  playback. Server-rendered pages, no frontend framework.
- I invite viewers by name and email. Each gets a single-use /s/<random-id> link tied
  to that address, with an expiry date and a max view count I set per invite.
- ffmpeg burns the viewer's name, email, and the date into the picture as a semi
  transparent overlay, one encode per viewer, cached in R2 and deleted on expiry. It
  is visible and it is meant to be, deterrence is the entire mechanism.
- Every play logs timestamp, IP, user agent, and how far they watched, shown on an
  /admin page behind basic auth. I can revoke any link instantly.
- Downloads are off, right click is off, and the manifest URL is signed and short
  lived. State plainly in the UI that none of this stops a screen recording.
- SQLite holds invites and the access log, R2 keys and the SMTP credentials come from
  .env. No accounts for viewers, no telemetry, no third party analytics.
- Out of scope: DRM, forensic watermarking, and TV apps. Do not claim to implement
  any of them and do not build a fake watermark that only sounds forensic.
- README: R2 and signed URL setup, per-viewer encode cost and time, and one blunt
  paragraph saying this is deterrence only and must never be used for a title under
  someone else's security requirements.

## Completion evidence
Demonstrate the prompt's acceptance scenarios against the scoped workflow. Include setup from a clean checkout and failure recovery. Check persistence across restart and export/restore only for the state the prompt says to store; for memory-only tools, confirm that temporary content is discarded as specified. Record actual results and remaining limitations. A detailed plan alone does not establish a working replacement.