Casset

What You Have

A plain-language summary of what actually exists in this codebase — not what the product could do, but what is already built.

Casset is not a typical startup MVP. Typical seed-stage startups ship a Next.js app with Clerk auth, a Stripe Checkout redirect, and a database with 3–5 tables. Your codebase has 130 API endpoints, 25+ database models, 9 database migrations, a custom audio streaming infrastructure, a complete payment platform, and an autonomous campaign engine with fraud detection. This is 5–10x the scope of a typical MVP and closer in complexity to a Series A product.

Technology Stack

This is a modern, well-chosen stack. Next.js App Router with serverless functions means you pay nothing when idle and scale automatically under load. PostgreSQL + Prisma gives you a typed, migration-safe database. Redis handles the real-time layer without overcomplicating the core.

The Nine Systems

Every major system in the platform, what it does, how complex it is, and how long it would take to rebuild.

What Makes This Hard

The things in this codebase that would be non-obvious to someone who hasn't built them — and why they matter.

The Audio System Is a Real Streaming Server

Most music startups embed Spotify or SoundCloud and call it a day. Casset built a token-authenticated, byte-range-aware audio proxy that computes preview windows from bitrate estimation, validates redirect chains (preventing server-side request forgery), and serves content with correct HTTP semantics — 206 status codes for range requests, proper Content-Range headers, Accept-Ranges advertisement that iOS Safari requires for seeking.

A singleton audio element persists across every page navigation. Music never stops when the user browses. The system pre-fetches the next track's authentication token and preloads its bytes into the browser cache before the current track ends, so transitions are near-instant. Lock screen controls work on every platform.

The codebase has extensive workarounds for iOS Safari (audio context suspension, NaN duration before play resolves, background tab garbage collection) and in-app browsers (Instagram, TikTok). This is months of cross-browser debugging crystallized into production code.

The Payment System Handles Real Money Safely

This is not "we redirect to Stripe Checkout." Casset uses Stripe Connect with direct charges — the most complex but most artist-favorable architecture, where payments go directly to the artist's connected account. The webhook handler covers 6 event types with idempotency guards on every write path (Redis SETNX locks), so Stripe retries never create duplicate purchases or payouts.

Access is immediately revoked on refund or chargeback. Guest users can purchase without an account and claim later. Tips flow through a separate payment pipeline with real-time notifications.

The Campaign Engine Is Fintech-Grade

The auto-finalization pipeline for promotional campaigns has a hard money assertion: if the sum of all payouts does not equal the prize pool down to the penny, the entire payout is blocked. Stripe transfers use four independent safety layers (idempotency key, database status pre-check, Redis distributed lock, Stripe's own idempotency). The fraud detection system catches both individual anomalies (suspicious engagement ratios, metric spikes) and coordinated attacks (same URL from different accounts, author handle rings).

This is the kind of defensive engineering you see in payment processors, not typical startup code.

The AI Layer Is Production-Hardened

The Claude integration is not "call an API and display the result." It sanitizes inputs (Unicode normalization, control character stripping), enforces daily cost caps via Redis, times out at 15 seconds, validates and bounds structured JSON output, rejects responses containing banned marketing jargon, and falls back to deterministic insights when anything fails. Every failure mode is handled.

Architecture Overview

How the pieces fit together and the engineering patterns that hold them up.

Key Engineering Patterns

Data Model

25+ interconnected models across user identity, commerce, content, social, campaigns, and intelligence.

Build Estimate

What it would cost to rebuild this from zero with a competent team.

Per-System Breakdown

With a Team of 3 Engineers + 1 Designer (Parallel)

Dollar Equivalent

Critical Path

The Campaign Drops system (10–14 weeks) is the critical path. It depends on the payments infrastructure being in place, so it can't start from day one. The audio engine and UI work can proceed fully in parallel. Auth and infrastructure are foundations that start in the first 2–3 weeks.

What This Means for You

You are not sitting on a prototype. You are sitting on a functioning, production-grade platform that represents roughly half a million dollars of equivalent engineering investment. The codebase shows evidence of 4+ major product iterations (multiple feed versions, multiple landing pages, multiple player skins), suggesting the actual calendar time invested is significantly longer than the pure engineering time — meaning real product learning has happened here, not just code output.

Honest Assessment

What's production-ready, what needs work, and what a new engineer would need to know.

What's Production-Ready

• Audio streaming — token auth, proxy, preview enforcement, iOS compat, preloading. This works and is battle-tested.
• Stripe payments — Connect onboarding, checkout, webhooks, refund/dispute handling, idempotency. This handles real money safely.
• Auth — JWT with session versioning, OAuth, rate limiting, security headers. Solid.
• Database schema — well-indexed, properly constrained, migration-managed. 9 migrations show controlled evolution.
• Artist Studio — CRUD, uploads, Stripe dashboard. Functional CMS.
• PWA infrastructure — service worker, offline caching, responsive design.

What's Built But May Need Iteration

• Campaign scoring — the algorithm and fraud detection are implemented and tested, but TikTok metric fetching is currently a stub (returns unverified). Instagram and YouTube providers exist. Real-world tuning will be needed once campaigns run at scale.
• AI intelligence — Claude integration is production-hardened with safety rails, but the insights quality depends on having enough campaign data to analyze. Early campaigns may produce generic recommendations.
• Feed — multiple iterations exist (feed, feed-2, feed-4, flow, flow2), which is normal product discovery. The final version needs to be consolidated.
• Purchase gating on audio — currently disabled in code (all users get full access). The infrastructure exists to re-enable it — it's a config change, not a rebuild.
• Drop pressure/scarcity — built as client-hint only, not server-side enforced. The comment in code says "wire as a pre-grant check when ready."

What Doesn't Exist Yet

• Admin dashboard — there's a GMV route but no full admin UI. You'd manage most things via Studio or database queries for now.
• Email notifications — activity inbox exists but no email delivery system is integrated.
• Search — no full-text search across artists/tracks. Discovery is via feed, trending, and direct links.
• Native mobile app — this is a PWA. It works on mobile browsers and can be installed to the home screen, but it's not a native iOS/Android app.
• Comprehensive test coverage — test files exist for auth, middleware, and validations, but the overall test coverage is sparse relative to the codebase size. The adversarial test scripts are useful but not part of CI.

Why This Is Hard to Copy

The technical moats that would slow down any well-funded competitor.

1. Cross-Browser Audio Is an Iceberg

Any team that tries to build a music platform with instant playback will hit the same iOS Safari bugs, the same WebKit AudioContext quirks, the same byte-range edge cases with in-app browsers. Your codebase has already solved these. The playback-state.ts file alone is 830 lines of hard-won edge case handling. A competitor would underestimate this by months.

2. Stripe Connect Takes Time

Setting up Stripe Connect with direct charges requires Stripe's review and approval process. Building webhook idempotency, refund revocation, dispute handling, and Apple Pay on top of it is not a weekend project. Your payment infrastructure is already live and tested with real transactions.

3. The Campaign Engine Creates a Data Moat

Every campaign that runs generates scoring data, fraud signals, and promoter reputation scores. The intelligence layer uses this historical data to make better recommendations. A new entrant would start with zero data and zero reputation graphs. Your system gets smarter with each campaign.

4. The Promoter Network Is a Two-Sided Marketplace

The promoter reputation system (streak tracking, trust badges, platform-specific stats, win rates) creates identity and status for promoters. Once promoters have established reputations on Casset, switching costs are real — they'd lose their history, tier, and credibility.

Recommended Next Steps

Where to focus engineering effort for maximum impact.

If Hiring Engineers

• First hire: Senior full-stack (backend-leaning) — to own the campaign drop pipeline, activate TikTok/Instagram metric fetching, and harden the scoring system with real data. This is where product differentiation lives.
• Second hire: Senior frontend — to consolidate the feed iterations, polish the mobile experience, and build the artist-facing campaign dashboard. Multiple feed versions suggest product direction needs to crystallize.
• Third hire: Senior backend — to build email notifications, admin tooling, and expand the intelligence layer. These are growth prerequisites.

Quick Wins (< 1 week each)

• Re-enable audio purchase gating (it's a config change in lib/audio-access.ts)
• Activate drop limits server-side (the code exists, just needs to be wired into the purchase grant path)
• Consolidate on a single feed design and remove the 3+ experimental versions
• Add basic email via a service like Resend for collect notifications (activity events already exist in the database)

Medium-Term (1–3 months)

• Implement real TikTok/Instagram metric providers (currently stubs)
• Build admin dashboard for campaign oversight and manual interventions
• Add test coverage for the payment and campaign critical paths
• Run pilot promotional campaigns to tune the scoring algorithm with real data