# Build brief — a focused alternative to Iconik

> **Verdict:** Not faithfully · **Buildability:** 16/100 · **Category:** Audio Video
> **Source:** https://www.canitbevibecoded.com/iconik
> Independent editorial assessment from Can It Be Vibe Coded? Not affiliated with, endorsed by, or derived from Iconik. Verify current pricing and capabilities before acting.

## Context

**Iconik** — Backlight's cloud MAM: indexes on-prem, LTO, and cloud storage into one searchable, permissioned media library. It currently costs $65/mo.

Iconik is not a search box, it is a storage gateway network. Its job is to make an on-prem NAS in one building, an LTO library in another, and three cloud buckets behave like one library, generate proxies for all of it, and then let a producer in another timezone browse the parts they are allowed to see without ever touching the original storage. Every hard part of that is infrastructure and permissions, and none of it gets easier because an agent writes the code. A solo editor can absolutely build a personal catalog of their own drives, and that is worth doing. It is not a MAM, and the moment a second person or a second site is involved you are staffing a product, not running a script.

This brief describes a focused, single-operator replacement for the part of Iconik that is genuinely reproducible. It is deliberately narrower than the product it replaces, and it says so in writing. Build the useful core; do not pretend to have rebuilt the rest.

## What you are building

For one person on their own drives: walk the volumes, make ffmpeg proxies, extract metadata, and search it locally. A catalog, not a MAM.

- Build a focused single-user workflow with real persistence, search, and export.
- A responsive interface with real empty, loading, success, and error states.

## Requirements

### Functional

- Ffmpeg.
- A machine that can see every volume you want indexed.
- SQLite plus FTS5.
- Storage for proxies.
- A lot of patience for the first index.

### Non-functional

- Accessibility: semantic markup, labelled controls, visible focus, and reduced-motion support.
- Security: server-side secrets, validated input, and no credentials in the client bundle.
- Reliability: retries with backoff on external calls, and a clear failure state when a provider is down.
- Portability: the operator can export their data and leave without losing it.

## Implementation brief

Build me a single-user local media catalog for my own drives, the honest
personal floor of iconik. It is for exactly one person; facility-scale asset
management is what iconik is for. Requirements:

- A Node CLI plus a local web app: better-sqlite3 for the index, Express serving on
  localhost, plain server-rendered pages.
- `scan <volume>` walks the drive, records path, size, mtime, and volume label, then
  runs ffprobe for duration, codec, resolution, frame rate, and embedded timecode.
  Re-running it is incremental, keyed on path plus mtime plus size.
- Every video gets a 480p H.264 proxy and a contact sheet of 9 frames written to
  ~/MediaCatalog/proxies/<hash>/, so I can identify a clip without mounting the drive
  it lives on.
- Search across filename, path, codec, and my own notes with SQLite FTS5, plus filters
  for duration, resolution, and volume. Results play the proxy inline.
- Offline drives stay in the index and are marked offline when the volume is not
  mounted, with the volume label shown so I know which shelf to go to.
- Free-text notes and tags per clip, and a starred collection I can export as a JSON
  or CSV shot list.
- Everything is local: no accounts, no cloud, no telemetry. The SQLite file plus the
  proxies folder is the entire product and both are backupable.
- Out of scope: multi-user access, permissions, cloud storage gateways, and AI tagging.
  Do not build a login system. If a second person needs this, buy iconik.
- README: installing ffmpeg, expected first-scan time for a 20TB volume, and a warning
  to run the proxy pass overnight.

## Delivery standard

- Inspect the repository first, then write a short implementation plan before writing code.
- Deliver the smallest complete end-to-end workflow first; every primary control must work against persisted data.
- Use real validation and storage; never substitute fake dashboards, decorative controls, hard-coded success states, or mock integrations.
- Include responsive layouts plus genuine empty, loading, success, validation, and failure states.
- Keep secrets server-side in environment variables, provide .env.example, and never commit credentials or user data.
- Add structured logs around every external call and return actionable errors without leaking sensitive details.
- Write unit tests for the core logic and one automated test of the main user journey.
- Finish with a README covering setup, architecture, data location, backups, tests, deployment, and known limitations.

## Acceptance criteria

- [ ] A clean install starts the app using only the README and .env.example.
- [ ] The primary journey works from first visit through saved result, reload, edit, export, and deletion where applicable.
- [ ] Invalid input, missing configuration, provider failure, and an empty database each have a usable state.
- [ ] The interface works at 390px and 1440px, is keyboard navigable, and shows visible focus on every control.
- [ ] Tests, type checking, linting, and a production build all pass with no ignored failures.
- [ ] No part of the interface implies a live integration, security guarantee, or scale capability that was not actually built and verified.

## Non-goals

Do not build these, and do not claim to have replaced them:

- Storage gateways that index on-prem NAS, LTO, and cloud buckets as one library.
- Per-user and per-collection permissions with an audit trail.
- Proxy transcoding that keeps up with petabyte ingest.
- Adobe and Resolve panels plus the desktop player.
- Reliability at the vendor's scale is an operations problem, not a prompt.
- Connectors, OAuth flows, and vendor API changes require constant upkeep.

## What you still own after launch

- Run migrations, backups, restores, and dependency updates.
- Test the critical journey after every model, API, or hosting change.
- Monitor failures and fix the edge cases a first prompt will miss.
- Maintain every third-party integration as APIs and OAuth rules change.

## Risk

**Operational risk.** The code is achievable; dependable data, integrations, and ongoing operations are the real cost.

Editorial confidence in this assessment: high. No independent one-shot implementation is linked yet.

## Prior art

Working open-source software you can read, fork, or borrow from before starting:

- [ResourceSpace](https://github.com/resourcespace/resourcespace) — Genuine open-source DAM with metadata, collections, and user permissions. Development lives on the project's own repo, the GitHub copy tracks it
- [Kitsu](https://github.com/cgwire/kitsu) — Open-source production platform with versioned media, review, and per-project access. Closer to a facility tool than a personal catalog

---

Generated by [Can It Be Vibe Coded?](https://www.canitbevibecoded.com) · Full report: https://www.canitbevibecoded.com/iconik