# Post-alpha backlog (Seaside Sanctuary)

This document tracks work described in **your local PRDs** (under `PRDs/`, not committed) that is **out of scope** for the static alpha. It is not a commitment order; prioritize by risk and value.

## Phase B - Secure media ingestion

Source: typical PRD themes (secure ingestion pipeline).

- Server-side upload endpoint (e.g. Nitro/Node) with temporary buffer storage.
- Extract GPS, `DateTimeOriginal`, camera make/model using `sharp` / `exif-reader` (or equivalent).
- Persist rich metadata in a private database; store only **scrubbed** images in public object storage (Cloudflare Images / R2).
- Re-encode or strip metadata so public files have **no** EXIF/IPTC/XMP (validate with external tools).
- Admin “Privacy Summary” UI after upload; optional “keep metadata” override (default off).
- Async/worker processing for bulk uploads so the admin UI stays responsive.
- Automated collection tagging from GPS polygons (e.g. Encinitas / garden / beachhouse regions).

**Acceptance targets:** Public downloads show no location metadata; admin shows exact stored time/location from DB.

## Phase C - Pluggable AI vision and tagging

Source: typical PRD themes (AI vision layer).

- `VisionProvider` interface with `analyzeImage(buffer)` (or similar).
- Implementations: e.g. Google Gemini Vision, OpenAI multimodal, **Ollama** (local), optional niche classifiers (BirdNET, etc.).
- Config UI: provider selection, API keys / base URLs, tunable system prompt; persist settings (e.g. Pinia + server-side secrets for production).
- After scrubbing, run analysis on the clean buffer; map results to the shared taxonomy schema (`Common Name`, `Scientific Name`, confidence, suggested tags).
- Confirmation step with chips (Meyer Lemon Gold for high confidence, softer styling for low).
- Graceful fallback to manual tagging when a provider is unreachable.
- Optional batch queue for many files.

**Acceptance targets:** Hot-swap providers without restart; consistent DB schema; resilient errors.

## Phase D - Operations and routing

Source: typical PRD themes (routing / ops).

- **Public origin:** Cloudflare Pages or Vercel for the gallery (current alpha is static-ready).
- **Internal origin:** Home lab via **Cloudflare Tunnel** (Proxmox/Docker) for admin/automation.
- **Edge routing:** Worker or WAF rules using `CF-Connecting-IP` - e.g. home IP → `admin.*` or internal tunnel; everyone else → public gallery only.
- TLS hostnames, secrets, and rate limits for upload endpoints.

## Phase E - Asset pipeline at scale

- Cloudflare Images (or R2 + Workers) for variants: WebP/AVIF, responsive widths, blur placeholders generated at the edge or build time.
- Optional BlurHash generation in ingestion for smaller manifest payloads.

---

When Phase B exists, replace or generate the gallery manifest (`src/data/gallery.defaults.json`, or your gitignored `src/data/gallery.json` override) from the database or export job; the `GalleryAsset` shape in `src/types/gallery.ts` is the contract to preserve.