domain-reference

Documents third-party service behavior for Auth0, bunny.net, Redis, and Resend in this repository.

Updated Jul 3, 2026
One-click install
npx skills add https://github.com/MarineTeam/fable-video --skill domain-reference-marineteam
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: domain-reference
Source: https://github.com/MarineTeam/fable-video/tree/main/.claude/skills/domain-reference
Command: npx skills add https://github.com/MarineTeam/fable-video --skill domain-reference-marineteam

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Engineers working on the Marine Video Portal repeatedly need to know how Auth0 v4, bunny.net Stream, Upstash Redis, Resend, TUS uploads, and player.js actually behave in this specific codebase — signature formulas, status codes, Redis key shapes, and route maps — without relearning each service from generic documentation. ## Core Features & Use Cases - Service behavior reference: Documents Auth0 v4 session handling, rolling sessions, route mounting, and the v3-to-v4 migration traps as they apply to this repo. - bunny.net integration details: Covers the three API keys, three SHA-256 signature formulas (embed token, TUS upload, thumbnail), video status code mapping, and the end-to-end TUS upload flow. - Redis key inventory: Lists every namespaced key, its type, writers, readers, and TTL behavior for the Upstash REST client. - Use Case: When modifying the watch page and wondering why the embed URL uses SHA-256 over a concatenated string, consult this skill to learn the exact formula, TTL, and why CodeQL flags it as a false positive. ## Quick Start Ask how a specific third-party service behaves in this repository, such as how the bunny.net embed token is generated or what a Redis key holds.

Frequently Asked Questions about domain-reference

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How does the bunny.net embed token signature work in this repo?

The embed token is SHA-256 over the concatenated string BUNNY_TOKEN_AUTH_KEY + videoId + expires, hex-encoded, with a 3-hour TTL. It is generated fresh per request by signEmbedUrl() in lib/bunny.js and never stored.

How does Auth0 v4 session handling work in a Next.js Pages Router app?

This app uses a zero-config Auth0Client from @auth0/nextjs-auth0/server, with auth routes mounted at /auth/* via middleware. Sessions are rolling, refreshed on every request that passes through the broad proxy.js matcher, and identity decisions rely only on the normalized session email.

What Redis keys does the Marine Video Portal use?

All keys are namespaced under fablevideo: and include settings, viewers, roles, groups, schedule, chapters, notes, transcripts, progress, mylist, ratings, and share records. Most keys have no TTL; only share links and rate-limit counters expire.

Why does CodeQL flag the SHA-256 signing code as weak password hashing?

CodeQL flags the SHA-256 digests in lib/bunny.js because they resemble password hashing, but they are per-request authorization tokens for bunny.net embed, TUS, and thumbnail URLs. This is a documented false positive with an accepted-risk record.

When should I not use this domain reference skill?

Do not use it for change-control decisions, architecture invariants, security incident response, dependency upgrades, runtime debugging, deployments, or test writing. It only answers how third-party services behave in this codebase.

Does bunny.net Stream support audio-only or MP3 output for a podcast feed?

No, bunny.net Stream has no audio-only or MP3 rendition. It stores HLS playlists, optional MP4 fallbacks at fixed heights, thumbnails, and captions, so podcast feed episodes are video files rather than audio.