Membership platform for creators
Sovereign Creator
A membership platform for creators who want their audience off YouTube and their work out from under someone else’s content policy. Fans pay one set price to join, the creator keeps more of what their audience pays, and the connection is direct and honest — no algorithm deciding who sees it, no recommendation system rationing what may be said, just the people who chose you. It carries its own object storage and its own player instead of an embedded third-party host, because if a third-party platform hosts your media, that platform’s content rules and takedown decisions govern your business. Holding the storage layer is the only way to own the audience, the storage and the terms.
Nothing here is open to the public yet: there is no hosted sign-in, no account a visitor can create, no playback a visitor can request, and payments are simulated. The pages describe and demonstrate; they do not grant. Underneath, it is Next.js 15 and React 19 on Node with a SQLite catalogue and media on a local disk or in any S3-compatible bucket behind one interface.
- One set membership price
- No algorithm in the middle
- Creators keep more
- Direct creator to fan
The interface is demonstrated as a self-contained static build. It runs entirely in the browser: no server, no network, no accounts, no playback and no data of its own. Every entry in it is illustrative demonstration metadata, and the rights values on those entries are placeholders rather than clearance records.
/demo/, captured from this directory in headless Chrome. The view shown is the catalogue, which is the second model; creator pages are the primary one. It is a static build with no server behind it.How it works
One membership, one storage layer, one place to publish
Creator pages are the primary model. A creator publishes posts on their own page and sets a monthly price for each tier. A fan picks a tier, pays that price and can cancel; the tier rank decides which posts are included. A catalogue is the second model: the same tier gate over a browsable set of entries, with a rights record for the case where a creator carries work they did not make. Both share one security core.
A post is gated by the tier a fan buys
A creator writes a post, attaches media and sets the lowest tier allowed to see it, or publishes it to everyone. A locked post keeps its title and artwork so the page stays browsable, but its body is never sent to a viewer who is not entitled. Where a creator carries work they did not make, the entry also carries a rights record: status, holder, territory and expiry.
The client never holds a durable media address
Every image and video element points at the platform's own media route, which re-checks entitlement at fetch time and only then mints an address that expires. A render-time check alone would be defeated by a cached page render, or by a membership lapsing between the render and the fetch.
Four questions, decided separately
May this viewer watch it, may the platform offer it here and now, has this viewer confirmed they are old enough for it, and how many streams does the account hold. Each is its own pure function with its own reason, and playback requires all four. Collapsing them would mean a licence expiry and a lapsed membership produced the same denial.
The access model
Four gates, four separate decisions
Three of the four refusals are deliberately indistinguishable from a missing entry. The exception is concurrency, which is the one condition a viewer can actually fix, so hiding it would just look like a broken player.
Entitlement 404
Decided by a pure function with no database, no network and no clock of its own — everything it needs is passed in. Membership, tier rank and draft state are the inputs; the single bridge from the database to that function is one file long, so the complete set of rules that grant access is two files long. The rank comparison is written to fail closed, so a non-finite rank cannot slip through a text column.
Availability 404
The pre-curated case: when a creator carries work they did not make, this is the gate that stops the platform offering something it has no right to. Rights status, licence term, scheduling window and licence territory, decided separately from entitlement so a licence expiry and a lapsed membership do not produce the same denial. Unlicensed material is refused unconditionally and is not governed by any configuration flag. An unknown region fails closed for a title whose licence names territories.
Age 404
R is the platform's ceiling, so this is a confirmation rather than an identity check: an R-rated entry asks the viewer to confirm they are 18 or older. The record stores a verdict and a timestamp and has nowhere to put a name, a date of birth or a document number, and the page says plainly that it is a self-declaration rather than statutory age verification.
Concurrency 409
Two simultaneous streams per account by default. A playback session is a cookie and a limited sharer can rotate it, so this raises the cost of sharing rather than preventing it. Sessions expire by going quiet, so a closed tab frees its slot within a heartbeat window instead of holding it forever.
What is different
The parts that carry the weight
Each of these is something in the repository you can read in the source tree: a threshold, a route, a signature, or a component that is deliberately absent.
The signature covers the key and the expiry
Media addresses are signed with an HMAC over the object key and the expiry together, so neither can be swapped for another entry's key or extended by editing the address. Object keys are validated against a strict character set and then containment-checked after resolution.
A manifest is never served raw
An HLS manifest is a plain-text list of addresses, so handing a player the stored file would teach it every segment key and leave the paywall guarding only the manifest. Nested playlists are rewritten to route back through the same gated endpoint, segment and key references become short-lived signed addresses, and a crafted manifest cannot reach another entry's prefix.
Withheld means removed, not greyed out
An entry the platform may not offer is omitted from the grid, the collections, the watchlist and the detail page; its artwork, stream and captions return the same not-found as a missing entry too, because a subtitle file is a transcript of the work. Posters stay public for entries that are offerable but unaffordable, or the grid would be unbrowsable. That line is asserted end to end.
When work is licensed, the audience sees the label
Entries read Owned, Licensed, Public domain, Rights unclear or Not cleared, and the full record is shown to the operator. A viewer looking at licensed work can see where it came from, and an operator cannot forget what they are carrying. This serves the licensed second model; a creator’s own posts simply read Owned.
Nothing stands between the post and the fan
A post is public, or gated to the tier that pays for it, and nothing else decides who sees it. Posts appear in the order they are published: no ranking, no recommendation, no model choosing whose work travels. R is the content ceiling — mature work asks the viewer to confirm they are 18 or older.
The storage layer is a seam, not a dependency
The local disk driver and the S3-compatible driver sit behind one interface, and the entitlement code path above them is identical either way. The bucket stays private in both cases; a short-lived signed address is the only way in.
Withheld content never reaches the render layer
A locked entry is projected through a view whose body is empty unless the viewer is entitled, so the text is never a component property at all. The repository holds a regression test for this, because the first version was correct on screen while the locked text sat in the page source.
The numbers
Counted from the repository, not rounded up
Every figure below is stated in the product's own README, seed script or configuration defaults.
Under the hood
What it is built from
- Stack
- Next.js 15 route handlers and React 19 server components on Node, in TypeScript, managed with pnpm. The delivered site you are reading is plain HTML and CSS with no framework at all.
- Surfaces
- A creator studio where posts are written, media uploaded and tier prices set, and per-creator pages in front of it. Then the second model: a catalogue and search at
/browse, per-entry pages, curated collections, a watchlist, an operator console for records, artwork, video, rights and the clearance queue, a public notice intake and an age step. - Storage
- Local disk by default, or any S3-compatible bucket: Cloudflare R2, Backblaze B2, Amazon S3 or MinIO. The bucket is private; a presigned address is the only way in, and a lifecycle rule is recommended to expire orphaned objects.
- Data
- A SQLite catalogue holding creators, tiers and their prices, memberships, posts, artwork and video assets, captions, content records and rights fields, notices and an audit log. A backup command takes a consistent snapshot plus a rights, notices and audit manifest.
- Payments
- Simulated. No card is collected, no processor is integrated and no money moves. The join and cancel endpoints are shaped so that only the writer of a membership row would change when a real acquirer is chosen.
- Accounts
- Email and password, hashed with scrypt, behind signed stateless session cookies. There is no email verification and no password reset, because both need a mail provider.
- Delivery
- Byte-range seeking, resume position and a watchlist. Multi-rendition playback by rewriting manifests; captions are WebVTT served through the entitlement gate. No DRM and no adaptive packaging are built in.
- Tested by
- The 287 unit tests and 177 end-to-end checks above, run against both a development server and a production build. The end-to-end suite drives real cookies, byte ranges, forged signatures, extended expiries, swapped object keys, path traversal and the not-found policy.
- Blocked on
- Three things before real content could sit behind it: the payment path, which is a business decision rather than a build one; a real age-assurance step for mature work, since the current method is a self-declaration; and a moderation pipeline with hash matching, a reporting path and a human review queue.
Status
Where this stands
- There is no public access to Sovereign Creator. This page is a description and a status report, and the demonstration at
/demo/is a static build. There is no hosted instance to sign in to, no account you can create here, no stream you can request from this site, and no payment path that takes money. - The software is built and covered by its own tests. Creator pages, creator-set tier prices, memberships, tier gating, signed-URL playback with byte-range seeking, posts and uploads, collections, search and filters, rights tracking, the operator console and the notice workflow are all implemented in the repository, and both test suites pass against a production build.
- Payments are simulated. Any signed-in user can grant themselves the top tier for nothing. That is the documented point of the stub and also the reason nothing of value should be gated behind this build until a signature-verified webhook replaces it.
- What a creator keeps is not fixed by this build. There is no platform-fee code and no processor, so no rate can be quoted yet. The intent is that the creator keeps more of what their audience pays; the number depends on the acquirer chosen and is not set here.
- The demonstration catalogue is not a clearance record. The entries are illustrative metadata chosen so that browsing and filtering have something meaningful to show, but the rights values on them are placeholders chosen to exercise every branch of the rights dashboard, and the video files are generated placeholders rather than real works.
- The age step is a self-declaration and says so. The gate, the storage, the redirect and the fail-closed behaviour all work, but the method is a confirmation, not an identity check, and the page states that rather than implying otherwise. Wiring a real age-assurance vendor changes only where the verdict comes from.
- Its own known gaps are documented rather than hidden: no DRM, no adaptive streaming, no content moderation pipeline, rate limiting that is database-backed but per-host, uploads buffered in memory, and a session model with no per-device revocation.
What this is not
Limits stated plainly
- Not a discovery engine, and not an audience of its own. There is no recommendation system and no feed ranking, so nothing here brings a creator viewers they did not bring. The fans who arrive are the ones a creator sends, and nobody in between decides who sees the work.
- Not a licence to publish anything. The rights fields are bookkeeping, not clearance. Where a creator carries work they did not make, a self-curated catalogue cannot reach the user-generated-content safe harbour, because there is no user whose direction is being followed.
- Not DRM and not anti-piracy. Any scheme that lets a browser play a video lets that browser capture it. The concurrency limit and the signed addresses raise the cost of sharing; they do not prevent it, and a session is only a cookie.
- Not geoblocking. Territory enforcement reads country headers that are client-controlled, so it is only meaningful behind an edge that overwrites them, and no header check defeats a virtual private network. It is accurate bookkeeping.
- Not a compliance posture. Nothing here is legal advice. The rights fields record what a creator can substantiate; they are not a clearance service, and they do not settle who is responsible for what a member uploads or a creator publishes.
- Not a money flow yet. No processor is integrated anywhere in the tree, so the join and cancel endpoints move no money, and picking an acquirer is a decision that precedes any deployment.
Questions about Sovereign Creator
This page is the product description; the codebase behind it is called PatronLite. If you are a creator, tell us what you would need from a page you own: how you set your price, what you post, how your fans reach it. If you are reading the build, tell us what broke or what you expected instead. The feedback form is on the studio’s main site, since this address is only the product page.