Can I vibecode Dropbox Transfer?

You are building a production-ready software product named “Parcel”, a deliberately focused alternative to Dropbox Transfer. Build a complete, usable vertical slice—not a landing page, static mockup, or disconnected collection of components.

WORKING AGREEMENT
Before writing implementation code, produce a short technical plan that names the routes or pages, server actions or endpoints, data tables, important state transitions, authorization boundaries, background jobs, and external adapters. Resolve contradictions in favor of the narrow audience and non-goals below. Prefer a small, legible architecture over speculative abstraction, but do not omit persistence, validation, error handling, or tests.

PRODUCT BRIEF
Primary user: a studio sending large deliverables to clients.
Primary outcome: package files behind a branded, expiring download link.
Product principle: optimize the exact workflow below instead of copying the full breadth of Dropbox Transfer. A first-time user should understand what to do from the interface itself, without a tour or documentation.

END-TO-END USER JOURNEYS
Implement all of these flows through the real interface and persistent data layer:
1. A studio user creates a transfer, selects several deliverable files, sees per-file validation and upload progress, adds a client message, expiry, passcode, and branding, then publishes it.
2. A recipient opens the transfer link, passes the access gate, reviews filenames and sizes, downloads one file or the complete package, and sees an expired-link explanation when appropriate.
3. The sender reviews download activity, copies or emails the link, extends an eligible expiry, manually revokes access, and confirms that stored files are later removed.

SCREENS AND INFORMATION ARCHITECTURE
Build these as coherent responsive views. Each screen must specify its primary action, secondary actions, visible status, validation feedback, empty state, loading or pending state, success confirmation, and recoverable failure state.
1. Transfer composer: transfer name, message, branding preview, expiry picker, optional passcode, multi-file drop zone, per-file progress, total size, and publish readiness.
2. Transfer dashboard: active, expired, revoked, and upload-failed states with recipient link, file count, expiry, download count, last activity, revoke, and duplicate actions.
3. Recipient download page: brand, sender message, access gate, file names and sizes, individual and download-all actions, progress, and clear expired or revoked states.
4. Transfer detail: file inventory, creation and expiry metadata, download-event timeline, link-copy and email actions, expiry extension, revoke confirmation, and cleanup status.

CORE CAPABILITIES
1. multi-file upload with progress and size validation
2. transfer name, optional message, expiry date, and passcode
3. branded recipient download page
4. download count and last-downloaded timestamp
5. manual revoke and automatic expiry cleanup

DETAILED BEHAVIOR AND BUSINESS RULES
Treat these as server-enforced product requirements, not interface suggestions:
1. Enforce per-file, total-transfer, and allowed-file limits before upload completion; incomplete uploads never produce an active recipient link.
2. Hash passcodes with a slow password hash, rate-limit failed attempts, and issue a short-lived transfer-scoped access session after successful verification.
3. Keep R2 objects private and issue short-lived signed downloads only for active transfers; revoke and expiry checks occur before every new file URL.
4. Model draft, uploading, active, expired, revoked, and deleted states explicitly; cleanup jobs are idempotent and retain only minimal non-file audit metadata.

DATA MODEL AND LIFECYCLE
Design a small relational schema centered on Transfer, TransferFile, DownloadEvent. Before implementing it, document:
1. Each table’s purpose, primary key, ownership or tenant boundary, timestamps, status fields, and important attributes.
2. Foreign keys, uniquen...