Can I vibecode GetWaitlist?

Build a complete, production-ready waitlist and referral management tool like GetWaitlist/LaunchList.

1. PRODUCT BRIEF & ARCHITECTURE
- User & Goal: Founders launching products who need viral waitlist signups.
- Stack: Node.js + Express, SQLite (better-sqlite3), single-process deployment.
- Widget: Zero-dependency embeddable widget.js script for drop-in forms on any page.

2. CORE USER JOURNEYS
- Signup & Position: Visitor submits email (and custom fields) via widget or landing page. Instant confirmation displays line position ('You are #247') and personal referral link (?ref=CODE).
- Referral Loop: User shares link. When friends join via ref=CODE, referrer moves up 5 spots.
- Automated Email: Instant confirmation email with referral link and position updates.

3. DATA MODEL (SQLite)
- Waitlist: id, name, created_at
- Entry: id, waitlist_id, email (unique), referral_code (unique slug), referred_by, position, status ('pending'|'invited'|'archived'), custom_fields (JSON), ip_address, created_at
- EmailLog: id, entry_id, template ('confirmation'|'position_update'|'invite'), status ('queued'|'sent'|'failed'), error_message, sent_at

4. REFERRAL MECHANICS & FRAUD PREVENTION
- Position Recalculation: Atomic calculation inside SQLite transaction: position = Max(1, base_position - (referral_count * 5)).
- Fraud Prevention: Block self-referral (no matching referral_code), same-IP detection within 1h, honeypot field.

5. SCREENS & UI
- Embeddable Widget: Drop-in form with copyable referral link state.
- Public Signup Page: Standalone landing page with position tracking.
- Admin Dashboard: Auth via Basic HTTP (.env). Live search, filter by status, bulk invite (move to 'invited'), CSV export, inline SVG growth sparkline.
- Referral Leaderboard: Top 10 referrers ranking table.

6. EMAIL & INTEGRATIONS
- SMTP integration via .env config. Queue failed sends in EmailLog for retry.
- Webhook: Send HTTP POST payload to WEBHOOK_URL on new signup.

7. SECURITY & NON-GOALS
- Security: Rate-limit signups (max 5/IP/15m), strict email validation, deduplicate entries.
- Non-goals: Payments, multi-tenant team management, complex drip sequences.