11 — ROADMAP — Phased Vertical Slices

Depends on: 10_DEPLOYMENT.md · Next: 12_AI_WORKFLOW.md

Every phase ends with a fully usable product. No phase closes until its gates in 09_TESTING.md are green and PROJECT_MEMORY.md updated.

Phase 0 — Foundation (2-3 days)

Goal: Skeleton that builds, lints, and deploys.

pnpm workspace + pnpm-workspace.yaml catalogs + .npmrc strict
Next.js 16 app shell (marketing + dashboard layout) + packages/ui tokens
Prisma + MariaDB connection + initial migration
Nginx + Docker compose dev
PROJECT_MEMORY.md initialized, 00–14 docs committed

Exit gate: pnpm -r build green, healthz returns ok, PROJECT_MEMORY P0 filled.

Phase 1 — Core Platform ⭐ THIS DELIVERY (5 Features Fully)

Goal: Shippable yas.sh with 5 end-to-end features + 5 blogs + full API docs.

Fully implemented (UI + API + DB + tests + docs):

Links — Shorten (POST /v1/links, list, get) + custom alias + validation
Redirect Engine (GET /:code 302, expiry check, bot-filter, click count)
QR Code (GET /v1/qr PNG/SVG, static, uses same link)
Analytics — Overview (GET /v1/analytics/overview, per-link, country/device/referrer)
Auth + API Keys (/v1/auth/*, sessions __Host-session, yas_live_ keys, scopes)

Also ships (shell quality):

Design system fully themed (Linear/Vercel level), dark/light, marketing pages (/, /pricing, /features, /security), dashboard shell
5 production blogs (see 07_BLOG_SYSTEM.md) + sitemap/robots/rss/JSON-LD
OpenAPI 3.1 + Stripe-like /docs with curl/JS/TS/Python/PHP/Go for all endpoints (5 executable, 145 stubbed as 501)
Security headers, rate limiting, grep gates, smoke scripts

Exit gate: 5-feature e2e shorten→redirect→analytics green + 5 blogs render + OpenAPI contract green + scripts/smoke.sh 8/8.

Phase 2 — Auth & Teams Expansion (10 features total)

Add fully: 6. Editable links + version history 7. Bulk create (100) + CSV export/import 8. Folders + Tags + search/filter/sort 9. Password-protected links 10. Expiration (datetime + click-count) + deactivation

Also: Teams/workspaces, RBAC (Owner/Admin/Member/Viewer), invite flow, audit logs

Blogs: +10 (total 15)

Phase 3 — Free Plan Complete (50 FREE features)

Goal: Free tier is genuinely usable, not crippled.

Add to reach 50 FREE (see 14_PRODUCT_SPECIFICATION.md FREE list):

Link history, duplicate detection, link notes, archiving, favicon preview
Device/browser/OS breakdowns, referrer, campaign/UTM builder (basic)
Branded link preview (without custom domain TLS)
Public share pages, expiration emails, click alerts
Search (full-text), 15 tools placeholders become functional stubs
Blog to 30 articles, docs expanded

Pricing: Free plan limits in plans.ts: 50 links, 1k clicks/mo, 1 API key, community support

Phase 4 — Paid Plans (100 PAID features)

Starter (35 features) → Pro (50) → Business (75) → Enterprise (150)

Add 100 PAID (grouped):

Teams & Enterprise: SSO (OAuth), 2FA TOTP, IP allowlist, custom roles, SAML stub
Domains: Custom domains + DNS verification + on-demand TLS (ACME)
Advanced QR: Dynamic QR (editable destination), logo overlay, analytics per QR, bulk QR
Analytics Pro: City, UTM/campaign, conversion tracking, webhooks, exports (PDF/CSV), scheduled reports, bot filtering toggle
Bulk & API: 10k bulk, CSV import with error report, webhooks, 10 API keys, higher rate limits
Admin & Abuse: Admin panel, abuse queue, kill-switch, security event logs
Bio Pages: Link-in-bio builder (module)
Tools (20): Password generator, UTM builder, base64, uuid, markdown, hash, slug, color, json, regex, etc. — each as modules/tools/*
Billing: Stripe adapter, plans, limits enforcement, invoices, webhooks idempotent, proration
Content: Blog to 50, resources, templates, integrations, changelog
Scale: Valkey for cache/queue, pg-boss jobs, daily rollup analytics_daily, Meilisearch optional

Phase 5 — Optimization & Hardening

k6 1000 RPS sustained (p95 <100ms redirect, <400ms dashboard at 100 concurrent)
Lighthouse: Perf ≥90, A11y ≥95, Best Practices ≥95, SEO 100
ZAP baseline 0 high/medium, semgrep 0 high, trivy 0 fixable high, SBOM
MariaDB tuning, read replica guidance, CDN proxied via yas.sh (no dedicated cdn.yas.sh)

Phase 6 — Migration & Launch

V1 import script (dry-run + row-count + checksum)
Oracle Linux 9 prod deploy + restore drill (RTO ≤1h)
DNS cutover + rollback plan
yas-enterprise-v3-production.zip delivered

Feature Counting

50 FREE: 14_PRODUCT_SPECIFICATION.md §FREE — Phase 1 ships 5, Phase 3 completes 50
100 PAID: 14_PRODUCT_SPECIFICATION.md §PAID — Phase 4 delivers in Starter→Enterprise order
Docs & Blogs: Every feature has docs entry + blog cross-link where relevant

Next: 12_AI_WORKFLOW.md — how AI executes phases.

11_ROADMAP