SMM Studio

★ The thinnest end-to-end slice (image → Instagram feed)

• HIGH

  Media storage foundation — Cloudflare R2 (S3 API) + media_asset model

  PREREQUISITE for any media post. A private R2 bucket via the S3 API behind a swappable MediaStorage adapter; a media_asset table (project-scoped: kind, source, status, storage_path, mime, dimensions); upload + short-lived signed URLs at publish & preview. Bytes in R2, a Postgres row points to each file. R2 chosen for zero egress.
  — assignVitalySergey
• HIGH

  AI image generation (OpenAI) → store in R2 → attach to a post

  The fastest visible 'wow'. Wire OpenAI gpt-image-1 behind the credential vault: prompt → generate → download (provider URLs expire) → store in R2 as a media_asset → attach to a post variant; preview via signed URL.
  — assignVitalySergey
• HIGH

  Instagram feed image publish (single image, tester-mode)

  The thin publish path that proves the spine WITHOUT waiting on video: IG container with a public R2 signed image_url → publish → write status + permalink back. Runs in Meta tester-mode (no App Review); the creator needs only a Business/Creator account (no Facebook Page). NOT Reels — a single feed image is the lowest-risk first publish; Reels (video) comes in v1.0.
  — assignVitalySergey
• HIGH

  One creator through it end-to-end + instrument first-value

  Get one real creator (the owner) from idea → generated image → published-to-IG → live, against the live stack. Instrument time-to-first-published-post — the proof the loop works before we widen. Surfaces every real gap (token refresh, signed-URL fetch by Meta, error paths).
  — assignVitalySergey

Foundation · Stage 0 — Clickable prototype

• DONE · 2026-06-08

  Every feature built & clickable on dummy data

  All 13 screens (dashboard, calendar, composer, strategist, approvals, inbox, listening, analytics, reports, projects, connections, settings) running, no backend.
  — assignVitalySergey
• DONE · 2026-06-08

  DataSource seam — the one swap point for going real

  Every screen reads through the DataSource interface in src/lib/data/datasource.ts; never the mock directly. Stage 1 swaps in SupabaseDataSource with zero screen rewrites.
  — assignVitalySergey
• DONE · 2026-06-08

  GitHub → Vercel, behind a temporary login gate

  Cookie + middleware demo gate; auto-deploys on push.
  — assignVitalySergey
• DONE · 2026-06-09

  Public, shareable /roadmap page

  This page. Now on the IP roadmap pattern — % derived from the checklist.
  — assignVitalySergey

Foundation · Stage 1 — Infrastructure & multi-project

• DONE · 2026-06-09

  Rename Brand → Project across the app

  Entity, route (/projects), switcher, nav & storage all renamed; design tokens (bg-brand etc.) left intact. BrandKit kept — a Project has a brand kit.
  — assignVitalySergey
• DONE · 2026-06-09

  Project switcher + create / rename / delete

  CRUD added to the DataSource contract (so SupabaseDataSource mirrors it); topbar + Projects page wired.
  — assignVitalySergey
• DONE · 2026-06-09

  Multi-tenant schema, RLS & seed (written)

  supabase/migrations/0001_init.sql — project_id on every tenant table, project.owner_id; RLS policies written but enabled at the go-public gate (supabase/policies); seed for the demo user + 3 projects.
  — assignVitalySergey
• DONE · 2026-06-09

  Async DataSource seam + SupabaseDataSource

  Seam went async (useQuery hook); SupabaseDataSource backs real projects behind it, mock fallback when no env.
  — assignVitalySergey
• DONE · 2026-06-09

  Live Supabase connected — projects are real

  Schema + seed applied to the Supabase project; app reads/creates/renames/deletes projects against Postgres (verified end-to-end via the UI). RLS deferred; anon-key access granted on `project`.
  — assignVitalySergey
• DONE · 2026-06-09

  Project content live in Supabase

  Accounts, posts (+variants) and approvals are real in Postgres — Dashboard, Calendar, Composer, Connections, Approvals & Analytics run on live data; KPIs/top-posts/metrics derived from real follower counts (synthetic until real metrics land).
  — assignVitalySergey
• DONE · 2026-06-10

  Light / dark theme

  App-shell theming via design tokens: System / Light / Dark in Settings → Appearance + a quick toggle in the topbar. No-flash inline script sets the theme before first paint; choice persists per-browser; charts adapt too. Dark stays the default.
  — assignVitalySergey

Foundation · Stage 2 — Connection & job framework

• DONE · 2026-06-09

  Integration adapter framework + mock adapter

  src/lib/integrations: Connection/Publisher/Metrics adapter interfaces + a registry every platform resolves through + a mock adapter. Adding a network later = one adapter.
  — assignVitalySergey
• DONE · 2026-06-10

  Server-side OAuth + encrypted token vault

  OAuth handshake runs server-side; tokens encrypted (AES-256-GCM) into the vault via the service-role key — never the browser/anon key. Migration 0004 applied; verified end-to-end (ciphertext at rest, decrypts to original, anon read denied).
  — assignVitalySergey
• DONE · 2026-06-09

  Background job/queue layer

  Generic durable queue (job table) + worker that claims due jobs, retries with backoff and dead-letters. Live on Vercel Cron → /api/jobs/run (CRON_SECRET-guarded); verified in production with the mock adapter. This is what the publish + generate-video jobs ride.
  — assignVitalySergey

Foundation · Stage 3 — First real connect (Facebook + Instagram)

• DONE · 2026-06-12

  One-click OAuth connect for Facebook + Instagram

  Live: Facebook and Instagram are independent real connections. Facebook Login connects a Page (in-app picker when an account has several); Instagram Login connects an IG Business/Creator account directly (standalone, no Page — the key enabler for Instagram Reels publish). Tokens encrypted in the vault; CSRF-protected; verified end-to-end against the live DB. (Surfaced & fixed a service_role DML grant gap — migration 0006.)
  — assignVitalySergey

★ Create · AI content — building on the v0.9 skeleton

• IN PROGRESS

  AI copy (Claude) — LIVE; video generation next

  Claude (Anthropic) copy is LIVE: encrypted AI-credential vault + Settings → AI Providers key entry (migration 0005), Composer & AI Strategist generate real per-platform caption variants. Image generation + R2 storage land in v0.9 (the skeleton); video generation is the v1.0 Create focus.
  — assignVitalySergey
• HIGH

  AI video generation (generate_video job) → store in R2 — the differentiator

  The moat — honest generative video for faceless content (the on-camera-anxiety pain). A generate_video job calls the provider (Sora / Veo / Runway / Kling, behind a provider-agnostic adapter), polls until done (self-re-enqueues on the cron), downloads with resumable upload → stores the source MP4 in R2 (reusing the v0.9 MediaStorage). Scoped truthfully: short clips, B-roll/hooks/image-to-video — not a final-cut replacement. v1 publishes the source AS-IS (per-platform transcoding is parked — see backlog).
  — assignVitalySergey

★ Publish · get it live reliably — Instagram Reels first

• HIGH

  Instagram Reels publish (video — extends the v0.9 image path)

  Extends the v0.9 IG feed-image publish to video Reels: media_type=REELS with a public R2 signed video_url → poll status until FINISHED → media_publish → write status + permalink back. Same Meta TESTER-MODE pilot (no App Review); creator needs a Business/Creator account (no Facebook Page — Instagram Login). 100 posts/24h; 60-day token-refresh job.
  — assignVitalySergey
• HIGH

  Facebook Page auto-publish — text/link, photo & video

  Scheduler enqueues due scheduled posts → real Facebook Page publish (text/link via /feed; photo/video + FB Reels via the media flow using R2 signed URLs) → status + live URL written back. Rides the existing job queue (retry/backoff/dead-letter). Cheap alongside IG (shared Meta infra); needs a Page.
  — assignVitalySergey
• HIGH

  Publish reliability — failure visibility + retry / repair

  Promoted from post-launch: silent publish failures + forced reconnections are the #1 trust-killer across every competitor. Show WHY a post failed (token expired, format rejected pre-transcoding, platform error) with a one-click retry/repair; surface expiring tokens before they break the connection.
  — assignVitalySergey

★ Sustain · stay consistent — the retention engine

• HIGH

  One idea → copy + image/video variants → “refill my queue”

  The activation AND retention engine — it hits three journey stages (Plan + Create + Sustain). One idea → Claude copy + a generated image/video per network → one click to fill the calendar. The solo creator's biggest pains are the blank page and keeping the queue full; this is the single highest-leverage flow.
  — assignVitalySergey
• MED

  Consistency engine — reminders, streaks, queue-health

  Retention is the #1 reason solo creators abandon (burnout, habit collapse; most quit within year one). Nudge before the queue runs dry, show a streak, flag gaps in the calendar. Consistency over weeks — not raw frequency — drives the engagement payoff.
  — assignVitalySergey

Measure · what worked — simple, not a report suite

• IN PROGRESS

  Live follower/reach metrics

  Half shipped: an hourly cron (+ a Refresh button) pulls real follower counts (and best-effort 24h reach) for connected FB/IG accounts and writes the live numbers the UI shows. Remaining: verify end-to-end with fresh tokens.
  — assignVitalySergey
• DONE · 2026-06-15

  Simple per-post “what worked” — import IG posts + per-post insights

  Import a connected Instagram account's recent posts + per-post analytics (reach/likes/comments/shares/saves) into the DB via the stored token (migration 0007; read-only, idempotent upsert), then surface them on Analytics: a 'what worked' leaderboard ranked by engagement, engagement-by-format, best-day-to-post, and headline KPIs — real numbers replace the synthetic demo. (Full 24h/7d/30d time-series, UTM attribution and white-label client reports stay agency-grade — deferred to v2.0.)
  — assignVitalySergey

Deferred to the go-public gate

• LOW

  Social inbox (comments & DMs)

  Engagement is real value but it competes with running the business for a solo creator; viable post-MVP. Deferred.
  — assignVitalySergey
• DEEP

  Meta App Review + Business Verification (leave tester-mode)

  Needed to publish for creators NOT added as app testers — i.e. to go beyond the invite-only pilot. instagram_business_content_publish needs Advanced Access (App Review screencast + business verification, ~2–4 wk, often rejected first try). Deferred to the same milestone as self-serve sign-up.
  — assignVitalySergey
• DEEP

  Self-serve sign-up (Clerk) + turn on RLS

  Invite-only manual onboarding for now (the dummy login stays). When we open to public self-serve: replace the login with Clerk (real users) and enable the database RLS already modeled (owner_id / project_id).
  — assignVitalySergey

• HIGH

  Error monitoring + alerting

  Sentry (or similar) on the app and the job/publish layer; know about failures before the creator does.
  — assignVitalySergey
• HIGH

  Onboard the first real solo creators end-to-end

  Connect → generate → schedule → publish → see results for a handful of invited creators (Meta tester-mode); capture the rough edges and first-value speed.
  — assignVitalySergey
• HIGH

  TikTok publishing (2nd network)

  Direct Post API (video.publish). Personal accounts work — no business tier. Needs TikTok's app audit for public posting (~2–6 wk); until then posts are private/self-only. Big video audience; next after Instagram is proven.
  — assignVitalySergey
• MED

  Media lifecycle / garbage collection

  Object stores don't cascade with Postgres FKs: deleting a project must purge its R2 prefix, and generated-but-unused media must be swept so storage cost doesn't grow unbounded. A cleanup job over media_asset.
  — assignVitalySergey
• MED

  Empty-state & first-run guidance for a new creator

  A brand-new account should guide the creator: connect → generate first post → publish, reaching first value in minutes (first-value speed drives 30-day retention).
  — assignVitalySergey

• MED

  YouTube Shorts publishing (3rd network)

  videos.insert upload (no special Shorts API). Upload-only scope is 'sensitive' (no costly CASA audit) but needs OAuth verification + a YouTube compliance audit, and the ~6 uploads/day-per-project quota is a real wall until raised. Lowest priority of the three networks.
  — assignVitalySergey
• MED

  AI & media cost guardrails

  Generation (image/video) and storage meter real money; add monitoring + per-creator quotas/limits so a runaway prompt or heavy video usage can't blow the budget. R2's zero egress helps, but generation + storage still meter.
  — assignVitalySergey
• MED

  Best-time-to-post suggestions from real metrics

  Use the account's real engagement history to recommend calendar slots.
  — assignVitalySergey
• LOW

  Bulk scheduling & CSV import

  Load a month of posts at once.
  — assignVitalySergey

• DEEP

  Agency mode — multiple client brands + team roles

  The original agency vision, deferred until the solo product is proven: manage many client projects with SMM-team vs account-manager vs client roles (who can publish vs approve vs view). The multi-project schema already supports it.
  — assignVitalySergey
• DEEP

  Client approvals + review portal

  Clients review/approve posts and view their dashboards. The approvals screen exists from the prototype but is low-value for a solo creator; it becomes core in the agency phase.
  — assignVitalySergey
• DEEP

  White-label monthly client reports + UTM attribution

  Auto monthly reports tracing posts → reach → clicks → leads, branded per client (the renew-the-contract artifact) plus full 24h/7d/30d time-series. Agency-grade — not the solo MVP.
  — assignVitalySergey
• DEEP

  Billing & plan tiers

  Explicitly OUT of scope until the owner confirms the MVP is complete. Designed only after that.
  — assignVitalySergey
• DEEP

  Paid-ad management / boosting

  Promote top posts from inside the tool. Large external lift per network.
  — assignVitalySergey
• DEEP

  Mobile app / push approvals

  Approve on the go; native push for pending sign-offs.
  — assignVitalySergey

• TECH DEBT

  Per-platform video transcoding / normalization

  v1 publishes the AI source video AS-IS, so clips that don't match a network's spec (codec, aspect, duration, max size for IG Reels / TikTok / YouTube Shorts / FB) will be rejected at publish. Deliberately deferred: add a managed transcoder (AWS MediaConvert / Coconut / Mux) that re-encodes the source media_asset into per-platform renditions (a media_rendition table) which publish then selects. Prioritised once real video volume justifies it.
  — assignVitalySergey
• TECH DEBT

  Video poster/thumbnail generation

  Video needs a poster frame for the UI and some publish flows. v1 uses the provider-supplied thumbnail where available; real frame-extraction (off-Vercel worker / transcoder) comes with the transcoding work above.
  — assignVitalySergey
• PARKED

  Migrate Next middleware → proxy

  Build warns the middleware convention is deprecated in this Next version; switch to the proxy file before launch.
  — assignVitalySergey
• PARKED

  Resolve set-state-in-effect lint warnings

  Several Stage-0 screens hydrate seed data in an effect; tidy when convenient.
  — assignVitalySergey
• PARKED

  Replace dummy-login copy & branding before public launch

  The temporary password gate is demo-only; swap for Clerk (go-public gate) and remove the demo credentials.
  — assignVitalySergey
• PARKED

  Mobile navigation

  The sidebar is desktop-only (hidden below md) with no hamburger/drawer; phones can't navigate. Deferred — desktop-first for now.
  — assignVitalySergey
• PARKED

  Lift muted/faint text contrast to WCAG AA

  --color-faint (#6b7280 on #0f1115) ≈ 3.9:1, below the 4.5:1 needed for normal text; it's used widely for small/secondary copy.
  — assignVitalySergey
• PARKED

  Add aria-labels to icon-only buttons

  Several icon buttons (inbox send, topbar logout, theme toggle) rely on title= or nothing; screen readers announce them with no purpose.
  — assignVitalySergey
• PARKED

  Keyboard alternative for calendar drag-to-reschedule

  Rescheduling is drag-only (WCAG 2.1.1); add a per-post date menu or arrow-key move for keyboard/AT users.
  — assignVitalySergey