Short.io

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me a branded link service that replaces Short.io: short links on my own domains, several team members, and numbers I can defend.

STACK
- Node 20+ with Fastify, SQLite through better-sqlite3, WAL mode
- Caddy in front with on-demand TLS, so a new branded domain works minutes after its DNS points here
- One process. The redirect must answer in single-digit milliseconds

THE DATA MODEL
- domains: id, host, is_default, verified_at, created_by — many domains, one install
- links: id, domain_id, slug, destination, title, tags_json, created_by, created_at, expires_at, max_clicks, password_hash, is_archived, utm_json
- link_versions: id, link_id, destination, changed_by, changed_at — a destination change is appended, never overwritten
- clicks: id, link_id, created_at, referrer_host, referrer_url, country, device, browser, os, ip_hash, bot, is_unique
- rules: id, link_id, kind, match_value, destination — send iOS here, Germany there, and everybody else to the default
- users, teams, memberships, api_tokens with scopes and a last_used_at
- Unique on (domain_id, slug). A slug is unique per domain, not globally

THE REDIRECT
- One prepared statement, one lookup, one 301 or 302 — permanent links get 301 and the interface warns that a 301 can never be re-pointed for anyone who has already followed it
- Rules evaluated in order: country, device, language, then default. The rule that matched is recorded with the click
- UTM parameters merged into the destination: the link's own tags, overridden by anything already on the destination
- Expired, archived or over its click limit answers 410 with a page that says which
- The click is written after the response has been sent
- Unknown slug: a 404 page on that domain, never a redirect to the homepage

TEAMS
- A link belongs to a team; a person can be in several
- Roles: owner, editor, viewer. A viewer sees numbers and cannot change a destination
- Every change carries who made it, and the link's page shows the history
- API tokens are scoped to a team and can be read-only

BULK WORK, WHICH IS WHY PEOPLE PAY FOR THIS
- Import a CSV of destination, slug, title and tags; report the rows that failed and why, import the rest
- Generate N links from a template with a counter or a random slug
- Bulk edit tags, bulk archive, bulk export
- A public API that does everything the interface does, with real status codes and a Retry-After on rate limits

THE NUMBERS
- Clicks and unique visitors per link, per domain, per tag, per day
- A unique visitor is a distinct salted hash of address and user agent inside the window, and the page says so beside the number
- Referrers with host and full URL, countries from a local database file, devices and browsers as coarse buckets
- Bots recorded with a flag and excluded from published figures — and a switch to see them, because 'was that campaign real' is a question worth answering
- Export any view to CSV; a JSON feed per link

QR CODES
- Generated locally, no third-party service, as SVG and PNG
- The QR encodes the short link, so the destination can change after the poster is printed — say that in the interface, because it is the reason to use one

THE INTERFACE
- A table of links: slug, destination, clicks, created, last click. Sortable, searchable, readable on a phone
- Creating a link is one field and a button; everything else is optional
- Copy button on every row
- Dark and light, one accent

OPERATIONS
- .env: DATABASE_PATH, HASH_SALT, SESSION_SECRET, GEOIP_DB_PATH, BASE_DOMAIN
- Migrations on boot, each once
- Caddy's on-demand TLS restricted to verified domains, or somebody will point their DNS at you and get a certificate
- Nightly backup off the machine, restore script tested
- Health endpoint that resolves one link

WHAT MATTERS MOST
The redirect path and multi-domain TLS. Write the redirect first, load-test it at ten thousand requests, then add the second domain — everything else is a table. A link service that is slow or occasionally wrong destroys the campaigns it was bought to measure.

Give me the repository, migrations, the Caddy configuration for on-demand certificates, .env.example, a seed with two domains, and a README with deploy steps.